aere-quantum/README.md

Aere Quantum

Self-hosted post-quantum infrastructure from Aere Network. Each component is a few files with no dependencies: Node.js 24 and the OpenSSL 3.5 it ships with (node:crypto), nothing from a package registry. The two exceptions need ethers: the notarization command of the verification layer, and the agents' x402 wallet (EIP-712 and secp256k1).

component	what it does
pq-gateway/	a TLS 1.3 terminating proxy in front of any HTTP service, with the hybrid key exchange X25519MLKEM768: hybrid-only refuses a classical client at the handshake, hybrid-preferred keeps it working; optional client authentication with ML-DSA certificates
pq-kms/	a transit-style key management service where every key is hybrid: X25519 + ML-KEM-768 for encryption, Ed25519 + ML-DSA-65 for signatures (both halves required); versions, rotation, rewrap, data keys, a chained audit log; the root key from the environment or sealed by an HSM through PKCS#11
pq-pki/	a private certificate authority for ML-DSA (X.509 v3, RFC 9881): root and issuing CAs, leaf certificates, revocation lists, and a strict chain verifier compared against OpenSSL
crypto-inventory/	a cryptographic inventory of source code (JavaScript/TypeScript, Python, Java, Go, PEM blocks, dependency manifests): every use classified by its exposure to a quantum computer, with a migration target, written as a CycloneDX 1.6 CBOM; nothing from the scanned tree is executed, and its cost stays linear on input built to be slow
verify-layer/	an audit-log sidecar for any deployment: entries are AIP-23 envelopes in a hash chain, the runtime adapter records every running Docker or Kubernetes container without any secret value, and the head of the chain can be signed by the operator (ML-DSA-65) and notarized on Aere Network for post-quantum finality; it says plainly what that proves (the history before a published head) and what it does not (that the host told the truth); the same log as a Merkle tree (RFC 9162): signed tree heads, and inclusion and consistency proofs of a few hashes that anyone checks without the log
proof-kinds/	the AIP-23 envelope builder the verification layer uses: fourteen proof kinds, one envelope format, digests instead of raw content
readiness/	the post-quantum readiness scanner of a public hostname: real TLS handshakes (hybrid only, hybrid preferred, TLS 1.2), HSTS, the certificate; no connection to an address not proven public; a rate limit per client that X-Forwarded-For cannot bypass
control-plane/	from findings to a finished migration: a prioritized plan from the inventory and the scanner, its execution through the gateway, KMS and PKI with consent per action and a measured proof afterwards, recipes for the servers the products do not touch and a rescan that judges them, a compliance report against NIST IR 8547, the EU roadmap and optionally CNSA 2.0, and a console that checks it all again
agents/	limits an AI agent cannot break unseen: a post-quantum identity (ML-DSA-65), a policy (spending per time window, allowed tools and recipients, which actions need human approval), a signed ledger of every action judged against the policy, approvals and revocation signed by people, and a verifier that re-runs the policy over the whole ledger without trusting the agent; two branches of one ledger are a proof of equivocation anyone can check; and a wallet that pays over x402 only what the agent's ledger records and its policy allows, either holding the payment key for the owner or co-signing from a 2-of-2 contract wallet that neither the agent nor the owner can spend alone; both run on the public testnet with their evidence; and the chain as the witness of a ledger: a notarized head, read through the AIP-23 verifier under a post-quantum certified anchor, bounds entry times from below (a backdated entry is caught)
identity/	post-quantum credentials: an issuer signs claims (hybrid Ed25519 + ML-DSA-65, both required), the holder shows only the claims it picks (selective disclosure in the manner of SD-JWT, RFC 9901, in a format of its own), bound to the verifier's audience and nonce; delegation to a phone, an agent or a ten-minute session key that can only narrow; revocation and an issuer status list in the manner of W3C Bitstring Status List; all checked offline from the files; and compliance without surveillance: a verifier's policy (issuers, required claims) judged on a presentation, recorded as an AIP-23 envelope that carries no personal data; and the Travel Rule between VASPs, the IVMS101 data sealed for the receiving VASP with a hybrid X25519 + ML-KEM-768 key encapsulation, signed, bound to the transfer and acknowledged

Each component's README says what it is not and what is not measured. No third party has reviewed any of them.

