diff --git a/app/console.py b/app/console.py
index fdaa1ab..6001d32 100644
--- a/app/console.py
+++ b/app/console.py
@@ -885,6 +885,25 @@ async def test_page(request: Request, current=Depends(require_login)):
 
     samples_dir = Path(__file__).resolve().parent.parent / "tests" / "samples"
     index_path = samples_dir / "index.json"
+    labels_path = Path(__file__).resolve().parent.parent / "rules" / "rule_labels.yaml"
+
+    # 加载规则中文标签
+    rule_labels: dict[str, str] = {}
+    layer_definitions: dict[str, str] = {}
+    try:
+        import yaml as _yaml
+        if labels_path.exists():
+            _lbl_raw = _yaml.safe_load(labels_path.read_text(encoding="utf-8")) or {}
+            # 映射 engine_rule_name → 中文标签
+            for k, v in _lbl_raw.items():
+                if isinstance(v, dict) and "label" in v:
+                    rule_labels[k] = v["label"]
+            # 层定义
+            if index_path.exists():
+                _idx = json.loads(index_path.read_text(encoding="utf-8"))
+                layer_definitions = _idx.get("layer_definition", {})
+    except Exception:  # noqa: BLE001
+        pass
 
     rescan = request.query_params.get("rescan") == "1"
     samples_list: list[Path] = []
@@ -1146,6 +1165,8 @@ async def test_page(request: Request, current=Depends(require_login)):
             "policy_version": policy_version,
             "last_run_at": last_run_at,
             "rescan": rescan,
+            "rule_labels": rule_labels,
+            "layer_definitions": layer_definitions,
         },
     )
 
diff --git a/app/templates/test_center.html b/app/templates/test_center.html
index 88da8c2..8c8127d 100644
--- a/app/templates/test_center.html
+++ b/app/templates/test_center.html
@@ -139,7 +139,7 @@
           {% if r.expected_rules %}
             <div style="margin-top:4px;">
               {% for rule in r.expected_rules %}
-                <span class="chip chip-gray" style="font-family:monospace;font-size:10px;">{{ rule }}</span>
+                <span class="chip chip-gray" style="font-size:10px;" title="{{ rule }}">{{ rule_labels.get(rule, rule) }}</span>
               {% endfor %}
             </div>
           {% endif %}
@@ -152,7 +152,7 @@
           {% if r.actual_rules %}
             <div style="margin-top:4px;">
               {% for rule in r.actual_rules %}
-                <span class="chip chip-{% if rule in r.expected_rules %}ok{% else %}info{% endif %}" style="font-family:monospace;font-size:10px;">{{ rule }}</span>
+                <span class="chip chip-{% if rule in r.expected_rules %}ok{% else %}info{% endif %}" style="font-size:10px;" title="{{ rule }}">{{ rule_labels.get(rule, rule) }}</span>
               {% endfor %}
             </div>
           {% elif r.actual_verdict in ('pass', 'clean') %}
diff --git a/rules/rule_labels.yaml b/rules/rule_labels.yaml
new file mode 100644
index 0000000..7375d6d
--- /dev/null
+++ b/rules/rule_labels.yaml
@@ -0,0 +1,280 @@
+# MeshSafe 规则名中文标签映射
+# 前端显示时用中文名代替引擎内部的英文 rule_name
+# 层级分组对应 CSV 里的 L0-L5 + NEG + L7
+
+# ===== L0 结构分析 =====
+ArchiveBroken:
+  label: "压缩包损坏"
+  desc: "ZIP/7z 结构异常，目录项或文件头损坏"
+
+ArchiveContainsExecutable:
+  label: "压缩包内含可执行文件"
+  desc: "归档内包含 .exe/.dll/.sys/.scr 等 PE 文件"
+
+ExtensionMismatch:
+  label: "后缀伪装"
+  desc: "文件声明扩展名与真实幻数不符（如 jpg 后缀实际 MZ 头）"
+
+DoubleExtension:
+  label: "双扩展名伪装"
+  desc: "文件名含两个扩展名，隐藏真实后缀（如 report.pdf.exe）"
+
+DangerousExecutableExtension:
+  label: "危险可执行扩展名"
+  desc: "文件后缀属于可执行/脚本类型（exe/ps1/bat/cmd/js/vbs 等）"
+
+ShellScriptDangerous:
+  label: "危险脚本扩展名"
+  desc: "shell/bash/powershell 等脚本类扩展名"
+
+PathTraversal:
+  label: "压缩包路径穿越"
+  desc: "ZIP 内文件名包含 ../ 或绝对路径，可能覆盖系统文件"
+
+PathTraversalBlocked:
+  label: "路径穿越已拦截"
+  desc: "扫描器已阻止路径穿越文件落地"
+
+ArchiveBombSuspect:
+  label: "ZIP 炸弹"
+  desc: "压缩比异常高（如 42.zip），解压膨胀可能耗尽磁盘/内存"
+
+EncryptedArchive:
+  label: "加密压缩包"
+  desc: "ZIP 设置了打开密码，无法扫描内部内容"
+
+MalformedStructure:
+  label: "文件结构畸形"
+  desc: "文件能识别但内部结构不符合该格式规范"
+
+ZeroByteFile:
+  label: "零字节文件"
+  desc: "空文件（0 字节）"
+
+# ===== L1 ClamAV =====
+"ClamAV:EICAR":
+  label: "ClamAV EICAR 测试病毒"
+  desc: "命中 ClamAV EICAR-STANDARD-ANTIVIRUS-TEST-FILE 签名"
+
+Eicar-Test-Signature:
+  label: "EICAR 测试签名"
+  desc: "ClamAV 识别到 EICAR 标准测试串（行业无害测试）"
+
+# ===== L2 文档深度 =====
+OfficeEncrypted:
+  label: "Office 加密文档"
+  desc: "DOCX/XLSX/PPTX 设置了打开密码"
+
+OleToolsUnavailable:
+  label: "OLE 工具不可用"
+  desc: "olefile 未安装，无法扫描 OLE 结构"
+
+OoxmlParseFailed:
+  label: "OOXML 解析失败"
+  desc: "DOCX/XLSX/PPTX ZIP 内部 XML 损坏"
+
+AttachedTemplate:
+  label: "模板注入风险"
+  desc: "Word 文档关联了外部模板（可能触发模板后门）"
+
+VBAAutoExecShell:
+  label: "VBA 宏自动执行 Shell"
+  desc: "检测到 AutoOpen/Workbook_Open 等自动执行入口 + Shell/CreateObject 等危险调用"
+
+PdfJavaScript:
+  label: "PDF 内含 JavaScript"
+  desc: "PDF 文档嵌入可执行 JavaScript"
+
+PdfOpenAction:
+  label: "PDF OpenAction 跳转"
+  desc: "PDF 启动时有自动跳转/打开外部链接动作"
+
+PdfParseFailed:
+  label: "PDF 解析失败"
+  desc: "PDF 结构异常或为占位文件，无法正常解析"
+
+ChmWithScript:
+  label: "CHM 内含脚本"
+  desc: "CHM 帮助文档包含 ActiveScript/JScript"
+
+DesktopFileAutoExec:
+  label: "Linux .desktop 自动执行"
+  desc: ".desktop 文件设置了自动执行属性"
+
+# ===== L3 关键词匹配 =====
+ReverseShellNetcat:
+  label: "NC 反弹 Shell"
+  desc: "包含 nc/ncat/netcat /bin/bash -i >& /dev/tcp/ 等反弹 shell 特征"
+
+ReverseShellPowershell:
+  label: "PowerShell EncodedCommand"
+  desc: "包含 powershell -enc / -w hidden 等混淆执行"
+
+CredentialStealer:
+  label: "凭据窃取工具"
+  desc: "包含 mimikatz/sekurlsa/gsecdump/DCSync/Rubeus 等"
+
+CredentialExport:
+  label: "凭据导出命令"
+  desc: "包含 reg save HKLM\\SAM/SYSTEM/secretsdump 等"
+
+RemoteDownloadPowerShell:
+  label: "PowerShell 远程下载"
+  desc: "Invoke-WebRequest/Invoke-RestMethod/DownloadString/BitsAdmin 等"
+
+RemoteDownloadUnix:
+  label: "Unix 远程下载"
+  desc: "wget/curl/certutil -urlcache -split 等"
+
+RemoteSessionHijack:
+  label: "远程会话劫持"
+  desc: "tscon/rdpclip/shadow/CreateRemoteThread 等"
