Historical pre-upgrade audit: non-reproducible deps, broken imports/tests, false-green CI, docs, and CD failures

[CoreyLeath-code]

Historical record: These findings were recorded before merged audit/upgrade work. Checked items indicate reported remediation in linked PRs; current main still requires revalidation.

Earliest baseline: 2902c21.

• Dev dependencies were unpinned/unhashed and CI was empty.
• README had stale references, mojibake, an unclosed fence, and mixed measured results with targets.
• Tests imported hyphenated/nonexistent modules and could not collect.
• Core event bus, matching, driver store, pricing, and app imports/time helpers were broken.
• CI masked failures, used stale cache/dependency inputs, and CD referenced nonexistent Dockerfiles.
• Deterministic benchmark JSON and validation were absent.
• GHCR image used uppercase owner text; Docker repository names must be lowercase.
• Dockerfile copied outside its build context and omitted complete runtime dependencies.
• PRs did not validate CD container builds before merge.

Remediated in PR #1, PR #2, PR #3, and PR #4.

Follow-up

• Revalidate lock regeneration, event/matching semantics, benchmark evidence, lowercase GHCR publishing, and PR container builds.

Remediation record — August 2026

Problem

The Compose-based local demonstration used build contexts that did not resolve to the intended application, so a nominal Compose launch did not reliably build the root API service.

Upgrade

PR #10 corrects the Compose build target, adds a root FastAPI driver-location service with a health check, and validates the Compose configuration in CI.

Verification

The PR-head CI/CD and hygiene workflow matrix passed.

Remaining boundary

This validates the demo composition and build contract; real event-stream durability, matching semantics, and service-scale behavior remain subject to the existing follow-up audit.