# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 52 → 56 (+3.9)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 68 → 70 (+1.9)
- Architecture 86 → 86 (+0.0)
- Maturity 55 → 55 (+0.0)
- Readiness 46 → 55 (+9.3)
- Security 71 → 72 (+0.1)
- Domain Modelling 56 → 56 (+0.0)
- Event-Driven 100 → 100 (+0.0)
- Accessibility 53 → 53 (+0.0)

## Resolved (16)

- Coverage not measured — analyzer environment
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- LLM evaluation failed
- Low IaC: DS-0026 (src/services/Ordering/CreateOrder.Consumer/Dockerfile)
- Low IaC: DS-0026 (src/services/Ordering/Ordering.StateService/Dockerfile)
- Low IaC: DS-0026 (src/services/Ordering/ProcessOrder.Consumer/Dockerfile)
- Medium CVE: SharpCompress 0.23.0
- No tests discovered

## New (16)

- Coverage not measured — analyzer environment
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Inconsistent spelling of 'Immutability' in type names. One is spelled 'Immutabilty' (missing 'i') and the other 'Immutabilty' (also missing 'i'). While they are distinct types, the shared root 'Immutabilty' suggests a systematic typo in the codebase's naming convention for this concept.
- Inconsistent spelling of 'Properties' in method names. One method is named 'AllProperiesAreEqual' (missing 'e' in Properties) while the other is 'ValueObjectAreEqual'. The typo 'Properies' should be 'Properties'.
- Medium CVE: SharpCompress 0.23.0
- Redundant/Overlapping Intent: These three types all represent actions on a burger order involving an OrderId, OrderDate, and CorrelationId (in some cases). The naming convention is inconsistent: 'Create' implies initial submission, 'Process' implies handling, and 'Submit' implies finalizing. However, they all share the same core identity (OrderId) and temporal data (OrderDate), making it unclear if they represent distinct lifecycle stages or are just different names for the same logical operation. Specifically, 'ProcessBurgerOrder' and 'SubmitBurgerOrder' are semantically ambiguous relative to each other.
- Test runner surfaced no tests
- redundant comment (src/services/Ordering/Ordering.IntegrationTests/TestStartup.cs)

## API surface

- Unchanged — 6 HTTP endpoints