Enterprise hardening (#16/20): WinLossAnalyzer — POST /api/v1/deals accepts arbitrary JSON with zero validati

[timjm25]

Enterprise-readiness hardening — priority #16 of top 20

Purpose: NLP-driven win/loss analysis for B2B pharmaceutical/CDMO sales teams, extracting themes and drivers from CRM deal notes.

Metric	Value
Portfolio rank (value × readiness-gap)	#16
Annual value at full adoption	$300,000
Current readiness	62%
Effort to enterprise-ready	L
GxP-scoped	no
Deployment mode	api_service

Single blocking gap

POST /api/v1/deals accepts arbitrary JSON with zero validation (request.get_json(force=True))

Top gaps (from portfolio audit)

• No CI/CD pipeline (tests and linting); jekyll workflow is documentation-only.
• Zero observability: no logging module anywhere; production debugging will be blind.
• Unpinned dependencies (Flask>=3.0) and no Dockerfile; reproducibility and containerization broken.

Critical / deployment-blocking flags

• POST /api/v1/deals accepts arbitrary JSON with zero validation (request.get_json(force=True))
• No authentication/authorization; any caller can trigger analysis or import CRM data.
• Requirements unpinned; CI absent means untested changes can merge.

Consolidation direction

• Capability cluster: commercial-intelligence
• Canonical service: CommercialIntelAgent

Rather than harden this repo in isolation, adopt the shared scaffold and fold this
capability toward its canonical service (see the portfolio CONSOLIDATION_PLAN.md).

How to fix (shared scaffold)

Adopt portfolio-agent/scaffold/ — it resolves the recurring blockers once:

• Pin dependencies at exact versions (pyproject.toml)
• Add multi-stage non-root Dockerfile (Azure Container Apps target)
• Add CI (.github/workflows/ci.yml: ruff + mypy + bandit + pip-audit + pytest + docker build)
• Replace print() with structured JSON logging (app/logging_config.py)
• Add auth on all mutating endpoints (@require_user)
• Remove any hardcoded secret / debug=True; move to env config (app/config.py)
• Fill in agent.yaml (assigns this to its agent; hook for the recursive-agent build)

Generated from the MINARIS portfolio audit + Fable consolidation pass.