# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 40 → 55 (+15.3)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.16) — scores are not directly comparable.

## Lenses

- Code Health 45 → 61 (+15.9)
- Architecture 56 → 51 (-5.2)
- Maturity 69 → 80 (+10.7)
- Readiness 27 → 53 (+26.6)
- Security 60 → 76 (+16.6)
- Performance 60 (new)

## Resolved (398)

- (anonymous) (cognitive 17) (bridge/team-mcp.cjs)
- (anonymous) (cognitive 18) (bridge/team-mcp.cjs)
- (anonymous) (cognitive 19) (bridge/runtime-cli.cjs)
- (anonymous) (cognitive 24) (bridge/runtime-cli.cjs)
- (anonymous) (cognitive 25) (bridge/team-mcp.cjs)
- (anonymous) (cognitive 25) (templates/hooks/keyword-detector.mjs)
- (anonymous) (cognitive 33) (bridge/runtime-cli.cjs)
- (anonymous) (cognitive 33) (templates/hooks/keyword-detector.mjs)
- (anonymous) (cyclomatic 16) (templates/hooks/keyword-detector.mjs)
- (anonymous) (cyclomatic 17) (bridge/runtime-cli.cjs)
- (anonymous) (cyclomatic 19) (templates/hooks/keyword-detector.mjs)
- (anonymous) (cyclomatic 22) (bridge/runtime-cli.cjs)
- (anonymous) (cyclomatic 25) (bridge/team-mcp.cjs)
- (anonymous) (cyclomatic 30) (bridge/runtime-cli.cjs)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Critical CVE: [GHSA redacted] (package-lock.json)
- Dimension evaluation failed
- FileTooLong: __tests__/post-tool-verifier.test.mjs (src/__tests__/post-tool-verifier.test.mjs)
- FileTooLong: bridge/claude-md-coordinator.cjs (bridge/claude-md-coordinator.cjs)
- FileTooLong: bridge/runtime-cli.cjs (bridge/runtime-cli.cjs)
- …and 378 more

## New (397)

- Coverage not measured — JavaScript/TypeScript suite
- Decision is a thin one-line statement with no context (why replace heuristics with Jev) and no consequences/trade-offs (docs/adr/03665-jev-degradation-contract.md)
- Decision is real but consequences/trade-offs are unstated: why one-shot child-process over stdin JSON rather than in-process TS imports or a local daemon; what happens if the resolver ever blocks tool execution (docs/adr/03671-script-side-judgment-channel.md)
- Dependency hygiene PARTLY measured — Python dependencies read, no exact pin to grade for currency
- Documentation: no project overview (docs/AGENTS.md)
- Further orphaned files (smaller)
- Further sole-owners (lower concentration)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 377 more

## Changes since last survey

- 300 commits — 135 feature/other, 165 fixes

## By area

- inventory/inventory-graph.json — 94 commits
- src/features — 59 commits
- (repo) — 39 commits
- src/__tests__ — 16 commits
- .github/generated-artifact-authorizations.json — 9 commits
- dist/lib — 7 commits
- src/team — 7 commits
- src/workflow — 7 commits
- src/cli — 6 commits
- src/hooks — 6 commits
- src/lib — 4 commits
- src/utils — 4 commits
- (root) — 3 commits
- dist/hooks — 3 commits
- dist/team — 3 commits
- docs/shipyard.md — 3 commits
- src/graph — 3 commits
- src/notifications — 3 commits
- src/tools — 3 commits
- .github/release-body.md — 2 commits

## Notable commits

- fix: Merge PR #3994 round-ten fixes and review fixes
- fix: Merge contributor round-eleven fixes without duplicate logic
- fix: Merge pull request #3921 from Yeachan-Heo/fix/issue-3920-windows-supervisor-stdio
- fix: Merge pull request #3927 from Yeachan-Heo/fix/issue-3926-notepad-tag-regex
- fix: Merge pull request #3928 from Yeachan-Heo/fix/issue-3923-hooks-pertool-cost
- fix: Merge pull request #3929 from Yeachan-Heo/fix/issue-3924-lsp-diagnostics-directory
- fix: Merge pull request #3930 from Yeachan-Heo/fix/issue-3925-session-search-buffering
- fix: Merge pull request #3932 from Yeachan-Heo/fix/issue-3922-hud-toplevel-memoization
- fix: Merge pull request #3974 from Yeachan-Heo/fix-3972-windows-tick-precision
- fix: Merge pull request #3983 from iyoda/fix/cursor-codex-startup-grace
- fix: Merge pull request #3997 from iyoda/fix/team-leader-terminal-pid-safety
- fix: Merge pull request #3999 from Iams4kura/bugfix/hud-model-date-suffix-20260909t040218z
- fix: Merge remote-tracking branch 'origin/dev' into fix/issue-3923-hooks-pertool-cost
- fix: chore(inventory): refresh graph after SQL regression
- fix: chore(inventory): refresh graph after lookout review fixes
- fix: chore(inventory): refresh inventory graph after lookout review fixes
- fix: chore(inventory): refresh inventory graph after lookout round-10 fixes
- fix: chore(inventory): refresh inventory graph after lookout round-11 fixes
- fix: chore(inventory): refresh inventory graph after lookout round-3 fixes
- fix: chore(inventory): refresh inventory graph after lookout round-4 fixes
- …and 280 more