{
  "tool_id": "art-86-tls-pki-migration-planner",
  "note": "golden_hash empty until first `node golden-parity.test.mjs --update`.",
  "vectors": [
    {
      "name": "default-inputs",
      "policy_parameters": {},
      "output_payload": {
        "migration_plan": [
          {
            "phase": 1,
            "target": "Root CA migration",
            "effort_weeks": 6,
            "notes": "1 root CA(s) — high effort; test in offline environment first"
          },
          {
            "phase": 2,
            "target": "Intermediate CA migration",
            "effort_weeks": 8,
            "notes": "2 intermediate CA(s) — schedule CRL/OCSP updates"
          },
          {
            "phase": 3,
            "target": "Leaf certificate / TLS endpoint rollout",
            "effort_weeks": 6,
            "notes": "1,000 leaf certs — automate via ACME or SCEP where possible"
          }
        ],
        "strategy": "hybrid",
        "payload_impact_bytes": 3565,
        "interop_risks": [
          "Hybrid mode doubles certificate chain size (~2.1× overhead) — verify path length constraints"
        ],
        "rollback_points": [
          "After root CA switch",
          "After intermediate rollout"
        ],
        "estimated_total_weeks": 20,
        "pki_summary": {
          "root_cas": 1,
          "intermediate_count": 2,
          "leaf_population": 1000,
          "tls_versions": []
        },
        "algorithm_refs": {
          "ml_kem_768_pk_bytes": 1184,
          "ml_dsa_65_sig_bytes": 3309,
          "rsa2048_sig_bytes": 256,
          "hybrid_overhead_mult": 2.1
        },
        "inventory_ref": null,
        "reference_version": "2026-06",
        "note": "DECISION-SUPPORT DRAFT. Algorithm sizes from NIST FIPS 203/204 (Aug 2024). Hybrid overhead multiplier is approximate — verify against current PQC overhead benchmarks. Effort estimates are indicative; adjust for organisational capacity and toolchain maturity."
      },
      "golden_hash": "7565fa6ee0146d653d4d5171abe1afe51237a9019166b3c3e688f62522c029aa"
    }
  ]
}