Architecture governance

MMCA.Common: Architecture Scorecard

Canonical, version-controlled scorecard for this repo: the single source of truth for MMCA.Common's architecture scores (replaces the former single-axis snapshot; see git history). Scored against the rubric at ArchitectureEvaluationCriteria.md; framework-wide facts (version, packages, ADR range, fitness counts) live in FACTS.md. The cross-repo Common-vs-ADC-vs-Store narrative lives once in the workspace-internal Docs/Architecture/CrossRepoComparison.md (not published).

Rubric: ArchitectureEvaluationCriteria.md • Rubric version 2 (rebased 2026-09-04, ADR-110: §10 is Messaging & Integration Architecture at weight 3, scored fresh against the v2 criteria for the first time this cycle; §16 is AI-Native Application Architecture, N/A; Σweight 81→80) • Date: 2026-09-04 (thirty-second wave: full 34-category, two-pass evidence re-score at framework v1.185.0, git HEAD 7018a48, clean working tree; seventeen published packages and 124 fitness methods across 47 bases (Common itself runs 197) per FACTS.md, ADR set 001-110 per the ADR index) • Two scores move, both on the Implementation axis and in opposite directions. §31 Cost Efficiency / FinOps Implementation 7→8 on new in-tree substance shipped since the prior wave: the default-ON Telemetry:FilterProbeTelemetry knob wires ProbeTelemetryFilter into both the ASP.NET Core and HttpClient tracing instrumentation (Aspire/Extensions.cs:224), and a ProbeTelemetryFilterProcessor registered before the exporters un-records the probe-child dependency spans the inbound filter cannot reach, the health check's SQL SELECT 1 and the Redis PING (Extensions.cs:248, Aspire/Telemetry/ProbeTelemetryFilterProcessor.cs:20); it is covered by 27 CI-gated tests in MMCA.Common.Aspire.Tests (MMCA.Common.slnx:46) and shipped in v1.182.0, the release the CHANGELOG titles "Cost release" (CHANGELOG.md:136), with v1.181.0 first making the Telemetry:DisableHttpClientMetrics and DisableRuntimeMetrics toggles actually hold under UseAzureMonitor() by registering MetricStreamConfiguration.Drop views (CHANGELOG.md:187). That falsifies the "byte-identical evidence, newest §31 artifact is the v1.118.0 knob pair" ground of the four prior refutations. Held at 8, not 9, and Maturity stays 2: right-sizing and reversible scale-events are still consumer-side actions the framework only recommends (common-COST.md:69), cost attribution and budgets exist only as compile-only sample IaC (samples/deployment/main.bicep:166), and Tests/Architecture still returns zero cost/budget/FinOps matches. §7 Microservices Readiness Implementation 9→8, a rubric-change deduction rather than the band recalibration eight prior cycles declined: rubric v2 added the criterion "Modernization patterns named: an Anti-Corruption Layer wraps any legacy or third-party model at the boundary, and extracting a module ... follows the Strangler Fig route" (ArchitectureEvaluationCriteria.md:263, added by ADR-110:55), and neither term appears anywhere in MMCA.Common source, docs, or any ADR. The ACL exists unnamed as an enforced convention (the hand-written adapter that implements the C# interface contract and delegates to the typed gRPC client, Grpc/DependencyInjection.cs:58), and ADR-008 documents a cutover ("Delete the combined MMCA.ADC.WebAPI host", 008-service-extraction-topology.md:33), not the strangler route. The other seven §7 criteria are met at high quality, so the row sits at the top of the Strong band, and Maturity 4 is untouched because the extraction boundary is a live merge gate (Rules/Layering/ArchitectureRules.Transport.cs:19, Bases/Layering/MicroserviceExtractionTestsBase.cs:13, MicroserviceExtractionTests.cs:11, MMCA.Common.slnx:52, ci.yml:144). Four first-pass lifts came back FLAG and are held at prior by merged-prior policy (in every case the prior is also what the fresh evidence supports): §12 8→9 (load/stress and evidence-based capacity are structurally deferred to consumers, backpressure is only broker defaults, nothing new since 2026-07-24); §13 8→9 (main.bicep:155 still comments "SLO alerting" while :156 declares only a Microsoft.Insights/actionGroups resource, no metricAlerts, and the only runbook remains the restore drill); §17 3/8→4/9 (no §17 evidence changed: the validate job is compile-only and is not one of the required contexts, and main.bicep:143 still binds secretRef: 'sql-conn' with no secrets: array); §30 3/8→4/9 (zero §30 substance between v1.179.0 and HEAD, every privacy-path diff a rename, and no PII/privacy/DSAR entry across the v1.180-v1.185 CHANGELOG: the eighth consecutive refusal by the ledger's own count). §10 Messaging & Integration Architecture is scored fresh under its v2 name for the first time and comes back CONFIRMED at M4/I9, so the "carried at prior scores pending re-score" caveat retires: broker topology by ADR with BrokerEventBus writing to the outbox and BrokerMessageBus publishing to RabbitMQ or Azure Service Bus, exponential UseMessageRetry over second-level delayed redelivery (Infrastructure/DependencyInjection.cs:961,957), fault-consumer plus dead-letter retention and ReplayDeadLettersAsync, an EF inbox staged in the handler's own transaction, upcasting contract evolution under ADR-090 with fitness-enforced versioning, and ADR-086's documented saga deferral with the ADR-054 choreography alternative. Anchor corrections: §7's two fitness files moved into Rules/Layering/ and Bases/Layering/, MicroserviceExtractionTests.cs declares at :11 not :10, and the inbox idempotency check is Infrastructure/Messaging/Consumers/IntegrationEventConsumer.cs:54, not Infrastructure/Services/IntegrationEventConsumer.cs:42; §31's row cited a COST.md that no longer exists in MMCA.Common and now cites common-COST.md; §13's SLO-alerting anchor is main.bicep:155 (the comment) against :156 (the action group). Indices: Maturity 97.5% (312/320, unchanged) and Implementation 86.3% (690/800, from 86.4%: +2 for §31 on weight 2, −3 for §7 on weight 3). The prior thirty-first-wave header (2026-09-01 at v1.179.0, git HEAD 84116a3, clean tree: no score moves, eight first-pass lifts refuted and held at prior) is condensed here and recorded in the Indices block and git history. Recalibration (2026-08-01): Implementation 10 is awardable for an almost perfect implementation, so the former "attainable ceiling" reporting line is retired and the index reads directly against 100% (denominators unchanged, so the trend line stays comparable). • Two axes per category: Maturity (0-4, process/governance) and Implementation (0-10, substance/execution). Indices computed deterministically from the scores below. Historical wave-by-wave detail lives in the executive summary below and in git history.

Update 2026-06-30 (tenth wave: focused in-repo remediation). Four scores moved up on shipped, tested evidence and both indices rose: Maturity 91.7% → 92.9% (301/324) and Implementation 84.1% → 84.9% (688/810). The moves: §27 i18n Maturity 2→3 / Implementation 6→7 (a ResourceTranslationsAreComplete translation-coverage fitness gate plus MA0076 raised to a build error close the two ADR-027 §7 follow-ups; 33 culture-less formatting sites fixed); §29 Resilience Maturity 3→4 (the in-repo DatabaseRestoreDrillTests is a build gate run on every CI build, now with a recorded measured RTO/RPO baseline in RESILIENCE.md; a build gate, not a non-gating scheduled cron, is the M4 bar); §28 Front-End Testing Implementation 8→9 (a deterministic render-snapshot regression tier, MarkupSnapshot + PrimitivesSnapshotTests, shipped in Testing.UI for reuse); §21 Accessibility Implementation 8→9 (axe coverage broadened to the loading/error states plus a documented manual screen-reader pass in ACCESSIBILITY.md, which also found and fixed a real WCAG 4.1.2 defect in PageLoadingState). One honest finding logged but not gated: a dark-mode palette contrast gap (filled-primary button label + error-alert text), tracked under §20. Fitness counts advanced to 72 methods / 19 bases (Common runs 39) per the regenerated FACTS.md. The dated note above records the prior ninth-wave (v1.92.0) re-score; the figures in the executive summary and closing analysis below predate this wave (the Indices section is authoritative).

Update 2026-06-30 (eleventh wave: ADR governance for two pre-existing mechanisms). No score moves this cycle. A full 34-category evidence re-score at framework v1.93.0 (git HEAD 3e72bfa, working tree dirty, see the caveat below) re-confirmed every category at its tenth-wave value, so the indices hold at Maturity 92.9% (301/324) / Implementation 84.9% (688/810) (the Indices section remains authoritative). The wave is governance and docs only: two new ADRs record mechanisms that already ship in framework code. ADR-033 (resource-ownership authorization) documents the OwnerOrAdminFilter plus OwnershipHelper axis (a single-resource 403 filter keyed on the customer_id claim, plus an ownership Specification that row-scopes collection queries, with one admin bypass; opt-in per controller, claim-trusting, not ABAC, adopted in MMCA.Store). ADR-034 (generic entity controllers + dynamic query contract) documents the EntityControllerBase / AggregateRootEntityControllerBase generic REST surface and OData-lite query contract (sparse fields, per-type IFilterStrategy filtering, sort, pagination with X-Pagination, the MaxUnboundedResultLimit ceiling, two-path includes). Both enrich evidence (§11, §9/§2/§12, §34) without moving a score: ADR-033 is the resource-ownership criterion §11's Implementation-8 cap named, but it stays ownership-by-claim, opt-in, not-ABAC, and Store-adopted, so §11 correctly holds at Implementation 8. The source-generated, CI-gated FACTS.md advanced to ADR set 001-034 and 72 fitness methods across 19 bases (Common runs 39); this scorecard's prose is synced to match. Honest caveat: the tree is dirty (ADRs 033/034 added; ADRs 015/026/030 plus ADRs/README.md and FACTS.md modified) until this docs pass is committed, the recurring per-cycle §34 hygiene nit, tracked in the backlog.

Update 2026-06-30 (twelfth wave: under-8 Implementation lift, v1.94.0 pending release). Two Implementation scores move up on shipped, tested in-repo evidence; both indices' Implementation axis rises while Maturity holds: Maturity 92.9% (301/324) unchanged, Implementation 84.9% → 85.3% (691/810). The moves: §22 Responsive & Cross-Browser Implementation 7→8, the two execution gaps the prior 7 named are closed with real framework code: grid density options now ship on DataGridListPageBase (DenseGrid + ToggleDensity(), persisted through ListPageState/URL/sessionStorage, unit-tested) and the 48px touch target is generalized from a cart-drawer-only rule into a shared .mmca-touch-target affordance (cart drawer + mobile cards + pager, enforced by a phone-viewport Playwright bounding-box test that passes locally), plus a documented RESPONSIVE.md device/browser matrix; and §27 Internationalization Implementation 7→8: a real pseudo-localization pass ships (PseudoLocalizer transform + an IStringLocalizerFactory decorator activated by a Development-only qps-Ploc culture, inert in production, unit-tested), closing the pseudo-localization gap the prior 7 named. §31 FinOps stays at Implementation 7 by deliberate, documented acceptance (a structural cap, not an open gap): its two unmet criteria (right-sizing and reversible scale-events) are consumer/IaC execution a NuGet library provisions nothing to perform, and per-service cost attribution via Aspire annotations is inert for the hand-written-Bicep consumers (ADC/Store); the in-repo levers (Telemetry:TracesSampleRatio, outbox-log trim, COST.md) are already shipped. Full Common Release build clean, 1685 tests pass; the touch-target + pseudo-loc tests are green. The version is v1.94.0 pending the release tag + consumer sweep (held for review at this writing, so the working tree is dirty against the v1.93.0 tag).

