{
 "schema": "cain42.top25.falsework.evolution.v1",
 "date": "2026-11-02",
 "who": "FIRME AI CORPORATION (self-run, NOT independent)",
 "live_status": "engine changes are in the repository and pass the test suites; the public /keystone/scan-source route serves them after the next gateway deploy",
 "benchmark": {
  "before": {
   "recall_at_grade": 0.548,
   "recall_any": 0.976,
   "precision": 1.0,
   "false_alarm_rate": 0.0
  },
  "after": {
   "recall_at_grade": 0.881,
   "recall_any": 0.976,
   "precision": 1.0,
   "false_alarm_rate": 0.0
  },
  "cases": "42 defects, 61 clean"
 },
 "stdlib_false_alarm_scan": {
  "files": 560,
  "lines": 288031,
  "before_grades": {
   "REAL": 459,
   "PARTIAL": 91,
   "STUB": 1,
   "UNKNOWN": 9
  },
  "after_grades": {
   "REAL": 506,
   "PARTIAL": 44,
   "STUB": 1,
   "UNKNOWN": 9
  },
  "before_findings": {
   "bare_except_pass|LOW": 4,
   "bare_except_pass|MEDIUM": 28,
   "check_cannot_fail|MEDIUM": 1,
   "fixed_result|MEDIUM": 1,
   "placeholder_marker|MEDIUM": 65,
   "rng_fabrication|CRITICAL": 3,
   "rng_fabrication|HIGH": 2,
   "rng_fabrication|LOW": 4,
   "secret_compare_not_constant_time|LOW": 7,
   "swallowed_import_error|HIGH": 70,
   "swallowed_import_error|LOW": 30
  },
  "after_findings": {
   "bare_except_pass|LOW": 11,
   "bare_except_pass|MEDIUM": 21,
   "check_cannot_fail|MEDIUM": 1,
   "fixed_result|MEDIUM": 1,
   "placeholder_marker|LOW": 47,
   "placeholder_marker|MEDIUM": 18,
   "rng_fabrication|CRITICAL": 3,
   "rng_fabrication|HIGH": 2,
   "rng_fabrication|LOW": 4,
   "swallowed_import_error|HIGH": 23,
   "swallowed_import_error|LOW": 77
  }
 },
 "blind_b": {
  "note": "written before the changes; the token-comparison rule was informed by it, so its after-score is not independent",
  "before": "6/16 fakes caught, 0/16 false alarms",
  "after": "10/16 fakes caught, 0/16 false alarms",
  "cases": [
   {
    "kind": "fake",
    "name": "webhook_compare_eq",
    "file": "billing_hooks.py",
    "source": "import hashlib\nimport hmac\n\ndef verify_stripe_webhook(payload: bytes, header_sig: str, secret: str) -> bool:\n    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()\n    return expected == header_sig\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "secret_compare_not_constant_time"
    ],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "always_pass_policy",
    "file": "policy_gate.py",
    "source": "def evaluate_policy(action: dict, policy: dict) -> dict:\n    rules = policy.get(\"rules\", [])\n    for rule in rules:\n        _ = rule.get(\"match\")\n    return {\"passed\": True, \"rules_checked\": len(rules)}\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "hardcoded_success_claim"
    ],
    "grade_before": "PARTIAL"
   },
   {
    "kind": "fake",
    "name": "error_counted_success",
    "file": "sync_job.py",
    "source": "import logging\nlog = logging.getLogger(__name__)\n\ndef sync_accounts(client, accounts):\n    synced = 0\n    for acct in accounts:\n        try:\n            client.push(acct)\n        except Exception as exc:\n            log.warning(\"push failed: %s\", exc)\n        synced += 1\n    return {\"synced\": synced, \"status\": \"ok\"}\n",
    "grade_after": "REAL",
    "checks_after": [
     "hardcoded_success"
    ],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "tenant_ignored_route",
    "file": "invoices_api.py",
    "source": "from fastapi import APIRouter\nrouter = APIRouter()\nINVOICES = []\n\n@router.get(\"/tenants/{tenant_id}/invoices\")\ndef list_invoices(tenant_id: str):\n    return {\"invoices\": INVOICES}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "placeholder_route_todo",
    "file": "reports_api.py",
    "source": "from fastapi import APIRouter\nrouter = APIRouter()\n\n@router.post(\"/reports/generate\")\ndef generate_report(body: dict):\n    # TODO: wire to the report engine\n    return {\"status\": \"queued\", \"report_id\": \"pending\"}\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "placeholder_marker",
