INVITE ONLY
OBSERVATORY

Download

Verify what you install.

Every distribution path serves byte-identical signed binaries — an ML-DSA-87 release manifest and a SHA-256 digest you check yourself.

iOS — closed beta Android — in development

01 / DISTRIBUTION — WHAT IS REAL TODAY

See exactly where QERYX runs today.

Access is invited, never bought. iOS runs in a closed TestFlight beta — build 21, signed 2026-07-16. The public invite link appears here the day it exists, and no sooner.

  1. iOS

    Closed beta — TestFlight

    QERYX for iOS is in closed TestFlight beta — build 21, signed 2026-07-16. It requires iOS 17 or later.

    The App Store listing follows beta stabilization and carries the same signed binary.

    Request a beta seat

  2. Android

    In development

    The Android client is in development in the same tree, on the same crypto-core — ML-KEM-1024, ML-DSA-87, X25519, ChaCha20-Poly1305 behind one FFI surface.

    Direct signed APK and F-Droid channels open with the Android release; the F-Droid metadata is already authored in-tree. No store badge renders here until the binary is real.

02 / VERIFICATION — THREE CHECKS

Trust the manifest, never the mirror.

Public releases begin at v1.0.0. Each one ships a release manifest signed under ML-DSA-87 (FIPS 204 context framing) listing the SHA-256 of every artifact, with an anchor into the KTS transparency log. Run the verifier against anything you download:

verify a release 
bash scripts/verify-release.sh --tag v1.0.0 \
  --artifact qeryx-1.0.0.ipa --check-kts

  1. Signature

    The manifest signature verifies under the QERYX release-signing key — ML-DSA-87, FIPS 204.

  2. Digest

    The artifact's SHA-256 must match an entry in the signed manifest.

  3. Anchor

    --check-kts confirms the manifest is anchored in a witness-bundled KTS root.

Nothing public to verify yet

The signing pipeline and this verifier exist in the tree today; the first public manifest ships with v1.0.0. Until then there is nothing public to verify, and this page will not pretend otherwise.

The deeper path — rebuilding from source and byte-comparing — lives at reproducible builds.

03 / THE HARD QUESTIONS

Ask the four that decide it.

When does the App Store listing open?

After the closed beta stabilizes. The listing carries the same signed binary as TestFlight. No date ships on this page until it is real.

Why is there no Android download button?

Because there is no Android build to give you yet. A path renders here only when the binary exists — the client is in development on the same crypto-core, and this page changes the day it ships.

Is there an onion mirror?

Not yet. When the onion service is provisioned, the address ships here and in the footer — roadmap, stated as roadmap.

Does store removal kill QERYX?

Distribution independence is designed in: direct signed artifacts and F-Droid metadata are first-class paths, and every path serves the same manifest-verified binary. A store is a mirror, never the source of trust.

Take a seat in the beta.

iOS closed beta, build 21. Bring a device on iOS 17 or later — and the people you message, because the seal needs both ends.

Request beta access Read the build proof

Next: Changelog