You accepted a 35-line AI suggestion into auth.py . It looks clean. No red flags. Your linter passes.

LineageLens has already scored it 54 out of 100.

That number does not come from a model, a semantic classifier, or vibes. It comes from a small set of deterministic rules applied at the moment the record is ingested — and understanding how those rules compose tells you something useful about what "AI code risk" actually means in practice.

The architecture: two functions, two moments

The risk scoring in LineageLens lives entirely in lineagelens-backend/app/services/risk_service.py . It exposes exactly two public functions:

python def compute_risk_score( inserted_code: str, prompt_messages: object | None = None, model_name: str | None = None, file_path: str | None = None, ) -> tuple[int, list[str]]: """Ingest-time. All tiers. Raw fields."""

def compute_risk_from_record( record: dict[str, Any], is_agentic: bool = False, ) -> tuple[int, list[str], set[str]]: """Insights-time. Plus/Max only.…