# Changelog

## Score

- CAI 45 → 45 (+0.2)
- Rubric changed (rubric-2026.08.18 → rubric-2026.08.19) — scores are not directly comparable.

## Lenses

- Code Health 82 → 76 (-6.4)
- Architecture 48 → 48 (-0.6)
- Maturity 65 → 65 (+0.0)
- Readiness 28 → 30 (+1.5)
- Security 63 → 63 (-0.2)
- Domain Modelling 100 → 100 (+0.0)

## Resolved (4)

- Boundary-crossing change coupling: report.controller.ts ↔ curier.controller.ts (src/accounting/reports/report/controllers/report.controller.ts)
- Change coupling: offer.controller.ts ↔ curier.controller.ts (src/delivery/board/offer/controllers/offer.controller.ts)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Off-boarding risk: anonymized user #1

## New (18)

- Boundary-crossing change coupling: domain-message.ts ↔ relay.service.ts (src/__lib__/domain-message.ts)
- Boundary-crossing change coupling: outbox.mapper.ts ↔ warehouse.entity.ts (src/__relay__/outbox.mapper.ts)
- Change coupling clique: report.controller.ts, offer.controller.ts, curier.controller.ts (src/accounting/reports/report/controllers/report.controller.ts)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- High CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium CVE: [GHSA redacted] (package-lock.json)
- Medium IaC: CKV_DOCKER_3 (Dockerfile)
- Small-team knowledge concentration
- The Tracking supporting subdomain is named but the README contains no description of what it does or how it differs from the Core subdomain. (src/warehouse/tracking/README.md)