Architecture governance

MMCA.Store: Architecture Scorecard

Canonical, version-controlled scorecard for this repo: the single source of truth for MMCA.Store's architecture scores. This is Store's first in-repo governance artifact (previously its posture lived only in the workspace docs + memory). Scored against the rubric at ArchitectureEvaluationCriteria.md; framework-wide facts in ../MMCA.Common/FACTS.md. Remediation lives in RemediationBacklog.md; the cross-repo comparison in the workspace-internal Docs/Architecture/CrossRepoComparison.md (not published).

Rubric: ArchitectureEvaluationCriteria.md • Rubric version 2 (rebased 2026-09-04, ADR-110: §10 is Messaging & Integration Architecture at weight 3, re-scored against the v2 criteria on 2026-09-04 and CONFIRMED at M4/I8; §16 is AI-Native Application Architecture, N/A; Σweight 80→79; no score moved) • Date: 2026-09-04 • Two axes per category: Maturity (0-4, process/governance) and Implementation (0-10, substance/execution). Indices computed deterministically from the scores below. Verified against current source at HEAD 04afa39d (clean tree); framework dependency pinned at MMCA.Common. v1.185.0* (all 17 packages, lockstep, confirmed no divergence; ADRs are canonical in Website/docs-src/adr/, count/range owned by its README.md). What moved this cycle (2026-09-04 full re-score, 34 categories, two-pass with adversarial verification, pin v1.185.0, the first cycle scored against rubric v2): no score moves. 29 categories came back CONFIRMED at their prior values and four (§15, §20, §25, §31) came back FLAG, every one an adversarial rejection of a first-pass proposal rather than a found regression: §15 held I8 (the MAUI head is still in neither solution filter, MMCA.Store.CI.slnf:24-25 lists only the two web hosts, and three global NoWarn codes at Directory.Build.props:26 still carry no rationale; the new weekly maui-audit.yml is §32 substance by its own header), §20 held I7 for a fourth consecutive cycle (zero .css files changed since 44d9304c, the razor diff is the §5 folder renames, still exactly 30 Style=/CellStyle= occurrences across 14 razor files), §25 held M4 against a proposed DOWNGRADE (all three maturity legs verified live: the three sealed *RouteAuthorizationTests in MMCA.Store.CI.slnf:40,46,52 executed by the required build-and-test check, deploy.yml:220, and again by backend-test-gate, :375; store-NavigationFlow.md documents the per-actor flows; the role-gating commit c4adff2a is in history) with Implementation 8 confirmed and a NEW implementation lever named (the claim at store-NavigationFlow.md:166 that each actor's menu shows only its diagrammed routes is falsified by the framework NavMenu.razor:142 rendering /profile/sessions for every signed-in user and by /notifications/send being routable behind a bare [Authorize]), and §31 held I8 as a VERIFIED hold (the verifier's structured return lost its implementation number to a schema retry cap, but its text confirmed Maturity 4 on a fresh read, cost-guard being a job in deploy.needs at deploy.yml:622-624/:999/:1032, and rejected the 9 on unchanged mechanism: cost-guard.yml:7 states it never mutates anything and :94 prints a manual reset, so the rubric's automated-revert criterion is still unmet, and the tag set is one uniform costCenter/component pair with no per-service dimension, infra/main.bicep:113-119; the 2026-09-02 cost pass, commit f07eb000, is real substance, 0.25 vCPU / 0.5 Gi on all five apps at :1006, 25% trace sampling :184, 300s metric export :221-222, the legacy MMCAStore database archived and dropped :620-624, a 30-day / 1 GB-per-day Log Analytics cap foundation.bicep:36-42, and a daily ACR purge :88-98, but it refines criteria already credited inside the 8). §10 is scored against the rubric v2 criteria for the first time and returned CONFIRMED M4/I8 (broker topology and transport per ADR-066, poison-message handling per ADR-087, gateway edge scope per ADR-088, saga compensation in Orders/Saga/OrderCancelledSagaHandler.cs, the frozen ProductVariantChanged wire contract in the merge-gating IntegrationEventContractTests, and the both-tier broker freshness gate at deploy.yml:770/:999), discharging