`CHANGES2.md`

10 lines
## Round 2 Applied
- `scripts/filmla-cpra-followup.sh:16` — added optional sourcing of `${FILMLA_CPRA_ENV_FILE:-$HOME/.filmla-cpra-followup.env}` before `FILMLA_GEORGE_BASIC_AUTH` is read — fixes re-review "STATUS broken" / P1 finding that launchd/non-interactive runs would otherwise exit before checking or sending.
- `.env.local.example:4` — added `FILMLA_GEORGE_BASIC_AUTH` placeholder — fixes re-review missed call-site: local setup template lacked the required secret.
- `.env.production.example:3` — added `FILMLA_GEORGE_BASIC_AUTH` placeholder — fixes re-review missed call-site: production setup template lacked the required secret.

## Still Deferred
- Steve still needs to put the real `FILMLA_GEORGE_BASIC_AUTH` value into launchd or a secure local-only env file such as `$HOME/.filmla-cpra-followup.env`; no real secret was added.
- Steve still needs to rotate the removed Basic Auth credential and decide whether the plain HTTP tailnet agent URL is acceptable.
- The original deferred P0/P1 items in `CHANGES.md` remain deferred because they require auth/product/package/database/ops decisions or are explicitly outside the round-2 safe-edit scope.