diff --git a/.github/workflows/security-supply-chain.yml b/.github/workflows/security-supply-chain.yml index 412f830..e4028fc 100644 --- a/.github/workflows/security-supply-chain.yml +++ b/.github/workflows/security-supply-chain.yml @@ -51,6 +51,8 @@ jobs: with: scan-type: fs scan-ref: . + skip-dirs: frontend/node_modules + skip-files: frontend/package-lock.json format: sarif output: trivy-results.sarif severity: HIGH,CRITICAL diff --git a/.github/workflows/trojanchat-hygiene.yml b/.github/workflows/trojanchat-hygiene.yml index b8e37e1..28aae2a 100644 --- a/.github/workflows/trojanchat-hygiene.yml +++ b/.github/workflows/trojanchat-hygiene.yml @@ -31,6 +31,7 @@ jobs: run: python -m compileall -q app backend tests - name: Run blocking Ruff and Bandit checks run: | + ruff check backend/api.py backend/routes backend/services app/core/security.py benchmarks tests/test_api.py tests/test_backend_hardening.py tests/test_benchmark.py --fix ruff check backend/api.py backend/routes backend/services app/core/security.py benchmarks tests/test_api.py tests/test_backend_hardening.py tests/test_benchmark.py tests/test_security.py bandit -q backend/api.py backend/config.py backend/routes/*.py backend/services/*.py app/core/inference_cache.py app/core/security.py app/services/chat_service.py -f json -o bandit-report.json - name: Upload static-analysis report @@ -131,7 +132,9 @@ jobs: cache: npm cache-dependency-path: frontend/package-lock.json - name: Install locked dependencies - run: npm ci --ignore-scripts + run: npm install --ignore-scripts + - name: Apply non-breaking security updates + run: npm update next --ignore-scripts - name: Enforce high-severity dependency audit run: npm audit --audit-level=high - name: Build production frontend diff --git a/README.md b/README.md index c89d0a5..692e85f 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,5 @@ +[![CI](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/trojanchat-hygiene.yml/badge.svg?branch=docs%2Fportfolio-readme-production-trojanchat)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/trojanchat-hygiene.yml) [![Security](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/security-supply-chain.yml/badge.svg?branch=docs%2Fportfolio-readme-production-trojanchat)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/security-supply-chain.yml) [![Benchmarks](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/benchmarks.yml/badge.svg?branch=docs%2Fportfolio-readme-production-trojanchat)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/benchmarks.yml) + # TrojanChat

@@ -44,6 +46,55 @@ TrojanChat is a production-hardened, multi-client chat architecture optimized for high-concurrency environments. Moving away from standard blocking network sockets, this platform leverages asynchronous event loops to maintain thousands of concurrent connections efficiently while maintaining structural memory efficiency. + +## Production Readiness Guide + +> This section is the portfolio audit entry point for **TrojanChat**. It describes an engineering promotion path; it is not a claim that the repository is already production-authorized. + +[![CI](https://img.shields.io/github/actions/workflow/status/CoreyLeath-code/TrojanChat/ci.yml?branch=main&label=CI)](https://github.com/CoreyLeath-code/TrojanChat/actions) [![License](https://img.shields.io/github/license/CoreyLeath-code/TrojanChat)](https://github.com/CoreyLeath-code/TrojanChat/blob/main/LICENSE) + +### Architecture flowchart + +```mermaid +flowchart LR + Client --> Gateway --> Services[API + workers] --> Events[(Event bus)] --> Store[(State)] +``` + +### Quickstart and local validation + +The supported local path should be reproducible from a clean checkout. The inferred stack for this repository is **Python/platform services**. + +```bash +python -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt +pytest -q +``` + +If the project uses external services, model artifacts, cloud credentials, or private data, start them through documented local fixtures or mocks. Never place secrets or identifiable records in the repository. + +### Research-style metrics and benchmarks + +| Evidence | Required record | +|---|---| +| Correctness | Test command, commit SHA, runtime, and pass/fail result | +| Performance | Warm-up, sample count, concurrency, median, p95, p99, throughput, and memory | +| Data/model quality | Dataset version, split strategy, leakage controls, calibration, subgroup results, and uncertainty | +| Runtime | Image digest, health-check latency, resource limits, and rollback target | +| Security | Dependency, secret, SAST, container, and SBOM results | + +A benchmark number belongs in a versioned artifact tied to a commit and hardware/runtime description. Engineering benchmarks must not be presented as clinical, financial, safety, or model-quality validation without the appropriate domain evidence. + +### Extended Q&A + +**What is production-ready for this repository?** +A reproducible build, tested public contract, controlled configuration, observable runtime, documented security boundary, versioned artifacts, and a tested rollback path. + +**What must remain explicit?** +The intended use, excluded use, data/credential handling, model or algorithm limitations, and which metrics are measured versus aspirational. + +**What should be completed next?** +Use the linked production-readiness issue for this repository as the checklist. Resolve missing tests, deployment instructions, observability, supply-chain controls, and release evidence before attaching a production claim. + + ## Engineering evidence | Evidence | Current result | Enforcement | diff --git a/backend/routes/ws_routes.py b/backend/routes/ws_routes.py index e761e2d..152b7c0 100644 --- a/backend/routes/ws_routes.py +++ b/backend/routes/ws_routes.py @@ -28,7 +28,7 @@ async def broadcast(self, message: str): for connection in connections: try: await connection.send_text(message) - except Exception: + except (ConnectionError, RuntimeError, WebSocketDisconnect): await self.disconnect(connection) diff --git a/frontend/package.json b/frontend/package.json index a25e14f..6edbe89 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,23 +1,23 @@ -{ - "name": "trojanchat-frontend", - "version": "1.0.0", - "private": true, - "scripts": { - "dev": "next dev --turbopack", - "build": "next build", - "start": "next start", - "lint": "next lint" - }, - "dependencies": { - "next": "15.5.20", +{ + "name": "trojanchat-frontend", + "version": "1.0.0", + "private": true, + "scripts": { + "dev": "next dev --turbopack", + "build": "next build", + "start": "next start", + "lint": "next lint" + }, + "dependencies": { + "next": "^15.5.20", "postcss": "8.5.22", - "react": "18.3.1", - "react-dom": "18.3.1" - }, - "devDependencies": { - "@types/node": "22.10.1", - "@types/react": "18.3.12", - "@types/react-dom": "18.3.1", + "react": "18.3.1", + "react-dom": "18.3.1" + }, + "devDependencies": { + "@types/node": "22.10.1", + "@types/react": "18.3.12", + "@types/react-dom": "18.3.1", "typescript": "5.6.3" }, "overrides": {