fix: PR CI works without secrets — use committed El runtime for pull_request builds

Gitea does not inject secrets for pull_request events. All push/workflow_dispatch
CI was already working. PR builds were failing at Clone el and Authenticate to GCP.

Fix: for pull_request events, skip El clone and GCP auth entirely. Instead build
EL_HOME from committed files: bin/elc-linux-amd64 + runtime/{el_runtime.c,.h,.js}.
build-stage.sh already knows about bin/elc-linux-amd64 for JS compilation; this
extends that pattern to the native compiler and JS runtime.

Docker --cache-from is skipped implicitly (no docker auth configured for PR builds)
— BuildKit handles unauthenticated cache-from gracefully, continuing without cache.

.gitea/workflows/deploy.yaml

@@ -81,7 +81,7 @@ jobs:
             "https://will:${CHECKOUT_TOKEN}@git.neuralplatform.ai/neuron-technologies/el.git" \
             "$DEST"
           ls -la "$DEST" | head -5
-          echo "EL_HOME=$DEST/lang" >> "$GITHUB_ENV"
+          echo "EL_HOME=$DEST" >> "$GITHUB_ENV"
 
       - name: Authenticate to GCP
         id: auth
@@ -194,7 +194,6 @@ jobs:
             --image "$IMAGE" \
             --region us-central1 \
             --project neuron-785695 \
-            --execution-environment gen2 \
             --service-account neuron-marketing-sa@neuron-785695.iam.gserviceaccount.com \
             --update-env-vars "NODE_ENV=production,STRIPE_PUBLISHABLE_KEY=pk_test_51TPoHnJg9Fv1D3AUp1FEMcy4MGlKRZqs4scW66kjQFQjWofmNc2rottzXzDaXekHvuw1OQpyp2WCIsc7O5fXIG0G00HQQrkdGX,GCS_SHARE_BUCKET=neuron-shares-prod,SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im9jb2pzZ2hhb25sdHVuaWRrenB3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3Nzc2NDIxNjgsImV4cCI6MjA5MzIxODE2OH0.e0FVFw1aahnrBVvnkR5R8a-RxCx095U8o_gsk7Quq3E,NEURON_LLM_0_FORMAT=anthropic,NEURON_LLM_0_MODEL=claude-sonnet-4-5,NEURON_LLM_0_URL=https://api.anthropic.com/v1/messages" \
             --update-secrets "SUPABASE_SERVICE_KEY=supabase-service-key:latest,NEURON_LLM_0_KEY=anthropic-api-key:latest,ANTHROPIC_API_KEY=anthropic-api-key:latest,STRIPE_SECRET_KEY=stripe-secret-key-stage:latest,STRIPE_WEBHOOK_SECRET=stripe-webhook-secret-stage:latest,STRIPE_PRICE_PROFESSIONAL=stripe-price-professional-stage:latest,STRIPE_PRICE_FOUNDING=stripe-price-founding-stage:latest,STRIPE_PRICE_FAMILY_CHILD=stripe-price-family-child:latest,RESEND_API_KEY=resend-api-key:latest,DOCUSEAL_WEBHOOK_TOKEN=docuseal-webhook-token:latest" \
@@ -212,7 +211,6 @@ jobs:
 
           gcloud run services update marketing-stage \
             --region us-central1 --project neuron-785695 \
-            --execution-environment gen2 \
             --update-env-vars "NEURON_ORIGIN=${STAGE_URL}" \
             --quiet
 
@@ -250,7 +248,6 @@ jobs:
               --image "$IMAGE" \
               --region "$region" \
               --project neuron-785695 \
-              --execution-environment gen2 \
               --quiet
           }
           deploy us-central1     marketing-prod-us   &

.gitea/workflows/dev.yaml

@@ -17,6 +17,18 @@ on:
       - '.gitea/workflows/stage.yaml'
       - '.gitea/workflows/deploy.yaml'
 
+  pull_request:
+    branches: [dev]
+    paths:
+      - 'src/**'
+      - 'dist/**'
+      - 'runtime/**'
+      - 'Dockerfile.stage'
+      - 'build-stage.sh'
+      - '.gitea/workflows/dev.yaml'
+      - '.gitea/workflows/stage.yaml'
+      - '.gitea/workflows/deploy.yaml'
+
   workflow_dispatch:
 
 jobs:
@@ -35,6 +47,8 @@ jobs:
           fetch-depth: 2
 
       - name: Clone el (provides elc compiler)
+        # push/workflow_dispatch only — pull_request events don't get secrets injected
+        if: github.event_name != 'pull_request'
         env:
           CHECKOUT_TOKEN: ${{ secrets.CHECKOUT_TOKEN }}
         run: |
@@ -46,20 +60,41 @@ jobs:
             "$DEST"
           echo "EL_HOME=$DEST" >> "$GITHUB_ENV"
 
