RunHaiku 4.5repeat 1
Propose-select on NIST SP 800-63B password rules, current revision
claude-haiku-4-5-20251001__propose-select__research-nist-password-rules__r1
Score
1.000
passed
design ran as designed- Cost
- $0.201
- Latency
- 1m 17s
- setup 0.0s, grading 0.0s
- Turns
- 27
- Tool calls
- 22
- Subagents
- 3
- Tokens in / out
- 186k / 16k
- 116,293 read from cache
Did the design run?
every check held
- Run completed: heldharness.run-completedThe environment was built, the architecture returned and grading finished, none of them throwing.
- No API failures: heldharness.apiNo model call failed at the API.
- Every call ended: heldharness.calls-endedEvery call ended with a result, or was stopped by the run's own limits.
- No harness tool denied: heldharness.harness-toolsThe sandbox guard never denied a harness tool, nor a tool the session itself offered.
- Tool servers connected: heldharness.mcp-connectedEvery tool server the harness gave a call was connected when the session started.
- No foreign tool servers: heldharness.mcp-hermeticNo call loaded a tool server the harness did not give it.
- Builtin tools: heldharness.builtin-toolsA check recorded with the run.
- Structured replies arrived: heldharness.structured-outputEvery call that asked for structured output and ran to the end got it.
- No silent fallbacks: heldharness.not-degradedNo phase fell back on a default (an empty plan, a default winner) instead of its output.
- All three proposers ran: heldpropose-select.proposalsThree proposers ran in parallel, each from its own angle, and none was starved while another ran.
- The selector chose: heldpropose-select.selectionThe selector picked a proposal by a valid number, read from its schema reply and not a default.
- Each call was shown the right tools: heldpropose-select.toolsEach proposer was shown the read-only tools, the selector none, and the executor the full toolset.
Phases
Proposal 1 (policy-first): 0.0s to 39.1s, finished, 8 tool calls, $0.066
Proposal 2 (state-first): 0.0s to 36.0s, finished, 8 tool calls, $0.050
Proposal 3 (outcome-first): 0.0s to 31.3s, finished, 6 tool calls, $0.046
Select: 39.1s to 1m 17s, finished, 0 tool calls, $0.039
Drawn from the phase records: timing and cost per call, no tool calls or messages.
| Phase | Duration | Cost | Turns | Tools | Model |
|---|---|---|---|---|---|
| Proposal 1 (policy-first) | 39.1s | $0.066 | 9 | 8 | claude-haiku-4-5-20251001 |
| Proposal 2 (state-first) | 36.0s | $0.050 | 9 | 8 | claude-haiku-4-5-20251001 |
| Proposal 3 (outcome-first) | 31.3s | $0.046 | 7 | 6 | claude-haiku-4-5-20251001 |
| Select | 37.7s | $0.039 | 2 | 0 | claude-haiku-4-5-20251001 |
The call-by-call replay is not published for this run. Traces are large, so the repository keeps 9 of this run set’s 900 and leaves the rest out; the score, phases and final answer on this page come from the committed run record.
Runs you can replay
- A gate that blocked the right moveGated-execute · Haiku 4.5
- Three proposals beat one agentPropose-select · Haiku 4.5
- A verifier that earned its keepPlan-execute-verify · Sonnet 5.5
- A revision that did not helpPlan-execute-verify · Haiku 4.5
- The control, missing a stepSingle · Haiku 4.5
Record this cell yourself: npm run bench -- run --strategies propose-select --tasks research-nist-password-rules --models claude-haiku-4-5-20251001 --repeats 1
Score breakdown
- passtopic single-factor-minimum-length: minimum length of a password used as the only authentication factor (characters)1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic maximum-length: the maximum password length verifiers permit (characters)1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic composition-rules: imposing composition rules, such as requiring a mix of character types1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic periodic-change: requiring subscribers to change their passwords periodically1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic password-hints: letting subscribers store a password hint that unauthenticated claimants can see1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic security-questions: prompting for knowledge-based authentication or security questions when a password is chosen1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic blocklist: checking a new password against a blocklist of commonly used, expected or compromised passwords1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic password-managers: allowing password managers and autofill1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic salt-length: the length of the salt used when storing passwords (bits)1.00weight 0.10
quote verified in nist-sp800-63b-4
- passtopic hashing-scheme: using an approved password hashing scheme from the latest revision of SP 800-1321.00weight 0.10
quote verified in nist-sp800-63b-4
Penalties
No penalties were applied.
Scorer metadata
- corpus
- {"version":2,"snapshot":"2026-10-01","hash":"0786c624b04f6c85e2ed8a55d4acedd99e4cf2c18632a0ebc22ee969fb3e2263","documents":4}
- opened documents
- ["nist-sp800-63b-4"]
- opened by role
- {"primary":["nist-sp800-63b-4"]}
- displayed share
- {"nist-sp800-63b-3":0.0037,"owasp-authentication":0.0163,"nist-sp800-63b-4":0.1294,"owasp-password-storage":0.0314}
- cited count
- 1
- verified count
- 1
- hallucinated count
- 0
- citation integrity
- 1
- hallucinated urls
- []
- answer block
- true
- answer block repaired
- false
- items answered
- 10
- item count
- 10
- field accuracy
- 1
- grounded items
- 10
- field misses
- {}
Final answer
{"answers":[{"topic":"single-factor-minimum-length","keyword":"SHALL","value":"15","quote":"Verifiers and CSPs SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"maximum-length","keyword":"SHOULD","value":"64","quote":"Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"composition-rules","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"periodic-change","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-hints","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT permit the subscriber to store a hint (e.g., a reminder of how the password was created) that is accessible to an unauthenticated claimant.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"security-questions","keyword":"SHALL NOT","value":null,"quote":"Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., \"What was the name of your first pet?\") or security questions when choosing passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"blocklist","keyword":"SHALL","value":null,"quote":"When processing a request to establish or change a password, verifiers SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"password-managers","keyword":"SHALL","value":null,"quote":"Verifiers SHALL allow the use of password managers and autofill functionality.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"salt-length","keyword":"SHALL","value":"32","quote":"The salt SHALL be at least 32 bits in length and chosen to minimize salt value collisions among stored hashes (i.e., to prevent multiple subscriber accounts from having the same hashed password).","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"},{"topic":"hashing-scheme","keyword":"SHOULD","value":null,"quote":"An approved password hashing scheme published in the latest revision of [SP800-132] or updated NIST guidelines on password hashing schemes SHOULD be used.","url":"https://pages.nist.gov/800-63-4/sp800-63b.html"}]}Provenance of the numbers on this page
- run set
- scaffold-or-scale-v1
- models
- Haiku 4.5, Sonnet 5.5, Opus 5.5
- effort
- high
- repeats
- 2
- fixtures
- replay
- runs
- 900 / 900
- strategy cost
- $354.44
- judge cost
- $9.19
- wall clock
- 9h 48m
- git
- fce5807b2d
Cost excludes judge calls, which are tracked separately so a scoring model never flatters or penalises an architecture. Every figure on this site is read from results/ at build time.