Seal's only pre-release design review came from the agent that wrote much of its code

The countdown is a signed record, and Seal has no cryptographic time lock ^[17]. The 90 days of silence, the 21 days of warnings and the 14-day quiet period are enforced by records that participating devices check, not by a key nobody can derive early ^[17][3]. The one pre-release design review found the flaw that structure invites: a key holder could have backdated a claim and skipped the warning period ^[13]. A second flaw could have let one recipient read newly sealed envelopes early after an earlier release, and Page says both were fixed in the submitted build ^[13].

Under the defaults, the earliest a release can happen is 125 days after the owner's last check-in ^[20]. Thirty-five of those days belong to the owner, who can end the process with one tap if he is alive and can still open the app ^[21][3]. Two of three key holders have to act, so one impatient key holder cannot start the clock, and two acting together can ^[3]. Rules are set per envelope, so urgent medical instructions can open sooner than the rest ^[4].

Authorising a release and reading one are separate powers in the published design. The estate key is split among the key holders with Shamir secret sharing, each recipient gets their own encrypted key table, and after the shares are combined a recipient still needs the key bound to their own device ^[7]. Content encryption is AES-256-GCM, device keys sit in Apple's Secure Enclave, identity runs on WebAuthn credentials, and X25519 wraps keys, with ML-KEM-768 available on devices running iOS 26 ^[8]. The app requires iOS 18 or later, and there is no Android version ^[9].

The published limits say there is no reproducible build process ^[15]. A reader can check the design in the public repository without being able to show that the binary Apple ships was built from it ^[1]. One documented security test suite is not registered to run, and most other tests execute inside debug builds that Page watches himself ^[16].

Seal's documentation credits Claude Fable 5.1 with much of the code and with the only pre-release design review, and the agent is co-author on the App Store submission commit ^[12]. Page makes the point himself, repeatedly: an agent reviewing code it helped produce is not independent scrutiny ^[14].

The gap Seal aims at is narrow. Apple's Legacy Contact can hand a designated person photos, messages, notes, files and backups after the account holder dies, and Apple excludes iCloud Keychain data, including passwords and passkeys ^[10]. Seal's setup requires participants to exchange identity information in person, where each phone pins the public key presented and rejects later substitutions ^[11]. Page is building it alone in Portland, and his App Store catalog otherwise holds a word game, a recipe app, a habit blocker and several small games ^[18]. He plans to charge once with no subscription, and the price has not been published ^[5].