its rebase-time "carried pending re-score" caveat. Citation repairs only (no substance change), wholesale this cycle because the 2026-09-02 cost pass, the 2026-09-03 backend-test-gate job and the §5 feature-by-folder renames moved almost every cited line: deploy.yml anchors above :340 re-based throughout (e2e-gate :634-649, load-freshness :714-745, deploy.needs :999, the gate block :1026-1039, the main.bicep deploy :1189-1195, smoke :1227, rollback :1235/:1333), infra/main.bicep anchors re-based throughout (sloAlertSpecs :260, workbook :527, budget :548, per-service databases :631-658, LTR policy :660-672, Service Bus :686), §31's row anchors corrected from parameters it never cited to the budget, tag and guard lines, the renamed ShoppingCarts/ cart files and Inventory/InventoryAllocationService.cs re-based, the architecture-test paths updated to their new Cqrs//Ui//Governance/ folders, Order.cs anchors re-based after the LineCount column landed, Directory.Packages.props pins :8-105, and the DR drill-history table :186-189. Indices unchanged: Maturity 97.8%, Implementation 83.9%. Prior cycle, retained (2026-09-01 full re-score, 34 categories, two-pass with adversarial verification, pin v1.179.0): no score moves. 28 categories came back CONFIRMED at their prior values and six (§7, §12, §19, §20, §21, §27) came back FLAG, every one an adversarial rejection of a proposed first-pass uplift rather than a found regression: §7 held I8 for a third consecutive cycle (the rubric's independent-deployability criterion is still only half met: the BUILD half became per-image incremental, dirty classifier deploy.yml:138-161 and matrix :848-873, but the DEPLOY half is one azure/arm-deploy of the whole main.bicep (:1115-1121) with all five container-app images pinned to the same commit sha (:1025-1029) and a whole-fleet rollback (:1147, :1191), which is the rubric's "services that must deploy together" red flag), §12 held M3 for a fifth consecutive cycle (load-test.yml and the load-freshness block are byte-identical since 063c90dd: k6 stays a monthly cron plus dispatch, load-test.yml:18/:9; the gate is push-only, deploy.yml:663, and keeps its break-glass skip, :673-690; no perf check runs on the merge path) with Implementation 8 explicitly CONFIRMED by the verifier on that same evidence, so §12 is a VERIFIED hold this cycle, not an unread carry-forward, §19 held I8 (the new M88 superseded-load guard covers only 4 of the 7 detail pages plus CatalogBrowse, leaving CategoryDetail.razor.cs:92, CustomerDetail.razor.cs:106 and InventoryItemDetail.razor.cs:87 on the identical unguarded assign-after-await shape, and the client-side IUiReadCache opt-in was withdrawn 2026-08-31, commit e60bb8be, pending a per-service invalidation story), §20 held I7 for a third consecutive cycle (zero .css files changed, still exactly 30 Style=/CellStyle= occurrences across 14 razor files, the shared semantic classes consumed by 1 of the 6 MudDataGrid list pages, and both hosts' StoreHome stylesheets still hard-coding a hex palette behind !important), §21 held M3/I8 (the manual screen-reader results log still holds only the placeholder row, store-ACCESSIBILITY-SCREENREADER-PASS.md:68, with Implementation 8 re-verified), and §27 held I8 (no .resx or localization file has changed since the 2026-08-14 pin-bump commit 9571a963; CultureInfo.InvariantCulture amount formatting and the "(s)" pluralization workaround are both still live). §5's 2026-08-23 unverified carry-forward is discharged: it returned M4/I8 CONFIRMED on a fresh read. Citation repairs only (no substance change): §7's three evidence anchors re-based, §8's two migration-gate anchors re-based (model-drift deploy.yml:263-277, expand/contract :279-325), §12's deploy-chain and k6 anchors re-based with the now-closed BulkSetInventoryHandler N+1 removed, §16's narrated pin and package count corrected, §19's DI / CartStateService / ServerTokenStorageService anchors corrected, §20's stale "zero UI files changed" basis sentence and its sibling-page count corrected, §21's and §27's e2e-gate anchors re-based, §22's cron and engine-selection anchors re-verified, and §29's drill-history anchors re-based. The header's framework package count is also corrected from 15 to 17, the count FACTS.md owns. Indices unchanged: Maturity 97.8%, Implementation 83.9%. Earlier cycle, retained (2026-08-23 full re-score, 34 categories, two-pass with adversarial verification, pin v1.160.0): no score moves. 