Operate: independent security and accessibility review

[oesteban]

Code that asks people to run a network service should be looked at by someone other than its authors. The node is headless, a background service plus a Python and Jupyter client with no web user interface, so the accessibility review is scoped to the documentation site and the security review to the service and its transport.

Outcomes

• Audit-readiness pack published in the repository: code walkthrough, threat-model handover, and a reproducible environment for reviewers
• Review findings processed and resolved publicly, issue by issue, with a written response to each
• Accessibility review of the documentation site against WCAG 2.2 AA (the international web content accessibility guidelines), and remediation of the findings
• Licence review completed; every file carries machine-readable licensing metadata (SPDX licence identifiers, following the REUSE specification), published and checked on every change