Update 2026-07-02 (thirteenth wave: performance-smoke CI gate + rubric-band recalibration). A full 34-category evidence re-score at framework v1.99.0 (git HEAD 4b83891, working tree dirty, see the caveat below) moves five scores: one maturity up, four implementation recalibrated down to their rubric bands. §12 Performance & Scalability Maturity 3 to 4: the BenchmarkDotNet hot-path harness is now a committed CI gate (a performance-smoke job runs the benchmarks --filter "*" --job Dry on every push/PR, .github/workflows/ci.yml:149), so the §12 hot path (Specification compiled-expression cache + criteria composition) is automatically enforced, meeting the rubric's maturity-4 "enforced automatically (CI), documented, evolved deliberately" bar. Implementation holds at 8 because that CI benchmark is a runs-clean smoke, not a latency-regression gate (ci.yml:145), and load/stress timing data still lives in the consumer apps. §14 Testability 10 to 9, §19 State Management 9 to 8, §26 Front-End Security 9 to 8, §34 Governance & Docs 9 to 8: four recalibrations to the Strong band on the same evidence the prior scores hedged as "just shy of 10". The 53% coverage floor is modest and there is no mutation testing (§14), server-vs-client-state staleness is only partially deliberate (§19), the default static CSP omits script-src/style-src (§26), and the governance docs' own uncommitted-ADR pass keeps traceability momentarily inconsistent with the CI-gated FACTS.md (§34). This is honest calibration to the rubric bands, not regressed work. Net indices: Maturity 92.9% to 93.5% (301 to 303 / 324, +2 from §12), Implementation 85.3% to 84.0% (691 to 680 / 810, minus 11 from the four Implementation recalibrations: §14/§19/§26 each minus 3 on weight 3, §34 minus 2 on weight 2). Implementation stays the weaker axis and the gap widens to ~9.5 points (Maturity up, Implementation recalibrated down); no category is N/A. The source-generated, CI-gated FACTS.md advanced to fourteen packages / ADR set 001-036 / 77 fitness methods across 24 bases (Common runs 39) and this scorecard's prose is synced to match. Honest caveat: the tree is dirty (a docs pass is uncommitted: ADRs 035/036 added and untracked; ADRs 015/023/027/029/030/032/033 + ADRs/README.md + FACTS.md modified), the recurring per-cycle §34 hygiene nit, tracked in the backlog. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-03 (fourteenth wave: clean-tree evidence re-score at v1.101.0). A full 34-category, two-pass evidence re-score (scorer plus adversarial verifier per category) at framework v1.101.0 (git HEAD 5e55be2, working tree clean: the recurring uncommitted-docs-pass caveat is closed this cycle) moves two scores. §24 Forms, Validation & UX Safety Maturity 3 to 4: the shared auth-form convention is enforced automatically in the CI-gated .slnx unit tier (AuthModelValidationTests, 8 facts covering required/email/complexity/password-match, plus RegisterFormTests asserting the per-field ValidationMessage renders on an empty submit with the auth service never invoked), meeting the rubric maturity-4 "enforced automatically by tests/CI" bar, consistent with how §19 holds M4 on the same CI-gated guard tests; the shared FormsConventionTestsBase fitness base remains consumer-scoped (it enumerates Source/Modules/**/*Create.razor, which Common does not contain, and Common has no subclass), so the in-repo enforcement rests on those bUnit/model tests. §14 Testability Implementation 9 to 8: an internal-consistency band recalibration, not regressed work; the row's own stated reasoning (a modest 53% gated coverage floor, no mutation testing) describes the rubric's Strong band (7-8) while 9 sits in Exemplary, so 8 is the number that matches the reasoning. Four further first-pass downgrade proposals were adversarially reviewed and not applied: §25 (Implementation 8 to 7) and §34 (Maturity 4 / Implementation 8 to 3/7) were refuted on evidence, and §7/§9/§13 (each Implementation 9 to 8, a band recalibration) were declined on review, so all five hold at their prior scores; their rows receive evidence corrections only (drifted Aspire/Extensions.cs and Directory.Packages.props line anchors, the extraction rule body relocated to the shared Testing.Architecture package, and one stale §13 hold-reason: the warm-up subsystem HAS been unit-tested since the eighth wave, so the §13 hold at 9 rests solely on deployer-owned SLO alerting/dashboards/runbooks). The stale §34 dirty-tree caveat is removed: ADRs 035/036 and the docs pass are committed, so governance traceability is consistent with the CI-gated FACTS.md again. Net indices: Maturity 93.5% to 94.1% (303 to 305 / 324, +2 from §24), Implementation 84.0% to 83.6% (680 to 677 / 810, minus 3 from §14 on weight 3). Implementation stays the weaker axis (gap ~10.6 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-03 (fifteenth wave: i18n completion train, §27 Maturity 3 to 4 + Implementation 8 to 9). The ADR-027 amendment (Decision 9) closes every stated §27 hold. Maturity 3 to 4: the pseudo-localization pass is no longer a developer diagnostic: PseudoLocalizationE2ETests runs in the REQUIRED chromium ui-e2e job (the gallery host enables qps-Ploc unconditionally as unpackaged test infrastructure) and fails the merge on a missing [!! sentinel (resource round-trip) or horizontal overflow under the ~40% expansion (the rubric's layout-tolerance criterion, previously unevidenced), alongside an en-US leak guard; a second fitness gate (LocalizedTextConventionTestsBase, subclassed in-repo as LocalizedTextConventionTests) fails the build on NEW hard-coded snackbar/title/<PageTitle>/breadcrumb/NavItem literals, so the localized state is machine-enforced end to end, not review-enforced. Implementation 8 to 9: MudBlazor's built-in chrome now localizes (ResxMudLocalizer over MudTranslations.{resx,es.resx}, all 145 built-in keys en + es, DI-resolution-tested), the framework's own UI chrome is fully externalized (NavMenu, auth pages, error/empty/loading states, ReconnectModal, notification pages, the UI.Web SSR Error page: SharedResource grew 22 to 136 keys), the ErrorMessages.Success fragment-concatenation red flag is [Obsolete] (whole-sentence page keys replace it) and the Common.Error.* templates no longer surface raw ex.Message, and NavItem.TitleResource makes module nav menus culture-aware. Held below 10: two locales, no RTL. LocalizationResourceTests also gains a non-vacuous floor (MinimumBaseResources = 3). Net indices: Maturity 94.1% to 94.4% (305 to 306 / 324), Implementation 83.6% to 83.7% (677 to 678 / 810), both +1 on §27's weight 1.