+
+CommandExecutionObfuscated:
+  label: "命令执行混淆"
+  desc: "certutil -decode/mshta/regsvr32 /s 等混淆执行"
+
+WMILdapAttack:
+  label: "WMI/LDAP 攻击"
+  desc: "wmic path/wmic process call create/ldapsearch 等"
+
+ClassifiedLevelMarkers:
+  label: "涉密密级标记"
+  desc: "包含绝密/机密/秘密/内部文件/禁止外传等密级标识"
+
+InternalDocumentPatterns:
+  label: "国家机密标识"
+  desc: "包含国家机密|涉密|密级：等关键词"
+
+# ===== L4 YARA =====
+# 留空 → YARA 规则文件自己的 rule name 就是中文或 meta 里有描述
+
+# ===== L5 PE 二进制 =====
+UPXPackerDetected:
+  label: "UPX 加壳"
+  desc: "PE 节名包含 UPX0/UPX1/UPX!，检测到 UPX 加壳"
+
+RWXSectionDetected:
+  label: "RWX 可写可执行节"
+  desc: "PE 节同时设置了 MEM_EXECUTE + MEM_WRITE，典型绕过 DEP 手法"
+
+HighEntropySection:
+  label: "节区熵值异常"
+  desc: "PE 节熵 ≥ 7.2，可能经过加密或加壳"
+
+SuspiciousImports:
+  label: "可疑导入表"
+  desc: "PE 导入表包含 VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 等高危注入 API"
+
+UnsignedExecutable:
+  label: "未签名可执行文件"
+  desc: "PE 未携带 Authenticode 数字签名"
+
+SuspiciousTimestamp:
+  label: "编译时间戳异常"
+  desc: "PE 编译时间戳为 0 或指向未来时间，可能被伪造"
+
+PEArchInfo:
+  label: "PE 架构信息"
+  desc: "PE 架构识别（x86/x64/ARM 等），辅助判断"
+
+DebugInformationPresent:
+  label: "含调试信息"
+  desc: "PE 包含 PDB 调试路径或 .debug 节"
+
+PeParseFailed:
+  label: "PE 结构解析失败"
+  desc: "pefile 无法解析 PE，可能是畸形文件"
+
+LinuxExecutable:
+  label: "Linux ELF 可执行"
+  desc: "ELF 格式 Linux 可执行文件"
+
+# ===== C1/C3/C7/C8 自动命名规则 =====
+"C1_PE_Downloader_Loader":
+  label: "YARA: PE 下载木马"
+  desc: "YARA C1_PE_Downloader_Loader 规则命中"
+
+"C1_PE_ProcessInjection":
+  label: "YARA: PE 进程注入"
+  desc: "YARA C1_PE_ProcessInjection 规则命中"
+
+"C3_PHP_Webshell_Oneliner":
+  label: "YARA: PHP 一句话木马"
+  desc: "YARA C3_PHP_Webshell_Oneliner 规则命中"
+
+"C3_PHP_Webshell_Obfuscated":
+  label: "YARA: PHP 混淆木马"
+  desc: "YARA C3_PHP_Webshell_Obfuscated 规则命中"
+
+"C3_JSP_Webshell_RuntimeExec":
+  label: "YARA: JSP Runtime exec 木马"
+  desc: "YARA C3_JSP_Webshell_RuntimeExec 规则命中"
+
+"C7_Linux_ReverseShell_Bash":
+  label: "YARA: Bash 反弹 Shell"
+  desc: "YARA C7_Linux_ReverseShell_Bash 规则命中"
+
+"C7_Linux_ReverseShell_NC":
+  label: "YARA: NC 反弹 Shell"
+  desc: "YARA C7_Linux_ReverseShell_NC 规则命中"
+
+"C7_Linux_ReverseShell_Misc":
+  label: "YARA: Linux 反弹 Shell（其他）"
+  desc: "YARA C7_Linux_ReverseShell_Misc 规则命中"
+
+"C7_Linux_Persistence_Crontab":
+  label: "YARA: Crontab 持久化"
+  desc: "YARA C7_Linux_Persistence_Crontab 规则命中"
+
+"C7_Linux_Miner_Generic":
+  label: "YARA: 挖矿程序"
+  desc: "YARA C7_Linux_Miner_Generic 规则命中"
+
+"C8_Ransomware_Encryption":
+  label: "YARA: 勒索加密特征"
+  desc: "YARA C8_Ransomware_Encryption 规则命中"
+
+"C8_Ransomware_Note_Filename":
+  label: "YARA: 勒索赎金文件名"
+  desc: "YARA C8_Ransomware_Note_Filename 规则命中"
+
+"C8_Ransomware_VolumeShadow":
+  label: "YARA: VSS 卷影副本删除"
+  desc: "YARA C8_Ransomware_VolumeShadow 规则命中"
+
+# ===== 邮件 =====
+EmailAttachmentDangerous:
+  label: "邮件附件危险"
+  desc: "EML 包含 .exe/.dll/.ps1 等危险附件"
+
+EmailAttachmentDisguised:
+  label: "邮件附件伪装"
+  desc: "EML 附件扩展名与真实类型不符"
+
+EmailAttachmentWebshell:
+  label: "邮件附件 Webshell"
+  desc: "EML 附件为 PHP/ASP/JSP 一句话木马"
+
+EmailPhishingKeyword:
+  label: "钓鱼邮件关键词"
+  desc: "EML 正文包含钓鱼诈骗关键词"
+
+# ===== 其他 =====
+SuspiciousScript:
+  label: "可疑脚本"
+  desc: "脚本内容触发通用恶意特征"
+
+"Txt.Malware.Sustes-6779550-1":
+  label: "ClamAV: Sustes 木马变体"
+  desc: "ClamAV 识别到 Sustes 木马家族签名"
+
+# ===== verdict → 中文 =====
+# （前端直接写死在 template 里，这里留文档）
+verdict_labels:
+  clean: "干净（放行）"
+  suspicious: "可疑（人工审核）"
+  reject: "拦截（零容忍）"
+  malicious: "恶意（零容忍）"
+  pending: "待测"
+  unknown: "未知"
diff --git a/tests/samples/index.json b/tests/samples/index.json
index 68456ca..0afd9ec 100644
--- a/tests/samples/index.json
+++ b/tests/samples/index.json
@@ -1,7 +1,16 @@
 {
   "meshsafe_target_version": "v0.2.1",
-  "index_regenerated_at": "2026-10-29T11:43:14.552192",
-  "regenerate_note": "expected_rules 已对齐引擎真实输出的 rule 字段（之前是手写瞎编名）",
+  "index_regenerated_at": "2026-10-29T11:48:22.953397",
+  "layer_definition": {
+    "L0": "结构分析（幻数/后缀伪装/嵌套/路径穿越/zip 炸弹）",
+    "L1": "ClamAV 病毒库扫描",
+    "L2": "文档深度检测（OLE/Macro/JS）",
+    "L3": "关键词匹配（恶意行为特征）",
+    "L4": "YARA 规则匹配",
+    "L5": "PE 二进制静态分析（壳/导入/节/签名）",
+    "NEG": "负样本（业务正常文件，应无告警）",
+    "L7": "历史遗留样本（CSV 之外的真实恶意/误报对照）"
+  },
   "samples": [
     {
       "filename": "L0-001_jpg_normal.jpg",
@@ -10,9 +19,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "干净jpg图片（对照负样本）",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-002_png_normal.png",
@@ -21,9 +28,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常文件幻数识别-PNG",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-003_docx_normal.docx",
@@ -32,9 +37,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "干净docx文档（对照负样本）",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-004_pdf_normal.pdf",
@@ -46,9 +49,7 @@
         "PdfParseFailed"
       ],
       "description": "正常文件幻数识别-PDF",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 20.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-005_pe_clean.exe",
@@ -60,9 +61,7 @@
         "PeParseFailed"
       ],
       "description": "干净hello PE（对照负样本）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-006_disguise_jpg_pe.jpg",
@@ -73,9 +72,7 @@
         "ExtensionMismatch"
       ],
       "description": "jpg 后缀 + 实际 PE MZ 头",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L0-007_disguise_txt_pdf.txt",
@@ -87,9 +84,7 @@
         "MalformedStructure"
       ],
       "description": "后缀伪装：txt后缀，实际PDF幻数",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L0-008_disguise_png_zip.png",
@@ -101,9 +96,7 @@
         "MalformedStructure"
       ],
       "description": "后缀伪装：png后缀，实际ZIP幻数",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L0-009_double_ext_pdf_exe.pdf.exe",
@@ -116,9 +109,7 @@
         "PeParseFailed"
       ],
       "description": "双扩展名伪装：report.pdf.exe",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L0-010_double_ext_txt_ps1.txt.ps1",
@@ -130,9 +121,7 @@
