# Cryptographic Control Plane

## Sanitised public brief

**Status:** Work in progress  
**Current reference release:** v0.9.1  
**Project type:** Evidence-backed cryptographic discovery and post-quantum cryptography migration governance reference implementation

## Purpose

The project explores how an organisation can build a trustworthy picture of its cryptographic dependencies and govern post-quantum migration decisions. Certificate monitoring is treated as an initial discovery sensor, not as complete cryptographic inventory.

The central design principle is simple: a decision should not claim more assurance than its evidence can support.

## What the reference implementation demonstrates

- versioned, validated evidence contracts;
- provenance and evidence-maturity labels;
- deterministic cryptographic exposure assessment;
- preservation of missing and conflicting evidence;
- dependency-aware migration planning;
- ownership, approval, exception and independent-verification controls;
- sanitised, integrity-checked offline evidence exchange;
- tenant-scoped workflow semantics and proposal-only integration boundaries.

Milestones 1 through 6 are implemented locally. Milestones 7 through 9 provide safe executable foundations for future pilot, service and integration work. Production gates have not been passed.

## What it does not claim

The current implementation is not a certificate authority, key-management service, vulnerability scanner, migration executor or autonomous remediation system. It does not issue or revoke certificates, rotate or delete keys, change trust stores, deploy cryptography, scan the public Internet or connect to a production environment.

Generated and simulated evidence is not presented as production evidence. A valid bundle signature proves integrity under a named key; it does not by itself prove source trust, deployment safety or enterprise coverage.

## Current assurance boundary

The repository is suitable for architecture review, controlled demonstrations and discussion of cryptographic discovery and migration governance. A real pilot still requires written authority, bounded read-only scope, authenticated sources, a real asset denominator, privacy and security review, production identity and operating controls, recovery and service-level evidence, independent testing and adapter-specific approval.

## Public repository

https://github.com/jibolufc/AI-for-cert-monitoring

This brief intentionally excludes credentials, private infrastructure details, internal hostnames, real enterprise data and operational access information.