q* stdlib roadmapqpkgs
The shared substrate, honestly tracked.
The 13 zero-dependency q* crates — qexec and qvalue plus the focused utilities — are shipping today and shared across every product. The planned work is the cryptographic primitives the security model needs, self-implemented behind the Crypto provider trait: the hash/KDF family, ChaCha20-Poly1305, Shamir, Ed25519, and ML-KEM/ML-DSA. No dates promised — only state.
Status board
Built, in progress, and planned
Three lanes, no dates. All 13 crates are present and usable now; cryptography sits behind a provider trait so it can grow without churn; the planned lane is the crypto order from the security docs, each primitive self-implemented with known-answer tests and a constant-time audit.
Shipping today
Present in the codebase and usable now.
- qexec — the bounded executorThe single chokepoint to the engine: one execute primitive and one function registry (static + dynamic), bounding memory and work per call.
- qvalue — the value model + ABIThe arbitrary-precision value model that every function speaks; the ABI that crosses the execute boundary.
- qarray, qobject, qstringCollection and text utilities over the qvalue model — array, object, and string operations, all QQL-callable.
- qmath, qnumber, qconvertNumeric and conversion utilities: math operations, number handling, and value coercion.
- qencoding, qregexEncoding/decoding (base/hex/JSON-shaped) and a from-scratch regex engine.
- qtime, quuidTime/duration handling and UUID generation — no system-clock or RNG crate dependency.
- qcrypto — the Crypto trait + base primitivesThe provider-trait seam that keeps cryptography swappable (the sole sanctioned dependency surface), with the primitives needed by auth today.
In progress
A working seam exists; the rest is designed, not yet built.
- Crypto behind a provider traitCryptography lives behind the Crypto trait so the implementation can be swapped without touching callers; today it carries the HMAC path auth relies on.
Planned
Designed but not yet built — no dates promised.
- SHA-512 / HMAC-SHA512 / HKDF / PBKDF2The hash + key-derivation family, self-implemented with known-answer tests and constant-time review, first in the crypto order.
- ChaCha20-Poly1305Authenticated encryption for at-rest secrets (the per-key sign_secret and the master seed).
- Shamir Secret SharingM-of-N splitting of the master seed for the custodian ceremony — any one of passkey-PRF, a second passkey, or a BIP39 plate recovers a share.
- Ed25519 / ES256 verifySignature verification for request signing and tokens, dispatched through the one before-auth security funnel.
- ML-KEM-768 / ML-DSA-65 (PQC)Post-quantum key encapsulation and signatures for API keys and tokens, behind the verify_request seam.
The crypto order is sourced from the repo's PENDING list and the architecture; the dependency arrow points one way — products depend on q*, never the reverse.