         "DoubleExtension"
       ],
       "description": "双扩展名伪装：data.txt.ps1",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L0-011_double_ext_docx_js.docx.js",
@@ -143,9 +132,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "双扩展名伪装：note.docx.js",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-012_double_ext_xlsx_bat.xlsx.bat",
@@ -157,9 +144,7 @@
         "DoubleExtension"
       ],
       "description": "双扩展名伪装：log.xlsx.bat",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L0-013_clean.ps1",
@@ -170,9 +155,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "干净 ps1 文件",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-014_clean.bat",
@@ -183,9 +166,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "干净 bat 文件",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-015_clean.cmd",
@@ -196,9 +177,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "干净 cmd 文件",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-016_clean.vbs",
@@ -209,9 +188,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "干净 vbs 文件",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-017_clean.js",
@@ -222,9 +199,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "干净 js 文件",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-018_zip_traversal.zip",
@@ -236,9 +211,7 @@
         "PathTraversalBlocked"
       ],
       "description": "ZIP单级路径穿越：../test.txt",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L0-019_zip_deep_traversal.zip",
@@ -250,9 +223,7 @@
         "PathTraversalBlocked"
       ],
       "description": "ZIP多级路径穿越：../../a.txt",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L0-020_zip_bomb.zip",
@@ -261,9 +232,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "ZIP炸弹42.zip",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-021_small_bomb.zip",
@@ -272,9 +241,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "自制小型 zip 炸弹（50 成员 × 8KB STORED）",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-022_3layer_nested.zip",
@@ -283,9 +250,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "3层无害嵌套ZIP",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-023_5layer_nested.zip",
@@ -294,9 +259,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "5 层无害嵌套 ZIP",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-024_encrypted.zip",
@@ -305,9 +268,7 @@
       "expected_verdict": "review",
       "expected_rules": [],
       "description": "加密 ZIP（标记待验证）",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-025_corrupt_zip.zip",
@@ -319,9 +280,7 @@
         "MalformedStructure"
       ],
       "description": "截断损坏 ZIP 头",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-026_corrupt_direntry.zip",
@@ -330,9 +289,7 @@
       "expected_verdict": "review",
       "expected_rules": [],
       "description": "损坏ZIP目录项",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-027_long_filename.zip",
@@ -341,9 +298,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "压缩包内 200 字符超长文件名",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-028_unicode_filename.zip",
@@ -352,9 +307,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "unicode/emoji 文件名",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L0-029_zero_byte_exe.exe",
@@ -366,9 +319,7 @@
         "PeParseFailed"
       ],
       "description": "空文件（0字节）后缀exe",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L0-030_nested_traversal.zip",
@@ -377,9 +328,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "嵌套 zip 内含穿越条目",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L1-001_eicar.txt",
@@ -390,9 +339,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "EICAR标准测试串文本",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-002_eicar_in_zip.zip",
@@ -403,9 +350,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "EICAR放入zip压缩包",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-003_eicar_in_encrypted.zip",
@@ -416,9 +361,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "加密 ZIP（占位：实际加密需 7z/zip -P）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-004_eicar_in_docx.docx",
@@ -429,9 +372,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "EICAR放入docx内嵌（OLE）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-005_eicar_modified.txt",
@@ -440,9 +381,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "修改 1 字节 EICAR，ClamAV 不应命中",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L1-009_minimal.cvd",
@@ -451,9 +390,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "热加载测试占位（需真实 .cvd 文件）",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L1-010_corrupt.cvd",
@@ -462,9 +399,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "损坏病毒库占位",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L1-011_eicar_in_3layer.zip",
@@ -475,9 +410,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "EICAR放在多层嵌套zip",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-012_eicar_base64.txt",
@@ -486,9 +419,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "base64 编码 EICAR，ClamAV 不解码",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L1-013_bigfile_eicar.txt",
@@ -497,9 +428,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "10MB+ 文本尾部含 EICAR",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L1-014_concurrent_eicar_00.txt",
@@ -510,9 +439,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #0",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_01.txt",
@@ -523,9 +450,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #1",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_02.txt",
@@ -536,9 +461,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #2",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_03.txt",
@@ -549,9 +472,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #3",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_04.txt",
@@ -562,9 +483,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #4",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_05.txt",