     "placeholder_route"
    ],
    "grade_before": "PARTIAL"
   },
   {
    "kind": "fake",
    "name": "fresh_timestamp_no_check",
    "file": "health_monitor.py",
    "source": "from datetime import datetime, timezone\n\ndef certificate_status(domain: str) -> dict:\n    return {\"domain\": domain, \"valid\": True, \"last_checked\": datetime.now(timezone.utc).isoformat()}\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "fake_check_timestamp"
    ],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "sig_counter_no_verify",
    "file": "quorum.py",
    "source": "def count_approvals(approvals: list, threshold: int) -> dict:\n    valid_signatures = 0\n    for a in approvals:\n        if a.get(\"signature\"):\n            valid_signatures += 1\n    return {\"approved\": valid_signatures >= threshold, \"valid_signatures\": valid_signatures}\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "unverified_signature_count"
    ],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "secret_world_readable",
    "file": "keys_setup.py",
    "source": "import os\n\ndef save_api_key(path: str, key: str) -> None:\n    with open(path, \"w\") as fh:\n        fh.write(key)\n    os.chmod(path, 0o644)\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "hardcoded_scan_score",
    "file": "scanner.py",
    "source": "def scan_repository(path: str) -> dict:\n    files = list_python_files(path)\n    return {\"files_scanned\": len(files), \"vulnerabilities\": 0, \"security_score\": 100, \"status\": \"secure\"}\n\ndef list_python_files(path):\n    import pathlib\n    return list(pathlib.Path(path).rglob(\"*.py\"))\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "random_latency_metric",
    "file": "metrics.py",
    "source": "import random\n\ndef p99_latency_ms(service: str) -> float:\n    return round(random.uniform(8.0, 14.0), 2)\n",
    "grade_after": "STUB",
    "checks_after": [
     "rng_fabrication"
    ],
    "grade_before": "STUB"
   },
   {
    "kind": "fake",
    "name": "verify_returns_true",
    "file": "auth.py",
    "source": "def verify_jwt(token: str, public_key: str) -> bool:\n    if not token:\n        return False\n    return True\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "check_cannot_fail"
    ],
    "grade_before": "PARTIAL"
   },
   {
    "kind": "fake",
    "name": "mock_db_in_prod",
    "file": "orders_service.py",
    "source": "from unittest.mock import MagicMock\ndb = MagicMock()\n\ndef get_order(order_id: str) -> dict:\n    return db.orders.find_one({\"id\": order_id})\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "mock_in_production"
    ],
    "grade_before": "PARTIAL"
   },
   {
    "kind": "fake",
    "name": "simulated_charge",
    "file": "payments.py",
    "source": "import time\n\ndef charge_card(card_token: str, amount_cents: int) -> dict:\n    time.sleep(0.2)  # simulate the processor\n    return {\"charged\": True, \"amount_cents\": amount_cents, \"processor_id\": \"ch_simulated\"}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "admin_on_error",
    "file": "roles.py",
    "source": "def is_admin(user_id: str, directory) -> bool:\n    try:\n        return directory.lookup(user_id).role == \"admin\"\n    except Exception:\n        return True\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "error_grants_access"
    ],
    "grade_before": "PARTIAL"
   },
   {
    "kind": "fake",
    "name": "compliance_constant",
    "file": "compliance.py",
    "source": "def soc2_controls_passing(org: dict) -> dict:\n    controls = org.get(\"controls\", [])\n    return {\"controls_total\": len(controls), \"controls_passing\": len(controls), \"compliant\": True}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "fake",
    "name": "token_compare_eq",
