STEP 01ranger
Day work
Reproduce and fix in the loopback lab, and capture a negative control.
Submission model
How work becomes verified truth.
No ranger writes their own score. The program measures each repository, signs the result, and your browser proves the signature. Here is the exact path from a day of work to a signed entry on the command center.
Identity GitHub handle on the roster
Attribution head commit SHA + author
Authenticity Ed25519 signature by program CI
Measurement program re-runs the evidence scan
Verification WebCrypto in the viewer's browser
private key never leaves CIpublic key ships with the site
The pipeline
Seven steps, from day work to a signed board.
STEP 02evidence
evidence/W##/D###
A README plus the results file, placeholders resolved, attested no-AI.
STEP 03PR
Pull request
One per day on branch day/Dxxx, opened against protected main.
STEP 04CI gate
validate
The autograder runs the board checks. Red blocks merge, every time.
STEP 05tag
Signed release
A board turns green only on its release tag, board1 through board6.
STEP 06program
Cohort sync
Program CI re-runs the evidence scan per repo, then Ed25519-signs the cohort.
STEP 07command center
Verified in your browser
Your browser checks the signature with WebCrypto before a single number renders. The data is trusted only after the signature is proven.
Why it cannot be faked
The program measures, not the ranger.
- Cohort sync clones each rostered repo and re-runs the same evidence scan. Editing a local status changes nothing.
- The aggregate is signed with an Ed25519 key held only as a CI secret; the public key ships with the site.
- The signature covers the exact served bytes. Change one digit and every visitor's browser shows the signature invalid.
# program CI, per sync (scheduled + on demand) # re-measures every rostered repo with the hardened, # answer-free grader, ignoring any committed report, # then Ed25519-signs the cohort AND each candidate ledger. QW_COHORT_PRIVKEY=$SECRET \ python3 scripts/sync_cohort.py \ --roster roster.json --cohort-id 2026-A \ --out registry # a passing board auto-records a signed clearance # the browser verifies the exact bytes on load
The integrity model, in depth
Four guarantees behind the signature.
The signature proves the numbers were not altered. These four properties are why the numbers mean something in the first place, and why a ranger cannot game, memorize, or forge their way to a green board.
GRADINGanswer-free
The grader stores no answers.
Every check verifies a behavioral property: the exploit is blocked by your patch, your detection fires on the attack and stays silent on benign traffic, the leaked secret was actually captured. There is no answer key to leak, so the grader can be public and still prove nothing to a candidate.
ROTATIONanti-reuse
Every cohort is a different challenge.
The vulnerability class rotates each cohort, and within a class every value an answer depends on, the secret, the tokens, the object ids, the detection field, is derived from the cohort seed. A ranger who returns later meets a different class or a freshly parameterized one. A memorized answer does not transfer.
LEDGERportable
Cleared work travels with you, signed.
Each board you clear is recorded in a portable, Ed25519-signed ledger. Step away and return past your cohort, and the program verifies that ledger, carries your cleared boards forward, and issues fresh instances only for what is left. You never redo proven work, and you cannot forge credit.
AUTHORINGAI-gated
Models help the program, never the ranger.
Candidates get no AI. On the program side, a model may draft a new challenge, but it ships only if it passes the same grader gate as a hand-written one, and cross-submission embeddings flag copied patches and detections for human review. The model proposes; the grader disposes.
How engagements are scored
A red action, and the detection meant to catch it.
Every engagement is a pair, mapped to a MITRE ATT&CK technique. The program records the outcome and the time to detect from the ranger's own SIEM and detection fixtures. Nothing is scored on a screenshot.
Detected
The alert fired and the evidence is linked to the engagement.
outcome · detected
Contained
Detected, and the response action was proven, not just described.
outcome · contained
Missed
No alert, a visibility gap that drives the next detection task.
outcome · missed
See it proven.
Every number on the command center took this exact path: measured by the program, signed, and verified in your browser.