# R2PQ research baseline — controlled reference v1

## Problem

Source text can resemble cryptographic use without establishing execution. A matching
evidence hash can preserve an incorrect observation. Research therefore needs separate
measurement of discovery semantics, acquisition reproducibility, and verification scope.

## Current baseline

`scanner/scanner_core.py` combines bounded patterns with Python AST checks. Scanner
semantics `candidate-indicators/2` preserves unknown sizes/purposes and treats PQC names
as references. `scanner/merkle_audit.py::canonical_evidence_commitment` commits an
assessment with explicit chain bindings; `receipt_json.py::build_evidence_receipt`
exports leaf hashes, root and proofs. Browser `verifyReceiptV2` reports eight layers
under `r2pq-verification-result/2`. Receipt and leaf encodings remain unchanged.

## Reference experiment

`experiments/reference-v1/cases.json` prespecifies 21 synthetic cases, their ground
truth, expected detections/labels/non-detections and rationale. Expectations were
written before scanner corrections and committed at
`61a70cd476f897e5952146f26cea67170e6c9f52`. The selected failure modes include RSA
parameter confusion, ECDH/ECDSA confusion, false 3DES cipher mapping, and PQC comments
influencing scores. `tools/reference_experiment.py` uses only these local files,
fixed replay time/identifier, stable relative paths and existing commitment APIs.
The harness generates ten inspectable artifacts and verifies them using Python and
the existing JavaScript verifier. The manifest pins exact module and fixture hashes.

## Results

Nineteen cases are inside the declared measurement scope; two are unsupported.
Unit: unique exact label per case and channel, not executed cryptographic operations.
Algorithm candidates: 11 true positives, 1 false positive, 0 false negatives;
precision 11/12 (91.7%), recall 11/11 (100%). PQC textual references: 4 true positives,
0 false positives, 0 false negatives; precision 4/4 and recall 4/4. Exact labels match
18/19 supported cases. These are small designed denominators, not population estimates.

The residual false positive is `unrelated_sha1`: an ordinary function named `sha1`.
AES128-SHA and a dynamically constructed hash alias remain unsupported and are excluded
from recall denominators, not counted as evidence of good coverage. Measurements and
case-level actual/expected sets are in `artifacts/measurement.json`.

Python confirms payload correspondence, root reconstruction and inclusion paths. The
browser confirms format, supplied leaves and proof paths. Its payload, timestamp and
signature layers are NOT PROVIDED, certificate trust is NOT EVALUATED, and provenance
is NOT PROVIDED. Timestamping is NOT EXERCISED IN THIS REFERENCE EXPERIMENT.

## Known limitations

- Selection bias: cases target known defects. No holdout population or real-world rates.
- Name/syntax ambiguity and missing runtime/dependency visibility remain.
- Scores remain uncalibrated heuristics; textual PQC flags no longer lower them.
- One-leaf package. Existing conformance tests separately exercise multi-leaf trees.
- Determinism uses a fixed synthetic clock, report ID, ordering and normalized paths.
  Only Windows/Python 3.12.14/Node 24.16.0 was exercised for this experiment here.
- The unsigned manifest is outside the receipt commitment. Someone can replace the
  entire package; trusted distribution and operator provenance are not established.
- The browser does not implement Python payload canonicalization or a TSA trust store.
- Historical RFC 3161 token fixtures exercise signature/binding separately. They do
  not timestamp this new root or establish current certificate/revocation status.
- SHA-256 commitments and classical signatures are not an end-to-end PQC evidence chain.

## What the evidence establishes

Under the recorded procedure, this synthetic input yields the published observations
and byte-comparable artifacts. The supplied assessment, binding fields, leaf and root
are related by the implemented canonicalization and Merkle procedures. A changed root
is detected when compared with the supplied leaves/proofs. A timestamp token signature
and its root binding are distinct checks in the separately tested historical demo.

## What it does not establish

Assessment correctness, runtime use, discovery completeness, operator identity, actual
acquisition time, trusted TSA identity, real-world precision/recall, migration outcome,
compliance, certification, institutional validation, or government acceptance.
An attacker replacing both content and its unauthenticated commitment is outside the
claimed guarantee. Metadata changes can leave available checks passing by design.

## Research direction

R2PQ is investigating methods for deriving useful, evidence-bounded cryptographic dependency and migration conclusions when available information is incomplete, stale, correlated or contradictory. The research concerns both withholding unsupported conclusions and retaining useful recommendations where the evidence justifies them.

The reference experiment documented above establishes a bounded discovery and receipt-verification baseline. It does not validate dependency inference or migration decisions. Detailed prospective evaluation protocols are outside the scope of this public baseline.