Cryptographic primitives
Randomness abstraction, hashing, KDF, KEM, digital signatures, AEAD and key serialization. The module does not own key lifecycles or OS access.
/ engineering / system design
One core. Clear layers. Explicit boundaries.
NEXUS-Q follows a library-first, four-layer architecture. Interfaces consume the public Rust API; the core depends on backend traits; only backend implementations talk to operating systems, filesystems or devices.
/ system map
The four layers
Conceptual view based on the repository architecture document. It shows responsibilities and dependency direction, not a claim that every optional backend or SDK is shipped on every platform.
L4
Consumers
CLI · nexusqHTTP / IPC serverRust library · C FFI · limited Python bindingSDK interfaces (availability varies)
PUBLIC LIBRARY API ↓
L3
NEXUS-Q Core · libnexusq
CryptoVaultIdentityPolicyStorageAudit subsystemHardware traits
BACKEND TRAITS ↓
L2
Backends
Software backend · OS RNGFile storageIn-memory vaultHardware-provider interfacesTPM / HSM / Secure Element adapters where implemented
PLATFORM SYSCALLS / DRIVERS ↓
L1
Platform
LinuxAndroid / TermuxmacOSWindowsx86_64 · ARM · RISC-V targets (support varies)
/ core responsibilities
What lives in the core
Secrets and lifecycle
Encrypted vault operations and key lifecycle management, with versioned persistent formats and atomic-write design.
Identity and credentials
Signing, verification, rotation, revocation and signed credential workflows.
Fail-closed decisions
Policy checks gate operations. Errors should fail closed rather than return partial plaintext or silently downgrade.
Persistent state
Versioned vault, envelope and storage formats; storage owns the audit subsystem.
Tamper evidence
HMAC-authenticated audit events and a persisted vault-state anchor help detect tampering, rollback or truncation within the documented model.
/ architectural guardrails
Boundaries matter more than boxes
Library-first
CLI and server are consumers of the Rust library, not separate cryptographic implementations.
Hardware-agnostic interfaces
Traits define extension points. Their existence does not mean every TPM, HSM, enclave or Secure Element has a supported, tested production adapter.
Best-effort zeroization
Secret material is cleared when no longer needed where the platform permits; this is not a guarantee against a compromised OS or process.
Versioned data formats
Persistent formats carry version information; migrations are treated as an explicit compatibility concern.
Security boundary: architecture is not a security audit. NEXUS-Q does not claim an independent external audit or FIPS 140-3 certification. Hardware abstraction is not equivalent to hardware-backed isolation.
Primary source: docs/ARCHITECTURE.md at v4.1.2 ↗. Also see security model ↗.