# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 68 → 46 (-21.6)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.15) — scores are not directly comparable.

## Lenses

- Code Health 96 → 100 (+3.7)
- Architecture 100 → 69 (-30.6)
- Maturity 54 → 43 (-11.5)
- Readiness 91 → 35 (-56.5)
- Security 65 → 60 (-5.0)

## Resolved (17)

- Change coupling: SleepSystem.scala ↔ WorkStealingThreadPool.scala (core/jvm-native/src/main/scala/cats/effect/unsafe/SleepSystem.scala)
- Coverage not included — suite not readable by the collector
- Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
- FileTooLong: effect/IO.scala (core/shared/src/main/scala/cats/effect/IO.scala)
- FileTooLong: effect/IOFiber.scala (core/shared/src/main/scala/cats/effect/IOFiber.scala)
- FileTooLong: kernel/Resource.scala (kernel/shared/src/main/scala/cats/effect/kernel/Resource.scala)
- FileTooLong: std/Queue.scala (std/shared/src/main/scala/cats/effect/std/Queue.scala)
- FileTooLong: unsafe/WorkerThread.scala (core/jvm-native/src/main/scala/cats/effect/unsafe/WorkerThread.scala)
- Further sole-owners (lower concentration)
- Off-boarding risk: anonymized user #1
- TooManyMethods: IO (core/shared/src/main/scala/cats/effect/IO.scala)
- TooManyMethods: IOFiber (core/shared/src/main/scala/cats/effect/IOFiber.scala)
- TooManyMethods: Poller (core/jvm/src/main/scala/cats/effect/unsafe/SelectorSystem.scala)
- TooManyMethods: Resource (kernel/shared/src/main/scala/cats/effect/kernel/Resource.scala)
- Workflow token permissions not restricted
- complexity unreadable for .java, .scala — churn × complexity hotspots could not be measured
- knowledge concentrated in recent work — freshness signal contradicted by repo activity

## New (8)

- Dimension evaluation failed
- High: security finding (details withheld)
- No artifact signing
- No automated tests
- No tests found
- early-stage repository — too little history to judge knowledge freshness
- single-commit history — no usable git history window to measure hotspots
- single-maintainer — knowledge-concentration (bus factor) risk

## Architecture

- Containers 0 added · 0 removed · contexts 0 added · 1 removed · edges 0 added · 0 removed

## Removed bounded contexts (1)

- .