# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 68 → 62 (-5.2)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 85 → 65 (-19.3)
- Architecture 81 → 84 (+3.2)
- Maturity 75 → 68 (-7.3)
- Readiness 60 → 71 (+11.2)
- Security 92 → 85 (-7.0)
- Accessibility 66 → 53 (-12.9)
- Performance 95 → 95 (+0.0)

## Resolved (16)

- Documentation: no licence statement (README.md)
- Duplicate intent for fetching coverage data. `coverage` and `coverage_for_types` in `HashRedisStore` appear to do the same thing (fetch coverage for specific types), with only a slight signature difference (`_local_type` vs `_types`).
- No ADRs found
- Off-boarding risk: anonymized user #1
- Outdated: rubocop
- Redundant methods with identical intent but different mutability semantics (bang vs non-bang) without clear distinction in naming or signature. Usually, if one is a no-op or just a wrapper, it should be removed or clearly differentiated.
- TodoComment (lib/coverband.rb)
- TodoComment (lib/coverband/adapters/base.rb)
- TodoComment (lib/coverband/adapters/web_service_store.rb)
- TodoComment (lib/coverband/configuration.rb)
- TodoComment (lib/coverband/reporters/base.rb)
- TodoComment (lib/coverband/reporters/html_report.rb)
- TodoComment (test/coverband/adapters/web_service_store_test.rb)
- Two methods for saving data with similar names but different signatures. `save_report` takes one arg, `save_coverage` takes two. It is unclear if they are interchangeable or serve different purposes (e.g., one for full report, one for incremental coverage).
- While these are implementations of a common interface, the presence of `DocumentRepository` and `RedisHashRepository` as separate classes under `TrackerStorage` suggests a potential duplication of the `TrackerStorage` concept if `Base` is also a concrete class. If `Base` is abstract, this is fine. However, `DocumentRepository` and `RedisHashRepository` both implement `entries()`, `pointer_session()`, etc., which is consistent, but the hierarchy is unclear. If `Base` is a module, it's fine. If it's a class, having two other classes inheriting from it or implementing it is standard, but the naming `TrackerStorage.Base` vs `TrackerStorage.DocumentRepository` is inconsistent (Base vs specific implementation).
- Workflow token permissions not restricted

## New (10)

- Conflicting or redundant coverage retrieval methods. `Base` defines `coverage(_local_type, opts)`, but `HashRedisStore` also defines `coverage_for_types(_types, opts)`. It is unclear if `coverage_for_types` is a specialized optimization or a duplicate. The naming `coverage` vs `coverage_for_types` is inconsistent with the base class expectation.
- High: security finding (details withheld)
- High: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- Orphaned file (lib/coverband/mcp/tools/get_file_coverage.rb)
- Orphaned file (lib/coverband/mcp/tools/get_uncovered_files.rb)
- Orphaned file (lib/coverband/utils/method_definition_scanner.rb)
- Redundant methods with identical intent. The bang (!) suffix in Ruby typically implies mutation or side effects, but both methods appear to trigger the same eager loading process. Having both creates confusion about whether one is a 'safe' version and the other is not, or if they are simply duplicates.
- Workflow token permissions not restricted (.github/workflows/diagram.yml)
- Workflow token permissions not restricted (.github/workflows/main.yml)

## Changes since last survey

- 17 commits — 13 feature/other, 4 fixes

## By area

- (repo) — 5 commits
- lib/coverband — 5 commits
- (root) — 4 commits
- .github/workflows — 2 commits
- test/coverband — 1 commit

## Notable commits

- fix: Fix runtime coverage percentages disagreeing with total coverage
- fix: Fix standalone web report JSON without ActiveSupport extensions
- fix: Merge pull request #669 from dajiaohuang/fix/standalone-report-json-20261016
- fix: Merge pull request #670 from danmayer/fix/runtime-coverage-percentages
- change: Add tsort to the Rails 7.0 test Gemfile for Ruby 4.1
- change: Finish Coverband 7 cleanup
- change: Keep pinned runner in CI matrix
- change: Make redis optional and tidy up before the 7.0 release
- change: Merge pull request #671 from danmayer/release-7-cleanup
- change: Merge pull request #672 from danmayer/codex/release-7-final-cleanup
- change: Merge pull request #674 from danmayer/codex/json3-ci-rc2
- change: Pin CI runners to Ubuntu 24.04
- change: Prepare 7.0.0.rc.1
- change: Prepare 7.0.0.rc.2 with JSON 3 coverage
- change: Remove coverband.io support and 7.0 deprecations, pin json for CI
- change: Remove misspelled Results method in 7.0
- change: Remove stale release metadata

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)