Per-message key evolution
Canonical across text, voice, photos, video, and calls. One compromised key exposes one ratchet step.
QERYX DESIGN KIT — WAVE 1 FROZEN CONTRACT
Read every primitive, mounted live.
One black, one green ladder of eight steps, hairlines instead of shadows, square corners everywhere. System monospace carries the whole page. Every glyph you read sits on the ladder — nothing below --text-2 ever carries a word.
KITColor tokens
Color tokens
Surfaces — two blacks + one nested step
--qx-bg
--qx-raised
--qx-raised-2
Serpent alpha scale — bands 1-8
--serpent-a1
--serpent-a2
--serpent-a3
--serpent-a4
--serpent-a5
--serpent-a6
--serpent-a7
--serpent-a8
Serpent solid + accent text
--serpent-9
--serpent-10
--serpent-11
--serpent-12
Hairlines + fills — white alpha
--qx-line-1
--qx-line-2
--qx-line-3
--qx-fill-1
--qx-fill-2
--qx-fill-3
Status wells
--qx-ok-bg
--qx-ok-border
--qx-ok-text
--qx-warn-bg
--qx-warn-border
--qx-warn-text
--qx-err-bg
--qx-err-border
--qx-err-text
Text
--qx-text
--qx-text-2
--qx-text-muted-floor
Green is never prose — no green-prose token exists. #00FF41 is never a fill: accent text, focus, live signal only. Labels on green fills are black (6.75:1).
KITType ramp
Type ramp
display / clamp(3rem, 8vw, 5.5rem) / 600 / -0.035em
The message arrives sealed.
h2 / clamp(1.5rem, 3vw, 2rem) / 600
The relay carries the envelope.
h3 / 1.0625rem / 600
Only your peer opens it.
body / 1rem / 1.6 / #EDEDED / measure ≤ 70ch
The system font stack carries every sentence a visitor reads. It costs zero bytes, shifts zero layout, and leaves the mono voice free to mean one thing: this value is cryptographic.
secondary / 0.9375rem / 55% white
Secondary copy holds captions, descriptors, and quiet context.
mono two-tone / label dim · value white
FIPS 203 ML-KEM-1024 shared secret 32 B
numerals / tabular-nums everywhere
0123456789 · 1,568 B · 626µs · 2-of-3
KITBadges
Badges
Live signal
Q-Ratchet — per message
Research preview
CAVP pending
Revoked
KITStatus wells
Status wells
Verified
Safety number matches. Both devices hold the same session.
CAVP validation pending
AES-256-GCM runs algorithm-conformant; the validation certificate is in progress and gated before any NSS claim.
Signature mismatch
The manifest signature did not verify. Re-run the check against a fresh copy.
Dot + text label carry the state together — never color alone.
KITHero
Hero
Hero specimen
A fresh key for every message you send.
Hybrid X25519 + ML-KEM-1024 agreement,
ChaCha20-Poly1305 sealing, Q-Ratchet
evolution — under every conversation, for everyone.
KITPrimitive strip
Primitive strip
- FIPS 203 ML-KEM-1024
- FIPS 204 ML-DSA-87
- RFC 7748 X25519
- RFC 8439 ChaCha20-Poly1305
- RFC 5869 HKDF-SHA-512
- RFC 9106 Argon2id
KITFeature rows
Feature rows
Sealed before it leaves your hand.
ChaCha20-Poly1305 seals every message on your device. The relay carries the envelope; only your peer opens it.
// Messaging bootstrap — the 1:1 schedule
root = HKDF-SHA-512(x25519_dh || ml_kem_ss,
salt = recipient_fp || SHA-256(eph_pk || ml_kem_ct),
info = "QERYX_SESSION_v4_ROOT", 32)
chain_a = HKDF-SHA-512(root, salt, info = "QERYX_SESSION_v1_CHAIN_A", 32)
chain_b = HKDF-SHA-512(root, salt, info = "QERYX_SESSION_v1_CHAIN_B", 32)
// Call bootstrap — where both peers' seed contributions do enter the key
ikm = hybrid_ss || initiator_seed || responder_seed
send = HKDF-SHA-512(ikm, salt = "ENTANGLED-SESSION-v2", info = "esp-send-key", 32)
recv = HKDF-SHA-512(ikm, salt = "ENTANGLED-SESSION-v2", info = "esp-recv-key", 32)
// After both peers complete the Entanglement Ceremony, the 623-byte canonical's anchor
// folds into the Q-Ratchet chain-key derivation every eight advances; it never enters the root above.One key per message.
