# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 62 → 52 (-10.4)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 86 → 72 (-14.2)
- Architecture 92 → 91 (-1.2)
- Maturity 79 → 54 (-25.5)
- Readiness 37 → 39 (+1.4)
- Security 84 → 81 (-3.1)
- Accessibility 87 → 61 (-26.2)
- Performance 100 → 100 (+0.0)

## Resolved (17)

- Duplicated block (11 lines × 2) (durable_dashboard/lib/durable_dashboard/live/inputs_live.ex)
- Duplicated block (16–18 lines × 3) (durable_dashboard/lib/durable_dashboard/live/executions_live.ex)
- Duplicated block (5 lines × 2) (durable_dashboard/lib/durable_dashboard/live/overview_live.ex)
- Duplicated block (6 lines × 2) (durable_dashboard/lib/durable_dashboard/live/inputs_live.ex)
- Duplicated block (8 lines × 2) (durable/lib/durable/executor.ex)
- Duplicated block (9 lines × 2) (durable_dashboard/lib/durable_dashboard/components/workflow/children_tab.ex)
- FileTooLong: workflow/flow_graph.ex (durable_dashboard/lib/durable_dashboard/components/workflow/flow_graph.ex)
- High CVE: [GHSA redacted] (durable_dashboard/mix.lock)
- Medium CVE: EEF-[CVE redacted] (durable_dashboard/mix.lock)
- Outdated: bandit
- Outdated: jason
- Outdated: jason
- Outdated: lazy_html
- Outdated: lazy_html
- Outdated: phoenix_live_view
- TooManyFunctions: ExecutionsLive (durable_dashboard/lib/durable_dashboard/live/executions_live.ex)
- Workflow token permissions not restricted

## New (25)

- Duplicated block (10–13 lines × 2) (durable_dashboard/lib/durable_dashboard/graph_builder.ex)
- Duplicated block (13–14 lines × 4) (durable_dashboard/lib/durable_dashboard/live/inputs_live.ex)
- Duplicated block (6 lines × 2) (durable/lib/durable/queue/sampler.ex)
- Duplicated block (6 lines × 3) (durable_dashboard/lib/durable_dashboard/live/schedules_live.ex)
- FileTooLong: data/execution_filters.ex (durable_dashboard/lib/durable_dashboard/components/data/execution_filters.ex)
- FileTooLong: live/executions_live.ex (durable_dashboard/lib/durable_dashboard/live/executions_live.ex)
- FileTooLong: live/inputs_live.ex (durable_dashboard/lib/durable_dashboard/live/inputs_live.ex)
- FileTooLong: live/workflow_live.ex (durable_dashboard/lib/durable_dashboard/live/workflow_live.ex)
- High CVE: [GHSA redacted] (durable_dashboard/assets/pnpm-lock.yaml)
- High CVE: [GHSA redacted] (mix.lock)
- Medium CVE: EEF-[CVE redacted] (mix.lock)
- Medium: security finding (details withheld)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (durable_dashboard/lib/durable_dashboard/live/inputs_live.ex)
- Off the main sequence: durable
- Orphaned file (durable/lib/durable/repo.ex)
- Orphaned file (durable/lib/mix/tasks/durable.install.ex)
- Orphaned files with no living knowledge
- Outdated: crontab
- Outdated: esbuild
- Outdated: lazy_html
- …and 5 more

## Changes since last survey

- 14 commits — 12 feature/other, 2 fixes

## By area

- durable/lib — 4 commits
- durable_dashboard/lib — 2 commits
- examples/phoenix_demo — 2 commits
- (repo) — 1 commit
- (root) — 1 commit
- durable/README.md — 1 commit
- durable_dashboard/assets — 1 commit
- durable_dashboard/priv — 1 commit
- durable_dashboard/test — 1 commit

## Notable commits

- fix: fix(core): stable ids for parallel and branch blocks
- fix: fix: keep a run's first start time; dashboard fixes found by page tests
- change: Merge pull request #11 from wavezync/feat/v1
- change: build(dashboard): rebuild the static bundle
- change: chore(demo): adopt the durable v1 schema and APIs
- change: chore: ignore .DS_Store and move dev Postgres to an 18-style volume
- change: docs(core): workflow options, errors, telemetry and the operator API
- change: feat(core): operator controls, workflow timeouts and run observability
- change: feat(core): schema for operator controls, deadlines and history
- change: feat(core): telemetry events and metrics
- change: feat(dashboard): v1 redesign — pages, design system, tooltips and query bar
- change: feat(dashboard): workflow graph with joins and branch gateways
- change: feat(demo): access resolver, telemetry and LiveDashboard
- change: test(dashboard): page tests for every screen against a real Durable