What's new in QNSI

Native-PQC HSM positioning and migration guidance

Published an evidence-backed guide to native-PQC provider adoption and QNSI's HSPK compatibility path. Public claims now distinguish native provider operations, module-certificate ownership, deployment qualification, and QNSI's current ML-DSA-44/65/87 software signing boundary under qualified PKCS#11 custody.

Durable and resumable host discovery

Host scans now checkpoint their deterministic filesystem cursor, resume after interruption, spool signed reports durably, and export bounded signed evidence bundles for controlled transfer from disconnected estates. Import verifies tenant and agent identity, payload integrity, signature validity, revocation state, and bundle reuse before inventory processing.

Durable AI event intelligence and governed remediation

Security operations can now retain and correlate AI and platform events, detect anomalies across services, build root-cause context, and prepare remediation behind tenant authorization and approval gates. The workflow preserves operator accountability instead of turning an AI recommendation into an unaudited production change.

Source-code cryptography discovery is live

The QNSI CLI can scan a repository locally for classical, PQC, and hybrid cryptography usage, emit JSON or a local CBOM, and upload signed findings through a scoped scanner identity. Uploaded findings enter Crypto Inventory as code_repo/code_usage assets and flow into discovery runs, posture, CBOM, and audit evidence. Source code stays in the customer's environment; only normalized findings are uploaded.

Governed migration execution and recovery

PQC migrations now support hash-bound dry runs, four-eyes approval, durable execution waves, pause/resume/cancel controls, per-asset cutover confirmation, lease-based crash recovery, and evidence-backed reconciliation when a provider outcome is ambiguous. Execution history remains readable even when new execution is feature-gated.

QNSI SDK 0.6.0 and MCP 0.2.0

Published @heossihq/qnsi 0.6.0 with the source-code scanner and HSPK client methods, plus @heossihq/qnsi-mcp 0.2.0 with HSPK seal/sign tools. The current HSPK API binds ML-DSA-44/65/87 private-key custody at rest to a qualified PKCS#11 HSM while ML-DSA operations remain in QNSI software.

SDK @heossihq/qnsi 0.5.2

PQC provider bumped to @noble/post-quantum 0.6.1 (the SDK's pure-JS cross-verification engine). NIST ACVP conformance unchanged (noble 435/435). Latest published npm release.

QNSI SDKs live on every registry

One SDK per language, published and installable: @heossihq/qnsi (npm), qnsi (PyPI), qnsi (crates.io), com.heossi:qnsi (Maven Central), the Go module, plus the @heossihq/qnsi-mcp server.

QNSI monorepo bootstrapped

Consolidated the platform into the current monorepo; established the @heossihq/qnsi-* namespace and Changesets-based semantic versioning.