# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 57 → 45 (-12.1)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 98 → 100 (+1.7)
- Architecture 100 → 94 (-5.6)
- Maturity 53 → 52 (-0.2)
- Readiness 46 → 27 (-18.5)
- Security 66 → 48 (-17.5)

## Resolved (15)

- Boundary-crossing change coupling: TensorflowConverter.scala ↔ Dependencies.scala (mleap-tensorflow/src/main/scala/ml/combust/mleap/tensorflow/converter/TensorflowConverter.scala)
- Concentrated knowledge decay
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- High CVE: [GHSA redacted] (python/requirements.txt)
- High CVE: [GHSA redacted] (python/requirements.txt)
- Largest orphaned file (python/mleap/sklearn/preprocessing/data.py)
- Low IaC: DS-0002 (.devcontainer/Dockerfile)
- Low IaC: DS-0029 (.devcontainer/Dockerfile)
- Off-boarding risk: anonymized user #1
- The README mentions two XGBoost implementations but clips mid-sentence before describing how to switch to the Predictor runtime. (mleap-xgboost-runtime/README.md)
- TooManyMethods: TypeConverters (mleap-grpc/src/main/scala/ml/combust/mleap/grpc/TypeConverters.scala)
- TooManyMethods: Value (bundle-ml/src/main/scala/ml/combust/bundle/dsl/Value.scala)
- Workflow token permissions not restricted
- complexity unreadable for .java, .py, .scala — churn × complexity hotspots could not be measured

## New (9)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High IaC: DS-0002 (.devcontainer/Dockerfile)
- High IaC: DS-0029 (.devcontainer/Dockerfile)
- High: security finding (details withheld)
- LLM evaluation failed
- Low IaC: DS-0026 (.devcontainer/Dockerfile)
- No artifact signing
- No tests found

## Architecture

- Containers 0 added · 0 removed · contexts 0 added · 1 removed · edges 0 added · 0 removed

## Removed bounded contexts (1)

- .