Quantum Readiness Copilot

• 

  Discovery Dashboard

• 

  Runtime Evidence

• 

  Isolated Impact Verification

Inspiration

Post-quantum cryptography is often discussed as a future infrastructure problem, but migration decisions need to start with the code that exists today. Teams first need to know where cryptography is used, which data may remain sensitive long enough to face a future quantum threat, and which dependencies or protocols could block migration.

I built Quantum Readiness Copilot to connect that strategic question to repository-level evidence. The goal was not to label a codebase “quantum-safe,” but to give developers a practical and technically honest starting point for planning the transition.

What it does

Quantum Readiness Copilot scans a local repository, public GitHub repository, or ZIP archive for cryptographic implementations, dependencies, configuration issues, and exposed secrets.

It then:

• Groups findings into actionable cryptographic assets.
• Distinguishes confidentiality risks from authenticity and signature risks.
• Calculates an explainable readiness score.
• Evaluates harvest-now-decrypt-later exposure using the Mosca inequality: (X + Y > Z).
• Builds a dependency-aware migration plan.
• Validates repository-owned evidence for ML-KEM, ML-DSA, SLH-DSA, and hybrid constructions.
• Uses GPT-5.6 through Codex to explain risks and prioritize the work.
• Generates reviewable patches for selected findings.
• Applies proposed patches only to an isolated copy, rescans it, and reports the measured impact without modifying the original repository.
• Exports Markdown and SARIF evidence for review and CI workflows.

The deterministic scanner remains the source of observed facts. GPT-5.6 adds repository context and planning, but it cannot silently change the score or claim that a migration has been completed.

How we built it

The application is built as a local Node.js developer-security tool with a browser-based dashboard. Its scanner uses deterministic rules for repository traversal, cryptographic discovery, evidence grouping, scoring, policy enforcement, and SARIF generation.

I added static call-site analysis, repository-owned migration policies, baseline tracking, exposure-horizon modelling, and a dependency graph for sequencing migration work. Model responses are constrained by structured schemas and checked against the deterministic evidence before they are accepted.

For implementation evidence, the project includes reproducible Node and Python interoperability checks covering ML-KEM-768, ML-DSA-65, and an X25519 + ML-KEM-768 hybrid based on the X-Wing draft. These checks include bidirectional operations, tamper tests, and fail-closed negotiation behaviour. They demonstrate bounded interoperability for the exact pinned implementations tested, rather than claiming general certification or production readiness.

Codex runs in a read-only repository context. Generated changes remain proposals until the user reviews them, and impact verification happens in a temporary copy.

Challenges we ran into

The main challenge was keeping the boundary between detection, inference, and proof clear.

Finding a cryptographic name in source code does not prove that the path executes in production. Similarly, installing a post-quantum package does not prove correct parameter selection, interoperability, protocol integration, or safe rollout. I designed the product to keep static evidence, runtime observations, provenance, qualification, and model reasoning separate.

Another challenge was modelling quantum exposure correctly. Harvest-now-decrypt-later primarily affects information that must remain confidential, while signature and authenticity systems have different migration timelines. Treating every cryptographic asset identically would produce misleading priorities.

The model-assisted workflow also required careful failure handling. Responses are schema-validated, sensitive values are redacted, network requests have bounded retries and timeouts, and malformed output falls back safely instead of becoming trusted application state.

Accomplishments that we're proud of

I am most proud that the project produces evidence that can be inspected and reproduced instead of relying on a polished AI answer.

The current implementation includes a pinned real-repository benchmark, reproducible post-quantum interoperability evidence, a governed CI workflow, and a judge-verification receipt bound to the evaluated artifacts. The automated suite covers the scanner, exposure logic, redaction, repository intake, model schemas, patch verification, network failures, and HTTP behaviour.

The result is a complete path from repository discovery to prioritized migration planning and reviewable remediation, while preserving human approval for security-sensitive changes.

What we learned

The biggest lesson was that post-quantum migration is an engineering and governance problem, not simply an algorithm replacement.

A technically valid primitive can still fail because of wire-size limits, protocol compatibility, dependency readiness, key lifecycle assumptions, or unsupported peers. Cryptographic agility and evidence provenance are therefore as important as identifying RSA or elliptic-curve usage.

I also learned that AI works best here as a contextual reasoning layer. Deterministic tooling should establish the facts; the model should explain trade-offs, identify blind spots, and help developers turn those facts into an achievable plan.

What's next for Quantum Readiness Copilot

The next step is to broaden language and framework coverage, improve runtime correlation, and add deeper integrations with CI and security platforms.

For use beyond a local single-user environment, I would also add hosted authentication, tenant isolation, durable storage, stricter resource controls, and deployment-specific security configuration.

Longer term, I want to validate migration plans against real protocol peers and staging environments so the product can connect repository readiness with measured operational readiness—without turning limited evidence into a certification claim.

Built With

• codex
• developer-tools
• github
• gpt-5.6
• javascript
• ml-dsa
• ml-kem
• nist
• node.js
• openai
• post-quantum-cryptography
• security
• static-analysis