# Changelog

## Score

- CAI 61 → 58 (-2.6)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 100 → 76 (-24.3)
- Architecture 69 → 69 (+0.0)
- Maturity 47 → 44 (-3.4)
- Readiness 70 → 70 (+0.0)
- Security 74 → 74 (+0.0)

## Resolved (3)

- Inconsistent API for provisioning information. The base OTP class exposes `provisioning_params` as a property (likely returning a hash/dict), while HOTP and TOTP expose `provisioning_uri` as a method that returns a string. This forces consumers to handle two different formats depending on which class they are interacting with.
- Inconsistent naming for the primary OTP generation operation. HOTP and TOTP use `.at(...)` to generate a code based on a specific input (counter or time), while the base OTP class uses `.generate_otp(input)`. Additionally, TOTP has a convenience method `.now()` which is semantically equivalent to `.at(Time.now)` but lacks a corresponding `.now()` on HOTP (which would be `.at(current_counter)`).
- Workflow token permissions not restricted

## New (7)

- Inconsistent naming and parameterization for OTP generation. HOTP and TOTP use `.at(...)` with specific inputs (count/time), while the base OTP class uses `.generate_otp(input)`. Additionally, TOTP has a convenience method `.now()` which is not present in HOTP, creating an asymmetry in the API surface for generating the current code.
- Inconsistent verification signatures for the same logical operation. HOTP uses a 'counter' and 'retries' model, while TOTP uses 'drift' parameters and optional time overrides. This forces consumers to write different validation logic for each type despite both being OTP verification.
- Orphaned file (lib/rotp/arguments.rb)
- Orphaned file (lib/rotp/otp.rb)
- Orphaned file (lib/rotp/totp.rb)
- Workflow token permissions not restricted (.github/workflows/release.yaml)
- Workflow token permissions not restricted (.github/workflows/test.yaml)