@@ -575,9 +494,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #5",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_06.txt",
@@ -588,9 +505,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #6",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_07.txt",
@@ -601,9 +516,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #7",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_08.txt",
@@ -614,9 +527,7 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #8",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_eicar_09.txt",
@@ -627,20 +538,16 @@
         "Eicar-Test-Signature"
       ],
       "description": "并发压测占位 #9",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L1-014_concurrent_test.txt",
       "case_id": "L1-014",
       "category": "L1",
-      "expected_verdict": "clean",
+      "expected_verdict": "pass",
       "expected_rules": [],
       "description": "并发压测占位（靠 API 并发调用）",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L1-015_layer_off_sample.bin",
@@ -654,9 +561,7 @@
         "PeParseFailed"
       ],
       "description": "关闭分层开关测试占位",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L3-001_001_sample.ps1",
@@ -669,9 +574,7 @@
         "SuspiciousScript"
       ],
       "description": "PS1明文：Invoke-WebRequest下载",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L3-002_002_sample.ps1",
@@ -684,9 +587,7 @@
         "ReverseShellNetcat"
       ],
       "description": "PS1明文：反弹shell nc",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L3-003_003_sample.bat",
@@ -698,9 +599,7 @@
         "RemoteDownloadUnix"
       ],
       "description": "bat明文：curl下载payload",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 60.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-004_004_sample.txt",
@@ -711,9 +610,7 @@
         "CredentialStealer"
       ],
       "description": "文本包含mimikatz关键字",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 45.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-005_005_sample.txt",
@@ -724,9 +621,7 @@
         "CredentialExport"
       ],
       "description": "文本包含reg save导出注册表",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 45.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-006_006_sample.txt",
@@ -737,9 +632,7 @@
         "RemoteSessionHijack"
       ],
       "description": "文本包含rdp、tscon劫持关键字",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-007_007_sample.txt",
@@ -748,9 +641,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "高危串base64编码放在txt",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L3-008_008_sample.ps1",
@@ -761,9 +652,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "Powershell字符串拆分拼接绕过",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-009_newline_split.txt",
@@ -772,9 +661,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "换行分割绕过（L3 不做换行合并，记录边界）",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L3-010_010_sample.ps1",
@@ -785,9 +672,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "高危串插入注释分割（powershell #注释）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-011_011_sample.js",
@@ -799,9 +684,7 @@
         "RemoteDownloadUnix"
       ],
       "description": "高危串放js脚本内",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 60.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-012_012_sample.bat",
@@ -813,9 +696,7 @@
         "RemoteDownloadUnix"
       ],
       "description": "正常内网运维curl（白名单对照）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 60.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-013_normal_scp.sh",
@@ -826,9 +707,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "内网正常 scp 运维脚本，不误报",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-014_l3001_in_zip.zip",
@@ -840,9 +719,7 @@
         "RemoteDownloadPowerShell"
       ],
       "description": "高危字符串放在zip内部txt",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L3-015_keyword_in_docx.docx",
@@ -853,9 +730,7 @@
         "RemoteDownloadPowerShell"
       ],
       "description": "高危字符串放在docx文本正文",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-016_016_sample.ps1",
@@ -866,9 +741,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "空脚本文件（负样本）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-017_017_sample.txt",
@@ -880,9 +753,7 @@
         "ReverseShellNetcat"
       ],
       "description": "多条高危特征同文件复合",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 85.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L3-018_018_sample.txt",
@@ -893,9 +764,7 @@
         "RemoteDownloadPowerShell"
       ],
       "description": "高危字符串大小写混写",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-019_unicode_obfuscated.txt",
@@ -904,9 +773,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "同形字混淆，L3 默认不命中",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L3-020_log_with_keyword.log",
@@ -918,9 +785,7 @@
         "ReverseShellNetcat"
       ],
       "description": "日志文件混杂正常日志+高危串",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L3-021_021_sample.eml",
@@ -931,9 +796,7 @@
         "RemoteDownloadPowerShell"
       ],
       "description": "高危字符串放在eml邮件正文",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-022_layer_off_sample.bin",
@@ -947,9 +810,7 @@
         "RemoteDownloadPowerShell"
       ],
       "description": "关闭分层开关测试占位",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L3-023_keyword_in_encrypted.zip",
@@ -960,9 +821,7 @@
         "CredentialStealer"
       ],
       "description": "加密 zip 内容无法扫描（标记）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 45.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-024_024_sample.txt",
@@ -973,9 +832,7 @@
         "RemoteDownloadPowerShell"
       ],
       "description": "超长单行文本（10万字符）包含高危串",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L3-025_whitelist_test.txt",
@@ -986,9 +843,7 @@
         "RemoteDownloadPowerShell"
       ],
