Metadata-Version: 2.5
Name: q-armor-proxy
Version: 0.1.2
Summary: QArmor enterprise runtime: protection proxy, firewall and SIEM webhook.
License-Expression: LicenseRef-Proprietary
License-File: LICENSE
Requires-Python: >=3.11
Requires-Dist: fastapi>=0.100
Requires-Dist: httpx>=0.27
Requires-Dist: q-armor-lib==0.1.2
Requires-Dist: slowapi>=0.1.9
Requires-Dist: uvicorn>=0.29
Description-Content-Type: text/markdown

# q-armor-proxy

**The enterprise runtime of QArmor: a protection proxy that turns a silent harvest into an alert with a timestamp.**

[![PyPI](https://img.shields.io/pypi/v/q-armor-proxy.svg)](https://pypi.org/project/q-armor-proxy/)
[![Python](https://img.shields.io/pypi/pyversions/q-armor-proxy.svg)](https://pypi.org/project/q-armor-proxy/)
[![Licence](https://img.shields.io/badge/licence-proprietary-1f6feb.svg)](https://idenq.io)

> Prevention alone has a hole in it: if somebody copies your traffic today and decrypts it in 2032, nothing in your logs will ever say it happened. Canary tokens close that hole. They are bait that only a decrypted capture can lead anyone to, so the day one is visited you learn two things at once: that the capture existed, and roughly when it was read.

It sits in front of a validator and does three things:

- **Injects canary tokens** into the traffic, to detect HNDL harvesting.
- **Blocks origins by list**, at the door.
- **Fires the full alert** when a canary is visited: SIEM notification, key
  rotation and blocking, in one path.

## Run it

```bash
pip install 'q-armor-cli[proxy]'
q-armor proxy --host 0.0.0.0 --port 8080
```

The `proxy` extra pulls this package and uvicorn. It is an extra on purpose:
an operator who only scans does not need FastAPI installed, and the import
lives inside the command so that its absence cannot break `scan` or `vqs`.

From a checkout of the workspace:

```bash
pip install -e packages/q-armor-lib -e packages/q-armor-proxy
```

## It does not implement cryptography

It consumes [`q-armor-lib`](https://pypi.org/project/q-armor-lib/), the same
library the CLI and the dashboard consume. A second scanner here would be
another surface producing the `key_establishment_class` axis and diverging in
silence (see `docs/layer-placement.md` §8).

It stays in Python rather than TypeScript for a measured reason, not out of
inertia: the proxy has no cryptographic tie of its own (it imports neither
ML-KEM nor ML-DSA), but migrating it would force porting the whole of
`q-armor-lib` and would leave **three** implementations of the same axis
instead of two.

## The QArmor family

Five packages, one version, published together from a single tag.

| Package | What it is |
|---|---|
| [`q-armor-lib`](https://pypi.org/project/q-armor-lib/) | Detection, scoring and the control-plane client |
| [`q-armor-cli`](https://pypi.org/project/q-armor-cli/) | `q-armor`, the operator's command line |
| [`q-armor-proxy`](https://pypi.org/project/q-armor-proxy/) | This one: the enterprise runtime |
| [`q-armor-chain`](https://pypi.org/project/q-armor-chain/) | DVN worker and `QArmorDVN.sol` |
| [`q-armor-pqc`](https://pypi.org/project/q-armor-pqc/) | Interim ML-DSA-65 primitive |

## Next

The proxy is the enterprise tier: real-time alerting, SLA and on-premise
deployment. [idenq.io](https://idenq.io)