Update 2026-07-06 (sixteenth wave: clean-tree re-score at v1.106.0, one score moves). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.106.0 (git HEAD 6f8b917, one commit past the v1.106.0 tag, working tree clean) moves one score. §14 Testability & Test Strategy Implementation 8 to 9: the specific reason the fourteenth wave recalibrated §14 down to 8 (a "modest 53% gated coverage floor") is resolved. The unit-tier coverage floor was ratcheted 53.0 to 68.3 (.github/workflows/ci.yml:226, commit b75fa8f, measured ~70.3% after the C1-C4 coverage program), and the suite grew from 1586 to 1880 [Fact]/[Theory] across 262 files via a coverage-driven program that found and fixed seven real defects (C-1..C-7, 55f3cab), coverage tracked on meaningful paths rather than as a vanity number, so the top band is now supported. Maturity holds at 4 (CI-gated fitness tests plus the blocking coverage-floor gate plus the zero-discovery min-tests guard); it is held below 10 only by the one remaining Exemplary gap, no mutation testing on the Core tier. All 33 other categories re-confirmed at their prior scores against current source: the defect-fix wave C-1..C-7 (§11 lockout-backoff-overflow clamp, §13 LoggingQueryDecorator query-failure outcome=failed RED-metric parity, the OAuth returnUrl safe-lookup, ChildEntityServiceBase token attach) and ADRs 037 (field-level encryption at rest) plus 038 (supply-chain provenance) are all evidence enrichment in categories already scored 8-9. ADR-037's EncryptedStringConverter is explicitly latent/unadopted, and ADR-038 records the SBOM as "generated, not yet signed or attested", so none moves a score. §34 Governance & Docs holds at M4/I8: the adversarial pass proposed 8 to 7 because the scorecard's own prose was stale against the CI-gated FACTS.md (it self-dated v1.101.0 / ADRs 001-036 while FACTS.md reports v1.106.0 / 001-038), but this refresh cures that staleness (the rewritten scorecard is current at commit time), and the durable Strong-8 cap remains the uncommittable ArchitecturalAnalysis.md in the workspace root. The source-generated, CI-gated FACTS.md is now ADR set 001-038 / 78 fitness methods across 25 bases (Common runs 40) and this scorecard's prose is synced to match. Net indices: Maturity 94.4% (306/324) unchanged, Implementation 83.7% to 84.1% (678 to 681 / 810, +3 from §14 on weight 3). Implementation stays the weaker axis (gap ~10.3 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-09 (seventeenth wave: evidence re-score at v1.108.0, one score recalibrated). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.108.0 (git HEAD 6c3b3bc, working tree clean, one commit ahead of origin: the ADR-012 mixed-endpoint transport amendment awaiting push) moves one score. §21 Accessibility Implementation 9 to 8: a band recalibration on evidence already on the record, not regressed work. The shipped, user-toggleable dark theme (ADR-028) carries two documented, deliberately un-gated WCAG AA contrast failures (the filled-primary button label and the error-alert message text, ACCESSIBILITY.md known limitations), a directly unmet §21 color-and-contrast criterion; the prior 9 parked that gap under §20 while sitting in the rubric's Exemplary band ("all criteria met to a high standard"), which does not hold when a §21 criterion fails in a default-available feature. Alongside the two standing smaller gaps (no automated focus-trap/reading-order assertion, manual pass only; axe breadth scoped to the gallery's representative states), the category recalibrates to the top of Strong. Held at 8 rather than 7 (reviewed): the gaps read as one minor cluster whose contrast half is a single palette-tuning item already tracked as the open §20 backlog entry, and everything else §21 claims is intact (the required chromium axe merge gate over the WCAG 2.1 AA tag set including the loading/error states, semantic landmarks and named controls, the documented manual screen-reader pass, the shipped E2E a11y bases). Maturity holds at 4. Two adversarially-refuted first-pass proposals are recorded, not applied: §8 Implementation 8 to 9 refuted (the rubric's "migrations run in CI/CD" criterion is structurally unmet in-repo: ci.yml has no migration-apply step, and ADR-030's boot-time self-migration is a runtime mechanism, not that gate) and §22 Implementation 8 to 9 refuted (no repo change since the twelfth-wave lift; firefox/webkit remain advisory continue-on-error, so the chromium-only gate stays the standing §22 gap). All 33 other categories re-confirmed at their prior scores against current source. The ADR set grew to 001-039 (ADR-039 live channel push: ephemeral events over the notification hub via ILiveChannelPublisher, plus the ADR-012 mixed-endpoint transport-profile amendment), both evidence enrichment in categories already scored 8-9 with no score move. The source-generated, CI-gated FACTS.md reports 78 fitness methods across 25 bases (Common runs 41) and this scorecard's prose is synced to match. Net indices: Maturity 94.4% (306/324) unchanged, Implementation 84.1% to 83.7% (681 to 678 / 810, minus 3 from §21 on weight 3). Implementation stays the weaker axis (gap ~10.7 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-12 (eighteenth wave: evidence re-score at v1.115.0, three scores move). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.115.0 (git HEAD 37d0a3b, working tree clean, at the release tag) moves three scores, all front-end. §20 Design System Implementation 8→9 and §21 Accessibility Implementation 8→9: the two documented dark-theme WCAG AA contrast failures that capped both categories (filled-primary button label + error-alert message text) are fixed in the palette (MMCATheme.cs:60,73, dark PrimaryContrastText/ErrorContrastText = rgba(0,0,0,0.87)) and locked by a blocking dark-mode axe gate (DarkModeE2ETests in the required chromium ui-e2e job, ci.yml:114); this is exactly the "tune the dark palette and gate the dark-mode axe scan" path back to 9 the seventeenth wave named. §20 stays below 10 on the residual raw-hex/!important in app.css and the Bootstrap-chrome coexistence; §21 stays below 10 on the manual-only focus-trap/reading-order pass. §23 Front-End Performance Maturity 3→4: the front-end performance conventions the thirteenth wave recalibrated to review-enforced are now measured AND automatically enforced: WebVitalsE2ETests asserts LCP/TTFB/CLS budgets on the gallery Login + Components pages inside the same blocking chromium ui-e2e gate (WebVitalsE2ETests.cs:43, ci.yml:114,145), meeting the rubric's maturity-4 "enforced automatically (CI)" bar; Implementation holds at 8 on the retained desktop-grid render-efficiency gap. Five adversarially-refuted first-pass proposals are recorded, not applied: §7 Implementation 9→8 (an unforced band recalibration re-litigating a fourteenth-wave decline), §10 Implementation 8→9 (the three documented hold-reasons still in source), §25 Maturity/Implementation downgrade (every §25 mechanism present on a clean tree), §26 Implementation 8→9 (the CSP script-src/style-src gap is unclosed), and §34 Implementation 8→7 (a transient stale-prose basis this refresh cures) all hold at their prior scores. All 26 other categories re-confirmed at their prior scores. Six capabilities landed since v1.108.0 as evidence enrichment with no band move: ADR-040 authenticated output caching, ADR-041 observability/telemetry, ADR-042 MAUI device-capability abstraction (the fifteenth package MMCA.Common.UI.Maui), ADR-043 mobile deep links + native OAuth callback, ADR-044 native push delivery, ADR-045 managed file storage + avatars, all in categories already scored 8-9 (§18/§6/§8/§11/§30). The source-generated, CI-gated FACTS.md reports 15 packages / ADR set 001-045 / 85 fitness methods across 28 bases (Common runs 46) and this scorecard's rows are synced to match. Net indices: Maturity 94.4% → 95.1% (306 → 308 / 324, +2 from §23 on weight 2), Implementation 83.7% → 84.3% (678 → 683 / 810, +2 from §20 on weight 2, +3 from §21 on weight 3). Implementation stays the weaker axis (gap ~10.8 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-15 (nineteenth wave: evidence re-score at v1.115.0, three table moves, one honest downgrade). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.115.0 (git HEAD c7b3cb9, working tree dirty: an ADR-adding pass is in flight, ADRs 046-048 untracked plus ten modified files including FACTS.md) moves three table scores. §22 Responsive & Cross-Browser Maturity 3→4: firefox was promoted to a required merge gate alongside chromium on 2026-07-12 (ci.yml:112, with continue-on-error now scoped to webkit only, ci.yml:115), exactly the promotion path the prior risk list named for +1 maturity; two real engines now block merges, clearing the chromium-only red flag (Implementation holds at 8: the promotion is an enforcement move, not new responsive execution breadth, and webkit stays advisory). §12 Performance & Scalability Maturity 4→3 (downgrade): the sole basis for the thirteenth-wave M4 was the performance-smoke CI job as automatic enforcement, but that job is a runs-clean smoke (--job Dry, fails only if a benchmarked path throws or no longer compiles, ci.yml:172,193), not a latency-regression gate, so it does not automatically enforce the performance property the rubric's maturity-4 bar requires; convention plus review plus a compile/run smoke is Maturity 3 (Implementation holds at 8; no work was lost, the recalibration rests entirely on the smoke-vs-regression distinction). §23 Front-End Performance Maturity 3→4 applied to the table: the eighteenth-wave prose recorded this move but the table row and the Indices block were never updated (a partial-application inconsistency this refresh cures); the WebVitals budget gate (WebVitalsE2ETests.cs:43, blocking chromium ui-e2e job) is re-confirmed against source. Three adversarially-refuted first-pass proposals are recorded, not applied: §9 Maturity 3→4 (the in-repo OpenAPI drift gate is deliberately consumer-owned, OpenApiEndpointExtensions.cs:12), §25 Maturity 3→4 (NavigationFlow.md has no drift gate and the Routes.razor route-auth wiring has no test; only leaf behaviors are auto-tested), and §33 Implementation 8→9 (the new consumer-source-build cross-repo canary, ci.yml:262, is real progress but advisory (continue-on-error: true) and does not remove the two cited caps: the Aspire AppHost headless hang and Common not being independently runnable). All 28 other categories re-confirmed at their prior scores. ADRs 046-048 (HTTP API versioning, soft-deleted user session revocation, primitive identifier type aliases) land as evidence enrichment in categories already scored 8-9 with no move. The source-generated, CI-gated FACTS.md reports 15 packages / ADR set 001-048 / 85 fitness methods across 28 bases (Common runs 46) and this scorecard's rows are synced to match. Net indices: Maturity 94.4% → 95.1% (306 → 308 / 324: §22 +2, §23 +2, §12 -2), Implementation 84.3% (683/810) unchanged (the prior Indices block read 678/83.7%, stale against its own table rows after the eighteenth-wave §20/§21 lifts; also cured here). Implementation stays the weaker axis (gap ~10.8 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-17 (twentieth wave: evidence re-score at v1.117.0, four scores move). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.117.0 (git HEAD 76d70cf, working tree clean) moves four scores. §25 Navigation & IA Maturity 3→4: the navigation-contract drift gate the prior risk list prescribed now ships and gates merges: NavigationContractTests reflects over every routable MMCA.Common.UI page and asserts set-equality plus auth-posture agreement against the embedded NavigationFlow.md routes table (with a non-vacuous 8-route floor), and the test project sits in MMCA.Common.slnx, so the gate runs in the CI-gated unit tier (NavigationContractTests.cs:29,44, MMCA.Common.slnx:45), meeting the rubric maturity-4 "enforced automatically (CI)" bar and closing the §25 red flag (navigation drifting from the documented per-role design). Implementation holds at 8: the gate is an enforcement move, not new execution breadth, and the "deep-link param typing beyond list-state is still light" cap is unchanged (framework routes are plain string templates with only the sanitized ?returnUrl= query state), the same calibration §22/§23 applied to their own gate promotions. §33 Developer Experience Maturity 3→4 + Implementation 8→9: the consumer-source-build canary (builds MMCA.Helpdesk against the PR's framework source via UseLocalMMCA) was promoted from advisory to a required merge gate on 2026-07-16 (continue-on-error removed and the "Consumer source build (Helpdesk)" context added to branch protection after 9 consecutive green runs, ci.yml:267-268, confirmed live via the branch-protection API), so a framework change that breaks a source-mode consumer now blocks the merge automatically: that clears both the maturity-4 automatic-enforcement bar and the sole cap the nineteenth wave placed on Exemplary implementation. Held below 10 by the residual friction items, now implementation notes only (the Aspire AppHost hangs when launched headless, and Common itself is a library, not independently runnable). §22 Responsive & Cross-Browser Implementation 8→9: webkit was promoted to a required merge gate on 2026-07-16 after 11 consecutive green main runs (ci.yml:112-114, no continue-on-error remains anywhere in the job, confirmed live via the branch-protection API), so all three engines now block merges: this closes the one stated reason the row held at 8 ("webkit remains advisory") and completes the full 3-engine matrix as an enforced, not just exercised, capability. Held below 10: the matrix runs against the backend-less gallery's representative states, and RESPONSIVE.md's device rows remain a documented matrix, not device-lab execution. (Doc drift cured with this refresh: RESPONSIVE.md still listed webkit as advisory.) §13 Observability Implementation 9→8 (band recalibration, no work lost): the row's own text names two of the six §13 criteria as deployer-owned (SLO alerting/dashboards and runbooks), which is the rubric's Strong band ("nearly all criteria met, minor isolated gaps"), not the Exemplary "all criteria met to a high standard" that 9 claims: the same calibration this scorecard already applies to §17 and §29 for structurally identical deferred-to-consumer reasoning. The in-repo substance is re-confirmed and unchanged (warm-up readiness gate wired unconditionally into AddServiceDefaults with 9 unit tests, RED-metric command/query parity, poll-span noise filtering; stale row anchors corrected to Extensions.cs:38,173,188,302-315,344-352). Three first-pass lift proposals were adversarially refuted and are recorded, not applied: §9 Maturity 3→4 (the OpenAPI/contract drift gate is deliberately consumer-owned per OpenApiEndpointExtensions.cs:13, and no §9-specific CI gate exists in-repo, so enforcement stays review/convention), §17 Maturity 3→4 (the new sample-deployment-validate job compile-checks the reference Bicep on every push, ci.yml:311-322, but a real what-if/deploy stays consumer-side by the workflow's own comment, so the CD axis is not automatically enforced in-repo), and §31 Maturity 2→3 / Implementation 7→8 (the proposal re-cited the identical evidence already grounding M2/I7; no new §31 work exists). One recorded candidacy is declined on live branch-protection evidence: §12 stays Maturity 3. The backlog's latency-regression gate shipped 2026-07-16 (the performance-smoke job now runs --job Short --exporters json and build/perfgate fails on committed perf-baseline.json ceiling/ratio violations, ci.yml:174-200), a real qualitative upgrade over the runs-clean smoke, but the job's context is absent from the live required_status_checks list (queried via the branch-protection API; CONTRIBUTING.md:57-62 agrees), so a red perf gate does not block a merge and the rubric's merge-gate bar is unmet; adding the context to branch protection is now the whole path to M4. All 28 other categories re-confirmed at their prior scores. The source-generated, CI-gated FACTS.md reports 15 packages / ADR set 001-048 / 85 fitness methods across 28 bases (Common runs 49) and this scorecard's rows are synced to match (the prior "Common runs 46" fitness-subclass count was stale against FACTS.md). Net indices: Maturity 95.1% → 96.3% (308 → 312 / 324: §25 +2, §33 +2), Implementation 84.3% → 84.6% (683 → 685 / 810: §22 +2, §33 +2, §13 -2). Implementation stays the weaker axis (gap ~11.7 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-21 (twenty-first wave: evidence re-score at v1.121.0, one score moves). Recorded in full in the executive summary below: §12 Performance & Scalability Maturity 3→4 (the Performance gate (BenchmarkDotNet Short + baseline verify) context is present in live required_status_checks on main, 8 required contexts, refuting the twentieth wave's sole stated basis for holding it at 3). Maturity 96.3%→96.9% (312→314/324); Implementation unchanged at 84.6% (685/810). Seven proposed lifts (§4, §9, §11, §19, §20, §26, §29) were refuted on an adversarial second pass and held at prior; the remaining 26 categories re-confirmed with no move. One documentation drift (the CONTRIBUTING.md gate list vs live protection) was routed to the backlog under #34 and fixed the same day (MMCA.Common PR #100).

MMCA.Common is a .NET 10.0 (LangVersion: preview) framework shipped as seventeen NuGet packages per FACTS.md to both nuget.org and GitHub Packages (dual-registry since v1.128.0, ADR-053) (Shared, Domain, Application, Infrastructure, API, Grpc, Gateway, UI, UI.Maui, UI.Web, Aspire, Aspire.Hosting, Testing, Testing.E2E, Testing.UI, Testing.Architecture, plus the MMCA.Common metapackage) (a library/SDK, not a runnable app) that supplies the cross-cutting foundation for modular-monolith applications built on DDD, Clean Architecture, and CQRS. Its substance is dense and consistent: a Result<T> error-flow pattern, soft-delete/audit-stamping aggregate base classes, an auto-discovered IModule system with topological (Kahn) registration, a Scrutor decorator pipeline, EF Core with a database-per-microservice resolver, and an outbox for cross-source consistency, all layered across Core/Presentation/Hosting tiers. The headline finding is that architecture rules are not aspirational here: the dependency rule is enforced twice over (compile-time MSBuild targets in §3 plus NetArchTest fitness functions, now factored into a define-once shared rule library: the 13th package Testing.Architecture: consumed identically by all three repos per ADR-015), and the same governance rigor extends to microservice-extraction boundaries (§7), supply chain (§32, the MassTransit-v8 license pin is a build gate, now also ADR-016), security (§11), and docs (§34's now-sixteen dated ADRs, 001-016). This is a reference-quality governance posture. The ADR set has since grown to twenty-two (001-022), a polyglot-persistence capability (three storage engines behind one entity model) ships as tested framework plumbing (ADR-018), v1.80.0 adds an opt-in permission-based authorization layer plus TimeProvider adoption (fourth wave), and v1.81.0-v1.82.0 add an opt-in Scalar OpenAPI UI, a FinOps COST.md, an RS256 pin on the JWKS-forwarded auth path, and three newly-committed ADRs (020-022) that clear the prior cycle's governance nits (see the fifth wave below).

This re-verification (2026-06-20) found the prior report materially stale. A remediation wave landed on 2026-06-19/06-20 (sixteen commits between v1.68.0 and v1.72.0) that closes four of the previously-flagged top risks, each verified against source: (1) event-schema versioning now exists: BaseIntegrationEvent.SchemaVersion => 1 (ADR-010) plus an EventVersioningConventionTests fitness gate, removing the §6 cross-service contract-break risk; (2) OpenAPI generation now ships: AddCommonOpenApi()/MapCommonOpenApi() over the built-in Microsoft.AspNetCore.OpenApi 10.0.8, removing the §9 "undocumented specs" red flag; (3) the CI coverage gate is now enforced: ci.yml fails the build below a 53% line-coverage floor (was report-only), closing the last §14 gap; (4) the chaos/fault-injection test is now real: ResilienceCircuitBreakerFaultInjectionTests trips a breaker and asserts short-circuiting (was prose-only TODO), lifting §29. Two further hardening moves landed: the CycloneDX SBOM step is now a blocking release gate (was continue-on-error), and the ADR set grew 9→11 (ADR-010 event versioning, ADR-011 single-locale i18n), each with a matching fitness function.

