# Changelog

## Score

- CAI 67 → 64 (-3.6)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 100 → 75 (-24.1)
- Architecture 69 → 69 (+0.0)
- Maturity 61 → 57 (-3.7)
- Readiness 67 → 67 (+0.0)
- Security 91 → 85 (-6.2)

## Resolved (3)

- Ambiguous distinction between plural and singular methods for similar intent. 'honeypots' likely returns a collection or configuration, while 'get_honeypot' likely returns a single instance or generates one. However, without clear naming convention (e.g., 'list_honeypots' vs 'create_honeypot'), it is unclear if 'get_honeypot' retrieves an existing one or generates a new one, especially given the presence of 'generate_random_honeypot'.
- Property 'honeypot_enabled' (boolean flag) and method 'honeypots' (likely returns list of honeypot names/fields) are related but distinct. However, 'honeypots' as a method name for a getter is inconsistent with Ruby/Rails conventions where plural methods often imply iteration or collection access, while singular 'honeypot' might be preferred for a single item. More critically, 'honeypot_enabled' is a property, while 'honeypots' is a method. If 'honeypots' is just a getter for a config attribute, it should be a property or named 'honeypot_fields'.
- Workflow token permissions not restricted

## New (3)

- Ambiguous distinction between plural and singular getter methods. It is unclear if `honeypots()` returns a collection and `get_honeypot()` returns a single instance, or if they are redundant aliases for retrieving the same data structure.
- Inconsistent naming for helper methods across different modules. `ControllerExt` uses a descriptive verb phrase `clear_invisible_captcha_session`, while `FormHelpers` and `ViewHelpers` use the noun phrase `invisible_captcha`. This creates a disjointed API surface where similar utility functions are named differently based on their module.
- Workflow token permissions not restricted (.github/workflows/ci.yml)