Declared Is Not Used: Measuring How Well Dependency Manifests Approximate Statically Evident Use of Quantum-Vulnerable Cryptography

Post-quantum migration starts from an inventory of where quantum-vulnerable cryptography is used, and the cheapest inventory reads dependency manifests. We ask how closely a manifest tracks statically evident use. We parse the source of the 1,963 most-downloaded PyPI packages for which a release archive within 30 MB exists (296,228 files; frozen ranking, hash-verified artifacts) with an import-resolving, scope- aware AST detector. Among the 1,948 packages that are not themselves crypto libraries, 60 (3.1%; 95% CI 2.4–3.9) directly call an RSA, DSA, elliptic-curve, EdDSA, X25519/X448 or DH primitive (or its key or parameter objects) in production code. A manifest allowlist of ten libraries flags 35 of them (recall 58%, 46–70) and 80 packages in all (precision 44%, 33–55); a keyword search reaches 85% recall at 35% precision. Optional extras are the single largest class of misses: counting a crypto library declared as an extra raises recall to 87% (76–93) at a cost of 4 points of precision. Of the 45 manifest-flagged packages with no detection, 27 use JWT, key, certificate or TLS handling in ways whose algorithm is not statically evident, so precision against runtime use is unknown. A further 111 packages call TLS or SSH transport APIs on top of that (only the stdlib subset is invisible to an allowlist by construction). Counting dependencies, 280 packages (14.4%) have a potential footprint through their own code or a harddependency, 4.7 times the direct figure. A census of one detection from each of the 60 positive packages found all genuine (single rater), but a resolver independent text probe over the 1,888 reference-negative consumers found four genuine uses the detector misses, so the reference’s recall is below 100%. Theseare measurements of declarations versus static evidence in popular Python packages, not of run-time behaviour or of enterprise code.