Engagement Policy

Non-destructive envelope

Default mission class is maximum non-destructive. QHunt, QScout, QStrike, and QSolve run only against systems the customer owns or has explicit written authorization to assess. Approved targets, methods, exclusions, and stop conditions are named before work starts. Activity outside attested scope is stopped.

• Operator attestation and approved scope bound every engagement
• Non-destructive techniques may run inside that attested boundary
• Out-of-scope recon, credential guessing, protected-data access, and stop-condition crossings are prohibited
• Assessment for air-gapped, restricted, or on-premise mission systems is delivered operator-to-operator inside the customer boundary — not as a hosted inventory service

Dual attestation for destructive action

Destructive action is not a configuration toggle. The operating classifier refuses a destructive mission unless both attestations are present: a destructive-mission attestation and a separate I-attest-destructive attestation. Either flag alone is refused as destructive_mission_requires_dual_attest. That dual gate is what keeps a single incomplete authorization from widening the envelope.

Public QHunt and QScout launches remain pinned to the maximum-non-destructive contract unless that dual attestation is complete and in-scope. See also the consent boundary.

Signed inventory format

QHunt engagements produce a cryptography bill of materials in CycloneDX 1.7, signed with ML-DSA-65 under FIPS 204. The public format sample is temporarily withdrawn while publication controls are reconciled. It is a machine-readable engagement output for authorized technical review — not software to run, a customer inventory, or a mission-system scan result.

• Public QHunt CBOM sample — temporarily withdrawn for publication-control review.
• Current glossary and mission terms
• Consent boundary
• Trust Center

Next action

Request a scoped engagement. Authorization and boundary are confirmed before anything runs.