# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 75 → 52 (-23.1)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 78 → 72 (-6.7)
- Maturity 80 → 75 (-4.1)
- Readiness 70 → 30 (-40.2)
- Security 88 → 74 (-13.5)

## Resolved (18)

- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: commands/schema.ts (src/commands/schema.ts)
- FileTooLong: commands/store.ts (src/commands/store.ts)
- FileTooLong: core/init.ts (src/core/init.ts)
- FileTooLong: core/update.ts (src/core/update.ts)
- FileTooLong: store/operations.ts (src/core/store/operations.ts)
- Further orphaned files (smaller)
- Hotspot: src/commands/validate.ts (src/commands/validate.ts)
- Hotspot: src/commands/workflow/instructions.ts (src/commands/workflow/instructions.ts)
- Hotspot: src/core/artifact-graph/instruction-loader.ts (src/core/artifact-graph/instruction-loader.ts)
- Hotspot: src/core/init.ts (src/core/init.ts)
- Hotspot: src/core/list.ts (src/core/list.ts)
- Hotspot: src/core/specs-apply.ts (src/core/specs-apply.ts)
- Hotspot: src/core/update.ts (src/core/update.ts)
- Hotspot: src/core/validation/validator.ts (src/core/validation/validator.ts)
- LLM evaluation failed
- Off-boarding risk: anonymized user #1

## New (21)

- Change coupling: archive-change.ts ↔ bulk-archive-change.ts (src/core/templates/workflows/archive-change.ts)
- Change coupling: config.ts ↔ index.ts (src/core/config.ts)
- Change coupling: index.ts ↔ command-registry.ts (src/cli/index.ts)
- Change coupling: index.ts ↔ config.ts (src/core/command-generation/adapters/index.ts)
- Change coupling: index.ts ↔ registry.ts (src/core/command-generation/adapters/index.ts)
- Change coupling: index.ts ↔ update.ts (src/core/templates/index.ts)
- Change coupling: init.ts ↔ index.ts (src/core/init.ts)
- Dimension evaluation failed
- High CVE: [GHSA redacted] (pnpm-lock.yaml)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: src/commands/workflow/shared.ts (src/commands/workflow/shared.ts)
- Hotspot: src/prompts/searchable-multi-select.ts (src/prompts/searchable-multi-select.ts)
- No automated tests
- No tests found
- Rotate the exposed credentials — git history can't be un-committed
- …and 1 more

## Changes since last survey

- 28 commits — 12 feature/other, 16 fixes

## By area

- src/core — 12 commits
- (root) — 4 commits
- test/core — 4 commits
- skills/openspec-apply-change — 2 commits
- .changeset/catch-up-rovo-codex-status.md — 1 commit
- .changeset/legacy-cleanup-live-command-files.md — 1 commit
- docs/stores-beta — 1 commit
- src/commands — 1 commit
- website/components — 1 commit
- website/package.json — 1 commit

## Notable commits

- fix: fix(adapters): stop deleting the CoStrict and Junie commands on every run (#1492)
- fix: fix(build): allow esbuild install scripts (#1196)
- fix: fix(codex): install skills in canonical agents directory (#1511)
- fix: fix(explore): scaffold changes before capturing artifacts (#1503)
- fix: fix(propose): use the requested workflow schema (#1504)
- fix: fix(propose): wait for explicit implementation request (#1501)
- fix: fix(security): keep paths on a short leash (#1499)
- fix: fix(security): patch fast-uri, postcss, and brace-expansion advisories (#1510)
- fix: fix(status): clarify planning completion (#1505)
- fix: fix(telemetry): honor telemetry.enabled in global config (#1513)
- fix: fix(templates): correct generated workflow guidance (#1500)
- fix: fix(templates): deduplicate apply skill and command instructions (#1153)
- fix: fix(templates): restore intentional apply skill/command separation (#1514)
- fix: fix(validate): allow non-English requirements (#1502)
- fix: fix(validate): warn on ambiguous task numbering (#1523)
- fix: fix(workflows): preserve nested spec paths (#1508)
- change: Version Packages (#1488)
- change: chore(deps): bump the website-dependencies group (#1496)
- change: chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 in the development-dependencies group (#1494)
- change: chore(release): add catch-up changeset for Rovo, Codex dir, status (#1518)
- …and 8 more