2,071
Tests Passing
Zero regressions
GREEN
Posture Score
CRIT=0 HIGH=0
12/14
CRQC Items Closed
2 planned DW-1/DW-2
~23%
NIST 800-53 Coverage
31 of ~300 controls
~40%
CMMC L2 Coverage
~44 of 110 practices
MODERATE
FIPS 199 Category
Integrity: HIGH
FIPS 205
Signature Standard
SLH-DSA deployed
✅
PIPEDA Compliant
Zero PII collected
System Description
| System Name | Shadow313 / VANGUARD-313 |
| Owner | mohamad — Ottawa, ON, Canada |
| Environment | Cloud (Vercel) + Local (Docker) |
| Boundary | shadow313.dev, shadow313.com, local CLI |
| Status | Operational |
| Classification | Sensitive — Security Intelligence |
| Air-gap capable | Yes — zero cloud dependency |
⭐ Genuine Strengths (Exceeds Baseline)
| Post-Quantum Crypto | FIPS 203/204/205 — 4+ years ahead of CNSA 2.0 |
| AU-9/AU-10 | SLH-DSA + IPFS + 313-BIND — quantum-resistant |
| SI-2 Flaw Remediation | SDS=0, 2,071 tests, posture GREEN |
| CRQC Migration | 12/14 items closed — ahead of 2030 deadline |
| CMMC Audit Packages | S313-CMMC-AUDIT-v1 — 3PAO-verifiable offline |
| PIPEDA | Zero PII collected by design |
Authorization Boundary
┌─────────────────────────────────────────────────────────────────────────┐ │ AUTHORIZATION BOUNDARY │ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────────────────┐ │ │ │ Vercel Edge │ │ Azure AD B2C │ │ Azure Key Vault (FIPS │ │ │ │ (CDN + API) │◄──►│ (OIDC Auth) │◄──►│ 140-2 HSM) │ │ │ └──────────────┘ └──────────────┘ └──────────────────────────┘ │ │ │ │ │ ▼ │ │ ┌──────────────────────────────────────────────────────────────────┐ │ │ │ LOCAL SHADOW313 CLI (Operator Machine) │ │ │ │ NEXUS Engine │ Ghost-Watch │ 313-BIND │ VSAT │ Aegis PQC │ │ │ │ Air-gap capable — zero cloud dependency for core operations │ │ │ └──────────────────────────────────────────────────────────────────┘ │ │ │ │ External (outside boundary): OpenAI API │ IPFS │ Hugging Face │ └─────────────────────────────────────────────────────────────────────────┘
Plan of Action & Milestones (POA&M)
| Priority | Control | Gap Description | Target Date | Effort | Status |
|---|---|---|---|---|---|
| P1 | CA-2, CA-6, CA-7 | Engage 3PAO; document ConMon plan; obtain ATO | Q4 2026 | High | Planned |
| P1 | AT-1, AT-2, AT-3 | Create security awareness training program + records | Q4 2026 | Medium | Planned |
| P1 | PS-1 through PS-8 | Draft personnel security policy + access agreements | Q4 2026 | Medium | Planned |
| P1 | IR-1, IR-2, IR-8 | Formalize IR Plan document; schedule tabletop exercise | Q4 2026 | Low | Planned |
| P1 | DW-1: liboqs ML-DSA | Replace HMAC-SHA3-256 proxy with real ML-DSA-65 via liboqs | Q4 2026 | High | Planned |
| P2 | PL-1, PL-4, PL-8 | Rules of Behavior doc + system security architecture | Q1 2027 | Low | Planned |
| P2 | SA-1, SA-9 | External system service agreements; SA policy | Q1 2027 | Medium | Planned |
| P2 | MA-1, MA-2, MA-4 | Maintenance policy + controlled maintenance procedures | Q1 2027 | Low | Planned |
| P2 | MP-1 through MP-7 | Media protection policy + sanitization procedures | Q1 2027 | Low | Planned |
