Engineering.
Architecture, configuration and operating detail for Quantum Helix.
Identity & policy
Credential issuance, attestation, federation and the security model.
Communication & integration
Application paths, proxy rules, interface changes and protected information.
Deployment & operations
Installation, local dependencies, signed updates and recovery.
Evidence & verification
Capture scope, signed records and independent review.
Control plane
Resource admission, policy reconciliation and proxy configuration.
Identity issuance, credential rotation and trust bundles. Administrators use the QHx CLI to manage the deployment.
On each node
Local services and workload identification. QHx Attestor can gate node identity issuance using TPM evidence where enabled.
Application traffic
Local application legs need protection. Optional evidence uses a separately configured proxy with Notary, supported middleware and storage; it is not shown on this service path.
Control points
From configuration to communication.
Admission, credential issuance and peer authentication happen at different points in the system. Resource admission and platform attestation are not repeated for every application request.
Admit and configure
Admission control maps principal identity to classification, compartment and releasability labels. QHx Manager can generate Kubernetes NetworkPolicies from those labels. Flowspecs on services describe communication paths; the Manager deploys and configures the proxies.
Issue workload identity
The node authenticates through the configured attestation method. Workload selectors then determine eligibility for a SPIFFE identity and short-lived X.509-SVID. Where enabled, QHx Attestor checks TPM evidence and PCR policy before node identity is issued.
Authenticate the connection
QHx Proxy uses workload credentials and trust bundles to authenticate peers, then carries configured HTTP or TCP traffic through an encrypted tunnel. Flowspecs govern the permitted path. The issuing authority and compatible transport profiles determine which cryptographic algorithms protect that connection.
Record selected exchanges
A proxy with supported middleware and storage can record selected interactions. The workload level signs workload statements; logRequest adds unsigned request records; signRequest signs the request receipt too. The evidence guide describes the current HTTP capture path and its limits.
Identity, connection and permission.
Sensors, applications, AI agents and effectors are built by different organizations. Their software participates in a larger computation. QHx establishes identities for integrated software participants and applies configured rules to their connections; applications enforce the resources and actions available through those services.
Federation lets workloads recognize identities from another authority. It does not itself grant access to services or data. CABE protects messages and objects beyond the connection, with separate decisions about recipient authorization and key access.
Workload identity builds on SPIFFE and SPIRE. QHx combines that foundation with policy and communication controls, federation management, post-quantum cryptographic options, and optional signed records. The guides describe the mechanisms and the responsibilities that remain with the integration.
For a concrete permitted and refused connection, follow the observation-feed example. It shows the operators, local connections, peer checks and identity restriction.
Workload identity depends on the host and the evidence available at issuance. TPM checks can strengthen that evidence, but a compromised host can still impersonate its workloads. Short credential lifetimes do not revoke extracted keys when a process stops.
Root keys, policy authority and trust-bundle freshness remain part of the security model. Disconnected operation requires explicit decisions about expiry, cached trust and recovery.
Threat model and residual risks →Worked integration and design
Worked integrationFollow an observation feed into a separately operated application, then change the recipient.
Design lineageWorkload identity, independent authorities and the conditions under which the architecture remains dependable.
WritingTechnical essays, field notes and company writing.