       "description": "内网白名单域名对照（策略层白名单）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L4-001_001_sample.txt",
@@ -997,9 +852,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "YARA正向命中占位（需对应规则）",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-002_002_sample.txt",
@@ -1008,9 +861,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "干净对照",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-003_pe_with_string.exe",
@@ -1024,9 +875,7 @@
         "UnsignedExecutable"
       ],
       "description": "二进制内嵌匹配字符串",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 75.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L4-004_multi_rule_match.txt",
@@ -1035,20 +884,16 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "同一个文件同时命中多条 YARA",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-005_005_sample.txt",
       "case_id": "L4-005",
       "category": "L4",
-      "expected_verdict": "clean",
+      "expected_verdict": "pass",
       "expected_rules": [],
       "description": "热加载测试占位",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-006_bad_syntax_rule.yar",
@@ -1059,9 +904,7 @@
         "ExtensionMismatch"
       ],
       "description": "语法错误 YARA 规则文件（输入给规则目录）",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L4-007_meta_rule_match.txt",
@@ -1070,20 +913,16 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "带 meta 的 YARA 规则匹配",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-008_in_zip.zip",
       "case_id": "L4-008",
       "category": "L4",
-      "expected_verdict": "clean",
+      "expected_verdict": "pass",
       "expected_rules": [],
       "description": "压缩包内文件匹配YARA规则",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-009_yara_in_encrypted.zip",
@@ -1092,20 +931,16 @@
       "expected_verdict": "review",
       "expected_rules": [],
       "description": "加密 zip 内 YARA 样本",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-010_010_sample.txt",
       "case_id": "L4-010",
       "category": "L4",
-      "expected_verdict": "clean",
+      "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正则 YARA 测试占位",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-011_count_condition.txt",
@@ -1114,9 +949,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "YARA count > 3 条件",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-012_size_condition.bin",
@@ -1129,9 +962,7 @@
         "PeParseFailed"
       ],
       "description": "YARA 文件大小条件",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L4-013_bigfile_yara.txt",
@@ -1140,9 +971,7 @@
       "expected_verdict": "reject",
       "expected_rules": [],
       "description": "100MB 文件 YARA 扫描",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L4-014_layer_off_sample.bin",
@@ -1155,9 +984,7 @@
         "PeParseFailed"
       ],
       "description": "关闭分层开关测试占位",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L4-015_hash_whitelist.txt",
@@ -1166,9 +993,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "MD5 在白名单",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "L5-001_clean_hello.exe",
@@ -1180,9 +1005,7 @@
         "PeParseFailed"
       ],
       "description": "原生干净HelloWorld PE（无壳）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-002_upx_shell.exe",
@@ -1194,9 +1017,7 @@
         "PeParseFailed"
       ],
       "description": "UPX0/UPX1 节名",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-003_double_upx.exe",
@@ -1208,9 +1029,7 @@
         "PeParseFailed"
       ],
       "description": "UPX加壳PE，二次压缩",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-004_rwx_section.exe",
@@ -1222,9 +1041,7 @@
         "PeParseFailed"
       ],
       "description": "节属性 RWX",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-005_injection_imports.exe",
@@ -1238,9 +1055,7 @@
         "UnsignedExecutable"
       ],
       "description": "注入组合导入（需要真实 pefile 引入 API）",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 75.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L5-006_single_virtualalloc.exe",
@@ -1254,9 +1069,7 @@
         "UnsignedExecutable"
       ],
       "description": "单一可疑内存 API",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 75.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L5-007_garbage_section.exe",
@@ -1268,9 +1081,7 @@
         "PeParseFailed"
       ],
       "description": "节名乱码",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-008_many_exports.exe",
@@ -1284,9 +1095,7 @@
         "UnsignedExecutable"
       ],
       "description": "导出表异常（需真实工具生成）",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 75.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L5-009_shell_in_resource.exe",
@@ -1300,9 +1109,7 @@
         "UnsignedExecutable"
       ],
       "description": "资源段内嵌字符串（占位）",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 75.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L5-010_bad_mz.exe",
@@ -1315,9 +1122,7 @@
         "PeParseFailed"
       ],
       "description": "PE 头非法",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "_scan_verdict": "reject"
     },
     {
       "filename": "L5-011_truncated.exe",
@@ -1329,9 +1134,7 @@
         "PeParseFailed"
       ],
       "description": "截断 PE",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-012_pe32.exe",
@@ -1343,9 +1146,7 @@
         "PeParseFailed"
       ],
       "description": "32 位识别",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-013_pe64.exe",
@@ -1357,9 +1158,7 @@
         "PeParseFailed"
       ],
       "description": "64 位识别占位",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-014_clean_tool.exe",
@@ -1371,9 +1170,7 @@
         "PeParseFailed"
       ],
       "description": "PE导入表大量系统API（正常工具）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-015_bad_reloc.exe",
@@ -1387,9 +1184,7 @@
         "UnsignedExecutable"
       ],
       "description": "重定位表损坏占位",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 75.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L5-016_zero_section.exe",
