# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 42 → 36 (-5.3)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 61 → 52 (-8.7)
- Architecture 95 → 94 (-0.9)
- Maturity 71 → 48 (-23.9)
- Readiness 42 → 50 (+8.7)
- Security 56 → 41 (-14.6)
- Accessibility 27 → 22 (-5.2)
- Performance 100 → 100 (+0.0)

## Resolved (22)

- Further orphaned files (smaller)
- High CVE: [GHSA redacted] (archive/kt-sft/requirements-sft.txt)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (kt-kernel/python/utils/amx.py)
- Members sharing a duplicated core (8 members, 50+ identical tokens) (kt-kernel/python/cli/commands/run.py)
- Off-boarding risk: anonymized user #1
- Orphaned knowledge (archive/ktransformers/models/modeling_deepseek.py)
- Orphaned knowledge (archive/ktransformers/models/modeling_llama.py)
- Orphaned knowledge (archive/ktransformers/models/modeling_mixtral.py)
- Orphaned knowledge (archive/ktransformers/models/modeling_qwen2_moe.py)
- Orphaned knowledge (archive/ktransformers/models/modeling_smallthinker.py)
- Orphaned knowledge (archive/ktransformers/operators/cpuinfer.py)
- Orphaned knowledge (archive/ktransformers/operators/dynamic_attention.py)
- Orphaned knowledge (archive/ktransformers/util/modeling_rope_utils.py)
- Orphaned knowledge (archive/setup.py)
- Orphaned knowledge (kt-kernel/bench/compare_moe_performance.py)
- Orphaned knowledge (kt-kernel/python/cli/commands/model.py)
- Orphaned knowledge (kt-kernel/python/cli/utils/model_verifier.py)
- Orphaned knowledge (kt-kernel/python/cli/utils/run_interactive.py)
- PR-triggered workflow grants a write-scoped token
- PR-triggered workflow without a permissions block
- …and 2 more

## New (37)

- High vulnerability: [GHSA redacted] (archive/kt-sft/requirements-sft.txt)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (kt-kernel/python/utils/amx.py)
- Members sharing a duplicated core (8 members, 50+ identical tokens) (kt-kernel/python/cli/commands/run.py)
- Off-boarding risk: anonymized user #1
- Outdated: absl-py
- Outdated: aiohappyeyeballs
- Outdated: aiohttp
- Outdated: aiosignal
- Outdated: attrs
- Outdated: conda-pack
- Outdated: datasets
- Outdated: dill
- Outdated: einops
- Outdated: frozenlist
- Outdated: graphviz
- Outdated: joblib
- Outdated: multidict
- Outdated: multiprocess
- …and 17 more

## Changes since last survey

- 11 commits — 7 feature/other, 4 fixes

## By area

- kt-kernel/operators — 2 commits
- kt-kernel/python — 2 commits
- papers/kt-ft — 2 commits
- (root) — 1 commit
- doc/en — 1 commit
- kt-kernel/CMakeLists.txt — 1 commit
- kt-kernel/cpu_backend — 1 commit
- kt-kernel/test — 1 commit

## Notable commits

- fix: [docs]: fix links to moved injection and Kimi-K2 native tutorials (#2223)
- fix: [fix](cli): fill in the model name and path in kt model remove/edit warnings (#2220)
- fix: [fix](kt-kernel): size per-NUMA thread counters by physical NUMA id (#2228)
- fix: [fix]: retain mmap owners for AVX2 RAWINT4 (#2225)
- change: [docs](sft): prepare DeepSeek V4 Flash 0.7.2 quickstart (#2247)
- change: [feat](kt-kernel): add AVX2 RAWINT4 routed-expert LoRA SFT backend (#2243)
- change: [feat](sycl): add opt-in Panther Lake XMX expert backend (#2250)
- change: [perf](kt-kernel): fuse CPU BF16 gradient norm reduction (#2234)
- change: [perf](kt-kernel): set up the llamafile forward_many buffers only for the experts in use (#2233)
- change: docs: publish KTransformers-FineTune author preprint
- change: docs: restore single-column Figure 2 in KT-FT paper

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)