Q-Ratchet advances the key with every message you send. Yesterday's key opens nothing today.
KITCrypto cards
Crypto cards
Key transparency
Append-only log whose roots are signed under one operator ML-DSA-87 key, verified against an anchor compiled into the app and cross-checked through gossip. The 2-of-3 witness quorum and its three external Ed25519 auditor slots start dormant, holding placeholder keys until auditors are onboarded.
Three-hop onion routing
Each hop re-encrypts. Once the relays run distributed, no single hop will see both ends of a conversation; in the single-site mode every layer key is registered with one relay. In development — tap through for the route.
KITSpec table
Spec table
| Primitive | Standard | Role | Key facts |
|---|---|---|---|
| ML-KEM-1024 | FIPS 203 | Key encapsulation | pk 1568 B · ct 1568 B · ss 32 B |
| ML-DSA-87 | FIPS 204 | Signatures | pk 2592 B · sig 4627 B · hedged signing |
| X25519 | RFC 7748 | Hybrid key agreement | 32 B public keys |
| ChaCha20-Poly1305 | RFC 8439 | AEAD | 32 B key · 12 B nonce · 16 B tag |
| HKDF-SHA-512 | RFC 5869 | Key derivation | labeled info, domain-separated |
| Argon2id | RFC 9106 | Password hardening | vault floor m=128 MiB · t=3 · p=4, calibrated upward; relay m=64 MiB · t=3 · p=4; local backup m=256 MiB · t=4 · p=2 |
KITStat blocks
Stat blocks
626µs1
added to the handshake by Bell-binding
3
relay hops in the QLEAP circuit design
32 B
session key derived by HKDF-SHA-512; the Bell fold costs one ritual and one extract per epoch — cargo bench --bench bell_integration
KITVerdict table
Verdict table
| QERYX | Classical E2E | SMS-class | |
|---|---|---|---|
| Key material | |||
| Key agreement | X25519 + ML-KEM-1024 hybrid | X25519 | Not included |
| Recording traffic today, decrypting on a quantum computer later | Stays sealed — ML-KEM-1024 | Not included | Not included |
| Per-message key evolution | Included | Included | Not included |
| Server exposure | |||
| What a subpoena of the relay yields | Ciphertext, routing metadata, upload records | Varies by operator | Full content |
| Group membership hidden from the server | Included | Not included | Not included |
| Deletion trace | Hard delete on ack | Soft-hide typical | Carrier retention |
| Transport | |||
| 3-hop onion routing | In development In development | No equivalent No equivalent | No equivalent No equivalent |
Comparisons stay at category level. Absent capability renders the lock glyph with hidden text — never color or shape alone.
KITTab switcher
Tab switcher
KEYGEN. Your device generates an ML-KEM-1024 keypair and an X25519 point. The public halves travel; the secrets never leave your device.
ENCAPSULATE. Your peer encapsulates to your public key. A 1568-byte ciphertext comes back carrying a 32-byte shared secret only your device can open.
DERIVE. HKDF-SHA-512 folds both shared secrets into one 32-byte session root under info = "QERYX_SESSION_v4_ROOT", with a salt that commits to the recipient's bundle and both transmitted values. Both locks must fall for the session to fall.
KITAccordion
Accordion
What can be handed over under subpoena?
Ciphertext blobs plus routing metadata under the published retention ladder. Group names and descriptions and all content are end-to-end encrypted; the group avatar, the admin and owner identifiers, and the roster of accounts each conversation delivers to are held by the relay for routing. A group message, sealed to each member by default, and a message read with Stealth Mode on or read receipts off keep their ciphertext until the 30-day horizon. Each photo, video, file or group voice note is held, encrypted, with an upload record that names its uploader, for up to 45 days after upload unless its sender deletes it sooner.
What happens when I delete my account?
Deletion hard-deletes the server-side record in one transaction and drops your identifier from every roster; the transparency log is append-only and keeps the record that your keys existed. No grace period, no soft-hide.
KITHighlights rail
Highlights rail
KITNumbered section
Numbered section
The handshake
Two independent agreements — X25519 and ML-KEM-1024 — meet in one derivation. An adversary must break both to read a single byte.
