Self-hosted post-quantum infrastructure: TLS 1.3 gateway with X25519MLKEM768, hybrid KMS (ML-KEM-768/ML-DSA-65), ML-DSA private CA. Zero dependencies, Node.js 24.
| agents | ||
| ai-trust | ||
| conformance | ||
| control-plane | ||
| crypto-inventory | ||
| device-identity | ||
| exposure-report | ||
| identity | ||
| market-settlement | ||
| payments | ||
| pq-gateway | ||
| pq-kms | ||
| pq-pki | ||
| proof-kinds | ||
| proof-of-ai | ||
| readiness | ||
| verifiable-data | ||
| verify-layer | ||
| CITATIONS-UNRESOLVED.md | ||
| LICENSE | ||
| README.md | ||
Aere Quantum
Self-hosted post-quantum infrastructure from Aere Network. Each component is a few files with no dependencies: Node.js 24
and the OpenSSL 3.5 it ships with (node:crypto), nothing from a package registry. The exceptions: ethers for the
notarization command of the verification layer and for the agents' x402 wallet (EIP-712 and secp256k1); @noble/hashes and
@noble/curves 1.x for the exposure report (keccak-256, RIPEMD-160, secp256k1 public-key recovery).
| component | what it does |
|---|---|
pq-gateway/ |
a TLS 1.3 terminating proxy in front of any HTTP service, with the hybrid key exchange X25519MLKEM768: hybrid-only refuses a classical client at the handshake, hybrid-preferred keeps it working; optional client authentication with ML-DSA certificates |
pq-kms/ |
a transit-style key management service where every key is hybrid: X25519 + ML-KEM-768 for encryption, Ed25519 + ML-DSA-65 for signatures (both halves required); versions, rotation, rewrap, data keys, a chained audit log; the root key from the environment or sealed by an HSM through PKCS#11 |
pq-pki/ |
a private certificate authority for ML-DSA (X.509 v3, RFC 9881): root and issuing CAs, leaf certificates, revocation lists, and a strict chain verifier compared against OpenSSL |
crypto-inventory/ |
a cryptographic inventory of source code (JavaScript/TypeScript, Python, Java, Go, Rust, PEM blocks, dependency manifests including Cargo.toml): every use classified by its exposure to a quantum computer, with a migration target, written as a CycloneDX 1.6 CBOM; nothing from the scanned tree is executed, and its cost stays linear on input built to be slow |
verify-layer/ |
an audit-log sidecar for any deployment: entries are AIP-23 envelopes in a hash chain, the runtime adapter records every running Docker or Kubernetes container without any secret value, and the head of the chain can be signed by the operator (ML-DSA-65) and notarized on Aere Network under a post-quantum validator certificate; it says plainly what that proves (the history before a published head) and what it does not (that the host told the truth); the same log as a Merkle tree (RFC 9162): signed tree heads, and inclusion and consistency proofs of a few hashes that anyone checks without the log |
proof-kinds/ |
the AIP-23 envelope builder the verification layer uses: fourteen proof kinds, one envelope format, digests instead of raw content |
readiness/ |
the post-quantum readiness scanner of a public hostname: real TLS handshakes (hybrid only, hybrid preferred, TLS 1.2), HSTS, the certificate; no connection to an address not proven public; a rate limit per client that X-Forwarded-For cannot bypass |
control-plane/ |
from findings to a finished migration: a prioritized plan from the inventory and the scanner, its execution through the gateway, KMS and PKI with consent per action and a measured proof afterwards, recipes for the servers the products do not touch and a rescan that judges them, a compliance report against NIST IR 8547, the EU roadmap and optionally CNSA 2.0, and a console that checks it all again |
agents/ |
limits an AI agent cannot break unseen: a post-quantum identity (ML-DSA-65), a policy (spending per time window, allowed tools and recipients, which actions need human approval), a signed ledger of every action judged against the policy, approvals and revocation signed by people, and a verifier that re-runs the policy over the whole ledger without trusting the agent; two branches of one ledger are a proof of equivocation anyone can check; and a wallet that pays over x402 only what the agent's ledger records and its policy allows, either holding the payment key for the owner or co-signing from a 2-of-2 contract wallet that neither the agent nor the owner can spend alone; both run on the public testnet with their evidence; and the chain as the witness of a ledger: a notarized head, read through the AIP-23 verifier under a post-quantum certified anchor, bounds entry times from below (a backdated entry is caught) |
proof-of-ai/ |
the AIP-23 envelope of an AI agent's action: model, version, weights digest, prompt, input, output, tools, agent, requester, as digests; verified by the same AIP-23 verifier as every other proof |
payments/ |
the risk step and the receipt of a payment for a person or a company: a declared policy (per-payment and sliding-window limits in USD per payer, assets allowed, counterparties refused with their source) gives a verdict anyone reproduces from the same inputs, with the signals it does not have named as unmeasured (no sanctions list, no identity tier); the receipt is an instruction (payer, payee, the amount in the asset and in USD at the rate declared as an input, the transaction, the verdict with its policy under hash) committed to by an AIP-23 settlement envelope, notarized and read back under a post-quantum certified anchor; a reader checks it against the policy, the inputs and the chain with plain JSON-RPC |
market-settlement/ |
