# Changelog

## Score

- CAI 64 → 61 (-2.6)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 91 → 70 (-20.7)
- Architecture 95 → 95 (+0.0)
- Maturity 72 → 64 (-7.8)
- Readiness 60 → 60 (+0.0)
- Security 55 → 55 (+0.0)
- Performance 87 → 87 (+0.0)

## Resolved (18)

- Ambiguous distinction between delete and force_delete. Without documentation, it is unclear what 'force' entails (e.g., bypassing checks, immediate deletion, ignoring errors). This creates a confusing pair where the difference is not self-evident from the signature.
- Confusing pair of delete methods. 'delete_cluster' returns the deleted config object, while 'delete_cluster_check' returns a Result. It is unclear what the 'check' variant does differently or why two methods are needed for deletion.
- Fork-triggerable workflow runs with an unscoped write token
- High CVE: [GHSA redacted] (Cargo.lock)
- High CVE: [GHSA redacted] (Cargo.lock)
- Inconsistent connection entry points. FluvioAdmin and Fluvio both expose connect() and connect_with_config(), but Fluvio adds a third connect_with_profile() variant while FluvioAdmin does not. This forces users to know which client type supports profile-based connection or requires manual config loading before calling connect_with_config.
- Inconsistent watch API. 'watch()' returns a generic Result (likely a generic stream or error), while 'watch_topics', 'watch_partitions', and 'watch_spus' return specific typed streams. This inconsistency makes it unclear when to use 'watch()' versus the specific methods.
- No AppArmor/SELinux confinement
- No seccomp profile
- Off-boarding risk: anonymized user #1
- Outdated: minijinja
- Outdated: parking_lot
- PR-triggered workflow grants a write-scoped token
- PR-triggered workflow without a permissions block
- Redundant creation methods with unclear distinction. 'create' takes individual parameters including a dry_run flag, while 'create_with_config' takes a CommonCreateRequest. It is unclear if CommonCreateRequest encapsulates the dry_run flag or other options, leading to potential confusion about which method to use for dry runs vs actual creation.
- Three different ways to list resources with overlapping intent. 'list' takes filters, 'list_with_params' takes filters plus a summary boolean, and 'list_with_config' takes a ListRequest. The relationship between filters, summary, and ListRequest is unclear, creating a fragmented API for the same operation.
- Workflow holding a long-lived secret is unscoped
- Workflow token grant is wider than its jobs use

## New (119)

- Ambiguous 'force' semantics. 'force_delete' implies a different behavior than 'delete', but the API does not expose what that difference is (e.g., bypassing checks, immediate removal). This creates a cognitive load to determine when to use which.
- Ambiguous loading behavior. 'load_default_or_new' suggests a specific fallback logic, while 'load' takes an optional path. It is unclear if 'load' with no path behaves the same as 'load_default_or_new'.
- Conflicting delete semantics. 'delete_cluster' returns the deleted config object, while 'delete_cluster_check' returns a Result. It is unclear if 'check' implies validation before deletion or if they are alternative implementations.
- Documentation: no project overview (crates/fluvio/README.md)
- Fork-triggerable workflow runs with an unscoped write token (.github/workflows/lint_pr.yml)
- High CVE: [GHSA redacted] (Cargo.lock)
- High CVE: [GHSA redacted] (Cargo.lock)
- Inconsistent connection entry points. FluvioAdmin and Fluvio both offer connect() and connect_with_config(), but Fluvio adds a third connect_with_profile() variant while FluvioAdmin does not. This forces users to remember which client supports profile-based connection directly.
- Inconsistent return types for watch operations. 'watch()' returns a generic Result (likely blocking or returning a generic stream), while specific watchers return typed streams. This breaks the principle of least surprise for stream-based APIs.
- Medium CVE: RUSTSEC-2026-0381 (Cargo.lock)
- Medium advisory (unmaintained): RUSTSEC-2024-0449 (Cargo.lock)
- Medium vulnerability: RUSTSEC-2026-0346 (Cargo.lock)
- Medium vulnerability: RUSTSEC-2026-0367 (Cargo.lock)
- Medium vulnerability: RUSTSEC-2026-0367 (Cargo.lock)
- No seccomp profile (k8-util/dashboard/metric-server.yaml)
- No seccomp profile (k8-util/util/busybox.yaml)
- Off-boarding risk: anonymized user #1
- Orphaned file (crates/cargo-builder/src/package.rs)
- Orphaned file (crates/cdk/src/generate.rs)
- Orphaned file (crates/fluvio-artifacts-util/src/package_meta_ext.rs)
- …and 99 more