A second wave landed 2026-06-21/06-22 (v1.73.0→v1.76.0), folded into this re-verification. It is governance-and-consolidation rather than score-moving substance, so the scores below are unchanged, but it reinforces the already-high §14/§15/§32/§34 ratings: (1) the architecture fitness functions were extracted into a define-once shared package: MMCA.Common.Testing.Architecture (the 13th package, v1.73.0) holding one IArchitectureMap-parameterized NetArchTest rule library + abstract test bases, so Common, ADC, and Store now run literally the same rules (ADR-015) instead of parallel copies; (2) shared cross-cutting infrastructure was promoted up into Common (v1.74.0, drift-reduction P4); (3) the ADR set grew 11→16: ADR-012 (gRPC-host transport), ADR-013 (Result pattern), ADR-014 (CQRS decorator pipeline), ADR-015 (architecture fitness functions), ADR-016 (lockstep versioning + MassTransit-v8 pin): documenting patterns that previously lived only in code; v1.76.0 itself was a docs-only release. The consumer apps were swept to v1.76.0 in lockstep (and have since moved with the framework to v1.79.0: see the third wave below), so the framework and both consumers remain fully converged with no version lead.

A third wave landed 2026-06-23/06-24 (v1.77.0→v1.79.0), folded into this re-verification. It adds one capability and several governance refinements: (1) polyglot persistence (ADR-018, v1.79.0): three storage engines (SQL Server / Cosmos / SQLite) behind one entity model, selected per entity by a [UseDataSource] attribute on an engine shim base (EntityTypeConfigurationSQLServer/Cosmos/Sqlite over the engine-aware EntityTypeConfiguration<TEntity,TId>), with WithSQLServerDataSource/WithCosmosDataSource/WithSqliteDataSource AppHost helpers (Aspire.Hosting/Extensions.cs:132/166/198), a CrossSourceSpecification.BuildAsync helper for engine-portable cross-source filters, and a new opt-in SpecificationsDoNotNavigateToOtherEntities fitness rule (ArchitectureRules.Specifications.cs:24) that fails the build on a latent cross-engine navigation hazard. The plumbing is complete, unit/integration-tested, and shipped, but no production entity routes to a non-SQL engine yet (ADR-018 records the capability as deliberately latent, even ADC's Conference Session→Cosmos / Room→SQLite trial was built, tested, then reverted to all-SQL-Server with the extension points kept). (2) ADR-017 (request idempotency) now formally documents the long-standing [Idempotent] HTTP-edge filter (Source/Presentation/MMCA.Common.API/Idempotency/, present since v1.14.0: Idempotency-Key header → distributed-cache replay with X-Idempotent-Replay, per-key SemaphoreSlim double-check), the inbound counterpart to ADR-003's consumer idempotency. (3) Supply-chain governance deepened: a committed .github/dependabot.yml adds weekly NuGet/Actions update PRs with semver-major ignores for the held packages (MassTransit, VS.Threading.Analyzers, StackExchange.Redis, MessagePack), reinforcing the §32 pin discipline in config (not just the fitness test), plus a sweep of dependencies to latest stable. (4) A 985-line, 9-phase GETTING-STARTED.md adoption guide shipped (worked companion to MMCA.Helpdesk), materially strengthening onboarding (§33). Two minor §34 hygiene regressions accompany the wave: the CHANGELOG skips 1.72-1.78 (jumps 1.79.0 → 1.71.0), and ADR-018 is on disk but uncommitted at review time. Net score effect: §33 rises (M2→M3, I7→I8); all other categories hold, with enriched evidence.

A fourth wave landed 2026-06-25/06-26 (v1.80.0), folded into this re-verification. It is capability-and-governance enrichment that lands in categories already scored 9-10, so no numeric score moves this cycle, but the evidence under §11/§1/§4/§14/§34 is materially enriched, with three honest caveats recorded rather than papered over: (1) permission-based authorization now ships (commit bc6c5d7): IPermissionRegistry + PermissionRegistryBuilder (Shared) declare role→permission grants, [HasPermission("x")] resolves an on-demand perm:x policy via PermissionPolicyProvider, and PermissionAuthorizationHandler checks the caller's roles/claims against the registry; it is opt-in and backward-compatible (the four named role policies are untouched, the mechanism is inert until a host calls AddPermissions(...)), well-factored (immutable FrozenDictionary/FrozenSet registry, additive cross-module grants), and backed by 13 new unit tests. Caveat: this is RBAC with a role→permission capability indirection, not ABAC/resource-based authorization, so it is a real §11 "policy-based" win but should not be over-credited as resource-based. (2) TimeProvider is now injected into TokenService (iat/nbf/exp), the notification read handlers, and UserNotification.MarkAsRead(DateTime readOnUtc) (which now takes an explicit UTC timestamp, keeping that aggregate free of ambient clock): a genuine §14-testability/§1-DIP improvement. The one remaining domain DateTime.UtcNow: BaseDomainEvent.DateOccurred: was reviewed 2026-06-26 and accepted as a deliberate choice (occurrence-time = when the aggregate raises the event is the correct event-sourcing/audit semantic, enforced by four domain tests; relocating it to the persistence boundary regresses the semantic), and is now documented as such in BaseDomainEvent's <remarks> rather than treated as a defect. (3) ADR-019 (rate-limiting) now documents the authenticated-only global limiter: the limiter itself is pre-existing code (shipped 2026-06-12, commit 285a169), already scored under §11; v1.80.0 added only the ADR. Post-review hardening (2026-06-26): the limiter's load-bearing partition/exemption logic is now unit-tested (RateLimitPartitionTests), and the two notification handler tests now assert the stamped read-time against a fixed TimeProvider: closing the two test-coverage caveats above. Governance is mixed: ADRs 017/018 are now committed (a real fix), but ADR-019 + the README/CLAUDE index edits are uncommitted, the CHANGELOG still skips 1.72-1.78 and now also lacks a 1.80.0 entry (empty [Unreleased]), and the framework's own scorecard/backlog were not yet refreshed for this wave. (All since resolved in the v1.81.0/v1.82.0 governance pass: CHANGELOG completed, ADRs committed, and this scorecard migrated in-repo as the canonical two-axis evaluation; see the fifth wave.)

A fifth wave landed 2026-06-26 (v1.81.0→v1.82.0, HEAD 0dcac4d, clean tree at the v1.82.0 tag). Like the fourth, it lands in categories already scored 9-10, so no numeric score moves, but it converts three previously-anticipated or working-tree items into shipped, committed fact and clears the prior cycle's §34 governance nits: (1) the Scalar OpenAPI UI helper is now released (v1.81.0, not "committed-but-unreleased"): MapCommonScalarUi() renders /scalar/{doc} from the generated document, non-Production only, via the bundled Scalar.AspNetCore 2.16.6 (no CDN), so §9's interactive-UI gap is closed in a tagged release; (2) COST.md (FinOps notes, §31) is released (v1.81.0), documenting the framework's cost levers (telemetry-span filtering, outbox poll/retention tuning) and the right-sizing/attribution/surge-revert defaults consumers set; (3) RS256 is now pinned on the JWKS-forwarded auth path (v1.82.0, §11/§26): ValidAlgorithms = [RsaSha256] on the forwarded-JWT (JWKS-discovery) validation path in MMCA.Common.API, defense-in-depth against an algorithm-confusion swap, matching the pre-existing in-process pin; (4) ADRs 020-022 are added and committed: 020 (permission-based authorization, documenting the v1.80.0 layer), 021 (consumer-inbox idempotency, documenting the pre-existing EfInboxStore), 022 (browser session-cookie auth, documenting the SSR BFF token-storage scheme), bringing the tracked set to 001-022; (5) the §34 hygiene nits are resolved: ADR-019 is committed, the CHANGELOG is complete (1.69.0→1.82.0, no gaps), and the working tree is clean. Two test-hardening and one stability item also landed: the rate-limiter partition/exemption logic and the notification read-time clock are now unit-tested (§14), and the E2E register/login success-detection got a grace window to de-flake it (R11, §28). (The prior cycle's minor README.md:42 stale "001-016" parenthetical has since been corrected to 001-022.)

A sixth, governance-focused pass is in flight at this re-score (uncommitted working tree) and is the immediate basis for this re-verification. It moves no score (every change lands in a category already at 9-10) but adds durable governance substance: (1) FACTS.md is now generated from source by a dependency-free build/facts tool and gated in CI (ci.yml:27-28 runs dotnet run --project build/facts -- . --check), so the framework-wide facts (version, package count, ADR range, fitness-method/base counts) can no longer drift from source: a fitness function for the docs themselves (§34/§16). (2) The rubric (ArchitectureEvaluationCriteria.md) and FACTS.md are now version-controlled in this repo (previously workspace-only), completing the §34 governance pattern already applied to the ADRs and this scorecard. (3) Security-response headers were centralized into one pluggable middleware in MMCA.Common.Aspire.Security (AddCommonSecurityHeaders + ICspPolicyProvider + SecurityHeadersMiddleware, unit-tested), removing the per-host drift the previously hand-rolled headers allowed, and documented in the new ADR-023 (bringing the set to 001-023, §11/§26/§34). The one honest caveat: the tree is dirty and the CHANGELOG [Unreleased] does not yet carry ADR-023, so traceability is momentarily inconsistent until this pass is committed.

A seventh wave landed 2026-06-26/06-27 (v1.83.0→v1.84.0, HEAD b2b0aae), folded into this re-verification, and it moves one score. (1) The sixth-pass governance items are now committed and tagged: v1.83.0 (b9a6a28) shipped ADR-023 (security-response headers), the source-generated CI-drift-gated FACTS.md, and this two-axis scorecard, resolving the prior cycle's "ADR-023 uncommitted" §34 caveat. (2) PiiRedactor ships and moves §30 from Implementation 7 to 8 (v1.84.0, b2b0aae): Domain/Privacy/PiiRedactor.cs masks every [Pii]-marked member (shallow, value-erasing) before an entity carrying personal data reaches a structured log or telemetry attribute, with 7 PiiRedactorTests (incl. a "never emits the clear-text PII values" assertion). This closes the §30 red flag the rubric names verbatim ("PII in logs/telemetry"), which the prior cycle recorded as documented-but-missing; §30 maturity holds at 3 because DSAR/export endpoints, consent capture, the personal-data inventory, residency verification, and retention execution remain consumer-owned and PiiConventionTests still passes vacuously in-repo. (3) A warm-up / readiness subsystem ships (Aspire/Warmup/: WarmupHostedService, WarmupReadinessGate, WarmupReadinessHealthCheck, OpenIdConnectMetadataWarmupTask), wired into AddServiceDefaults so every host gates /health/ready on warm-up (gate starts closed, opens even on task failure = availability over warmth, with lazy-retry fallback under ADR-009; the built-in task pre-fetches OIDC discovery to kill ACA cold-start), now documented in ADR-025. It is genuine §29/§13 substance but was scored at v1.84.0 as enrichment, not a lift: it shipped with zero unit tests (since added in the eighth wave below, which lifts §29 Impl 7→8) and the §29-capping recovery gaps (no in-repo restore drill, RTO/RPO, or SLO/error-budget) are unchanged, so at v1.84.0 §29 held 3/7 and §13 holds 4/9. (4) ADR-024 (two-channel notifications) documents the pre-existing SignalR-push + durable UserNotification-inbox extension points (IPushNotificationSender/INotificationRecipientProvider with no-op defaults), enriching §6 evidence with no move. The honest caveat: at this re-score ADR-024/025 are untracked and the CHANGELOG [Unreleased] is empty while the repo is tagged through v1.84.0 (a transient §34 hygiene nit, tracked in the backlog).

