q-armor-cli

q-armor: post-quantum posture of any TLS endpoint, from your terminal, in one command.

The traffic your validator is emitting right now is being recorded by somebody who cannot read it yet. Harvest Now, Decrypt Later is the one attack you cannot respond to after the fact, because the copy was taken years before the key broke. The first useful question is simple: what is this endpoint actually negotiating?

pip install q-armor-cli
q-armor scan example.com

hostname: example.com
port: 443
tls_version: TLSv1.3
cipher_suite: TLS_AES_256_GCM_SHA384
cert_key_type: rsa-2048
cert_issuer: DigiCert Inc
key_exchange_group: x25519
signing_algo: rsa
session_algo: x25519
vqs_score: 80
risk_tier: deny
consensus_weight_factor: 0.1
error: None

vqs_score is exposure, so higher is worse. RSA signing and an x25519 key exchange are both classical, both fall to Shor, and the consensus weight factor is what that costs a validator: one tenth of its vote.

Three commands

q-armor scan example.com            # post-quantum posture of a TLS endpoint
q-armor vqs <validator-id>          # a validator's VQS
q-armor proxy --port 8080           # start the protection proxy

Add --json to any of them and pipe it into whatever you already run.

Three, and the list is not a matter of taste: docs/priorities.md (P1-11) says that before writing a CLI you have to answer what an operator asks for, "because a CLI without that case is surface to maintain".

What it will not do

• It does not reimplement detection. Every command consumes q-armor-lib. A second scanner here would be another producer of the key_establishment_class axis, diverging in silence.
• It does not let telemetry block your answer. A scan reports what it measured even if the border is down, misconfigured or refusing on consent grounds. A command that failed because it could not report would be a command that lies about what it has measured. --no-telemetry turns the emission off outright.

Exit codes, so a script can tell the difference

Code 3 is repository-root code (services/state/validator_store.py) that no wheel carries, so installed from PyPI the command says so by name with its own code instead of dying with an ImportError. It works from a checkout, until the registry moves to the platform's POST /validators (docs/priorities.md, P1-13).

The QArmor family

Five packages, one version, published together from a single tag.

Next

Scanning is free. The collective canary network, real-time alerting and on-premise deployment are the paid tiers: idenq.io