Research-grade evidence, bounded chat storage, and blocking quality gates

.github/workflows/benchmarks.yml

@@ -19,20 +19,26 @@ jobs:
         with:
           python-version: '3.11'
 
-      - name: Install Performance Harness Dependencies
-        run: |
-          if [ -f "requirements.txt" ]; then pip install -r requirements.txt; fi
-          pip install pytest pytest-benchmark pytest-asyncio websockets cryptography fastapi
+      - name: Install benchmark dependencies
+        run: pip install -r requirements-dev.txt
 
       - name: Execute Profiling Suite & Track Latency Metrics
         env:
           PYTHONPATH: .
         run: |
-          echo "Executing high-concurrency message broadcast and cryptographic routine benchmarks..."
-          # Runs benchmarks if present, otherwise outputs structured system performance logging
-          if [ -d "tests/benchmarks" ]; then
-            pytest tests/benchmarks/ --benchmark-json=output.json
-          else
-            echo "Executing isolated performance profile for local encryption times and pub/sub message dispatch speeds..."
-            echo "Performance metrics captured successfully. Broadcast pipelines remain sub-millisecond."
-          fi
+          python -m benchmarks.run_benchmark --output benchmarks/latest.json
+          python -m pytest tests/test_benchmark.py -q
+          python - <<'PY'
+          import json
+          result = json.load(open("benchmarks/latest.json", encoding="utf-8"))
+          regression = result["comparison"]["throughput_change_percent"]
+          if regression < -15:
+              raise SystemExit(f"Throughput regression {regression}% exceeds 15% budget")
+          PY
+      - name: Upload benchmark evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: benchmark-report
+          path: |
+            benchmarks/latest.json
+            benchmarks/benchmark_report.md

.github/workflows/security-supply-chain.yml

@@ -54,8 +54,9 @@ jobs:
           format: sarif
           output: trivy-results.sarif
           severity: HIGH,CRITICAL
+          limit-severities-for-sarif: true
           ignore-unfixed: true
-          exit-code: "0"
+          exit-code: "1"
       - name: Upload SARIF
         uses: github/codeql-action/upload-sarif@v4
         with:
@@ -88,4 +89,4 @@ jobs:
           format: table
           severity: HIGH,CRITICAL
           ignore-unfixed: true
-          exit-code: "0"
+          exit-code: "1"

.github/workflows/trojanchat-hygiene.yml

@@ -26,11 +26,19 @@ jobs:
           python-version: "3.11"
           cache: pip
       - name: Install quality tooling
-        run: python -m pip install --upgrade pip ruff black
+        run: python -m pip install --upgrade pip ruff black bandit
       - name: Validate Python syntax
         run: python -m compileall -q app backend tests
-      - name: Run blocking Ruff correctness checks
-        run: ruff check app backend tests/test_api.py tests/test_chat_service.py tests/test_inference_cache.py --select E9,F63,F7,F82
+      - name: Run blocking Ruff and Bandit checks
+        run: |
+          ruff check backend/api.py backend/routes backend/services app/core/security.py benchmarks tests/test_api.py tests/test_backend_hardening.py tests/test_benchmark.py tests/test_security.py
+          bandit -q backend/api.py backend/config.py backend/routes/*.py backend/services/*.py app/core/inference_cache.py app/core/security.py app/services/chat_service.py -f json -o bandit-report.json
+      - name: Upload static-analysis report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: static-analysis-report
+          path: bandit-report.json
       - name: Publish formatting advisory
         run: |
           black --check app backend tests/test_api.py tests/test_chat_service.py tests/test_inference_cache.py \
@@ -63,7 +71,16 @@ jobs:
             tests/test_api.py \
             tests/test_chat_service.py \
             tests/test_inference_cache.py \
-            --cov=app \
+            tests/test_backend_hardening.py \
+            tests/test_benchmark.py \
+            tests/test_security.py \
+            --cov=backend.api \
+            --cov=backend.routes.chat_routes \
+            --cov=backend.routes.ws_routes \
+            --cov=backend.services.chat_service \
+            --cov=app.core.inference_cache \
+            --cov=app.services.chat_service \
+            --cov-fail-under=90 \
             --cov-report=term-missing \
             --cov-report=xml \
             --junitxml=pytest-results.xml \
@@ -90,20 +107,36 @@ jobs:
           cache: pip
       - name: Install audit tooling
         run: pip install pip-audit
-      - name: Generate dependency audit report
+      - name: Enforce dependency audit
         run: |
-          set +e
           pip-audit -r requirements.txt --progress-spinner off --format json --output pip-audit.json
-          status=$?
-          echo "pip-audit completed with status ${status}; findings are retained as an artifact for triage."
-          exit 0
       - name: Upload dependency audit
         uses: actions/upload-artifact@v4
         with:
           name: pip-audit-report
           path: pip-audit.json
           if-no-files-found: warn
 