@@ -1401,9 +1196,7 @@
         "PeParseFailed"
       ],
       "description": "零节 PE 占位",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-016_zero_sections.exe",
@@ -1417,9 +1210,7 @@
         "UnsignedExecutable"
       ],
       "description": "无节表最小 PE",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 75.0,
-      "_last_scan_findings": 4
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "L5-017_upx_rwx.exe",
@@ -1431,9 +1222,7 @@
         "PeParseFailed"
       ],
       "description": "UPX壳 + RWX节复合特征",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-018_debug_info.exe",
@@ -1445,9 +1234,7 @@
         "PeParseFailed"
       ],
       "description": "调试信息占位",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-019_200mb_huge.exe",
@@ -1459,9 +1246,7 @@
         "PeParseFailed"
       ],
       "description": "200MB 超大 PE（占位，真实生成会写满磁盘）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "L5-020_layer_off_sample.bin",
@@ -1477,9 +1262,7 @@
         "UnsignedExecutable"
       ],
       "description": "关闭分层开关测试占位",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 6
+      "_scan_verdict": "reject"
     },
     {
       "filename": "NEG-001_clean.jpg",
@@ -1488,9 +1271,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "业务标准JPG图片",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "NEG-002_clean.png",
@@ -1499,9 +1280,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "业务PNG图片",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "NEG-003_clean.mp4",
@@ -1510,9 +1289,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "业务MP4视频",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "NEG-004_clean.docx",
@@ -1521,9 +1298,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "业务正常docx报表",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "NEG-005_clean.xlsx",
@@ -1532,9 +1307,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "业务正常xlsx表格",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "NEG-006_clean.pdf",
@@ -1546,9 +1319,7 @@
         "PdfParseFailed"
       ],
       "description": "业务正常PDF报告",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 20.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "NEG-007_clean.java",
@@ -1557,9 +1328,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "业务源码java文件",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "reject"
     },
     {
       "filename": "NEG-008_clean.py",
@@ -1570,9 +1339,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "业务源码python脚本",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "NEG-009_clean.zip",
@@ -1581,9 +1348,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常业务压缩包zip",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "NEG-010_clean.exe",
@@ -1595,9 +1360,7 @@
         "PeParseFailed"
       ],
       "description": "正常业务安装包（干净开源）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "NEG-011_clean.log",
@@ -1606,9 +1369,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常日志文件",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "reject"
     },
     {
       "filename": "NEG-012_clean.csv",
@@ -1617,9 +1378,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常csv业务数据文件",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "NEG-013_clean.eml",
@@ -1628,9 +1387,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常eml业务邮件（无附件、无外联恶意）",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "clean"
     },
     {
       "filename": "NEG-014_clean.dll",
@@ -1642,9 +1399,7 @@
         "PeParseFailed"
       ],
       "description": "正常dll（系统干净dll）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "NEG-015_clean.ttf",
@@ -1653,9 +1408,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常字体文件ttf",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "reject"
     },
     {
       "filename": "NEG-016_clean.dwg",
@@ -1664,9 +1417,7 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常CAD图纸",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "reject"
     },
     {
       "filename": "NEG-017_4layer_nested.zip",
@@ -1678,9 +1429,7 @@
         "MalformedStructure"
       ],
       "description": "多层嵌套干净zip（无风险）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 2
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "NEG-018_clean.bat",
@@ -1691,9 +1440,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "正常bat运维脚本（内网备份）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "NEG-019_clean.ps1",
@@ -1704,9 +1451,7 @@
         "DangerousExecutableExtension"
       ],
       "description": "正常ps1运维脚本（内网查询）",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "NEG-020_clean.odt",
@@ -1715,97 +1460,83 @@
       "expected_verdict": "pass",
       "expected_rules": [],
       "description": "正常odt文档",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 0
+      "_scan_verdict": "reject"
     },
     {
       "filename": "broken.zip",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-001",
+      "category": "L7",
       "expected_verdict": "clean",
       "expected_rules": [],
-      "description": "",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "description": "损坏 ZIP",
+      "_scan_verdict": "clean"
     },
     {
       "filename": "evil.iso",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-002",
+      "category": "L7",
       "expected_verdict": "suspicious",
       "expected_rules": [
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "description": "恶意 ISO 镜像",
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "evil_help.chm",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-003",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "ChmWithScript",
         "DangerousExecutableExtension",
         "RemoteDownloadUnix"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "description": "含脚本 CHM 帮助",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "linux_malicious",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-004",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "C7_Linux_ReverseShell_Bash",
