Q-Day Ledger™

The deadlines are already law

Before any of it can be fixed, one question has to be answered: what cryptography do we actually run — and when must each piece change? Done by hand, that is months of manual inventory work. Q-Day Ledger does it in an afternoon.

What it does

1. Finds everything. Four scanners inventory your source code, live TLS endpoints, certificates and firmware signatures, and third-party libraries and SBOMs — every finding with the exact evidence attached.
2. Scores the risk. Every asset receives a documented, reproducible 0–100 score plus a harvest-now-decrypt-later class. No unexplained numbers.
3. Writes the plan. Each asset mapped to its governing mandate (CNSA 2.0 · EO 14412 · NIST IR 8547 · NSM-10), sequenced into four phases, every line carrying its FIPS 203/204/205 replacement and its deadline.
4. Packs the proof. One command exports a CycloneDX 1.6 CBOM and an auditor evidence pack, including a procurement questionnaire answered from your own inventory.

Your code never leaves your machine

See it run

The package includes a bundled sample target and a one-command demo (./demo.sh) that inventories 37 assets and produces the full plan, CBOM, evidence pack, and report. The figures below are unedited output from that demo.

The migration plan, excerpted (Phase 1 of the demo run)

Phases 2–4 sequence the remaining assets against the 2030 wall, the 2031 signature wave, and the 2033–2035 completion window.

The CBOM, excerpted (CycloneDX 1.6)

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "metadata": {
    "tools": [
      { "vendor": "J-Dawgs Industries",
        "name": "Q-Day Ledger",
        "version": "1.0.0-vault1" }
    ]
  },
  "components": [
    {
      "type": "cryptographic-asset",
      "name": "AES",
      "cryptoProperties": {
        "assetType": "algorithm",
        "algorithmProperties": { "primitive": "encryption" }
      }
    }
    // … one component per inventoried asset
  ]
}

Who it is for

• Federal contractors and subcontractors facing the 2030 deadlines — especially the below-enterprise tier the large platforms do not aim at.
• Vendors selling software, firmware, or networking into national-security supply chains.
• Banks, health systems, and any organization holding data that must stay secret for 10+ years.
• Auditors and consultants producing these inventories for clients — in days, not months.

Verify it yourself

The engine is verifiable byte-for-byte against its sealed build manifest (sha256sum -c MANIFEST.sha256). A 26-test suite is included and verified passing on the shipped package. The full prediction behind this product — with its evidence, its confidence level, and its failure modes — is published in the research dossier that ships in the package.

How this could be wrong — stated plainly

Governments have slipped crypto deadlines before; a formal deferral would soften the 2028–2030 demand crest (the need survives; the urgency moves). If the large platforms ship a free, good-enough inventory inside their enterprise stacks, the independent-tool window narrows to the multi-vendor, below-enterprise tier — the tier this tool is built and priced for. The mandate dates are published law and policy: facts. What the market does with them is a prediction, labeled one everywhere it appears, including in our own sales forecast.

Editions and pricing

One-time payment. No subscription, no per-seat metering, no renewal. Your outputs belong to you; we claim the software, never your data.

Delivery: q-day-ledger-v1.zip — the complete tool, quickstart, license, bundled sample target with demo outputs, and the research dossier. Card purchases are delivered by email immediately after payment; Gumroad purchases download directly from Gumroad.