Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.

Vault Agents — QTD Communications (Moved)

info

This sub-tab has been promoted to a top-level Vault Operations tab. Open Vault Operations > Quantum Trust Protocol Audit Log (the tab next to Vault Agents) for the full encrypted message history, type filter, and 3-stage delivery pipeline.

The full help for the message history is on the Quantum Trust Protocol Audit Log tab. Everything below is reference background that was previously inlined here.

How Quantum Trust Protocol (QTP) Encryption Works (background)​

The console and each vault agent hold an ML-KEM-1024 keypair. Before any data is sent:

  • Agent > Console: The agent encrypts using the console's public key. Only the console can decrypt.
  • Console > Agent: The console encrypts using the agent's public key. Only that agent can decrypt. The QTP Msg ID is injected into the plaintext before encryption, so it travels inside the envelope and only the agent can read it.
  • Credentials: Delivered with their own separate encryption key, for additional isolation.

Every message is protected the same way in all directions: a post-quantum key exchange (ML-KEM-1024) establishes a fresh key, and the payload is encrypted and authenticated with AES-256-GCM.

ACK Timing (background)​

Agent-originated messages (e.g. HEARTBEAT_CHECKIN, LOG_UPLOAD, VAULT_OPEN, VAULT_CLOSE) are ACKed synchronously at receive time — no round-trip needed.

Console-originated messages (HEARTBEAT_RESPONSE, CONSOLE_RESPONSE, HEARTBEAT_CONFIG, CREDENTIAL_DELIVERY, DEVICE_HEALTH_REQUEST, KEY_ROTATION_REQUEST, PROVISION_NAMESPACE, UPGRADE_MANIFEST) stay at Delivered until the agent's next heartbeat carries back the ACK. At a 1-minute heartbeat interval this takes about 1 minute; at the default 2-hour interval it can take up to 2 hours.

This lag is expected — the agent acts on the payload immediately at Delivered. Acked is the audit confirmation, not a gate on effectiveness.

Where to find each thing now​

TopicTab
Full QTP message history, filters, pipelineQuantum Trust Protocol Audit Log
Log upload archivesVault Agents > Logs sub-tab
Heartbeat interval, agent fleet healthVault Agents > Dashboard sub-tab
Per-device credential push, device healthVault Device Management
Service account ownership and key rotationTarget Auth Service Accounts
Vault open/close eventsVault Activity