An eighth wave (the under-8 Implementation remediation) shipped in v1.85.0 (commit 78e5312, tag v1.85.0) and is verified against source in this re-score. Every category whose Implementation sat below 8 was lifted with shipped, tested in-repo evidence rather than narrative: §5 (a SliceCohesionTestsBase fitness function enforcing slice co-location), §12 (a BenchmarkDotNet smoke harness + the framework page-size guard), §17 (a reference samples/deployment Bicep/OIDC sample + DEPLOYMENT.md), §24 (Register/Login converted to EditForm + DataAnnotations field-level validation), §25 (an in-shell Forbidden 403 page + NavigationFlow.md), §29 (warm-up subsystem unit tests + a RESILIENCE.md SLO/error-budget + restore-drill reference), and §31 (a built-in OTel Telemetry:TracesSampleRatio sampler knob + a per-message log trim). §5/§12/§17/§24/§25/§29 each reach Implementation 8 and §31 reaches 7 (full Release build clean, 1651 tests pass). The wave also moves one maturity score: §5 Vertical Slice 3→4, because its new slice-cohesion fitness function is automatic CI enforcement of the slice convention (the rubric's maturity-4 bar). A separate docs governance pass remains uncommitted at this writing (ADRs 024/025/026 untracked, the FACTS.md ADR-count bump, ADR cross-links, and a ServiceContractAttribute doc-comment correction that stops it claiming a non-existent [ServiceContract] arch test); ADR-026 documents the two-tier caching substrate (the ICacheService memory-or-distributed swap + the HTTP output-cache edge) that §10 already scored.

A ninth wave landed 2026-06-28/29 (v1.86.0→v1.92.0) and is the basis for this re-score, it moves five scores. The headline is internationalization: multi-locale i18n (en-US + Spanish) now ships in the framework itself (ADR-027, superseding the single-locale ADR-011): co-located .resx + IStringLocalizer<T>, backend errors localized at the edge keyed by the existing Error.Code, one culture cookie as the source of truth across SSR/Server/WASM (forwarded to services as Accept-Language), and a per-user PreferredCulture. This flips §27 from N/A to a scored Maturity 2 / Implementation 6 (immature: culture-less date/number formatting is guarded only by an advisory analyzer, with no missing-key/coverage CI gate), and removes the last N/A category, so all 34 categories now count toward the indices. Five further capabilities landed without moving a score, each enriching evidence: ADR-028 day/dark theme (the dark palette is now wired through MudThemeProvider with a ThemeService + a ThemeToggle in the shared layout, §20, where the raw-hex/!important deductions still hold); ADR-029 brute-force protection plus ADR-032 password hashing (PBKDF2-HMAC-SHA512, 32-byte salt, 600k iterations, FixedTimeEquals, with a load-bearing legacy-HMAC verify-and-migrate branch: §11, which still recalibrated to 8); ADR-030 startup sole-migrator (each service self-applies its EF migrations at boot: §8/§17, a runtime mechanism, not the CI migration-apply gate those categories' gaps name); and ADR-031 feature-flag management (Microsoft.FeatureManagement on both the controller [FeatureGate] and CQRS IFeatureGated surfaces: §10). The ADR set grew 026→032 and the source-generated FACTS.md advanced the fitness counts (71 methods across 18 bases, Common's own build executes 38). The honest caveat: ADR-032 is untracked and a docs/source pass (seven ADR edits, FACTS.md, one source edit) is uncommitted at this re-score.

The two axes remain deliberately asymmetric: at the ninth wave Maturity 91.7% vs Implementation 84.1% (current: 97.5% vs 86.3%, see the Indices section), keeping Implementation the weaker axis. Both indices dip slightly this cycle, and the dip is honest re-calibration rather than regressed work: §27 i18n enters both denominators at a low 2/6 (genuinely shipped, but newly so and only advisory-guarded), and §11/§22/§23 were trimmed to better-supported bands on a close re-read (algorithm-confusion defenses and a 3-engine matrix are real, but vault binding, a chromium-only gate, and unmeasured Web Vitals keep them out of the top band). The residual gap is structural rather than a quality defect: the framework consistently ships mature, well-governed mechanisms (ADRs, fitness functions, documented patterns) whose full execution necessarily completes in the consumer apps (ADC/Store). The in-repo half of §17 (a reference Bicep/OIDC sample) and §29 (warm-up tests + an SLO/restore reference) is done; the deeper §17 CD-to-Azure and §29 drilled-restore substance still lives downstream, and Data-migration gating (§8) remains maturity-above-implementation because a verifiable CI migration-apply step lives in the consumer repos (ADR-030's boot-time self-migration is a runtime mechanism, not that gate). Compliance (§30) and FinOps (§31) are the inverse: their in-repo implementation (the PiiRedactor log-masking + IAnonymizable erasure extension point, now gated by PiiErasureContractFitnessTests; the documented cost-lever defaults) leads a maturity that stays capped because the governing process (DSAR/consent capture, the personal-data inventory, residency verification, per-service cost attribution, right-sizing) is consumer-resident.

The practical implication: closing the remaining Implementation gap is mostly about adding evidence and verification of execution inside MMCA.Common itself (the committed OpenAPI baseline-drift check this named for §9 shipped 2026-08-22 in PR #271), an in-repo restore drill + baseline SLOs (§29), a CI migration-apply step against an ephemeral DB (§8), and a smoke-deploy of the reference Bicep/OIDC sample (§17): rather than re-architecting. The freshest gap this cycle is the newly-scored §27 i18n: lifting it toward maturity 4 needs a missing-key/translation-coverage CI gate and a documented locale-addition governance step. There are no longer any N/A categories: §27 Internationalization, previously excluded under the single-locale ADR-011, is now an active scored category after ADR-027 shipped en-US + Spanish in the framework.

A twenty-first-wave re-score ran 2026-07-21 at v1.121.0 (HEAD 4a4fc05, clean tree) and moves exactly one score. §12 Performance & Scalability rises Maturity 3→4. The nineteenth wave dropped it to 3 for lack of a real regression gate, the twentieth wave kept it at 3 on the narrower ground that the shipped gate's job context was absent from live branch protection. That ground no longer holds: main now requires 8 status checks including Performance gate (BenchmarkDotNet Short + baseline verify), and the job carries no continue-on-error (.github/workflows/ci.yml:179,196-204), so a latency or allocation regression against the committed baseline blocks the merge. That is automatic enforcement, the rubric's Maturity-4 bar. Implementation holds at 8 because load and stress timing against realistic volumes still lives in the consumer apps. The cycle's more useful finding is what did not move: first-pass scoring proposed lifts in seven categories (§4, §9, §11, §19, §20, §26, §29) and an adversarial second pass refuted every one against source, each for a concrete reason rather than caution: only Notifications is a bounded context in-repo (§4), the three contract-test bases are subclassed downstream and never in Common's own tests (§9), the sample's Key Vault secret binding is still dangling in the bicep template (§11), and no commit has touched resilience, restore-drill, or warm-up files since the twentieth-wave baseline (§29). One documentation drift was surfaced and routed to the backlog under #34 rather than scored: CONTRIBUTING.md still advertises five required gates and calls webkit advisory, while live protection requires eight including webkit, the Helpdesk consumer-source canary, and the perf gate. Because scorecard adjudications cite that file, its drift can mis-ground a future score, which is precisely what happened to §12 this cycle.

A twenty-second-wave re-score ran 2026-07-23 at v1.123.0 (HEAD c911480, clean tree) and moves nothing: all 34 categories re-confirm at their twenty-first-wave values. The cycle's value is again in what it refused to move. Three first-pass lifts were refuted against source: §9 (Maturity 3→4) because OpenApiContractTestsBase is still subclassed only in consumer hosts, never in Common's own tests, and OpenApiEndpointExtensions.cs:13 records that delegation as deliberate, so no in-repo CI gate enforces the contract; §10 (Implementation 8→9) because the three documented hold-reasons are still in code (the distributed cache path is a no-op without a real IConnectionMultiplexer, DependencyInjection.cs:158; the idempotency semaphore is in-memory, not cross-instance-exclusive; resilience config is partly literal); and §30 (Maturity 3→4) because the only automatic gate, PiiErasureContractFitnessTests, proves the erasure mechanism while the structural [Pii] convention scan stays vacuous in-repo and the governing process (inventory, DSAR, consent, residency, retention) is consumer-resident. Two first-pass downgrades were also refuted: §23 and §24 (each Implementation 8→7) failed on a fresh re-read of every cited file: no regression exists, and §23's web-vitals budget gate is now enforced on all three browser engines (ci.yml:107), stronger than when its 8 was set. The v1.122.0-v1.123.0 train (the typed filter DSL operators, the EntityQueryPipeline page-size clamp, cache-observability warnings, the IIntegrationEventPublisher removal with callers moved to IEventBus) lands as evidence enrichment with no band move. Indices hold at Maturity 96.9% (314/324) / Implementation 84.6% (685/810).

A twenty-third-wave re-score ran 2026-07-25 at v1.128.0 (HEAD 3dff29b, clean tree) and again moves nothing: all 34 categories re-confirm, the third consecutive steady-state cycle at 96.9% / 84.6%. Five first-pass proposals were refuted on the adversarial pass, and two of the refutations sharpen a standing row rather than merely declining it. §17 DevOps (proposed 3/8 → 4/9, held): the maturity-3 hold-reason is unchanged in source (ci.yml:591-592 still records that a real what-if/deploy stays a consumer-side concern), and the verification surfaced that the sample-deployment-validate context is absent from the 8 required status checks on main, so the row's own "blocking" claim was drifted; the row is corrected here to say compile-check-on-pull-request, not merge gate. The genuinely new §17 evidence is real but partial: releases now publish to nuget.org as well as GitHub Packages using NuGet/login OIDC trusted publishing with no stored API key (release.yml:79-88,155-165, ADR-053), which strengthens the secretless-deploy-identity criterion without touching either hold-reason, so it lands as evidence enrichment. §31 FinOps (proposed Maturity 2→3, held): a search for cost, FinOps, and budget across .github and Tests/Architecture returns nothing, so no cost convention is enforced by review or CI, and every cited artifact is byte-identical to the v1.123.0 tree already scored at 2. §30 holds at Maturity 3 (the structural [Pii] scan is still vacuous in-repo), §34 holds at Implementation 8 (Docs/Architecture/ArchitecturalAnalysis.md still lives at the uncommittable workspace root, with no committable replacement anywhere under docs-src/ or MMCA.Common), and the one proposed §23 downgrade fails on a fresh read: WebVitalsE2ETests asserts its LCP/TTFB/CLS budgets inside the unfiltered ui-e2e job with no continue-on-error anywhere. The cycle's real output is documentation hygiene, routed to the backlog under #34: this scorecard's own prose had drifted five minor versions behind the CI-gated FACTS.md (§14's fitness counts read 85/28/49 against an actual 93/30/56, and §16/§34 read ADRs 001-051 against an actual 001-055), all corrected in this refresh.

A twenty-fourth-wave re-score ran 2026-07-28 at v1.131.0 (HEAD 2c52aa9, clean tree) and again moves nothing: all 34 categories re-confirm, the fourth consecutive cycle at 96.9% / 84.6%. Five first-pass proposals were refuted on the adversarial pass, and the shape of the refusals is now the stable signal: every one of them is a criterion the framework cannot close from inside a library. §9 API & Contract (proposed Maturity 3→4, held): the rubric's Maturity-4 bar is automatic enforcement, and neither §9 enforcement mechanism exists in-repo. The OpenAPI contract-drift gate is delegated to consumer integration tiers by the framework's own comment (OpenApiEndpointExtensions.cs:12-14), the shipped OpenApiContractTestsBase has no MMCA.Common subclass, and the [ServiceContract] architecture rule is still absent by its own docstring (ServiceContractAttribute.cs:6-10); the only CI-gated §9 tests are two DI-registration facts for AddCommonApiVersioning (WebApplicationBuilderExtensionsTests.cs:17,29) that assert registration presence, not a contract property. §13 Observability (proposed Implementation 8→9, held): the two criteria that set the twentieth-wave hold (SLO alerting/dashboards, runbooks) are still unmet in-repo, which is the Strong band, not Exemplary. §25 Navigation & IA (proposed 8→9, held): no §25 source changed since the tree scored at 8, and the "parameters typed and validated" half of the route-design criterion is still structurally unexercised. §29 Resilience (proposed 8→9, held): the framework's own guide records restores, RTO/RPO and SLO alerting as executed in the consumer apps' IaC (common-RESILIENCE.md:3,27), and the only new §29 work (health-check tagging plus the readiness-gate fix) is opt-in enrichment of a criterion already partly met. §30 Compliance & Privacy (proposed Maturity 3→4, held for the third consecutive cycle): zero files matching pii/privacy/retention/anonym/consent/erasure/encrypt changed between the twenty-third-wave baseline (3dff29b) and this HEAD, so the proposal re-cited the identical evidence that already grounds Maturity 3. The cycle's real output is again documentation hygiene, routed to the backlog under #34: this scorecard's prose had drifted three minor versions behind the CI-gated FACTS.md (§14's fitness counts read 93/30/56 against an actual 96/31/61, and §16/§34 read ADRs 001-055 against an actual 001-060), and six evidence anchors had drifted with the code (§9's AddCommonOpenApi and header-versioning anchors, §13's AddWarmupReadiness call site, and §17's sample-deployment-validate comment and step lines), all corrected in this refresh. One deliberate choice was recorded rather than scored: the consumers skipped v1.128.0 through v1.130.0 and swept 1.127.0 straight to 1.131.0 in one pass (CHANGELOG.md:9-15), which is ADR-016 lockstep behavior, not three missed sweeps.

