quantakrypto-tools

Engineering, standards, and compliance documentation for the quantakrypto-tools monorepo. Start here.

Objectives & decisions

• OBJECTIVES.md — what the toolchain is for, what each library does, the load-bearing decisions, and the deliberate scope boundaries. Read this first.
• COMPARISON.md — two head-to-head comparisons: quantakrypto vs QRAMM / cryptodeps (another crypto-dependency scanner) and quantakrypto vs NIST (the standards baseline), with verified algorithm, ecosystem, and standards coverage plus the honest gaps.
• adr/ — Architecture Decision Records: the immutable "why" behind each load-bearing choice (zero deps, shared core contract, monorepo, no fabricated vectors, the two-plane agent architecture, English-only output).
• VERSIONING.md — SemVer + deprecation policy (operationalises ADR-0002).
• CONFIG.md — the optional quantakrypto.config.json spec.

Standards & compliance

• COMPLIANCE.md — how the toolset maps to PQC standards (FIPS 203/204/205, CNSA 2.0, SP 800-208, IR 8547), interchange formats (SARIF, CycloneDX/CBOM, OpenVEX, SPDX/REUSE), and information-security frameworks — with honest "touches / helps align / would require" verbs.
• standards/pqc-standards.md — the dated, cited standards source of truth and the quarterly review runbook.
• compliance/iso27001-a8.24-evidence.md — the ISO/IEC 27001 A.8.24 evidence-chain export (qscan --format evidence), its deterministic content hash, external signing, and --policy verdicts.
• compliance/acvp-provenance.md — how Sieve records ACVP vector provenance for exact-value conformance claims.

Security & supply chain

• THREAT-MODEL.md — the security model: the offline scanner's posture and the BYOK agent line's threats/mitigations (STRIDE, CWE-mapped).
• SUPPLY-CHAIN.md — the supply-chain posture: zero runtime deps, SHA-pinned Actions, provenance, and the weekly cadence audit.

API reference

• API.md + api-surface.json — the generated, frozen public API surface for @quantakrypto/core and the other packages (npm run api:docs regenerates; npm run api:check gates drift).

Validation & accuracy

Empirical, reproducible measurements of behaviour — each locked as a regression guard in the test suite:

Doc	What it measures
validation/detection-benchmark.md	qScan detector precision / recall / F1 against a labelled corpus, with a frank list of known false positives / false negatives
validation/recall-benchmark.md	Real-world false-negative (recall depth) benchmark, gated per language
validation/remediation-benchmark.md	Correctness of the deterministic codemod layer (applied / cleared / no-regression / idempotent)
validation/sieve-real-impl.md	Sieve driven against a real audited PQC implementation
validation/qscan-dogfood.md	qScan run on real crypto-heavy repositories
validation/reproducible-build.md	Byte-for-byte reproducibility of the published tarballs

---

Per-package usage docs live in each package's own README: core · qscan · mcp · sieve · action · agent · qprobe.