Rubric

Assessment	Points
Correct environment and reproducible commands	10
Direct/transitive dependency explanation	15
Advisory evidence and application-context reasoning	20
Justified remediation and manifest/lockfile review	20
Functional tests and before/after scan comparison	25
Limitations and clear submission	10
Total	100

Report-analysis fallback: award the verification portion for correctly interpreting supplied artifacts and specifying checks that would be run. Require explicit disclosure that execution was not performed; do not award invented runs.