# Changelog

## Score

- CAI 34 → 34 (+0.2)
- Rubric changed (rubric-2026.09.12 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 39 → 39 (+0.0)
- Architecture 100 → 89 (-11.2)
- Maturity 82 → 82 (+0.0)
- Readiness 20 → 20 (-0.2)
- Security 76 → 73 (-3.6)
- Event-Driven 61 → 61 (+0.0)
- Event Sourcing 74 → 74 (+0.0)
- Accessibility 33 → 34 (+0.8)
- Performance 100 (new)

## Resolved (5)

- Coverage not measured — no coverage collector is wired up
- Dependency hygiene PARTLY measured — npm pinning read, dependency currency not (no pnpm-resolved versions to grade)
- Documentation: written for insiders (docs/STREAMING_FUNCTION_CALLS_DOCUMENTATION.md)
- Documentation: written for insiders (docs/STREAMING_IMPLEMENTATION_SUMMARY.md)
- Documentation: written for insiders (docs/UI_REVIEW_FINDINGS.md)

## New (24)

- Dependency not covered by the lockfile: jsx
- Documentation: no project overview (docs/DISTRIBUTION_STRATEGY.md)
- Floating source dependency: jesse
- High CVE: [GHSA redacted] (rebar.lock)
- High CVE: [GHSA redacted] (rebar.lock)
- High CVE: [GHSA redacted] (rebar.lock)
- High CVE: [GHSA redacted] (rebar.lock)
- Off the main sequence: openai
- Outdated: accept
- Outdated: base64url
- Outdated: cowboy
- Outdated: exometer_core
- Outdated: folsom
- Outdated: gproc
- Outdated: gun
- Outdated: hackney
- Outdated: jiffy
- Outdated: observer_cli
- Outdated: prometheus
- Outdated: prometheus_cowboy
- …and 4 more