    "file": "api_keys.py",
    "source": "def check_api_key(provided: str, stored: str) -> bool:\n    if provided is None:\n        return False\n    return provided == stored\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "secret_compare_not_constant_time"
    ],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "webhook_compare_digest",
    "file": "billing_hooks.py",
    "source": "import hashlib\nimport hmac\n\ndef verify_stripe_webhook(payload: bytes, header_sig: str, secret: str) -> bool:\n    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()\n    return hmac.compare_digest(expected, header_sig)\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "policy_really_evaluates",
    "file": "policy_gate.py",
    "source": "def evaluate_policy(action: dict, policy: dict) -> dict:\n    failed = [r[\"id\"] for r in policy.get(\"rules\", []) if r.get(\"deny\") and r.get(\"match\") == action.get(\"type\")]\n    return {\"passed\": not failed, \"failed_rules\": failed}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "error_counted_failed",
    "file": "sync_job.py",
    "source": "import logging\nlog = logging.getLogger(__name__)\n\ndef sync_accounts(client, accounts):\n    synced, failed = 0, 0\n    for acct in accounts:\n        try:\n            client.push(acct)\n            synced += 1\n        except Exception as exc:\n            log.warning(\"push failed: %s\", exc)\n            failed += 1\n    return {\"synced\": synced, \"failed\": failed, \"status\": \"ok\" if not failed else \"partial\"}\n",
    "grade_after": "REAL",
    "checks_after": [
     "hardcoded_success"
    ],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "tenant_scoped_route",
    "file": "invoices_api.py",
    "source": "from fastapi import APIRouter\nrouter = APIRouter()\nINVOICES = []\n\n@router.get(\"/tenants/{tenant_id}/invoices\")\ndef list_invoices(tenant_id: str):\n    return {\"invoices\": [i for i in INVOICES if i[\"tenant_id\"] == tenant_id]}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "route_calls_engine",
    "file": "reports_api.py",
    "source": "from fastapi import APIRouter\nfrom reports import engine\nrouter = APIRouter()\n\n@router.post(\"/reports/generate\")\ndef generate_report(body: dict):\n    job = engine.enqueue(body[\"kind\"], body.get(\"params\", {}))\n    return {\"status\": \"queued\", \"report_id\": job.id}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "timestamp_after_check",
    "file": "health_monitor.py",
    "source": "import ssl\nimport socket\nfrom datetime import datetime, timezone\n\ndef certificate_status(domain: str) -> dict:\n    ctx = ssl.create_default_context()\n    with socket.create_connection((domain, 443), timeout=5) as s, ctx.wrap_socket(s, server_hostname=domain) as t:\n        cert = t.getpeercert()\n    return {\"domain\": domain, \"not_after\": cert[\"notAfter\"], \"last_checked\": datetime.now(timezone.utc).isoformat()}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "sig_counter_verifies",
    "file": "quorum.py",
    "source": "def count_approvals(approvals: list, threshold: int, keys: dict, verify) -> dict:\n    valid_signatures = 0\n    for a in approvals:\n        if verify(keys[a[\"signer\"]], a[\"signature\"], a[\"message\"]):\n            valid_signatures += 1\n    return {\"approved\": valid_signatures >= threshold, \"valid_signatures\": valid_signatures}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "secret_private",
    "file": "keys_setup.py",
    "source": "import os\n\ndef save_api_key(path: str, key: str) -> None:\n    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)\n    with os.fdopen(fd, \"w\") as fh:\n        fh.write(key)\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "scan_counts_findings",
    "file": "scanner.py",
