# Changelog

## Score

- CAI 53 → 56 (+3.6)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 62 → 61 (-0.7)
- Architecture 83 → 83 (+0.0)
- Maturity 59 → 59 (+0.0)
- Readiness 53 → 53 (+0.0)
- Security 46 → 55 (+8.6)
- Performance 64 → 64 (+0.0)

## Resolved (5)

- Inconsistent naming for authentication/token generation endpoints. Admin uses 'AdminLogin' while User uses 'TokenRequest' and 'PasswordTokenRequest'. The intent (obtaining an auth token) is the same, but the verbs and structure differ.
- Inconsistent naming for retrieval operations within the same controller. 'GetRoles' is used, but 'GetAuthRoutes' is used for a different resource. While the resources differ, the pattern of using 'Get' for simple retrieval is consistent, but the resource naming ('AuthRoutes' vs 'Roles') suggests a potential domain confusion or lack of standardization in resource naming.
- Inconsistent naming for retrieval operations. One uses 'GetOrders' (verb-noun) while the other uses 'GetAllUsers' (verb-all-noun). The 'All' qualifier is used inconsistently.
- Off-boarding risk: anonymized user #1
- Outdated: OpenTelemetry.Exporter.Prometheus.AspNetCore

## New (19)

- Inconsistent naming for authentication/token generation endpoints. 'AdminLogin' implies a login flow, while 'TokenRequest' and 'PasswordTokenRequest' imply generic token issuance. There is no clear distinction between a 'Login' action and a 'TokenRequest' action in the API surface.
- Inconsistent naming for read-only list/fetch operations. Some use 'Get' (GetOrders, GetRoles, GetAuthRoutes) while another uses 'GetAll' (GetAllUsers). This suggests a lack of standardization in how collection retrieval is named.
- Medium IaC: CKV2_GHA_1 (.github/workflows/package.yml)
- Medium IaC: CKV_DOCKER_10 (Dockerfile)
- Medium IaC: CKV_DOCKER_3 (Dockerfile)
- Medium IaC: CKV_SECRET_6 (src/API/CleanArc.Web.Api/appsettings.json)
- Medium IaC: CKV_SECRET_6 (src/API/CleanArc.Web.Api/bin/Debug/net10.0/appsettings.json)
- Medium IaC: CKV_SECRET_6 (src/API/CleanArc.Web.Api/bin/Release/net10.0/appsettings.json)
- Off-boarding risk: anonymized user #1
- XML-doc coverage: CleanArc.Application (src/Core/CleanArc.Application/CleanArc.Application.csproj)
- XML-doc coverage: CleanArc.Domain (src/Core/CleanArc.Domain/CleanArc.Domain.csproj)
- XML-doc coverage: CleanArc.Infrastructure.CrossCutting (src/Infrastructure/CleanArc.Infrastructure.CrossCutting/CleanArc.Infrastructure.CrossCutting.csproj)
- XML-doc coverage: CleanArc.Infrastructure.Identity (src/Infrastructure/CleanArc.Infrastructure.Identity/CleanArc.Infrastructure.Identity.csproj)
- XML-doc coverage: CleanArc.Infrastructure.Monitoring (src/Infrastructure/CleanArc.Infrastructure.Monitoring/CleanArc.Infrastructure.Monitoring.csproj)
- XML-doc coverage: CleanArc.Infrastructure.Persistence (src/Infrastructure/CleanArc.Infrastructure.Persistence/CleanArc.Infrastructure.Persistence.csproj)
- XML-doc coverage: CleanArc.SharedKernel (src/Shared/CleanArc.SharedKernel/CleanArc.SharedKernel.csproj)
- XML-doc coverage: CleanArc.Web.Api (src/API/CleanArc.Web.Api/CleanArc.Web.Api.csproj)
- XML-doc coverage: CleanArc.Web.Plugins.Grpc (src/API/Plugins/CleanArc.Web.Plugins.Grpc/CleanArc.Web.Plugins.Grpc.csproj)
- XML-doc coverage: CleanArc.WebFramework (src/API/CleanArc.WebFramework/CleanArc.WebFramework.csproj)

## API surface

- Unchanged — 20 HTTP endpoints