Architecture governance

MMCA.Common — Architecture Scorecard

Canonical, version-controlled scorecard for this repo — the single source of truth for MMCA.Common's architecture scores (replaces the former single-axis snapshot; see git history). Scored against the rubric at ArchitectureEvaluationCriteria.md; framework-wide facts (version, packages, ADR range, fitness counts) live in FACTS.md. The cross-repo Common-vs-ADC-vs-Store narrative lives once in ../Docs/Architecture/CrossRepoComparison.md.

Rubric: ArchitectureEvaluationCriteria.md • Date: 2026-07-23 (full 34-category, two-pass evidence re-score at framework v1.123.0, git HEAD c911480, clean working tree; fifteen published packages, 91 fitness methods across 30 bases per FACTS.md) • No score moves this cycle: all 34 categories re-confirmed at their twenty-first-wave values against current source. Five first-pass proposals were adversarially refuted and held at prior: three lifts (§9 Maturity 3→4: the contract-drift gate stays deliberately consumer-owned, no in-repo CI enforcement; §10 Implementation 8→9: the three documented hold-reasons are still in source; §30 Maturity 3→4: only the erasure-mechanism gate is automatic, the governing process stays consumer-resident) and two downgrades (§23 and §24, each Implementation 8→7: refuted on a fresh re-read of every cited file, no regression exists). Indices unchanged: Maturity 96.9% (314/324), Implementation 84.6% (685/810). The v1.122.0-v1.123.0 capability train (typed filter DSL operators, the EntityQueryPipeline page-size clamp, cache-observability warnings, the IIntegrationEventPublisher removal with callers moved to IEventBus) lands as evidence enrichment in categories already scored 8-9, with no band move. • Two axes per category: Maturity (0-4, process/governance) and Implementation (0-10, substance/execution). Indices computed deterministically from the scores below. Historical wave-by-wave detail lives in the executive summary below and in git history.

Update 2026-06-30 (tenth wave: focused in-repo remediation). Four scores moved up on shipped, tested evidence and both indices rose: Maturity 91.7% → 92.9% (301/324) and Implementation 84.1% → 84.9% (688/810). The moves: §27 i18n Maturity 2→3 / Implementation 6→7 (a ResourceTranslationsAreComplete translation-coverage fitness gate plus MA0076 raised to a build error close the two ADR-027 §7 follow-ups; 33 culture-less formatting sites fixed); §29 Resilience Maturity 3→4 (the in-repo DatabaseRestoreDrillTests is a build gate run on every CI build, now with a recorded measured RTO/RPO baseline in RESILIENCE.md; a build gate, not a non-gating scheduled cron, is the M4 bar); §28 Front-End Testing Implementation 8→9 (a deterministic render-snapshot regression tier, MarkupSnapshot + PrimitivesSnapshotTests, shipped in Testing.UI for reuse); §21 Accessibility Implementation 8→9 (axe coverage broadened to the loading/error states plus a documented manual screen-reader pass in ACCESSIBILITY.md, which also found and fixed a real WCAG 4.1.2 defect in PageLoadingState). One honest finding logged but not gated: a dark-mode palette contrast gap (filled-primary button label + error-alert text), tracked under §20. Fitness counts advanced to 72 methods / 19 bases (Common runs 39) per the regenerated FACTS.md. The dated note above records the prior ninth-wave (v1.92.0) re-score; the figures in the executive summary and closing analysis below predate this wave (the Indices section is authoritative).

Update 2026-06-30 (eleventh wave: ADR governance for two pre-existing mechanisms). No score moves this cycle. A full 34-category evidence re-score at framework v1.93.0 (git HEAD 3e72bfa, working tree dirty, see the caveat below) re-confirmed every category at its tenth-wave value, so the indices hold at Maturity 92.9% (301/324) / Implementation 84.9% (688/810) (the Indices section remains authoritative). The wave is governance and docs only: two new ADRs record mechanisms that already ship in framework code. ADR-033 (resource-ownership authorization) documents the OwnerOrAdminFilter plus OwnershipHelper axis (a single-resource 403 filter keyed on the customer_id claim, plus an ownership Specification that row-scopes collection queries, with one admin bypass; opt-in per controller, claim-trusting, not ABAC, adopted in MMCA.Store). ADR-034 (generic entity controllers + dynamic query contract) documents the EntityControllerBase / AggregateRootEntityControllerBase generic REST surface and OData-lite query contract (sparse fields, per-type IFilterStrategy filtering, sort, pagination with X-Pagination, the MaxUnboundedResultLimit ceiling, two-path includes). Both enrich evidence (§11, §9/§2/§12, §34) without moving a score: ADR-033 is the resource-ownership criterion §11's Implementation-8 cap named, but it stays ownership-by-claim, opt-in, not-ABAC, and Store-adopted, so §11 correctly holds at Implementation 8. The source-generated, CI-gated FACTS.md advanced to ADR set 001-034 and 72 fitness methods across 19 bases (Common runs 39); this scorecard's prose is synced to match. Honest caveat: the tree is dirty (ADRs 033/034 added; ADRs 015/026/030 plus ADRs/README.md and FACTS.md modified) until this docs pass is committed, the recurring per-cycle §34 hygiene nit, tracked in the backlog.

Update 2026-06-30 (twelfth wave: under-8 Implementation lift, v1.94.0 pending release). Two Implementation scores move up on shipped, tested in-repo evidence; both indices' Implementation axis rises while Maturity holds: Maturity 92.9% (301/324) unchanged, Implementation 84.9% → 85.3% (691/810). The moves: §22 Responsive & Cross-Browser Implementation 7→8 — the two execution gaps the prior 7 named are closed with real framework code: grid density options now ship on DataGridListPageBase (DenseGrid + ToggleDensity(), persisted through ListPageState/URL/sessionStorage, unit-tested) and the 48px touch target is generalized from a cart-drawer-only rule into a shared .mmca-touch-target affordance (cart drawer + mobile cards + pager, enforced by a phone-viewport Playwright bounding-box test that passes locally), plus a documented RESPONSIVE.md device/browser matrix; and §27 Internationalization Implementation 7→8 — a real pseudo-localization pass ships (PseudoLocalizer transform + an IStringLocalizerFactory decorator activated by a Development-only qps-Ploc culture, inert in production, unit-tested), closing the pseudo-localization gap the prior 7 named. §31 FinOps stays at Implementation 7 by deliberate, documented acceptance (a structural cap, not an open gap): its two unmet criteria — right-sizing and reversible scale-events — are consumer/IaC execution a NuGet library provisions nothing to perform, and per-service cost attribution via Aspire annotations is inert for the hand-written-Bicep consumers (ADC/Store); the in-repo levers (Telemetry:TracesSampleRatio, outbox-log trim, COST.md) are already shipped. Full Common Release build clean, 1685 tests pass; the touch-target + pseudo-loc tests are green. The version is v1.94.0 pending the release tag + consumer sweep (held for review at this writing, so the working tree is dirty against the v1.93.0 tag).

