From 72e83cd9813c9d0016974e584e86c7d350ccd6bf Mon Sep 17 00:00:00 2001 From: ahrazzle <38987266+ahrazzle@users.noreply.github.com> Date: Tue, 27 Oct 2026 23:05:43 -0500 Subject: [PATCH 1/2] Record paired candidate scores for rounds four and five --- README.md | 2 ++ research/candidate-rounds-four-five.md | 45 ++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 research/candidate-rounds-four-five.md diff --git a/README.md b/README.md index 00bb792..38813a9 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,8 @@ Graduation at each level is merged work that a computer checked. That record is ## Read more +The [round four and five candidate scores](research/candidate-rounds-four-five.md) preserve both assessments and their differences. + See FOUNDING-BRIEF.md for the full plan: how a project moves through the factory, how the academy works, how the org is funded, and the 90-day plan. See [reviews/](reviews/) for review records: what an attack on a project found, with commands to reproduce it. ## Website diff --git a/research/candidate-rounds-four-five.md b/research/candidate-rounds-four-five.md new file mode 100644 index 0000000..07bbb1c --- /dev/null +++ b/research/candidate-rounds-four-five.md @@ -0,0 +1,45 @@ +# Candidate scores: rounds four and five + +This records the two published assessments of each candidate from [mission issue 19](https://github.com/Proven-Commons/mission/issues/19). Scores are estimates for choosing work, not claims that a library is correct or verified. A higher specification score means a smaller, clearer specification. + +The six axes are harm, reach, specification size, available test oracle, useful slice size and upstream interest. Each runs from 0 to 3, for a total of 18. `Sheet` is the first assessment; `Total` is the second. Disagreements remain visible rather than being replaced by a single unexplained number. + +## Round four + +| Target | Harm | Reach | Spec | Oracle | Slice | Upstream | Total | Sheet | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +| JWS compact | 3 | 3 | 2 | 3 | 3 | 2 | 16 | 16 | +| MQTT 5.0 framing | 2 | 2 | 2 | 3 | 3 | 2 | 14 | 16 | +| NTP packet | 2 | 3 | 2 | 3 | 3 | 2 | 15 | 16 | +| DHCPv4 message | 3 | 3 | 3 | 2 | 3 | 1 | 15 | 15 | +| TLS ClientHello | 2 | 3 | 2 | 3 | 3 | 2 | 15 | 15 | +| XML safe subset | 3 | 3 | 2 | 3 | 2 | 2 | 15 | 14 | +| INI | 2 | 3 | 1 | 2 | 3 | 1 | 12 | 11 | + +[Second assessment and reasons](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6418822706). + +The six format targets now have repositories: [jws](https://github.com/Proven-Commons/jws), [mqtt](https://github.com/Proven-Commons/mqtt), [ntp](https://github.com/Proven-Commons/ntp), [dhcpv4](https://github.com/Proven-Commons/dhcpv4), [clienthello](https://github.com/Proven-Commons/clienthello) and [xml](https://github.com/Proven-Commons/xml). Their plan issues and PRs are the current work records. INI remains a research proposal; no repository is requested here. + +The second assessment corrects the NTP scope to include RFC 7822 extension framing, trailing authentication bytes and zero timestamps as unknown. It also revises several cited failure cases. This page does not repeat the original security citations: the linked assessments preserve the claims and the corrections together. + +## Round five + +| Target | Harm | Reach | Spec | Oracle | Slice | Upstream | Total | Sheet | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | +| Regular expressions, Thompson NFA engine | 2 | 3 | 2 | 2 | 3 | 2 | 14 | 15 | +| SSH wire types and public key blobs | 3 | 2 | 3 | 3 | 3 | 1 | 15 | 15 | +| ELF64 header and section table reader | 2 | 2 | 3 | 2 | 3 | 2 | 14 | 14 | +| Binary property list reader (bplist00) | 2 | 2 | 2 | 3 | 3 | 2 | 14 | 14 | +| JSON Pointer and JSON Patch | 1 | 2 | 3 | 3 | 3 | 2 | 14 | 14 | +| BSON reader and printer | 1 | 2 | 3 | 2 | 3 | 2 | 13 | 13 | +| Cron expressions with next fire time | 1 | 3 | 2 | 2 | 3 | 2 | 13 | 13 | + +[First assessment](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6420742101); [second assessment and reasons](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6426417423). + +[SSH](https://github.com/Proven-Commons/ssh) now has a repository and a merged first slice. The other six rows remain research proposals. JSON Pointer and Patch would first be considered as additions to the existing JSON library; publication of a score does not authorise a new repository or promise an implementation. + +## Earlier proposals and prior work + +Rounds [one](https://github.com/Proven-Commons/mission/issues/12) and [two](https://github.com/Proven-Commons/mission/issues/15) feed the candidate list in PR #16 and its update in PR #21. Those PRs still need their current-main integration and status corrections; this page does not replace their list. + +The [WebAssembly reassessment](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6436747917) is separate from rounds four and five. It distinguishes framing from full module validation and corrects the earlier prior-work summary. It remains research: no WebAssembly repository or novelty claim is approved by this page. From e9b82c7d5cc88b6748d55d529b6571c0dcec58be Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 29 Oct 2026 19:54:35 +0000 Subject: [PATCH 2/2] Bring the round four and five page up to date with review Drop the stale status of #16 and #21 and link CANDIDATES.md, which is on main now. Say that the axis columns are the second assessment and list the first assessment's differing axis scores, name the account that posted both round-five assessments, note the first-pass totals and the old NTP rule in the plan issues, and say decoding rather than validation for WebAssembly. