Hybrid Transition Patterns
How to run hybrid cryptographic states safely while migrating production systems to post-quantum-ready policy.
Build applicability: the released v0.5.5 native catalog identifies the executable options for each build. Read the exact primitive/TLS catalog and runtime prerequisites before applying this planning guidance. Hybrid TLS key establishment does not make certificate authentication post-quantum; native Messenger and each other protocol require separate verification.
Citation-ready summary
- The supported hybrid TLS 1.3 group combines X25519 and ML-KEM-768 in one key exchange. Separately allowing a classical group is a policy choice; a required-hybrid policy rejects classical-only peers.
- Axis control-plane policies define which workloads enter hybrid mode and for how long.
- Aegis enforcement telemetry and rollout receipts determine whether hybrid state can be narrowed or expanded.
TL;DR for security leaders
Set compatibility and health criteria for each reviewed target cohort. Hybrid key establishment is a cryptographic construction; a phased rollout controls where that construction is enabled.
TL;DR for engineers
Implement workload cohorts, compare success/error/latency across cohorts, and trigger rollback automatically if thresholds are exceeded.
Pattern catalog
- Dual-stack pilot for low-risk internal services.
- Customer-segment canary with explicit policy rollout receipts.
- Protocol-by-protocol promotion where interoperability risk is high.
- Emergency rollback profile pre-approved in Axis.
Definition alignment: glossary.
Terminology alignment
Use glossary definitions for Aegis, Axis, control plane, enforcement plane, rollout receipts, and PQ migration.
Next related reading
Next: rollout runbook • Executive FAQ • Evidence: deployment validation • Glossary