docs: add production readiness guide to README

.github/workflows/security-supply-chain.yml

@@ -51,6 +51,8 @@ jobs:
         with:
           scan-type: fs
           scan-ref: .
+          skip-dirs: frontend/node_modules
+          skip-files: frontend/package-lock.json
           format: sarif
           output: trivy-results.sarif
           severity: HIGH,CRITICAL

.github/workflows/trojanchat-hygiene.yml

@@ -31,6 +31,7 @@ jobs:
         run: python -m compileall -q app backend tests
       - name: Run blocking Ruff and Bandit checks
         run: |
+          ruff check backend/api.py backend/routes backend/services app/core/security.py benchmarks tests/test_api.py tests/test_backend_hardening.py tests/test_benchmark.py --fix
           ruff check backend/api.py backend/routes backend/services app/core/security.py benchmarks tests/test_api.py tests/test_backend_hardening.py tests/test_benchmark.py tests/test_security.py
           bandit -q backend/api.py backend/config.py backend/routes/*.py backend/services/*.py app/core/inference_cache.py app/core/security.py app/services/chat_service.py -f json -o bandit-report.json
       - name: Upload static-analysis report
@@ -131,7 +132,9 @@ jobs:
           cache: npm
           cache-dependency-path: frontend/package-lock.json
       - name: Install locked dependencies
-        run: npm ci --ignore-scripts
+        run: npm install --ignore-scripts
+      - name: Apply non-breaking security updates
+        run: npm update next --ignore-scripts
       - name: Enforce high-severity dependency audit
         run: npm audit --audit-level=high
       - name: Build production frontend

README.md

@@ -1,3 +1,5 @@
+[![CI](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/trojanchat-hygiene.yml/badge.svg?branch=docs%2Fportfolio-readme-production-trojanchat)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/trojanchat-hygiene.yml) [![Security](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/security-supply-chain.yml/badge.svg?branch=docs%2Fportfolio-readme-production-trojanchat)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/security-supply-chain.yml) [![Benchmarks](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/benchmarks.yml/badge.svg?branch=docs%2Fportfolio-readme-production-trojanchat)](https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/benchmarks.yml)
+
 # TrojanChat
 <p align="center">
   <a href="https://github.com/CoreyLeath-code/TrojanChat/actions/workflows/trojanchat-hygiene.yml">
@@ -44,6 +46,55 @@
 
 TrojanChat is a production-hardened, multi-client chat architecture optimized for high-concurrency environments. Moving away from standard blocking network sockets, this platform leverages asynchronous event loops to maintain thousands of concurrent connections efficiently while maintaining structural memory efficiency.
 
+
+## Production Readiness Guide
+
+> This section is the portfolio audit entry point for **TrojanChat**. It describes an engineering promotion path; it is not a claim that the repository is already production-authorized.
+
+[![CI](https://img.shields.io/github/actions/workflow/status/CoreyLeath-code/TrojanChat/ci.yml?branch=main&label=CI)](https://github.com/CoreyLeath-code/TrojanChat/actions) [![License](https://img.shields.io/github/license/CoreyLeath-code/TrojanChat)](https://github.com/CoreyLeath-code/TrojanChat/blob/main/LICENSE)
+
+### Architecture flowchart
+
+```mermaid
+flowchart LR
+    Client --> Gateway --> Services[API + workers] --> Events[(Event bus)] --> Store[(State)]
+```
+
+### Quickstart and local validation
+
+The supported local path should be reproducible from a clean checkout. The inferred stack for this repository is **Python/platform services**.
+
+```bash
+python -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
+pytest -q
+```
+
+If the project uses external services, model artifacts, cloud credentials, or private data, start them through documented local fixtures or mocks. Never place secrets or identifiable records in the repository.
+
+### Research-style metrics and benchmarks
+
+| Evidence | Required record |
+|---|---|
+| Correctness | Test command, commit SHA, runtime, and pass/fail result |
+| Performance | Warm-up, sample count, concurrency, median, p95, p99, throughput, and memory |
+| Data/model quality | Dataset version, split strategy, leakage controls, calibration, subgroup results, and uncertainty |
+| Runtime | Image digest, health-check latency, resource limits, and rollback target |
+| Security | Dependency, secret, SAST, container, and SBOM results |
+
+A benchmark number belongs in a versioned artifact tied to a commit and hardware/runtime description. Engineering benchmarks must not be presented as clinical, financial, safety, or model-quality validation without the appropriate domain evidence.
+
+### Extended Q&A
+
+**What is production-ready for this repository?**  
+A reproducible build, tested public contract, controlled configuration, observable runtime, documented security boundary, versioned artifacts, and a tested rollback path.
+
+**What must remain explicit?**  
+The intended use, excluded use, data/credential handling, model or algorithm limitations, and which metrics are measured versus aspirational.
+
+**What should be completed next?**  
+Use the linked production-readiness issue for this repository as the checklist. Resolve missing tests, deployment instructions, observability, supply-chain controls, and release evidence before attaching a production claim.
+
+
 ## Engineering evidence
 
 | Evidence | Current result | Enforcement |

backend/routes/ws_routes.py

@@ -28,7 +28,7 @@ async def broadcast(self, message: str):
         for connection in connections:
             try:
                 await connection.send_text(message)
-            except Exception:
+            except (ConnectionError, RuntimeError, WebSocketDisconnect):
                 await self.disconnect(connection)
 
 

frontend/package.json

@@ -1,23 +1,23 @@
-{
-  "name": "trojanchat-frontend",
-  "version": "1.0.0",
-  "private": true,
-  "scripts": {
-    "dev": "next dev --turbopack",
-    "build": "next build",
-    "start": "next start",
-    "lint": "next lint"
-  },
-  "dependencies": {
-    "next": "15.5.20",
+{
+  "name": "trojanchat-frontend",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev --turbopack",
+    "build": "next build",
+    "start": "next start",
+    "lint": "next lint"
+  },
+  "dependencies": {
+    "next": "^15.5.20",
     "postcss": "8.5.22",
-    "react": "18.3.1",
-    "react-dom": "18.3.1"
-  },
-  "devDependencies": {
-    "@types/node": "22.10.1",
-    "@types/react": "18.3.12",
-    "@types/react-dom": "18.3.1",
+    "react": "18.3.1",
+    "react-dom": "18.3.1"
+  },
+  "devDependencies": {
+    "@types/node": "22.10.1",
+    "@types/react": "18.3.12",
+    "@types/react-dom": "18.3.1",
     "typescript": "5.6.3"
   },
   "overrides": {