# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 55 → 61 (+5.1)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 68 → 74 (+6.5)
- Architecture 97 → 99 (+2.0)
- Maturity 56 → 68 (+11.5)
- Readiness 46 → 49 (+3.7)
- Security 69 → 69 (+0.0)
- Performance 71 → 71 (+0.0)

## Resolved (10)

- Coverage not measured — analyzer environment
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Inconsistent naming for the 'magic number' concept. Some classes use a property named 'MagicNumber' (e.g., ExampleSaga, ExampleCommand), while others use 'IsSuccess' or 'AggregateRoot' for different concepts, but the specific field 'magicNumber' is also passed as a parameter in multiple places with inconsistent casing or naming in the method signatures (e.g., 'magicNumber' vs 'MagicNumber'). More critically, the parameter name 'magicNumber' is used in methods like 'SetMagicNumer' and 'ResetMagicNumber', but the property is 'MagicNumber'. While parameter naming is less strict, the typo in the type name 'Snaphost' is a clear inconsistency with the rest of the codebase's use of 'Snapshot'.
- Medium CVE: SharpCompress 0.23.0
- No tests discovered
- Off the main sequence: EventStore
- Typo in the type name 'Snaphost' (missing 's' in 'Snapshot'). This typo is also present in the parameter 'snapshot' in 'LoadSnapshotAsync' and the property 'PreviousVersions' within the same misspelled type.

## New (10)

- Coverage not measured — analyzer environment
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Medium CVE: SharpCompress 0.23.0
- Test runner surfaced no tests
- The README mentions Docker compose but does not link to it and no build status or PRs welcome badge is shown. (README.md)
- Typo in the class name 'ExampleSnaphost' (missing 's' in 'Snapshot'). This typo is consistently applied to the type and its members, but the name itself is misspelled.
- redundant comment (EventFlow.Example/PublishCommand.cs)