# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 56 → 41 (-14.9)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 46 → 41 (-5.6)
- Architecture 100 → 89 (-10.9)
- Maturity 68 → 63 (-4.6)
- Readiness 49 → 23 (-25.7)
- Security 90 → 80 (-9.9)

## Resolved (22)

- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Duplicated block (10 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/compress.py)
- Duplicated block (11 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/validate.py)
- Duplicated block (12 lines × 2) (evals/plot.py)
- Duplicated block (12 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/detect.py)
- Duplicated block (14 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/benchmark.py)
- Duplicated block (18 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/compress.py)
- Duplicated block (18 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/validate.py)
- Duplicated block (19 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/detect.py)
- Duplicated block (22 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/cli.py)
- Duplicated block (22 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/compress.py)
- Duplicated block (26 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/compress.py)
- Duplicated block (7 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/validate.py)
- Duplicated block (9 lines × 2) (plugins/caveman/skills/caveman-compress/scripts/benchmark.py)
- Further sole-owners (lower concentration)
- High: security finding (details withheld)
- Hotspot: plugins/caveman/skills/caveman-compress/scripts/compress.py (plugins/caveman/skills/caveman-compress/scripts/compress.py)
- Hotspot: skills/caveman-compress/scripts/compress.py (skills/caveman-compress/scripts/compress.py)
- Hotspot: src/plugins/opencode/plugin.js (src/plugins/opencode/plugin.js)
- …and 2 more

## New (55)

- (anonymous) (cognitive 54) (src/hooks/caveman-mode-tracker.js)
- (anonymous) (cyclomatic 35) (src/hooks/caveman-mode-tracker.js)
- Coverage not measured — test suite did not build
- Dimension evaluation failed
- FileTooLong: cli/install.js (cli/install.js)
- FileTooLong: hooks/caveman-stats.js (src/hooks/caveman-stats.js)
- FileTooLong: installer/e2e.freshinstall.test.mjs (tests/installer/e2e.freshinstall.test.mjs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: cli/install.js (cli/install.js)
- Hotspot: cli/lib/settings.js (cli/lib/settings.js)
- Hotspot: src/hooks/caveman-parse.js (src/hooks/caveman-parse.js)
- Medium: security finding (details withheld)
- No tests found
- The 'why use many token when few do trick' hook is an excellent one-liner but it does not explain what the agent actually does (e.g. how output tokens are saved) and there is no link to the benchmarks section that measures this. (README.md)
- aggregateHistory (cognitive 25) (src/hooks/caveman-stats.js)
- aggregateHistory (cyclomatic 21) (src/hooks/caveman-stats.js)
- appendBootstrapToSoul (cognitive 16) (cli/lib/openclaw.js)
- appendFlag (cognitive 26) (src/hooks/caveman-config.js)
- appendFlag (cyclomatic 16) (src/hooks/caveman-config.js)
- …and 35 more

## Changes since last survey

- 5 commits — 5 feature/other, 0 fixes

## By area

- (root) — 3 commits
- cli/install.js — 1 commit
- dist/caveman.skill — 1 commit

## Notable commits

- change: Update README for clarity on coding runs
- change: chore: sync SKILL.md copies [skip ci]
- change: chore: use local star history image in README
- change: docs: clarify token savings by workload
- change: release: pin install ref to v1.10.0