docs: add unified project launch audit report to project root

Author: anujsingh-cse

audit_report.md

@@ -0,0 +1,121 @@
+# GhostCoder Audit Report
+
+## 1. Executive Summary
+Ship post-fixes. Core architecture robust, low-VRAM auto-scaling works. Key race conditions, leak issues resolved. Launch ready.
+
+---
+
+## 2. Critical Issues (Must Fix Before Launch)
+
+### A. Replay metadata serialization failure
+- **Problem**: `fix_applied` events logged without `agent`, `hint`, or `fix` data. `ghostcoder replay` parsed null entries and failed to apply updates.
+- **Severity**: Critical.
+- **Status**: Fixed. Stored active suggestion context in daemon, serialized complete state on apply.
+
+### B. File watcher observer thread leak
+- **Problem**: Project context updates triggered new `setup_file_watcher` calls without stopping old `Observer` instances. Left redundant threads monitoring old paths.
+- **Severity**: Critical.
+- **Status**: Fixed. Added checks to stop and join active watchers during update sequences.
+
+### C. Non-thread-safe session saves
+- **Problem**: Watchdog observer threads modified `SessionState` and called `save()` concurrently with the main stream client loop. No synchronization locks.
+- **Severity**: Critical.
+- **Status**: Fixed. Added threading Lock to state mutations.
+
+---
+
+## 3. Warnings (Fix in v1.1)
+
+### A. Static regex guardrail bypasses
+- **Problem**: Safety patterns block `rm -rf` or specific SQL commands using basic regular expressions. Simple space variations (e.g., `rm  -rf`) or string concats in python/bash scripts bypass checks.
+- **Severity**: Warning.
+
+### B. VS Code socket connection drop handling
+- **Problem**: If daemon dies during active session, VS Code extension status bar switches to offline but doesn't auto-retry reconnecting on daemon revival.
+- **Severity**: Warning.
+
+---
+
+## 4. Suggestions (Nice to Have)
+
+### A. Async session writes
+- **Problem**: Repeated synchronous file writes on properties update slow down local execution.
+- **Suggestion**: Use queued async writes for session serialization.
+
+---
+
+## 5. Specific Code Audits & Fixes
+
+### 🔴 Blocker: Replay Logs Missing Metadata
+- **File**: [daemon.py](file:///c:/Users/ANUJ%20SINGH/OneDrive/Desktop/ghostcoder/ghostcoder/daemon.py)
+- **Fix**:
+```python
+# Save current suggestion
+self.last_suggestion = sugg
+
+# Log full context on apply
+if action in ["apply", "apply_skeptic"]:
+    agent = self.last_suggestion.get("agent", "unknown")
+    hint = self.last_suggestion.get("hint", "")
+    fix = self.last_suggestion.get("skeptic_fix" if action == "apply_skeptic" else "fix") or ""
+    self.replay.log_event("fix_applied", {
+        "file": self.get_last_modified_file(),
+        "timestamp": time.time(),
+        "version": "skeptic" if action == "apply_skeptic" else "original",
+        "agent": agent,
+        "hint": hint,
+        "fix": fix
+    })
+```
+
+### 🔴 Blocker: Watchdog Observer Thread Leak
+- **File**: [daemon.py](file:///c:/Users/ANUJ%20SINGH/OneDrive/Desktop/ghostcoder/ghostcoder/daemon.py#L65)
+- **Fix**:
+```python
+def setup_file_watcher(self):
+    if self.observer:
+        try:
+            self.observer.stop()
+            self.observer.join()
+        except Exception:
+            pass
+```
+
+### 🔴 Blocker: Non-Thread-Safe Session Operations
+- **File**: [session.py](file:///c:/Users/ANUJ%20SINGH/OneDrive/Desktop/ghostcoder/ghostcoder/session.py)
+- **Fix**: Add threading locks to `SessionState.save` and state mutations.
+
+---
+
+## 6. UX Improvements (VS Code Hover & Code Actions)
+
+### Hover Interactive Buttons (Before vs. After)
+
+```
+Before:
+--------------------------------------------------
+*Press Alt+A to apply, Alt+D to dismiss*
+--------------------------------------------------
+
+After:
+--------------------------------------------------
+[⚡ Apply Fix] | [⚡ Apply Skeptic Fix] | [❌ Dismiss]
+*Press Alt+A, Alt+S, or Alt+D to trigger*
+--------------------------------------------------
+```
+
+### Quick-Fix Code Actions (Before vs. After)
+*   **Before**: User must remember hotkeys (`Alt+A`, `Alt+D`).
+*   **After**: Interactive lightbulb appears on active lines. Select suggestions directly via editor menus.
+
+---
+
+## 7. Launch Checklist
+
+- [x] Comprehensive README with hero details, comparison tables, and quickstarts.
+- [x] Complete project documentation in `docs/` (Architecture, Scaling, Safety, Replay, Integrations).
+- [x] Model agnosticism & custom config overrides.
+- [x] VS Code click-to-apply hover links and code actions.
+- [x] IPC hot-swapping configuration.
+- [x] Thread cleanups and correct log serialization.
+- [ ] Pyproject.toml PyPI registry release pipeline verification.