# Changelog

## Score

- CAI 82 → 81 (-0.6)
- Rubric changed (rubric-2026.09.4 → rubric-2026.09.11) — scores are not directly comparable.

## Lenses

- Code Health 87 → 87 (+0.0)
- Architecture 95 → 95 (+0.0)
- Maturity 91 → 91 (+0.0)
- Readiness 72 → 74 (+1.6)
- Security 90 → 83 (-6.3)
- Accessibility 100 → 100 (+0.0)

## Resolved (14)

- Bounded contexts not declared
- IaC check set not pinned — scanned with trivy's embedded checks
- Inconsistent naming for classifier helper methods: some use descriptive nouns/verbs (UnderstoodSummary, Guard, FindAggregateTolerant) while others use abbreviated or cryptic names (EntityProps, SimilarRule, VerbMatch). 'Props' is an abbreviation for 'Properties' which is inconsistent with the more explicit naming elsewhere.
- Inconsistent naming for refusal-related concepts: one is a method 'RefusalVerdict' and the other is a parameter 'Refusal'. While they may represent different things (a verdict vs a value), the naming is confusingly similar without clear semantic distinction in the names themselves.
- Inconsistent naming for utility/helper methods within GraphGate: 'IsPascal' and 'Err' are very short/abbreviated compared to 'CheckAggregates' and 'CheckAreaNamesAndGuardSpan'. 'Err' is particularly ambiguous and inconsistent with the descriptive style of other methods in the same class.
- Inconsistent test method naming convention: multiple test methods use snake_case (e.g., Flags_domain_referencing_marten, Does_not_flag_generated_files) while others use PascalCase (e.g., CleanBc, Tail). This creates a mixed style within the test suite.
- Inconsistent test method naming convention: one test uses snake_case for the method name while the other uses PascalCase. The codebase appears to mix these styles for test methods.
- Leaked secret: signing-key (infra/keycloak/unfold-realm.json)
- Monorepo: only 1 of 6 solutions was scored
- No exposed public API
- The 'What it proves' section names the outline sections (browser-truth, rule this encodes, full-flow.js) but only one of those is shown in text; the reader cannot tell whether the described freeze was fixed by the PoC. (PoCs/ui-smoke/README.md)
- XML-doc coverage: Unfold.AppHost (src/Unfold.AppHost/Unfold.AppHost.csproj)
- npm dependencies not read for dependency currency
- single-maintainer repository — bus factor is not applicable

## New (3)

- Documentation: no installation or build instructions (README.md)
- Documentation: no usage examples (README.md)
- Inconsistent naming convention for test methods: one uses snake_case (`Board_change_highlights...`) while the other uses sentence case with spaces (`Board_without_baseline...`).

## API surface

- Unchanged — 7 HTTP endpoints