Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yml:
- Around line 13-19: Replace the floating version tags (`@v4` and `@v5`) in the
GitHub Actions workflow with specific commit SHAs for both the Checkout
Repository step (actions/checkout) and the Set up Python step
(actions/setup-python). Additionally, add persist-credentials: false as a
configuration option under the Checkout Repository step to prevent credential
exposure in PR workflows. These changes pin the exact action versions to prevent
supply-chain vulnerabilities from action re-releases.

In `@router/main.py`:
- Around line 2547-2570: The static file mount for "/data" and the
save_annotations endpoint lack authentication, exposing them to unauthorized
access. Add route-level authentication to both the app.mount("/data", ...) call
and the save_annotations function by implementing a Depends() dependency that
validates API keys or authorization tokens. Consider creating a reusable
authentication dependency function that validates incoming requests and returns
an authenticated user or raises an HTTPException, then apply this dependency to
both the data mount configuration and as a parameter to the save_annotations
endpoint to ensure only authenticated requests can read or write data.
- Around line 706-711: The create_task call on line 710 does not retain a
reference to the returned task, which can cause the background stats-save
operation to be garbage collected before completion, violating Ruff RUF006.
Create a module-level set to store pending background tasks, then after calling
loop.create_task(save_persisted_stats()) assign the returned task to this set
and attach a done callback that removes the task from the set when it completes,
ensuring the fire-and-forget telemetry write is not lost.
- Around line 393-408: The cleanup code for persisting stats and timeline (the
calls to save_persisted_stats and _atomic_write_json_async) may not execute if
an exception occurs during the yield statement. Wrap the yield and the task
cancellation logic in a try/finally block, with the stats/timeline persistence
code in the finally block to guarantee cleanup always runs regardless of
exceptions during the main execution path.

In `@router/static/visualizer.html`:
- Around line 157-158: Replace the array index-based keying mechanism for
annotations with stable identifiers such as a prompt hash, session_id, or
explicit id throughout the annotation system. In the getAnnotation function and
related annotation storage/retrieval code (lines 307-324, 330, 346-347), update
the key structure to use these stable identifiers instead of array indices.
Maintain backward compatibility by adding a fallback mechanism that attempts to
resolve annotations by the legacy index-based key if the stable identifier
lookup fails, allowing existing saved annotations to continue working during
migration.
- Around line 228-232: The div element with class "list-item" that renders
selectable prompt rows is currently only mouse-operable via the onclick handler
for selectPrompt. To make this keyboard-operable for accessibility, convert the
div element to a button element or add keyboard event handling and accessibility
attributes (tabindex, role="button", and onkeydown handler) to the div. This
will allow keyboard-only users to focus on and select prompts using Tab and
Enter keys, enabling them to use the core review workflow.

In `@scripts/benchmark_classifier.py`:
- Around line 53-56: The benchmark script assumes every item in the prompts
dataset has a "tier" key and that the value is always one of the valid TIERS,
but datasets from reclassify_all.py use "llm_tier" or "clf_tier" instead, and
may contain unresolved labels like "ERROR". Replace the direct access to
item["tier"] with a safe lookup using .get() that checks for multiple possible
key names (tier, llm_tier, clf_tier), and add defensive validation around line
68 where the tier value is checked against TIERS to handle unexpected values
gracefully rather than raising a KeyError that crashes the benchmark run.

In `@scripts/extract_complex.py`:
- Around line 40-55: The extract_user_prompt function currently iterates through
messages in reversed order using reversed(messages), which causes it to select
the last user message instead of the first. Change the loop to iterate forward
through messages in their original order by removing the reversed() call and
updating for msg in reversed(messages) to for msg in messages. This will ensure
the function returns the first user message, aligning with the behavior already
implemented in scripts/extract_prompts.py and preventing the prompt-selection
issue mentioned in the review.

In `@scripts/extract_gapfill.py`:
- Around line 38-56: The extract_user_prompt function must use the same prompt
extraction semantics as the primary extractor to avoid reintroducing the bad
prompt capture issue fixed elsewhere. Currently, the function walks through
messages in reversed order looking for user role entries without filtering
pseudo-user system notes. Locate the primary extractor's implementation in the
codebase and apply its same message filtering and validation logic to the
message extraction loop in extract_user_prompt, ensuring both functions handle
user prompts consistently.

In `@scripts/retry_errors.py`:
- Around line 70-71: The retry logic needs to be schema-aware to handle both the
old tier schema (single `tier` field) and the new schema used by
reclassify_all.py (which uses `llm_tier` and `clf_tier`). Update the list
comprehension at line 70 that filters for `tier == 'ERROR'` to check for both
old and new schema fields, then apply the same schema-aware logic consistently
throughout lines 82-98 when reading and counting tier values (currently line 95
references `llm_tier` inconsistently). Additionally, the `fixed` counter should
only be incremented when the classify() function returns a successful result
(not "ERROR"), so add a check before incrementing the counter to ensure the
classification actually fixed the error.

---

Nitpick comments:
In `@pod.yaml`:
- Around line 471-472: The hostPath volume definition uses a hardcoded
user-specific path that reduces portability across different environments and
machines. Replace the hardcoded path `/home/gpav/Vrac/LAB/AI/LLM-Routing/data`
with a parameterized value by either creating a Kustomize overlay that patches
the path for different environments, using Helm chart values with a configurable
data path parameter, or using environment variable substitution in your
deployment pipeline. This allows the pod.yaml to be reused across local
development, staging, and production environments without modification.
- Around line 1-474: Add security context configurations to the pod
specification to address three security concerns. First, add a `securityContext`
section at the pod spec level (under spec) to define default security settings
for all containers, or add individual `securityContext` sections to each
container definition. Set `allowPrivilegeEscalation: false` to prevent privilege
escalation, add `runAsNonRoot: true` and specify an explicit `runAsUser` value
(e.g., 1000) to run containers with non-root users instead of root.
Additionally, review the necessity of `hostNetwork: true` at the pod spec level,
as it bypasses network policies by sharing the host's network namespace, and
consider removing or restricting it if not absolutely required for the
application functionality.

In `@test_circuit_breaker.py`:
- Around line 38-41: Replace all explicit True/False comparisons in assertions
with idiomatic truthiness checks to resolve Ruff E712 violations. For assertions
checking True values like is_allowed(), google.is_allowed(), and
vendor.is_allowed(), remove the == True comparison and use a direct assert
statement. For any assertions checking False values (if present), use assert not
instead. Apply this pattern consistently across all 14 instances mentioned in
the comment (lines 38, 40, 41, 53, 56, 69, 70, 71, 86, 103, 118, 130, 135).

In `@verify_breaker.py`:
- Line 11: The assertions in verify_breaker.py are using explicit `== True` and
`== False` comparisons which violates PEP 8 and Ruff E712 linting rules. Replace
the assertion at line 11 that compares `b.is_allowed() == True` with a direct
boolean assertion `assert b.is_allowed()`, and similarly replace all assertions
comparing `sub.is_allowed() == False` at lines 14, 17, 20, and 21 with `assert
not sub.is_allowed()` to use direct truthiness checks instead of explicit
boolean comparisons.