# Changelog

## Score

- CAI 62 → 43 (-18.3)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 72 → 58 (-14.5)
- Architecture 88 → 88 (+0.0)
- Maturity 54 → 33 (-21.1)
- Readiness 71 → 71 (-0.2)
- Security 81 → 39 (-41.4)
- Domain Modelling 67 → 67 (+0.0)
- Accessibility 65 → 65 (+0.0)

## Resolved (8)

- Documentation: no usage examples (README.md)
- Duplicate intent with ambiguous semantics. `set_payment_processor` and `add_payment_processor` likely perform similar or overlapping functions regarding assigning a processor to a customer, but the distinction is unclear from the signatures alone.
- Duplicate intent with inconsistent spelling. Both methods check if a subscription is canceled, but use American ('canceled') and British ('cancelled') spellings interchangeably.
- Inconsistent configuration entry points. The main `Pay` module has a `setup` method, but each processor (Braintree, LemonSqueezy, PaddleBilling) also exposes its own `setup` method. This creates confusion about whether configuration should happen at the top-level namespace or per-processor.
- Inconsistent naming convention for state transitions. The `Subscription` class uses `pause` and `unpause` (verb-based), whereas other state changes like `cancel` and `resume` (or `cancel_now!`) are used. Specifically, `resume` is used to unpause, but `unpause` is also present in Stripe's implementation, creating redundancy.
- Off-boarding risk: anonymized user #1
- Orphaned files with no living knowledge
- Workflow holding a long-lived secret is unscoped

## New (11)

- Documentation: no contributor guidance (README.md)
- Documentation: no installation or build instructions (README.md)
- Duplicate intent with inconsistent spelling. Both methods check if a subscription is canceled, but use American ('canceled') and British ('cancelled') spellings. This forces users to guess which spelling is supported or call both.
- Duplicate intent. 'set_payment_processor' and 'add_payment_processor' appear to do the same thing (assigning a processor to a customer). The distinction between 'set' (overwrite?) and 'add' (append?) is not clear from the signature, and having both suggests redundancy.
- Inconsistent naming for resume operations. Some processors (Stripe, PaddleBilling, PaddleClassic, FakeProcessor) use 'resume()', while Stripe also exposes 'unpause()'. 'Pause' and 'Unpause' are a pair, but 'Pause' and 'Resume' are a pair. Mixing these verbs across the same domain (subscription state management) is confusing.
- Off-boarding risk: anonymized user #1
- Outdated: braintree
- Outdated: sqlite3
- Outdated: webmock
- Workflow holding a long-lived secret is unscoped (.github/workflows/ci.yml)
- Workflow token permissions not restricted (.github/workflows/publish_gem.yml)

## Changes since last survey

- 7 commits — 6 feature/other, 1 fixes

## By area

- (root) — 2 commits
- app/models — 2 commits
- lib/pay — 1 commit
- test/pay — 1 commit
- test/vcr_cassettes — 1 commit

## Notable commits

- fix: Require paddle 3 and fix Paddle error handling (#1285)
- change: Changelog for 12.3.0
- change: Make Pay's configuration and state readable from Ractors (#1288)
- change: Make processor scopes and predicates usable from Ractors (#1287)
- change: Upgrade to Stripe 20 and update dependencies (#1284)
- change: Use minitest 6 where Rails supports it (#1286)
- change: Version bump

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)