# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 45 → 49 (+4.0)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 73 → 76 (+3.4)
- Architecture 73 → 94 (+20.7)
- Maturity 52 → 55 (+3.7)
- Readiness 30 → 32 (+2.4)
- Security 57 → 62 (+4.9)

## Resolved (49)

- Duplicated block (19 lines × 21) (Src/Core/F1/Presentation/Filters/Validation/ValidationFilter.cs)
- Duplicated block (20 lines × 2) (Src/Core/F5/Presentation/Filters/SetStateBag/SetStateBagFilter.cs)
- Duplicated block (22–27 lines × 4) (Src/Core/F5/Mapper/HttpResponseMapper.cs)
- Duplicated block (23–28 lines × 3) (Src/Core/F6/Mapper/HttpResponseMapper.cs)
- Duplicated block (23–41 lines × 8) (Src/Core/F13/Mapper/HttpResponseMapper.cs)
- Duplicated block (24 lines × 2) (Src/Core/F11/Mapper/HttpResponseMapper.cs)
- Duplicated block (25 lines × 19) (Src/Core/F1/Presentation/Filters/SetStateBag/SetStateBagFilter.cs)
- Duplicated block (9 lines × 2) (Src/Core/F13/Presentation/Filters/Validation/ValidationProfile.cs)
- High IaC: DS-0002 (AppInfrastructure/Customs/Pgbouncer/Dockerfile)
- High IaC: DS-0002 (AppInfrastructure/Customs/Postgres/Dockerfile)
- High IaC: DS-0002 (AppInfrastructure/Customs/Redis/Dockerfile)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- In module F11, the model is named 'TaskTodoModel', while in other modules (e.g., F13, F14, F15, F16, F17, F18, F19, F20, F21), the model is named 'TodoTaskModel' or 'TodoTaskListModel'. 'TaskTodo' vs 'TodoTask' is an inconsistency in the order of words.
- Inconsistent naming for response body wrappers. Some modules use 'Body' or 'BodyModel' as a nested class or property, while others use 'BodyDto' or 'BodyModel'. Additionally, some responses wrap data in a 'Body' property, while others use 'BodyModel' or 'BodyDto'.
- Leaked secret: signing-key (Src/Entry/appsettings.Production.json)
- Leaked secret: signing-key (Src/Entry/appsettings.Staging.json)
- …and 29 more

## New (5)

- Response models are named inconsistently. Some use 'AppResponseModel' in the Models namespace, while others use 'Response' or 'BodyDto' in the Presentation namespace. This suggests a lack of consistent layering or naming convention for response objects.
- The 'SetStateBag' filter is implemented in multiple modules (F5, F6, F9, F11, F14, F19, F20) with potentially different implementations. This suggests a lack of shared base class or interface for this common functionality.
- The term 'HttpResponseMapper' is used for classes that appear to handle HTTP responses or mapping, but the naming is inconsistent with the broader codebase which uses 'Response' or 'Dto' for response models. More critically, some mappers implement 'Init' while others implement 'Get', suggesting different responsibilities or patterns for the same concept.
- The term 'RefreshTokenModel' is used in multiple modules (F1, F6), but the structure and usage might differ. Additionally, 'RefreshToken' is also used in FConfig.NSwagOption.DocOption.AuthOption.BearerOption.Type, which is a configuration, not a model.
- There is a mix of 'AppRequestModel' and 'Request' for request models. Some modules use 'AppRequestModel' in the Models namespace, while others use 'Request' in the Presentation namespace. This creates confusion about whether these are the same concept.