```json
{
  "criteria": {
    "c1": "not_met",
    "c2": "not_met",
    "c3": "not_met",
    "c4": "not_met",
    "c5": "not_met"
  },
  "note": "The response mostly restates the existing specification instead of identifying missing requirements, failing to cover token lifecycle, credential attacks, password storage/hashing, and other required security edge cases."
}
```