# Changelog

## Score

- CAI 65 → 49 (-16.5)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 83 → 67 (-16.5)
- Architecture 98 → 98 (+0.0)
- Maturity 56 → 42 (-14.3)
- Readiness 66 → 66 (-0.1)
- Security 89 → 39 (-50.2)
- Domain Modelling 100 → 100 (+0.0)
- Accessibility 68 → 68 (+0.0)

## Resolved (4)

- Ambiguous Collection Access: `Task` exposes both `csv_collection` (which takes arguments) and `collection` (which takes none). It is unclear if `collection()` is a default wrapper for `csv_collection` or if they access different underlying data sources. Given `CsvCollectionBuilder` and `BatchCsvCollectionBuilder` exist, the public API on `Task` should likely delegate to a single consistent method or clearly distinguish between 'raw' vs 'batched' access.
- High CVE: [GHSA redacted] (Gemfile.lock)
- Off-boarding risk: anonymized user #1
- Redundant Builder Hierarchy: `NoCollectionBuilder` and `NullCollectionBuilder` appear to serve identical purposes to `NoCollectionBuilder` (which already handles the 'no collection' case). Having both `NoCollectionBuilder` and `NullCollectionBuilder` with identical method signatures (`collection`, `count`, `has_csv_content?`, `no_collection?`) suggests a duplication of intent or a legacy artifact. `NoCollectionBuilder` likely covers the 'null/empty' case, making `NullCollectionBuilder` redundant.

## New (6)

- Ambiguous relationship between `csv_collection` and `collection`. `csv_collection` takes arguments and seems to be a factory for a builder, while `collection` takes no arguments. It is unclear if `collection` is a simplified wrapper, a different implementation, or if one is deprecated. The naming suggests `collection` is the primary method, but `csv_collection` is more specific. If `collection` delegates to a builder, the builder pattern is hidden inconsistently.
- Inconsistent naming conventions for state checks. Some use `?` suffix (e.g., `stopping?`, `started?`), while `running` does not (it is a method, not a predicate). This breaks the Ruby convention where state checks are predicates. Additionally, `running()` vs `running?` ambiguity if `running` is a method that returns something other than a boolean.
- Off-boarding risk: anonymized user #1
- Orphaned file (app/models/maintenance_tasks/progress.rb)
- Outdated: sqlite3
- Redundant/Confusing naming of 'NoCollectionBuilder' and 'NullCollectionBuilder'. Both implement the same interface as CsvCollectionBuilder but represent empty states. 'NoCollectionBuilder' takes an underscore argument `_task` while others take `task`, implying a slight behavioral difference or inconsistency in usage, but semantically they are likely identical 'empty' implementations. Having two distinct classes for 'no data' scenarios is confusing.

## Changes since last survey

- 11 commits — 11 feature/other, 0 fixes

## By area

- (root) — 5 commits
- (repo) — 2 commits
- .github/workflows — 2 commits
- app/controllers — 1 commit
- app/models — 1 commit

## Notable commits

- change: Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1567)
- change: Bump capybara-lockstep from 2.3.1 to 2.3.2 (#1553)
- change: Bump herb from 0.10.4 to 0.11.0 (#1558)
- change: Bump job-iteration from 1.15.0 to 1.15.1 (#1557)
- change: Bump rubocop from 1.91.0 to 1.92.0 (#1568)
- change: Bump ruby/setup-ruby from 1.321.0 to 1.329.0
- change: Bump rubyzip from 3.3.0 to 3.4.0 (#1555)
- change: Clean up new progress bar functions and move them into an IIFE to avoid polluting the global scope.
- change: Merge pull request #1538 from salasebas/animate-progress-bars
- change: Merge pull request #1539 from salasebas/agent/add-previous-page
- change: Merge pull request #1569 from Shopify/dependabot/github_actions/ruby/setup-ruby-1.329.0

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)