ArchivioMD: Tamper-Evident Publishing with Post-Quantum Signatures on Commodity Hosting Infrastructure

Independent journalists, human rights documentarians, and at-risk publishers overwhelmingly operate on shared-host WordPress installations nfrastructure they do not control and cannot audit. Existing tamper-evident publishing solutions require dedicated servers, compiled native libraries, or HSM-backed key storage, placing them beyond reach of the population most exposed to infrastructure-level content suppression. We present ArchivioMD, a cryptographic content integrity system deployable on shared-host PHP 7.4+ without native extensions, root access, or Composer dependencies. ArchivioMD combines four composable integrity layers: Deterministic content hashing across 22 algorithms with four-level HMAC hardening Six independent signing methods including a pure-PHP NIST FIPS 205 SLH-DSA post-quantum implementation Simultaneous anchoring to four independent external trust registries via a persistent queue with exponential backoff DANE/DNSSEC key corroboration An OpenPGP identity companion plugin (ArchivioID) adds configurable multi-signer threshold workflows and public proof pages for external verification. This paper formally defines the adversary model across four adversary classes (hostile infrastructure operator, law enforcement with legal compulsion, state-level attacker, and compromised administrator), maps each deployment scenario to its applicable adversary class, and proves that modification is detectable under any single-anchor compromise. Benchmark results are reported across shared hosting, VPS, and dedicated server tiers. The adversarial robustness of the 14-channel steganographic canary token system is analysed, including a formal keyspace proof of approximately 2198 combined subset configurations. To our knowledge, this is the first complete FIPS 205 SLH-DSA implementation deployable on commodity PHP hosting without native library dependencies.