# Changelog

## Score

- CAI 63 → 62 (-0.2)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 92 → 81 (-10.9)
- Architecture 100 → 100 (+0.0)
- Maturity 60 → 60 (+0.3)
- Readiness 55 → 56 (+1.4)
- Security 65 → 64 (-0.5)

## Resolved (6)

- Dependency hygiene not measured — no packages were read
- LLM evaluation failed
- Off-boarding risk: anonymized user #1
- SchemaTests.findSchemaWithProps (cognitive 18) (test/Frank.OpenApi.Tests/SchemaTests.fs)
- TestAuthHandler.HandleAuthenticateAsync (cognitive 16) (test/Frank.Auth.Tests/AuthorizationTests.fs)
- TooManyMethods: ResourceBuilder (src/Frank/ResourceBuilder.fsi)

## New (30)

- Duplicated block (15 lines × 2) (src/Frank.Alps/AuthorizationFilter.fs)
- Duplicated block (17 lines × 2) (src/Frank.Alps/DescriptorTypes.fsi)
- Duplicated block (18 lines × 2) (src/Frank.Validation/ShapeTypes.fsi)
- Duplicated block (8 lines × 2) (src/Frank.Validation/Shacl.fs)
- Duplicated block (9 lines × 2) (src/Frank.Alps/AuthorizationFilter.fs)
- Medium CVE: AngleSharp 1.4.0
- Off-boarding risk: anonymized user #1
- Outdated: Expecto
- Outdated: FSharp.Analyzers.SDK
- Outdated: FSharp.Control.TaskSeq
- Outdated: FSharp.Core
- Outdated: FSharp.SystemTextJson
- Outdated: Falco
- Outdated: Falco.Markup
- Outdated: Giraffe
- Outdated: Microsoft.AspNetCore.TestHost
- Outdated: Microsoft.Extensions.Logging.Abstractions
- Outdated: Microsoft.NET.Test.Sdk
- Outdated: Microsoft.OpenApi
- Outdated: Microsoft.Playwright.NUnit
- …and 10 more

## Changes since last survey

- 145 commits — 121 feature/other, 24 fixes

## By area

- docs/superpowers — 24 commits
- src/Frank.Validation — 23 commits
- src/Frank.Alps — 21 commits
- (root) — 14 commits
- src/Frank.Rdf — 13 commits
- src/Frank.Provenance — 10 commits
- test/Frank.Validation.Tests — 9 commits
- (repo) — 7 commits
- test/Frank.Rdf.Tests — 6 commits
- sample/Frank.Rdf.Sample — 5 commits
- test/Frank.Alps.Tests — 3 commits
- sample/Frank.Alps.Sample — 2 commits
- sample/Frank.Provenance.Sample — 2 commits
- sample/Frank.Validation.Sample — 2 commits
- .github/workflows — 1 commit
- hooks/check-new-package-deliverables.sh — 1 commit
- src/Directory.Build.props — 1 commit
- src/Frank — 1 commit

## Notable commits

- fix: chore: fix warnings
- fix: fix(alps): filter authorization through the whole descriptor tree; excerpt cache headers
- fix: fix(alps): use IStartupFilter instead of IHostedService for startup validation -- endpoints don't exist yet when IHostedService.StartAsync runs
- fix: fix(negotiate): add HttpContext -> Task<unit> overload so self-writing handlers dispatch directly
- fix: fix(provenance): CI registration, stronger eviction test, config safety clamp, docs
- fix: fix(provenance): guard mailbox loop against exceptions, always reply to Query
- fix: fix(provenance): use ProvRelation.toIri instead of hardcoded PROV-O IRIs in toSparqlQuery
- fix: fix(rdf): correct Task 2's undeclared-prefix test example (schema:Game is a well-formed URI, not a genuine failure case)
- fix: fix(rdf): document the NU1902 suppression in Frank.Rdf.fsproj
- fix: fix(rdf): fix case-sensitivity and unanchored ://  in resolveIri gate
- fix: fix(rdf): rename include to includeDoc to avoid FS0046
- fix: fix(rdf): restore Rdf.fsi to the build, resolve DescribeBuilder signature mismatch
- fix: fix(rdf): restore Task 5's undeclared-prefix test with a corrected example
- fix: fix(rdf): tighten resolveIri's undeclared-prefix fallback
- fix: fix(rdf-sample): explicit RequestDelegate avoids negotiate auto-format misroute, buffer JSON-LD via Doc.toJsonLd; register in Frank.sln
- fix: fix(sample): correct Doc.merge/include claims in Frank.Rdf.Sample
- fix: fix(sln): remove duplicate Frank.Rdf.Sample registration
- fix: fix(validation): bound EnableBuffering's memory use so the 413 guard actually caps buffering, not just the post-read check
- fix: fix(validation): decouple a shape's subject from its target class (final review I2)
- fix: fix(validation): dedupe Shacl.toDoc's shapeStatements emission when a ShapeDecl is shared between a top-level list entry and a nested sh:node/sh:qualifiedValueShape reference
- …and 125 more