vxcontrol/pentagi: technical due diligence, read from its repository

The first commit carries 414,095 lines — 54% of every line ever added. Whatever happened before that commit happened somewhere this repository cannot show you, so the early history is not available as evidence of how the system was designed.

1 test file commits a focused `.only`, which runs that test and silently skips the rest of its suite. 1 skip markers across 1 of 532 test files. Each is a failure somebody chose to stop seeing; the question is whether anyone is tracking them.

Strings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key.

There is no disclosure policy, no automated dependency updates, no named code owners and no pre-commit configuration. None of these is load-bearing on its own. Their collective absence says that security posture here is whatever the current team happens to remember to do, which is not a posture that survives the team changing.

26 of 1,341 locked dependencies match 98 published advisories in OSV, 54 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.