Skip to content

docs: re-score Store ArchitectureScorecard + reconcile backlog - #229

Merged
ivanball merged 1 commit into
mainfrom
docs/scorecard-20261001
Oct 1, 2026
Merged

ivanball merged 1 commit into
mainfrom
docs/scorecard-20261001

Conversation

@ivanball

@ivanball ivanball commented Oct 1, 2026

Copy link
Copy Markdown
Owner

Re-scores the MMCA.Store architecture scorecard at MMCA.Common v1.217.0 (Store HEAD 579e395b) and reconciles the backlog on both axes.

Before After
Maturity 98.4% (311/316) 97.5% (308/316)
Implementation 84.2% (665/790) 83.4% (659/790)

Score changes (user-adjudicated):

  • s1 SOLID: M4/I9 -> M4/I8. Four classes are at or above the rubric's 8+ constructor-dependency red flag; the accepted ceilings cap the row, so s1 leaves the Resolved table.
  • s10 Messaging: M4/I8 -> M3/I8. The broker error queue has no alert, runbook or replay path, the same gap that holds ADC at M3.
  • s11 Security: M4/I8 -> M4/I7. Identity's customer gRPC edge is anonymous and returns PII. Other red flags: a shared db_owner identity, Manage-rights SAS rules, and the Stripe signing secret written to stderr and cached in plaintext in Redis.

Backlog: new s10 and s11 items plus a [C->A] TD for the gRPC edge; the threat model is recorded as not maintained, by decision. The implementation band is 21 categories / 52 points; the maturity band is 3 categories / 8 points. Line references across both pages are re-pointed to the current deploy.yml, main.bicep and source files.

Verified: pwsh Tools/Scripts/scorecard-indices.ps1 -Repo store exits 0 (indices, Weighted cells and band rows all match). Site re-rendered with npm run build: 0 dead links.

🤖 Generated with Claude Code

https://claude.ai/code/session_012sDGvYdTD88ZjjD7if2SMW

Store re-score at v1.217.0, HEAD 579e395b: maturity 98.4% -> 97.5%,
implementation 84.2% -> 83.4%.

- s1 SOLID M4/I9 -> M4/I8: four classes at or above the 8+ constructor
  dependency red flag; the accepted ceilings cap the row (leaves Resolved)
- s10 Messaging M4/I8 -> M3/I8: no alert, runbook or replay path for the
  broker error queue (ADC parity)
- s11 Security M4/I8 -> M4/I7: anonymous Identity customer gRPC edge returns
  PII; shared db_owner identity, Manage-rights SAS rules, Stripe signing
  secret in stderr and plaintext Redis
- New backlog items: s10 error-queue procedure, s11 hardening, s11 [C->A] TD
  for the gRPC edge; threat model recorded as not maintained by decision
- deploy.yml, main.bicep and source anchors re-pointed to HEAD

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012sDGvYdTD88ZjjD7if2SMW
@ivanball
ivanball merged commit 14e4967 into main Oct 1, 2026
4 checks passed
@ivanball
ivanball deleted the docs/scorecard-20261001 branch October 1, 2026 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant