CONTROLLED REFERENCE EXPERIMENT v1

Inspect the input.
Inspect the limits.

A synthetic cryptographic-evidence experiment, with expected observations specified before scanner corrections.

This is a deliberately constructed reference fixture, not a customer assessment or an estimate of enterprise performance. Textual and syntactic indicators do not establish runtime cryptographic use.

What ran

Twenty-one synthetic files → bounded scanner configuration → observations → assessment payload → canonical commitment → one-leaf Merkle root → receipt → Python and browser verification results.

The replay uses a fixed synthetic clock and report ID. No live timestamp was acquired. Timestamping: NOT EXERCISED IN THIS REFERENCE EXPERIMENT.

Measured observations

• 19 supported cases; 2 deliberately unsupported cases.
• Algorithm candidate labels: 11 true positives, 1 false positive, 0 false negatives. Precision 11/12; recall 11/11.
• PQC textual-reference flags: 4 true positives, 0 false positives, 0 false negatives. Precision 4/4; recall 4/4.
• Exact labels match in 18 of 19 supported cases.

The unit is a unique exact label per case and channel. Unsupported cases are visible but excluded from metric denominators. The false positive is an unrelated function named sha1. AES128-SHA and a dynamic hash alias remain unsupported. These small designed denominators do not estimate real-world precision or recall. PQC names do not lower the scanner score.

What can be checked

Python reproduces the payload-to-leaf commitment, root and inclusion path. The browser checks supplied hashes and proofs; it does not reproduce the Python assessment payload. In this package, timestamp and token signature are NOT PROVIDED, TSA trust is NOT EVALUATED, and operator provenance is NOT PROVIDED.

The unsigned manifest is a separate reproduction record outside the receipt commitment. These artifacts do not prove assessment correctness, complete coverage, actual acquisition time, runtime security or migration completion. The evidence chain is not end-to-end post-quantum secure.

Inspect the evidence

Prespecified cases and ground truth · Reference baseline and research direction · Versioned verification contract

• assessment.json
• audit.json
• browser-verification.json
• commitment-envelope.json
• configuration.json
• manifest.json
• measurement.json
• observations.json
• python-verification.json
• receipt.json

Reproduce locally

The source baseline revision and exact module hashes are recorded in manifest.json; the manifest does not claim every module existed at that baseline, and the engineering repository is not public. With Python and Node available, inspect the tools and corpus before running:

python -B tools/reference_experiment.py --check
node tools/verify_reference.mjs experiments/reference-v1/artifacts/receipt.json

The check regenerates ten artifacts in memory and compares their bytes. Source hashes normalize UTF-8 to LF; artifact hashes cover raw bytes. The tested environment was Windows, Python 3.12.14 and Node 24.16.0. Cross-platform replay remains a research question.

To inspect browser checks, open receipt.json, then paste it into the local receipt verifier. The verifier's older timestamp demo is a separate historical fixture and does not timestamp this experiment.

R2PQ claims no government endorsement, compliance determination or institutional validation for this experiment.

Earlier R2PQ websites and protocol/SDK prototypes document historical work. They are not evidence of the current capabilities described here. This site’s reference materials describe the current public baseline.