A twenty-fifth-wave re-score ran 2026-08-01 at v1.135.0 (HEAD f292233, clean tree) and moves one score, ending the four-cycle steady state: §10 Cross-Cutting Concerns Implementation 8→9. The move rests on new shipped evidence, not recalibration: the idempotency guard's cross-instance-exclusivity hold-reason (recorded verbatim since the twenty-second wave) is closed in source. IdempotencyFilter now resolves an IDistributedLock and falls back to the striped per-process semaphore only when a host registers none (IdempotencyFilter.cs:31-34,109,161-164), and AddCaching registers RedisDistributedLock (SET NX PX acquire + compare-and-delete Lua release, real cross-replica mutual exclusion, Infrastructure/DependencyInjection.cs:181-195, Concurrency/RedisDistributedLock.cs:36) whenever an IConnectionMultiplexer is present; the filter's distributed-lock path is unit-covered and ADR-017 is revised to document the guard. Held at 9, not 10: prefix eviction stays TTL-only with no multiplexer, HttpResilienceDefaults values are compile-time constants, and the Redis lock is mock-tested only. Four first-pass proposals were adversarially refuted and held at prior. §2 Design Patterns (I9→10): the four cited files are byte-identical to the baseline that scored 9, and a rubric-named §2 red flag is live in shipped code (ServiceExceptionHelper.ThrowIfDomainExceptionAsync re-throws API error payloads as DomainInvariantViolationException from three shipped UI service bases, and pages type-sniff that exception to pick the user-facing message: documented and deliberate under ADR-027's rationale, but exceptions-as-control-flow where Result<T> is the framework's own convention is not trivial polish). §15 Best Practices (I9→10): the NoWarn surface grew rather than shrank (S8970 added 2026-07-28) and three §15-tagged backlog items are open, two re-verified live in source (CD-1's silently dropped where/orderBy on GetAllForLookupAsync, CD-2's untranslatable lookup ToString()); the one hold-reason that did close (the dated NuGetAuditSuppress, removed 2026-07-20, accepted-advisory list now empty) supports 9, not 10. §17 DevOps (3/8→4/9): no §17 source changed since the v1.128.0 tree already scored 3/8, the Bicep job is compile-only and absent from the 8 required contexts (verified live via the branch-protection API), and the verification surfaced a new defect in the reference IaC: samples/deployment/main.bicep:143 binds secretRef: 'sql-conn' but the template declares no secrets array anywhere, so the sample would be rejected at deploy time and az bicep build does not catch it (routed to the backlog under #17). §31 FinOps (I7→8): refuted a third time on byte-identical evidence (the newest §31 artifact remains the v1.118.0 metric-family knob pair); the documented acceptance cap stands. A scoring recalibration also lands this cycle (2026-08-01): Implementation 10 is awardable for an almost perfect implementation (every criterion at reference quality, no red flags, at most trivial polish left), so the "attainable ceiling" reporting line is retired and the implementation index reads directly against 100%; the denominators stay ×4/×10, so the trend line is unbroken, and the backlog's scheduling target stays 9 (the 9→10 rung is recognition at re-score time, not scheduled work). Doc hygiene corrected in this refresh: the §1/§2 Result.cs anchors had drifted (Match/Map/BindAsync now at :165/:181/:194), §2's decorator-registration anchor is :88-102, §15's row cited the removed NuGetAuditSuppress and a stale analyzer-ItemGroup anchor (now Directory.Build.props:63-84), and the §16/§34 ADR range read 001-060 against an actual 001-064 (ADR-061 runtime secret management through ADR-064 deploy recency gates, added in the 2026-08-01 ADR audit). The FR-1..FR-7 deferral ledger was not individually re-verified this cycle and stays open as recorded. Both consumers are pinned to 1.135.0 (MMCA.ADC/Directory.Packages.props:127, MMCA.Store/Directory.Packages.props:8). Net indices: Maturity 96.9% (314/324) unchanged, Implementation 84.6% → 84.8% (685 → 687/810, +2 from §10 on weight 2). Implementation stays the weaker axis (gap ~12.1 points); no category is N/A. The Indices section below is authoritative.

A twenty-sixth-wave re-score ran 2026-08-07 at v1.142.0 (HEAD 710d29d, clean tree) and moves nothing: all 34 categories re-confirm at their twenty-fifth-wave values. Seven first-pass lift proposals were adversarially refuted and held at prior, and every refutation rests on evidence read this run rather than caution. §6 CQRS (proposed Implementation 9→10, held): event-schema versioning remains a signal with no mechanism (BaseIntegrationEvent.SchemaVersion defaults to 1 and ADR-010's own trade-off section records the upcaster registration extension point as unbuilt follow-up work; a repo-wide search for upcasters returns only the CHANGELOG and a doc comment), the framework's own event-versioning fitness gate stays vacuous in-repo (Common ships no concrete integration event), and consumer-side idempotency is opt-in and off by default (MessageBusSettings.EnableInbox defaults false, DI registers NoOpInboxStore unless a host opts in); the v1.135.0..HEAD range touches only CachingCommandDecorator, the EfInboxStore duplicate-detach fix, and outbox metrics, none of which closes a hold-reason. §11 Security and §12 Performance (each Implementation 8→9, held): both categories' stated caps are still open in current source and no criterion-closing §11/§12 evidence has landed since the 2026-08-01 re-score. §17 DevOps (proposed 3/8→4/9, refuted for the third consecutive cycle on byte-identical evidence): the Bicep validate job stays compile-only and absent from the required contexts, and the reference template's dangling secretRef: 'sql-conn' binding (backlog #17) is re-verified live at samples/deployment/main.bicep:143. §25 Navigation & IA (proposed Implementation 8→9, held): all ten framework routes are still parameterless string templates (NavigationFlow.md:13-21, zero route parameters or constraints in any MMCA.Common.UI page), the only typed-ish query state remains the sanitized ?returnUrl= (Login.razor:127), OAuthComplete's query parameters are untyped strings, and DeepLinkListener navigates its route strings unsanitized (DeepLinkListener.razor:26,36), so the hold-at-8 reason is literally true in source; the Maturity-4 gate is independently re-confirmed (NavigationContractTests.cs:29,44, in the CI-gated unit tier at MMCA.Common.slnx:46, an anchor drift corrected this refresh). §26 Front-End Security (proposed Implementation 8→9, held): the default static CSP still omits script-src/style-src (Aspire/Security/SecurityHeaders.cs:42-48); no §26 code has landed since 2026-07-05, and the likely new-evidence candidate (BlazorCspPolicyProvider, which does carry both directives) predates both prior refutations of this same lift, so proposing 9 re-litigates the eighteenth- and twenty-first-wave adjudications on byte-identical evidence. §31 FinOps (proposed Maturity 2→3 / Implementation 7→8, held): no §31 artifact has landed since v1.118.0 (2026-07-17); the documented acceptance cap stands (fourth consecutive cycle it survives a proposed lift). The cycle's real output is again documentation hygiene under #34: the governance prose had drifted behind the CI-gated FACTS.md (fitness counts read 96/31/61 against an actual 100 methods across 32 bases, Common runs 78, per FACTS.md:44-48; the §16/§34 ADR range read 001-064 against an actual 001-070), one §25 evidence anchor had drifted (MMCA.Common.slnx:45→:46), and FACTS.md no longer states the ADR range itself: it delegates the count/range to the Website ADR index (FACTS.md:38-41), so ADR-range citations now point at docs-src/adr/README.md. All corrected in this refresh. One live consumer-state note: the framework is at v1.142.0 with MMCA.Store already pinned to 1.142.0 while MMCA.ADC pins 1.141.0 with its bump open as ADC PR #106, an in-flight sweep, not drift. Three stale backlog entries whose categories already score M4/I9 (#18, #20, #32) are closed to the protect list in the companion RemediationBacklog.md reconciliation; no index effect. Net indices: Maturity 96.9% (314/324) and Implementation 84.8% (687/810), both unchanged. Implementation stays the weaker axis (gap ~12.1 points); no category is N/A. The Indices section below is authoritative.

A twenty-seventh-wave re-score ran 2026-08-14 at v1.152.0 (HEAD 3ba8d13, clean tree) and moves nothing: all 34 categories re-confirm at their twenty-sixth-wave values. Nine first-pass lift proposals were adversarially refuted and held at prior, and every refutation rests on evidence read this run. §5 Vertical Slice (proposed Implementation 8→9, held): the one genuinely new §5 fact, the Application/Users/UseCases/{ChangePassword,ChangePreferences,DeleteUser,ExportUserData,GetPreferences} family (landed aa73eff/ad509d3), is real but unenforced: every one of those five handlers is abstract while the slice-cohesion gate scans only concrete classes (RuleHelpers.cs:36), four of the five ship no framework-owned contract at all (the command record is deliberately app-side, ChangePasswordHandlerBase.cs:17-29), and every Users use case emits through the shared UserUseCaseLog switchboard, so the enforced in-repo slicing surface is still the Notifications family plus one validator; the §5 row's prose is refreshed to record the new family honestly. §11 Security, §13 Observability, §25 Navigation & IA, §29 Resilience, §34 Governance (each Implementation 8→9, held): each category's recorded hold-reasons are re-verified live in current source with no criterion-closing evidence since the prior baseline (§25's nine framework routes remain parameterless literal templates; §13's SLO alerting/dashboards and runbooks stay deployer-owned; §29's real backup/restore of a production store and measured SLOs remain in-repo templates; §34's durable cap, the uncommittable ArchitecturalAnalysis.md, is unchanged). §26 Front-End Security (proposed Implementation 8→9, refuted a fourth time on byte-identical evidence): the default static CSP still omits script-src/style-src, and the only §26-adjacent commits since 2026-08-06 are packages.lock.json bumps. §17 DevOps (proposed 3/8→4/9, refuted a fourth consecutive cycle): the only §17 diff since the prior score is five documentation lines in samples/deployment/DEPLOYMENT.md; foundation.bicep, main.bicep, ci.yml and release.yml are byte-identical to the already-adjudicated state, and the dangling secretRef: 'sql-conn' defect is re-verified live at main.bicep:143. §30 Compliance & Privacy (proposed Maturity 3→4, held for the fifth consecutive cycle, on genuinely new evidence this time): real §30 substance shipped 2026-08-13/14 (a DSAR export controller base behind the Privacy.DataExport feature flag, ADR-076; a field-level audit trail that records the redaction token for [Pii] members on both sides of every change, with a 90-day retention purge job, ADR-075), which weakens the old "DSAR endpoints and retention execution are consumer-resident" leg of the M3 rationale, but the new surfaces are opt-in twice over (AuditTrailSettings.Enabled defaults false, the purge runs only if the host also runs the scheduler) and no new automatic category-level gate landed: the only two §30 gates remain the unchanged vacuous convention scan and the single-sample mechanism test, so review-enforced Maturity 3 stands and Implementation 8 is confirmed (consent/lawful basis absent, no PII-inventory artifact, and the CSV export row-scoping hook fail-open by default, EntityControllerBase.cs:488). The cycle's doc hygiene, corrected in this refresh: the §16/§34 ADR range read 001-070 against an actual 001-078 (ADR-071 barcode scanning + QR display through ADR-078 CSV export endpoint, including the 2026-08-14 enterprise wave's ADRs 073-078), and the §5/§30 row prose had drifted behind the new source as described above. One live consumer-state note: both consumers are re-converged on the framework at v1.152.0 (MMCA.Store/Directory.Packages.props:9-10, MMCA.ADC/Directory.Packages.props:96); the twenty-sixth wave's in-flight ADC sweep is closed and lockstep is intact. Net indices: Maturity 96.9% (314/324) and Implementation 84.8% (687/810), both unchanged. Implementation stays the weaker axis (gap ~12.1 points); no category is N/A. The Indices section below is authoritative.

