Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ROADMAP.md`:
- Around line 88-90: Update the three provider roadmap lines so their endpoints
are fully-qualified HTTPS URLs: replace the scheme-less endpoints for XAI
(`api.x.ai/v1/chat/completions`), DeepSeek
(`api.deepseek.com/v1/chat/completions`), and Gemini (any listed Gemini
endpoint) with explicit `https://` prefixed URLs (e.g.,
`https://api.x.ai/v1/chat/completions`,
`https://api.deepseek.com/v1/chat/completions`, and the correct `https://...`
Gemini endpoint) in the `_PROVIDERS` roadmap entries referencing issues `#425`,
`#450`, and `#451`.

In `@tests/test_codegen.py`:
- Around line 9949-9963: Update the test_mistral_provider to assert that the
request sent by _call_inference_provider uses Bearer auth and OpenAI-compatible
request shape: verify req.get_header("Authorization") or req.headers contains
"Authorization: Bearer sk-mistral", ensure the request body is the OpenAI-style
JSON (e.g., has "messages"/"choices" and "model" == "mistral-small-latest"), and
additionally assert Anthropic-specific headers/fields are not present (e.g., no
"x-api-key" header and no "max_tokens" field in the JSON) so the Mistral branch
cannot be accidentally routed through the Anthropic path.

In `@vera/codegen/api.py`:
- Around line 2100-2106: If the selected provider (from VERA_INFERENCE_PROVIDER)
is set but its credential env var is missing, currently api_key becomes "" and
we still call _call_inference_provider; add an early failure: after resolving
cfg = _PROVIDERS.get(provider) and computing api_key, if provider is truthy and
api_key == "" (or cfg exists but cfg.env_key is missing), immediately return
Err(...) with a clear message about the missing API key rather than proceeding
to _call_inference_provider; place this check just before the try block that
invokes _call_inference_provider to fail fast.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/test_codegen.py`:
- Around line 9984-9992: The test test_explicit_provider_missing_key_returns_err
currently only asserts exec_result.value == 0 which can be satisfied by
unrelated failures; update this test to also verify the provider is never
invoked by instrumenting or mocking the provider entry point used by
TestInferenceCollection._CLASSIFY_SOURCE (e.g., patch the provider invocation
function or client factory so it raises or records calls) and then assert that
no call was made (or that the sentinel was not triggered) after execute(...,
env_vars={"VERA_INFERENCE_PROVIDER":"mistral"}), ensuring the code took the
early-fail path rather than failing later.

---

Duplicate comments:
In `@ROADMAP.md`:
- Line 90: Update the Gemini entry in the ROADMAP.md Inference effect item
[`#451`] to include the explicit Gemini API endpoint URL for consistency with the
xAI and DeepSeek entries; locate the bullet that mentions env var
VERA_GEMINI_API_KEY and default model gemini-2.5-pro and append the Gemini
endpoint (e.g., the public Gemini REST URL) so the entry includes the endpoint,
env var, and default model together.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@ROADMAP.md`:
- Line 11: Update the test count in README.md by changing the string "3,237
tests" to "3,238 tests" so it matches the canonical TESTING.md count (3,238);
locate the occurrence of "3,237 tests" in README.md and replace it with "3,238
tests" and verify no other outdated test-count occurrences remain.

In `@tests/test_codegen.py`:
- Around line 9971-9983: Add a new test that verifies provider precedence when
multiple API keys are present: create a test (e.g., test_multi_key_auto_detect)
that imports vera.codegen.api._PROVIDERS and patches _call_inference_provider
like test_mistral_auto_detect does, then call execute with env_vars containing
at least two different provider keys set (e.g., VERAs for two providers) and
assert that the first provider string from _PROVIDERS is the one passed to the
patched _call_inference_provider; this ensures the ordered scan across
_PROVIDERS is enforced by the detection logic.

---

Outside diff comments:
In `@tests/test_codegen.py`:
- Around line 9911-9920: The test test_anthropic_provider is too weak; augment
it to assert the outbound request shape so the Anthropic path isn't accidentally
using the OpenAI/bearer builder. In the patched urllib.request.urlopen call
inside test_anthropic_provider, capture the request object passed to urlopen and
assert the URL matches the Anthropic endpoint, that headers include "x-api-key"
with the provided key and "anthropic-version" with the expected version, and
that the JSON payload contains "max_tokens" (and other Anthropic-specific
fields) before returning the mocked response; keep using
_call_inference_provider("anthropic", ...) to drive the code and fail the test
if any of those endpoint/header/payload expectations are not met.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/test_codegen.py`:
- Around line 9934-9943: The test currently only asserts response parsing but
must also verify the OpenAI provider wiring: update test_openai_provider to
assert that _PROVIDERS["openai"] is used with the expected OpenAI endpoint,
request body model, and Authorization header; do this by patching
urllib.request.urlopen with a side-effect function that captures the outgoing
Request object (or its full URL/body/headers) when
_call_inference_provider("openai", ...) is invoked, then assert the request URL
equals the OpenAI endpoint from _PROVIDERS["openai"], the JSON body includes the
expected model field, and the Authorization header equals "Bearer sk-openai"
(and Content-Type is application/json) so the test fails if the registry row is
wired incorrectly.