Working log behind tls_certificates. Corpus-wide caveats are on corpus. Citations use the shared bibliography.

Run: 2026-08-27. Corpus: 5,859 extracted papers, 7 venues, 2010–2026, data/extract/run1. Item: drain wiki-measuretheweb / “security:tls_certificates (new)”, claimed as cursor-drain-tls, store id 220, run 58. Author of the page and this log: Cursor, not Claude Code. Reviews: three focused passes then one generic, all on GPT 5.6 Luna medium (gpt-5.6-luna-medium), the sitting's requested substitute for the spec's sonnet/fable split.

Creating, not extending. node scripts/dw.mjs info security:tls_certificates — page did not exist. ?do=export_raw on a missing page returns the HTML error page (not an existence test by byte count). dw.mjs pages does not list provenance:. Neighbour security already linked the red child. Overlap judgement: write the promised child rather than widening mobile_and_app_measurement (pinning) or ip_classification (Censys-as-IP).

No ~~DISCUSSION~~ on this provenance page. Comments belong on the content page.

scripts/report_tls_certificates.mjs plus scripts/tls_fold.mjs. Deterministic. Re-run:

node scripts/report_tls_certificates.mjs > scripts/report_tls_certificates-output.txt

Flags: --wiki, --list, --quotes, --hits <re>. Unknown flags print FAILURE and exit 1. Exits 1 if corpus size is not 5,859, crawled not 1,120, web not 1,622, missing .cols not 4, task residue not 0, or a HAND_TASK key is not a candidate. A printed FAILURE with exit 0 is forbidden.

python3 pages/pin_web_pki.py is the published script. Advertised flags: --host, --port, --skip-ct, --timeout. All exist on the live object. crt.sh HTTP errors raise RuntimeError with the URL and status.

bash scripts/tls_external_probe.sh re-fetches Chrome log_list.json, Censys docs, Let’s Encrypt posts, GitHub, PyPI, crt.sh, and the CT landing redirect. Honours GH_TOKEN. Exits 1 if any check is FAILED. This sitting: crt.sh HTTP 502.

Membership UNION, then task fold. Offtopic families first (rpki, code-signing, email-s-mime, iot-tls, mobile-client, client-library, crypto-not-web-pki, ct-as-feed, not-pki), then lets-encrypt, revocation, ct-logs, https-adoption, misissuance, interception, browser-errors, scan-instrument, cert-ecosystem.

Do not use bare /certificat/ (PCI certification, vaccine certificates, Alexa skill certs) or bare revocation (Johnny consent-revocation, location-heartbleeding).

HAND_TASK (all keys must remain candidates; the report fails otherwise):

Instrument families are ordered; first match wins. isTlsish restricts the fold to TLS-ish names (plus nmap, ZLint, Boulder) so Firefox/Chrome/Nginx are not residue.

Detection evidence.quote vs paper.cols.txt on the 56: 192 exact, 110 partial (≥60% of 5-word windows), 52 FAILED, 0 missing quotes, 0 missing .cols. Below-threshold is not automatically unsupported — column splices do this. The content page does not publish the 52 as verbatim blockquotes.

Published blockquotes, confirmed in .cols:

Paraphrased, not quoted, because the extractor quote was below threshold or spliced: Durumeric 2013 12.7% misconfigured; Durumeric CCS 2015 46% SSLv3 and 76.3% SHA-1; Kotzias 23.6% / 1.3% (the 1.3% sentence is in .cols; the 23.6% sentence is interleaved with a table). Kotzias “In 2012, 90% of TLS connections used TLS 1.0” is in .cols and is used as paraphrase with the year attached.

Holz 18.09% with SNI, ~60% chain validity: in .cols, used as paraphrase.

Fetched 2026-08-27, re-checked by scripts/tls_external_probe.sh:

Rejected: SEO “best SSL scanner” listicles; Censys pricing pages; quoting Let’s Encrypt chart pixels as numbers.