Update 2026-07-02 (thirteenth wave: performance-smoke CI gate + rubric-band recalibration). A full 34-category evidence re-score at framework v1.99.0 (git HEAD 4b83891, working tree dirty, see the caveat below) moves five scores: one maturity up, four implementation recalibrated down to their rubric bands. §12 Performance & Scalability Maturity 3 to 4: the BenchmarkDotNet hot-path harness is now a committed CI gate (a performance-smoke job runs the benchmarks --filter "*" --job Dry on every push/PR, .github/workflows/ci.yml:149), so the §12 hot path (Specification compiled-expression cache + criteria composition) is automatically enforced, meeting the rubric's maturity-4 "enforced automatically (CI), documented, evolved deliberately" bar. Implementation holds at 8 because that CI benchmark is a runs-clean smoke, not a latency-regression gate (ci.yml:145), and load/stress timing data still lives in the consumer apps. §14 Testability 10 to 9, §19 State Management 9 to 8, §26 Front-End Security 9 to 8, §34 Governance & Docs 9 to 8: four recalibrations to the Strong band on the same evidence the prior scores hedged as "just shy of 10". The 53% coverage floor is modest and there is no mutation testing (§14), server-vs-client-state staleness is only partially deliberate (§19), the default static CSP omits script-src/style-src (§26), and the governance docs' own uncommitted-ADR pass keeps traceability momentarily inconsistent with the CI-gated FACTS.md (§34). This is honest calibration to the rubric bands, not regressed work. Net indices: Maturity 92.9% to 93.5% (301 to 303 / 324, +2 from §12), Implementation 85.3% to 84.0% (691 to 680 / 810, minus 11 from the four Implementation recalibrations: §14/§19/§26 each minus 3 on weight 3, §34 minus 2 on weight 2). Implementation stays the weaker axis and the gap widens to ~9.5 points (Maturity up, Implementation recalibrated down); no category is N/A. The source-generated, CI-gated FACTS.md advanced to fourteen packages / ADR set 001-036 / 77 fitness methods across 24 bases (Common runs 39) and this scorecard's prose is synced to match. Honest caveat: the tree is dirty (a docs pass is uncommitted: ADRs 035/036 added and untracked; ADRs 015/023/027/029/030/032/033 + ADRs/README.md + FACTS.md modified), the recurring per-cycle §34 hygiene nit, tracked in the backlog. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-03 (fourteenth wave: clean-tree evidence re-score at v1.101.0). A full 34-category, two-pass evidence re-score (scorer plus adversarial verifier per category) at framework v1.101.0 (git HEAD 5e55be2, working tree clean: the recurring uncommitted-docs-pass caveat is closed this cycle) moves two scores. §24 Forms, Validation & UX Safety Maturity 3 to 4: the shared auth-form convention is enforced automatically in the CI-gated .slnx unit tier (AuthModelValidationTests, 8 facts covering required/email/complexity/password-match, plus RegisterFormTests asserting the per-field ValidationMessage renders on an empty submit with the auth service never invoked), meeting the rubric maturity-4 "enforced automatically by tests/CI" bar, consistent with how §19 holds M4 on the same CI-gated guard tests; the shared FormsConventionTestsBase fitness base remains consumer-scoped (it enumerates Source/Modules/**/*Create.razor, which Common does not contain, and Common has no subclass), so the in-repo enforcement rests on those bUnit/model tests. §14 Testability Implementation 9 to 8: an internal-consistency band recalibration, not regressed work; the row's own stated reasoning (a modest 53% gated coverage floor, no mutation testing) describes the rubric's Strong band (7-8) while 9 sits in Exemplary, so 8 is the number that matches the reasoning. Four further first-pass downgrade proposals were adversarially reviewed and not applied: §25 (Implementation 8 to 7) and §34 (Maturity 4 / Implementation 8 to 3/7) were refuted on evidence, and §7/§9/§13 (each Implementation 9 to 8, a band recalibration) were declined on review, so all five hold at their prior scores; their rows receive evidence corrections only (drifted Aspire/Extensions.cs and Directory.Packages.props line anchors, the extraction rule body relocated to the shared Testing.Architecture package, and one stale §13 hold-reason: the warm-up subsystem HAS been unit-tested since the eighth wave, so the §13 hold at 9 rests solely on deployer-owned SLO alerting/dashboards/runbooks). The stale §34 dirty-tree caveat is removed: ADRs 035/036 and the docs pass are committed, so governance traceability is consistent with the CI-gated FACTS.md again. Net indices: Maturity 93.5% to 94.1% (303 to 305 / 324, +2 from §24), Implementation 84.0% to 83.6% (680 to 677 / 810, minus 3 from §14 on weight 3). Implementation stays the weaker axis (gap ~10.6 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-03 (fifteenth wave: i18n completion train, §27 Maturity 3 to 4 + Implementation 8 to 9). The ADR-027 amendment (Decision 9) closes every stated §27 hold. Maturity 3 to 4: the pseudo-localization pass is no longer a developer diagnostic: PseudoLocalizationE2ETests runs in the REQUIRED chromium ui-e2e job (the gallery host enables qps-Ploc unconditionally as unpackaged test infrastructure) and fails the merge on a missing [!! sentinel (resource round-trip) or horizontal overflow under the ~40% expansion (the rubric's layout-tolerance criterion, previously unevidenced), alongside an en-US leak guard; a second fitness gate (LocalizedTextConventionTestsBase, subclassed in-repo as LocalizedTextConventionTests) fails the build on NEW hard-coded snackbar/title/<PageTitle>/breadcrumb/NavItem literals, so the localized state is machine-enforced end to end, not review-enforced. Implementation 8 to 9: MudBlazor's built-in chrome now localizes (ResxMudLocalizer over MudTranslations.{resx,es.resx}, all 145 built-in keys en + es, DI-resolution-tested), the framework's own UI chrome is fully externalized (NavMenu, auth pages, error/empty/loading states, ReconnectModal, notification pages, the UI.Web SSR Error page: SharedResource grew 22 to 136 keys), the ErrorMessages.Success fragment-concatenation red flag is [Obsolete] (whole-sentence page keys replace it) and the Common.Error.* templates no longer surface raw ex.Message, and NavItem.TitleResource makes module nav menus culture-aware. Held below 10: two locales, no RTL. LocalizationResourceTests also gains a non-vacuous floor (MinimumBaseResources = 3). Net indices: Maturity 94.1% to 94.4% (305 to 306 / 324), Implementation 83.6% to 83.7% (677 to 678 / 810), both +1 on §27's weight 1.

