01
Bound the hypothesis
Start with a QScout finding, the affected cryptographic surface, the data-retention window, and a falsifiable attack-path question. QStrike does not expand scope without operator approval.
QStrike methodology
Execute the governed attack path. Publish the boundary. Invite falsification.
QStrike methodology: a governed side-channel and ephemeral leak expose nonces, carried through a Hidden Number Problem path and lattice reduction.
Truth boundary: provider names describe quantum-cloud execution paths and published calibration context. They are not evidence of live provider execution, customer runtime, hardware access, or endorsement.
02
Bind the side-channel evidence
Observed algorithms, configurations, dependencies, side-channel evidence, and the ephemeral nonce-information leak remain bound to their approved sources and scope.
03
Run the governed quantum-cloud path
Approved workloads use real commercial quantum-cloud services across four modalities and can use up to 8 access services. QStrike carries the ephemeral leak through a Hidden Number Problem formulation and lattice reduction; it does not directly break encryption.
04
Attack the conclusion
Adversarial review checks alternative explanations, confidence, reproducibility boundaries, and the exact condition that would demote or falsify the evidence-bound conclusion.
05
Deliver a governed decision object
The output ties scope, observed evidence, attack-path inputs, result, confidence, falsification path, remediation owner, and QSolve handoff to one reviewable record.
Minimum evidence record
- Observed
- Approved-scope asset, algorithm, configuration, dependency, and source.
- Execution
- Commercial service, modality, attack-path input, evidence, and runtime version.
- Result
- Conclusion, confidence, alternative explanations, and falsification condition.
- Action
- Remediation owner, dependency, sequence, exit gate, and residual risk.
What the method never upgrades into fact
- A resource estimate for a future machine is not a demonstrated cryptographic break.
- A named commercial service is not proof of customer execution or provider endorsement.
- A commercial quantum-cloud runtime is not customer evidence or proof that a client key was broken.
- The 2029 planning horizon is not a Q-Day prediction.