Imagine you're debugging a complex web app where the frontend, API layer, and database are all tangled into one monolithic codebase. Every time you change a CSS rule, a SQL query breaks. You can't tell whether a bug is in the rendering, the business logic, or the data layer because they share state in unpredictable ways. That's the state of most COW-QKD security analyses: the optical physics, the finite-sample statistics, and the security proof logic are welded together, so when the final key rate comes out wrong, nobody can isolate which layer is responsible. This paper builds the microservices architecture for COW-QKD security analysis. The pipeline is explicit: physical parameters (source brightness, channel loss, detector efficiency) → click probabilities → observable detector counts → interchangeable security evaluators. Each layer has a clean interface. Swap out the security evaluator (Kato vs. Azuma-Hoeffding) and the physics layer doesn't change. Tune the optical model and the statistical inference stays fixed. The authors call this the θphys → p → O → Sj(O) pipeline, and the modularity is the actual contribution. The headline numbers are modest but honest. Compared to reported experimental COW-QKD operating points, the Kato finite-key calculation deviates by -1.5% at 50 km and -10.3% at 75 km. Monitoring-port decoy counts agree within 0.9-2.4%. The dark-port residual — the gap between model prediction and experiment for the security-critical monitoring detector — remains distance-dependent and is flagged explicitly as the principal model-sensitive observable. This is exactly the kind of honesty a framework paper should have: here's what works, here's what doesn't, here's where the next problem lives. The comparison between Kato and Azuma-Hoeffding concentration inequalities on identical detector records is the sharpest result. By holding the physics layer constant and swapping only the statistical inference, the authors isolate a pure apples-to-apples difference in finite-key tightness. Kato yields substantially tighter phase-error bounds for the rare-event monitoring records that matter most in COW-QKD. This is the kind of controlled experiment that's only possible because the framework exists — you literally couldn't do this comparison cleanly in a monolithic codebase. The protocol optimization result is practically useful: jointly optimizing the mean photon number μ and the receiver beam-splitter ratio tB yields 7.4-20.2% higher predicted secure-key rates compared to optimizing μ alone with tB fixed at the conventional 0.3. This isn't a new protocol — it's showing that existing COW-QKD deployments are leaving performance on the table because nobody had the tooling to explore the joint parameter space cleanly. The limitation is clear: this is a simulation framework validated against published experimental data, not new experimental data. The dark-port residual disagreement grows with distance, which means the optical model has a gap that matters exactly where you'd most want it to be accurate — at longer ranges where key rates are marginal. The authors are forthright about this, but it means the framework's predictions at the edges of its operating range are the least trustworthy. The real value here is infrastructural. COW-QKD is a commercially deployed protocol (ID Quantique ships it), and the field has lacked a common computational interface where different security proofs can be stress-tested against the same physical model. This paper provides that interface. It's a tooling paper, not a breakthrough paper, and it should be evaluated on those terms.