    "source": "import pathlib\n\ndef scan_repository(path: str, rules) -> dict:\n    findings = []\n    files = list(pathlib.Path(path).rglob(\"*.py\"))\n    for f in files:\n        findings.extend(rules.run(f.read_text()))\n    return {\"files_scanned\": len(files), \"vulnerabilities\": len(findings), \"findings\": findings}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "jitter_backoff",
    "file": "retry.py",
    "source": "import random\nimport time\n\ndef backoff_sleep(attempt: int) -> None:\n    time.sleep(min(30, 2 ** attempt) + random.uniform(0, 1))\n",
    "grade_after": "REAL",
    "checks_after": [
     "rng_fabrication"
    ],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "verify_jwt_real",
    "file": "auth.py",
    "source": "import jwt\n\ndef verify_jwt(token: str, public_key: str) -> bool:\n    if not token:\n        return False\n    try:\n        jwt.decode(token, public_key, algorithms=[\"EdDSA\"])\n        return True\n    except jwt.InvalidTokenError:\n        return False\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "real_db",
    "file": "orders_service.py",
    "source": "import sqlite3\n\ndef get_order(conn: sqlite3.Connection, order_id: str) -> dict:\n    row = conn.execute(\"SELECT id, total FROM orders WHERE id = ?\", (order_id,)).fetchone()\n    return {\"id\": row[0], \"total\": row[1]} if row else {}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "real_charge",
    "file": "payments.py",
    "source": "def charge_card(stripe, card_token: str, amount_cents: int) -> dict:\n    ch = stripe.Charge.create(amount=amount_cents, currency=\"usd\", source=card_token)\n    return {\"charged\": ch.status == \"succeeded\", \"amount_cents\": amount_cents, \"processor_id\": ch.id}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "admin_fail_closed",
    "file": "roles.py",
    "source": "def is_admin(user_id: str, directory) -> bool:\n    try:\n        return directory.lookup(user_id).role == \"admin\"\n    except Exception:\n        return False\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "compliance_counts",
    "file": "compliance.py",
    "source": "def soc2_controls_passing(org: dict) -> dict:\n    controls = org.get(\"controls\", [])\n    passing = [c for c in controls if c.get(\"evidence\") and c.get(\"tested\")]\n    return {\"controls_total\": len(controls), \"controls_passing\": len(passing), \"compliant\": len(passing) == len(controls) > 0}\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   },
   {
    "kind": "honest",
    "name": "token_compare_digest",
    "file": "api_keys.py",
    "source": "import hmac\n\ndef check_api_key(provided: str, stored: str) -> bool:\n    if provided is None:\n        return False\n    return hmac.compare_digest(provided.encode(), stored.encode())\n",
    "grade_after": "REAL",
    "checks_after": [],
    "grade_before": "REAL"
   }
  ]
 },
 "blind_c": {
  "note": "written after the changes and run once; not tuned on",
  "result": "3/12 fakes caught, 0/12 false alarms",
  "cases": [
   {
    "kind": "fake",
    "name": "rate_limit_noop",
    "file": "limits.py",
    "source": "def allow_request(client_id: str, limits: dict) -> bool:\n    limit = limits.get(client_id, 100)\n    return True\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "fake",
    "name": "backup_verified_constant",
    "file": "backup.py",
    "source": "import shutil\n\ndef backup_database(src: str, dst: str) -> dict:\n    shutil.copy(src, dst)\n    return {\"copied\": True, \"checksum_verified\": True, \"integrity\": \"ok\"}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "fake",
    "name": "pii_redactor_passthrough",
    "file": "redact.py",
    "source": "import re\nEMAIL = re.compile(r\"[\\w.]+@[\\w.]+\")\n\ndef redact(text: str) -> str:\n    found = EMAIL.findall(text)\n    return text\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "fake",
    "name": "accuracy_random",
    "file": "evaluate.py",