KITBento grid
Bento grid
01
Messenger
Text, voice, video — sealed end-to-end, keys evolving per message. The flagship surface every other product orbits.
02
QLEAP
Three hops. Each one re-encrypts. In development.
03
QVault
Secrets that stay on your iPhone, sealed on the device.
04
Zero-knowledge relay
The server moves envelopes it cannot open.
05
Trust
Every claim anchored to an artifact. →
KITCTA ladder
CTA ladder
KITCode block
Code block
# confirm a build matches the signed manifest
scripts/verify-release.sh v1.0.0 qeryx-release.ipa// Messaging bootstrap — the 1:1 schedule
root = HKDF-SHA-512(x25519_dh || ml_kem_ss,
salt = recipient_fp || SHA-256(eph_pk || ml_kem_ct),
info = "QERYX_SESSION_v4_ROOT", 32)
chain_a = HKDF-SHA-512(root, salt, info = "QERYX_SESSION_v1_CHAIN_A", 32)
chain_b = HKDF-SHA-512(root, salt, info = "QERYX_SESSION_v1_CHAIN_B", 32)
// Call bootstrap — where both peers' seed contributions do enter the key
ikm = hybrid_ss || initiator_seed || responder_seed
send = HKDF-SHA-512(ikm, salt = "ENTANGLED-SESSION-v2", info = "esp-send-key", 32)
recv = HKDF-SHA-512(ikm, salt = "ENTANGLED-SESSION-v2", info = "esp-recv-key", 32)
// After both peers complete the Entanglement Ceremony, the 623-byte canonical's anchor
// folds into the Q-Ratchet chain-key derivation every eight advances; it never enters the root above.curl -s https://qeryx.com/.well-known/security.txtKITSkeleton text
Skeleton text
Loading states render as dim ciphertext resolving once over 300ms — the skeleton mirrors final geometry, never a blank hole.
KITEmpty states
Empty states
No devices linked
Devices appear here the moment you pair one.
No matches
Nothing in the index matches that query.
Verification failed
The signature did not match the manifest. Re-run the check against a fresh copy.
Underground
QSeal, Shadow ID, and Ghost Serpent are in development.
KITCTA section
CTA section
Carried sealed. Opened only by you.
QERYX is the herald: it moves your message and holds nothing.
KITObservatory grammar — the station, the pipeline, the rule
Observatory grammar
The four shapes the walk is built from. Every one of them is a global class in observatory.css — a page composes them, never restyles them.
The station marker
03Tech behind — in motion
Format is fixed: NN / TITLE IN CAPS with an optional
qualifier after the em dash. Printing one declares the block it sits in
to the escort rail, so numbering a section and adding it to the walk are
the same act.
The numbered pipeline
1
Measure
The detector returns +1 or −1 at its own angle. Nothing is recorded that a second party did not also record.
2
Extract
SHAKE256 over both peer seeds. The round is reproducible from the seeds alone, by anyone, afterwards.
3
Sign & chain
ML-DSA-87 over the transcript, rounds linked by SHA3-256. Editing one round breaks every link after it.
4
Verify
Recompute the chain, check the signature, fail closed. A verifier that cannot fail is not a verifier.
Use it wherever a mechanism is explained. One boxed numeral, one uppercase verb, one paragraph naming the real primitive.
The coloured rule
The default rule carries a fact the reader must not miss. Green: this is true today, in the present tense.
Amber: the open question — the thing only a decision can close. The canary reissue ceremony has not begun; no date is displayed.
Red: the blocker you must read first. Nothing ships past a red rule until the rule is gone.
Three states, one geometry. Colour is the only thing that moves — which is why the set reads as one object rather than three components.
The honest-status ladder
01
Built
Hybrid key agreement
X25519 + ML-KEM-1024 through HKDF-SHA-512 on every session.
02
Specified
Sealed sender v2 — specified, refused by default
An envelope that blinds the recipient as well as the sender. Implemented, refused by default.
03
Horizon
Operator-signed QPU transcripts
The v2 Bell lane is designed and not active on any deployment; the v1 ritual carries the binding after both peers complete the Entanglement Ceremony.
A rung states what it is. Nothing on this ladder is allowed to read as built until the command that proves it passes.
Border, diamond and glow move together per state, so a reader tells built from planned without reading a word.