Cyber Defence: find the weak cryptography first, and keep the evidence.

A tool for an offline machine lists the cryptography in a system's keys, certificates, dependencies, settings and compiled code, asks running services what they negotiate without completing a connection, and writes the findings as a migration plan, key exchanges first.

A device keeps a log chained entry to entry with signed post-quantum checkpoints, so a cut, a swap, a change or a dropped end is visible.

Since 5 November 2026 another device or a station can witness a device's log: it countersigns what it was shown and refuses a shorter log or a second version of the same history, so a captured device cannot quietly rewrite its own past once a witness has seen it.

Every security test in our source was first shown to fail against a deliberate break in the code it guards; the breaks are kept as records and a share of them is planted again regularly.

Since 5 November 2026 several devices' signed logs become one timeline: each log checked against the device's key, each entry marked signed or not yet signed, and what two devices both recorded linked. A changed or forged log is refused whole.

Since 6 November 2026 the timeline also says which events the logs themselves prove came before which: where one device recorded another's entry, or a witness vouched for it, the order is proved; elsewhere the order is only each device's own clock, and is labelled so. A clock the proof contradicts is named. Two copies of one device's log that disagree are shown as two histories that device signed.