the dispute and settlement rail of a verifiable infrastructure market, measured end to end on testnet 28001: an order with its reward in escrow and a provider bond, the result committed on chain with its execution envelope notarized under a post-quantum certified anchor, a challenge window in which anyone disputes with a recomputed result and a bond, an arbiter that can only route the escrow (with a permissionless 14-day timeout), deadline reclaims, and an AIP-23 settlement receipt; a pure judge over the job's timeline that checks deadlines, the window, who resolved, the payout, the replay and the proof |
verifiable-data/ |
a dataset whose every answer is checkable against a short commitment without the data: RFC 9162 commitments per version (append-only, consistency proofs), equality and range queries proven correct AND complete (contiguous run of a sorted index plus its two neighbours), hash-based selective disclosure of fields, availability sampling against the serving endpoint, and the version's AIP-23 envelope notarized and read back under a post-quantum certified anchor; not zero knowledge, and says so |
ai-trust/ |
the trust chain of an AI result: the agent's identity (agents/), the model artifact's attestation, the host's runtime record (verify-layer/), the policy and signed ledger, the Proof of AI envelope and the chain as witness, joined in one bundle whose verifier checks only the links between them |
conformance/ |
a conformance suite for the AIP-23 proof kinds: one verdict form over the verifiers published here (four levels: integrity, authenticity, anchoring, finality; each passed, failed or not measured, with the named rule), 181 rules of eleven verifiers read from their code (the presentation verifier of identity/ and the device verifier of device-identity/ among them since 2026-10-05), 422 vectors derived from the producers and from evidence recorded on testnet 28001 (each invalid one is one operation away from one that is not, or one change at its producer, and must be refused for exactly its named rules), and a runner that scores any implementation given as a command, in any language; a second implementation in Python covers 6 of the 181 rules. Not a certification and not an audit |
identity/ |
post-quantum credentials: an issuer signs claims (hybrid Ed25519 + ML-DSA-65, both required), the holder shows only the claims it picks (selective disclosure in the manner of SD-JWT, RFC 9901, in a format of its own), bound to the verifier's audience and nonce; delegation to a phone, an agent or a ten-minute session key that can only narrow; revocation and an issuer status list in the manner of W3C Bitstring Status List; all checked offline from the files; and compliance without surveillance: a verifier's policy (issuers, required claims) judged on a presentation, recorded as an AIP-23 envelope that carries no personal data; and the Travel Rule between VASPs, the IVMS101 data sealed for the receiving VASP with a hybrid X25519 + ML-KEM-768 key encapsulation, signed, bound to the transfer and acknowledged; and the same credentials as standard SD-JWT (IETF RFC 9901): issued with the issuer's Ed25519 key (EdDSA) or its ML-DSA-65 key, presented with a key binding JWT, and verified against the RFC's own example vectors (identity-cli.mjs verify-sdjwt, behind Aere Cloud's POST /v1/identity/sd-jwt/verify) |
device-identity/ |
what a machine is, as a chain of signed statements checked offline: the manufacturer's credential for the device key (the manufacturer and the owners sign hybrid, Ed25519 + ML-DSA-65, both required; the device key is ML-DSA-65), a firmware release with a floor and retractions (a rolled-back or retracted firmware is refused), ownership by transfers each signed by the owner before, the current owner's authorization, a status registry in which the manufacturer's retirement is final and an owner's lasts as long as its ownership (after a sale the records of the previous owner are named and not applied: a seller could date one before the sale after it; a retirement by an owner that survives a sale needs a witness of time that is not built), and the device's fresh attestation to the verifier's nonce, with an AIP-23 envelope that can be notarized and read back under a post-quantum certified anchor; one verifier makes every check it can reach, names every rule that refused and says VALID, PARTIAL (what it was not handed, or could not read) or INVALID. The device key is a software key: no TPM, secure element or TEE is used or checked, and the README says what that leaves open |
exposure-report/ |
classifies Bitcoin and Ethereum addresses by whether their public key is already readable from chain data, in three declared modes (offline, by address or script type only; through your own Electrum server, Esplora index, Bitcoin Core or Ethereum JSON-RPC, one declared target; through a third-party provider only with written consent, recorded in the report), with exactly two labels ("exposed (on-chain evidence)", "no on-chain evidence of exposure") and "unmeasured" when the reading did not happen, the evidence named for each address, and a dated report (JSON, Markdown, an AIP-23 compliance envelope that binds the JSON). It records what was readable on the date of the report: it does not protect, move or recover any coins, it does not change what a spend reveals, and it says nothing about the future. The one component with npm dependencies (@noble/hashes, @noble/curves 1.x: npm install --ignore-scripts in its directory) |
Each component's README says what it is not and what is not measured. No third party has reviewed any of them.
