# Changelog

## Score

- CAI 66 → 63 (-2.6)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 87 → 69 (-18.4)
- Architecture 80 → 80 (+0.0)
- Maturity 55 → 54 (-1.0)
- Readiness 65 → 65 (+0.0)
- Security 100 → 100 (+0.0)

## Resolved (4)

- Inconsistent constructor naming and parameter types. `Sanitize` and `CSS` use `initialize` with a `config` object, while `CleanAttribute` and `CleanElement` accept `sanitizer_or_config`. This creates ambiguity about whether the argument is a configuration object or a sanitizer instance, and mixes initialization patterns between core types and transformer types.
- Inconsistent naming for similar low-level operations. `Sanitize` uses `node!` while `CSS` uses `tree!`. Both appear to perform in-place sanitization/modification of a structural element (node vs tree). The naming convention should be consistent across the library's core operations.
- Inconsistent parameter handling for optional configuration. Some methods require the config argument while others do not, despite the existence of a default config property. This forces the caller to guess whether to pass `nil`/`null` or omit the argument, and breaks method overloading consistency.
- Workflow token permissions not restricted

## New (4)

- Inconsistent arity and configuration handling across entry points. Some methods accept an explicit config argument while their counterparts do not, despite the type having a `Sanitize.config` property and an `initialize` constructor. This forces users to guess whether to pass config or rely on a global/stateful default, and duplicates the logic for default config resolution.
- Inconsistent constructor parameter types. `CleanAttribute` and `CleanElement` (under CSS) accept `sanitizer_or_config`, while the top-level `CleanElement` accepts only `config`. This creates ambiguity about whether a sanitizer instance or a raw config object is expected, and duplicates the transformer intent across namespaces without clear distinction.
- Same inconsistency as above but within the CSS sub-namespace. Redundant overloads with and without config arguments create confusion about the source of truth for configuration.
- Workflow token permissions not restricted (.github/workflows/tests.yml)