# Changelog

## Score

- CAI 40 → 38 (-2.2)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 90 → 56 (-33.6)
- Architecture 100 → 100 (+0.0)
- Maturity 62 → 61 (-1.3)
- Readiness 41 → 41 (+0.0)
- Security 71 → 74 (+2.7)
- Accessibility 20 → 20 (+0.0)
- Performance 85 → 85 (+0.0)

## Resolved (6)

- Inconsistent Backend Client vs. Backend API: The `MessageBus.Backends.*` types (e.g., `Redis`, `Postgres`) expose a `publish` method, while their inner `Client` types expose `add` (or `publish` in Postgres Client). This creates a dual API for the same operation. Furthermore, `Postgres.Client.publish` lacks the `opts` argument present in the parent `Postgres.publish` and other backends, breaking interface consistency between the Backend and its Client.
- Off-boarding risk: anonymized user #1
- Redundant Codec Abstractions: The API exposes multiple distinct types for serialization (`MarshalCodec`, `PackedString`, `StringHack`, `MessageBus.Codec.*`) that all implement the exact same `encode(hash)` / `decode(payload)` interface. `PackedString` and `StringHack` appear to be legacy or specialized wrappers around the same concept as `MarshalCodec` or `MessageBus.Codec`, creating confusion about which codec to use for general message serialization versus internal packed string handling.
- Workflow holding a long-lived secret is unscoped
- jquery-1.8.2.matcherFromGroupMatchers (cognitive 54) (assets/jquery-1.8.2.js)
- jquery-1.8.2.matcherFromGroupMatchers (cyclomatic 33) (assets/jquery-1.8.2.js)

## New (12)

- Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
- Documentation: no architecture or design documentation
- Inconsistency in `global_subscribe` signature: `Redis.global_subscribe` accepts a block (`blk`), while `Memory` and `Postgres` do not show a block parameter in their signatures. This suggests a lack of uniform interface across backend implementations for the same operation.
- Multiple distinct types implement encoding/decoding logic with inconsistent naming and signatures. `MarshalCodec`, `PackedString`, `StringHack`, and `MessageBus.Codec.*` all define `encode` and `decode` methods, but they operate on different data structures (hashes vs payloads) and are not unified under a single interface or base class in the public API surface. Furthermore, `MessageBus.Message` has its own `encode`/`decode` pair, and a separate `encode_without_ids` method, creating confusion about which encoder to use for which domain.
- Off-boarding risk: anonymized user #1
- Orphaned file (lib/message_bus/backends/memory.rb)
- Orphaned file (lib/message_bus/distributed_cache.rb)
- Orphaned file (lib/message_bus/http_client.rb)
- The backend implementations (`Memory`, `Postgres`, `Redis`) duplicate the interface defined in `Base`, but `Base` also exposes `last_id` and `last_ids`. While this is technically inheritance, the public API surface exposes both the base and concrete implementations with identical signatures. If `Base` is abstract, it should not be part of the public API surface alongside its implementations, or the implementations should not expose these methods if they are strictly internal to the bus implementation.
- Workflow holding a long-lived secret is unscoped (.github/workflows/ci.yml)
- jquery-1.8.2.matcherFromGroupMatchers::superMatcher (cognitive 53) (assets/jquery-1.8.2.js)
- jquery-1.8.2.matcherFromGroupMatchers::superMatcher (cyclomatic 32) (assets/jquery-1.8.2.js)

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)