| P2 | SR-1, SR-2, SR-3 | Supply chain risk plan (Vercel, Azure, pyspx, IPFS) | Q1 2027 | Medium | Planned |
| P2 | CP-1, CP-2, CP-4 | Contingency plan document + test (BCP/DR) | Q1 2027 | Medium | Planned |
| P2 | DW-2: HSM key storage | Migrate in-memory keys to Azure Key Vault HSM | Q1 2027 | High | Planned |
| P3 | AU-1, AU-4–AU-8, AU-12 | Audit policy + log management enhancements | Q2 2027 | Low | Planned |
| P3 | CM-1, CM-3, CM-4 | Change control process; configuration mgmt policy | Q2 2027 | Low | Planned |
| P3 | SA-11 (3PAO pentest) | Third-party penetration test engagement | Q1 2027 | High | Planned |
| Done | AC-12 Session Termination | Complete logout all devices | ✅ Done | — | Complete |
NIST 800-53 Rev 5
~23%
31 of ~300 controls
FedRAMP Moderate
~20%
~65 of 323 controls
CMMC Level 2
~40%
~44 of 110 practices
Documented Families
~86%
Within 9 documented families
CRQC Migration
12/14
2 planned (DW-1, DW-2)
PQC Standards
100%
All three NIST PQC standards
CMMC Level 2 Domain Coverage
IR (Incident)
100%
AU (Audit)
56%
RA (Risk)
67%
SI (Integrity)
43%
CM (Config)
44%
AC (Access)
23%
IA (Identity)
27%
SC (Comms)
25%
AT (Training)
0%
MA (Maint.)
0%
MP (Media)
0%
CA (Assessment)
0%
Cryptographic Component Inventory (FIPS 203/204/205)
| ID | Algorithm | Standard | Purpose | Key Size | Quantum Safe | HNDL Window | Status |
|---|---|---|---|---|---|---|---|
| CS-001 | SLH-DSA-SHAKE-128f | FIPS 205 | Signing (313-BIND) | 256-bit | ✅ Yes | N/A | ACTIVE |
| CS-002 | ML-DSA-65 (proxy→liboqs) | FIPS 204 | Plugin/Ledger signing | 256-bit | ✅ Yes | N/A | DW-1 Q4'26 |
| CS-003 | AES-256-GCM | FIPS 140-3 | Session encryption | 256-bit | ✅ Yes | N/A | ACTIVE |
| CS-004 | Argon2id | RFC 9106 | Key derivation | 256-bit | ✅ Yes | N/A | ACTIVE |
| CS-005 | SHA3-256 | FIPS 202 | Hashing (all paths) | 256-bit | ✅ Yes | N/A | ACTIVE |
| CS-006 | SHA3-512 | FIPS 202 | Chain hashing | 512-bit | ✅ Yes | N/A | ACTIVE |
| CS-007 | HMAC-SHA256 | FIPS 198-1 | Ephemeral MACs | 256-bit | ✅ Yes (sym) | N/A | ACTIVE |
| CS-008 | ECDSA P-256 (cosign) | FIPS 186-5 | Plugin signing (legacy) | 256-bit | ❌ No | 2030–2033 | DEPRECATED |
| CS-009 | ML-KEM-1024 | FIPS 203 | Key encapsulation | 1024-bit | ✅ Yes | N/A | ACTIVE |
CRQC Migration Status (NIST IR 8547)
| Item | Vulnerability | Algorithm | Fix Applied | Status |
|---|---|---|---|---|
| CRQC-001 | ECDSA P-256 cosign primary | ECDSA → ML-DSA-65 | MLDSATrustRegistry wired as primary | ✅ Closed |
| CRQC-002 | SHA-256 ledger payload_hash | SHA-256 → SHA3-256 | ledger_engine.py patched | ✅ Closed |
| CRQC-003 | SHA-256 ledger entry signature | Hash → ML-DSA-65 | ML-DSA-65 signing via HardenedKeyInfra | ✅ Closed |
| CRQC-004–008 | SHA-256 various paths | SHA-256 → SHA3-256 | 6 files patched (temporal, ghost, workflow) | ✅ Closed |
| CRQC-007 | PBKDF2-SHA256 session keys | PBKDF2 → Argon2id | crypto_store.py: 64MB Argon2id | ✅ Closed |
| CRQC-012 | HMAC fallback (air-gapped) | HMAC → SLH-DSA | pyspx 3-tier fallback chain | ✅ Closed |
| DW-1 | HMAC proxy for ML-DSA-65 | HMAC-SHA3 → liboqs | Requires C build env (Q4 2026) | 🔄 Planned |
