Roadmap

Pilot /pqc/* cryptographic inventory, Mosca risk, CBOM exports, PQ handshake proof.

ML-DSA-65 / Ed25519 signed reports, public /verify, stable signing key registry.

Append-only hash chain, inclusion proofs, witness co-signing, key retirement.

Scheduled re-scans, drift alerts, SIEM v2 webhooks with HMAC and DLQ replay.

Full Tenant API reference, RBAC matrix, OpenAPI artifact, CI coverage gate.

v0.9 beta — published npm/PyPI clients with idempotency, verify helpers, and retry policies.

Read-only credential model for AWS KMS, Azure Key Vault, Keyfactor inventory.

Control evidence collection in progress — no certification claim until complete.

Dedicated EU deployment for regulated tenants by enterprise agreement.

Public CycloneDX SBOM for Qtangl platform components (dogfood CBOM).

Labs expansion motion for hybrid optimization demos — secondary to readiness.