Recomputable AgentsPost-quantum
Quantum-ready by recomputation
Shor's algorithm breaks the elliptic-curve signatures under most of Web3 and most AI attestation. It does not break hashes — and re-deriving an action from a hash of public data is our whole trust model. So the recompute layer is post-quantum by construction; what remains is the signature layer, and here's exactly how we're closing it — recomputable, not asserted.
Already post-quantum
Integrity + precedence are hashes end to end — receipt roots, input provenance, content-addressing, and every on-chain anchor. Grover only halves a hash (256→128 bit, still safe), and you can't backdate into an anchor. Prospective forgery, not retroactive decryption — nothing already committed is at risk.
The lane we're migrating
Signatures (ECDSA / Schnorr) are what Shor breaks. The fix isn't a second signature — a forger just omits it. It's an anchored key-binding + a cutoff, published before any break and verified by re-deriving it, not by trusting a server.
One profile, two NIST families
A post-quantum key-binding says this classical key → this post-quantum key, dual-signed and anchored. Below are two live bindings from two different NIST post-quantum families — ML-DSA (lattice) and SLH-DSA (hash-based) — landing on byte-compatible content-addresses through the same canonicalization alone. That's the interop proof: {algorithm} is a field, not a fork. Recompute either one in your browser.
To be exact about whose is whose: the SLH-DSA binding is ours — our gateway's KYA-L4 attestor identity; the ML-DSA one is invinoveritas' independent implementation. “Two families” means two independent implementations converging on one profile — not two signatures on every agent.
invinoveritas · ML-DSA-65 (lattice)
Live, OTS-anchored to Bitcoin. Re-derive its content-address + NIP-01 id, verify the ML-DSA-65 companion signature — all in your browser. A different family, the same shared profile.
KYA-L4 · SLH-DSA-SHA2-192s (hash-based)
Our production binding — our gateway's L4 attestor identity, the one key that signs every agent's attestation, bound to a hash-based PQ key. Recompute the content-address + verify the SLH-DSA signature client-side. That classical key is OCP-anchored on Ethereum mainnet, and the anchor tx is sent by that same key — so the on-chain record is the classical proof-of-possession, not a second signature to forge around.
Why two families, not one
In 2026, cryptanalysis from Anthropic cut HAWK-256's estimated key-recovery cost from 264 → 238, and its submission team withdrew HAWK from NIST's additional-signatures process. But the result is structural, not general: HAWK is a Falcon-lineage hash-and-sign scheme on the Lattice Isomorphism Problem — a different problem and construction from ML-DSA (Fiat-Shamir over MLWE/MSIS), so it doesn't reach the finalized standards. HAWK was a candidate, deployed nowhere; the finalized FIPS — ML-KEM, ML-DSA, SLH-DSA — are untouched (withdrawal stated on NIST's round-3 additional-signatures page). The lesson isn't “lattices are broken”; it's that candidates fall and finalized standards hold — a break that depends on lattice structure doesn't transfer to the hash-based lane.
Our design already leans on that twice. The per-agent lane uses ML-DSA-65 — a finalized standard (FIPS 204), not a candidate. And our root attestor identity uses SLH-DSA (FIPS 205), which is hash-based, not lattice at all — a lattice break like HAWK's can't touch it, because its security reduces to plain hash preimage/collision resistance, the same primitive the whole recompute layer already rests on. So even a future weakness in the lattice family leaves the hash lane — and every anchor — standing. Build on what survived the gauntlet, and keep a second, different foundation under it.
Both bindings conform to one shared profile, pq_key_binding.v0, with each pinned as a golden vector anyone can reproduce cold — the conformance suite
We don't say “quantum-proof.” The claim is precise: the recompute layer's trust rests on hashes — the primitive that survives quantum — and here are two post-quantum bindings you can verify yourself. Authentication still uses today's signatures; the recompute layer doesn't need them to prove integrity.
And precise about scope: the binding shown here is our signing identity — the L4 attestor, hash-based (SLH-DSA). Beyond it, per-agent PQ is now live: every agent has its own ML-DSA-65 key, epoch-anchored, signing a companion on every attestation, with an anchor-time cutoff enforcer whose rule you can reproduce against the pinned vectors (hit /pq/agent/<registry>/<id>/enforce/selftest on the gateway). Live enforcement runs in shadow — the verdict is recorded, not yet rejected — until companion coverage is proven, so nothing legitimate breaks in the meantime.
What is not yet verifiable without trusting us, stated because leaving it out would read as coverage: owner authorization is optional and currently held by a minority of agents — the rest are gateway-attested, which is a weaker claim. Rotation and revocation are owner-signed and the gateway refuses any other signer, but those signatures were only persisted from 12 Aug 2026, so earlier transitions read null — that evidence was verified and then discarded, and is gone rather than withheld. And which key governs an artifact still resolves against a value the gateway holds; deriving it from the anchors instead is proposed as v1 and is not live.
No side trusts another's UI: the ML-DSA binding above also recomputes independently on invinoveritas' own origin — api.babyblueviper.com/verify . Two panels, two origins, same raw bytes.