{
  "context": "Evaluates whether the solution relies on python-jose's unverified inspection helpers to surface JWT/JWS headers and claims as described, without doing any signature validation. Emphasizes correct API selection for header/claim access and safe handling of malformed tokens using jose's parsing behavior.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Header API",
      "description": "Uses python-jose unverified header helper (e.g., jose.jwt.get_unverified_header or jose.jws.get_unverified_header[s]) for every header lookup instead of manual base64 parsing or verification-oriented calls.",
      "max_score": 30
    },
    {
      "name": "Claim API",
      "description": "Uses python-jose unverified claim helper (jose.jwt.get_unverified_claims or jose.jws.get_unverified_claims) to read payloads so expired or unknown-signature tokens are still decoded without verification.",
      "max_score": 30
    },
    {
      "name": "No verification",
      "description": "Does not call verification-focused helpers (e.g., jose.jwt.decode/jose.jws.verify) or require keys/secrets for the inspection paths; relies solely on unverified helpers while assembling summaries.",
      "max_score": 20
    },
    {
      "name": "Error handling",
      "description": "Detects malformed tokens by handling jose parsing errors (e.g., jose.exceptions.JWTError/JWSError from get_unverified_header/claims) and maps them to the spec's ValueError response rather than custom token parsing.",
      "max_score": 20
    }
  ]
}