Historical pre-upgrade audit record: empty scaffold, false-green CI, and unsupported claims #8

Historical record: This issue documents problems recorded before the repository's audit/upgrade work. Checked items mean a merged PR reports the item remediated; they are not a substitute for re-validating the current default branch. The scope is the evidence in linked commits and PRs—not a claim that every historical defect has been discovered.

Baselines

The repository was initially empty scaffolding at a9fd798. The later production audit used ce9bd2f.

Initial functionality gaps

• Source files were zero-byte placeholders; no functional parser, analyzer, package, CLI, tests, or usable CI existed.
• Parser level aliases were inconsistent in case, causing WARN/FATAL to resolve incorrectly.
• Packaging used an invalid setuptools backend.
• Deployment scaffolding, health checks, environment examples, container contract, and actionable run instructions were absent.

Remediated in PR #1 and PR #3.

Production-audit findings

• Workflows could remain green after failed tests, security scans, or benchmarks.
• Some workflows targeted nonexistent paths or swallowed failures.
• Invalid anomaly/spike/window parameters were accepted at library and CLI boundaries.
• Runtime dependency surface included unused NumPy/scikit-learn packages.
• Container/Compose controls lacked the audited non-root, read-only, capability-drop, health, and resource-limit contract.
• Security policy, deployment guide, benchmark methodology, license/SBOM/dependency audit, CodeQL, and Dependabot evidence were incomplete.
• README advertised unsupported deployment behavior or unverifiable performance claims.
• Core coverage was below the later 90% enforcement floor, and support-script lint debt was acknowledged.

Remediated in PR #5; earlier metrics work is in PR #4.

Follow-up verification

• Confirm current workflow gates fail closed under intentional test/scan/benchmark failures.
• Re-run package, container, SBOM, dependency, and benchmark jobs on current main.
• Confirm the README limits the supported product surface to the implemented CLI.