A thirty-second-wave re-score ran 2026-09-04 at v1.185.0 (HEAD 7018a48, clean tree) and moves two scores, both on the Implementation axis and in opposite directions. (The twenty-eighth through thirty-first waves are recorded on the header line above, in the Indices block, and in git history.) §31 Cost Efficiency / FinOps rises Implementation 7→8, the first §31 move since the twelfth wave, on new in-tree substance rather than recalibration: the default-ON Telemetry:FilterProbeTelemetry knob wires ProbeTelemetryFilter into both the ASP.NET Core and HttpClient tracing instrumentation (Aspire/Extensions.cs:224), and a ProbeTelemetryFilterProcessor registered ahead of the exporters un-records the probe-child dependency spans the inbound filter cannot reach, the health check's SQL SELECT 1 and the Redis PING (Extensions.cs:248, Aspire/Telemetry/ProbeTelemetryFilterProcessor.cs:20), with 27 CI-gated tests behind it (MMCA.Common.slnx:46). It shipped in v1.182.0, the release the CHANGELOG titles "Cost release" (CHANGELOG.md:136), after v1.181.0 made the Telemetry:DisableHttpClientMetrics and DisableRuntimeMetrics toggles actually hold under UseAzureMonitor() by registering MetricStreamConfiguration.Drop views (CHANGELOG.md:187), so the "byte-identical evidence since the v1.118.0 knob pair" ground of the four prior refutations no longer holds. The row stops at 8 and Maturity stays 2 for the reasons the acceptance always named: right-sizing and reversible scale-events are consumer-side actions the framework only recommends (common-COST.md:69), cost attribution and budgets exist only as compile-only sample IaC (samples/deployment/main.bicep:166), and Tests/Architecture still returns zero cost/budget/FinOps matches, so no §31 convention is machine-enforced. §7 Microservices Readiness falls Implementation 9→8, and the trigger is a rubric change, not a re-litigation of the band recalibration eight prior cycles declined: rubric v2 added "Modernization patterns named: an Anti-Corruption Layer wraps any legacy or third-party model at the boundary, and extracting a module ... follows the Strangler Fig route" (ArchitectureEvaluationCriteria.md:263, added by ADR-110:55), and neither term appears anywhere in MMCA.Common source, docs, or any ADR. The pattern is practised without being named: the gRPC extension point tells hosts to "register a hand-written adapter that implements the C# interface contract ... and delegates to this typed gRPC client" (Grpc/DependencyInjection.cs:58), which is an Anti-Corruption Layer by construction, while ADR-008 documents a cutover ("Delete the combined MMCA.ADC.WebAPI host", 008-service-extraction-topology.md:33) rather than the new-path-beside-old, traffic-moved, old-path-retired sequence the criterion asks for. One wholly unmet criterion against seven met at high quality is the top of the rubric's Strong band, so the row lands at 8, not lower, and Maturity 4 is untouched: the extraction boundary is enforced automatically, not by review (Rules/Layering/ArchitectureRules.Transport.cs:19 subclassed through Bases/Layering/MicroserviceExtractionTestsBase.cs:13 and MicroserviceExtractionTests.cs:11, in MMCA.Common.slnx:52, run at ci.yml:144 under a required check). The path back to 9 is documentation, not code: name the ACL over the gRPC adapter convention and record the Strangler Fig route in ADR-007/008. §10 Messaging & Integration Architecture is scored fresh under its v2 name for the first time and comes back CONFIRMED at M4/I9, retiring the rubric-v2 rebase caveat that carried it at prior scores: broker topology by ADR, BrokerEventBus writing through the outbox with BrokerMessageBus on RabbitMQ or Azure Service Bus, exponential UseMessageRetry layered over second-level delayed redelivery (Infrastructure/DependencyInjection.cs:961,957), a fault consumer plus dead-letter retention and ReplayDeadLettersAsync, an EF inbox staged in the handler's own transaction, ADR-090 upcasting for contract evolution with fitness-enforced versioning, and ADR-086's documented saga deferral with the ADR-054 choreography alternative as the accepted interim. Four first-pass lifts came back FLAG and are held at prior by merged-prior policy, each on evidence read this run: §12 8→9 (load/stress and evidence-based capacity stay consumer work, backpressure is broker defaults), §13 8→9 (main.bicep:155 comments "SLO alerting" while :156 declares only an action group, no metricAlerts resource), §17 3/8→4/9 (the Bicep validate job is compile-only and not a required context; main.bicep:143 still binds secretRef: 'sql-conn' with no secrets: array), and §30 3/8→4/9 (no §30 substance between v1.179.0 and HEAD, the eighth consecutive refusal). The indices land at Maturity 97.5% (312/320, unchanged) and Implementation 86.3% (690/800, from 86.4%), so Implementation stays the weaker axis, now by 11.2 points.

Scorecard

Weighted column = Maturity·weight / Implementation·weight per row. Axis-gap findings: §17 is mature-but-execution-deferred (mechanism shipped, deeper proof lives downstream); §8 left that group on the thirtieth wave (2026-08-31) when its CI migration-apply gate landed and Implementation reached 9; §13 joined that calibration on the twentieth wave (Implementation 8: alerting/dashboards/runbooks are deployer-owned); §29 closed its maturity gap (the restore drill is now a build gate with a measured baseline) but its Implementation 8 still defers production SLOs downstream; §30/§31 are the inverse (in-repo implementation leads a maturity capped by consumer-owned governance/cost process); §12 left that group this cycle when its perf gate became a required check, and now sits mature-but-execution-deferred like §17/§8 (load and stress timing against realistic volumes is a consumer-app concern). §10 left the under-9 group on the twenty-fifth wave when its distributed idempotency lock shipped. Together these are the structural source of the 97.5% vs 86.2% gap; §9 left the review-enforced group on 2026-08-22 when its two in-repo contract gates landed.

Indices

• Maturity index = Σ(maturity×weight) ÷ Σ(weight×4) = 312 ÷ 320 = 97.5% (unchanged on the thirty-second-wave full re-score, 2026-09-04, at v1.185.0: no maturity value moved, §17 3→4 and §30 3→4 were refuted once more (§30 for the eighth consecutive cycle) and §31 held at 2 because no cost convention is enforced by CI or review anywhere in-repo; rubric v2 rebase, 2026-09-04: §10 carried at M4 but re-weighted 2→3 (+4), §16 N/A removes 4×2 (−8), Σweight 81→80, no score moved; prior figure 316 ÷ 324 = 97.5%, up from 96.9% (314/324) on the targeted 2026-08-22 update: §9 API & Contract Design Maturity 3→4 on weight 2, 314 + 2 = 316, after the in-repo OpenAPI baseline diff and the dedicated [ServiceContract] purity rule landed in MMCA.Common PR #271; re-confirmed on the twenty-eighth-wave full re-score, 2026-08-23, which also refuted a proposed §30 Maturity 3→4; re-confirmed again on the twenty-ninth-wave full re-score, 2026-08-31, which refuted three further maturity proposals: §17 3→4, §30 3→4 for the sixth consecutive cycle, and §31 2→3; re-confirmed once more on the thirtieth-wave full re-score, 2026-08-31, with every maturity value holding; re-confirmed again on the thirty-first-wave full re-score, 2026-09-01, at v1.179.0, which refuted §17 3→4 and §30 3→4 (the seventh consecutive refusal) once more. The prior move was the twenty-first wave's §12 Maturity 3→4: 312 + 2 = 314.)
• Implementation index = Σ(impl×weight) ÷ Σ(weight×10) = 690 ÷ 800 = 86.3% (thirty-second-wave full re-score, 2026-09-04, at v1.185.0: two moves on this axis in opposite directions, §31 Cost Efficiency / FinOps Implementation 7→8 on weight 2 (+2, on the probe-telemetry filter shipped in v1.182.0) and §7 Microservices Readiness Implementation 9→8 on weight 3 (−3, on the rubric-v2 Anti-Corruption-Layer / Strangler-Fig naming criterion), so 691 + 2 − 3 = 690; four further 8→9 lifts (§12, §13, §17, §30) were refuted on the adversarial pass and held at prior, and §10 was scored fresh under its v2 name at the I9 it was already carrying. Prior figure 691 ÷ 800 = 86.4% after the rubric v2 rebase of the same date: §10 carried at I9 but re-weighted 2→3 (+9), §16 N/A removes 8×2 (−16), Σweight 81→80, no score moved; prior figure 698 ÷ 810 = 86.2%, held on the thirty-first-wave re-score, 2026-09-01, at v1.179.0: eight proposals refuted on adversarial re-verification and held at prior, seven 8→9 (§4, §5, §11, §13, §17, §30, §34) and one 9→10 (§8). Up from 84.8% (687/810) on the thirtieth-wave re-score, 2026-08-31: §8, §19 and §26 each Implementation 8→9 on weight 3, §25 8→9 on weight 2, 687 + 11 = 698, all four on work shipped in commit 59d7a97/PR #325 at v1.175.0, landed after the same-day twenty-ninth-wave adjudication of the prior tree; three further 8→9 proposals (§11, §13, §23) were refuted on adversarial re-verification and held at prior. The index had held at 84.8% across the twenty-fifth through twenty-ninth waves, whose adversarial passes refuted twenty-nine lift proposals in aggregate (the twenty-ninth alone refuted eleven); the previous move was the twenty-fifth wave's §10 Implementation 8→9: 685 + 2 = 687.)
• Recalibration (2026-08-01): Implementation 10 is awardable for an almost perfect implementation (every criterion at reference quality, no red flags, at most trivial polish left), so the former "attainable ceiling" reporting line is retired and the index reads directly against 100%. The denominators stay ×4 and ×10, so the raw percentages remain comparable to every prior cycle; the backlog's scheduling target stays 9 (the 9→10 rung is recognition at re-score time, not scheduled work), and Σ implPriority = 30 across 13 categories is the actual scheduled gap ranked in the backlog's implementation band (down from 42 when #8, #19, #25 and #26 left the band on the thirtieth wave; the figure read 31 while the now-retired §16 row still counted, and 29 across twelve live rows going into this cycle; the thirty-second wave adds #7 at implPriority 3 on its 9→8 move and drops #31 from 4 to 2 on its 7→8 lift).
• Weaker axis: Implementation (execution quality), by ~11.2 points
• N/A (excluded from denominators): §16 AI-Native Application Architecture (rubric v2, 2026-09-04: no product feature calls a model; weight 2 leaves both denominators, Σweight 80). §27 Internationalization is scored (ADR-027 superseded the single-locale ADR-011), so 33 categories count
• §32 weight = 3 (raised from the default 2 because MMCA.Common is a published framework)

Top 5 strengths

1. Dual-enforced Clean Architecture dependency rule (compile-time + fitness functions), §3 (impl 9): Source/Build/MMCA.Common.LayerEnforcement.targets:1-90 fails the build on layer violation (BeforeTargets ResolveProjectReferences); LayerDependencyTests.cs:12-58 and DomainPurityTests.cs:13-26 re-enforce Shared→Domain→Application→Infra→API/UI and Domain framework-freedom via NetArchTest. Reinforced by §34 (impl 8).

   • Remediation: Preserve by keeping both gates wired into CI and adding a regression test whenever a new layer/package is introduced; document the targets file in CLAUDE.md. To push the residual point, narrow the broader base-controller/UoW surfaces noted in §1.
   • Expected delta: Preserves +9 impl on §3/§34; protects §16 maintainability from regression.