Update 2026-07-06 (sixteenth wave: clean-tree re-score at v1.106.0, one score moves). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.106.0 (git HEAD 6f8b917, one commit past the v1.106.0 tag, working tree clean) moves one score. §14 Testability & Test Strategy Implementation 8 to 9: the specific reason the fourteenth wave recalibrated §14 down to 8 (a "modest 53% gated coverage floor") is resolved. The unit-tier coverage floor was ratcheted 53.0 to 68.3 (.github/workflows/ci.yml:226, commit b75fa8f, measured ~70.3% after the C1-C4 coverage program), and the suite grew from 1586 to 1880 [Fact]/[Theory] across 262 files via a coverage-driven program that found and fixed seven real defects (C-1..C-7, 55f3cab), coverage tracked on meaningful paths rather than as a vanity number, so the top band is now supported. Maturity holds at 4 (CI-gated fitness tests plus the blocking coverage-floor gate plus the zero-discovery min-tests guard); it is held below 10 only by the one remaining Exemplary gap, no mutation testing on the Core tier. All 33 other categories re-confirmed at their prior scores against current source: the defect-fix wave C-1..C-7 (§11 lockout-backoff-overflow clamp, §13 LoggingQueryDecorator query-failure outcome=failed RED-metric parity, the OAuth returnUrl safe-lookup, ChildEntityServiceBase token attach) and ADRs 037 (field-level encryption at rest) plus 038 (supply-chain provenance) are all evidence enrichment in categories already scored 8-9. ADR-037's EncryptedStringConverter is explicitly latent/unadopted, and ADR-038 records the SBOM as "generated, not yet signed or attested", so none moves a score. §34 Governance & Docs holds at M4/I8: the adversarial pass proposed 8 to 7 because the scorecard's own prose was stale against the CI-gated FACTS.md (it self-dated v1.101.0 / ADRs 001-036 while FACTS.md reports v1.106.0 / 001-038), but this refresh cures that staleness (the rewritten scorecard is current at commit time), and the durable Strong-8 cap remains the uncommittable ArchitecturalAnalysis.md in the workspace root. The source-generated, CI-gated FACTS.md is now ADR set 001-038 / 78 fitness methods across 25 bases (Common runs 40) and this scorecard's prose is synced to match. Net indices: Maturity 94.4% (306/324) unchanged, Implementation 83.7% to 84.1% (678 to 681 / 810, +3 from §14 on weight 3). Implementation stays the weaker axis (gap ~10.3 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-09 (seventeenth wave: evidence re-score at v1.108.0, one score recalibrated). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.108.0 (git HEAD 6c3b3bc, working tree clean, one commit ahead of origin: the ADR-012 mixed-endpoint transport amendment awaiting push) moves one score. §21 Accessibility Implementation 9 to 8: a band recalibration on evidence already on the record, not regressed work. The shipped, user-toggleable dark theme (ADR-028) carries two documented, deliberately un-gated WCAG AA contrast failures (the filled-primary button label and the error-alert message text, ACCESSIBILITY.md known limitations), a directly unmet §21 color-and-contrast criterion; the prior 9 parked that gap under §20 while sitting in the rubric's Exemplary band ("all criteria met to a high standard"), which does not hold when a §21 criterion fails in a default-available feature. Alongside the two standing smaller gaps (no automated focus-trap/reading-order assertion, manual pass only; axe breadth scoped to the gallery's representative states), the category recalibrates to the top of Strong. Held at 8 rather than 7 (reviewed): the gaps read as one minor cluster whose contrast half is a single palette-tuning item already tracked as the open §20 backlog entry, and everything else §21 claims is intact (the required chromium axe merge gate over the WCAG 2.1 AA tag set including the loading/error states, semantic landmarks and named controls, the documented manual screen-reader pass, the shipped E2E a11y bases). Maturity holds at 4. Two adversarially-refuted first-pass proposals are recorded, not applied: §8 Implementation 8 to 9 refuted (the rubric's "migrations run in CI/CD" criterion is structurally unmet in-repo: ci.yml has no migration-apply step, and ADR-030's boot-time self-migration is a runtime mechanism, not that gate) and §22 Implementation 8 to 9 refuted (no repo change since the twelfth-wave lift; firefox/webkit remain advisory continue-on-error, so the chromium-only gate stays the standing §22 gap). All 33 other categories re-confirmed at their prior scores against current source. The ADR set grew to 001-039 (ADR-039 live channel push: ephemeral events over the notification hub via ILiveChannelPublisher, plus the ADR-012 mixed-endpoint transport-profile amendment), both evidence enrichment in categories already scored 8-9 with no score move. The source-generated, CI-gated FACTS.md reports 78 fitness methods across 25 bases (Common runs 41) and this scorecard's prose is synced to match. Net indices: Maturity 94.4% (306/324) unchanged, Implementation 84.1% to 83.7% (681 to 678 / 810, minus 3 from §21 on weight 3). Implementation stays the weaker axis (gap ~10.7 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-12 (eighteenth wave: evidence re-score at v1.115.0, three scores move). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.115.0 (git HEAD 37d0a3b, working tree clean, at the release tag) moves three scores, all front-end. §20 Design System Implementation 8→9 and §21 Accessibility Implementation 8→9: the two documented dark-theme WCAG AA contrast failures that capped both categories (filled-primary button label + error-alert message text) are fixed in the palette (MMCATheme.cs:60,73, dark PrimaryContrastText/ErrorContrastText = rgba(0,0,0,0.87)) and locked by a blocking dark-mode axe gate (DarkModeE2ETests in the required chromium ui-e2e job, ci.yml:114); this is exactly the "tune the dark palette and gate the dark-mode axe scan" path back to 9 the seventeenth wave named. §20 stays below 10 on the residual raw-hex/!important in app.css and the Bootstrap-chrome coexistence; §21 stays below 10 on the manual-only focus-trap/reading-order pass. §23 Front-End Performance Maturity 3→4: the front-end performance conventions the thirteenth wave recalibrated to review-enforced are now measured AND automatically enforced: WebVitalsE2ETests asserts LCP/TTFB/CLS budgets on the gallery Login + Components pages inside the same blocking chromium ui-e2e gate (WebVitalsE2ETests.cs:43, ci.yml:114,145), meeting the rubric's maturity-4 "enforced automatically (CI)" bar; Implementation holds at 8 on the retained desktop-grid render-efficiency gap. Five adversarially-refuted first-pass proposals are recorded, not applied: §7 Implementation 9→8 (an unforced band recalibration re-litigating a fourteenth-wave decline), §10 Implementation 8→9 (the three documented hold-reasons still in source), §25 Maturity/Implementation downgrade (every §25 mechanism present on a clean tree), §26 Implementation 8→9 (the CSP script-src/style-src gap is unclosed), and §34 Implementation 8→7 (a transient stale-prose basis this refresh cures) all hold at their prior scores. All 26 other categories re-confirmed at their prior scores. Six capabilities landed since v1.108.0 as evidence enrichment with no band move: ADR-040 authenticated output caching, ADR-041 observability/telemetry, ADR-042 MAUI device-capability abstraction (the fifteenth package MMCA.Common.UI.Maui), ADR-043 mobile deep links + native OAuth callback, ADR-044 native push delivery, ADR-045 managed file storage + avatars, all in categories already scored 8-9 (§18/§6/§8/§11/§30). The source-generated, CI-gated FACTS.md reports 15 packages / ADR set 001-045 / 85 fitness methods across 28 bases (Common runs 46) and this scorecard's rows are synced to match. Net indices: Maturity 94.4% → 95.1% (306 → 308 / 324, +2 from §23 on weight 2), Implementation 83.7% → 84.3% (678 → 683 / 810, +2 from §20 on weight 2, +3 from §21 on weight 3). Implementation stays the weaker axis (gap ~10.8 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-15 (nineteenth wave: evidence re-score at v1.115.0, three table moves, one honest downgrade). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.115.0 (git HEAD c7b3cb9, working tree dirty: an ADR-adding pass is in flight, ADRs 046-048 untracked plus ten modified files including FACTS.md) moves three table scores. §22 Responsive & Cross-Browser Maturity 3→4: firefox was promoted to a required merge gate alongside chromium on 2026-07-12 (ci.yml:112, with continue-on-error now scoped to webkit only, ci.yml:115), exactly the promotion path the prior risk list named for +1 maturity; two real engines now block merges, clearing the chromium-only red flag (Implementation holds at 8: the promotion is an enforcement move, not new responsive execution breadth, and webkit stays advisory). §12 Performance & Scalability Maturity 4→3 (downgrade): the sole basis for the thirteenth-wave M4 was the performance-smoke CI job as automatic enforcement, but that job is a runs-clean smoke (--job Dry, fails only if a benchmarked path throws or no longer compiles, ci.yml:172,193), not a latency-regression gate, so it does not automatically enforce the performance property the rubric's maturity-4 bar requires; convention plus review plus a compile/run smoke is Maturity 3 (Implementation holds at 8; no work was lost, the recalibration rests entirely on the smoke-vs-regression distinction). §23 Front-End Performance Maturity 3→4 applied to the table: the eighteenth-wave prose recorded this move but the table row and the Indices block were never updated (a partial-application inconsistency this refresh cures); the WebVitals budget gate (WebVitalsE2ETests.cs:43, blocking chromium ui-e2e job) is re-confirmed against source. Three adversarially-refuted first-pass proposals are recorded, not applied: §9 Maturity 3→4 (the in-repo OpenAPI drift gate is deliberately consumer-owned, OpenApiEndpointExtensions.cs:12), §25 Maturity 3→4 (NavigationFlow.md has no drift gate and the Routes.razor route-auth wiring has no test; only leaf behaviors are auto-tested), and §33 Implementation 8→9 (the new consumer-source-build cross-repo canary, ci.yml:262, is real progress but advisory (continue-on-error: true) and does not remove the two cited caps: the Aspire AppHost headless hang and Common not being independently runnable). All 28 other categories re-confirmed at their prior scores. ADRs 046-048 (HTTP API versioning, soft-deleted user session revocation, primitive identifier type aliases) land as evidence enrichment in categories already scored 8-9 with no move. The source-generated, CI-gated FACTS.md reports 15 packages / ADR set 001-048 / 85 fitness methods across 28 bases (Common runs 46) and this scorecard's rows are synced to match. Net indices: Maturity 94.4% → 95.1% (306 → 308 / 324: §22 +2, §23 +2, §12 -2), Implementation 84.3% (683/810) unchanged (the prior Indices block read 678/83.7%, stale against its own table rows after the eighteenth-wave §20/§21 lifts; also cured here). Implementation stays the weaker axis (gap ~10.8 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-17 (twentieth wave: evidence re-score at v1.117.0, four scores move). A full 34-category, two-pass evidence re-score (per-category scorer plus adversarial verifier) at framework v1.117.0 (git HEAD 76d70cf, working tree clean) moves four scores. §25 Navigation & IA Maturity 3→4: the navigation-contract drift gate the prior risk list prescribed now ships and gates merges: NavigationContractTests reflects over every routable MMCA.Common.UI page and asserts set-equality plus auth-posture agreement against the embedded NavigationFlow.md routes table (with a non-vacuous 8-route floor), and the test project sits in MMCA.Common.slnx, so the gate runs in the CI-gated unit tier (NavigationContractTests.cs:29,44, MMCA.Common.slnx:45), meeting the rubric maturity-4 "enforced automatically (CI)" bar and closing the §25 red flag (navigation drifting from the documented per-role design). Implementation holds at 8: the gate is an enforcement move, not new execution breadth, and the "deep-link param typing beyond list-state is still light" cap is unchanged (framework routes are plain string templates with only the sanitized ?returnUrl= query state), the same calibration §22/§23 applied to their own gate promotions. §33 Developer Experience Maturity 3→4 + Implementation 8→9: the consumer-source-build canary (builds MMCA.Helpdesk against the PR's framework source via UseLocalMMCA) was promoted from advisory to a required merge gate on 2026-07-16 (continue-on-error removed and the "Consumer source build (Helpdesk)" context added to branch protection after 9 consecutive green runs, ci.yml:267-268, confirmed live via the branch-protection API), so a framework change that breaks a source-mode consumer now blocks the merge automatically: that clears both the maturity-4 automatic-enforcement bar and the sole cap the nineteenth wave placed on Exemplary implementation. Held below 10 by the residual friction items, now implementation notes only (the Aspire AppHost hangs when launched headless, and Common itself is a library, not independently runnable). §22 Responsive & Cross-Browser Implementation 8→9: webkit was promoted to a required merge gate on 2026-07-16 after 11 consecutive green main runs (ci.yml:112-114, no continue-on-error remains anywhere in the job, confirmed live via the branch-protection API), so all three engines now block merges: this closes the one stated reason the row held at 8 ("webkit remains advisory") and completes the full 3-engine matrix as an enforced, not just exercised, capability. Held below 10: the matrix runs against the backend-less gallery's representative states, and RESPONSIVE.md's device rows remain a documented matrix, not device-lab execution. (Doc drift cured with this refresh: RESPONSIVE.md still listed webkit as advisory.) §13 Observability Implementation 9→8 (band recalibration, no work lost): the row's own text names two of the six §13 criteria as deployer-owned (SLO alerting/dashboards and runbooks), which is the rubric's Strong band ("nearly all criteria met, minor isolated gaps"), not the Exemplary "all criteria met to a high standard" that 9 claims: the same calibration this scorecard already applies to §17 and §29 for structurally identical deferred-to-consumer reasoning. The in-repo substance is re-confirmed and unchanged (warm-up readiness gate wired unconditionally into AddServiceDefaults with 9 unit tests, RED-metric command/query parity, poll-span noise filtering; stale row anchors corrected to Extensions.cs:38,173,188,302-315,344-352). Three first-pass lift proposals were adversarially refuted and are recorded, not applied: §9 Maturity 3→4 (the OpenAPI/contract drift gate is deliberately consumer-owned per OpenApiEndpointExtensions.cs:13, and no §9-specific CI gate exists in-repo, so enforcement stays review/convention), §17 Maturity 3→4 (the new sample-deployment-validate job compile-checks the reference Bicep on every push, ci.yml:311-322, but a real what-if/deploy stays consumer-side by the workflow's own comment, so the CD axis is not automatically enforced in-repo), and §31 Maturity 2→3 / Implementation 7→8 (the proposal re-cited the identical evidence already grounding M2/I7; no new §31 work exists). One recorded candidacy is declined on live branch-protection evidence: §12 stays Maturity 3. The backlog's latency-regression gate shipped 2026-07-16 (the performance-smoke job now runs --job Short --exporters json and build/perfgate fails on committed perf-baseline.json ceiling/ratio violations, ci.yml:174-200), a real qualitative upgrade over the runs-clean smoke, but the job's context is absent from the live required_status_checks list (queried via the branch-protection API; CONTRIBUTING.md:57-62 agrees), so a red perf gate does not block a merge and the rubric's merge-gate bar is unmet; adding the context to branch protection is now the whole path to M4. All 28 other categories re-confirmed at their prior scores. The source-generated, CI-gated FACTS.md reports 15 packages / ADR set 001-048 / 85 fitness methods across 28 bases (Common runs 49) and this scorecard's rows are synced to match (the prior "Common runs 46" fitness-subclass count was stale against FACTS.md). Net indices: Maturity 95.1% → 96.3% (308 → 312 / 324: §25 +2, §33 +2), Implementation 84.3% → 84.6% (683 → 685 / 810: §22 +2, §33 +2, §13 -2). Implementation stays the weaker axis (gap ~11.7 points); no category is N/A. The Indices section below is authoritative; the executive summary and closing analysis predate this wave.