+  frontend-build:
+    name: "Continuous Integration / Frontend Build"
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install locked dependencies
+        run: npm ci --ignore-scripts
+      - name: Enforce high-severity dependency audit
+        run: npm audit --audit-level=high
+      - name: Build production frontend
+        run: npm run build
+
   container-smoke-test:
     name: "Deployment / Container Build & Smoke Test"
     needs: test-matrix
@@ -126,7 +159,7 @@ jobs:
 
   release-readiness:
     name: "Release Engineering / Artifact Readiness"
-    needs: [test-matrix, dependency-audit, container-smoke-test]
+    needs: [test-matrix, dependency-audit, frontend-build, container-smoke-test]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

CHANGELOG.MD

@@ -1,15 +1,33 @@
 # Changelog
 All notable changes to TrojanChat will be documented in this file.
 
+## [Unreleased]
+### Added
+- Reproducible before/after latency, throughput, and peak-memory benchmark with raw JSON evidence.
+- Unit and integration tests for bounded storage, negative API cases, and WebSocket lifecycle.
+- CodeQL default-setup documentation, blocking static/security scans, audit, and production checklist.
+
+### Changed
+- Canonical critical-path coverage is enforced at 90%.
+- Message retention is bounded and thread-safe; API inputs and history queries are constrained.
+
+### Performance
+- Reference run reduced peak Python allocations by 80.06% with a 6.8% throughput tradeoff.
+
+### Security
+- Sanitized internal errors and changed dependency/Trivy findings from advisory to blocking.
+- Upgraded Next.js from 14.2.15 to 15.5.20 to remove current HIGH-severity advisories; added a blocking frontend audit and production build.
+- Removed pip/setuptools/wheel build tooling from the runtime image and constrained SARIF output to the declared HIGH/CRITICAL policy.
+
 ## [0.2.0] - 2026-04-02
 ### Changed
 - **Python runtime**: Docker base image upgraded from `python:3.10-slim` to `python:3.12-slim`
-- **CI/CD**: GitHub Actions updated — `actions/checkout@v3→v4`, `actions/setup-python@v4→v5`, Python `3.11→3.12`
+- **CI/CD**: GitHub Actions updated — `actions/checkout@v3→v4`, `actions/setup-python@v4→v5`, Python `3.11→3.12`
 - **CI/CD**: Fixed `backend/requirements.txt` reference (created missing file) and corrected test runner path
 - **requirements.txt**: Pinned minimum versions for all Python dependencies; added `pydantic-settings>=2.5.0`, `fastapi>=0.115.0`, `uvicorn>=0.30.0`, `httpx>=0.27.0`, `pytest-asyncio>=0.24.0`
 - **Pydantic v2**: Migrated `BaseSettings` import in `app/core/app/core/config.py` from `pydantic` to `pydantic_settings` package
 - **Deprecation fixes**: Replaced `datetime.utcnow()` (deprecated in Python 3.12) with `datetime.now(timezone.utc)` in `mcp_adapter.py`, `app/core/security.py`, and `backend/services/chat_service.py`
-- **Node.js (server/)**: Upgraded dependencies — `express@4.18→4.21`, `socket.io@4.7→4.8`, `mongoose@7→8`, `dotenv@16.0→16.4`, `jest@29.5→29.7`, `supertest@6→7`, `nodemon@2→3`
+- **Node.js (server/)**: Upgraded dependencies — `express@4.18→4.21`, `socket.io@4.7→4.8`, `mongoose@7→8`, `dotenv@16.0→16.4`, `jest@29.5→29.7`, `supertest@6→7`, `nodemon@2→3`
 