How each is checked
Every component ships its test suite and a negative control: the control plants a real defect in a copy of the code, one at a time, and requires the named test to fail for the named reason; a planting that cannot be applied, or that breaks the build instead of the test, counts as a failure of the control. Results measured on 2026-09-29 (Node.js 24.14.1, OpenSSL 3.5.5):
| component | tests | negative control |
|---|---|---|
| pq-gateway | 33/33 (node proba-pq-gateway.mjs) |
33/33 (bash proba-pq-gateway-control-negativ.sh) |
| pq-kms | 62/62 (node test/proba.mjs); HSM root on SoftHSM2 + OpenSC 20/20 (pq-kms/test/proba-hsm.mjs, Linux); sealed-file trust rules 7/7 (pq-kms/test/proba-hsm-incredere.mjs) |
16/16 (node test/control-negativ.mjs); sealed-file rules 2/2 in this repository (pq-kms/test/control-negativ-hsm-incredere.mjs) |
| pq-pki | 27/27 (node test/proba.mjs), each verdict compared with OpenSSL 3.5 |
22/22 (node test/control-negativ.mjs) |
| crypto-inventory | 44/44 (node test/proba.mjs, measured 2026-10-18 with the Rust detector); cost on hostile input 8/8 linear (node test/proba-timp.mjs) |
21/21 (node test/control-negativ.mjs); cost 3/3 in this repository (node test/control-negativ-timp.mjs; its fourth case compares with version 0.1.0 from the development history and is skipped here) |
| verify-layer | 45/45 with the AIP-23 reference verifier, measured 2026-10-05 (AERE_VERIFY_PROOF=<verify-proof.mjs from aere.network/tools> node proba-sidecar.mjs); without it 40 run, 5 are reported as skipped and the exit code is 2; the Merkle tree 20/20 (node proba-arbore.mjs: the reference roots of Certificate Transparency, every proof up to 64 leaves, each attack), measured 2026-09-30 |
10/10 in this repository on 2026-10-05 (node control-negativ-sidecar.mjs; its eleventh case compares with the version from the development history and is skipped here); the tree 14/14 (node control-negativ-arbore.mjs) |
| proof-kinds | 24/24 with the same verifier (AERE_VERIFY_PROOF=... node proba-proof-kinds.mjs) |
six negative controls inside the test |
| readiness | 6/6 (node proba-adrese-private.mjs: the private-address rules, and a local listener no scan may touch) |
the rate limit and the queue bound are tested where the service runs, not here (its README says so) |
| control-plane | planner 30/30, command line 9/9, execution 30/30 on real products started locally, remediation 33/33 on real TLS servers, compliance report 27/27 (with the AIP-23 verifier), console 8/8; the console viewer in a real Chromium, phone and desktop, 26/26 (node proba-consola-web.mjs, measured 2026-09-30; needs playwright-core and a Chromium, otherwise it exits 2) |
remediation 7/7, compliance report 3/3 in this repository; viewer 8/8 (node control-negativ-consola-web.mjs) |
| identity | 46/46 (node proba-identity.mjs, with the AIP-23 verifier for its envelope test; without it that test is reported as skipped and the exit code is 2), compliance 15/15 (node proba-conformitate.mjs), Travel Rule 19/19 (node proba-travel-rule.mjs), SD-JWT 23/23 (node proba-sdjwt.mjs, the RFC 9901 vectors included), measured 2026-10-05 |
53/53 (node control-negativ-identity.mjs); compliance 14/14 (node control-negativ-conformitate.mjs); Travel Rule 19/19 (node control-negativ-travel-rule.mjs); SD-JWT 29/29 (node control-negativ-sdjwt.mjs) |
| agents | policy 27/27 with the AIP-23 verifier (without it 25 run, 2 are reported as skipped and the exit code is 2), ledger 54/54 on 2026-10-05, approval and revocation 39/39, the chain as witness 26/26 without a network and 7/7 on testnet 28001 on 2026-09-30 (proba-agent-ancora-testnet.mjs, needs a funded testnet key and the AIP-23 verifier), command line 23/23 through files and processes only (on Linux and macOS one more test checks the key file mode; not measured here); x402 wallet 25/25, 2-of-2 co-signing 16/16 and payment verifier 14/14 without a network; on the public testnet 28001, 9/9 with the wallet key and 13/13 with the 2-of-2 contract wallet (agents/x402/proba-x402-testnet.mjs, agents/x402/proba-cosign-testnet.mjs, each needs a funded testnet key); the contract's artifact recompiles byte for byte with solc 0.8.23 (node x402/recompileaza-contract.mjs --solc <solc>) |
