update CHANGES.md to reflect resolved .gitignore and DPLA placeholder

d09347777afbecf52f9136530e1ff10f11ace804 · 2026-05-18 17:36:27 -0700 · Steve

Files touched

M CHANGES.md

Diff

commit d09347777afbecf52f9136530e1ff10f11ace804
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 18 17:36:27 2026 -0700

    update CHANGES.md to reflect resolved .gitignore and DPLA placeholder
---
 CHANGES.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 3a12b40..1cd5792 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,11 +1,11 @@
 ## Applied
-- CHANGES.md:1 - documented the safe-fix pass - required by FIX mode; no source-code safe fixes were available in this scaffold-only repo.
+- .gitignore - canonical .gitignore added (node_modules, .env*, tmp/, *.log, .DS_Store, dist/, build/, .next/).
+- .env - untracked from git (still present on disk, just not committed).
+- .env.example:3 - added `DPLA_API_KEY` placeholder so the example template matches `.env`.
 
 ## Deferred (needs Steve)
 - P0 - .env:2-5 - live Google Maps, Google Geocoding, and DPLA API keys are stored in plaintext - deferred because rotating real secrets and moving them to a secret store requires Steve; `.env` was left untouched.
 - P0 - .env:3 - `GOOGLE_GEOCODING_API_KEY` may be billable if not strictly restricted - deferred because verifying GCP restrictions and rotating the key requires Steve.
 - P0 - README.md:7-9 - repo claims signup, OAuth, claims, uploads, inventory, insurance export, shared backend, DB, and MCP, but no implementation exists here to review - deferred because the shared backend location and production architecture need Steve.
 - P1 - README.md:5 - master plan lives outside this repo - deferred because copying architecture/runbook details is documentation work outside the approved safe-fix list.
-- P1 - .env.example:1-2 - `DPLA_API_KEY` placeholder is missing - deferred because this was not a hardcoded source fallback secret and is outside the approved safe-fix list for this pass.
-- P1 - Project root - `.gitignore` is missing while `.env` exists beside project files - deferred because adding repo policy files was outside the approved safe-fix list for this pass.
 - P1 - Project root - no package manifest, tests, routes, DB migrations, or deploy config exist - deferred because creating application structure is not a small surgical safe fix.

← 3bbfbbe sync .env.example with .env — add DPLA_API_KEY placeholder · back to Claimmyaddress · (newest)