`CHANGES.md`

15 lines
## Applied
- `src/llm.js:10` — replaced the user-specific absolute Claude CLI fallback path with `claude` — removes a hardcoded `/Users/...` path while preserving env override via `CLAUDE_CLI`.
- `.env.example:15` — added `CLAUDE_CLI=claude` placeholder — documents the configurable CLI path without introducing a real secret or machine-local path.

## Deferred (needs Steve)
- P0 — `server.js:31`, `server.js:67`, `server.js:95` — no auth plus wildcard CORS allows browser-origin localhost POSTs — deferred because adding token auth/CORS policy is outside the safe-fix list and changes operator workflow.
- P0 — `server.js:95`, `server.js:104`, `server.js:143` — activation can copy generated files into `~/.claude` and `?force=true` bypasses approval — deferred because removing force or adding local confirmation/diff changes activation semantics.
- P0 — `src/stages/scaffold.js:16`, `src/stages/smoke_test.js:20` — generated subagents may include dangerous tools and smoke tests only verify presence — deferred because safe remediation requires a frontmatter parser and artifact-specific allowlist design.
- P1 — `server.js:78` — fire-and-forget pipeline can leave runs stuck after a process crash — deferred because a resumable worker/stale-job recovery is a behavioral change beyond the safe list.
- P1 — `src/stages/memory_write.js:32` — read-modify-write append to `MEMORY.md` can race under concurrent activations — deferred because lock/atomic append behavior needs concurrency testing.
- P1 — `src/pipeline.js:52`, `src/llm.js:51` — no concurrency limit around Ollama/Claude CLI — deferred because queue sizing and backpressure policy need Steve’s decision.
- P1 — `README.md:17`, `package.json:8` — docs say `npm run start` boots orchestrator and viewer, but it only starts the orchestrator — deferred because docs/public-facing command behavior changes were not in the safe-fix list.
- P1 — `PLAN.md:106` — completed items are duplicated as open TODOs — deferred because plan/status cleanup is not in the safe-fix list.
- P1 — `package.json:15`, `.env.example:4`, `src/llm.js:5` — Anthropic SDK/API key remain despite “No Anthropic API” — deferred because dependency/env removal is not a safe autonomous fix and may require package-lock decisions.