diff --git a/.github/CODE_REVIEW_AUDIT_2026-07-29.md b/.github/CODE_REVIEW_AUDIT_2026-07-29.md
new file mode 100644
index 0000000..f965361
--- /dev/null
+++ b/.github/CODE_REVIEW_AUDIT_2026-07-29.md
@@ -0,0 +1,14 @@
+# Code Review Audit Request - 2026-07-29
+
+This branch exists only to trigger external review on the current `main` state.
+
+Audit scope:
+
+- README badges, About metadata, and governance docs consistency.
+- Test-suite correctness and missing validation gates.
+- Secret-safety boundary: no `.env`, token, cookie, cPanel, payment, or provider secret exposure.
+- SecuredMe Education gateway compatibility without direct secret storage.
+- Pre-alpha wording, human-review boundary, and student/teacher safety posture.
+- Repository-specific architecture risks and stale documentation.
+
+No application behavior is intentionally changed by this audit branch.
diff --git a/.github/workflows/ci-datadog.yml b/.github/workflows/ci-datadog.yml
index 9e6ed61..4d78909 100644
--- a/.github/workflows/ci-datadog.yml
+++ b/.github/workflows/ci-datadog.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Install package dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -e ".[dev]"
+          python -m pip install -e ".[dev,api]"
 
       - name: Run public unit tests with package dependencies
         run: python -m pytest
diff --git a/SECURITY.md b/SECURITY.md
index 9bafd17..7284a2b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -25,6 +25,8 @@ Useful report content:
 
 Never commit or disclose API keys, OAuth tokens, cookies, browser sessions, .env values, passwords, cPanel details, payment credentials, private corpora, raw student records, production logs, or unpublished research material.
 
+Do not commit Datadog API keys, OpenAI keys, GitHub tokens, cPanel credentials, PayPal credentials, or any other operational secret. This MVP is not a production cryptographic system.
+
 The shared SecuredMe gateway may route configured audit, observability, and assistant handoff metadata. This repository must not expose gateway secrets, provider tokens, or private operator state in README files, tests, logs, exceptions, screenshots, or issue reports.
 
 ## AI And Human Review Boundary
diff --git a/pyproject.toml b/pyproject.toml
index a10857b..a9590cf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,7 +17,7 @@ dependencies = ["cryptography>=42.0"]
 [project.optional-dependencies]
 dev = ["pytest>=8.0"]
 e2b = ["e2b>=1.0.0"]
-api = ["fastapi>=0.110", "uvicorn>=0.29", "pydantic>=2.0"]
+api = ["fastapi>=0.110", "uvicorn>=0.29", "pydantic>=2.0", "httpx>=0.27"]
 
 [project.scripts]
 ffed-qlc = "ffed_qlc.cli:main"