`CHANGES.md`

20 lines

## Applied
- admin/server.js:15 - removed the hardcoded `SESSION_SECRET` fallback and now fail fast unless a 32+ character secret is provided - prevents booting with a known session signing secret.
- admin/server.js:139 - bound the admin Express server to `127.0.0.1` - keeps the local-only admin surface off public interfaces.
- admin/.env.example:14 - replaced the weak session placeholder with a long random-secret placeholder - documents the required env without adding a real secret.
- sites/wholivedthere.com/app/app/api/webhook/stripe/route.ts:11 - production now returns 500 when Stripe or `STRIPE_WEBHOOK_SECRET` is missing - avoids silently accepting unsigned live webhook events.
- sites/bubbesblock.com/app/app/api/webhook/stripe/route.ts:11 - production now returns 500 when Stripe or `STRIPE_WEBHOOK_SECRET` is missing - avoids silently accepting unsigned live webhook events.
- sites/claimmyaddress.com/app/app/api/webhook/stripe/route.ts:11 - production now returns 500 when Stripe or `STRIPE_WEBHOOK_SECRET` is missing - avoids silently accepting unsigned live webhook events.

## Deferred (needs Steve)
- P0 - .env:10, .env:13, sites/*/app/.env.local:5-7 - live Cloudflare/Stripe/webhook secrets are in the project tree - rotating/removing real secrets requires Steve-controlled credential rotation; left `.env*` files untouched.
- P0 - ecosystem.config.js:49, admin/server.js:43-46 - PM2 sets `SF_ADMIN_DEV=1`, enabling auto-admin - PM2 ecosystem files are explicitly out of scope; OAuth/dev-bypass policy needs owner confirmation.
- P0 - orchestrator/server.js:15,37,96,130,164,180 - orchestrator has open CORS and unauthenticated write routes - adding shared auth/restricting CORS is a behavioral/API change beyond the safe fix list.
- P0 - orchestrator/server.js:195-204, stages/runners.js:240-243 - concurrent advance calls can duplicate stage work - advisory locks/transaction semantics are not a surgical safe change.
- P0 - sites/wholivedthere.com/app/lib/db.ts:30-33, db/schema.sql:80-89 - webhook persistence schema mismatch - `.sql`/schema and DDL changes are forbidden in this pass.
- P1 - orchestrator/server.js:110-112,144-146, db/schema.sql:16-25 - missing `theme_overrides`/`copy_overrides` schema columns - migration/schema work is forbidden.
- P1 - orchestrator/server.js:24-35,158-160 - async Express routes lack centralized error wrappers - broader route behavior change not included in safe list.
- P1 - stages/runners.js:76-123,203-212 - stub stages advance as done - pipeline semantics need owner decision.
- P1 - critic/server.js:112-148 - `/critique/stub` has no auth/rate limit - auth policy change beyond safe list.
- P1 - scripts/deploy-vercel.sh:40-45 - deploy script pushes every `.env.local` key to Vercel production - production env allowlist needs Steve review to avoid dropping required keys.