How each is checked

Every component ships its test suite and a negative control: the control plants a real defect in a copy of the code, one at a time, and requires the named test to fail for the named reason; a planting that cannot be applied, or that breaks the build instead of the test, counts as a failure of the control. Results measured on 2026-09-29 (Node.js 24.14.1, OpenSSL 3.5.5):

component	tests	negative control
pq-gateway	33/33 (node proba-pq-gateway.mjs)	33/33 (bash proba-pq-gateway-control-negativ.sh)
pq-kms	62/62 (node test/proba.mjs); HSM root on SoftHSM2 + OpenSC 20/20 (test/proba-hsm.mjs, Linux); sealed-file trust rules 7/7 (test/proba-hsm-incredere.mjs)	16/16 (node test/control-negativ.mjs); sealed-file rules 2/2 in this repository (test/control-negativ-hsm-incredere.mjs)
pq-pki	27/27 (node test/proba.mjs), each verdict compared with OpenSSL 3.5	22/22 (node test/control-negativ.mjs)
crypto-inventory	37/37 (node test/proba.mjs); cost on hostile input 8/8 linear (node test/proba-timp.mjs)	18/18 (node test/control-negativ.mjs); cost 3/3 in this repository (node test/control-negativ-timp.mjs; its fourth case compares with version 0.1.0 from the development history and is skipped here)
verify-layer	44/44 with the AIP-23 reference verifier (AERE_VERIFY_PROOF=<verify-proof.mjs from aere-node> node proba-sidecar.mjs); without it 39 run, 5 are reported as skipped and the exit code is 2; the Merkle tree 19/19 (node proba-arbore.mjs: the reference roots of Certificate Transparency, every proof up to 64 leaves, each attack), measured 2026-09-30	9/9 in this repository (node control-negativ-sidecar.mjs; its tenth case compares with the version from the development history and is skipped here); the tree 13/13 (node control-negativ-arbore.mjs)
proof-kinds	24/24 with the same verifier (AERE_VERIFY_PROOF=... node proba-proof-kinds.mjs)	six negative controls inside the test
readiness	6/6 (node proba-adrese-private.mjs: the private-address rules, and a local listener no scan may touch)	the rate limit and the queue bound are tested where the service runs, not here (its README says so)
control-plane	planner 30/30, command line 9/9, execution 30/30 on real products started locally, remediation 33/33 on real TLS servers, compliance report 27/27 (with the AIP-23 verifier), console 8/8; the console viewer in a real Chromium, phone and desktop, 26/26 (node proba-consola-web.mjs, measured 2026-09-30; needs playwright-core and a Chromium, otherwise it exits 2)	remediation 7/7, compliance report 3/3 in this repository; viewer 8/8 (node control-negativ-consola-web.mjs)
identity	43/43 (node proba-identity.mjs, with the AIP-23 verifier for its envelope test; without it that test is reported as skipped and the exit code is 2), compliance 14/14 (node proba-conformitate.mjs), Travel Rule 18/18 (node proba-travel-rule.mjs), measured 2026-09-30	46/46 (node control-negativ-identity.mjs); compliance 13/13 (node control-negativ-conformitate.mjs); Travel Rule 18/18 (node control-negativ-travel-rule.mjs)
agents	policy 27/27 with the AIP-23 verifier (without it 25 run, 2 are reported as skipped and the exit code is 2), ledger 51/51, approval and revocation 39/39, the chain as witness 26/26 without a network and 7/7 on testnet 28001 on 2026-09-30 (proba-agent-ancora-testnet.mjs, needs a funded testnet key and the AIP-23 verifier), command line 23/23 through files and processes only (on Linux and macOS one more test checks the key file mode; not measured here); x402 wallet 25/25, 2-of-2 co-signing 16/16 and payment verifier 14/14 without a network; on the public testnet 28001, 9/9 with the wallet key and 13/13 with the 2-of-2 contract wallet (x402/proba-x402-testnet.mjs, x402/proba-cosign-testnet.mjs, each needs a funded testnet key); the contract's artifact recompiles byte for byte with solc 0.8.23 (node x402/recompileaza-contract.mjs --solc <solc>)	26/26 (node control-negativ-aprobare.mjs); the chain as witness 11/11 (node control-negativ-ancora.mjs); x402 30/30 (node x402/control-negativ-wallet.mjs); the contract's own tests (7) and their negative control (4/4) run in the Aere Network contracts project, not in this repository

Code comments, most function and variable names (also many exported between the files of a component), test names and control messages are in Romanian, and so are the two command words of the KMS HSM tool (explained in its README). Error codes, error messages, the HTTP APIs, the inventory's module interface (scan, buildCbom, renderSummary, ...), the agents' module interface, command line and data (definePolicy, verifyLedger, approve, ...) and the documentation are in English.

Licence

MIT, see LICENSE. Files: 154 (pq-gateway 6, pq-kms 10, pq-pki 6, crypto-inventory 42, verify-layer 12, proof-kinds 3, control-plane 19, agents 39, identity 11, readiness 4).