Update 2026-07-21 (twenty-first wave: evidence re-score at v1.121.0, one score moves). Recorded in full in the executive summary below: §12 Performance & Scalability Maturity 3→4 (the Performance gate (BenchmarkDotNet Short + baseline verify) context is present in live required_status_checks on main, 8 required contexts, refuting the twentieth wave's sole stated basis for holding it at 3). Maturity 96.3%→96.9% (312→314/324); Implementation unchanged at 84.6% (685/810). Seven proposed lifts (§4, §9, §11, §19, §20, §26, §29) were refuted on an adversarial second pass and held at prior; the remaining 26 categories re-confirmed with no move. One documentation drift (the CONTRIBUTING.md gate list vs live protection) was routed to the backlog under #34 and fixed the same day (MMCA.Common PR #100).

MMCA.Common is a .NET 10.0 (LangVersion: preview) framework shipped as fifteen NuGet packages to GitHub Packages (Shared, Domain, Application, Infrastructure, API, Grpc, UI, UI.Maui, UI.Web, Aspire, Aspire.Hosting, Testing, Testing.E2E, Testing.UI, Testing.Architecture) (a library/SDK, not a runnable app) that supplies the cross-cutting foundation for modular-monolith applications built on DDD, Clean Architecture, and CQRS. Its substance is dense and consistent: a Result<T> error-flow pattern, soft-delete/audit-stamping aggregate base classes, an auto-discovered IModule system with topological (Kahn) registration, a Scrutor decorator pipeline, EF Core with a database-per-microservice resolver, and an outbox for cross-source consistency, all layered across Core/Presentation/Hosting tiers. The headline finding is that architecture rules are not aspirational here: the dependency rule is enforced twice over (compile-time MSBuild targets in §3 plus NetArchTest fitness functions, now factored into a define-once shared rule library — the 13th package Testing.Architecture — consumed identically by all three repos per ADR-015), and the same governance rigor extends to microservice-extraction seams (§7), supply chain (§32 — the MassTransit-v8 license pin is a build gate, now also ADR-016), security (§11), and docs (§34's now-sixteen dated ADRs, 001-016). This is a reference-quality governance posture. The ADR set has since grown to twenty-two (001-022), a polyglot-persistence capability (three storage engines behind one entity model) ships as tested framework plumbing (ADR-018), v1.80.0 adds an opt-in permission-based authorization layer plus TimeProvider adoption (fourth wave), and v1.81.0-v1.82.0 add an opt-in Scalar OpenAPI UI, a FinOps COST.md, an RS256 pin on the JWKS-forwarded auth path, and three newly-committed ADRs (020-022) that clear the prior cycle's governance nits (see the fifth wave below).

This re-verification (2026-06-20) found the prior report materially stale. A remediation wave landed on 2026-06-19/06-20 (sixteen commits between v1.68.0 and v1.72.0) that closes four of the previously-flagged top risks, each verified against source: (1) event-schema versioning now exists — BaseIntegrationEvent.SchemaVersion => 1 (ADR-010) plus an EventVersioningConventionTests fitness gate, removing the §6 cross-service contract-break risk; (2) OpenAPI generation now ships — AddCommonOpenApi()/MapCommonOpenApi() over the built-in Microsoft.AspNetCore.OpenApi 10.0.8, removing the §9 "undocumented specs" red flag; (3) the CI coverage gate is now enforced — ci.yml fails the build below a 53% line-coverage floor (was report-only), closing the last §14 gap; (4) the chaos/fault-injection test is now real — ResilienceCircuitBreakerFaultInjectionTests trips a breaker and asserts short-circuiting (was prose-only TODO), lifting §29. Two further hardening moves landed: the CycloneDX SBOM step is now a blocking release gate (was continue-on-error), and the ADR set grew 9→11 (ADR-010 event versioning, ADR-011 single-locale i18n), each with a matching fitness function.