26/26 (node control-negativ-aprobare.mjs); the chain as witness 11/11 (node control-negativ-ancora.mjs); x402 30/30 (node x402/control-negativ-wallet.mjs); the contract's own tests (7) and their negative control (4/4) run in the Aere Network contracts project, not in this repository |
| proof-of-ai | 6/6 with the AIP-23 verifier (AERE_VERIFY_PROOF=... node proba-proof-of-ai.mjs); without it the probe reports NEMASURAT and exits 2 |
one negative control inside the test (an envelope touched after its hash: INVALID) |
| payments | 23/23 without a chain (node proba-risc.mjs: the verdicts under a policy, the reproducible verdict hash, a receipt verified, nine forged ones refused by name, a malformed payment refused by name); 9/9 on testnet 28001 on 2026-10-02 (AERE_TESTNET_KEY_FILE=... AERE_ETHERS_DIR=... node proba-plata-28001.mjs: a payment allowed, paid, its receipt notarized and read back with finality PASSED, the public reader VALID; a payment above the limit refused with nothing sent; the fourth in the window refused; a forged receipt and a loosened policy INVALID) |
10/10 (node proba-risc.mjs --control-negativ: form, asset, counterparty, rate, per-payment limit, window, linkage, USD arithmetic, verdict reproduction, chain facts, each planted out on a copy and each forged fixture then accepted) |
| market-settlement | 20/20 on testnet 28001 on 2026-10-02 (AERE_TESTNET_KEY_FILE=... AERE_ETHERS_DIR=... node proba-piata-28001.mjs: five scenarios on AereComputeMarketV3 deployed from the committed artifact, every refusal by its named custom error, the provider's notarized envelope read back under a post-quantum certified anchor); the judge on the recorded timelines 26/26 without a chain (node proba-judecata.mjs: seven honest readings VALID, eighteen forged or malformed ones INVALID for their named reason, the settlement receipt) |
10/10 (node proba-judecata.mjs --control-negativ: form, completeness of the timeline, posting, deadline, window, arbiter, payout, result bytes, replay, proof, each planted out on a copy and each forged fixture then accepted) |
| verifiable-data | 23/23 with the AIP-23 verifier (AERE_VERIFY_PROOF=... node proba-verifiable-data.mjs: honest answers VALID, ten forged or malformed ones INVALID for their named reason, availability sampling on a local server; the envelope row is NEMASURAT without the verifier, exit 2); the two chain rows of --viu measured on testnet 28001 on 2026-10-02 (a version notarized with a test key and read back under a post-quantum certified anchor; evidence in dovezi/) |
5/5 (node proba-verifiable-data.mjs --control-negativ: field commitment, index order, completeness, consistency, sampling, each planted out on a copy and each forged fixture then accepted) |
| ai-trust | 16/16 with the AIP-23 verifier, measured 2026-10-05 (AERE_VERIFY_PROOF=... node proba-lant-de-incredere.mjs: the whole chain on a committed fixture, then thirteen bundles broken on purpose, each refused for its named reason, among them an agent with a classical key and an audit head signed with one); without the verifier it exits 2 |
11/11 (node proba-lant-de-incredere.mjs --control-negativ) |
| conformance | 12/12 on 2026-10-14 with the AIP-23 verifier as served (fetched and installed in an empty folder), Python 3 and testnet 28001 read (AERE_VERIFY_PROOF=... node proba-conformance.mjs --online: the rules and the vectors are what the code derives, every rule has a vector, every invalid vector is one operation from its base or one declared change at its producer, the published verifiers pass 467/467, an independent Python implementation passes the 62 it claims and the other 405 are reported not covered, 96,757 malformed inputs and 183 malformed envelope files each get a verdict); without --online the nine chain vectors are reported unmeasured and the exit code is 2 |
