{
 "product": "Top 25 #18 VIBEGUARD KEYSTONE",
 "date": "2026-11-02",
 "method": "blind set scripts/vibeguard/blind_2026_11_02.py written before changes; scan cases live via POST /vibeguard-keystone/scan-code, prove cases on the engine",
 "runs": [
  {
   "run": "1",
   "held": "3/12",
   "at": "2026-11-02T19:12:56Z"
  }
 ],
 "rows": [
  {
   "kind": "scan",
   "name": "ordinary hashing helper",
   "want": "not blocked",
   "pass": true,
   "detail": "(200, 'CLEAN', [])",
   "after": "held"
  },
  {
   "kind": "scan",
   "name": "errors silenced with contextlib.suppress",
   "want": "flagged",
   "pass": false,
   "detail": "(200, 'CLEAN', [])",
   "after": "HIGH swallowed_exception_risk: contextlib.suppress(Exception)"
  },
  {
   "kind": "scan",
   "name": "except Exception: continue in a validation loop",
   "want": "flagged",
   "pass": false,
   "detail": "(200, 'CLEAN', [])",
   "after": "HIGH swallowed_exception_risk: broad except + continue"
  },
  {
   "kind": "scan",
   "name": "from random import uniform as a risk score",
   "want": "flagged",
   "pass": false,
   "detail": "(200, 'CLEAN', [])",
   "after": "HIGH rng_fabricated_metric (alias resolved)"
  },
  {
   "kind": "scan",
   "name": "import random as r; r.random() as a confidence",
   "want": "flagged",
   "pass": false,
   "detail": "(200, 'CLEAN', [])",
   "after": "HIGH rng_fabricated_metric (alias resolved)"
  },
  {
   "kind": "scan",
   "name": "importlib.import_module of an invented package",
   "want": "flagged",
   "pass": false,
   "detail": "(200, 'CLEAN', [])",
   "after": "CRITICAL: runtime import name checked by the supply-chain guard"
  },
  {
   "kind": "scan",
   "name": "__import__ of an invented package",
   "want": "flagged",
   "pass": false,
   "detail": "(200, 'CLEAN', [])",
   "after": "CRITICAL: runtime import name checked by the supply-chain guard"
  },
  {
   "kind": "scan",
   "name": "typosquat 'reqeusts'",
   "want": "flagged",
   "pass": true,
   "detail": "(200, 'POISONED_DIFF', ['hallucinated_package_slingshot_risk'])",
   "after": "held"
  },
  {
   "kind": "prove",
   "name": "fix deletes the functions",
   "want": "NOT_VERIFIED",
   "pass": false,
   "detail": "VERIFIED",
   "after": "NOT_VERIFIED: functions deleted"
  },
  {
   "kind": "prove",
   "name": "fix adds subprocess the original never used",
   "want": "NOT_VERIFIED",
   "pass": false,
   "detail": "VERIFIED",
   "after": "NOT_VERIFIED: adds subprocess"
  },
  {
   "kind": "prove",
   "name": "proper fix using functools",
   "want": "VERIFIED",
   "pass": false,
   "detail": "Fixed code imports unverified packages: ['functools']",
   "after": "VERIFIED: any standard-library module accepted"
  },
  {
   "kind": "prove",
   "name": "proper fix",
   "want": "VERIFIED",
   "pass": true,
   "detail": "VERIFIED",
   "after": "held"
  }
 ],
 "dev_check": "after the fix: 0 false alarms on 5 ordinary patterns (except ValueError: continue, suppress(FileNotFoundError), import_module('json'), random.choice in a game, secrets.token_hex); used while tuning, not a blind result",
 "fixes": [
  "contextlib.suppress(Exception) and broad 'except: continue' count as swallowed errors",
  "import aliases resolved for the randomness check (from random import uniform, import random as r, numpy.random)",
  "importlib.import_module / __import__ with a literal name go through the supply-chain guard; computed names are flagged",
  "prove(): any standard-library module accepted (functools was refused); no new process/network/native/unsafe-loading module; every top-level function and class kept"
 ],
 "tests": "VibeGuard suites 47 -> 49",
 "samples": "3 bundled samples keep their grades",
 "pending_deploy": "gateway rolling deploy (the /vibeguard-keystone routes import keystone/vibeguard.py)",
 "limits": [
  "self-run, no independent review",
  "static analysis of Python only; behaviour at run time is not observed",
  "a swallowed error written another way (a broad except that logs and returns a default) is reported by the vulnerability rules only in some shapes",
  "keeping function names does not prove the behaviour was kept"
 ]
}