# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 44 → 58 (+13.6)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 70 → 65 (-4.3)
- Architecture 86 (new)
- Maturity 70 → 76 (+5.8)
- Readiness 18 → 48 (+29.4)
- Security 70 → 77 (+7.0)
- Accessibility 61 (new)

## Resolved (41)

- Coverage not measured — test suite did not build
- Critical CVE: [GHSA redacted] (webui/bun.lock)
- Critical CVE: [GHSA redacted] (webui/bun.lock)
- Dimension evaluation failed
- High CVE: [GHSA redacted] (webui/package-lock.json)
- High CVE: [GHSA redacted] (webui/bun.lock)
- High CVE: [GHSA redacted] (webui/bun.lock)
- High CVE: [GHSA redacted] (webui/bun.lock)
- High CVE: [GHSA redacted] (webui/bun.lock)
- High CVE: [GHSA redacted] (webui/bun.lock)
- High CVE: [GHSA redacted] (webui/bun.lock)
- High CVE: [GHSA redacted] (webui/bun.lock)
- High IaC: DS-0002 (Dockerfile)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 21 more

## New (1278)

- (anonymous) (cognitive 21) (webui/public/sw.js)
- (anonymous) (cyclomatic 17) (webui/public/sw.js)
- AgentActivityCluster.ActivityTraceRow (cognitive 22) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.AgentActivityCluster (cognitive 17) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.CliRunRow (cognitive 20) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.CliRunRow (cyclomatic 16) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.FoldedAgentActivity (cognitive 47) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.FoldedAgentActivity (cyclomatic 44) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.McpRunRow (cognitive 19) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.collectCliRuns (cognitive 16) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.collectMcpRuns (cognitive 16) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentActivityCluster.countActivity (cognitive 18) (webui/src/components/thread/AgentActivityCluster.tsx)
- AgentLoop.__init__ (cognitive 20) (nanobot/agent/loop.py)
- AgentLoop.__init__ (cyclomatic 19) (nanobot/agent/loop.py)
- AgentLoop._aclose_unlocked (cognitive 17) (nanobot/agent/loop.py)
- AgentLoop._build_turn (cognitive 35) (nanobot/agent/loop.py)
- AgentLoop._build_turn (cyclomatic 29) (nanobot/agent/loop.py)
- AgentLoop._dispatch_one (cognitive 39) (nanobot/agent/loop.py)
- AgentLoop._dispatch_one (cyclomatic 28) (nanobot/agent/loop.py)
- AgentLoop._persist_user_message_early (cognitive 19) (nanobot/agent/loop.py)
- …and 1258 more

## Changes since last survey

- 300 commits — 104 feature/other, 196 fixes

## By area

- webui/src — 114 commits
- nanobot/channels — 57 commits
- nanobot/agent — 38 commits
- tests/agent — 18 commits
- (root) — 8 commits
- nanobot/providers — 8 commits
- nanobot/cli — 7 commits
- tests/tools — 7 commits
- nanobot/webui — 6 commits
- tests/cli — 6 commits
- nanobot/utils — 5 commits
- tui/src — 5 commits
- .github/workflows — 3 commits
- nanobot/api — 3 commits
- nanobot/cron — 2 commits
- docs/chat-commands.md — 1 commit
- docs/cli-reference.md — 1 commit
- docs/configuration.md — 1 commit
- docs/guides — 1 commit
- docs/multiple-instances.md — 1 commit

## Notable commits

- fix: fix(agent): complete automation cancelled before execution
- fix: fix(agent): discard stopped follow-up recovery journal
- fix: fix(agent): keep tool results stable across replay (#5695)
- fix: fix(agent): log mid-turn injected messages (#5878)
- fix: fix(agent): preserve per-session message order
- fix: fix(agent): preserve queued turn semantics and completion
- fix: fix(agent): preserve state for required Codex compaction (#5883)
- fix: fix(agent): redact private recovery and reconnect diagnostics
- fix: fix(agent): remove local context tail truncation (#5820)
- fix: fix(agent): report background task failures
- fix: fix(agent): respect temporary chat privacy in tool execution
- fix: fix(agent): run explicit recovery continuations
- fix: fix(agent): serialize session inbox processing
- fix: fix(api): preserve nullable stream compatibility
- fix: fix(api): require boolean stream values
- fix: fix(channels): drop compaction notices on channels without an in-place affordance (#5799)
- fix: fix(channels): keep the compaction outcome visible, gate only the start notice
- fix: fix(channels): make automatic compaction notices follow send_progress
- fix: fix(cli): explain session storage conflicts before startup
- fix: fix(cli): harden attach-only Desktop selection [skip ci]
- …and 280 more