# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 48 → 72 (+23.1)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 100 → 99 (-0.9)
- Architecture 94 → 94 (+0.2)
- Maturity 59 → 53 (-6.2)
- Readiness 27 → 80 (+52.9)
- Security 59 → 100 (+41.2)

## Resolved (16)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- No exposed public API
- No tests found
- Test reliability not included
- The README does not mention licensing or a For Enterprise section (the outline lists it but the visible text ends before mentioning enterprise support). (README.md)

## New (22)

- Change coupling: FulfilledPromise.php ↔ RejectedPromise.php (src/FulfilledPromise.php)
- Documentation: no installation or build instructions (README.md)
- Documentation: no usage examples (README.md)
- Duplicated block (11 lines × 2) (src/Utils.php)
- Duplicated block (11–13 lines × 2) (src/FulfilledPromise.php)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: src/Promise.php (src/Promise.php)
- No assertions: testShouldCancelResultPromiseAndOutsideCurrentPromise (tests/CoroutineTest.php)
- No assertions: testShouldProxyPromiseMethodsToResultPromise (tests/CoroutineTest.php)
- No assertions: testShouldProxyResolveWithoutValueToResultPromiseAsNull (tests/CoroutineTest.php)
- No dependency advisory monitoring
- …and 2 more

## Changes since last survey

- 3 commits — 3 feature/other, 0 fixes

## By area

- (root) — 3 commits

## Notable commits

- change: Add PHP 8.6 to the CI matrix and version guidance (#242)
- change: Document that getState() reflects settlement, not the eventual outcome (#240)
- change: Release 3.0.2