Audit TrojanChat for production readiness

[CoreyLeath-code]

Audit scope

This issue records the production-readiness work required for TrojanChat and should be kept with the README organization PR.

Repository evidence

The current README describes the project as:

TrojanChat

<img src="https://github.com/CoreyLeath-code/TrojanChat/actions/w

That description is a useful portfolio starting point, but it needs a single, verifiable promotion contract before the repository is presented as production-ready.

Production-readiness gaps to resolve

• reproduce the clean-checkout install/build path;
• define the supported runtime, dependency lock/update policy, and configuration/secrets boundary;
• add or verify automated unit, integration, and failure-mode tests;
• document the architecture, public interfaces, and data/model lineage;
• capture reproducible performance benchmarks with commit/runtime/hardware provenance;
• add health/readiness checks, structured observability, and resource limits;
• add dependency, secret, SAST, container, and SBOM checks;
• publish versioned artifacts with rollback instructions;
• document intended use, excluded use, limitations, ownership, and incident response.

Acceptance criteria

• README Quickstart works from a clean checkout.
• CI validates build, tests, and the supported runtime matrix.
• Release artifacts are immutable and traceable to a commit.
• Security and data-handling controls are documented and tested.
• Benchmark results distinguish measured evidence from targets or claims.
• A staging deployment and rollback path are documented.
• Any domain-sensitive claim is supported by appropriate evaluation and review.

Priority

High before an internet-facing or consequential deployment; otherwise use this as the portfolio hardening checklist.