2. Reference-quality test strategy (define-once fitness functions + an enforced coverage gate) §14 (impl 9): right-shaped pyramid (1880 [Fact]/[Theory] across 262 files) with executable architecture fitness functions (LayerDependency, DomainPurity, MicroserviceExtraction, DependencyVersion, PiiConvention, PiiErasureContract, AggregateConvention, EventVersioningConvention, FrameworkSanity, Specification, SliceCohesion) authored once in the shipped MMCA.Common.Testing.Architecture package (122 methods across 46 abstract bases) and re-run identically across all three repos (ADR-015), a zero-discovery min-tests guard, a shipped reusable E2E package, and a 68.3% line-coverage floor that fails the build (ci.yml:226, ratcheted from 53% by the 2026-07 coverage program, measured ~70.3%).

   • Remediation: Preserve by keeping the floor green and ratcheting it upward over releases; add mutation testing on the Core tier to reach a 10.
   • Expected delta: Holds §14 at impl 9; mutation testing on the Core tier is the remaining path toward 10; protects §28.

3. Supply-chain hardening with a license-pin build gate, a blocking SBOM, and Dependabot held-package guards, §32 (impl 9, weight 3): Directory.Build.props:8-10 (lock files, NuGetAudit, audit=all); Directory.Packages.props:54-56 (MassTransit 8.5.5 pinned with documented v9 commercial-license crash hazard, ADR-016); DependencyVersionTestsBase.cs:24-37 fails the build if any MassTransit package goes major≥9; 24 packages.lock.json; CycloneDX SBOM a hard release gate (release.yml:45-50); and a committed .github/dependabot.yml:24-35 with semver-major ignores on every held package, the pin discipline now lives in config as well as the test.

   • Remediation: Automate the coordinated consumer version sweep (currently policy) to close the one remaining minor gap.
   • Expected delta: Automating the sweep nudges §32 maturity toward fully-exemplary; preserves +9 impl.

4. Centralized, alg-pinned security with shipped anti-automation defenses and PBKDF2 hashing, §11 (impl 8): WebApplicationBuilderExtensions.cs:364,380 pins ValidAlgorithms per RS256/HS256 (defeats alg-confusion) with full issuer/audience/lifetime/signing-key validation, :217 extends the RS256 pin to the JWKS-forwarded path; :34 rate-limit bypass for health/.well-known/grpc; LoginProtectionService.cs:50-56,74-82 adds exponential brute-force lockout + per-IP registration limit (ADR-029); PasswordHasher.cs:9,53 hashes with PBKDF2-HMAC-SHA512 (600k iterations, PBKDF2-only: the legacy-salt verify+migrate branch has been removed, FixedTimeEquals, ADR-032): all returning Result.Failure rather than throwing.

   • Remediation: Keep the CI vulnerable-package gate green; document the deployer's vault/managed-identity binding (the acknowledged gap holding impl at 8) with a reference wiring sample.
   • Expected delta: A documented MI binding sample nudges §11 toward 9 and supports §17/§26.

5. Architecture-test-enforced microservices extraction boundaries + event versioning, §7 (maturity 4, impl 8): ADR-006 (database-per-service), transport-agnostic IMessageBus.cs:28, and the shared Rules/Layering/ArchitectureRules.Transport.cs:19 rule (subclassed through Bases/Layering/MicroserviceExtractionTestsBase.cs:13 in MicroserviceExtractionTests.cs:11, run at ci.yml:144 under a required check) forbidding Application/Domain/Shared→MassTransit and Grpc→Domain/Application/Infrastructure. Reinforced by §6's BaseIntegrationEvent.SchemaVersion (ADR-010) + EventVersioningConventionTests, so cross-service contracts carry an explicit version, and by ADR-090 upcasting for retired contracts. The strength is the enforcement, which is why maturity holds at 4; implementation stepped back to 8 on the thirty-second wave because rubric v2 now asks for the modernization patterns to be named, and neither Anti-Corruption Layer nor Strangler Fig appears anywhere in the repo (ArchitectureEvaluationCriteria.md:263).

   • Remediation: Name the Anti-Corruption Layer over the gRPC adapter convention (Grpc/DependencyInjection.cs:58) and record the Strangler Fig route (new path beside old, traffic moved, old path retired) in ADR-007/008; separately, demonstrate one end-to-end lift-out (the Notifications module) in a sample to convert 'extractable by design' into 'extracted and proven'.
   • Expected delta: +1 impl on §7 (8→9, +3 weighted) once both patterns are named; the enforcement half is already preserved at maturity 4.

Top 5 risks

Note (twenty-first wave, v1.121.0): earlier waves closed risks previously listed here (§29's restore drill, the §27 i18n train, §24 forms enforcement, §22's firefox gate, §23's WebVitals gate, §25's navigation drift gate), and this wave closes another: §12's perf gate is now a required check on main, so the category returns to the protect list and its risk entry is retired. A documentation-drift risk entered in its place and was closed the same day: CONTRIBUTING.md still advertised the pre-promotion gate list, and because scorecard adjudications cite that file, its staleness mis-grounded §12's own score for a full cycle (fixed in MMCA.Common PR #100, 658786b; kept in the list with its resolution for provenance). The remaining deeper execution each risk names (per-service cost attribution, CD-to-Azure, a CI migration-apply step, consumer-side privacy governance) still lives downstream. Note (2026-08-22): risk 2 (§9's missing in-repo contract gate) closed on MMCA.Common PR #271 and is kept in place with its resolution, so the surviving entries are not renumbered.

1. FinOps execution and governance live downstream: §31 (impl 8, maturity 2, the lowest maturity on the board; a documented accepted cap per the backlog's Deliberate / accepted section): the framework ships real cost levers (an OTel Telemetry:TracesSampleRatio sampler knob, the outbox per-message log trimmed to Debug, OutboxPollFilterProcessor, and since v1.182.0 the default-ON probe-telemetry filter plus its span processor, Aspire/Extensions.cs:224,248, that keep health-probe traces and their SQL/Redis children out of ingestion), but right-sizing, reversible scale-events, and per-service cost attribution are consumer/IaC concerns a library cannot perform, and no in-repo process or review enforces cost discipline, so maturity stays at 2 while implementation rose to 8 on the thirty-second wave.

   • Remediation: The in-repo telemetry-cost half is done and now scores 8. What remains is structural: the consumer apps must demonstrate measured right-sizing and per-service cost attribution that the framework's knobs feed, and a cost convention would have to be enforced somewhere (nothing under Tests/Architecture or in any workflow gates cost today).
   • Expected delta: The +1 impl (7→8, +2 weighted) landed this cycle; +1 maturity on §31 (2→3) still needs an enforced cost convention, and 8→9 needs the consumer-side right-sizing and attribution evidence.

2. API contract stability has no in-repo automatic enforcement RESOLVED 2026-08-22 (MMCA.Common PR #271, squash 8a6c603): both halves the entry prescribed shipped in-repo, so §9 rises to Maturity 4 and returns to the protect list. The OpenAPI drift gate now exists at the framework level (OpenApiBaselineTests.cs:45-77 diffs the normalized generated document against the committed openapi-baseline.v1.json, regenerated only through MMCA_UPDATE_OPENAPI_BASELINE=1 in the same pull request) while each consumer host keeps guarding its own concrete surface, and the previously-absent [ServiceContract] rule ships as a dedicated fitness function (ArchitectureRules.Contracts.cs:32 + Bases/ServiceContractPurityTestsBase.cs:24-26, subclassed at ServiceContractPurityTests.cs:11). Recorded here with its resolution for provenance, the same way risk 5 is; the entry as raised read: §9 (impl 9, maturity 3, weight 2) has genuinely strong contract substance (centralized RFC 9457 ProblemDetails mapping, header-based versioning with a backward-compatible v1.0 default, the ADR-034 generic query contract, OpenAPI + Scalar UI helpers), but no §9-specific fitness function or CI job exists in-repo, so contract discipline is enforced by review and convention, the rubric's Maturity-3 band. (§25, which this entry displaced, closed on the NavigationContractTests drift gate.)

   • Remediation: Done, via the first of the two levers the entry named (a minimal in-repo contract-surface fitness check over the framework-owned pieces) rather than the documented-acceptance alternative. Preserve by regenerating the baseline deliberately in the pull request that changes the contract, and by subclassing ServiceContractPurityTestsBase in each consumer so the attribute-driven rule runs where contract types actually live.
   • Expected delta: +2 weighted maturity on §9 (6/18 → 8/18), lifting the Maturity index 314 → 316/324 (96.9% → 97.5%); Implementation holds at 9 (the baseline covers the framework-owned surface only and the purity rule's in-repo run stays a ratchet until a type carries the attribute).

3. Deployment gating verified only downstream (§17 DevOps, impl 8: a reference samples/deployment Bicep/OIDC sample + DEPLOYMENT.md ship and are compile-checked per pull request, though that job is not a required context, and a library cannot self-deploy anyway, so real CD-to-Azure lives in consumers; the v1.128.0 keyless nuget.org publishing path under ADR-053 hardens the release identity but not the deploy axis). and §8 Data (no verifiable CI migration-apply step here) the §8 half RESOLVED 2026-08-31 (commit 59d7a97/PR #325, kept here with its resolution for provenance): the ephemeral-DB migration-apply step this entry's remediation named now exists as a required-gate CI job with outcome assertions (ci.yml:578,597) plus an in-repo DB-free apply proof (MigrationApplyProofTests.cs:92), so §8 rises to Implementation 9 and leaves the backlog's implementation band. §17's mechanism-shipped-execution-downstream shape remains, now the sole member of that group.

   • Remediation: Done for §8, via exactly the CI apply step the entry prescribed. For §17: a smoke-deploy of the samples/deployment sample (raises §17 toward proven-not-just-referenced) and fixing the dangling secretRef: 'sql-conn' binding (backlog #17).
   • Expected delta: The §8 +1 impl landed this cycle (part of 687 → 698); +1 impl on §17 remains available downstream.

4. Compliance governance is consumer-owned; the in-repo guard verifies a mechanism, not the category, §30 (impl 8, maturity 3, weight 2): the headline §30 red flags are closed in-framework (the IAnonymizable erasure extension point, AES-256-GCM at rest, and the shipped+tested PiiRedactor masking [Pii] members before logs/telemetry), and PiiErasureContractFitnessTests now forces a [Pii] type through PiiRedactor + IAnonymizable so the erasure contract is no longer un-gated. But that gate verifies the mechanism rather than gating a repo-wide convention (the structural PiiConventionTests scan is still vacuous (no PII-bearing type lives in Common's Domain), and the governing process) the personal-data inventory, DSAR/export endpoints, consent capture, residency verification, retention execution: is delegated to consumers. Maturity held at 3 (reviewed this cycle): the category as a whole is not automatically enforced.

   • Remediation: The in-repo mechanism is done; further maturity movement needs the consumer apps to carry the personal-data inventory + DSAR/consent/residency process the framework's [Pii]/IAnonymizable extension points feed (documented in ADR-005).
   • Expected delta: +1 maturity on §30 (3→4) is a consumer-side governance lift, not an in-repo one; the framework half is complete.

5. The documented merge-gate list has drifted from live branch protection, and adjudications cite it RESOLVED 2026-07-21, same day it was raised (MMCA.Common PR #100, 658786b): the gate list and the reproduce snippet now name all eight live contexts, verified byte-identical against the protection API, and the file now directs readers to that API as authoritative over the committed copy. Recorded here for provenance; the finding as raised read: (§34 / §16, both impl 8) CONTRIBUTING.md:57-64 lists five required gates and calls webkit advisory, and its reproduce snippet (CONTRIBUTING.md:104-112,124) omits webkit, the Helpdesk consumer-source canary, and the perf gate, while live required_status_checks on main carries all eight contexts (branch-protection API, this run; ci.yml:116-118 already asserts all three browser engines are required). This is the rubric's "stale docs" red flag with a governance edge: the twentieth wave held §12 at Maturity 3 partly on this file's authority, and the score was only corrected a cycle later.

   • Remediation: Done. The gate list and reproduce snippet were synced and the API is now named as authoritative; the backlog item under #34 is closed with the proving reference.
   • Expected delta: no index move, as expected; it protects future scores from being mis-grounded and removes a §16/§34 stale-docs deduction. §34 holds M4/I8 this cycle; the next re-score can weigh the fix on fresh evidence.

Cross-repo comparison

How this repo's quality relates to the other consumers (where the framework's quality propagates, where a repo diverges or under-uses it, and where a consumer does better than the shared baseline) is maintained once, for all three repos, in the workspace-internal Docs/Architecture/CrossRepoComparison.md (not published) (it is inherently cross-repo and would only drift if copied into each scorecard).