CRYPTOMAP: Evidence-Driven Cryptographic Dependency Mapping for Post-Quantum Migration

The transition from conventional public-key cryp-tography to post-quantum cryptography (PQC) is becoming an important requirement for organizations operating large and long-lived software systems. Enterprise cryptographic mech-anisms are distributed across source code, libraries, APIs, certificates, keys, TLS/SSL configurations, and infrastructure, making algorithm identification alone insufficient to under-stand migration impact. This paper presents CRYPTOMAP, an evidence-driven framework that combines repository-level cryptographic discovery, dependency-graph construction, deter-ministic migration-impact analysis, and bounded local artificial intelligence for explanation. A progressive repository-reduction pipeline filters repository content before evidence is normalized and represented as a repository-scoped graph. Blast radius, impact, and migration ordering are computed deterministically, while a planned local language model is intended to explain the resulting verified context rather than determine graph facts. The implementation uses Neo4j, PostgreSQL, FastAPI, and n8n. The current implementation was validated with 151 automated tests, all passing. These results establish implementation-level correct-ness of the tested software contracts, not universal cryptographic-detection completeness or enterprise migration effectiveness. The planned local-AI explanation and grounding workflow remains future work.