27 categories came back CONFIRMED at their prior values and seven (§5, §6, §7, §9, §12, §20, §31) came back FLAG, every one an adversarial rejection of a proposed first-pass move rather than a found regression: §6 held 8 (the only Source-side delta on the event path since the prior pin is a comment; the cross-service flow still carries its self-documented non-atomic publish window), §7 held 8 (the new evidence is a CI fitness gate, an enforcement gain on an already-M4 category, plus a second test that is vacuous in Store; the lockstep all-services deploy cap is confirmed live), §9 held 9 against a proposed DOWNGRADE (the contract-guard evidence base grew from the narrated two files to seven across all three services plus the frozen gRPC proto contract; only the row's narration and anchors were stale), §12 held M3 (the workflow files backing the axis are byte-unchanged since the cycle that rejected the identical uplift), §20 held 7 (zero .razor/.css/.razor.cs files changed since the last scored commit; the residual count corrects 31 to 30 as a counting fix, and the StoreHome stylesheets carry an additional previously un-cited hard-coded hex palette with !important), and §31 held 8 (the reversible-scale-events criterion is still unmet in its exact terms, the identical basis on which ADC's §31 uplift was rejected on 2026-08-01; the 300s metric-export interval and tighter ACR purge refine criteria already credited inside the 8). §5 is the one special case: its first-pass scorer returned no numbers, so M4/I8 is carried forward unverified this cycle and owes a fresh read at the next re-score. Citation repairs only (no substance change): MMCA.Store.CI.slnf:53 corrected to :53 throughout (line 52 is now MMCA.Store.Identity.UI.Tests), §8's migration-gate anchors re-based (model-drift deploy.yml:216-230, expand/contract :232-274), §9's guard narration and anchors corrected, §12's controller anchor re-based, and §27's MoneyExtensions anchor extended to :54-59. Indices unchanged: Maturity 97.8%, Implementation 83.9%. Earlier cycle, retained (2026-08-14 full re-score, 34 categories, two-pass with adversarial verification, pin v1.152.0): no score moves. All 34 categories were re-scored from evidence read at HEAD 9571a963; 28 came back CONFIRMED at their prior values and six (§5, §15, §17, §19, §20, §21) came back FLAG, every one an adversarial rejection of a proposed first-pass uplift rather than a found regression: §5 held 8 (horizontal technical folders persist inside module Application layers; generic-CRUD slices dispatch to shared framework handlers), §17 held 9 (no Bicep validate/what-if before the prod run; SQL publicNetworkAccess: Enabled, the identical caveat holding ADC at 9; single prod-only environment), §19 held 8 for the second consecutive cycle (IsDrawerOpen is still publicly settable and mutated outside the notify path, CartDrawer.razor:4, CartDrawer.razor.cs:145), §20 held 7 (the ProductList remediation converted 3 attributes while 31 identical Style=/CellStyle= occurrences remain across 14 razor files, five byte-identical to the new classes), and §21 held 3/8 (the screen-reader results log still holds only the placeholder row; the one delta since the prior pin is a single added dark-palette home axe scan, now 23 scans total). §15's verify pass proposed a correction to Implementation 7 on three suppression-hygiene gaps (the expired GHSA-2m69-gcr7-jv3q audit suppression at Directory.Build.props:54 whose own removal condition is met under the v1.152.0 pin, three undocumented global NoWarn codes at :26, and the MAUI head outside all CI enforcement); the user adjudicated a hold at the prior 8 with the three gaps recorded as §15's named backlog lever. Indices unchanged: Maturity 97.8%, Implementation 83.9%. Anchor refreshes only (no substance change): §16's stale narrated pin corrected to v1.152.0, §20/§21/§22 evidence re-anchored, and §22's nightly cadence