Historical pre-upgrade audit: broken backend/frontend CI, unsafe dependencies, unbounded state, and evidence gaps

[CoreyLeath-code]

Historical record: These findings were recorded before merged audit/upgrade work. Checked items indicate reported remediation in linked PRs; current main still requires revalidation.

Representative baselines: 332804c, 3a83ee4, 588436c.

• CI lacked pytest/httpx/async support, collected unsupported tests, and frontend builds had misplaced/corrupted components.
• Missing packages/imports, truncated backend code, eager external-AI initialization, and package shadowing blocked reliable startup/testing.
• Upload/API paths had vulnerable multipart, debug/error leakage, missing bounds, and incomplete validation.
• Docs contained stale stacks, broken formatting, placeholder panels, and implemented/planned ambiguity.
• Deployment lacked consistent non-root container, health smoke, security scans, SBOM, release contract, and governance.
• Chat history was unbounded and not thread-safe; WebSocket router was not mounted in the canonical app.
• Username/content/history bounds and extra-field rejection were incomplete; storage failures could expose exception text.
• Local bind default was broad; python-jose pulled vulnerable ecdsa.
• Performance/quality claims lacked reproducible comparative JSON and blocking 90% critical-path coverage.

Remediation evidence: PR #2, PR #13, PR #14, PR #15, PR #16, PR #18, and PR #27.

Follow-up

• Revalidate bounded retention/concurrency, JWT, WebSocket lifecycle, 90% gate, benchmark tradeoffs, scans, container, and release workflows.