A second wave landed 2026-06-21/06-22 (v1.73.0→v1.76.0), folded into this re-verification. It is governance-and-consolidation rather than score-moving substance, so the scores below are unchanged, but it reinforces the already-high §14/§15/§32/§34 ratings: (1) the architecture fitness functions were extracted into a define-once shared package — MMCA.Common.Testing.Architecture (the 13th package, v1.73.0) holding one IArchitectureMap-parameterized NetArchTest rule library + abstract test bases — so Common, ADC, and Store now run literally the same rules (ADR-015) instead of parallel copies; (2) shared cross-cutting infrastructure was promoted up into Common (v1.74.0, drift-reduction P4); (3) the ADR set grew 11→16 — ADR-012 (gRPC-host transport), ADR-013 (Result pattern), ADR-014 (CQRS decorator pipeline), ADR-015 (architecture fitness functions), ADR-016 (lockstep versioning + MassTransit-v8 pin) — documenting patterns that previously lived only in code; v1.76.0 itself was a docs-only release. The consumer apps were swept to v1.76.0 in lockstep (and have since moved with the framework to v1.79.0 — see the third wave below), so the framework and both consumers remain fully converged with no version lead.

A third wave landed 2026-06-23/06-24 (v1.77.0→v1.79.0), folded into this re-verification. It adds one capability and several governance refinements: (1) polyglot persistence (ADR-018, v1.79.0) — three storage engines (SQL Server / Cosmos / SQLite) behind one entity model, selected per entity by a [UseDataSource] attribute on an engine shim base (EntityTypeConfigurationSQLServer/Cosmos/Sqlite over the engine-aware EntityTypeConfiguration<TEntity,TId>), with WithSQLServerDataSource/WithCosmosDataSource/WithSqliteDataSource AppHost helpers (Aspire.Hosting/Extensions.cs:132/166/198), a CrossSourceSpecification.BuildAsync helper for engine-portable cross-source filters, and a new opt-in SpecificationsDoNotNavigateToOtherEntities fitness rule (ArchitectureRules.Specifications.cs:24) that fails the build on a latent cross-engine navigation hazard. The plumbing is complete, unit/integration-tested, and shipped, but no production entity routes to a non-SQL engine yet (ADR-018 records the capability as deliberately latent — even ADC's Conference Session→Cosmos / Room→SQLite trial was built, tested, then reverted to all-SQL-Server with the seams kept). (2) ADR-017 (request idempotency) now formally documents the long-standing [Idempotent] HTTP-edge filter (Source/Presentation/MMCA.Common.API/Idempotency/, present since v1.14.0 — Idempotency-Key header → distributed-cache replay with X-Idempotent-Replay, per-key SemaphoreSlim double-check), the inbound counterpart to ADR-003's consumer idempotency. (3) Supply-chain governance deepened — a committed .github/dependabot.yml adds weekly NuGet/Actions update PRs with semver-major ignores for the held packages (MassTransit, VS.Threading.Analyzers, StackExchange.Redis, MessagePack), reinforcing the §32 pin discipline in config (not just the fitness test), plus a sweep of dependencies to latest stable. (4) A 985-line, 9-phase GETTING-STARTED.md adoption guide shipped (worked companion to MMCA.Helpdesk), materially strengthening onboarding (§33). Two minor §34 hygiene regressions accompany the wave: the CHANGELOG skips 1.72-1.78 (jumps 1.79.0 → 1.71.0), and ADR-018 is on disk but uncommitted at review time. Net score effect: §33 rises (M2→M3, I7→I8); all other categories hold, with enriched evidence.

A fourth wave landed 2026-06-25/06-26 (v1.80.0), folded into this re-verification. It is capability-and-governance enrichment that lands in categories already scored 9-10, so no numeric score moves this cycle — but the evidence under §11/§1/§4/§14/§34 is materially enriched, with three honest caveats recorded rather than papered over: (1) permission-based authorization now ships (commit bc6c5d7) — IPermissionRegistry + PermissionRegistryBuilder (Shared) declare role→permission grants, [HasPermission("x")] resolves an on-demand perm:x policy via PermissionPolicyProvider, and PermissionAuthorizationHandler checks the caller's roles/claims against the registry; it is opt-in and backward-compatible (the four named role policies are untouched, the mechanism is inert until a host calls AddPermissions(...)), well-factored (immutable FrozenDictionary/FrozenSet registry, additive cross-module grants), and backed by 13 new unit tests. Caveat: this is RBAC with a role→permission capability indirection, not ABAC/resource-based authorization, so it is a real §11 "policy-based" win but should not be over-credited as resource-based. (2) TimeProvider is now injected into TokenService (iat/nbf/exp), the notification read handlers, and UserNotification.MarkAsRead(DateTime readOnUtc) (which now takes an explicit UTC timestamp, keeping that aggregate free of ambient clock) — a genuine §14-testability/§1-DIP improvement. The one remaining domain DateTime.UtcNow — BaseDomainEvent.DateOccurred — was reviewed 2026-06-26 and accepted as a deliberate choice (occurrence-time = when the aggregate raises the event is the correct event-sourcing/audit semantic, enforced by four domain tests; relocating it to the persistence boundary regresses the semantic), and is now documented as such in BaseDomainEvent's <remarks> rather than treated as a defect. (3) ADR-019 (rate-limiting) now documents the authenticated-only global limiter — the limiter itself is pre-existing code (shipped 2026-06-12, commit 285a169), already scored under §11; v1.80.0 added only the ADR. Post-review hardening (2026-06-26): the limiter's load-bearing partition/exemption logic is now unit-tested (RateLimitPartitionTests), and the two notification handler tests now assert the stamped read-time against a fixed TimeProvider — closing the two test-coverage caveats above. Governance is mixed: ADRs 017/018 are now committed (a real fix), but ADR-019 + the README/CLAUDE index edits are uncommitted, the CHANGELOG still skips 1.72-1.78 and now also lacks a 1.80.0 entry (empty [Unreleased]), and the framework's own scorecard/backlog were not yet refreshed for this wave. (All since resolved in the v1.81.0/v1.82.0 governance pass — CHANGELOG completed, ADRs committed, and this scorecard migrated in-repo as the canonical two-axis evaluation; see the fifth wave.)

A fifth wave landed 2026-06-26 (v1.81.0→v1.82.0, HEAD 0dcac4d, clean tree at the v1.82.0 tag). Like the fourth, it lands in categories already scored 9-10, so no numeric score moves — but it converts three previously-anticipated or working-tree items into shipped, committed fact and clears the prior cycle's §34 governance nits: (1) the Scalar OpenAPI UI helper is now released (v1.81.0, not "committed-but-unreleased") — MapCommonScalarUi() renders /scalar/{doc} from the generated document, non-Production only, via the bundled Scalar.AspNetCore 2.16.6 (no CDN), so §9's interactive-UI gap is closed in a tagged release; (2) COST.md (FinOps notes, §31) is released (v1.81.0), documenting the framework's cost levers (telemetry-span filtering, outbox poll/retention tuning) and the right-sizing/attribution/surge-revert defaults consumers set; (3) RS256 is now pinned on the JWKS-forwarded auth path (v1.82.0, §11/§26) — ValidAlgorithms = [RsaSha256] on the forwarded-JWT (JWKS-discovery) validation path in MMCA.Common.API, defense-in-depth against an algorithm-confusion swap, matching the pre-existing in-process pin; (4) ADRs 020-022 are added and committed — 020 (permission-based authorization, documenting the v1.80.0 layer), 021 (consumer-inbox idempotency, documenting the pre-existing EfInboxStore), 022 (browser session-cookie auth, documenting the SSR BFF token-storage scheme) — bringing the tracked set to 001-022; (5) the §34 hygiene nits are resolved — ADR-019 is committed, the CHANGELOG is complete (1.69.0→1.82.0, no gaps), and the working tree is clean. Two test-hardening and one stability item also landed: the rate-limiter partition/exemption logic and the notification read-time clock are now unit-tested (§14), and the E2E register/login success-detection got a grace window to de-flake it (R11, §28). (The prior cycle's minor README.md:42 stale "001-016" parenthetical has since been corrected to 001-022.)