note updated (since 2026-07-29 the scheduled matrix runs one alternating engine per week, widening the per-engine blind window to 7 days). Earlier cycle, retained (2026-07-28 full re-score, 34 categories, two-pass with adversarial verification, pin v1.131.0): three scores moved. §8 Data Architecture I8→9 on substance that landed after the prior cycle: the atomic conditional-UPDATE stock decrement (SET qty = qty - n WHERE qty >= n) with deterministic variant-id lock ordering closes the oversell read-modify-write race (InventoryAllocationService.cs:71), backed by a CK_InventoryItem_AvailableQuantity_NonNegative schema CHECK constraint (InventoryItemConfiguration.cs:27), an explicit single-transaction checkout write phase with the cross-service gRPC price fetch deliberately outside the lock window (CheckOutHandler.cs:90), and a fail-closed expand/contract destructive-migration guard in the required build-and-test job (deploy.yml:190); held at 9, not 10, because Identity has no concurrency round-trip test. §22 Responsive M4→3, the reopen the 2026-07-23 drift note predicted: the deploy-gating e2e-gate passes browsers: '["chromium"]' only (deploy.yml:494) and firefox/webkit run solely on the Mon/Thu schedule where they stay continue-on-error (e2e.yml:124,131), with no cross-browser freshness job in deploy.needs, so cross-engine verification is convention-enforced (Consistent=3), not automatic; the proposed Implementation 8→7 was adversarially REJECTED as a CI-cadence change mis-posted to the substance axis, matching ADC's M3/I8 on the identical mechanism. §27 i18n I9→7→8, a corrected over-grant rather than a regression (no i18n file changed since 2026-07-17): every price renders through Money.ToDisplayString(), which hard-codes a $ glyph and formats with CultureInfo.InvariantCulture (MMCA.Common .../MoneyExtensions.cs:20,41, consumed at CatalogBrowse.razor.cs:302), the rubric's explicit "manual number formatting ignoring culture" red flag, and pluralization is the "{0} item(s)" workaround rather than the i18n mechanism (CartDrawer.resx:20); the scorer proposed 7 and the user adjudicated 8, the conservative half of the band the verifier called defensible, since the gates and coverage behind the original grant are all intact. Three further first-pass proposals were adversarially REJECTED and held at prior: §12 M3→4 and I8→9 (no new merge-path perf gate exists; load-test.yml:17-18 is still monthly cron plus dispatch, and the load-freshness gate actually GAINED a break-glass skip at deploy.yml:577-592, a weakening), §19 I8→9 (no new state-management substance since the prior pin; IsDrawerOpen is still publicly settable outside the notify path), and §30 M4/I8→M3/I7 (every cited mechanism re-read live at HEAD, no gap found). Indices Maturity 98.4%→97.8%, Implementation 83.6%→83.9%. Earlier cycles, retained below, oldest first (2026-07-03 drift-plan execution, D1/D4/D5/D8/D9/D10): §21 Accessibility M3→4 and §28 Front-End Testing M3→4 (the Playwright + axe suite now gates the deploy: e2e-gate joined deploy.yml's needs after two consecutive fully green E2E runs, 28682334766 chromium 83/83 with firefox + webkit also green, confirmed by 28683063228), §12 Performance I7→8 (client Web Vitals are now measured in CI: WebVitalsTests writes LCP/CLS/TTFB/FCP artifacts per run), §23 Front-End Performance I6→8 (the public CatalogBrowse moved to server-side paging via GetPagedAsync + bounded MobileInfiniteScrollList, and cart enrichment now uses a targeted by-variant-id batch lookup instead of fetching the whole product list), and §32 Supply-Chain I7→8 (all three CI restores run --locked-mode and the suppress-aware vulnerability audit is now gating, D8/D9). The prior cycle's moves (2026-07-02 docs sweep: §16/§25/§20 M3→4, §27 scored M4/I7, §14 I6→9, §34 I7→9) are retained in the rows below. A same-day i18n completion sweep (2026-07-03, ADR-027 Decision 9) then lifted §27 Implementation 7→8 (zero residual literals incl. the cart/checkout/Stripe snackbars, dual CI gates, MudBlazor chrome + nav localized; indices Implementation 80.3%→80.4%). A subsequent 2026-07-11 drift-convergence cycle (drift plan D1-D13, pin v1.113.0) moved six scores: §1 SOLID