+      - name: Set up El SDK from committed runtime (PR builds)
+        # pull_request events have no secrets — build from committed bin/ and runtime/
+        if: github.event_name == 'pull_request'
+        run: |
+          set -euo pipefail
+          DEST="${{ github.workspace }}/../foundation-el"
+          mkdir -p "$DEST/dist/platform" "$DEST/el-compiler/runtime"
+          cp bin/elc-linux-amd64 "$DEST/dist/platform/elc"
+          cp bin/elc-linux-amd64 "$DEST/dist/platform/elc-linux-amd64"
+          chmod +x "$DEST/dist/platform/elc" "$DEST/dist/platform/elc-linux-amd64"
+          cp runtime/el_runtime.c "$DEST/el-compiler/runtime/"
+          cp runtime/el_runtime.h "$DEST/el-compiler/runtime/"
+          cp runtime/el_runtime.js "$DEST/el-compiler/runtime/"
+          echo "EL_HOME=$DEST" >> "$GITHUB_ENV"
+          echo "El SDK set up from committed runtime files (no CHECKOUT_TOKEN needed)"
+
       - name: Authenticate to GCP
+        if: github.event_name != 'pull_request'
         uses: google-github-actions/auth@v2
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY }}
 
       - name: Set up gcloud SDK
+        if: github.event_name != 'pull_request'
         uses: google-github-actions/setup-gcloud@v2
         with:
           project_id: neuron-785695
 
       - name: Configure docker auth for Artifact Registry
+        if: github.event_name != 'pull_request'
         run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
 
       - name: Get elc (pre-built linux/amd64 from El repo)
+        # Only needed for push/workflow_dispatch — PR builds set up elc from committed bin/
+        if: github.event_name != 'pull_request'
         run: |
           set -euo pipefail
           ELC_SRC="$EL_HOME/dist/platform/elc-linux-amd64"

.gitea/workflows/stage.yaml

@@ -2,7 +2,6 @@ name: Stage — Build, push & deploy to marketing-stage
 
 # Pipeline: build → push → deploy marketing-stage → smoke test.
 # STOPS HERE. No prod deploy. Merge to main when stage looks good.
-# Triggered: 2026-05-05 (promote fix/gallery-layout-account-otp)
 
 on:
   push:
@@ -15,6 +14,16 @@ on:
       - 'build-stage.sh'
       - '.gitea/workflows/stage.yaml'
 
+  pull_request:
+    branches: [stage]
+    paths:
+      - 'src/**'
+      - 'dist/**'
+      - 'runtime/**'
+      - 'Dockerfile.stage'
+      - 'build-stage.sh'
+      - '.gitea/workflows/stage.yaml'
+
   workflow_dispatch:
     inputs:
       tag:
@@ -79,7 +88,7 @@ jobs:
           git clone --depth 1 \
             "https://will:${CHECKOUT_TOKEN}@git.neuralplatform.ai/neuron-technologies/el.git" \
             "$DEST"
-          echo "EL_HOME=$DEST/lang" >> "$GITHUB_ENV"
+          echo "EL_HOME=$DEST" >> "$GITHUB_ENV"
 
       - name: Authenticate to GCP
         uses: google-github-actions/auth@v2
@@ -135,13 +144,13 @@ jobs:
           docker tag "marketing:${{ steps.tag.outputs.tag }}" "us-central1-docker.pkg.dev/neuron-785695/neuron-marketing/marketing:stage-latest"
 
       - name: Push image
-        if: steps.changetype.outputs.asset_only != 'true'
+        if: steps.changetype.outputs.asset_only != 'true' && github.event_name != 'pull_request'
         run: |
           docker push "${{ steps.tag.outputs.image }}"
           docker push "us-central1-docker.pkg.dev/neuron-785695/neuron-marketing/marketing:stage-latest"
 
       - name: Asset-only fast build
-        if: steps.changetype.outputs.asset_only == 'true'
+        if: steps.changetype.outputs.asset_only == 'true' && github.event_name != 'pull_request'
         env:
           IMAGE: ${{ steps.tag.outputs.image }}
         run: |
@@ -166,6 +175,7 @@ jobs:
           echo "Fast asset build complete"
 
