Off-host auth for AI agents: per-message HMACs, nonce/timestamp binding, and a policy engine the model can't tamper with.

Repo for a PQ-hybrid client-side crypto library, with a self-describing, cipher-suite-agile v1 format and legacy v0 decrypts.