# Current State Scorecard (2026-03-25)

Purpose: provide a single operational view of architecture/debt progress with evidence references.

## RAG Legend

- Green: materially addressed for current stream
- Amber: partial progress, follow-on needed
- Red: unresolved/high risk remains

## Scorecard

| Area                              | Status | Current position                                                                                         | Evidence                                                                                                                  |
| --------------------------------- | ------ | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| API contract consistency          | Green  | Large endpoint clusters normalized on structured contracts with phase21 coverage.                        | `memory-bank/change-log.md` (endpoint hardening stream), `tests/phase21/endpoint-handler-contract.test.cjs`               |
| Actions/service decomposition     | Amber  | Shared clients and route builders introduced; monolith risk reduced but full domain split remains.       | `actions/clients/*`, `actions/services/*`, `memory-bank/debt-list.md`                                                     |
| Endpoint sprawl/proxy duplication | Amber  | Shared relay forwarding and helper reuse reduced duplication; long-tail handlers still exist.            | `pages/api/middleware/relayForwarding.js`, `context/architecture.md`                                                      |
| High-risk automation              | Green  | Focused checks now cover auth redirect safety, signed-delete/upload negatives, and EN/CY rewrite parity. | `tests/phase22/auth-redirect-safety.test.cjs`, `tests/phase22/i18n-route-parity.test.cjs`, `tests/phase22/index.test.cjs` |
| i18n parity assurance             | Amber  | Targeted parity checks in place; CI-level parity enforcement still pending.                              | `tests/phase22/i18n-route-parity.test.cjs`, `context/architecture.md`                                                     |
| Logging redaction consistency     | Amber  | Relay-side structured redaction improved; broader auth/email/file logging hardening remains open.        | `memory-bank/open-questions.md` (Q-001), `context/architecture.md`                                                        |
| Runtime canonicalization          | Red    | `server.js` and `server/server.js` ambiguity not yet formally closed.                                    | `memory-bank/architect-review.md`, `context/architecture.md`                                                              |

## Next execution focus

1. Sequence B: signed-request consolidation + logging hardening.
2. Sequence C: CI-level i18n parity gates + endpoint long-tail reduction.
3. Runtime canonicalization decision with explicit operational owner.

## Update cadence

- Update after every non-trivial architecture/debt slice.
- Keep this file aligned with:
    - `context/architecture.md`
    - `memory-bank/debt-list.md`
    - `memory-bank/change-log.md`