RunHaiku 4.5repeat 1
Orchestrator-workers on NIST SP 800-63B password rules, current revision
claude-haiku-4-5-20251001__orchestrator-workers__research-nist-password-rules__r1
Score
1.000
passed
design ran as designed- Cost
- $0.243
- Latency
- 1m 42s
- setup 0.0s, grading 0.0s
- Turns
- 42
- Tool calls
- 36
- Subagents
- 3
- Tokens in / out
- 445k / 15k
- 361,611 read from cache
Did the design run?
every check held
- Run completed: heldharness.run-completedThe environment was built, the architecture returned and grading finished, none of them throwing.
- No API failures: heldharness.apiNo model call failed at the API.
- Every call ended: heldharness.calls-endedEvery call ended with a result, or was stopped by the run's own limits.
- No harness tool denied: heldharness.harness-toolsThe sandbox guard never denied a harness tool, nor a tool the session itself offered.
- Tool servers connected: heldharness.mcp-connectedEvery tool server the harness gave a call was connected when the session started.
- No foreign tool servers: heldharness.mcp-hermeticNo call loaded a tool server the harness did not give it.
- Builtin tools: heldharness.builtin-toolsA check recorded with the run.
- Structured replies arrived: heldharness.structured-outputEvery call that asked for structured output and ran to the end got it.
- No silent fallbacks: heldharness.not-degradedNo phase fell back on a default (an empty plan, a default winner) instead of its output.
- The task was decomposed: heldorchestrator-workers.decompositionThe orchestrator’s reply was read through its schema and held at least one subtask.
- The fan-out happened: heldorchestrator-workers.fan-outEvery subtask got a worker, every worker ran, and the recorded subagent count matches.
- The synthesis wrote the answer: heldorchestrator-workers.synthesisThe final answer came from the synthesis call, not from a worker’s report standing in for it.
- Each call was shown the right tools: heldorchestrator-workers.toolsThe orchestrator and the synthesis were shown no tools and every worker the task’s full toolset.
Phases
Decompose: 0.0s to 21.3s, finished, 0 tool calls, $0.015
Worker 1: password-length-composit: 21.3s to 1m 0s, finished, 10 tool calls, $0.058
Worker 2: password-user-management: 21.3s to 1m 25s, finished, 22 tool calls, $0.117
Worker 3: password-storage-hashing: 21.3s to 40.7s, finished, 4 tool calls, $0.035
Synthesize: 1m 25s to 1m 42s, finished, 0 tool calls, $0.017
Drawn from the phase records: timing and cost per call, no tool calls or messages.
| Phase | Duration | Cost | Turns | Tools | Model |
|---|---|---|---|---|---|
| Decompose | 21.3s | $0.015 | 2 | 0 | claude-haiku-4-5-20251001 |
| Worker 1: password-length-composit | 39.2s | $0.058 | 11 | 10 | claude-haiku-4-5-20251001 |
| Worker 2: password-user-management | 1m 4s | $0.117 | 23 | 22 | claude-haiku-4-5-20251001 |
| Worker 3: password-storage-hashing | 19.4s | $0.035 | 5 | 4 | claude-haiku-4-5-20251001 |
| Synthesize | 16.6s | $0.017 | 1 | 0 | claude-haiku-4-5-20251001 |
The call-by-call replay is not published for this run. Traces are large, so the repository keeps 9 of this run set’s 900 and leaves the rest out; the score, phases and final answer on this page come from the committed run record.
Runs you can replay
- A gate that blocked the right moveGated-execute · Haiku 4.5
- Three proposals beat one agentPropose-select · Haiku 4.5
- A verifier that earned its keepPlan-execute-verify · Sonnet 5.5
- A revision that did not helpPlan-execute-verify · Haiku 4.5
- The control, missing a stepSingle · Haiku 4.5
Record this cell yourself: npm run bench -- run --strategies orchestrator-workers --tasks research-nist-password-rules --models claude-haiku-4-5-20251001 --repeats 1
Score breakdown
- passtopic single-factor-minimum-length: minimum length of a password used as the only authentication factor (characters)1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic maximum-length: the maximum password length verifiers permit (characters)1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic composition-rules: imposing composition rules, such as requiring a mix of character types1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic periodic-change: requiring subscribers to change their passwords periodically1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic password-hints: letting subscribers store a password hint that unauthenticated claimants can see1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic security-questions: prompting for knowledge-based authentication or security questions when a password is chosen1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic blocklist: checking a new password against a blocklist of commonly used, expected or compromised passwords1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic password-managers: allowing password managers and autofill1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic salt-length: the length of the salt used when storing passwords (bits)1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic hashing-scheme: using an approved password hashing scheme from the latest revision of SP 800-1321.00weight 0.10
quote verified in nist-sp800-63b-4
Penalties
No penalties were applied.
Scorer metadata
- corpus
- {"version":2,"snapshot":"2026-10-01","hash":"0786c624b04f6c85e2ed8a55d4acedd99e4cf2c18632a0ebc22ee969fb3e2263","documents":4}
- opened documents
- ["nist-sp800-63b-4"]
- opened by role
- {"primary":["nist-sp800-63b-4"]}
- displayed share
- {"nist-sp800-63b-3":0.0029,"owasp-authentication":0.0061,"nist-sp800-63b-4":0.1987,"owasp-password-storage":0.0268}
- cited count
- 1
- verified count
- 1
- hallucinated count
- 0
- citation integrity
- 1
- hallucinated urls
- []
- answer block
- true
- answer block repaired
- false
- items answered
- 10
- item count
- 10
- field accuracy
- 1
- grounded items
- 10
- field misses
- {}
Final answer
Final Answer
All three worker reports successfully retrieved the current revision of NIST SP 800-63B-4 and found normative requirements for all 10 topics in the task. The findings are complete and consistent across all reports—all citations point to https://pages.nist.gov/800-63-4/sp800-63b.html, which is Section 3.1.1.2 (Password Verifiers) of the current revision.
Here is the complete compilation:
{"answers":[{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., \"What was the name of your first pet?\") or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}]}Provenance of the numbers on this page
- run set
- scaffold-or-scale-v1
- models
- Haiku 4.5, Sonnet 5.5, Opus 5.5
- effort
- high
- repeats
- 2
- fixtures
- replay
- runs
- 900 / 900
- strategy cost
- $354.44
- judge cost
- $9.19
- wall clock
- 9h 48m
- git
- fce5807b2d
Cost excludes judge calls, which are tracked separately so a scoring model never flatters or penalises an architecture. Every figure on this site is read from results/ at build time.