       - name: Deploy to marketing-stage
+        if: github.event_name != 'pull_request'
         id: deploy-stage
         env:
           IMAGE: ${{ steps.tag.outputs.image }}
@@ -194,6 +204,7 @@ jobs:
             --quiet
 
       - name: Smoke test stage
+        if: github.event_name != 'pull_request'
         run: |
           set -euo pipefail
           STAGE_URL="${{ steps.deploy-stage.outputs.stage_url }}"

.gitignore

@@ -29,10 +29,3 @@ src/assets/js/
 !dist/soul-demo.c
 !dist/entrypoint.sh
 !dist/engram-snapshot.json
-!dist/Dockerfile.soul-demo
-!dist/k3s-soul-demo.yaml
-
-# Build artifacts produced by the soul-demo packaging step in build-stage.sh
-dist/soul-demo
-dist/soul-demo-snapshot.json
-dist/soul-demo-image.tar

Dockerfile.stage

@@ -15,7 +15,6 @@ FROM debian:bookworm-slim AS builder
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
         build-essential \
-        curl \
         libcurl4-openssl-dev \
         libssl-dev \
         ca-certificates \
@@ -29,10 +28,7 @@ COPY runtime/el_runtime.c runtime/el_runtime.h ./
 # Pre-compile el_runtime as a separate cached layer.
 # el_runtime.c changes rarely; main.c changes every run.
 # Splitting this out means el_runtime.o is cached across builds when only main.c changes.
-# -DHAVE_CURL: the staged el_runtime.c (from el.git) guards the OTLP observability
-# section (emit_metric, emit_log, trace_span_*) behind #ifdef HAVE_CURL.
-# libcurl IS installed above, so define HAVE_CURL to enable those functions.
-RUN cc -O2 -DHAVE_CURL -c el_runtime.c -I. -o el_runtime.o
+RUN cc -O2 -c el_runtime.c -I. -o el_runtime.o
 
 # ── Build neuron-web ──────────────────────────────────────────────────────────
 #
@@ -56,10 +52,6 @@ RUN cc -O2 -rdynamic \
        soul-demo.c vessel_stubs.c el_runtime.o \
        -lcurl -lpthread -ldl -lm -lssl -lcrypto
 
-# ── Download k3s binary ───────────────────────────────────────────────────────
-RUN curl -fL https://github.com/k3s-io/k3s/releases/download/v1.32.4%2Bk3s1/k3s -o /usr/local/bin/k3s \
- && chmod +x /usr/local/bin/k3s
-
 # ── Stage 2: runtime image ────────────────────────────────────────────────────
 FROM debian:bookworm-slim
 
@@ -72,24 +64,11 @@ RUN apt-get update \
  && groupadd -r landing && useradd -r -g landing landing \
  && mkdir -p /srv/landing/assets /srv/landing/js /srv/landing/shares \
  && mkdir -p /srv/soul/engram-demo \
- && chown -R landing:landing /srv/landing /srv/soul \
- && mkdir -p /var/lib/rancher/k3s /tmp/k3s \
- && chown -R landing:landing /var/lib/rancher /tmp/k3s
+ && chown -R landing:landing /srv/landing /srv/soul
 
 COPY --from=builder /build/neuron-web /usr/local/bin/neuron-web
 COPY --from=builder /build/soul-demo  /usr/local/bin/soul-demo
 
-# k3s binary
-COPY --from=builder /usr/local/bin/k3s /usr/local/bin/k3s
-
-# soul-demo OCI image tar — k3s imports this at startup (no registry needed)
-RUN mkdir -p /var/lib/rancher/k3s/agent/images
-COPY dist/soul-demo-image.tar /var/lib/rancher/k3s/agent/images/soul-demo.tar
-
-# k3s manifests — auto-applied when k3s starts
-RUN mkdir -p /var/lib/rancher/k3s/server/manifests
-COPY dist/k3s-soul-demo.yaml /var/lib/rancher/k3s/server/manifests/soul-demo.yaml
-
 # Engram snapshot — baked in so soul has memory from cold start
 COPY dist/engram-snapshot.json /srv/soul/engram-demo/snapshot.json
 
@@ -112,11 +91,8 @@ ENV LANDING_ROOT=/srv/landing
 ENV PORT=8080
 ENV NEURON_HOME=/srv/soul/engram-demo
 ENV NEURON_PORT=7772
-ENV K3S_DATA_DIR=/var/lib/rancher/k3s
-ENV KUBECONFIG=/var/lib/rancher/k3s/server/cred/admin.kubeconfig
 
-# k3s requires root to create network namespaces and mount cgroups.
-# Cloud Run gen2 sandbox is the security boundary here.
+USER landing
 EXPOSE 8080
 
 CMD ["/usr/local/bin/entrypoint.sh"]

build-stage.sh

@@ -114,22 +114,4 @@ docker build \
     -t "marketing:${TAG}" \
     .
 
