# Changelog

## Score

- CAI 44 → 45 (+1.8)

## Lenses

- Code Health 84 → 84 (+0.0)
- Architecture 84 → 84 (+0.0)
- Maturity 58 → 58 (+0.0)
- Readiness 18 → 18 (+0.0)
- Security 59 → 72 (+12.8)
- Event-Driven 100 → 100 (+0.0)

## Resolved (2)

- Bounded contexts not declared
- High CVE: Microsoft.NETCore.App 2.2.0

## New (6)

- High CVE: Microsoft.NETCore.App 2.2.0
- Inconsistent spelling of 'Bearer' in the authentication-related types. 'BaererAuthorizeAttribute' uses a non-standard spelling ('Baerer' instead of 'Bearer').
- Inconsistent spelling of 'Cancelled' vs 'Canceled'. The codebase uses 'Canceled' in 'Pluto.Domain.Models.Order.Canceled', but British spelling 'Cancelled' is often preferred in this codebase (e.g., 'Pluto.Domain.Models.Order.Commited' suggests a mix of errors or variants).
- Inconsistent spelling of 'Committed' and 'Cancelled' in the Order model properties. 'Commited' is a misspelling of 'Committed', and 'Canceled' uses one 'l' while 'Commited' (if intended as committed) or other status properties show spelling variations.
- The README mentions architecture topics like CQRS, Event Sourcing, Domain Events but does not link them or explain how they are implemented in code. (README.md)
- redundant comment (Pluto.API/Controllers/OrderController.cs)

## API surface

- Unchanged — 12 HTTP endpoints

## Architecture

- Unchanged — 2 containers · 1 contexts · 0 edges