This console coordinates your modernization: the discovery role reviews your environment, the architect proposes an implementation plan under Agent-008 governance, and you approve it.
This takes about 30 minutes to connect and review. The analysis happens automatically after that.
To review your environment, the discovery role needs read-only permission on the systems you choose.
Read-only access. We do not modify anything during assessment.
The discovery role is reviewing your environment (read-only).
Current posture
3 of 4 critical controls are protected. 1 area is exposed. 2 need attention.
What’s protected
Identity, access control, and backups are in good shape.
What’s exposed
Some systems still rely on cryptography that won’t hold up to quantum computers.
What needs attention
A few over-privileged accounts, and one aging key policy.
Recommended plan
Evidence package available — independently verifiable.
Would you like to implement this plan?
Your post-quantum implementation plan
A mapped architecture for the systems you connected. Every change is tied to a specific H33 service, a concrete endpoint, and independently verifiable evidence — and nothing executes until the conversion agent is governed.
/apqc/connectors/*
/v1/agent-008/decision
/v1/h33-74/attest
/v1/keys/revoke
/v1/hats/attestation
| Service | Endpoint | Access | Produces |
|---|---|---|---|
| Phase 0 · Assess (read-only) | |||
| AWS · crypto & KMS inventory | GET api.h33.ai/apqc/connectors/aws/inventory | Read-only | Signed asset inventory |
| Okta · identity & entitlements | GET api.h33.ai/apqc/connectors/okta/entitlements | Read-only | Privilege map |
| Microsoft 365 · policy posture | GET api.h33.ai/apqc/connectors/m365/policies | Read-only | Policy findings |
| GitHub · secrets & CI keys | GET api.h33.ai/apqc/connectors/github/secrets | Read-only | Exposure list |
| APQC · assessment envelope | POST api.h33.ai/apqc/envelope | Read-only | Immutable scope + report |
| Phase 1 · Govern the conversion agent — Agent-008 | |||
| Agent-008 · governed session | POST api.h33.ai/v1/agent-008/session | Managed | Session of record |
| Agent-008 · gated decision | POST api.h33.ai/v1/agent-008/decision | Managed | Authority·policy·evidence·precondition verdict |
| Agent-008 · decision replay | GET api.h33.ai/v1/agent-008/replay | Read-only | Replayable decision log |
| Phase 2 · Modernize cryptography — PQ Conversions + H33-74 | |||
| PQ · scan RSA/ECC in scope | POST api.h33.ai/v1/pq/scan | Read-only | Quantum-exposed inventory |
| PQ · convert to NIST PQC | POST api.h33.ai/v1/pq/convert | Managed | ML-KEM / ML-DSA rollout |
| H33-74 · attest converted asset | POST api.h33.ai/v1/h33-74/attest | Managed | 74-byte PQ attestation |
| H33-74 · verify attestation | GET api.h33.ai/v1/h33-74/verify | Read-only | Independent proof |
| Phase 3 · Least-privilege identity — H33-Key | |||
| H33-Key · app authority | POST api.h33.ai/v1/keys/resolve | Managed | Signed proof-of-use |
| H33-Key · rotate exposed key | POST api.h33.ai/v1/keys/rotate | Managed | Signed rotation receipt |
| H33-Key · revoke over-privilege | POST api.h33.ai/v1/keys/revoke | Managed | Signed revocation |
| Phase 4 · Continuous verification — HATS | |||
| HATS · control checks | GET api.h33.ai/v1/hats/controls | Read-only | Continuous status |
| HATS · signed attestation | POST api.h33.ai/v1/hats/attestation | Managed | Insurance-grade evidence |
| HATS · drift transition | GET api.h33.ai/v1/hats/transitions | Read-only | Signed moment-of-drift |
| Commission & handoff — APQC lifecycle | |||
| APQC · grant authority | POST api.h33.ai/apqc/grant | Managed | Scoped, health-independent grant |
| APQC · commission plan | POST api.h33.ai/apqc/commission | Managed | Approved plan of record |
| APQC · derived report | GET api.h33.ai/apqc/report | Read-only | Deterministic, hash-referenced report |
| APQC · HATS handoff | POST api.h33.ai/apqc/handoff | Managed | Custody transition to monitoring |
This plan is generated from the systems you connected. Every step runs under a read-only or explicitly-granted scope, is governed by Agent-008 before it executes, and emits independently verifiable evidence. Endpoints shown are the integration points for each step.
On your authorization, the performers make the approved changes under Agent-008 governance, and Verification records the evidence. This console coordinates and displays — it does not make the changes itself.
Your environment is now protected.
One last step — set up billing to keep your protection active.
Secure checkout
Billing setup goes here — placeholder for the demo.
Conversion complete. Continuous governance remains active.
The migration phase is complete. It does not end here — HATS monitors, Verification verifies, and Authority Center preserves the trusted baseline continuously.
APQC is the coordinator of governed cryptographic-estate transformation. It exists because crypto migration is a lifecycle — not a wizard — that must be orchestrated across many components without losing governance. This Terminal is the eight-phase reference console that runs that lifecycle: Govern → Discover → Architect → Validate → Commission → Supervise → Verify → Sustain. The console coordinates, displays, and records; the work of each phase is done by a named, external performer.
The APQC invariant. APQC coordinates each transition; it does not produce the evidence, govern the policy, render the verification verdict, or preserve authority. Read the phase steps above as coordination: the discovery role inventories, Agent-008 governs and authorizes, the cryptographic surfaces perform the ML‑KEM / ML‑DSA primitive, Verification renders the independent verdict, and HATS monitors continuously. The console never performs the primitive, decides authorization, or issues the verdict itself.
Who owns each adjacent responsibility: Agent-008 governs · H33-74 produces the portable evidence · Verification renders the verdict · Authority Center preserves authority · HATS records and monitors. When to use APQC vs. another capability: use APQC to coordinate the whole governed transformation; use the owning flagship directly when you need that one capability on its own. See the APQC specification suite for the vendor-neutral standard this console implements.