         "LinuxExecutable",
         "ReverseShellNetcat"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "description": "Linux 恶意脚本集",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "lolbin.cmd",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-005",
+      "category": "L7",
       "expected_verdict": "suspicious",
       "expected_rules": [
         "CommandExecutionObfuscated",
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 55.0,
-      "_last_scan_findings": 2
+      "description": "LOLBin cmd 混淆",
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "macro_alert.docm",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-006",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "RemoteDownloadPowerShell",
         "RemoteDownloadUnix",
         "VBAAutoExecShell"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "description": "含 VBA 宏 DOCM",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "malicious.desktop",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-007",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "C7_Linux_ReverseShell_Bash",
@@ -1814,128 +1545,108 @@
         "DesktopFileAutoExec",
         "ReverseShellNetcat"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 6
+      "description": "恶意 .desktop 反序列化",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "malicious.pdf",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-008",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "PdfJavaScript",
         "PdfOpenAction"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "description": "含 JS/Action PDF",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "miner_config.json",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-009",
+      "category": "L7",
       "expected_verdict": "suspicious",
       "expected_rules": [
         "C7_Linux_Miner_Generic"
       ],
-      "description": "",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 45.0,
-      "_last_scan_findings": 1
+      "description": "挖矿配置文件",
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "neg_tmp1.zip",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-035",
+      "category": "L7",
       "expected_verdict": "clean",
       "expected_rules": [],
-      "description": "",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "description": "占位残留 tmp zip",
+      "_scan_verdict": "clean"
     },
     {
       "filename": "normal.pdf",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-010",
+      "category": "L7",
       "expected_verdict": "clean",
       "expected_rules": [],
-      "description": "",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "description": "干净 PDF 对照",
+      "_scan_verdict": "clean"
     },
     {
       "filename": "normal_deploy.sh",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-011",
+      "category": "L7",
       "expected_verdict": "suspicious",
       "expected_rules": [
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "description": "运维部署脚本（误报）",
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "normal_readme.txt",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-012",
+      "category": "L7",
       "expected_verdict": "clean",
       "expected_rules": [],
-      "description": "",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "description": "干净 README 对照",
+      "_scan_verdict": "clean"
     },
     {
       "filename": "normal_report.docx",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-013",
+      "category": "L7",
       "expected_verdict": "clean",
       "expected_rules": [],
-      "description": "",
-      "_last_scan_verdict": "clean",
-      "_last_scan_score": 0.0,
-      "_last_scan_findings": 0
+      "description": "干净 DOCX 对照",
+      "_scan_verdict": "clean"
     },
     {
       "filename": "ole_dropper.doc",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-014",
+      "category": "L7",
       "expected_verdict": "suspicious",
       "expected_rules": [
         "OleToolsUnavailable",
         "RemoteSessionHijack"
       ],
-      "description": "",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 35.0,
-      "_last_scan_findings": 2
+      "description": "OLE 投递 DOC",
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "pe_downloader.exe",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-015",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "C1_PE_Downloader_Loader",
         "DangerousExecutableExtension",
         "PeParseFailed"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 3
+      "description": "PE 下载木马",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "pe_injection.exe",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-016",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "C1_PE_ProcessInjection",
@@ -1943,15 +1654,13 @@
         "PeParseFailed",
         "RemoteSessionHijack"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 4
+      "description": "PE 注入程序",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "persist_cron.sh",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-017",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "C7_Linux_Persistence_Crontab",
@@ -1960,15 +1669,13 @@
         "ShellScriptDangerous",
         "Txt.Malware.Sustes-6779550-1"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 6
+      "description": "Crontab 持久化脚本",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "phishing.eml",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-018",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "EmailAttachmentDangerous",
@@ -1976,28 +1683,24 @@
         "EmailAttachmentWebshell",
         "EmailPhishingKeyword"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 10
