`CHANGES2.md`

18 lines

## Round 2 Applied
- `app/api/webhooks/pulse-topic/route.ts:8` — added a `GEMINI_API_KEY` guard and builds the Gemini URL only when called — fixes CODEX_REREVIEW “New issues introduced” concern about `GEMINI_API_KEY || ''`.
- `app/api/webhooks/pulse-topic/route.ts:29` — moved missing `WEBHOOK_SECRET` handling into the route response instead of module-scope throw — addresses CODEX_REREVIEW “concern” on this patch.
- `scripts/detect-news-mentions.ts:16` — removed the hardcoded Gemini fallback and require `GEMINI_API_KEY` for Gemini calls — fixes CODEX_REREVIEW “Missed call-sites”.
- `scripts/detect-news-mentions.ts:185` — fail fast when `--gemini` is used without `GEMINI_API_KEY` — keeps the missed-call-site fix from being swallowed by the fallback catch path.
- `scripts/enrich-news-ai.js:18` — removed the hardcoded Gemini key and require `GEMINI_API_KEY` before requests — fixes CODEX_REREVIEW “Missed call-sites”.
- `agents/shared/ai.js:12` — removed the hardcoded Gemini fallback and require `GEMINI_API_KEY` — fixes CODEX_REREVIEW “Missed call-sites”.
- `app/api/outreach/generate/route.ts:8` — replaced empty-key Gemini URL fallback with a guarded URL helper — fixes CODEX_REREVIEW “Missed call-sites”.
- `app/api/outreach-pipeline/generate/route.ts:7` — replaced empty-key Gemini URL fallback with a guarded URL helper — fixes CODEX_REREVIEW “Missed call-sites”.
- `app/api/pipeline/generate/route.ts:8` — replaced empty-key Gemini URL fallback with a guarded URL helper — fixes CODEX_REREVIEW “Missed call-sites”.
- `app/api/statements/generate/route.ts:8` — replaced empty-key Gemini URL fallback with a guarded URL helper — fixes CODEX_REREVIEW “Missed call-sites”.
- `app/api/agents/petition/generate/route.ts:5` — replaced empty-key Gemini URL fallback with a guarded URL helper — fixes CODEX_REREVIEW “Missed call-sites”.
- `app/api/agents/advocacy/generate/route.ts:5` — replaced empty-key Gemini URL fallback with a guarded URL helper — fixes CODEX_REREVIEW “Missed call-sites”.

## Still Deferred
- Additional hardcoded Gemini keys remain in other `scripts/` and `agents/*/skills/` files found during verification, but they were outside the explicit CODEX_REREVIEW missed-call-site list and would exceed the surgical round-2 scope.
- Original `CHANGES.md` deferred items remain for Steve: real-secret rotation/history cleanup, auth model changes, abuse controls, SSRF guard work, OAuth state, schema fixes, request caps, and streaming/truncation refactors.