{
  "tool_id": "art-86-tls-pki-migration-planner",
  "kernel_id": "art-86-tls-pki-migration-planner",
  "display_name": "TLS / X.509 PKI Migration Planner",
  "tool_version": "1.0.0",
  "mandate_type": "compliance_mandate",
  "purpose": "Sequences TLS and X.509 PKI migration from RSA/ECDSA to post-quantum algorithms (ML-KEM/ML-DSA per NIST FIPS 203/204 Aug 2024). Builds a phased plan (root CAs -> intermediates -> leaf certificates), models payload impact for hybrid/composite/replace strategies, and flags interoperability risks. Reuses CBOM inventory from tool 499.",
  "control_description": "Sequences TLS and X.509 PKI migration from RSA/ECDSA to post-quantum algorithms (ML-KEM/ML-DSA per NIST FIPS 203/204 Aug 2024). Builds a phased plan (root CAs -> intermediates -> leaf certificates), models payload impact for hybrid/composite/replace strategies, and flags interoperability risks. Reuses CBOM inventory from tool 499.",
  "declared_inputs": [
    "art-85-pqc-timeline-fit-diagnostic",
    "499-crypto-asset-inventory-classifier"
  ],
  "declared_outputs": [
    "cry-04-merkle-batch-verifier",
    "cry-05-agent-action-audit-trail-aggregator"
  ],
  "kernel_digest": "sha256:e85d6bf7a77f232f5abd1634ba2c1b56fdf0bb46db01403dc6bf55e317bfe718",
  "trust_label": "independently verified -- zkVM execution proof (risc0/groth16-bn254)",
  "data_vintage": "2026-07-10",
  "last_validated": "2026-07-10",
  "conformance_fixtures_vendored": false,
  "compute_proof_ready": "ready",
  "wave": 18,
  "source_url": "https://ainumbers.co/chaingraph/art-86-tls-pki-migration-planner.html",
  "generated_at": "2026-07-25T20:02:55.601Z"
}