+      "description": "钓鱼邮件 EML",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "photo.jpg.php",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-019",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 1
+      "description": "双扩展名伪装 .jpg.php",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "ransom_dropper.exe.txt",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-020",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "C8_Ransomware_Encryption",
@@ -2005,15 +1708,13 @@
         "C8_Ransomware_VolumeShadow",
         "DoubleExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 4
+      "description": "勒索软件投递器",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "sealed.docx",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-021",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "ArchiveBroken",
@@ -2021,15 +1722,13 @@
         "OfficeEncrypted",
         "OoxmlParseFailed"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 4
+      "description": "加密 DOCX（被视为损坏）",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "sealed.xlsx",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-022",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "ArchiveBroken",
@@ -2038,28 +1737,24 @@
         "OfficeEncrypted",
         "OoxmlParseFailed"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 5
+      "description": "加密 XLSX（被视为损坏）",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "shell_aspx.aspx",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-023",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 1
+      "description": "ASPX 一句话木马",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "shell_bash_devtcp.sh",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-024",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "C7_Linux_ReverseShell_Bash",
@@ -2067,29 +1762,25 @@
         "ReverseShellNetcat",
         "ShellScriptDangerous"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 4
+      "description": "Bash /dev/tcp 反弹",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "shell_jsp_runtime.jsp",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-025",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "C3_JSP_Webshell_RuntimeExec",
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "description": "JSP Runtime exec 木马",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "shell_nc.sh",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-026",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "C7_Linux_ReverseShell_NC",
@@ -2097,97 +1788,83 @@
         "ReverseShellNetcat",
         "ShellScriptDangerous"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 4
+      "description": "NC 反弹 Shell",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "shell_php_eval.php",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-027",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "C3_PHP_Webshell_Oneliner",
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "description": "PHP eval 一句话木马",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "shell_php_obf.php",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-028",
+      "category": "L7",
       "expected_verdict": "reject",
       "expected_rules": [
         "C3_PHP_Webshell_Obfuscated",
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "reject",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "description": "PHP 混淆木马",
+      "_scan_verdict": "reject"
     },
     {
       "filename": "shell_python.py",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-029",
+      "category": "L7",
       "expected_verdict": "suspicious",
       "expected_rules": [
         "DangerousExecutableExtension"
       ],
-      "description": "",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 30.0,
-      "_last_scan_findings": 1
+      "description": "Python 反弹脚本",
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "shortcut.lnk",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-030",
+      "category": "L7",
       "expected_verdict": "suspicious",
       "expected_rules": [
         "DangerousExecutableExtension",
         "RemoteDownloadUnix"
       ],
-      "description": "",
-      "_last_scan_verdict": "suspicious",
-      "_last_scan_score": 60.0,
-      "_last_scan_findings": 2
+      "description": "恶意 .lnk 快捷方式",
+      "_scan_verdict": "suspicious"
     },
     {
       "filename": "template_backdoor.docx",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-031",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "AttachedTemplate"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 1
+      "description": "模板后门 DOCX",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "vba_autoexec.bas",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-032",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "RemoteDownloadUnix",
         "VBAAutoExecShell"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "description": "VBA AutoOpen 宏",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "wps_macro.js",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-033",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "C7_Linux_ReverseShell_Bash",
@@ -2195,24 +1872,20 @@
         "DangerousExecutableExtension",
         "ReverseShellNetcat"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 4
+      "description": "WPS JS 宏",
+      "_scan_verdict": "malicious"
     },
     {
       "filename": "zip_traversal.zip",
-      "case_id": "",
-      "category": "",
+      "case_id": "L7-034",
+      "category": "L7",
       "expected_verdict": "malicious",
       "expected_rules": [
         "PathTraversal",
         "PathTraversalBlocked"
       ],
-      "description": "",
-      "_last_scan_verdict": "malicious",
-      "_last_scan_score": 100.0,
-      "_last_scan_findings": 2
+      "description": "ZIP 路径穿越（旧版）",
+      "_scan_verdict": "malicious"
     }
   ]
 }
\ No newline at end of file