A sixth, governance-focused pass is in flight at this re-score (uncommitted working tree) and is the immediate basis for this re-verification. It moves no score (every change lands in a category already at 9-10) but adds durable governance substance: (1) FACTS.md is now generated from source by a dependency-free build/facts tool and gated in CI (ci.yml:27-28 runs dotnet run --project build/facts -- . --check), so the framework-wide facts (version, package count, ADR range, fitness-method/base counts) can no longer drift from source: a fitness function for the docs themselves (§34/§16). (2) The rubric (ArchitectureEvaluationCriteria.md) and FACTS.md are now version-controlled in this repo (previously workspace-only), completing the §34 governance pattern already applied to the ADRs and this scorecard. (3) Security-response headers were centralized into one pluggable middleware in MMCA.Common.Aspire.Security (AddCommonSecurityHeaders + ICspPolicyProvider + SecurityHeadersMiddleware, unit-tested), removing the per-host drift the previously hand-rolled headers allowed, and documented in the new ADR-023 (bringing the set to 001-023, §11/§26/§34). The one honest caveat: the tree is dirty and the CHANGELOG [Unreleased] does not yet carry ADR-023, so traceability is momentarily inconsistent until this pass is committed.

A seventh wave landed 2026-06-26/06-27 (v1.83.0→v1.84.0, HEAD b2b0aae), folded into this re-verification — and it moves one score. (1) The sixth-pass governance items are now committed and tagged — v1.83.0 (b9a6a28) shipped ADR-023 (security-response headers), the source-generated CI-drift-gated FACTS.md, and this two-axis scorecard, resolving the prior cycle's "ADR-023 uncommitted" §34 caveat. (2) PiiRedactor ships and moves §30 from Implementation 7 to 8 (v1.84.0, b2b0aae) — Domain/Privacy/PiiRedactor.cs masks every [Pii]-marked member (shallow, value-erasing) before an entity carrying personal data reaches a structured log or telemetry attribute, with 7 PiiRedactorTests (incl. a "never emits the clear-text PII values" assertion). This closes the §30 red flag the rubric names verbatim ("PII in logs/telemetry"), which the prior cycle recorded as documented-but-missing; §30 maturity holds at 3 because DSAR/export endpoints, consent capture, the personal-data inventory, residency verification, and retention execution remain consumer-owned and PiiConventionTests still passes vacuously in-repo. (3) A warm-up / readiness subsystem ships (Aspire/Warmup/ — WarmupHostedService, WarmupReadinessGate, WarmupReadinessHealthCheck, OpenIdConnectMetadataWarmupTask), wired into AddServiceDefaults so every host gates /health/ready on warm-up (gate starts closed, opens even on task failure = availability over warmth, with lazy-retry fallback under ADR-009; the built-in task pre-fetches OIDC discovery to kill ACA cold-start), now documented in ADR-025. It is genuine §29/§13 substance but was scored at v1.84.0 as enrichment, not a lift: it shipped with zero unit tests (since added in the eighth wave below, which lifts §29 Impl 7→8) and the §29-capping recovery gaps (no in-repo restore drill, RTO/RPO, or SLO/error-budget) are unchanged, so at v1.84.0 §29 held 3/7 and §13 holds 4/9. (4) ADR-024 (two-channel notifications) documents the pre-existing SignalR-push + durable UserNotification-inbox seams (IPushNotificationSender/INotificationRecipientProvider with no-op defaults), enriching §6 evidence with no move. The honest caveat: at this re-score ADR-024/025 are untracked and the CHANGELOG [Unreleased] is empty while the repo is tagged through v1.84.0 (a transient §34 hygiene nit, tracked in the backlog).

An eighth wave — the under-8 Implementation remediation — shipped in v1.85.0 (commit 78e5312, tag v1.85.0) and is verified against source in this re-score. Every category whose Implementation sat below 8 was lifted with shipped, tested in-repo evidence rather than narrative: §5 (a SliceCohesionTestsBase fitness function enforcing slice co-location), §12 (a BenchmarkDotNet smoke harness + the framework page-size guard), §17 (a reference samples/deployment Bicep/OIDC sample + DEPLOYMENT.md), §24 (Register/Login converted to EditForm + DataAnnotations field-level validation), §25 (an in-shell Forbidden 403 page + NavigationFlow.md), §29 (warm-up subsystem unit tests + a RESILIENCE.md SLO/error-budget + restore-drill reference), and §31 (a built-in OTel Telemetry:TracesSampleRatio sampler knob + a per-message log trim). §5/§12/§17/§24/§25/§29 each reach Implementation 8 and §31 reaches 7 (full Release build clean, 1651 tests pass). The wave also moves one maturity score: §5 Vertical Slice 3→4, because its new slice-cohesion fitness function is automatic CI enforcement of the slice convention (the rubric's maturity-4 bar). A separate docs governance pass remains uncommitted at this writing (ADRs 024/025/026 untracked, the FACTS.md ADR-count bump, ADR cross-links, and a ServiceContractAttribute doc-comment correction that stops it claiming a non-existent [ServiceContract] arch test); ADR-026 documents the two-tier caching substrate (the ICacheService memory-or-distributed swap + the HTTP output-cache edge) that §10 already scored.

A ninth wave landed 2026-06-28/29 (v1.86.0→v1.92.0) and is the basis for this re-score — it moves five scores. The headline is internationalization: multi-locale i18n (en-US + Spanish) now ships in the framework itself (ADR-027, superseding the single-locale ADR-011) — co-located .resx + IStringLocalizer<T>, backend errors localized at the edge keyed by the existing Error.Code, one culture cookie as the source of truth across SSR/Server/WASM (forwarded to services as Accept-Language), and a per-user PreferredCulture. This flips §27 from N/A to a scored Maturity 2 / Implementation 6 (immature: culture-less date/number formatting is guarded only by an advisory analyzer, with no missing-key/coverage CI gate), and removes the last N/A category, so all 34 categories now count toward the indices. Five further capabilities landed without moving a score, each enriching evidence: ADR-028 day/dark theme (the dark palette is now wired through MudThemeProvider with a ThemeService + a ThemeToggle in the shared layout — §20, where the raw-hex/!important deductions still hold); ADR-029 brute-force protection plus ADR-032 password hashing (PBKDF2-HMAC-SHA512, 32-byte salt, 600k iterations, FixedTimeEquals, with a load-bearing legacy-HMAC verify-and-migrate branch — §11, which still recalibrated to 8); ADR-030 startup sole-migrator (each service self-applies its EF migrations at boot — §8/§17, a runtime mechanism, not the CI migration-apply gate those categories' gaps name); and ADR-031 feature-flag management (Microsoft.FeatureManagement on both the controller [FeatureGate] and CQRS IFeatureGated surfaces — §10). The ADR set grew 026→032 and the source-generated FACTS.md advanced the fitness counts (71 methods across 18 bases, Common's own build executes 38). The honest caveat: ADR-032 is untracked and a docs/source pass (seven ADR edits, FACTS.md, one source edit) is uncommitted at this re-score.

The two axes remain deliberately asymmetric: at the ninth wave Maturity 91.7% vs Implementation 84.1% (current: 96.9% vs 84.6%, see the twenty-first wave below), keeping Implementation the weaker axis. Both indices dip slightly this cycle, and the dip is honest re-calibration rather than regressed work: §27 i18n enters both denominators at a low 2/6 (genuinely shipped, but newly so and only advisory-guarded), and §11/§22/§23 were trimmed to better-supported bands on a close re-read (algorithm-confusion defenses and a 3-engine matrix are real, but vault binding, a chromium-only gate, and unmeasured Web Vitals keep them out of the top band). The residual gap is structural rather than a quality defect: the framework consistently ships mature, well-governed mechanisms (ADRs, fitness functions, documented patterns) whose full execution necessarily completes in the consumer apps (ADC/Store). The in-repo half of §17 (a reference Bicep/OIDC sample) and §29 (warm-up tests + an SLO/restore reference) is done; the deeper §17 CD-to-Azure and §29 drilled-restore substance still lives downstream, and Data-migration gating (§8) remains maturity-above-implementation because a verifiable CI migration-apply step lives in the consumer repos (ADR-030's boot-time self-migration is a runtime mechanism, not that gate). Compliance (§30) and FinOps (§31) are the inverse: their in-repo implementation (the PiiRedactor log-masking + IAnonymizable erasure seam, now gated by PiiErasureContractFitnessTests; the documented cost-lever defaults) leads a maturity that stays capped because the governing process — DSAR/consent capture, the personal-data inventory, residency verification, per-service cost attribution, right-sizing — is consumer-resident.