 ### Breaking Changes
 - **Pydantic v2**: `BaseSettings` is no longer exported from `pydantic`; it requires the `pydantic-settings` package. Run `pip install pydantic-settings` or use the updated `requirements.txt`.
@@ -31,4 +49,3 @@ All notable changes to TrojanChat will be documented in this file.
 ### Security
 - Added JWT expiration
 - Added request rate limiting
-

Dockerfile

@@ -7,7 +7,9 @@ WORKDIR /build
 COPY requirements.txt .
 RUN python -m venv /opt/venv \
     && /opt/venv/bin/pip install --upgrade pip \
-    && /opt/venv/bin/pip install -r requirements.txt
+    && /opt/venv/bin/pip install -r requirements.txt \
+    && /opt/venv/bin/pip uninstall --yes setuptools wheel \
+    && /opt/venv/bin/pip uninstall --yes pip
 
 FROM python:3.11-slim AS runtime
 
@@ -16,7 +18,11 @@ ENV PATH=/opt/venv/bin:$PATH \
     PYTHONDONTWRITEBYTECODE=1 \
     PYTHONPATH=/app
 
-RUN useradd --create-home --uid 10001 appuser
+# The base image ships build tooling that is unnecessary at runtime. Removing it
+# also prevents scanners from treating setuptools' vendored build dependencies
+# as remotely exploitable application packages.
+RUN python -m pip uninstall --yes setuptools wheel \
+    && useradd --create-home --uid 10001 appuser
 WORKDIR /app
 
 COPY --from=builder /opt/venv /opt/venv

README.md

@@ -1,4 +1,14 @@
 # TrojanChat
+[![CI](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/trojanchat-hygiene.yml/badge.svg)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/trojanchat-hygiene.yml)
+[![Benchmarks](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/benchmarks.yml/badge.svg)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/benchmarks.yml)
+[![Security](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/security-supply-chain.yml/badge.svg)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/security-supply-chain.yml)
+[![CodeQL](https://img.shields.io/badge/CodeQL-default%20setup-enabled-2F80ED?logo=github)](https://github.com/CoreyLeath-code/TrojanChat/security/code-scanning)
+[![Release](https://img.shields.io/github/v/release/CoreyLeath-code/TrojanChat?display_name=tag)](https://github.com/CoreyLeath-code/TrojanChat/releases)
+[![Coverage](https://img.shields.io/badge/critical--path%20coverage-92.57%25-success)](#engineering-evidence)
+[![Throughput](https://img.shields.io/badge/throughput-40%2C326.50%20msg%2Fs-blue)](#research-benchmark)
+[![Peak memory](https://img.shields.io/badge/peak%20memory-4.228%20MiB-blueviolet)](#research-benchmark)
+[![Memory improvement](https://img.shields.io/badge/memory%20reduction-80.06%25-success)](#research-benchmark)
+[![Benchmark date](https://img.shields.io/badge/benchmark-2026--07--18-informational)](benchmarks/benchmark_report.md)
 ![Python](https://img.shields.io/badge/Python-3.11%20%7C%203.12-3776AB?logo=python&logoColor=white)
 ![FastAPI](https://img.shields.io/badge/FastAPI-Backend-009688?logo=fastapi&logoColor=white)
 ![Streamlit](https://img.shields.io/badge/Streamlit-Frontend-FF4B4B?logo=streamlit&logoColor=white)
@@ -30,6 +40,49 @@
 
 TrojanChat is a production-hardened, multi-client chat architecture optimized for high-concurrency environments. Moving away from standard blocking network sockets, this platform leverages asynchronous event loops to maintain thousands of concurrent connections efficiently while maintaining structural memory efficiency.
 
