# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 60 → 46 (-14.2)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 91 → 92 (+0.7)
- Architecture 98 → 97 (-1.1)
- Maturity 55 → 57 (+2.3)
- Readiness 53 → 23 (-29.6)
- Security 74 → 60 (-13.5)

## Resolved (7)

- Change coupling clique: simplecov.rb, maximum_coverage_drop_check.rb, minimum_coverage_by_file_check.rb (lib/simplecov.rb)
- Change coupling: coverage_statistics.rb ↔ source_file.rb (lib/simplecov/coverage_statistics.rb)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- Low vulnerability: [GHSA redacted] (html_frontend/bun.lock)
- Off-boarding risk: anonymized user #1
- PR-triggered workflow without a permissions block

## New (6)

- Coverage not measured — test suite did not build
- Dimension evaluation failed
- High: security finding (details withheld)
- No build provenance
- No tests found
- Scanner failed to run — not a clean result

## Changes since last survey

- 11 commits — 11 feature/other, 0 fixes

## By area

- lib/simplecov — 4 commits
- html_frontend/bun.lock — 2 commits
- (root) — 1 commit
- .github/dependabot.yml — 1 commit
- .github/workflows — 1 commit
- benchmarks/collate — 1 commit
- spec/combine — 1 commit

## Notable commits

- change: Add a benchmark for collation
- change: Add mixed-form merge specs for the tuple combiners
- change: Add the html_frontend bun ecosystem to Dependabot
- change: Bump ruby/setup-ruby from 1.320.0 to 1.321.0
- change: Extract shared identity interning into Combine::IdentityInterner
- change: Make the HTML report a single self-contained index.html
- change: Update esbuild to 0.28.1
- change: Update typescript to 7.0.2
- change: bundle update
- change: perf: intern merge identities to Integers
- change: perf: memoise merge identities and reuse combiner tables

## Architecture

- Containers 0 added · 0 removed · contexts 0 added · 1 removed · edges 0 added · 0 removed

## Removed bounded contexts (1)

- simplecov