`CHANGES2.md`

11 lines
## Round 2 Applied
- server.js:15 — added a dependency-free `.env` loader before auth env vars are read — fixes the `server.js`/`.env.example` concern that documented credentials must actually satisfy fail-fast startup without adding `dotenv`.
- create-missing-collections.js:5 — replaced the hidden `require('dotenv')` dependency with a local `.env` parser — fixes the P1 rereview finding that missing `dotenv` made `.env.example` ineffective.
- scripts/collection-descriptions.js:5 — replaced the hidden `require('dotenv')` dependency with a local `.env` parser — fixes the same P1 rereview finding for this script's required env vars.
- setup-yolo-remote.sh:196 — changed the setup output from a host-IP dashboard URL to `localhost` plus an SSH tunnel command — fixes the missed call-site where remote setup still assumed public dashboard access after loopback binding.

## Still Deferred
- Credential rotation and redaction remain for old exposed values in task artifacts and operational scripts; this requires Steve-owned secret replacement and archive cleanup.
- setup-yolo-remote.sh still contains legacy generated auth examples; changing deployment auth flow was previously deferred and needs an owner decision.
- The P2 remote-access behavior is now documented as tunnel-only, but any broader decision to make bind host configurable is deferred.