# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 61 → 45 (-16.6)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 92 → 98 (+5.3)
- Architecture 98 → 94 (-3.5)
- Maturity 55 → 55 (+0.2)
- Readiness 56 → 24 (-31.9)
- Security 63 → 52 (-10.3)

## Resolved (16)

- Boundary-crossing change coupling: Revoke.php ↔ REST.php (src/AccessToken/Revoke.php)
- Change coupling: Revoke.php ↔ Verify.php (src/AccessToken/Revoke.php)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: src/Client.php (src/Client.php)
- Model.__get (cognitive 21) (src/Model.php)
- Model.mapTypes (cognitive 18) (src/Model.php)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block
- Resource.call (cognitive 27) (src/Service/Resource.php)
- Resource.call (cyclomatic 23) (src/Service/Resource.php)
- Resource.createRequestUri (cognitive 24) (src/Service/Resource.php)
- Runner.__construct (cognitive 16) (src/Task/Runner.php)
- TooManyMethods: Client (src/Client.php)
- UriTemplate.combine (cognitive 35) (src/Utils/UriTemplate.php)
- UriTemplate.combine (cyclomatic 21) (src/Utils/UriTemplate.php)

## New (4)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High: security finding (details withheld)
- No tests found