Metadata-Version: 2.5
Name: q-armor-cli
Version: 0.1.0
Summary: q-armor: the QArmor operator command line. Post-quantum posture of a TLS endpoint, the VQS of a validator, and the protection proxy.
License-Expression: LicenseRef-Proprietary
License-File: LICENSE
Requires-Python: >=3.11
Requires-Dist: q-armor-lib==0.1.0
Provides-Extra: proxy
Requires-Dist: q-armor-proxy==0.1.0; extra == 'proxy'
Requires-Dist: uvicorn>=0.29; extra == 'proxy'
Description-Content-Type: text/markdown

# q-armor-cli

**`q-armor`: post-quantum posture of any TLS endpoint, from your terminal, in one command.**

[![PyPI](https://img.shields.io/pypi/v/q-armor-cli.svg)](https://pypi.org/project/q-armor-cli/)
[![Python](https://img.shields.io/pypi/pyversions/q-armor-cli.svg)](https://pypi.org/project/q-armor-cli/)
[![Licence](https://img.shields.io/badge/licence-proprietary-1f6feb.svg)](https://idenq.io)

> The traffic your validator is emitting right now is being recorded by somebody who cannot read it yet. Harvest Now, Decrypt Later is the one attack you cannot respond to after the fact, because the copy was taken years before the key broke. The first useful question is simple: what is this endpoint actually negotiating?

```bash
pip install q-armor-cli
q-armor scan example.com
```

```
hostname: example.com
port: 443
tls_version: TLSv1.3
cipher_suite: TLS_AES_256_GCM_SHA384
cert_key_type: rsa-2048
cert_issuer: DigiCert Inc
key_exchange_group: x25519
signing_algo: rsa
session_algo: x25519
vqs_score: 80
risk_tier: deny
consensus_weight_factor: 0.1
error: None
```

`vqs_score` is **exposure**, so higher is worse. RSA signing and an x25519 key
exchange are both classical, both fall to Shor, and the consensus weight
factor is what that costs a validator: one tenth of its vote.

## Three commands

```
q-armor scan example.com            # post-quantum posture of a TLS endpoint
q-armor vqs <validator-id>          # a validator's VQS
q-armor proxy --port 8080           # start the protection proxy
```

Add `--json` to any of them and pipe it into whatever you already run.

Three, and the list is not a matter of taste: `docs/priorities.md` (P1-11)
says that before writing a CLI you have to answer **what an operator asks
for**, "because a CLI without that case is surface to maintain".

## What it will not do

- **It does not reimplement detection.** Every command consumes
  [`q-armor-lib`](https://pypi.org/project/q-armor-lib/). A second scanner
  here would be another producer of the `key_establishment_class` axis,
  diverging in silence.
- **It does not let telemetry block your answer.** A `scan` reports what it
  measured even if the border is down, misconfigured or refusing on consent
  grounds. A command that failed because it could not report would be a
  command that lies about what it has measured. `--no-telemetry` turns the
  emission off outright.

## Exit codes, so a script can tell the difference

| Code | Meaning |
|---|---|
| `0` | It measured the endpoint |
| `1` | Error |
| `2` | It could not observe the endpoint: that is a **finding**, not a broken command |
| `3` | `vqs` only: the local validator registry is not present |

Code 3 is repository-root code (`services/state/validator_store.py`) that no
wheel carries, so installed from PyPI the command says so by name with its own
code instead of dying with an ImportError. It works from a checkout, until the
registry moves to the platform's `POST /validators` (`docs/priorities.md`,
P1-13).

## The QArmor family

Five packages, one version, published together from a single tag.

| Package | What it is |
|---|---|
| [`q-armor-lib`](https://pypi.org/project/q-armor-lib/) | Detection, scoring and the control-plane client |
| [`q-armor-cli`](https://pypi.org/project/q-armor-cli/) | This one: `q-armor`, the operator's command line |
| [`q-armor-proxy`](https://pypi.org/project/q-armor-proxy/) | Enterprise runtime: protection proxy, firewall, SIEM webhook |
| [`q-armor-chain`](https://pypi.org/project/q-armor-chain/) | DVN worker and `QArmorDVN.sol` |
| [`q-armor-pqc`](https://pypi.org/project/q-armor-pqc/) | Interim ML-DSA-65 primitive |

## Next

Scanning is free. The collective canary network, real-time alerting and
on-premise deployment are the paid tiers: [idenq.io](https://idenq.io)
