Risk scoring

Signals

A score is not a black box. It is produced by weighted signals, and each one appears in the response with its severity and an explanation:

{
  "score": 70,
  "level": "moderate",
  "signals_count": 3,
  "signals": [
    {
      "code": "contract_unverified",
      "severity": "high",
      "detail": "No published source to read.",
      "weight": 18
    }
  ],
  "basis": "…what the score was computed from"
}

Ceiling scores

When a check could not run, the score it would have affected is missing — so the score shown can only be too generous, never too harsh. In a portfolio screen this is explicit:

is_upper_bound

True when a check was missed. The real score is this or lower — never higher.

checks_missed[]

Which checks did not run, by name.

score: null

Nothing could be established at all. Not zero, which would read as the worst possible result, and not a hundred.

This follows directly from Evidence: a score built on checks that did not run is a claim the platform cannot make.