Implementation 8→9 (the ctor-dependency-ceiling gate ConstructorDependencyCountTests + TimeProvider injection, D9), §9 API Implementation 8→9 (the v2 ServiceInfoController + two deploy-gating Contract tests, D12), §24 Forms Maturity 3→4 (the CI-gated FormsConventionTests, D11), §28 Front-End Testing Implementation 6→8 (bUnit breadth grown to 214 facts across 40 files, D7), §29 Resilience Implementation 8→9 (the dr-freshness deploy gate + weekly dr-drill cron + GracefulShutdownTests, D3), and §21 Accessibility Maturity 4→3 with Implementation 7→8 (honest reconciliation to ADC's M3: 22 axe scans + the new screen-reader runbook, but no dated SR pass yet, D6). D2 (MI-SQL activation wiring) and D4 (cost-guard deploy gate) also landed, with no §17/§31 score move. Indices Maturity 94.4%→94.1%, Implementation 80.4%→82.5%. A 2026-07-16 full re-score (34 categories, two-pass with adversarial verification) moved three scores: §13 Observability Implementation 8→9 (both prior deductions closed: the SLO workbook is provisioned in IaC at infra/main.bicep:274 and the per-alert infra/OPERATIONS.md runbook is in-repo; Maturity holds 3 because dashboards/runbooks are IaC/review-enforced, not CI-gated), and §18 UI Architecture + §19 State Management Maturity 3→4 (the sealed UIArchitectureConventionTests and StateManagementConventionTests subclasses of the shared v1.116.0 fitness bases run non-vacuously in the deploy-gating MMCA.Store.CI.slnf on every push and PR, the same mechanism that earned ADC its M4; their proposed Implementation bumps were adversarially rejected as enforcement gains mis-posted to the substance axis). The same re-score DECLINED the recorded maturity candidacies on §12 (k6 stays monthly/on-demand, not a merge gate) and §22 (firefox/webkit are still continue-on-error in e2e.yml:71, contrary to the backlog's promotion claim), and held the §20/§24/§27 impl candidacies. §17 Implementation 8→9 additionally banked on directly verified evidence: MI-SQL is active in production (repo variable USE_MANAGED_IDENTITY_SQL=true since 2026-07-12, activation deploy 29192048197 green), correcting the row's stale inert claim. Indices Maturity 94.1%→95.9%, Implementation 82.5%→83.0%. A same-day drift-analysis fold (2026-07-16, cross-repo ADC-vs-Store comparison, each move adversarially verified) moved two more scores: §23 Maturity 3→4 (the CWV budgets are hard assertions in the deploy-gating chromium e2e-gate, the identical evidence ADC's twentieth cycle credited; the earlier same-day hold at M3 had wrongly imported §12's k6-cadence reasoning) and §32 Implementation 8→9 (capability-level parity with ADC's I9: identical --locked-mode/audit/SBOM gating; the earlier FLAG reasoned from stale scorecard text, not capability). Doc corrections in the same fold: §16's narrated pin 1.113.0→1.116.0, §32's lock-file count 49→55, and the README gained the ADC-parity broker note (§33). Indices Maturity 95.9%→96.6%, Implementation 83.0%→83.3%. A 2026-07-17 full re-score (34 categories, two-pass with adversarial verification, pin v1.117.0) moved four scores: §5 Vertical Slice M3→4 and I7→8 (the sealed SliceCohesionTests subclass runs non-vacuously in the deploy-gating MMCA.Store.CI.slnf, the identical gate ADC credits at M4/I8; the layered-by-project hybrid stays a deliberate implementation-axis cap, no longer a maturity deduction), §13 Observability M3→4 (ObservabilityConventionTests machine-enforces the sloAlertSpecs-to-OPERATIONS.md pairing in the CI merge gate, closing exactly the "not CI-gated" reasoning that held M3), §22 Responsive M3→4 (the 2026-07-16 gate flip verified live: continue-on-error in e2e.yml is scoped to scheduled non-chromium runs only, so all three engines the e2e-gate invokes can fail a deploy; note 2026-07-23: this basis drifted on 2026-07-18 when the gate was cut to chromium-only, see the §22 row), and §27 i18n I8→9 (the PseudoLocalizationTests candidacy granted: pseudo-loc sentinel, no-overflow, and en-US leak probes run over Store's own /, /catalog, and /login pages in the deploy-gating chromium e2e-gate). The narrated framework pin refreshed 1.116.0→1.117.0 throughout. Indices Maturity 96.6%→98.4%, Implementation 83.3%→83.6%.

