# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 43 → 40 (-3.4)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 39 → 33 (-6.2)
- Architecture 81 → 87 (+5.3)
- Maturity 64 → 61 (-2.2)
- Readiness 41 → 43 (+1.6)
- Security 60 → 60 (-0.5)
- Domain Modelling 54 → 52 (-2.5)
- Accessibility 40 → 38 (-2.5)
- Performance 100 → 100 (+0.0)

## Resolved (9)

- Boundary-crossing change coupling: user.rb ↔ devise.rb (app/models/user.rb)
- High CVE: [GHSA redacted] (Gemfile.lock)
- High: security finding (details withheld)
- Low CVE: [GHSA redacted] (yarn.lock)
- Medium vulnerability: [GHSA redacted] (yarn.lock)
- No AppArmor/SELinux confinement
- PR-triggered workflow without a permissions block
- Repeated repair: app/jobs/scheduled/check_health_job.rb (app/jobs/scheduled/check_health_job.rb)
- Workflow token grant is wider than its jobs use

## New (45)

- AgentComputerProxy.handle_websocket (cognitive 20) (lib/agent_computer_proxy.rb)
- AgentComputerProxy.handle_websocket (cyclomatic 18) (lib/agent_computer_proxy.rb)
- BrowseWatchJob.perform (cognitive 16) (app/jobs/agent_sessions/browse_watch_job.rb)
- Documentation: no project overview (README.md)
- Duplicated block (10 lines × 2) (app/mcp/tools/get_error_issue.rb)
- Duplicated block (12 lines × 2) (app/mcp/tools/list_error_issues.rb)
- High CVE: [GHSA redacted] (yarn.lock)
- High CVE: [GHSA redacted] (yarn.lock)
- High IaC: WD-COMPOSE-0002 (dev/langfuse/docker-compose.yml)
- High: security finding (details withheld)
- Hotspot: lib/agent_computer_proxy.rb (lib/agent_computer_proxy.rb)
- Low IaC: WD-COMPOSE-0002 (dev/langfuse/docker-compose.override.yml)
- Low: security finding (details withheld)
- Low: security finding (details withheld)
- Low: security finding (details withheld)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Medium IaC: WD-COMPOSE-0002 (dev/langfuse/docker-compose.yml)
- Medium IaC: WD-COMPOSE-0002 (dev/langfuse/docker-compose.yml)
- Medium IaC: WD-COMPOSE-0002 (dev/langfuse/docker-compose.yml)
- …and 25 more

## Changes since last survey

- 83 commits — 82 feature/other, 1 fixes

## By area

- app/views — 18 commits
- (repo) — 15 commits
- app/mcp — 7 commits
- app/models — 7 commits
- app/actions — 5 commits
- (root) — 4 commits
- app/controllers — 4 commits
- app/jobs — 4 commits
- resources/agent_computer — 4 commits
- app/services — 3 commits
- app/helpers — 2 commits
- app/javascript — 2 commits
- db/migrate — 2 commits
- app/lib — 1 commit
- config/initializers — 1 commit
- spec/jobs — 1 commit
- spec/requests — 1 commit
- spec/services — 1 commit
- swagger/v1 — 1 commit

## Notable commits

- fix: Fix cross-account cluster use, tunnel mix-ups and cookie forwarding; keep the TURN token on Canine; drop watch mode
- change: Accept default-scope tokens on /mcp again
- change: Add Sentry-compatible error tracking per project
- change: Add Sign in with Google
- change: Add search, sorting and paging to error issues
- change: Back off and dedupe agent turns, and let manual runs through the presence lock
- change: Build the error tracking DSN from APP_HOST
- change: Check cluster access before any other project create step
- change: Check cluster ownership when creating or moving projects and add-ons
- change: Check the short ID instead of the removed trend tooltip in the bulk spec
- change: Compact the branch's agent migrations into one
- change: Configure which models an agent computer uses
- change: Dedupe recurring checks so they don't pile up in the queue
- change: Drop post kinds, the unused blocked action status, and the gap in session statuses
- change: Drop the find_cluster helper
- change: Drop the issue summary from get_error_issue
- change: Fit the error issues list on phone screens
- change: Gate agent pages in their base controller, drop the VNC viewer, and remove unused code
- change: Gate all of agent computers behind one flag, require an OpenRouter key on the feed, and drop personal names
- change: Give agent computers 8GiB, not 4
- …and 63 more

## Architecture

- 0 containers · 2 bounded contexts · 0 dependency edges (baseline)