# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 51 → 55 (+4.3)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 48 → 70 (+22.2)
- Architecture 100 → 87 (-13.5)
- Maturity 64 → 48 (-16.1)
- Readiness 40 → 54 (+14.2)
- Security 62 → 77 (+15.4)
- Accessibility 80 → 75 (-5.8)
- Performance 100 → 60 (-40.0)

## Resolved (90)

- 01-markdown.blocks (cognitive 25) (src/invisible_playwright_mcp/ui/js/01-markdown.js)
- 01-markdown.blocks (cyclomatic 24) (src/invisible_playwright_mcp/ui/js/01-markdown.js)
- 01-markdown.inline (cognitive 18) (src/invisible_playwright_mcp/ui/js/01-markdown.js)
- 01-markdown.inline (cyclomatic 16) (src/invisible_playwright_mcp/ui/js/01-markdown.js)
- 01-markdown.listAt (cognitive 19) (src/invisible_playwright_mcp/ui/js/01-markdown.js)
- 03-which-session.onEvent (cognitive 23) (src/invisible_playwright_mcp/ui/js/03-which-session.js)
- 03-which-session.onEvent (cyclomatic 21) (src/invisible_playwright_mcp/ui/js/03-which-session.js)
- 05-browser.onePass (cognitive 42) (src/invisible_playwright_mcp/ui/js/05-browser.js)
- 05-browser.onePass (cyclomatic 16) (src/invisible_playwright_mcp/ui/js/05-browser.js)
- 06-sessions.drawChats (cyclomatic 23) (src/invisible_playwright_mcp/ui/js/06-sessions.js)
- Conversation.run (cognitive 25) (src/invisible_playwright_mcp/agent.py)
- Documentation: no installation or build instructions (docs/ai-agent-login-to-a-website.md)
- Duplicate listing functionality. `chats.known_chats` returns a list of dicts (likely metadata), and `Sessions.listing` returns a list of dicts. These likely serve the same purpose of listing available sessions.
- Duplicate persistence logic with identical signatures. Both modules handle deleting chat/session data by ID.
- Duplicate persistence logic with identical signatures. Both modules handle loading chat/session data by ID, likely reading from the same underlying storage mechanism but exposing it through different namespaces.
- Duplicate persistence logic with similar signatures. Both handle saving state, but accept different payloads (`history/messages` vs `browsers/focus`). This suggests a split responsibility that is confusingly named; 'save_chat' implies general session saving, while 'save' is generic.
- Duplicated block (17 lines × 2) (scripts/pack_bundle.py)
- Edited copy of a member (21 corresponding lines) (scripts/pack_bundle.py)
- FileTooLong: mcp/actions.py (src/invisible_playwright_mcp/mcp/actions.py)
- High: security finding (details withheld)
- …and 70 more

## New (316)

- ActivityView.ActivityView (cognitive 24) (apps/web/src/components/activity/ActivityView.tsx)
- ActivityView.ActivityView (cyclomatic 20) (apps/web/src/components/activity/ActivityView.tsx)
- AgentRunner._drain_injections (cognitive 20) (invisible_engine_dots/nanobot/agent/runner.py)
- AgentRunner._run_core (cognitive 64) (invisible_engine_dots/nanobot/agent/runner.py)
- AgentRunner._run_core (cyclomatic 34) (invisible_engine_dots/nanobot/agent/runner.py)
- AgentServer._handle (cognitive 65) (invisible_engine_dots/nanobot/dots/server.py)
- AgentServer._handle (cyclomatic 41) (invisible_engine_dots/nanobot/dots/server.py)
- ApplyPatchTool.execute (cognitive 100) (invisible_engine_dots/nanobot/agent/tools/apply_patch.py)
- ApplyPatchTool.execute (cyclomatic 42) (invisible_engine_dots/nanobot/agent/tools/apply_patch.py)
- BindingRunner.#supervise (cognitive 18) (packages/channels/src/runner.ts)
- Boundary-crossing change coupling: scheduler.ts ↔ client.ts (apps/scheduler/src/scheduler.ts)
- BrowserManager.launch (cognitive 18) (invisible_engine_dots/nanobot/dots/browser.py)
- Change coupling: scheduler.ts ↔ testing.ts (apps/scheduler/src/scheduler.ts)
- ChannelHub.#inbound (cognitive 16) (packages/channels/src/hub.ts)
- ChannelHub.#inbound (cyclomatic 16) (packages/channels/src/hub.ts)
- ClassTooLong: Lifecycle (apps/scheduler/src/lifecycle.ts)
- ClassTooLong: Scheduler (apps/scheduler/src/scheduler.ts)
- Consolidator.summarize (cognitive 25) (invisible_engine_dots/nanobot/agent/memory.py)
- Consolidator.summarize (cyclomatic 16) (invisible_engine_dots/nanobot/agent/memory.py)
- ContextGovernor.backfill_missing_tool_results (cognitive 43) (invisible_engine_dots/nanobot/agent/context_governance.py)
- …and 296 more

## Changes since last survey

- 300 commits — 292 feature/other, 8 fixes

## By area

- (repo) — 55 commits
- apps/web — 47 commits
- guest/image-builder — 35 commits
- invisible_engine_dots/nanobot — 21 commits
- .github/test-floors.json — 19 commits
- invisible_engine_dots/tests — 19 commits
- (root) — 15 commits
- docs/images — 14 commits
- tests/bench — 14 commits
- apps/scheduler — 12 commits
- docs/wiki — 8 commits
- tests/e2e — 8 commits
- packages/channels — 7 commits
- apps/cli — 6 commits
- apps/api — 4 commits
- apps/vm-manager — 3 commits
- docs/architecture.md — 2 commits
- docs/guide.md — 2 commits
- guest/dot-agentd — 2 commits
- packages/database — 2 commits

## Notable commits

- fix: Merge branch 'clients-fixes' into fixes-batch
- fix: Merge branch 'engine-lean' into fixes-batch
- fix: Merge branch 'guest-fixes' into fixes-batch
- fix: Merge pull request #1443 from feder-cr/fixes-batch
- fix: cli test: serve's tests wait for what they check instead of a fixed 20 ms
- fix: engine: a request is sized by what the provider counted of the prompt it extends plus an estimate of the rest scaled to the worst tokenizer measured, not by tiktoken with a fixed margin (Claude counts code a third above it, and a task on a 1M window was refused for asking an answer 2779 tokens too long)
- fix: engine: no fixed cap on a tool's result; the cut is the model's window, read from OpenRouter on every turn
- fix: merge: lane-fixes (channels, host API, integration fixes, automation wake, L13) into the browser block (M5)
- change: Community files: how to contribute, the code of conduct and the security policy, and issue and PR templates that ask for what a report of this project needs (doctor, logs, commit, host)
- change: Merge main into readme-gif-dark
- change: Merge pull request #1413 from feder-cr/readme-short
- change: Merge pull request #1414 from feder-cr/readme-medium
- change: Merge pull request #1415 from feder-cr/soak-flakes-2
- change: Merge pull request #1416 from feder-cr/readme-hero-alternative
- change: Merge pull request #1417 from feder-cr/browser-stop-closed
- change: Merge pull request #1418 from feder-cr/readme-hero-gif
- change: Merge pull request #1419 from feder-cr/community-files
- change: Merge pull request #1420 from feder-cr/readme-gif-dark
- change: Merge pull request #1421 from feder-cr/approvals-order
- change: Merge pull request #1422 from feder-cr/readme-four
- …and 280 more

## Architecture

- 0 containers · 2 bounded contexts · 0 dependency edges (baseline)