Executive summary

MMCA.Store is a .NET 10.0 (LangVersion preview) DDD/Clean Architecture e-commerce system (Catalog, Sales, Identity modules; Stripe checkout) extracted into independently-hosted services behind a YARP gateway, collaborating via Result-over-the-wire gRPC and MassTransit integration events on the outbox pattern. It consumes the shared MMCA.Common.* framework at v1.185.0 in lockstep with MMCA.ADC. Architecturally it is at ADC parity, and one prior assumption is corrected here: Store runs database-per-service (Store_Catalog/Store_Sales/Store_Identity, each with its own dbo.OutboxMessages; the legacy single MMCAStore DB is retained read-only as an archive/rollback only), not a single shared database. Its tactical depth (Clean Architecture, DDD, CQRS, the decorator pipeline, soft-delete/audit, RowVersion concurrency) is inherited framework substance, enforced by 23 NetArchTest fitness-test classes (shared *TestsBase subclasses from MMCA.Common.Testing.Architecture plus Store-local guards such as DataResidencyTests, PiiConventionTests, and IntegrationEventContractTests, ADR-015; the compile-time layer-guard MSBuild target is MMCA.Common-internal and does not run here).

The two axes are asymmetric: Maturity 97.8% vs Implementation 83.9%. Implementation is the weaker axis by ~14 points, a wider gap than ADC's. The maturity is high because Store inherits the framework's governed mechanisms and adds a strong operational floor (two-phase Bicep IaC, OIDC + Key Vault managed identity, a post-deploy smoke gate with auto-rollback, a drilled DR restore, a cost-guard surge-drift check, a k6 load test, and now a chromium E2E/axe deploy gate at ADC parity). The former §21/§28 gate gap and the §23 catalog fetch-all are closed this cycle, and the §27 residual unlocalized strings were closed by the same-day i18n completion sweep (I7→8; zero literals, dual CI gates); the former §18/§19 review-only maturity gap closed on 2026-07-16 (both are now CI-enforced by the shared convention fitness gates at M4), and the same-day drift-fold closed §23 (the deploy-gated CWV budget assertions credited at M4, ADC parity); the 2026-07-17 re-score then closed §5 (slice cohesion CI-gated, the hybrid kept as an implementation cap), §13 (the alert-to-runbook pairing gate), and §22 (the three-engine gate flip verified live). §22 reopened to maturity 3 on 2026-07-28 when the 2026-07-18 Actions-minute reduction was scored rather than frozen: the deploy gate runs chromium only, so §12 (k6 not a merge gate), §21 (screen-reader pass pending), and §22 (cross-engine verification convention-enforced) are the three below-4 maturity categories. §14's former coverage gap is closed: the deploy-gating floor is 51.6 measured on Store's own code (+MMCA.Store.*;-*.Tests, ~54% actual). Supply-chain (§32): the vulnerability gate is NuGetAudit + TreatWarningsAsErrors at restore plus the gating suppress-aware audit, the SBOM is a hard gate, and all three CI restores run --locked-mode.

Front-end security is the standout (§26, impl 9): access token in-memory, refresh token in an HttpOnly cookie (no localStorage), a hardened origin-pinned CSP, and runtime-config fetch (no secrets in the bundle), confirmed at ADC parity. No category is N/A: §27 Internationalization is scored (M4/I8 after the 2026-07-28 correction; the 2026-07-03 completion sweep and the 2026-07-17 pseudo-loc layout-tolerance grant had carried it to I9) since the ADR-027 en-US + es localization shipped with its CI-gated translation-completeness fitness function, superseding ADR-011's single-locale exclusion; the sweep added the LocalizedTextConventionTests literal gate and removed every residual hard-coded string. The 2026-07-28 correction is not a regression: both CI gates and the pseudo-loc E2E suite are intact and un-skipped, but culture-aware number formatting and mechanism-driven pluralization, two of the rubric's five criteria, are demonstrably unmet in current code, so the I9 was an over-grant.

