docs/audit_checklist.md

• Set GROQ_MODEL=openai/gpt-oss-20b as a variable on the Instant-SWOT-Agent HF Space (done 2026-07-17)
• Restore Gemini: quota restored after closing the Google Cloud billing account; GEMINI_MODEL=gemini-flash-lite-latest set on the HF Space and confirmed serving a live analysis (2026-07-17)
• Set OPENROUTER_MODEL=openai/gpt-oss-20b:free as a variable on the HF Space (done 2026-07-17; model validated via direct API call)
• Run a live analysis after the model changes (MSFT run 2026-07-17: completed, 6/6 sources, served by gemini:gemini-flash-lite-latest via fallback — chain works end-to-end)
• Remove frontend/.env.production (deleted from working tree 2026-07-17; commit pending)
• Commit the BUSINESS_README.md change (95a89bb, pushed 2026-07-18)
• Push origin/main to the hf remote — drift closed, both remotes at 7045b2d (2026-07-18)
• After redeploy, served JS bundle verified free of execute-api URLs (2026-07-18)
• Update code defaults in src/llm_client.py and .env.example to the new model IDs (done 2026-07-17; commit pending)
• Fix A2A_RESEARCHER_URL in .env.example (done 2026-07-17; commit pending)
• Replace SEC EDGAR User-Agent placeholder with real contact (fetchers.py + config.py, pushed 2026-07-18)
• Add a LICENSE file (MIT) to Instant-SWOT-Agent (pushed 2026-07-18)
• Add a LICENSE file (MIT) to Researcher-Agent (pushed 2026-07-18)
• Pin Python dependencies via uv pip compile (requirements.in -> fully pinned requirements.txt, 2026-07-18)
• Pin Researcher-Agent root requirements via uv (2026-07-18); per-MCP-server requirements files are for standalone use only (Docker installs root file)
• Dockerfile frontend stage now uses npm ci --legacy-peer-deps (2026-07-18)
• Pinned resolution (langgraph 0.6.11, langchain 0.3.30) matches the rebuild the live canary validated on 2026-07-18
• Add GitHub Actions CI (2026-07-18): flake8 critical + import smoke on backend, eslint (non-blocking) + build on frontend; pytest excluded — existing tests are live integration tests needing API keys, modernize under the test-suite item
• Add GitHub Actions auto-mirror main -> HF Space via HF_TOKEN secret (2026-07-18)
• Investigate the 0-revision anomaly: resolved — with working models the loop revises correctly (MSFT run: 3 revisions, score 5.7); earlier 0-revision AAPL run was likely analyzer_revision_skipped triggered by dead fallback models
• LangSmith tracing: closed as on-demand-only — loop issue was resolved without it; enable via LANGCHAIN_TRACING_V2=true + key on the Space if debugging is ever needed (decision 2026-07-18)
• Add /health/deep endpoint pinging each configured LLM with a tiny request (2026-07-18)
• Check the Supabase project is not paused (confirmed working 2026-07-17: https://atilxlecbaqcksnrgzav.supabase.co)
• Document PIPELINE_SUPABASE_URL in .env.example and CLAUDE.md (2026-07-18)
• Add missing env vars to Researcher-Agent .env.example (pushed 2026-07-18)
• Data-source keys fully verified (2026-07-18): all 8 keys (NYT, NewsAPI, Alpha Vantage, FRED, Finnhub, Tavily, BLS, BEA) tested valid via direct API calls; live-run attribution confirms FRED/BLS/BEA/Tavily/NewsAPI/Finnhub/SEC/Yahoo serving on the Space. Earlier 'stale keys' finding was a test-harness error (shell sourcing), not a key problem. Keys live in ~/researcherAgent/.env (data) and ~/instantSWOTAgent/.env (LLM + 6 duplicated data keys); Tradier absent everywhere (volatility works without it)
• Decide whether AWS or HF Spaces is the canonical backend (decided: HF; AWS backend torn down 2026-07-17 via AWS CLI — API Gateway, 8 Lambdas, Step Functions, 2 DynamoDB tables, 3 S3 buckets, 2 alarms, 8 log groups, 2 IAM roles deleted; secret swot-agent-api-keys scheduled for deletion 2026-07-24)
• Remove awsDeployment/ directory (2026-07-18; history preserves it)
• Fix CORS: allow_origin_regex for hf.space subdomains, credentials dropped (2026-07-18)
• Add per-IP rate limit (10/h) and concurrent-workflow cap (3) on POST /analyze (2026-07-18, dependency-free in-memory guards)
• Add 1h TTL eviction for WORKFLOWS (analysis route) and Researcher TASK_STORE (2026-07-18)
• Update README.md and CLAUDE.md to match the real workflow (2026-07-18)
• Delete dead code: src/graph_cyclic.py (2026-07-18)
• Remove unused deps from requirements.txt (2026-07-18)
• Rewrite stale pyproject.toml (2026-07-18)
• Remove repo noise from Researcher-Agent: reports/ and .obsidian/ untracked + gitignored (pushed 2026-07-18)
• Delete the local 265MB awsDeployment/build/ directory (2026-07-18)
• Structured JSON outputs for the critic (2026-07-18): json_mode in llm_client (response_format json_object on Groq/OpenRouter, responseMimeType on Gemini) validated against all three live providers; analyzer intentionally left as prose (its report is consumed as text by parser and UI). LangSmith item re-opened and closed same day: code was already fully @traceable-instrumented, local key validated against the LangSmith API - enabling requires LANGCHAIN_TRACING_V2=true + LANGCHAIN_API_KEY + LANGCHAIN_PROJECT on the HF Space (user step)
• Replace deprecated @app.on_event with a lifespan handler (2026-07-18)
• Test suite green: live-integration test replaced with 7 unit tests for the loop conditions; pytest now gates CI (2026-07-18)
• Persistent MCP sessions: closed as deferred-by-design (2026-07-18) — spawn-per-request is more robust (fresh process, no session locking, no respawn logic); revisit only if latency becomes a complaint
• Add scheduled live canary: weekly (Mon 06:17 UTC) E2E analysis asserting provider, SWOT sections, and data sources (2026-07-18)
• Weekly keep-warm ping: covered by the canary's health checks against both Spaces (2026-07-18)
• Upgrade Vite 5 → 7.3.6 and React 18 → 19.2.7 (2026-07-18): tsc clean, 10/10 unit tests pass, production build OK; Docker builder bumped to node:22-slim; stale ActivityLog tests rewritten for current component API
• Add cache headers: immutable for hashed /assets, no-cache for the app shell (2026-07-18)
• SSE streaming of workflow status (2026-07-18): GET /workflow/{id}/events (1s change-driven snapshots, 15min cap) with EventSource-first frontend transport and automatic fallback to the original 700ms polling