# Changelog

## Score

- CAI 72 → 67 (-5.0)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 99 → 75 (-23.9)
- Architecture 96 → 96 (+0.0)
- Maturity 62 → 57 (-4.1)
- Readiness 65 → 65 (+0.0)
- Security 95 → 95 (+0.0)

## Resolved (2)

- Off-boarding risk: anonymized user #1
- Workflow token permissions not restricted

## New (8)

- Ambiguous configuration loading strategy. `configure` takes a block (likely for in-memory DSL configuration), while `load_config` and `load_config_with_defaults` take a path. It is unclear if `load_config` and `load_config_with_defaults` are distinct operations or if one is a wrapper of the other with different default behavior. Furthermore, it is unclear if these methods are mutually exclusive or if they compose (e.g., does calling `load_config` after `configure` override it?).
- Documentation: no contributor guidance (README.md)
- Duplicate method signatures with different arities. `Base.run` is defined twice: once with `(args, kwargs, block)` and once with no arguments. This suggests either an overload that isn't clearly distinguished by name, or a copy-paste error in the API surface definition. If they serve different purposes (e.g., one for internal execution, one for public API), they should have distinct names.
- Off-boarding risk: anonymized user #1
- Workflow token permissions not restricted (.github/workflows/lint.yml)
- Workflow token permissions not restricted (.github/workflows/mysql.yml)
- Workflow token permissions not restricted (.github/workflows/postgresql.yml)
- Workflow token permissions not restricted (.github/workflows/sqlite.yml)

## Changes since last survey

- 1 commits — 1 feature/other, 0 fixes

## By area

- lib/active_record_doctor — 1 commit

## Notable commits

- change: postgres_timestamps_without_time_zone: new detector (#229)