{
    "status": "pilot",
    "generated": "2026-11-03",
    "disclaimer": "Illustrative reference service. Readiness comes only from editor-approved PQC navigator assertions; a product that supports an algorithm does not mean the service can migrate. Dates are unknown unless published; nothing here is agreed between parties. Not compliance advice.",
    "service": {
        "id": "ssh-administration",
        "title": "SSH administration of servers, partly by an outsourced operator",
        "illustrative": true,
        "summary": "Administrators of the organisation and of an outsourced operator reach managed servers through a bastion host run by the operator. Each SSH hop negotiates its own key exchange.",
        "limitations": "A generic template. Only key exchange is covered; no requirement source for post-quantum SSH host or user keys is recorded in this pilot.",
        "compiled": "2026-10-23"
    },
    "components": [
        {
            "id": "admin-clients",
            "label": "Administrators' SSH clients",
            "controlled_by": "Own organisation",
            "function": "SSH key exchange",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "operator-bastion",
            "label": "Bastion host run by the outsourced operator",
            "controlled_by": "Supplier or vendor",
            "function": "SSH key exchange",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "managed-servers",
            "label": "SSH servers on the managed hosts",
            "controlled_by": "Own organisation",
            "function": "SSH key exchange",
            "chosen_release": null,
            "readiness": "No product release chosen",
            "assertion": null,
            "depends_on": [],
            "blocked_by": []
        },
        {
            "id": "kex-agreement",
            "label": "Agreed key exchange methods on each hop",
            "controlled_by": "All parties of the service jointly",
            "function": "SSH key exchange",
            "chosen_release": null,
            "readiness": "No agreement recorded between the parties",
            "assertion": null,
            "depends_on": [
                "admin-clients",
                "operator-bastion",
                "managed-servers"
            ],
            "blocked_by": [
                "admin-clients",
                "operator-bastion",
                "managed-servers"
            ]
        }
    ],
    "plan": [
        {
            "party": "own-organisation",
            "party_label": "Own organisation",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "admin-clients",
            "component_label": "Administrators' SSH clients",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Administrators' SSH clients and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "supplier",
            "party_label": "Supplier or vendor",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "operator-bastion",
            "component_label": "Bastion host run by the outsourced operator",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for Bastion host run by the outsourced operator and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "own-organisation",
            "party_label": "Own organisation",
            "step": "inventory",
            "step_label": "Inventory and scope confirmed",
            "component": "managed-servers",
            "component_label": "SSH servers on the managed hosts",
            "readiness": "No product release chosen",
            "action": "Identify the product and release used for SSH servers on the managed hosts and record it.",
            "state": "can-start",
            "state_label": "Can start now",
            "waits_for": [],
            "waits_for_labels": [],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "configuration",
            "step_label": "Compatible configuration agreed",
            "component": "kex-agreement",
            "component_label": "Agreed key exchange methods on each hop",
            "readiness": "No agreement recorded between the parties",
            "action": "Agree Agreed key exchange methods on each hop between the parties concerned and record who agreed and when.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-admin-clients",
                "c-operator-bastion",
                "c-managed-servers"
            ],
            "waits_for_labels": [
                "Administrators' SSH clients",
                "Bastion host run by the outsourced operator",
                "SSH servers on the managed hosts"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "interop-test",
            "step_label": "Interoperability test",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Run a joint interoperability test of the whole chain in a test environment and record its scope and result.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "c-admin-clients",
                "c-operator-bastion",
                "c-managed-servers",
                "c-kex-agreement"
            ],
            "waits_for_labels": [
                "Administrators' SSH clients",
                "Bastion host run by the outsourced operator",
                "SSH servers on the managed hosts",
                "Agreed key exchange methods on each hop"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "pilot",
            "step_label": "Pilot",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Pilot the service with a limited group, keeping the classical fallback.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-interop-test"
            ],
            "waits_for_labels": [
                "Interoperability test"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "rollout",
            "step_label": "Staged rollout",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Roll out in stages agreed by every party.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-pilot"
            ],
            "waits_for_labels": [
                "Pilot"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "validation",
            "step_label": "Validation",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Validate that the post-quantum mechanisms are actually negotiated or verified on every hop.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-rollout"
            ],
            "waits_for_labels": [
                "Staged rollout"
            ],
            "date": "Unknown: no date published or agreed"
        },
        {
            "party": "joint",
            "party_label": "All parties of the service jointly",
            "step": "retire-legacy",
            "step_label": "Retirement of the legacy fallback, when authorised",
            "component": null,
            "component_label": "Whole service",
            "readiness": "",
            "action": "Retire the classical-only fallback only when every party has authorised it.",
            "state": "waiting",
            "state_label": "Waiting for the items listed",
            "waits_for": [
                "s-validation"
            ],
            "waits_for_labels": [
                "Validation"
            ],
            "date": "Unknown: no date published or agreed"
        }
    ],
    "milestones": [
        {
            "id": "eu-pqc-milestone-2026",
            "date": "2026-12-31",
            "date_text": "By 31 December 2026",
            "title": "EU roadmap milestone 1: first steps and national roadmaps",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        },
        {
            "id": "eu-pqc-milestone-2030",
            "date": "2030-12-31",
            "date_text": "By 31 December 2030",
            "title": "EU roadmap milestone 2: high-risk use cases migrated",
            "type": "Authority guidance target: not a legal deadline and not agreed between the parties"
        }
    ],
    "interop": []
}