[ILIASTEKEOGLOU]

Summary

• X25519MLKEM768, SecP256r1MLKEM768 and SecP384r1MLKEM1024 are
  classified as pq_t_hybrid_kem, quantum_resistant,
  standardized_pq_t_hybrid. Matching is exact after normalization. Other
  hybrid spellings, and X25519Kyber768Draft00 / SecP256r1Kyber768Draft00
  (obsoleted by RFC 10024 Section 7.4), receive no positive classification.
• Registry schema 2, content version 2:
  • components are spelled as in RFC 10024, in the shared-secret order of
    Section 4.3;
  • certification_component follows Section 5 and must be a component;
  • sources may carry excerpt, verbatim text from the cited section.
• Decision: retain_monitor; human review is required under every policy
  pack; reason code classification:standardized_pq_t_hybrid.
• Policy pack nist-pqc-basic 0.3 adds
  standardized_pq_t_hybrid_requires_certification_evidence_review and the
  reference RFC-10024. policy_pack_hash changes.
• PDR target-state rationale names the components, quotes RFC 10024
  Section 5 and states which component implementation must be shown to be
  certified. Reports list components and the certification component.
• The PDR field validation_component is named certification_component,
  the term used by RFC 10024 Section 5. PDR 0.3 has not been released.
• design/r0-architecture.md has a dated amendment (A1 to A4).

Source text

Registry excerpts were compared with the published text of RFC 10024 and
NIST SP 800-227 and appear there verbatim. One notation change: a subscript
is written as S_j. Tests pin every excerpt and every generated message.
No generated text states that a hybrid is approved; a test enforces this.

Verification

• Classification snapshot: the three group names were pinned as unknown
  and are listed as intended changes; the other 213 pinned classifications
  are unchanged.
• Decisions for examples/sample_inventory.yaml are unchanged; only policy
  pack identity fields differ.
• Property tests over deterministic corpora: normalization is idempotent;
  every registry identifier resolves to its entry; more than 500 generated
  spellings with a PQ marker and not in the registry get no positive
  classification.
• All hashes of a PDR containing hybrid assets, including registry_hash,
  were recomputed with the independent rfc8785 0.1.4 package and matched.
• Local runs: Linux Python 3.11 and 3.13, 1441 passed, 3 skipped; Windows
  Python 3.11, 1440 passed, 4 skipped. A generated PDR for an
  X25519MLKEM768 asset passes 8 of 8 verification checks.