TLS / X.509 PKI PQC Migration Plan

CBOM inventory (499) -> TLS + PKI migration sequencing, hybrid vs composite strategy (ART-86) -> Merkle integrity (cry-04). The PKI protocol-migration workhorse, built on the live inventory tool.

OpenChainGraph · 3 Steps cryptographic mandate Hash-Anchored §4 chain_depth:3 Client-Side · Zero PII

Chain Stages · 3 Steps

1 ROOT · D0 catalog

Crypto Asset Inventory Classifier 499-crypto-asset-inventory-classifier

classified PKI-relevant assets (H1) feed the planner

↓

2 D2 node

TLS / X.509 PKI Migration Planner art-86-tls-pki-migration-planner

sequenced plan (H2) feeds the verifier

MCP Call · plan_tls_pki_migration

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "plan_tls_pki_migration",
    "arguments": {}
  },
  "id": 1
}

↓

3 TERMINAL · D3 node

Merkle Batch Verifier cry-04-merkle-batch-verifier

Exports composite TLS/PKI plan artifact with Merkle-root execution_hash (H3) -- final stage

MCP Call · verify_merkle_batch

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "verify_merkle_batch",
    "arguments": {}
  },
  "id": 1
}