Scorecard

Weighted = Maturity·weight / Implementation·weight. Axis-gap finding: §21 Accessibility is honestly M3/I8 (the chromium axe gate earns Implementation 8; Maturity caps at 3 pending a recorded manual screen-reader pass, matching ADC, D6), and §22 joined it at M3/I8 on 2026-07-28 for the mirror-image reason: strong substance, an enforcement mechanism that no longer covers what it certifies. Both are the healthy direction of the gap. The widest remaining M-over-I gap is §20 (M4/I7, residual inline styles), followed by §27 (M4/I8) where the enforcement is fully automatic but two rubric criteria are unmet in code.

Indices

• Maturity index = Σ(maturity×weight) ÷ Σ(weight×4) = 309 ÷ 316 = 97.8% (2026-09-04 full re-score, the first against rubric v2: no score moved; basis 29 rescored + 4 prior, the four FLAG categories §15/§20/§25/§31 keeping their prior scores under the merged-prior rule, each a verified hold; §10 re-scored on the v2 criteria at M4 (re-weighted 2→3 at the same-day rebase, +4) and §16 N/A removes 4×2 (−8), Σweight 80→79; prior figure 313 ÷ 320 = 97.8%; §12, §21, and §22 are the three categories at maturity 3)
• Implementation index = Σ(impl×weight) ÷ Σ(weight×10) = 663 ÷ 790 = 83.9% (2026-09-04 full re-score, the first against rubric v2: no score moved; basis 29 rescored + 4 prior, with §15/§20/§25/§31 holding their prior scores under the merged-prior rule (§31's verifier text confirmed the 8 even though its structured return carried no number); §10 re-scored on the v2 criteria at I8 (re-weighted 2→3 at the same-day rebase, +8) and §16 N/A removes 8×2 (−16), Σweight 80→79; prior figure 671 ÷ 800 = 83.9%)
• The implementation index reads directly against 100% (recalibration 2026-08-01: a 10 is awardable for an almost perfect implementation, so the former "attainable ceiling" line is retired). The denominators stay ×4 and ×10 so the trend line remains comparable to every prior cycle.
• Weaker axis: Implementation (execution quality), by ~14 points.
• N/A (excluded from denominators): §16 AI-Native Application Architecture (rubric v2, 2026-09-04: no product feature calls a model; weight 2 leaves both denominators, Σweight 79). §27 joined the denominators on the 2026-07-02 cycle (ADR-027 superseded ADR-011) and remains scored. §32 weight = 2 (default; raised to 3 only for the published framework MMCA.Common).

Top 5 strengths

1. Clean Architecture + DDD + CQRS depth, fitness-enforced: §3/§4 (impl 9): inherited framework substance, guarded by the shared NetArchTest suite (23 test classes, StoreArchitectureMap.cs:14-43).
2. Full microservices parity on a race-safe data layer, §7 (impl 8) / §8 (impl 9): database-per-service + per-service outbox + versioned gRPC + MassTransit broker + RS256/JWKS, extractable modules (re-anchored 2026-09-04: infra/main.bicep:631-658 per-service DBs, :686 Service Bus), with the oversell race closed by an atomic conditional UPDATE under deterministic lock ordering plus a schema CHECK backstop (InventoryAllocationService.cs:71, InventoryItemConfiguration.cs:27) and destructive migrations blocked at the merge gate (deploy.yml:279-325). (Corrects the prior "single shared DB" assumption.)
3. Exemplary DevOps / operational floor: §17 (impl 9) / §31 / §12: two-phase Bicep, OIDC + Key Vault MI, passwordless MI-SQL active in prod (2026-07-12), post-deploy smoke gate with auto-rollback (re-anchored 2026-09-04: deploy.yml:1227, rollback app list at :1235), cost-guard/dr-drill/load-test workflows.
4. Reference front-end security, §26 (impl 9): in-memory access token + HttpOnly refresh cookie (no localStorage), hardened origin-pinned CSP, runtime-config fetch (ServerTokenStorageService.cs:10-13, BlazorCspPolicyProvider.cs:71).
5. Drilled DR + real erasure path (§29 impl 9 / §30 impl 8): recorded 28.9-min restore (DISASTER-RECOVERY.md:186, drill-history table :186-189), the dr-freshness deploy gate + weekly cron + CI-gated GracefulShutdownTests, IAnonymizable anonymize-in-place + export + residency/PII fitness functions.

