# Changelog

## Score

- CAI 65 → 60 (-4.4)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 100 → 100 (+0.0)
- Architecture 64 → 64 (+0.1)
- Maturity 56 → 46 (-9.2)
- Readiness 70 → 70 (+0.0)
- Security 91 → 91 (+0.0)

## Resolved (3)

- Inconsistent request execution signatures. Chainable.request takes a block for the request body/configuration, whereas Client and Session.request take explicit keyword arguments (headers, params, form, json, body, etc.). This forces users to switch mental models between the chainable DSL and the imperative client/session APIs.
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block

## New (10)

- Inconsistent naming for factory/conversion methods. `URI.parse` is a class method for construction from a string. `Headers.coerce` is a class method for construction from various objects. While `coerce` is often used for type conversion in Ruby (e.g., `Numeric`), `parse` is specific to parsing strings. If `Headers.coerce` is intended to be a general constructor, `Headers.new` or `Headers.parse` might be more consistent with `URI.parse`. However, `coerce` is a valid Ruby idiom for type conversion. This is acceptable.
- No genuine inconsistency found. `merge` and `merge!` follow standard Ruby Hash conventions.
- Off-boarding risk: anonymized user #1
- Orphaned file (lib/http/headers/known.rb)
- PR-triggered workflow without a permissions block (.github/workflows/docs.yml)
- PR-triggered workflow without a permissions block (.github/workflows/lint.yml)
- PR-triggered workflow without a permissions block (.github/workflows/mutant.yml)
- PR-triggered workflow without a permissions block (.github/workflows/test.yml)
- PR-triggered workflow without a permissions block (.github/workflows/typecheck.yml)
- Redundant accessors for header retrieval. `Headers.[]` is the standard Ruby idiom for hash-like access, while `get` is a common alternative. Having both without clear distinction (e.g., one returning nil vs default) creates confusion.

## Changes since last survey

- 8 commits — 8 feature/other, 0 fixes

## By area

- (root) — 4 commits
- lib/http — 3 commits
- test/http — 1 commit

## Notable commits

- change: Add mutant:full rake task to run Mutant on all subjects
- change: Enable TCP_NODELAY by default
- change: Ensure rubocop ~> 1.91, needed for rubocop:disable-next
- change: Only install the sig group on Ruby 3.3 and newer
- change: Remove redundant Steep ignore comments
- change: Replace Steep ignore comments with signatures
- change: Require http/cookie instead of http/cookie_jar in Session
- change: Validate RBS signatures in a new typecheck task