ScaffoldBench

RunHaiku 4.5repeat 2

Gated-execute on NIST SP 800-63B password rules, current revision

claude-haiku-4-5-20251001__gated-execute__research-nist-password-rules__r2

Score

1.000

passed
design ran as designed
Cost
$0.092
Latency
1m 19s
setup 0.0s, grading 0.0s
Turns
17
Tool calls
16
Subagents
0
Tokens in / out
156k / 6.8k
129,414 read from cache

Did the design run?

every check held
  • Run completed: heldharness.run-completedThe environment was built, the architecture returned and grading finished, none of them throwing.
  • No API failures: heldharness.apiNo model call failed at the API.
  • Every call ended: heldharness.calls-endedEvery call ended with a result, or was stopped by the run's own limits.
  • No harness tool denied: heldharness.harness-toolsThe sandbox guard never denied a harness tool, nor a tool the session itself offered.
  • Tool servers connected: heldharness.mcp-connectedEvery tool server the harness gave a call was connected when the session started.
  • No foreign tool servers: heldharness.mcp-hermeticNo call loaded a tool server the harness did not give it.
  • Builtin tools: heldharness.builtin-toolsA check recorded with the run.
  • Structured replies arrived: heldharness.structured-outputEvery call that asked for structured output and ran to the end got it.
  • No silent fallbacks: heldharness.not-degradedNo phase fell back on a default (an empty plan, a default winner) instead of its output.
  • Every state change was reviewed: heldgated-execute.reviewedEvery call that changed the world had been allowed by a review before it ran, counted from the world’s own journal.
  • Every decision was read: heldgated-execute.decisionsEvery review that ran to its end gave its decision through the schema; an unreadable one is a denial.
  • Each call was shown the right tools: heldgated-execute.toolsThe executor was shown the task’s full toolset and each reviewer the read-only tools.

Phases

Execute: 0.0s to 1m 19s, finished, 16 tool calls, $0.092

Drawn from the phase records: timing and cost per call, no tool calls or messages.

PhaseDurationCostTurnsToolsModel
Execute1m 19s$0.0921716claude-haiku-4-5-20251001

The call-by-call replay is not published for this run. Traces are large, so the repository keeps 9 of this run set’s 900 and leaves the rest out; the score, phases and final answer on this page come from the committed run record.

Runs you can replay

Record this cell yourself: npm run bench -- run --strategies gated-execute --tasks research-nist-password-rules --models claude-haiku-4-5-20251001 --repeats 1

Score breakdown

  • passtopic single-factor-minimum-length: minimum length of a password used as the only authentication factor (characters)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic maximum-length: the maximum password length verifiers permit (characters)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic composition-rules: imposing composition rules, such as requiring a mix of character types
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic periodic-change: requiring subscribers to change their passwords periodically
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic password-hints: letting subscribers store a password hint that unauthenticated claimants can see
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic security-questions: prompting for knowledge-based authentication or security questions when a password is chosen
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic blocklist: checking a new password against a blocklist of commonly used, expected or compromised passwords
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic password-managers: allowing password managers and autofill
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic salt-length: the length of the salt used when storing passwords (bits)
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

  • passtopic hashing-scheme: using an approved password hashing scheme from the latest revision of SP 800-132
    1.00weight 0.10

    quote verified in nist-sp800-63b-4

Penalties

No penalties were applied.

Scorer metadata

corpus
{"version":2,"snapshot":"2026-10-01","hash":"0786c624b04f6c85e2ed8a55d4acedd99e4cf2c18632a0ebc22ee969fb3e2263","documents":4}
opened documents
["nist-sp800-63b-4"]
opened by role
{"primary":["nist-sp800-63b-4"]}
displayed share
{"nist-sp800-63b-3":0.0014,"owasp-authentication":0.0061,"nist-sp800-63b-4":0.1126,"owasp-password-storage":0.0132}
cited count
1
verified count
1
hallucinated count
0
citation integrity
1
hallucinated urls
[]
answer block
true
answer block repaired
false
items answered
10
item count
10
field accuracy
1
grounded items
10
field misses
{}

Final answer

Based on my research of the current revision of NIST SP 800-63B-4 (Revision 4), I have found all the password requirements from section 3.1.1.2 and the hashing section. The document was published on August 26, 2025, and supersedes all previous versions.

Here are the findings for each topic:

single-factor-minimum-length: The requirement is that passwords used as a single authentication factor must be a minimum of 15 characters in length. This represents a significant increase from previous revisions.

maximum-length: The requirement uses SHOULD (permissive) to recommend allowing at least 64 characters as the maximum length, not prohibiting longer passwords.

composition-rules: The current revision explicitly forbids imposing composition rules such as requiring mixes of character types.

periodic-change: Password changes are not required periodically; however, verifiers must force a change if compromise is detected.

password-hints: Hints that are accessible to unauthenticated claimants are prohibited.

security-questions: Knowledge-based authentication (KBA) or security questions are explicitly prohibited when choosing passwords.

blocklist: Verifiers must check new passwords against a blocklist of commonly used, expected, or compromised passwords.

password-managers: Password managers and autofill functionality must be permitted and supported.

salt-length: The salt used when storing hashed passwords must be at least 32 bits in length.

hashing-scheme: An approved password hashing scheme from the latest revision of SP 800-132 should be used.

{"answers":[{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., \"What was the name of your first pet?\") or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}]}

Provenance of the numbers on this page

run set
scaffold-or-scale-v1
models
Haiku 4.5, Sonnet 5.5, Opus 5.5
effort
high
repeats
2
fixtures
replay
runs
900 / 900
strategy cost
$354.44
judge cost
$9.19
wall clock
9h 48m
git
fce5807b2d

Cost excludes judge calls, which are tracked separately so a scoring model never flatters or penalises an architecture. Every figure on this site is read from results/ at build time.