Top 5 risks

1. Accessibility maturity is capped pending a human pass: §21 (mat 3, weight 3): the 23-scan axe suite gates the deploy (impl 8), but the rubric pairs axe-in-CI with a recorded manual screen-reader pass and the ACCESSIBILITY-SCREENREADER-PASS.md results log is still empty (matching ADC's M3; re-verified 2026-09-04 at store-ACCESSIBILITY-SCREENREADER-PASS.md:68, placeholder row only).
   • Remediation: record a dated NVDA/VoiceOver pass in the runbook against the running app (needs a human; cannot be done headless). Expected: §21 mat 3→4.
2. Load evidence is capacity-planning cadence, not a merge gate: §12 (mat 3): the k6 suite is real with pass/fail thresholds and a load-freshness deploy gate, but the test itself runs monthly/on-demand (load-test.yml:21 cron, workflow_dispatch at :12; re-verified 2026-09-04, the only delta since being the synthetic-traffic header), so a latency regression can merge and deploy inside the freshness window. The window loosened further on 2026-07-28: load-freshness gained a break-glass skip (re-anchored 2026-09-04: deploy.yml:729-745, skip branch at :732, job at :714), justified but a weakening of the only deploy-chain hook §12 has.
   • Remediation: right-size deliberately: either accept the monthly cadence as the recorded posture (matching ADC's accepted §12 M3) or add a cheap latency-regression smoke to the merge path. Expected: decision recorded either way; §12 mat 3→4 only with a gate.
3. Design-system residual inline styles: §20 (impl 7, the widest M-over-I gap): the token convention is CI-enforced (BrandColorTokenTests), and the semantic-class pattern now exists (commit a1de5a89 converted ProductList's three attributes to .list-search-field/.grid-cell-count/.grid-cell-actions, store.css:28-40), but 30 Style=/CellStyle= occurrences remain across 14 razor files (count corrected from 31 on 2026-08-23), five byte-identical to those classes (CategoryList.razor:23,79,88; OrderList.razor:22; CustomerList.razor:81; re-verified byte-identical 2026-09-01 and 2026-09-04).
   • Remediation: sweep the remaining occurrences onto the now-existing semantic classes (the sibling admin list pages first, where the classes are byte-identical drop-ins). Expected: §20 impl 7→8.
4. Client validation short of server parity: §24 (impl 8): the four create forms' guard/dirty/validated-MudForm markers are CI-gated (FormsConventionTests, M4), but client validation stays MudForm-level rather than full FluentValidation parity with the server rules.
   • Remediation: mirror the remaining server-only rules client-side where they do not need the DB. Expected: §24 impl 8→9.
5. Cross-engine verification no longer gates a deploy: §22 (mat 3, reopened 2026-07-28, posture widened since): the e2e-gate runs chromium only (re-anchored 2026-09-04: deploy.yml:648, job at :634), and since 2026-07-29 the scheduled matrix runs one alternating engine per week (Monday firefox, Thursday webkit; crons e2e.yml:46-47, matrix expression :133-136) where it stays continue-on-error (:143), so a webkit-only layout or API break can reach production and sit undetected for up to 7 days per engine. The Actions-minute saving is real and the trade-off is recorded, so this is a priced risk, not an oversight.
   • Remediation: either add a cross-browser-freshness job to deploy.needs on the dr-freshness/load-freshness pattern (bounds the blind window without paying for three engines per deploy), or promote firefox/webkit back into the gate. Expected: §22 mat 3→4.

Cross-repo comparison

How Store relates to MMCA.Common (the framework) and MMCA.ADC (the sibling consumer) is maintained once, for all three repos, in the workspace-internal Docs/Architecture/CrossRepoComparison.md (not published).