# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 64 → 55 (-8.5)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 95 → 63 (-31.3)
- Architecture 69 → 69 (+0.0)
- Maturity 51 → 40 (-11.5)
- Readiness 67 → 67 (+0.0)
- Security 94 → 92 (-1.9)
- Performance 100 → 100 (+0.0)

## Resolved (3)

- Inconsistent naming convention for output methods. `to_pdf`, `to_html`, `to_png`, and `to_jpeg` follow a `to_<format>` pattern, while `screenshot` breaks this pattern despite performing a similar output function (capturing visual state). Additionally, `screenshot` accepts a `format` argument, implying it can generate multiple formats, which overlaps with the specific `to_png` and `to_jpeg` methods.
- Off-boarding risk: anonymized user #1
- Workflow token permissions not restricted

## New (10)

- Documentation: no architecture or design documentation
- Inconsistent naming convention for output methods. `to_pdf`, `to_html`, `to_png`, and `to_jpeg` follow a `to_<format>` pattern, while `screenshot` breaks this pattern despite performing a similar output function (capturing visual state). Additionally, `screenshot` accepts a format argument, whereas the specific `to_<format>` methods do not, creating ambiguity about whether `screenshot` is a generic fallback or a distinct operation.
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- Orphaned file (lib/grover.rb)
- Orphaned file (lib/grover/middleware.rb)
- Orphaned file (lib/grover/processor.rb)
- Orphaned file (lib/grover/utils.rb)
- Workflow token permissions not restricted (.github/workflows/test.yml)