• A live crt.sh row count or “leaf in CT” bit for example.com on 2026-08-27 (502).
• A Censys Platform dataset date (no PAT in this sitting).
• Whether RFC 9162 will become what browsers enforce — today it is Experimental.
• A hand map of all 102 excluded candidates beyond the family regex + 12 overrides. Residue of the fold is 0 by construction of HAND_TASK; that is not a claim that every exclusion was read in full text.

pages/pin_web_pki.py. Stdlib. Writes pin_web_pki.manifest.json next to itself. Handshake uses ssl.create_default_context(), check_hostname = True, CERT_REQUIRED. crt.sh list JSON has no sha256 field; live-in-CT is a second query by fingerprint. --skip-ct is how this sitting produced the quoted output.

Collision-checked against a fresh export of live literature:bibliography at publish time (not the stale pages/literature_bibliography.txt). Already live from the security-namespace sitting: holz2011_landscape, durumeric2013_https, kotzias2018_coming, durumeric2015_search, aas2019_encrypt, durumeric2024_years.

Added this sitting: felt2017_https, vandersloot2016_complete, scheitle2018_rise, huang2014_forged.

felt2017_https is USENIX: no DOI in the index. Authors hand-written from the landing page’s citation_author meta tags (Adrienne Porter Felt, Richard Barnes, April King, Chris Palmer, Chris Bentzel, Parisa Tabriz), fetched 2026-08-27. bibgen.mjs could not derive a surname from usenixsecurity17/technical-sessions/presentation/felt (the regex expects usenixsecurityNN/presentation/).

The file scripts/report_tls_certificates-output.txt is the unedited stdout of node scripts/report_tls_certificates.mjs from this sitting. Do not edit it by hand; re-run the script.

Drafts frozen to out/freeze_tls/ before any reviewer ran. Three focused passes then one generic, all gpt-5.6-luna-medium. The content page was not edited while a pass was running.

• Reject (lesser): change <WRAP todo> to <WRAP TODO>. House style and check_wrap.mjs want the plugin tag WRAP uppercase and the box class todo lowercase. Gold pages (ip_classification, phishing) use <WRAP todo>. The page already matches.

• Accept (lesser): 99.4% is of trusted certificates (“of all trusted certificates seen by any perspective we studied”, VanderSloot .cols). The WRAP bullet said “certificates any of their eight perspectives saw”. Applied: qualified as trusted; extended the blockquote to the trusted-certificates clause.

• Accept: no findings. Live fetches matched Chrome log_list.json, RFC 9162 Experimental, LE posts, sslyze 6.3.1, GitHub unarchived, crt.sh 502 disclosed.

• Accept (blocking, applied): a Chrome log-list version is not a CT dataset. Pin section now says to hash the crt.sh JSON or record a log ID and tree head; log-list pin is necessary and not sufficient.
• Accept (blocking, applied): “Chrome enforces RFC 6962 plus tiled logs” was inferred from log_list.json. Replaced with a citation to the Chrome CT Log Policy (RFC 6962 or static-ct-api v1.1.0) and pointed SCT-count rules at the CT Policy document.
• Accept (blocking, applied): Censys pin now asks for API version, query, and dataset timestamp, not a date alone.
• Accept (lesser, applied): renamed ct_newest → ct_max_not_after (maximum expiry, not newest issuance); cite line now includes Python 3.11.2 and OpenSSL 3.0.20.
• Accept (lesser, applied): table header now says crt.sh is an aggregator; Chrome log list is metadata.
• Accept (lesser, applied): 99.4% (trusted certs, eight perspectives) and 1.5% (zone-file crawl) are named as different denominators in the WRAP bullet.
• Accept (lesser, applied): 12/22 is “the reporting rate in this page’s 56-paper population”, not “the field’s current practice”.
• Accept (lesser, applied): handshake helper now emits Python and OpenSSL versions. Still a single-host demonstration, and the page already says so.

No remaining GENERIC_REVIEW gap: this section is the log.