+## Engineering evidence
+
+| Evidence | Current result | Enforcement |
+|---|---:|---|
+| Unit + integration tests | 30 passing locally | Python 3.11/3.12 CI matrix |
+| Critical-path coverage | 92.57% | CI fails below 90% |
+| Median / P99 write latency | 1,239.880 / 1,303.501 ms per 50k-message run | Reproducible benchmark artifact |
+| Throughput | 40,326.50 messages/s | Regression budget: no worse than -15% |
+| Peak Python memory | 4.228 MiB | 80.06% below legacy baseline |
+| Static analysis | Ruff + Bandit | Blocking; JSON report retained |
+| Security | CodeQL, Gitleaks, pip-audit, Trivy | Blocking on secrets and actionable vulnerabilities |
+| Supply chain | CycloneDX SBOM + Dependabot | Artifact per run; weekly updates |
+
+The reference benchmark uses Windows 11, Python 3.12.13, 50,000 messages, seven iterations,
+and a 10,000-message retention bound. Results describe this microbenchmark—not end-to-end network
+latency or a production SLO. See the [benchmark methodology](benchmarks/benchmark_report.md),
+[audit](docs/AUDIT.md), [architecture](ARCHITECTURE.md), [deployment guide](DEPLOYMENT.MD), and
+[production checklist](docs/PRODUCTION_CHECKLIST.md).
+
+## Research benchmark
+
+**Question.** Can bounded, synchronized retention stop unbounded memory growth without exceeding a
+15% write-throughput regression budget?
+
+| Metric | Legacy list | Bounded, synchronized store | Relative change |
+|---|---:|---:|---:|
+| Mean latency / 50k writes | 1,141.831 ms | 1,237.607 ms | +8.4% |
+| Median latency / 50k writes | 1,155.519 ms | 1,239.880 ms | +7.3% |
+| P95 / P99 latency | 1,221.577 ms | 1,303.501 ms | +6.7% |
+| Minimum / maximum latency | 1,063.323 / 1,221.577 ms | 1,180.249 / 1,303.501 ms | observed range |
+| Throughput | 43,270.60 msg/s | 40,326.50 msg/s | **−6.8%** |
+| Peak Python allocations | 21.205 MiB | 4.228 MiB | **−80.06%** |
+
+**Method.** Seven independent iterations insert 50,000 structurally identical messages. Both
+variants generate UUID4 identifiers and UTC timestamps; only storage and synchronization differ.
+Latency uses `time.perf_counter`, memory uses `tracemalloc`, and throughput is derived from median
+elapsed time. The raw, versioned result is [`benchmarks/latest.json`](benchmarks/latest.json).
+
+**Interpretation.** The optimized store remains inside the pre-declared 15% throughput budget while
+substantially reducing peak Python allocations. The experiment does not measure network transport,
+JSON serialization, Redis, database persistence, multi-process contention, CPU utilization, or RSS.
+CI reruns the benchmark on Ubuntu/Python 3.11 and uploads the raw result for per-commit comparison.
+
 ---
 
  Architectural Overview
@@ -45,7 +98,7 @@ The platform splits operations across an event-driven system architecture to eli
 
 ---
 
-## 🚀 Getting Started
+## 🚀 Getting Started
 
 ### Prerequisites
 * Python 3.11 or higher
@@ -74,20 +127,20 @@ The platform splits operations across an event-driven system architecture to eli
     python client.py "Corey"
     ```
 
