release: wire prod Turnstile sitekey + wrangler.jsonc comment audit (post-#115 follow-up)

[brettdavies]

Summary

Two related changes in two commits.

Commit 1, enable the production homepage form after fail-closed verification. PR #115 deliberately omitted the production TURNSTILE_SITEKEY value from wrangler.jsonc, with the express purpose of forcing the live-scoring form to fail closed in production immediately after the v3 cut deployed: an empty sitekey causes src/client/live-score.ts to disable the form with a "Live scoring is available on staging only" notice rather than render a non-functional Turnstile widget. The point of that deliberate omission was to verify, on live anc.dev, that the fail-closed path actually works end-to-end before flipping the switch. It did: the form was disabled, the disabled-state message rendered, the surface degraded gracefully without a single 5xx. With fail-closed verified in production, this commit now enables the form by wiring the real production sitekey into the top-level vars block. The matching TURNSTILE_SECRET was set on the production Worker via wrangler secret put TURNSTILE_SECRET separately (encrypted at rest in CF; never committed). The sitekey is public-by-design: Turnstile embeds it in HTML at request time for the client-side widget to render. Anyone viewing the page source already sees it; committing it to wrangler.jsonc is intentional. The secret is what enforces ownership server-side at the siteverify API boundary, and it is not in the repo.

Commit 2, trim wrangler.jsonc comments per /code-comments policy + stash rationale. Eight comment blocks audited against the WHY-only / no-temporal / no-task-flow / no-local-doc-ref / no-instructional policy. Net 65 lines removed from wrangler.jsonc, 41 lines added to RELEASES-RATIONALE.md under a new ## Wrangler env inheritance traps section that consolidates which keys inherit from top-level (routes, triggers, vars), which do not (containers, durable_objects, migrations, etc.), the REPLACE-not-merge semantics on vars, and the 2026-04-30 routing-drift incident as historical context. Each trimmed comment in wrangler.jsonc keeps the WHY that's unique to inline context and points at the consolidated rationale for the rest. Procedural runbook content that was duplicated between wrangler.jsonc and RELEASES.md § Sandbox image releases is dropped from the config in favor of the pointer.

Changelog

Added

• Enable the live-scoring homepage form on anc.dev by wiring the production TURNSTILE_SITEKEY. PR release: live-scoring v3 + anc 0.4.0 + post-#91 promotion #115's intentional omission served its purpose: the fail-closed path was verified in production (form disabled with the staging-only notice, no 5xx, graceful degradation). With fail-closed proven, the real sitekey is now in place and the form is live.

Changed

• Consolidate Wrangler env-inheritance rationale (routes / triggers / vars inheritance semantics, the 2026-04-30 routing-drift incident, container app naming quirk) into a new RELEASES-RATIONALE.md § Wrangler env inheritance traps. wrangler.jsonc comments now point at the consolidated rationale.

Documentation

• Trim eight wrangler.jsonc comment blocks per the /code-comments policy: drop temporal phrasing (first-ever, since 2026-04-30, etc.), drop docs/plans/ and personal-repo references, drop instructional voice (Flip via:, Deploy with:, Removing this line will reintroduce the bug), drop runbook content that duplicates RELEASES.md § Sandbox image releases.

Type of Change

• feat: New feature (non-breaking change which adds functionality)

PR #115 shipped working live-scoring infrastructure behind a deliberate fail-closed gate. Commit 1 flips the gate open after that fail-closed behavior was verified in production. Commit 2 is documentation hygiene that surfaced during a /code-comments audit of the config file we were already editing.

Related Issues/Stories

• Story: Closes the deferred-promotion step from PR release: live-scoring v3 + anc 0.4.0 + post-#91 promotion #115 (live-scoring v3 launch). PR release: live-scoring v3 + anc 0.4.0 + post-#91 promotion #115's empty TURNSTILE_SITEKEY was a designed-in safety gate so the v3 cut would fail closed if anything about Turnstile wiring were misconfigured. Manual visit to anc.dev right after release: live-scoring v3 + anc 0.4.0 + post-#91 promotion #115 deployed confirmed the fail-closed UX: form disabled, staging-only notice rendered, no error pages. Commit 1 enables the form now that fail-closed is proven. Documentation cleanup is opportunistic, triggered by being in the file already.
• Issue: n/a
• Architecture: n/a
• Related PRs: release: live-scoring v3 + anc 0.4.0 + post-#91 promotion #115 (the deliberate fail-closed cut this enables), feat(sandbox): bump anc to v0.4.0 + rebuild image :9aed5c3 for soak #114 (sandbox image bump to anc 0.4.0 that release: live-scoring v3 + anc 0.4.0 + post-#91 promotion #115 promoted).

Testing

• Unit tests added/updated
• All tests passing

Test Summary:

• bun test: 737 pass / 0 fail across 28 files.
• bun x wrangler deploy --dry-run: clean. Lists env.TURNSTILE_SITEKEY ("ff0x4AAAAAADQFMBoVm56-OPuQ") (the real production sitekey).
• bun x wrangler deploy --dry-run --env staging: clean. Lists env.TURNSTILE_SITEKEY ("1x00000000000000000000AA") (Cloudflare's always-pass test sitekey, unchanged). Confirms env.staging.vars REPLACE semantics correctly isolates staging from the new top-level value.
• Pre-push gate: pass (lint, build, test, both wrangler dry-runs, pack-README, banned-fonts, prose-check 0 blocking).
• /code-comments policy pattern scan against wrangler.jsonc: zero temporal / zero local-doc / zero instructional findings post-trim.
• wrangler secret list against the production Worker confirms TURNSTILE_SECRET is set (re-set from 1Password's agentnative-site Cloudflare Turnstile / prod.secret_key field via wrangler secret put before this PR opened).
• Fail-closed verification (post-release: live-scoring v3 + anc 0.4.0 + post-#91 promotion #115, pre-release: wire prod Turnstile sitekey + wrangler.jsonc comment audit (post-#115 follow-up) #116): anc.dev homepage form rendered the disabled state with the "Live scoring is available on staging only" notice; no Turnstile widget rendered; no /api/score POST was dispatched; no 5xx in the request log. The deliberate omission worked exactly as designed.

Post-merge verification plan (after the production deploy on this PR's merge):

• Visit anc.dev. Confirm the homepage form is now enabled and the Turnstile widget renders (invisible-mode, so it may not be visually obvious; the form's submit button should be clickable rather than greyed out with the staging-only notice).
• Submit a real input through the homepage form. Confirm round-trip: Turnstile widget executes, POST to /api/score returns a scorecard, browser redirects to /live-score/<binary> with the inline scorecard.
• curl https://anc.dev/api/score -H 'Content-Type: application/json' -d '{}' still returns 400 unrecognized_input (sanity: handler unchanged by this PR).

Files Modified

Modified:

• wrangler.jsonc: enabled the top-level vars block and populated TURNSTILE_SITEKEY with the production sitekey from 1Password (agentnative-site Cloudflare Turnstile / prod.site_key). Trimmed eight comment blocks per the /code-comments policy (see ## Summary commit 2 for the per-block summary). Net 65 lines removed.
• RELEASES-RATIONALE.md: new ## Wrangler env inheritance traps section consolidates inheritance semantics, override patterns, and the historical context that the config-file comments previously held inline.

Created:

• None.

Renamed:

• None.

Deleted:

• None.