# Changelog

## Score

- CAI 68 → 61 (-6.7)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 98 → 70 (-28.6)
- Architecture 95 → 95 (+0.0)
- Maturity 54 → 48 (-5.9)
- Readiness 65 → 65 (+0.0)
- Security 100 → 100 (+0.0)

## Resolved (5)

- Inconsistent method naming: 'onUnSubscribe' vs 'onUnsubscribe'. The WampServerInterface uses camelCase for the 'Un' prefix, while the implementation (TopicManager) and other methods (onSubscribe, onPublish) use standard camelCase 'Unsubscribe'.
- Inconsistent parameter naming and structure for WAMP protocol responses. callResult takes generic 'data', while callError takes specific 'errorUri, desc, details'. This makes the API asymmetric and harder to use programmatically compared to a unified error/result object or consistent naming.
- Inconsistent type hinting in proxy classes for Symfony compatibility. Symfony6's setId accepts mixed/any type (implied by lack of strict hint in signature provided), while Symfony7 explicitly types it as string. This creates an inconsistency in the expected contract between the two proxy implementations.
- Off-boarding risk: anonymized user #1
- Workflow token permissions not restricted

## New (14)

- Inconsistent method naming: 'onUnSubscribe' vs 'onUnsubscribe'. The WampServerInterface uses camelCase for the 'Un' prefix, while the implementation (TopicManager) and other methods (onSubscribe, onPublish) use standard camelCase ('Unsubscribe').
- Inconsistent parameter naming and structure for WAMP call responses. callResult takes generic 'data', while callError takes specific 'errorUri', 'desc', 'details'. This forces consumers to know the specific structure of error details rather than passing a generic payload, unlike the success path.
- Inconsistent verb usage for state modification: 'block' vs 'unblock'. While clear, 'unblock' is less standard than 'remove' or 'allow' in many security contexts, and contrasts with 'isBlocked' (state check). More importantly, 'blockAddress' and 'unblockAddress' are specific to IP, whereas 'filterAddress' is a generic check. The naming 'block' implies an action, but 'unblock' is the inverse. A more consistent pair might be 'addBlocked'/'removeBlocked' or 'block'/'unblock' (which is used here, so this is minor). However, looking at 'isBlocked' vs 'filterAddress', there is ambiguity.
- Off-boarding risk: anonymized user #1
- Orphaned file (src/Ratchet/Http/Router.php)
- Orphaned file (src/Ratchet/Server/FlashPolicy.php)
- Orphaned file (src/Ratchet/Server/IpBlackList.php)
- Orphaned file (src/Ratchet/Session/SessionProvider.php)
- Orphaned file (src/Ratchet/Wamp/ServerProtocol.php)
- Orphaned file (src/Ratchet/Wamp/Topic.php)
- Orphaned file (src/Ratchet/Wamp/TopicManager.php)
- Orphaned file (src/Ratchet/Wamp/WampConnection.php)
- Orphaned file (src/Ratchet/WebSocket/WsServer.php)
- Workflow token permissions not restricted (.github/workflows/ci.yml)