263/263 on 2026-10-14: 181/181 rules (node proba-conformance.mjs --control-negativ --online: each rule planted out of its verifier in a copy; the vectors that expect it, and only they, must fail), then 76/76 conditions of the device verifier's compound checks, each planted out alone (exactly the vectors written for it must fail), then six controls of the instruments |
| device-identity | 372/372 with the AIP-23 verifier, measured 2026-10-14 (AERE_VERIFY_PROOF=... node proba-device.mjs: fifty-four bundles that must be VALID; seventy-seven with something not brought, not read or not readable, each PARTIAL for its named causes; two hundred and four attack rows, each refused for exactly its named rules, among them a clone with another key, a rolled-back or retracted firmware (also when the release is left out of the bundle), a previous owner that still signs, an owner's retirement written under no ownership head, a replayed attestation, an attestation dated ahead of the verifier's clock, a manufacturer the verifier does not trust, a retirement, a classical key under the ML-DSA-65 name, a signature in another base64 text, a day that does not exist; 804 damaged bundles each given a verdict; the command line through files only; the evidence recorded on testnet 28001 judged again offline); the chain as witness 10/10 on testnet 28001 on 2026-10-05, before the repairs of that day (proba-device-ancora-testnet.mjs, needs a funded testnet key and the AIP-23 verifier; not run again since: the bundles and readings it recorded give the same verdicts under the verifier of now) |
220/220 (node control-negativ-device.mjs: the untouched copy green; each of the 47 rules taken out of a copy, the rows that expect it, and only they, go red; 172 more plantings, most of them one condition of a compound check taken out alone, each with its rows) |
| exposure-report | 164 passed and 1 NEMASURAT of 165 rows in the AERE development tree on 2026-10-14 (node proba-expunere.mjs: codec checks with real public vectors, mode 1 and mode 2 through four mock targets that serve recorded responses, the network guard's proof that in modes 1 and 2 nothing leaves the machine, the language gate, the AIP-23 compliance envelopes judged by the reference verifier; the NEMASURAT row is mode 3 against a real provider, which would send addresses to a third party); in this copy, after npm install --ignore-scripts in its directory: 153 passed, 0 red, 0 broken, 12 NEMASURAT with the reason (the rows compared with the AIP-23 verifier, the anchor verifier's RLP encoder and MPT walker and the shield's header pins, none of which is in this repository: with AERE_PROOF_PROTOCOL_VERIFY, AERE_VERIFY_PROOF and AERE_EXPUNERE_PINI naming them the rows run, 162 passed and 3 NEMASURAT; the scan of the directory for names from the AERE host inventory; the git-ignore row outside a git tree); the exit code is 0 unless a row is red or broken |
inside the test, 2026-10-14: each rule has its reverse planting in a copy of the tool (a foreign provider planted on each network path is caught, a label planted in the language gate is refused, each classification rule taken out turns its row red, a @noble/curves 2.x planted first is passed over and alone is named as missing), and the recorded fixtures are judged against their declared date |
Code comments, most function and variable names (also many exported between the files of a component), test names and control
messages are in Romanian, and so are the two command words of the KMS HSM tool (explained in its README). Error codes, error
messages, the HTTP APIs, the inventory's module interface (scan, buildCbom, renderSummary, ...), the agents' module
interface, command line and data (definePolicy, verifyLedger, approve, ...) and the documentation are in English.
Licence
MIT, see LICENSE. Files: 705 (pq-gateway 6, pq-kms 10, pq-pki 6, crypto-inventory 47, verify-layer 12, proof-kinds 3, control-plane 19, agents 39, identity 15, proof-of-ai 3, ai-trust 6, verifiable-data 7, market-settlement 9, payments 8, conformance 479, device-identity 11, exposure-report 18, readiness 4).