The practical implication: closing the remaining Implementation gap is mostly about adding evidence and verification of execution inside MMCA.Common itself — a committed OpenAPI baseline-drift check (§9), an in-repo restore drill + baseline SLOs (§29), a CI migration-apply step against an ephemeral DB (§8), and a smoke-deploy of the reference Bicep/OIDC sample (§17) — rather than re-architecting. The freshest gap this cycle is the newly-scored §27 i18n: lifting it toward maturity 4 needs a missing-key/translation-coverage CI gate and a documented locale-addition governance step. There are no longer any N/A categories: §27 Internationalization, previously excluded under the single-locale ADR-011, is now an active scored category after ADR-027 shipped en-US + Spanish in the framework.

A twenty-first-wave re-score ran 2026-07-21 at v1.121.0 (HEAD 4a4fc05, clean tree) and moves exactly one score. §12 Performance & Scalability rises Maturity 3→4. The nineteenth wave dropped it to 3 for lack of a real regression gate, the twentieth wave kept it at 3 on the narrower ground that the shipped gate's job context was absent from live branch protection. That ground no longer holds: main now requires 8 status checks including Performance gate (BenchmarkDotNet Short + baseline verify), and the job carries no continue-on-error (.github/workflows/ci.yml:179,196-204), so a latency or allocation regression against the committed baseline blocks the merge. That is automatic enforcement, the rubric's Maturity-4 bar. Implementation holds at 8 because load and stress timing against realistic volumes still lives in the consumer apps. The cycle's more useful finding is what did not move: first-pass scoring proposed lifts in seven categories (§4, §9, §11, §19, §20, §26, §29) and an adversarial second pass refuted every one against source, each for a concrete reason rather than caution: only Notifications is a bounded context in-repo (§4), the three contract-test bases are subclassed downstream and never in Common's own tests (§9), the sample's Key Vault secret binding is still dangling in the bicep template (§11), and no commit has touched resilience, restore-drill, or warm-up files since the twentieth-wave baseline (§29). One documentation drift was surfaced and routed to the backlog under #34 rather than scored: CONTRIBUTING.md still advertises five required gates and calls webkit advisory, while live protection requires eight including webkit, the Helpdesk consumer-source canary, and the perf gate. Because scorecard adjudications cite that file, its drift can mis-ground a future score, which is precisely what happened to §12 this cycle.

A twenty-second-wave re-score ran 2026-07-23 at v1.123.0 (HEAD c911480, clean tree) and moves nothing: all 34 categories re-confirm at their twenty-first-wave values. The cycle's value is again in what it refused to move. Three first-pass lifts were refuted against source: §9 (Maturity 3→4) because OpenApiContractTestsBase is still subclassed only in consumer hosts, never in Common's own tests, and OpenApiEndpointExtensions.cs:13 records that delegation as deliberate, so no in-repo CI gate enforces the contract; §10 (Implementation 8→9) because the three documented hold-reasons are still in code (the distributed cache path is a no-op without a real IConnectionMultiplexer, DependencyInjection.cs:158; the idempotency semaphore is in-memory, not cross-instance-exclusive; resilience config is partly literal); and §30 (Maturity 3→4) because the only automatic gate, PiiErasureContractFitnessTests, proves the erasure mechanism while the structural [Pii] convention scan stays vacuous in-repo and the governing process (inventory, DSAR, consent, residency, retention) is consumer-resident. Two first-pass downgrades were also refuted: §23 and §24 (each Implementation 8→7) failed on a fresh re-read of every cited file: no regression exists, and §23's web-vitals budget gate is now enforced on all three browser engines (ci.yml:107), stronger than when its 8 was set. The v1.122.0-v1.123.0 train (the typed filter DSL operators, the EntityQueryPipeline page-size clamp, cache-observability warnings, the IIntegrationEventPublisher removal with callers moved to IEventBus) lands as evidence enrichment with no band move. Indices hold at Maturity 96.9% (314/324) / Implementation 84.6% (685/810).

Scorecard

Weighted column = Maturity·weight / Implementation·weight per row. Axis-gap findings: §17/§8 are mature-but-execution-deferred (mechanism shipped, deeper proof lives downstream); §13 joined that calibration on the twentieth wave (Implementation 8: alerting/dashboards/runbooks are deployer-owned); §29 closed its maturity gap (the restore drill is now a build gate with a measured baseline) but its Implementation 8 still defers production SLOs downstream; §30/§31 are the inverse (in-repo implementation leads a maturity capped by consumer-owned governance/cost process); §12 left that group this cycle when its perf gate became a required check, and now sits mature-but-execution-deferred like §17/§8 (load and stress timing against realistic volumes is a consumer-app concern). Together these are the structural source of the 96.9% vs 84.6% gap.

Indices

• Maturity index = Σ(maturity×weight) ÷ Σ(weight×4) = 314 ÷ 324 = 96.9% (unchanged on the twenty-second-wave re-score, 2026-07-23: no maturity score moved; two proposed lifts, §9 and §30 Maturity 3→4, were refuted on adversarial re-verification. The latest move remains the twenty-first wave's §12 Maturity 3→4: 312 + 2 = 314.)
• Implementation index = Σ(impl×weight) ÷ Σ(weight×10) = 685 ÷ 810 = 84.6% (unchanged: no Implementation score moved on the twenty-second-wave re-score; one proposed lift (§10 8→9) and two proposed downgrades (§23 and §24, each 8→7) were refuted on adversarial re-verification and held at prior.)
• Weaker axis: Implementation (execution quality), by ~12.3 points
• N/A (excluded from denominators): none (§27 Internationalization is scored: ADR-027 superseded the single-locale ADR-011, so all 34 categories count)
• §32 weight = 3 (raised from the default 2 because MMCA.Common is a published framework)

Top 5 strengths

1. Dual-enforced Clean Architecture dependency rule (compile-time + fitness functions) — §3 (impl 9): Source/Build/MMCA.Common.LayerEnforcement.targets:1-90 fails the build on layer violation (BeforeTargets ResolveProjectReferences); LayerDependencyTests.cs:12-58 and DomainPurityTests.cs:13-26 re-enforce Shared→Domain→Application→Infra→API/UI and Domain framework-freedom via NetArchTest. Reinforced by §34 (impl 8).

   • Remediation: Preserve by keeping both gates wired into CI and adding a regression test whenever a new layer/package is introduced; document the targets file in CLAUDE.md. To push the residual point, narrow the broader base-controller/UoW surfaces noted in §1.
   • Expected delta: Preserves +9 impl on §3/§34; protects §16 maintainability from regression.

2. Reference-quality test strategy — define-once fitness functions + an enforced coverage gate — §14 (impl 9): right-shaped pyramid (1880 [Fact]/[Theory] across 262 files) with executable architecture fitness functions (LayerDependency, DomainPurity, MicroserviceExtraction, DependencyVersion, PiiConvention, PiiErasureContract, AggregateConvention, EventVersioningConvention, FrameworkSanity, Specification, SliceCohesion) authored once in the shipped MMCA.Common.Testing.Architecture package (85 methods across 28 abstract bases) and re-run identically across all three repos (ADR-015), a zero-discovery min-tests guard, a shipped reusable E2E package, and a 68.3% line-coverage floor that fails the build (ci.yml:226, ratcheted from 53% by the 2026-07 coverage program, measured ~70.3%).

   • Remediation: Preserve by keeping the floor green and ratcheting it upward over releases; add mutation testing on the Core tier to reach a 10.
   • Expected delta: Holds §14 at impl 9; mutation testing on the Core tier is the remaining path toward 10; protects §28.

3. Supply-chain hardening with a license-pin build gate, a blocking SBOM, and Dependabot held-package guards — §32 (impl 9, weight 3): Directory.Build.props:8-10 (lock files, NuGetAudit, audit=all); Directory.Packages.props:41-43 (MassTransit 8.5.5 pinned with documented v9 commercial-license crash hazard, ADR-016); DependencyVersionTestsBase.cs:24-37 fails the build if any MassTransit package goes major≥9; 24 packages.lock.json; CycloneDX SBOM a hard release gate (release.yml:45-50); and a committed .github/dependabot.yml:24-35 with semver-major ignores on every held package — the pin discipline now lives in config as well as the test.

   • Remediation: Automate the coordinated consumer version sweep (currently policy) to close the one remaining minor gap.
   • Expected delta: Automating the sweep nudges §32 maturity toward fully-exemplary; preserves +9 impl.

