# Changelog

## Score

- CAI 67 → 72 (+5.6)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 80 → 79 (-0.3)
- Architecture 88 → 94 (+6.4)
- Maturity 52 → 66 (+13.5)
- Readiness 90 → 76 (-14.7)
- Security 75 → 78 (+3.2)
- Performance 86 (new)

## Resolved (69)

- Documentation: contradicts the code
- Documentation: contradicts the code (docs/plans/2026-04-24-issue-594-phase-2-schema-plan.md)
- Documentation: no installation or build instructions (README.md)
- Duplicated block (10 lines × 2) (crates/nono-cli/src/command_runtime.rs)
- Duplicated block (10 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (10 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (11–13 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (12 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (12 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (13 lines × 2) (crates/nono-cli/src/exec_strategy.rs)
- Duplicated block (13 lines × 2) (crates/nono-cli/src/execution_runtime.rs)
- Duplicated block (13 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (15 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (15 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (16 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (18 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (18 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (19 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (20 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (21–24 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- …and 49 more

## New (79)

- Change coupling: app_runtime.rs ↔ cli_bootstrap.rs (crates/nono-cli/src/app_runtime.rs)
- Change coupling: main.rs ↔ snapshot.rs (crates/nono-cli/src/main.rs)
- DiagnosticFormatter::format_network_denial_guidance (cognitive 18) (crates/nono-cli/src/diagnostic/formatter.rs)
- Documentation: no project overview (README.md)
- Duplicated block (10 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (10 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (10 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (10 lines × 2) (tool-sandbox-examples/kubernetes-with-approval/make-proxy-kubeconfig.py)
- Duplicated block (11–13 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (12 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (13 lines × 2) (crates/nono-cli/src/command_runtime.rs)
- Duplicated block (14 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (15 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (16 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (16 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (18 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (19 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (19 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (20 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- Duplicated block (21–24 lines × 2) (crates/nono-cli/src/tool-sandbox/platform/linux.rs)
- …and 59 more

## Changes since last survey

- 63 commits — 45 feature/other, 18 fixes

## By area

- crates/nono-cli — 25 commits
- (root) — 22 commits
- .github/workflows — 6 commits
- crates/nono-proxy — 3 commits
- docs/cli — 2 commits
- neps/0003-keychain-authorisation-to-cli.md — 1 commit
- neps/0004-opt-in-linux-namespace-isolation.md — 1 commit
- packaging/aur — 1 commit
- tests/integration — 1 commit
- tool-sandbox-examples/docker-tool-sandbox — 1 commit

## Notable commits

- fix: fix(aur): update upstream URLs to nolabs-ai (#1979)
- fix: fix(cli): accept keyring:// URIs in custom credential_key (#1931)
- fix: fix(cli): audit approval backend decisions prior to file operations (#2010)
- fix: fix(cli): keep protected-root attempts out of actionable denial guidance (#1941)
- fix: fix(cli): show resolved session hooks in profile output (#1935)
- fix: fix(exec): keep session temp files alive against the OS reaper (#1942)
- fix: fix(keystore): refuse empty sanitized PATH for host-side brokers (#1895)
- fix: fix(linux): preserve O_PATH in musl builds (#2005)
- fix: fix(macos): recursively block sockets under denied directories (#2026)
- fix: fix(policy): allow Linux font configuration reads (#1991)
- fix: fix(policy): allow reading Linux MIME types (#2013)
- fix: fix(policy): let man/apropos/whatis work on Linux (#1953)
- fix: fix(proxy): decode chunked client-credentials token responses (#1976)
- fix: fix(proxy): preserve query string on jwt-bearer token_url (#1913)
- fix: fix(tool-sandbox): derive shim broker socket from executable path (#2002)
- fix: fix(tool-sandbox): fall back to the interpreter's directory for RPATH-less ELF dependencies (#1650)
- fix: fix(tool-sandbox): isolate network policy by effective command scope (#1981)
- fix: fix: file grants negate filesystem.deny - #1949 (#2019)
- change: Merge commit from fork
- change: Merge commit from fork
- …and 43 more