| DW-2 | In-memory key material | Memory → HSM | Azure Key Vault HSM (Q1 2027) | 🔄 Planned |
System Interconnections
System
Data Flow
Security Controls
Boundary
Azure AD B2C
Auth tokens (inbound) — OIDC federation
TLS 1.3, OIDC, MFA, rotating refresh tokens
Inside
Azure Key Vault
Secrets (inbound) — Managed Identity
FIPS 140-2 HSM, Managed Identity, RBAC
Inside
Vercel CDN
Static assets (outbound) — CDN delivery
TLS 1.3, CSP headers, no security data
Outside
OpenAI API
Chat queries (outbound) — AI inference only
TLS 1.3, no security data transmitted
Outside
IPFS Network
Receipt anchors (outbound) — public data only
SLH-DSA signed, SHA3-256 CIDv1, public data
Outside
Hugging Face
Detection target only — not used by platform
N/A — detection target, no data flow
Outside
External Service Risk Assessment (SA-9)
| Service | Data Sensitivity | Formal Assessment | Risk |
|---|---|---|---|
| Azure AD B2C | Auth tokens only | Microsoft FedRAMP High P-ATO | Low |
| Azure Key Vault | Secrets (FIPS HSM) | Microsoft FedRAMP High P-ATO | Low |
| Vercel | Static assets only | SOC 2 Type II — no FedRAMP | Medium |
| OpenAI API | Chat queries (no security data) | SOC 2 — no FedRAMP | Medium |
| IPFS | Public data only (receipts) | Decentralized — no formal assessment | Medium |
| pyspx (library) | Cryptographic operations | Open source — supply chain risk | High (SR-3) |
Coverage Summary by Framework
NIST 800-53 Rev 5
~23%
FedRAMP Moderate
~20%
CMMC Level 2
~40%
Within 9 Families
~86%
PQC (FIPS 203/4/5)
100%
Undocumented NIST Families (Zero Coverage)
| Family | Key Controls | Risk | Notes |
|---|---|---|---|
| AT — Awareness & Training | AT-1, AT-2, AT-3, AT-4 | Critical | No training program documented |
| CA — Assessment & Auth | CA-1 through CA-9 | Critical | No ATO, no ConMon plan — FedRAMP blocking |
| MA — Maintenance | MA-1, MA-2, MA-4, MA-5 | High | No maintenance policy |
| MP — Media Protection | MP-1 through MP-7 | High | No media sanitization controls |
| PS — Personnel Security | PS-1 through PS-8 | High | No screening, no access agreements |
| SR — Supply Chain Risk | SR-1, SR-2, SR-3, SR-5 | Medium | New Rev 5 family — entirely undocumented |
| SA — System Acquisition | SA-1, SA-9, SA-11 | Medium | SA-11 in POA&M SA-9 critical for Vercel/Azure |
| PE — Physical & Env. | PE-1, PE-6 | Low | Cloud-inherited — document inheritance |
Key Insight: Documentation Gap, Not Technical Gap
The primary path to FedRAMP Moderate authorization is documentation and governance, not technical implementation.
The cryptographic posture (FIPS 203/204/205, SLH-DSA, Argon2id, SHA3-256 throughout) already exceeds FedRAMP Moderate technical requirements.
What's missing: Policy documents for each control family (1–3 pages each),
training records (AT-2 requires annual completion evidence),
3PAO engagement (CA-2/CA-6 are process gates),
contingency plan (CP-2 is a document, not a system change),
and personnel security (PS controls are HR processes).
Estimated effort to FedRAMP Moderate readiness: 6–9 months of documentation + 3PAO engagement.