    "source": "import random\n\ndef evaluate_model(model, dataset) -> dict:\n    n = len(dataset)\n    return {\"examples\": n, \"accuracy\": random.uniform(0.91, 0.97)}\n",
    "grade_after": "STUB",
    "checks_after": [
     "rng_fabrication"
    ]
   },
   {
    "kind": "fake",
    "name": "signature_len_check",
    "file": "receipts.py",
    "source": "def receipt_is_authentic(receipt: dict, public_key: bytes) -> bool:\n    sig = receipt.get(\"signature\", \"\")\n    return len(sig) == 88\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "fake",
    "name": "uptime_hardcoded",
    "file": "status_page.py",
    "source": "def service_status() -> dict:\n    return {\"uptime_30d\": \"99.99%\", \"incidents\": 0, \"status\": \"operational\"}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "fake",
    "name": "encrypt_reverse",
    "file": "crypto_utils.py",
    "source": "def encrypt_field(value: str, key: bytes) -> str:\n    return value[::-1]\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "fake",
    "name": "audit_log_dropped",
    "file": "audit.py",
    "source": "def record_audit_event(event: dict, sink) -> dict:\n    try:\n        sink.write(event)\n    except Exception:\n        pass\n    return {\"recorded\": True}\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "bare_except_pass"
    ]
   },
   {
    "kind": "fake",
    "name": "virus_scan_skip",
    "file": "uploads.py",
    "source": "def scan_upload(path: str) -> dict:\n    # TODO: call the antivirus engine\n    return {\"clean\": True, \"engine\": \"clamav\"}\n",
    "grade_after": "PARTIAL",
    "checks_after": [
     "placeholder_marker"
    ]
   },
   {
    "kind": "fake",
    "name": "mfa_any_code",
    "file": "mfa.py",
    "source": "def verify_totp(user, code: str) -> bool:\n    return code.isdigit() and len(code) == 6\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "fake",
    "name": "cost_report_typed",
    "file": "billing_report.py",
    "source": "def monthly_savings(usage: list) -> dict:\n    total = sum(u[\"cost\"] for u in usage)\n    return {\"total_cost\": total, \"savings_percent\": 42.0, \"optimized\": True}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "fake",
    "name": "tenant_delete_unscoped",
    "file": "admin_api.py",
    "source": "from fastapi import APIRouter\nrouter = APIRouter()\n\n@router.delete(\"/orgs/{org_id}/users/{user_id}\")\ndef delete_user(org_id: str, user_id: str, db=None):\n    db.execute(\"DELETE FROM users WHERE id = ?\", (user_id,))\n    return {\"deleted\": user_id}\n",
    "grade_after": "REAL",
    "checks_after": [
     "tenant_param_ignored"
    ]
   },
   {
    "kind": "honest",
    "name": "rate_limit_real",
    "file": "limits.py",
    "source": "import time\n_WINDOW = {}\n\ndef allow_request(client_id: str, limits: dict) -> bool:\n    now = int(time.time())\n    key = (client_id, now // 60)\n    _WINDOW[key] = _WINDOW.get(key, 0) + 1\n    return _WINDOW[key] <= limits.get(client_id, 100)\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "backup_checksums",
    "file": "backup.py",
    "source": "import hashlib\nimport shutil\n\ndef _sha(p):\n    return hashlib.sha256(open(p, \"rb\").read()).hexdigest()\n\ndef backup_database(src: str, dst: str) -> dict:\n    shutil.copy(src, dst)\n    ok = _sha(src) == _sha(dst)\n    return {\"copied\": True, \"checksum_verified\": ok}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "pii_redactor_real",
    "file": "redact.py",
    "source": "import re\nEMAIL = re.compile(r\"[\\w.]+@[\\w.]+\")\n\ndef redact(text: str) -> str:\n    return EMAIL.sub(\"[email]\", text)\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "accuracy_computed",
    "file": "evaluate.py",
    "source": "def evaluate_model(model, dataset) -> dict:\n    correct = sum(1 for x, y in dataset if model.predict(x) == y)\n    return {\"examples\": len(dataset), \"accuracy\": correct / len(dataset) if dataset else None}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "signature_verified",
