`CHANGES2.md`

13 lines
## Round 2 Applied
- `scripts/ralph-llm-runner.js:45` — removed the module-scope Gemini env failure and kept the key lookup passive — fixes CODEX_REREVIEW "STATUS broken" / P1 new issue where default Ollama runs required Gemini credentials.
- `scripts/ralph-llm-runner.js:110` — added the Gemini env failure inside `callGemini()` only — follows CODEX_REREVIEW recommendation to require `GEMINI_API_KEY_RALPH`/`GEMINI_API_KEY` only when the Gemini backend is actually used.
- `app/api/prd/clarify/route.ts:75` — wrapped `request.json()` with a local 400 invalid-JSON response — fixes CODEX_REREVIEW missed call-site at line 75.
- `app/api/ralph/convert/route.ts:141` — wrapped `request.json()` with a local 400 invalid-JSON response — fixes CODEX_REREVIEW missed call-site at line 141.
- `app/api/claude/suggest/route.ts:130` — wrapped `request.json()` with a local 400 invalid-JSON response and kept safe defaults for destructured fields — fixes CODEX_REREVIEW missed call-site at line 130.
- `app/api/processes/analyze/route.ts:33` — wrapped `request.json()` with a local 400 invalid-JSON response — fixes CODEX_REREVIEW missed call-site at line 33.
- `app/api/processes/fix/route.ts:36` — wrapped `request.json()` with a local 400 invalid-JSON response — fixes CODEX_REREVIEW missed call-site at line 36.

## Still Deferred
- Original `CHANGES.md` deferred security items remain for Steve: local secret rotation/history purge, auth/session redesign, process/shell sandboxing, SSRF controls, broad file path/upload guards, referer trust/shell interpolation, and concurrent state-write design.
- No additional safe P0/P1/BROKEN/concern items from `CODEX_REREVIEW.md` were left unapplied.