Readiness report

Readiness report on a zone’s Post-quantum tab builds one page a security lead can hand to their manager: a score, which origins are fixed and which aren’t, the public deadlines, and the cryptography inventory. It’s built only from what Flarebox already stored (the zone’s DNS origins, the post-quantum history, the risk weights, a local code scan of projects routed to the zone, and the CBOM). It runs no checks.

Zone → Post-quantum → Readiness report: the preview of the page, its score and factors, and the Save buttons · Demo mode, sample data

The score

0–100. Every factor is a line on the page, and the formula is printed underneath in small type.

Factor	Points	What earns them
Key exchange	70	The risk-weighted share of checked origins that negotiate post-quantum. The weights are those of Fix these first, so an unfixed sign-in origin costs more than a static host
Stability	15	The share of checked origins with no drop from post-quantum in 30 days
Code scan	10	Minus 2 per high-risk finding in local projects routed to the zone
ML-DSA	5	The share of origins serving an ML-DSA certificate

A factor without data is printed not measured and left out of both sides, never estimated. With no origin checked there’s no score. The grade is in words: Ready (90 or more, every origin checked and post-quantum, no regression), Mostly ready (70 or more), In progress, or Not started.

The page

A4 or US Letter, portrait, always exactly one page:

• the zone, when it was generated, a one-line verdict, the score seal and the factor lines;
• Origins, worst risk first, each with its result, cause, one-line fix and check date (with more than eight: the worst six, two post-quantum ones, and “+N more”);
• Deadlines: a 2026–2036 timeline of the twelve public milestones and where the zone stands against each;
• Cryptography inventory: algorithms by family, how many origins use each, and the SHA-256 of the exported CBOM, so the PDF and the JSON can be matched;
• a footer with what was measured and what wasn’t, the Flarebox and pqdoctor versions, and “A point-in-time measurement, not a certification.”

There’s no Cloudflare logo and no wording that suggests anyone endorses it. It reads the same in greyscale: ✓, ✗, ◆ and ○ carry the meaning, not colour.

Saving

Button	Saves
Save PDF…	The page, printed by WebView2’s own PrintToPdf in a hidden window with JavaScript off. Flarebox checks the PDF has exactly one page before saving it
Save CBOM (JSON)…	The exact CycloneDX 1.6 file whose SHA-256 is on the page
Save HTML…	The self-contained page: no scripts, no outside files

The Save dialog is Windows’ own, so it asks before replacing a file.