# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 59 → 64 (+5.2)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 39 → 52 (+13.5)
- Architecture 91 → 91 (+0.0)
- Maturity 81 → 81 (-0.1)
- Readiness 68 → 63 (-4.9)
- Security 76 → 78 (+2.1)
- Domain Modelling 100 → 100 (+0.0)
- Event Sourcing 100 → 100 (+0.0)

## Resolved (6)

- High CVE: [GHSA redacted] (yarn.lock)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Low: security finding (details withheld)
- Medium vulnerability: [GHSA redacted] (yarn.lock)
- Off-boarding risk: anonymized user #1

## New (6)

- Hotspot: ecc2/src/main.rs (ecc2/src/main.rs)
- Hotspot: ecc2/src/session/store.rs (ecc2/src/session/store.rs)
- Medium CVE: [GHSA redacted] (yarn.lock)
- Off-boarding risk: anonymized user #1
- StateStore::evaluate_promote_and_health_check (cyclomatic 17) (ecc2/src/session/store.rs)
- The Quick Start assumes `cd .kiro` to install into a project root but does not mention how to install into an existing subdirectory (e.g. `/path/to/your/project`) from the command line, which is critical for users who already have a Kiro project. (.kiro/README.md)

## Changes since last survey

- 17 commits — 6 feature/other, 11 fixes

## By area

- (root) — 4 commits
- scripts/hooks — 2 commits
- scripts/lib — 2 commits
- tests/lib — 2 commits
- tests/scripts — 2 commits
- commands/learn-eval.md — 1 commit
- ecc2/Cargo.lock — 1 commit
- ecc2/src — 1 commit
- integrations/aura — 1 commit
- scripts/memory-mcp.mjs — 1 commit

## Notable commits

- fix: fix(aura): reject history-free agents by default (#2652)
- fix: fix(commands): generate discoverable skills from learning workflows (#2653)
- fix: fix(commands): probe for auto-update.js in auto-update ECC_ROOT resolver (#2462)
- fix: fix(continuous-learning): /evolve never produces skill or agent candidates (#2664)
- fix: fix(deps): bump fast-uri to 3.1.5 and brace-expansion to 5.0.9 (#2672)
- fix: fix(docs): restore main CI (#2623)
- fix: fix(hooks): catch the bypass short flag anywhere in a cluster (#2668)
- fix: fix(hooks): never format installed plugin and marketplace clones (#2667)
- fix: fix(install): exclude ECC skills from antigravity install target (#2680)
- fix: fix(mcp): accept reserved _meta field in tools/call params (#2670)
- fix: fix: add claude-opus-5 to KNOWN_MODEL_WINDOW_TOKENS (#2609)
- change: Add bounded harness evaluation and rollback loop (#2686)
- change: chore(deps): bump tar in the npm-security group across 1 directory (#2671)
- change: chore(deps): bump toml in /ecc2 in the cargo-minor-and-patch group (#2661)
- change: chore(deps-dev): require pytest-asyncio 1.4.0 (#2327)
- change: feat: add retention feedback loop and honest support matrix (#2681)
- change: test(lib): extract shared mini test runner for coordination tests (#2663)

## Architecture

- Unchanged — 0 containers · 1 contexts · 0 edges