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01QwrvNdsMA6RtgKxXn1Pmhf --- README.md | 2 +- research/candidate-rounds-four-five.md | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 38813a9..92bbc27 100644 --- a/README.md +++ b/README.md @@ -41,7 +41,7 @@ Graduation at each level is merged work that a computer checked. That record is ## Read more -The [round four and five candidate scores](research/candidate-rounds-four-five.md) preserve both assessments and their differences. +The [round four and five candidate scores](research/candidate-rounds-four-five.md) record both assessments' totals and the second assessment's axis scores. See FOUNDING-BRIEF.md for the full plan: how a project moves through the factory, how the academy works, how the org is funded, and the 90-day plan. See [reviews/](reviews/) for review records: what an attack on a project found, with commands to reproduce it. diff --git a/research/candidate-rounds-four-five.md b/research/candidate-rounds-four-five.md index 07bbb1c..84e6010 100644 --- a/research/candidate-rounds-four-five.md +++ b/research/candidate-rounds-four-five.md @@ -2,7 +2,7 @@ This records the two published assessments of each candidate from [mission issue 19](https://github.com/Proven-Commons/mission/issues/19). Scores are estimates for choosing work, not claims that a library is correct or verified. A higher specification score means a smaller, clearer specification. -The six axes are harm, reach, specification size, available test oracle, useful slice size and upstream interest. Each runs from 0 to 3, for a total of 18. `Sheet` is the first assessment; `Total` is the second. Disagreements remain visible rather than being replaced by a single unexplained number. +The six axes are harm, reach, specification size, available test oracle, useful slice size and upstream interest. Each runs from 0 to 3, for a total of 18. The axis columns and `Total` are the second assessment; `Sheet` is the first assessment's total. Where the first assessment scored an axis differently (the issue 19 sheet for round four, the first linked comment for round five), these are its scores: MQTT reach 3 and spec 3, NTP spec 3, XML oracle 2, INI reach 2, and regular expressions oracle 3. Disagreements remain visible rather than being replaced by a single unexplained number. ## Round four @@ -18,7 +18,7 @@ The six axes are harm, reach, specification size, available test oracle, useful [Second assessment and reasons](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6418822706). -The six format targets now have repositories: [jws](https://github.com/Proven-Commons/jws), [mqtt](https://github.com/Proven-Commons/mqtt), [ntp](https://github.com/Proven-Commons/ntp), [dhcpv4](https://github.com/Proven-Commons/dhcpv4), [clienthello](https://github.com/Proven-Commons/clienthello) and [xml](https://github.com/Proven-Commons/xml). Their plan issues and PRs are the current work records. INI remains a research proposal; no repository is requested here. +The six format targets now have repositories: [jws](https://github.com/Proven-Commons/jws), [mqtt](https://github.com/Proven-Commons/mqtt), [ntp](https://github.com/Proven-Commons/ntp), [dhcpv4](https://github.com/Proven-Commons/dhcpv4), [clienthello](https://github.com/Proven-Commons/clienthello) and [xml](https://github.com/Proven-Commons/xml). Their plan issues and PRs are the current work records. The plan issues still give the first-pass totals, and ntp#1 still says an extension field running past the end is rejected; the second assessment's NTP scope below supersedes that. INI remains a research proposal; no repository is requested here. The second assessment corrects the NTP scope to include RFC 7822 extension framing, trailing authentication bytes and zero timestamps as unknown. It also revises several cited failure cases. This page does not repeat the original security citations: the linked assessments preserve the claims and the corrections together. @@ -34,12 +34,12 @@ The second assessment corrects the NTP scope to include RFC 7822 extension frami | BSON reader and printer | 1 | 2 | 3 | 2 | 3 | 2 | 13 | 13 | | Cron expressions with next fire time | 1 | 3 | 2 | 2 | 3 | 2 | 13 | 13 | -[First assessment](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6420742101); [second assessment and reasons](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6426417423). +[First assessment](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6420742101); [second assessment and reasons](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6426417423). Both round-five assessments were posted from the abu-aska account. [SSH](https://github.com/Proven-Commons/ssh) now has a repository and a merged first slice. The other six rows remain research proposals. JSON Pointer and Patch would first be considered as additions to the existing JSON library; publication of a score does not authorise a new repository or promise an implementation. ## Earlier proposals and prior work -Rounds [one](https://github.com/Proven-Commons/mission/issues/12) and [two](https://github.com/Proven-Commons/mission/issues/15) feed the candidate list in PR #16 and its update in PR #21. Those PRs still need their current-main integration and status corrections; this page does not replace their list. +Rounds [one](https://github.com/Proven-Commons/mission/issues/12) and [two](https://github.com/Proven-Commons/mission/issues/15) feed the [candidate list](../CANDIDATES.md). This page does not replace that list. -The [WebAssembly reassessment](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6436747917) is separate from rounds four and five. It distinguishes framing from full module validation and corrects the earlier prior-work summary. It remains research: no WebAssembly repository or novelty claim is approved by this page. +The [WebAssembly reassessment](https://github.com/Proven-Commons/mission/issues/19#issuecomment-6436747917) is separate from rounds four and five. It distinguishes framing from full module decoding and corrects the earlier prior-work summary. It remains research: no WebAssembly repository or novelty claim is approved by this page.