Opening the vault is a timed challenge-response. The formula is public; the clock is the obstacle.
key = SHA256( shard[0] + shard[1] + ... + shard[N-1] ) code = HMAC_SHA256(key, nonce) # hex
Endpoints:
GET /vault/info — N, window, exact formulaGET /vault/shard?i=K — one shard valueGET /vault/challenge — a nonce that expires fastPOST /vault/open — {nonce, code} → flag if correct and in timeYou will not beat the timer by hand. Script it.