# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 48 → 48 (+0.5)

## Lenses

- Code Health 61 → 61 (-0.0)
- Architecture 86 → 86 (+0.0)
- Maturity 67 → 52 (-15.4)
- Readiness 49 → 46 (-3.1)
- Security 38 → 44 (+6.1)
- Accessibility 59 → 59 (+0.0)

## Resolved (7)

- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- redundant comment (src/EndToEndTests/ShoppingCartE2ETests.cs)

## New (10)

- Ambiguous pluralization: 'ShoppingCart' is used for the aggregate root, while 'ShoppingCartItem' is used for the line item. However, in other parts of the codebase (e.g., `Sales.Data.SalesContext.ShoppingCarts`), the plural form 'ShoppingCarts' is used for a collection of carts, while `Sales.Data.Models.ShoppingCartItem` is a single item. The inconsistency lies in the naming of the line item: `ShoppingCartItem` vs potentially `CartLine` or `CartItem` elsewhere. More critically, `Sales.Data.Models.ShoppingCart` is the entity, but `Sales.Data.SalesContext.ShoppingCarts` suggests a DbSet. The main inconsistency is between `ShoppingCart` (the container) and `ShoppingCartItem` (the content). While distinct, the term 'ShoppingCart' is used for both the aggregate and the collection property `ShoppingCarts`, which can be confusing. A more significant inconsistency is the use of `ShoppingCartItem` in `Sales.Data.Models` but `Shipping.Data.Models.ShoppingCartItem` in other namespaces, implying a potential duplication or mismatch in model definitions across bounded contexts.
- Command duplication: 'AddItemToCart' is defined in multiple namespaces (Sales, Shipping, Warehouse, Marketing). While each may have different payloads, the command name is identical. This can cause confusion when debugging or tracing messages across services.
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Inconsistent event naming for state changes: 'ShoppingCartGotInactive' and 'ShoppingCartGotStale' use different verbs ('Inactive' vs 'Stale') to describe potentially similar or related lifecycle states. This makes it unclear if these are distinct states or if one should be renamed to match the other's pattern (e.g., 'ShoppingCartExpired' or 'ShoppingCartTimedOut').
- Inconsistent naming for policy/timeout concepts: 'ShoppingCartLifecyclePolicy' is a saga/policy, while 'CartGettingStaleTimeout' is a timeout state or configuration. The naming convention differs: one uses 'Policy' and the other uses 'Timeout' or 'State'.

## Changes since last survey

- 2 commits — 2 feature/other, 0 fixes

## By area

- .github/workflows — 2 commits

## Notable commits

- change: Update renovatebot/github-action action to v46.2.0 (#652)
- change: Update renovatebot/github-action action to v46.2.1 (#653)

## API surface

- Unchanged — 11 HTTP endpoints

## Architecture

- Unchanged — 12 containers · 0 contexts · 0 edges