# Changelog

## Baseline

- First survey — no prior run to compare against. CAI 79.

## Lenses

- Code Health 79
- Architecture 78
- Maturity 90
- Readiness 80
- Security 79
- Accessibility 90
- Performance 87

## Changes since last survey

- 162 commits — 142 feature/other, 20 fixes

## By area

- src/Cai.Web — 53 commits
- app/Cai.Web — 26 commits
- .github/workflows — 13 commits
- (root) — 9 commits
- tests/Cai.Tests — 9 commits
- (repo) — 6 commits
- scorer/Cai.Scoring — 6 commits
- src/Cai.Scoring — 5 commits
- src/Cai.Delivery — 3 commits
- deploy/PREPROD.md — 2 commits
- deploy/nginx — 2 commits
- docs/adr — 2 commits
- docs/brand — 2 commits
- src/Cai.Cli — 2 commits
- benchmarks/Cai.Benchmarks — 1 commit
- deploy/registry — 1 commit
- docs/spec — 1 commit
- examples/evidence.sample.json — 1 commit
- rubrics/rubric-2026.08.19 — 1 commit
- rubrics/rubric-2026.08.20 — 1 commit

## Notable commits

- fix: Merge branch 'ws-d-cai-delivery-package' into fix/registry-unconfigured-auth
- fix: fix(a11y): page structure — title, heading levels and text (AC3)
- fix: fix(bands): state the band mapping as half-open intervals everywhere it is published
- fix: fix(cai): unify band words to Strong/Adequate/Weak (correct F1 direction)
- fix: fix(delivery): give the sample its own key id, and stop calling a signature "trustworthy"
- fix: fix(deploy): /health is not a test of the standard, and prod had nothing else
- fix: fix(deploy): the noise-API gate was handing the next reader my wrong guess
- fix: fix(dimensions): lens-filter-note readable in dark mode
- fix: fix(noise): the ceiling refusal rendered "16,7 %" on a da-DK host
- fix: fix(noise): the standard was disagreeing with itself across two of its own doors
- fix: fix(preprod): the preprod register rejected every publish, and had since it was built
- fix: fix(preprod): the trigger missed preprod-corpus.py, and a stale comment contradicted the new step
- fix: fix(registry): on-behalf applies to the whole request so the share loop is consistent
- fix: fix(registry): unconfigured registry is safe-by-default — 401 + public health, never 500
- fix: fix(scoring): an absent "coverage" must default to 1.0, not 0
- fix: fix(web): pin the /api/auth/* fail-closed contract — 401, never 500
- fix: fix(web): the app host's own redirect table still pointed home
- fix: fix(web): the standard had two websites, and the one with the working tools was unreachable
- fix: fix(web): traffic-class rate limiter — registry principals and public probes off the anonymous budget
- fix: revert(deploy): drop systemd notify/watchdog P4 attempt — it regressed C2
- …and 142 more

## API surface

- 48 HTTP endpoints (baseline)

## Architecture

- 3 containers · 2 bounded contexts · 1 dependency edges (baseline)