Historical pre-upgrade audit: missing entrypoints, CVEs, defunct agent APIs, invalid container stages, and deployment gaps

[CoreyLeath-code]

Historical record: These findings were recorded before merged audit/upgrade work. Checked items indicate reported remediation in linked PRs; current main still requires revalidation.

Earliest baseline: 8c12d2f.

• API/CLI entrypoints were missing; imports/package markers, CI YAML, and dependency manifest were broken.
• MLflow/Starlette pins carried numerous RCE/path traversal/injection/DoS advisories.
• Agent used nonexistent LangGraph Graph API, hardcoded placeholder routing, and crashed without Java/C++ artifacts.
• Runtime dependencies were missing; /predict returned a placeholder.
• Data ingestion lacked file/schema/split/min-row validation and correct validation-fraction semantics.
• CI/security/SBOM/container/release/governance contracts were incomplete.
• Dockerfile referenced a nonexistent Java Maven project/planner JAR; release-readiness skipped on upstream failure.
• Public Streamlit deployment entrypoint/config/smoke validation were absent.

Remediated in PR #1, PR #2, PR #4, PR #18, and PR #19.

Follow-up

• Re-audit dependency pins, native fallback parity, deterministic splitting, container health, release readiness, and Streamlit deployment.