Summary

Automated audit fixes for FirstradePlatform focused on runtime reliability, notification contract drift, secret-safe error handling, dependency pin consistency, and CI/Docker gates.

Problems found

• Runtime settings could fail when optional Telegram credentials were absent and Secret Manager libraries were unavailable.
• Optional boolean runtime flags defaulted to false when unset, including RUNTIME_TARGET_ENABLED, causing disabled-by-default behavior drift.
• Telegram cycle summary rendering had drifted from expected localized strategy/account labels, timing lines, signal/risk lines, and execution-blocked banners.
• Route contract tests did not include registered /health and /healthz endpoints.
• QPK pin checker matched nearby non-QPK git SHAs and allowed failures in CI.
• CI did not run pytest and had a duplicate pip upgrade step.
• Docker build used a full resolver install path that conflicts with cross-repo git package metadata when QPK pin advances.
• Runtime exception messages could echo sensitive-looking values into logs, HTTP error payloads, or Telegram runtime alerts.

Fixes applied

• Made optional Telegram credential resolution safe when env and Secret Manager are unavailable.
• Restored unset optional bool semantics and kept runtime_target_enabled defaulting to true.
• Restored localized summary labels, timing/signal/risk lines, and blocked/retryable/funding banners.
• Updated route contract tests for health endpoints.
• Updated direct QPK pins to canonical QPK_PIN and fixed the QPK pin checker to only match QuantPlatformKit.git@<sha> refs.
• Added CI pip check, pytest, and made QPK pin consistency a blocking check.
• Aligned Docker git dependency install with CI by installing git packages with --no-deps.
• Added local sensitive-text redaction for runtime errors and regression coverage.
• Moved Ruff ignore config to [tool.ruff.lint] to remove the deprecation warning.

Security impact

• No production secrets, broker credentials, GitHub Actions secrets, trading permissions, or cloud resources were modified.
• Runtime error output now redacts common token/password/API-key/header/Telegram bot URL patterns before logging or alerting.
• Local high-confidence literal secret scan found no committed secrets.
• pip-audit found no known vulnerabilities in the installed local environment.

Architecture impact

• No public API or strategy behavior changes intended.
• CI and Docker now share the same safer dependency installation pattern for cross-repo git packages.
• Redaction is local to this repo to avoid depending on private/internal APIs from a moving shared package pin.

Tests run

• actionlint
• .venv/bin/ruff check --exclude external .
• .venv/bin/python -m pytest -q → 163 passed
• .venv/bin/python scripts/check_qpk_pin_consistency.py
• uv pip check --python .venv/bin/python
• uvx pip-audit --path .venv
• high-confidence literal secret scan (values suppressed)
• uv build
• docker build -t firstradeplatform-audit:local .
• docker run --rm firstradeplatform-audit:local python - <<'PY' ... import main ... PY
• git diff --check

Failed or skipped checks with reasons

• No mypy/pyright config was found, so Python static type checking was not run.
• uv build succeeds but emits a setuptools deprecation warning for project.license table syntax; left as follow-up to avoid expanding build-system requirements in this PR.
• Full uv pip install -r requirements.txt -c constraints.txt initially exposed a cross-repo git metadata conflict after QPK pin advancement; CI/Docker already use and now consistently enforce the no-deps git install path.

Deployment notes

• Do not deploy unless branch protection and required GitHub Actions checks (gate, test) pass.
• This PR does not change production secrets, Cloud Run environment values, trading-account permissions, or live-trading enablement.
• If merged to main, existing repository workflows may build/deploy according to their configured environment flags and approvals; do not bypass approval gates.

Rollback plan

• Revert the squash merge commit from main.
• Re-run CI and any Cloud Run runtime guard/smoke workflow normally configured for main.
• If a deployment was triggered, redeploy the previous known-good image/revision using the existing release/deploy workflow.

Manual follow-up checklist

• Review whether official GitHub Actions should be SHA-pinned rather than version-pinned.
• Decide whether to update pyproject.toml license metadata and raise build-system setuptools minimum before 2027-02-18.
• Coordinate UsEquityStrategies metadata to the canonical QPK pin to reduce reliance on --no-deps git installs.
• Confirm branch protection required checks remain gate and test after this CI change.
• After merge, verify any Cloud Run deploy workflow status and smoke/health checks.