Review audit: Qodo, Codex, and Gemini pass

.github/CODE_REVIEW_AUDIT_2026-07-29.md

@@ -0,0 +1,14 @@
+# Code Review Audit Request - 2026-07-29
+
+This branch exists only to trigger external review on the current `main` state.
+
+Audit scope:
+
+- README badges, About metadata, and governance docs consistency.
+- Test-suite correctness and missing validation gates.
+- Secret-safety boundary: no `.env`, token, cookie, cPanel, payment, or provider secret exposure.
+- SecuredMe Education gateway compatibility without direct secret storage.
+- Pre-alpha wording, human-review boundary, and student/teacher safety posture.
+- Repository-specific architecture risks and stale documentation.
+
+No application behavior is intentionally changed by this audit branch.

.github/workflows/ci-datadog.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Install package dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -e ".[dev]"
+          python -m pip install -e ".[dev,api]"
 
       - name: Run public unit tests with package dependencies
         run: python -m pytest

SECURITY.md

@@ -25,6 +25,8 @@ Useful report content:
 
 Never commit or disclose API keys, OAuth tokens, cookies, browser sessions, .env values, passwords, cPanel details, payment credentials, private corpora, raw student records, production logs, or unpublished research material.
 
+Do not commit Datadog API keys, OpenAI keys, GitHub tokens, cPanel credentials, PayPal credentials, or any other operational secret. This MVP is not a production cryptographic system.
+
 The shared SecuredMe gateway may route configured audit, observability, and assistant handoff metadata. This repository must not expose gateway secrets, provider tokens, or private operator state in README files, tests, logs, exceptions, screenshots, or issue reports.
 
 ## AI And Human Review Boundary

pyproject.toml

@@ -17,7 +17,7 @@ dependencies = ["cryptography>=42.0"]
 [project.optional-dependencies]
 dev = ["pytest>=8.0"]
 e2b = ["e2b>=1.0.0"]
-api = ["fastapi>=0.110", "uvicorn>=0.29", "pydantic>=2.0"]
+api = ["fastapi>=0.110", "uvicorn>=0.29", "pydantic>=2.0", "httpx>=0.27"]
 
 [project.scripts]
 ffed-qlc = "ffed_qlc.cli:main"