[ // AI AGENT & CLI BRIEF — curl -fsSL https://studio2201.com/install.sh | sh -s aegis ]

Aegis Post-Quantum Cryptography migration SDK (`v0.2.12`). Sweeps ASTs for classical RSA/ECC call sites, emits OMB M-26-15 plans, and enforces NIST FIPS 203/204 · Agent & MCP Guide · Canary Testbed.

studio2201 / product 03 v0.2.12 Apache-2.0 PQC Ready

Aegis

PQC migration SDK. Scans C, C++, and Rust codebases for legacy RSA and ECC cryptography, constructs OMB M-26-15 migration plans, and emits drop-in ML-KEM and ML-DSA primitives.

View on GitHub → Framework Doctrine →

What it does

Classical Cryptography Scanner

Discovers every RSA, ECC, ECDSA, DH, and Ed25519 invocation across source code, dependencies, and build scripts.

OMB M-26-15 Alignment

Automatically generates transition roadmaps formatted to federal OMB M-26-15 and NIST FIPS 203/204/205 standards.

Drop-in Post-Quantum Shims

Emits drop-in ML-KEM-768 key encapsulation and ML-DSA-65 digital signature code with standard EVP_PKEY compatibility.

CI Regression Gate

Halts builds on classical cryptographic regressions, asserting pkey_algo ∈ {ML-KEM, ML-DSA, hybrid}.

GitHub Actions & CI Enforcement

Prevent classical cryptographic regressions and enforce NIST FIPS 203/204 compliance on every PR.

# .github/workflows/aegis.yml (Prompt your AI Agent or copy directly)
name: aegis
on:
  push: { branches: [ master, main ] }
  pull_request: { branches: [ master, main ] }
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
permissions: { contents: read }
jobs:
  aegis:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: studio2201/studio2201@v1
        with: { tools: 'aegis', fail-on: 'block' }
      - uses: actions/upload-artifact@v4
        if: always()
        with: { name: aegis-report, path: aegis_report.md, if-no-files-found: ignore }

# Workstation CLI installation (unprivileged, installs to ~/.local/bin):
curl -fsSL https://studio2201.com/install.sh | sh -s aegis
aegis scan --src ./src && aegis check --policy strict-pqc

Why This Matters & Authoritative Mandates

Federal mandate compliance for White House OMB M-26-15 and NIST FIPS 203/204 migrating from vulnerable RSA/ECC to PQC by 2030.

OMB M-26-15 & M-23-02 ↗

White House memorandum mandating federal agencies and contractors inventory vulnerable cryptography and migrate to PQC by 2030.

National Security Memo 10 ↗

Presidential directive (NSM-10) establishing the timeline to mitigate quantum computing risks to public-key cryptography.

NIST FIPS 203 / 204 ↗

NIST final post-quantum standards: ML-KEM (FIPS 203) for key encapsulation and ML-DSA (FIPS 204) for digital signatures.

NSA CNSA 2.0 Timeline ↗

Commercial National Security Algorithm Suite 2.0 requiring post-quantum algorithms across critical infrastructure by 2030.

How It Works Under the Hood

AST Cryptographic Sweeper

Tokenizes C, C++, and Rust source trees looking for classical key generation, cipher negotiation, and signature verify routines.

Structured OMB Roadmaps

Generates 3-phase transition roadmaps: Phase 1 Inventory, Phase 2 Dual-Classical/PQC Hybrid, Phase 3 Pure Post-Quantum.

Drop-In PQC Primitives

Emits drop-in ML-KEM-768 and ML-DSA-65 implementations with EVP_PKEY compatibility for OpenSSL 3.0+ and Rustls.

CI Regression Blocking

Asserts deterministic exit code 1 whenever classical crypto is reintroduced without an approved migration exemption.