-├── chat_core/
-│   ├── __init__.py
-│   ├── config.py             # <-- Application security settings & validation rules
-│   ├── crypto_broker.py      # <-- Challenge generation and key distribution logic
-│   └── connection_manager.py # <-- Tier 5: High-concurrency socket tracking state loop
-├── deployment/
-│   ├── gateway.conf          # <-- Tier 2: Envoy or Nginx reverse-proxy ingress rules
-│   ├── docker-compose.yml    # <-- Full local container environment mesh (Redis, App, Postgres)
-│   └── Dockerfile            # <-- Minimal production runtime workspace blueprint
-├── tests/
-│   ├── unit/                 # <-- Job #3: Asynchronous socket validation benches
-│   └── schemas/              # <-- Job #7: JSON framing contract tests
-├── dailylog.md               # <-- Maintenance operations history ledger
-└── requirements.txt          # <-- Managed dependencies
+├── chat_core/
+│   ├── __init__.py
+│   ├── config.py             # <-- Application security settings & validation rules
+│   ├── crypto_broker.py      # <-- Challenge generation and key distribution logic
+│   └── connection_manager.py # <-- Tier 5: High-concurrency socket tracking state loop
+├── deployment/
+│   ├── gateway.conf          # <-- Tier 2: Envoy or Nginx reverse-proxy ingress rules
+│   ├── docker-compose.yml    # <-- Full local container environment mesh (Redis, App, Postgres)
+│   └── Dockerfile            # <-- Minimal production runtime workspace blueprint
+├── tests/
+│   ├── unit/                 # <-- Job #3: Asynchronous socket validation benches
+│   └── schemas/              # <-- Job #7: JSON framing contract tests
+├── dailylog.md               # <-- Maintenance operations history ledger
+└── requirements.txt          # <-- Managed dependencies
 
 
  Engineering Roadmap

app/core/security.py

@@ -2,9 +2,9 @@
 
 import os
 from datetime import datetime, timedelta, timezone
-from typing import Optional
 
-from jose import JWTError, jwt
+import jwt
+from jwt import InvalidTokenError
 from passlib.context import CryptContext
 
 SECRET_KEY = os.getenv("SECRET_KEY")
@@ -27,7 +27,7 @@ def verify_password(plain_password: str, hashed_password: str) -> bool:
     return pwd_context.verify(plain_password, hashed_password)
 
 
-def create_access_token(data: dict, expires_delta: Optional[timedelta] = None):
+def create_access_token(data: dict, expires_delta: timedelta | None = None):
     to_encode = data.copy()
 
     expire = datetime.now(timezone.utc) + (
@@ -42,5 +42,5 @@ def verify_token(token: str):
     try:
         payload = jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
         return payload
-    except JWTError:
-        return None
+    except InvalidTokenError:
+        return None

backend/api.py

@@ -1,6 +1,9 @@
 from fastapi import FastAPI
+
 from backend.config import settings
 from backend.routes.chat_routes import router as chat_router
+from backend.routes.ws_routes import router as websocket_router
+
 
 def create_app() -> FastAPI:
     """
@@ -15,6 +18,7 @@ def create_app() -> FastAPI:
 
     # Include application routes
     app.include_router(chat_router, prefix="/chat", tags=["Chat"])
+    app.include_router(websocket_router, tags=["WebSocket"])
 
     @app.get("/", tags=["Health"])
     async def root():

backend/config.py

@@ -18,7 +18,7 @@ class Settings:
     API_VERSION: str = "v1"
 
     # Local development settings
-    HOST: str = os.getenv("HOST", "0.0.0.0")
+    HOST: str = os.getenv("HOST", "127.0.0.1")
     PORT: int = int(os.getenv("PORT", "10000"))
 
 settings = Settings()