# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 53 → 70 (+17.0)
- Rubric changed (rubric-2026.08.15 → rubric-2026.09.15) — scores are not directly comparable.

## Lenses

- Code Health 100 → 75 (-25.3)
- Architecture 92 → 91 (-0.8)
- Maturity 82 → 88 (+6.1)
- Readiness 27 → 66 (+38.3)
- Security 65 → 68 (+2.1)

## Resolved (46)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 26 more

## New (595)

- AggressiveFilter::filter (cognitive 24) (src/core/filter.rs)
- CargoTestHandler::compute_test_summary (cognitive 21) (src/cmds/rust/cargo_cmd.rs)
- ClassTooLong: Commands (src/main.rs)
- ClassTooLong: Tracker (src/core/tracking.rs)
- ClaudeProvider::discover_sessions_in_projects_dir (cognitive 18) (src/discover/provider.rs)
- ClaudeProvider::extract_commands (cognitive 37) (src/discover/provider.rs)
- ClaudeProvider::extract_commands (cyclomatic 17) (src/discover/provider.rs)
- Dependency advisory scan runs only on code events
- Dependency hygiene PARTLY measured — Maven/Gradle declarations read, no dependency graph resolved
- DependencyState::format_compact (cognitive 16) (src/parser/formatter.rs)
- DependencyState::format_verbose (cognitive 17) (src/parser/formatter.rs)
- Documentation: no project overview (README.md)
- Duplicated block (10 lines × 2) (src/analytics/gain.rs)
- Duplicated block (10 lines × 2) (src/cmds/git/git_cmd.rs)
- Duplicated block (10 lines × 2) (src/cmds/js/lint_cmd.rs)
- Duplicated block (10 lines × 2) (src/cmds/system/json_cmd.rs)
- Duplicated block (10–11 lines × 2) (src/cmds/jvm/mvn_cmd.rs)
- Duplicated block (11 lines × 2) (src/cmds/cloud/aws_cmd.rs)
- Duplicated block (11 lines × 2) (src/cmds/dotnet/dotnet_cmd.rs)
- Duplicated block (11 lines × 2) (src/cmds/git/gh_cmd.rs)
- …and 575 more

## Changes since last survey

- 300 commits — 123 feature/other, 177 fixes

## By area

- src/cmds — 101 commits
- (repo) — 74 commits
- src/core — 39 commits
- src/hooks — 23 commits
- (root) — 13 commits
- src/discover — 9 commits
- docs/guide — 6 commits
- docs/usage — 4 commits
- src/analytics — 4 commits
- .github/workflows — 3 commits
- src/main.rs — 3 commits
- .claude/rules — 2 commits
- docs/TELEMETRY.md — 2 commits
- tests/fixtures — 2 commits
- tests/git_show_blob_differential_test.rs — 2 commits
- tests/guard_integration_test.rs — 2 commits
- tests/read_window_bytes_test.rs — 2 commits
- tests/run_shell_test.rs — 2 commits
- src/filters — 1 commit
- tests/grep_faithful_format_test.rs — 1 commit

## Notable commits

- fix: Merge branch 'develop' into fix/global-init-create-claude-config-dir
- fix: Merge branch 'develop' into fix/global-init-create-claude-config-dir
- fix: Merge branch 'develop' into fix/minimal-python-multiline-string
- fix: Merge develop into fix/init-agent-cursor-directory
- fix: Merge origin/develop into fix/pipe-safe-consummer-and-slim-instructions
- fix: Merge pull request #1122 from carlosdagos/fix/gh-pr-no-early-exit
- fix: Merge pull request #1298 from rtk-ai/fix/tracking-weighted-aggregations
- fix: Merge pull request #1422 from JackDanger/fix/suppress-hook-warn-during-init
- fix: Merge pull request #2397 from hgunduzoglu/fix/minimal-filter-comment-detection
- fix: Merge pull request #2515 from allanbatista/codex/fix-native-test-expression
- fix: Merge pull request #2521 from elite133713/fix/global-init-create-claude-config-dir
- fix: Merge pull request #2709 from guyoron1/fix/gradle-filter-regex-match
- fix: Merge pull request #3000 from rNoz/fix/init-agent-cursor-directory
- fix: Merge pull request #3083 from lntutor/fix/2669-ruff-subcommand-routing
- fix: Merge pull request #3087 from lntutor/fix/2663-npm-subcommands
- fix: Merge pull request #3258 from breisnerlopez/fix/grep-l-max-len-collision
- fix: Merge pull request #3275 from breisnerlopez/fix/pnpm-strip-global-opts
- fix: Merge pull request #3336 from imkp1/fix/minimal-python-multiline-string
- fix: Merge pull request #3343 from rtk-ai/fix/pipe-safe-consummer-and-slim-instructions
- fix: Merge pull request #3542 from uuzzrm/fix/gh-checks-watch-deduplicate
- …and 280 more