`Norma/rereview.md`

30 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
`lib/auth.ts:5` — predictable fallback session secret — now requires `SESSION_SECRET` at module load — good  
`app/api/webhooks/pulse-topic/route.ts:6` — hardcoded webhook secret fallback — now requires `WEBHOOK_SECRET` at module load — concern  
`lib/detect-mentions.ts:20` — hardcoded Gemini key fallback — replaced with env lookup before Gemini call — good  
`app/api/drafts/auto-generate/route.ts:12` — hardcoded Gemini key — replaced with env lookup before Gemini call — good  
`app/api/social/ai-compose/route.ts:4` — hardcoded Gemini key — replaced with env lookup before Gemini call — good  
`.env.example:1` — missing required session config docs — placeholder added — good  
`.env.example:2` — missing required webhook config docs — placeholder added — good  
`.env.example:3` — missing required Gemini config docs — placeholder added — good

## New issues introduced
`app/api/webhooks/pulse-topic/route.ts:11` — same route now fail-fasts for `WEBHOOK_SECRET` but still builds Gemini URL with `GEMINI_API_KEY || ''`; missing Gemini config becomes a runtime 502 path instead of the documented fail-fast behavior — P2

## Missed call-sites (same problem elsewhere)
`scripts/detect-news-mentions.ts:15` — hardcoded Gemini key fallback still present  
`scripts/enrich-news-ai.js:17` — hardcoded Gemini key still present  
`agents/shared/ai.js:11` — hardcoded Gemini key fallback still present  
`app/api/outreach/generate/route.ts:8` — empty Gemini key fallback still present  
`app/api/outreach-pipeline/generate/route.ts:7` — empty Gemini key fallback still present  
`app/api/pipeline/generate/route.ts:8` — empty Gemini key fallback still present  
`app/api/statements/generate/route.ts:8` — empty Gemini key fallback still present  
`app/api/agents/petition/generate/route.ts:5` — empty Gemini key fallback still present  
`app/api/agents/advocacy/generate/route.ts:5` — empty Gemini key fallback still present

## Recommendations
- Add the same `GEMINI_API_KEY` guard to `pulse-topic` and the remaining production Gemini routes.
- Remove hardcoded Gemini keys from scripts/agents or explicitly defer them in `CHANGES.md`.