Skip to content

Changelog

All notable changes to this assessment are documented here. Format: Keep a Changelog. Versioning: SemVer — MAJOR = breaking item or scoring/report changes, MINOR = items, questions, or additive scoring/report behavior, PATCH = wording fixes without semantic change.

[Unreleased]

[0.3.0] - 2026-10-20

Added

  • Added illustrative evidence examples for states 1–4 on code review and recovery planning; they are explicitly unvalidated pending pilot sessions.
  • Added a pilot record template for session timing, completion, interview friction, independent ratings, and cross-session findings.
  • Score calculator now supports separately scored custom practices, exports their report-local IDs, and warns when custom sets or weights change between reports.
  • Added a 7.4 question on access to coaching and mentoring relationships. Existing item IDs remain unchanged. Release impact: MINOR.
  • Added a 4.6 question on how the team prioritizes known bugs against new feature work. Existing item IDs remain unchanged. Release impact: MINOR.
  • Added a 3.6 question on safe service initialization, readiness, and shutdown. Existing item IDs remain unchanged. Release impact: MINOR.
  • Added a 7.3 question on structured, role-relevant, and consistent interview practices. Existing item IDs remain unchanged. Release impact: MINOR.
  • Added 6.1 questions on communicating security priorities, tracking security measures, and reinforcing secure-coding practices. Existing item IDs remain unchanged. Release impact: MINOR.
  • Added a 5.8 question on managing and injecting non-secret configuration per environment. Existing item IDs remain unchanged. Release impact: MINOR.
  • Added a 5.4 question on artifact integrity, signing, and provenance. Existing item IDs remain unchanged. Release impact: MINOR.
  • Added item 1.10 on user experience and accessibility; existing item IDs remain unchanged. Release impact: MINOR.
  • Defined report-local custom practice IDs and separate supplemental scoring under “Other,” so custom rows cannot inflate standard category scores.
  • Standalone score calculator with inputs generated from assessment item headings, score summaries, top gaps, and comparison warnings.
  • Optional 15-item lite assessment profile with a 30–60 minute planning target for discovery and focused re-checks.
  • Markdown checkpoint template and agent guidance for pausing and resuming interviews with confirmed answers, notes, and evidence references preserved.
  • coverage/ directory documenting point-by-point coverage of external frameworks, starting with the Joel Test (9/12 full, 3/12 partial), plus a template for future mappings.
  • Twelve-Factor Methodology coverage mapping (5/12 full, 6/12 partial, 1 deliberately not covered).
  • OWASP SAMM (OpenSAMM) coverage mapping against SAMM v2's 15 practices (6/15 full, 9/15 partial).
  • ISO 25010 coverage mapping against the eight product quality characteristics (5/8 full, 3/8 partial), with a note on the 2023 revision's Safety characteristic.
  • Fictional full sample report with checked weighted scores and gap priorities, including N/A and unknown answers.

Changed

  • Completed a wording consistency review across all seven category files. Clarified four item titles while preserving item IDs, questions, and scoring meaning.
  • Release impact: MINOR. Custom practices use a supplemental score and do not alter the standard score formula; prior reports that scored multiple practices through a single “Other” row are not directly comparable to the supplemental custom score.
  • Clarified that importance weights express team priorities while state 4 remains the common score reference. Defined confirmed, unknown, deferred, unconfirmed, N/A, and skipped answers; incomplete category scores are provisional, include coverage counts, and exclude unconfirmed rows from calculations.
  • Added report context for system boundary, environment, selected profile/items, and evidence date, plus rules for changed weights and scope. Existing calculations for complete assessments remain unchanged. Release impact: MINOR; 0.1.1 incomplete reports are not comparable to provisional scores because their missing-answer behavior was undefined.
  • Clarified the boundaries between review interaction and ownership, unit-test quality and release regression confidence, and regression confidence and CI/CD enforcement. Item IDs and assessed practices are unchanged.
  • Set expectations for report audience and participant review, and added guidance for summarizing sensitive interview evidence without unnecessary identifying details.

[0.1.1] - 2026-07-18

Changed

  • Project title renamed to "Software Project Maturity Assessment" (was "Software Engineering Maturity Assessment"); index and report titles aligned.
  • README description rewritten around the set-your-own-bar → measure → gap-roadmap flow and the assessor-or-LLM-agent choice.

[0.1.0] - 2026-07-18

Added

  • Structured item blocks (why it matters, what good looks like, questions to ask, red flags) for all categories.
  • Importance/state scoring model with gap priority and category scores.
  • AGENT.md LLM interview prompt and templates/report.md report template.
  • LICENSE file (CC BY 4.0), this changelog, versioning policy.
  • Quick start instructions and single-file bundle service-audit-full.md (built by scripts/build-bundle.sh) for attaching the whole assessment to a web-based LLM chat.

Changed

  • Split ASSESSMENT.md into per-category files under assessment/; ASSESSMENT.md is now the index.
  • Moved "Team Health & Culture" from Processes (2.14) to Culture (7.5).
  • Scoped 1.8 Compliance & Legal to product obligations; cross-referenced 6.10 for operations.
  • Rescoped 6.7 to the org-wide vulnerability scanning and triage program; day-to-day dependency patching hygiene cross-referenced to 4.14.

Fixed

  • Numbering and wording defects ("13" item, "Feedbacks", "Groundrules", "Unit-tests", README link spacing).