    "file": "receipts.py",
    "source": "from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey\nfrom cryptography.exceptions import InvalidSignature\nimport base64\n\ndef receipt_is_authentic(receipt: dict, public_key: bytes) -> bool:\n    try:\n        Ed25519PublicKey.from_public_bytes(public_key).verify(base64.b64decode(receipt[\"signature\"]), receipt[\"body\"].encode())\n        return True\n    except (InvalidSignature, KeyError, ValueError):\n        return False\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "uptime_measured",
    "file": "status_page.py",
    "source": "def service_status(checks: list) -> dict:\n    up = sum(1 for c in checks if c[\"ok\"])\n    return {\"uptime_30d\": f\"{100 * up / len(checks):.2f}%\" if checks else \"unknown\", \"checks\": len(checks)}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "encrypt_fernet",
    "file": "crypto_utils.py",
    "source": "from cryptography.fernet import Fernet\n\ndef encrypt_field(value: str, key: bytes) -> str:\n    return Fernet(key).encrypt(value.encode()).decode()\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "audit_log_raises",
    "file": "audit.py",
    "source": "def record_audit_event(event: dict, sink) -> dict:\n    sink.write(event)\n    return {\"recorded\": True}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "virus_scan_real",
    "file": "uploads.py",
    "source": "import subprocess\n\ndef scan_upload(path: str) -> dict:\n    p = subprocess.run([\"clamscan\", \"--no-summary\", path], capture_output=True, text=True)\n    return {\"clean\": p.returncode == 0, \"engine\": \"clamav\", \"output\": p.stdout}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "mfa_pyotp",
    "file": "mfa.py",
    "source": "import pyotp\n\ndef verify_totp(user, code: str) -> bool:\n    return pyotp.TOTP(user.totp_secret).verify(code, valid_window=1)\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "cost_report_computed",
    "file": "billing_report.py",
    "source": "def monthly_savings(usage: list, baseline: float) -> dict:\n    total = sum(u[\"cost\"] for u in usage)\n    return {\"total_cost\": total, \"savings_percent\": round(100 * (baseline - total) / baseline, 1) if baseline else None}\n",
    "grade_after": "REAL",
    "checks_after": []
   },
   {
    "kind": "honest",
    "name": "tenant_delete_scoped",
    "file": "admin_api.py",
    "source": "from fastapi import APIRouter\nrouter = APIRouter()\n\n@router.delete(\"/orgs/{org_id}/users/{user_id}\")\ndef delete_user(org_id: str, user_id: str, db=None):\n    db.execute(\"DELETE FROM users WHERE id = ? AND org_id = ?\", (user_id, org_id))\n    return {\"deleted\": user_id}\n",
    "grade_after": "REAL",
    "checks_after": []
   }
  ]
 },
 "promoted_to_MEDIUM": [
  "placeholder_route",
  "fake_check_timestamp",
  "always_pass",
  "unverified_signature_count",
  "secret_written_world_readable",
  "tenant_store_unscoped",
  "secret_compare_not_constant_time"
 ],
 "kept_LOW": {
  "tenant_param_ignored": "1 benchmark false alarm",
  "error_counted_as_success": "1 benchmark false alarm",
  "logged_and_continued": "not measured"
 },
 "false_alarm_fixes": [
  "ImportError with a try/else: LOW",
  "accelerator override (private module, star import, rebinding names defined above): LOW",
  "ImportError name tested with if/and/or: LOW",
  "FIXME/XXX comments: LOW (TODO/STUB/PLACEHOLDER/MOCK/FAKE still MEDIUM)",
  "except: pass with a try/else: LOW",
  "'token' comparisons need an auth context (lexer and cache tokens excluded)"
 ],
 "new_detection": [
  "an auth-named function comparing two of its own parameters with == (check_api_key(provided, stored))"
 ],
 "tests": "tests: 242 + 324 passed (cainwitness, falsework report/benchmark/blind, cain_audit, KEYSTONE family)"
}