4. Centralized, alg-pinned security with shipped anti-automation defenses and PBKDF2 hashing — §11 (impl 8): WebApplicationBuilderExtensions.cs:364,380 pins ValidAlgorithms per RS256/HS256 (defeats alg-confusion) with full issuer/audience/lifetime/signing-key validation, :217 extends the RS256 pin to the JWKS-forwarded path; :34 rate-limit bypass for health/.well-known/grpc; LoginProtectionService.cs:50-56,74-82 adds exponential brute-force lockout + per-IP registration limit (ADR-029); PasswordHasher.cs:24,52,58 hashes with PBKDF2-HMAC-SHA512 (600k iterations, legacy-salt verify+migrate, FixedTimeEquals, ADR-032) — all returning Result.Failure rather than throwing.

   • Remediation: Keep the CI vulnerable-package gate green; document the deployer's vault/managed-identity binding (the acknowledged gap holding impl at 8) with a reference wiring sample.
   • Expected delta: A documented MI binding sample nudges §11 toward 9 and supports §17/§26.

5. Architecture-test-enforced microservices extraction seams + event versioning — §7 (impl 9): ADR-006 (database-per-service), transport-agnostic IMessageBus.cs:28, and the shared ArchitectureRules.Transport.cs:19 rule (subclassed in MicroserviceExtractionTests.cs:10) forbidding Application/Domain/Shared→MassTransit and Grpc→Domain/Application/Infrastructure. Newly reinforced by §6's BaseIntegrationEvent.SchemaVersion (ADR-010) + EventVersioningConventionTests, so cross-service contracts now carry an explicit version.

   • Remediation: Demonstrate one end-to-end lift-out (the Notifications module) in a sample to convert 'extractable by design' into 'extracted and proven'; add an upcaster/compat policy to ADR-010.
   • Expected delta: Preserves +9 impl on §7; an upcaster policy lifts §6 toward 10.

Top 5 risks

Note (twenty-first wave, v1.121.0): earlier waves closed risks previously listed here (§29's restore drill, the §27 i18n train, §24 forms enforcement, §22's firefox gate, §23's WebVitals gate, §25's navigation drift gate), and this wave closes another: §12's perf gate is now a required check on main, so the category returns to the protect list and its risk entry is retired. A documentation-drift risk entered in its place and was closed the same day: CONTRIBUTING.md still advertised the pre-promotion gate list, and because scorecard adjudications cite that file, its staleness mis-grounded §12's own score for a full cycle (fixed in MMCA.Common PR #100, 658786b; kept in the list with its resolution for provenance). The remaining deeper execution each risk names (per-service cost attribution, CD-to-Azure, a CI migration-apply step, consumer-side privacy governance) still lives downstream.

1. FinOps execution and governance live downstream — §31 (impl 7, maturity 2, the lowest maturity on the board; a documented accepted cap per the backlog's Deliberate / accepted section): the framework now ships real cost levers (an OTel Telemetry:TracesSampleRatio sampler knob, the outbox per-message log trimmed to Debug, OutboxPollFilterProcessor, a COST.md with attribution-tag + cost-guard samples), but right-sizing, reversible scale-events, and per-service cost attribution are consumer/IaC concerns a library cannot perform, and no in-repo process/review enforces cost discipline — so maturity stays at 2.

   • Remediation: This is largely structural; the in-repo half is done. Further movement needs the consumer apps to demonstrate measured right-sizing + per-service cost attribution that the framework's knobs feed.
   • Expected delta: +1 maturity on §31 (2→3) once a consumer-side cost-attribution convention exercises the framework knobs.

2. API contract stability has no in-repo automatic enforcement: §9 (impl 9, maturity 3, weight 2). The contract substance is genuinely strong (centralized RFC 9457 ProblemDetails mapping, header-based versioning with a backward-compatible v1.0 default, the ADR-034 generic query contract, OpenAPI + Scalar UI helpers), but the OpenAPI/contract drift gate is deliberately consumer-owned (OpenApiEndpointExtensions.cs:13 states the framework does not duplicate the consumer-host snapshot gate), and no §9-specific fitness function or CI job exists in-repo, so contract discipline is enforced by review and convention, the rubric's Maturity-3 band. Unlike every other Maturity-4 category here, §9 has no category-specific automatic gate. (§25, previously listed here, closed this wave on the NavigationContractTests drift gate.)

   • Remediation: Either add a minimal in-repo contract-surface fitness check over the framework-owned pieces (e.g. assert the ProblemDetails status map and the version-header default against a committed expectation), or record the consumer delegation as a deliberate accepted cap in the backlog so the category stops reading as an open gap.
   • Expected delta: +1 maturity on §9 (3→4) if gated in-repo; alternatively a documented acceptance mirroring §31's treatment.

3. Deployment and data-migration gating verified only downstream — §17 DevOps (impl 8: a reference samples/deployment Bicep/OIDC sample + DEPLOYMENT.md now ship and lint clean, but a library can't self-deploy — real CD-to-Azure lives in consumers) and §8 Data (impl 8: migration application is policy-driven — services self-migrate at boot under ADR-030, but that is runtime, not a verifiable CI migration-apply step here). These remain mature mechanisms whose verifiable execution sits downstream — much of the residual axis gap.

   • Remediation: Add a CI step that applies/validates migrations against an ephemeral DB (closes the §8 gate) and a smoke-deploy of the samples/deployment sample (raises §17 toward proven-not-just-referenced).
   • Expected delta: +1 impl each on §8/§17; closes more of the Implementation-axis gap.

4. Compliance governance is consumer-owned; the in-repo guard verifies a mechanism, not the category — §30 (impl 8, maturity 3, weight 2): the headline §30 red flags are closed in-framework (the IAnonymizable erasure seam, AES-256-GCM at rest, and the shipped+tested PiiRedactor masking [Pii] members before logs/telemetry), and PiiErasureContractFitnessTests now forces a [Pii] type through PiiRedactor + IAnonymizable so the erasure contract is no longer un-gated. But that gate verifies the mechanism rather than gating a repo-wide convention (the structural PiiConventionTests scan is still vacuous — no PII-bearing type lives in Common's Domain), and the governing process — the personal-data inventory, DSAR/export endpoints, consent capture, residency verification, retention execution — is delegated to consumers. Maturity held at 3 (reviewed this cycle): the category as a whole is not automatically enforced.

   • Remediation: The in-repo mechanism is done; further maturity movement needs the consumer apps to carry the personal-data inventory + DSAR/consent/residency process the framework's [Pii]/IAnonymizable seams feed (documented in ADR-005).
   • Expected delta: +1 maturity on §30 (3→4) is a consumer-side governance lift, not an in-repo one; the framework half is complete.

5. The documented merge-gate list has drifted from live branch protection, and adjudications cite it RESOLVED 2026-07-21, same day it was raised (MMCA.Common PR #100, 658786b): the gate list and the reproduce snippet now name all eight live contexts, verified byte-identical against the protection API, and the file now directs readers to that API as authoritative over the committed copy. Recorded here for provenance; the finding as raised read: (§34 / §16, both impl 8) CONTRIBUTING.md:57-64 lists five required gates and calls webkit advisory, and its reproduce snippet (CONTRIBUTING.md:104-112,124) omits webkit, the Helpdesk consumer-source canary, and the perf gate, while live required_status_checks on main carries all eight contexts (branch-protection API, this run; ci.yml:116-118 already asserts all three browser engines are required). This is the rubric's "stale docs" red flag with a governance edge: the twentieth wave held §12 at Maturity 3 partly on this file's authority, and the score was only corrected a cycle later.

   • Remediation: Done. The gate list and reproduce snippet were synced and the API is now named as authoritative; the backlog item under #34 is closed with the proving reference.
   • Expected delta: no index move, as expected; it protects future scores from being mis-grounded and removes a §16/§34 stale-docs deduction. §34 holds M4/I8 this cycle; the next re-score can weigh the fix on fresh evidence.

Cross-repo comparison

How this repo's quality relates to the other consumers — where the framework's quality propagates, where a repo diverges or under-uses it, and where a consumer does better than the shared baseline — is maintained once, for all three repos, in ../Docs/Architecture/CrossRepoComparison.md (it is inherently cross-repo and would only drift if copied into each scorecard).