# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 48 → 51 (+2.9)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 58 → 56 (-1.1)
- Architecture 92 → 92 (-0.1)
- Maturity 62 → 62 (+0.1)
- Readiness 53 → 54 (+0.3)
- Security 37 → 42 (+5.6)
- Performance 56 → 60 (+3.4)

## Resolved (97)

- BareSuppressMessage repeated across 38 files (Src/AspVersioning/Extensions.cs)
- Change coupling: EventHubStorage.cs ↔ InMemoryEventHubStorage.cs (Src/Messaging/Messaging.Remote/Server/Events/Storage/EventHubStorage.cs)
- Change coupling: EventSubscriber.cs ↔ EventHub.cs (Src/Messaging/Messaging.Remote.Core/Client/Events/EventSubscriber.cs)
- Change coupling: EventSubscriberStorage.cs ↔ EventHubStorage.cs (Src/Messaging/Messaging.Remote.Core/Client/Events/Storage/EventSubscriberStorage.cs)
- Change coupling: IValidationErrors.cs ↔ ValidationExtensions.cs (Src/Library/Validation/IValidationErrors.cs)
- Dead code: AutoTagOverrideEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: BareRouteSubstringReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: BindFromQueryGetReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: BindFromQueryPostReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: CatchAllRouteReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: ChildValidatorReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: CollectionLengthReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: CookieGetReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: CustomersEndpoint (TestHarness/OData/Program.cs)
- Dead code: DeepNestedValidatorReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: DefaultRouteValueReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: DefaultValueSchemaReviewEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: Describe (TestHarness/Web/Auth/Allow.cs)
- Dead code: DualChildAddressEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- Dead code: DuplicateIdempotencyHeaderEndpoint (TestHarness/Web/[Features]/TestCases/Swagger/Review/Endpoints.cs)
- …and 77 more

## New (23)

- .ComplexBindMeta (cognitive 17) (Src/Library/Binder/BinderExtensions.cs)
- BareSuppressMessage repeated across 37 files (Src/AspVersioning/Extensions.cs)
- Change coupling: EventSubscriber.cs ↔ InMemoryEventStorageRecord.cs (Src/Messaging/Messaging.Remote.Core/Client/Events/EventSubscriber.cs)
- EmptyCatchBlock (Src/Library/Endpoint/Endpoint.Properties.cs)
- EmptyCatchBlock (Src/Messaging/Messaging.Remote/Server/Events/Storage/EventHubStorage.cs)
- EmptyCatchBlock (Src/Swagger/ValidationSchemaProcessor.cs)
- EmptyCatchBlock (Src/Testing/AppFixture.Aot.cs)
- EmptyCatchBlock (Src/Testing/AppFixture.Aot.cs)
- EmptyCatchBlock (Src/Testing/AppFixture.Aot.cs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: Src/Library/Binder/ComplexSourceBinder.cs (Src/Library/Binder/ComplexSourceBinder.cs)
- Inconsistent naming for event completion/storage: 'MarkEventAsCompleteAsync' vs 'SetEvent'.
- Inconsistent naming for event storage: 'MarkEventAsCompleteAsync' vs 'SetEvent'.
- Inconsistent naming for job status updates: 'CancelJobAsync' vs 'MarkEventAsCompleteAsync'.
- Inconsistent naming for job/event status updates: 'CancelJobAsync' vs 'MarkEventAsCompleteAsync'.
- Inconsistent naming for storage operations: 'CancelJobAsync' and 'MarkEventAsCompleteAsync' use domain-specific verbs ('Cancel', 'Mark...Complete'), while 'SetEvent' uses a generic verb ('Set').
- …and 3 more

## Changes since last survey

- 7 commits — 7 feature/other, 0 fixes

## By area

- Src/Library — 6 commits
- Tests/IntegrationTests — 1 commit

## Notable commits

- change: Reduce per-request closure allocations (#1147)
- change: centralize IServiceResolverBase forwarders in ServiceResolverClient
- change: optimize complex model binding from query/forms
- change: reduce complex query/form binding string allocations
- change: skip flat query bind when request has no primary props
- change: split message reg and http concerns from endpointdata class
- change: test coverage for #1148

## API surface

- Unchanged — 3 HTTP endpoints

## Architecture

- Unchanged — 6 containers · 3 contexts · 0 edges