# Changelog

## Score

- CAI 53 → 50 (-2.9)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 100 → 76 (-24.3)
- Architecture 69 → 69 (+0.0)
- Maturity 58 → 51 (-6.9)
- Readiness 80 → 80 (+0.0)
- Security 96 → 96 (+0.0)
- Domain Modelling 35 → 35 (+0.0)

## Resolved (3)

- Ambiguous distinction between bang and non-bang methods. In Ruby conventions, '!' often implies mutation or raising errors, while the non-bang version might return a result or handle errors silently. However, both appear to perform the same core action of creating a session. Without clear documentation on the difference (e.g., one raises, one returns nil), this creates confusion for API consumers.
- Overlap in session lookup logic. `find_passwordless_session_for` looks up a session by class, while `Context.resource_for` looks up a resource (which contains session logic) by session or authenticatable. These seem to serve similar discovery purposes but are exposed in different contexts (Controller vs Context), potentially leading to inconsistent usage patterns for finding the active session/resource.
- Workflow token permissions not restricted

## New (7)

- Ambiguous distinction between bang and non-bang methods. In Ruby conventions, '!' usually implies mutation or raising an error on failure, while the non-bang version might return nil or a boolean. However, without documentation, it is unclear if the non-bang version is a 'dry run' or a 'soft create'. This creates confusion for API consumers regarding error handling and return values.
- Duplicate hashing functionality. Passwordless.digest(token) appears to be a convenience wrapper around TokenDigest, but exposing both creates redundancy. If Passwordless.digest is just a wrapper, it should delegate clearly; if it does something different (e.g., uses a different algorithm or key), the naming does not reflect that difference.
- Inconsistent method signatures across test helper modules. Controller and Request test cases take a single 'resource' argument, while SystemTestCase takes an additional 'only_path' boolean. This forces test writers to remember different signatures depending on the test type, or handle optional arguments inconsistently.
- Orphaned file (app/controllers/passwordless/sessions_controller.rb)
- Orphaned file (lib/passwordless/controller_helpers.rb)
- Orphaned file (lib/passwordless/test_helpers.rb)
- Workflow token permissions not restricted (.github/workflows/ci.yml)

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)