Document fixed Colab worker configuration

README.md

@@ -42,7 +42,7 @@ Store tokens, the service-role key, and proxy secret as Space secrets. `HF_TOKEN
 Analysis automatically uses Colab for inference when its worker lease is healthy. If no worker is registered, Colab is on CPU, or its connection is lost, the backend falls back to its existing local analysis pipeline. Colab returns analysis reports only; the backend still prepares playback videos, writes the normal `sessions/{session_id}` dataset folder, and updates Supabase.
 
 1. Generate a separate random secret with at least 32 characters. Add it to the Hugging Face Space as `COLAB_WORKER_SECRET`. Do not reuse `ANALYSIS_PROXY_SECRET`.
-2. Open [`Colab Server/worker.ipynb`](../Colab%20Server/worker.ipynb) in Colab and add these Colab Secrets: `HF_TOKEN`, `STORAGE_REPO_ID`, `CORE_REPO_ID`, `SPORALIZE_BACKEND_URL`, and `SPORALIZE_COLAB_WORKER_SECRET`. `HF_TOKEN` needs read access to Core and read/write access to the private storage dataset; `STORAGE_REPO_ID` and `CORE_REPO_ID` must match the backend values. Set `CORE_REVISION` too if the backend pins one. The backend URL is the public Space origin, such as `https://shoraky-sporalize-api.hf.space`; the Colab secret must match `COLAB_WORKER_SECRET` exactly.
+2. Open [`Colab Server/worker.ipynb`](../Colab%20Server/worker.ipynb) in Colab and set the fixed variables at the top of the first code cell. Use a fine-grained GitHub token with read-only Contents access to the private Sporalize repository. The Hugging Face token needs read access to Core and read/write access to the private storage dataset; the repository IDs must match the backend values. Set `CORE_REVISION` too if the backend pins one. The backend URL is the public Space origin, such as `https://shoraky-sporalize-api.hf.space`; the worker secret must match `COLAB_WORKER_SECRET` exactly. Keep real token and secret values out of Git commits.
 3. Select a GPU runtime and run the notebook. It starts the worker and Cloudflare quick tunnel, waits for model initialization, then registers the generated URL automatically. Keep the notebook cell running while analyses should use Colab.
 4. The notebook refreshes the worker lease every 20 seconds. The backend treats it as offline after 75 seconds without a heartbeat. Stopping or disconnecting Colab returns new jobs to the normal backend pipeline.