{
  "context": "Evaluates how the solution leverages python-jose's JWE helpers to encrypt and decrypt payloads with configurable algorithms and optional compression, while exposing headers. Focus is on correct calls into jose.jwe.encrypt/decrypt and related helpers rather than custom cryptography.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Encrypt call",
      "description": "encrypt_payload delegates to jose.jwe.encrypt, passing the provided alg as the algorithm parameter and enc as the encryption parameter instead of implementing encryption manually.",
      "max_score": 25
    },
    {
      "name": "Compression flag",
      "description": "When use_compression is true, jose.jwe.encrypt is invoked with zip=\"DEF\" to mark compression, without rolling custom compression outside the library.",
      "max_score": 20
    },
    {
      "name": "Header propagation",
      "description": "cty and kid inputs flow into jose.jwe.encrypt via cty/kid arguments, and decrypt_payload surfaces protected headers by calling jose.jwe.get_unverified_header (or equivalent package helper) rather than manual base64 parsing.",
      "max_score": 20
    },
    {
      "name": "Decrypt call",
      "description": "decrypt_payload relies on jose.jwe.decrypt with the key resolved from key_provider (using kid when present) to obtain plaintext instead of performing custom decryption.",
      "max_score": 25
    },
    {
      "name": "Error handling",
      "description": "Mismatched keys or algorithm errors propagate jose.exceptions.JWEError (or derivatives) from encrypt/decrypt so callers observe a clear failure rather than silent fallback.",
      "max_score": 10
    }
  ]
}