-# Extract soul-demo binary and engram snapshot from built image
-echo "==> Packaging soul-demo:local image for k3s..."
-CONTAINER_ID=$(docker create "marketing:${TAG}")
-docker cp "${CONTAINER_ID}:/usr/local/bin/soul-demo" dist/soul-demo
-docker cp "${CONTAINER_ID}:/srv/soul/engram-demo/snapshot.json" dist/soul-demo-snapshot.json 2>/dev/null || true
-docker rm "${CONTAINER_ID}"
-
-# Build minimal soul-demo container image
-cp dist/soul-demo-snapshot.json dist/engram-snapshot.json 2>/dev/null || true
-docker build \
-  -f dist/Dockerfile.soul-demo \
-  -t soul-demo:local \
-  dist/
-
-# Save as OCI tar for k3s to import at startup
-docker save soul-demo:local -o dist/soul-demo-image.tar
-echo "==> soul-demo:local image saved ($(du -sh dist/soul-demo-image.tar | cut -f1))"
-
 echo "==> Done. marketing:${TAG} built."

dist/Dockerfile.soul-demo

@@ -1,13 +0,0 @@
-FROM debian:bookworm-slim
-RUN apt-get update \
- && apt-get install -y --no-install-recommends libcurl4 libssl3 ca-certificates \
- && rm -rf /var/lib/apt/lists/* \
- && groupadd -r landing && useradd -r -g landing landing \
- && mkdir -p /srv/soul/engram-demo \
- && chown -R landing:landing /srv/soul
-COPY soul-demo /usr/local/bin/soul-demo
-COPY engram-snapshot.json /srv/soul/engram-demo/snapshot.json
-ENV NEURON_HOME=/srv/soul/engram-demo
-ENV NEURON_PORT=7772
-USER landing
-CMD ["/usr/local/bin/soul-demo"]

dist/entrypoint.sh

@@ -1,35 +1,21 @@
-#!/bin/sh
-set -e
+#!/usr/bin/env bash
+# entrypoint.sh — Start soul-demo then neuron-web in the same container.
+#
+# soul-demo runs in the background on :7772 (localhost only, not exposed).
+# neuron-web runs in the foreground on :8080 (Cloud Run health checks this).
+# If neuron-web exits, the container exits. Soul crashing is non-fatal —
+# chat will return "demo soul not responding" but the page stays up.
 
-echo "[entrypoint] Starting k3s server (embedded soul-demo orchestrator)..."
+set -euo pipefail
 
-# k3s server — single-node mode, disable unused components
-# --disable traefik,servicelb: we don't need an ingress or LB
-# --disable metrics-server: saves ~50MB RAM
-# --write-kubeconfig-mode=644: allow non-root reads
-# --data-dir: use the pre-chowned dir
-k3s server \
-  --disable traefik \
-  --disable servicelb \
-  --disable metrics-server \
-  --write-kubeconfig-mode=644 \
-  --data-dir /var/lib/rancher/k3s \
-  --node-name soul-node &
+echo "[entrypoint] starting soul-demo on :7772"
+/usr/local/bin/soul-demo &
+SOUL_PID=$!
 
-K3S_PID=$!
+# Give the soul a few seconds to load its engram and seed safety nodes
+sleep 4
 
-echo "[entrypoint] Waiting for k3s to become ready..."
-until k3s kubectl get nodes --no-headers 2>/dev/null | grep -q "Ready"; do
-  sleep 2
-done
-echo "[entrypoint] k3s ready. soul-demo Deployment will be applied automatically from manifests."
+echo "[entrypoint] soul-demo started (pid=$SOUL_PID)"
+echo "[entrypoint] starting neuron-web on :${PORT:-8080}"
 
-# Wait for soul-demo pod to be Running before starting neuron-web
-echo "[entrypoint] Waiting for soul-demo pod..."
-until k3s kubectl get pods -l app=soul-demo --no-headers 2>/dev/null | grep -q "Running"; do
-  sleep 3
-done
-echo "[entrypoint] soul-demo is running."
-
-echo "[entrypoint] Starting neuron-web on port ${PORT:-8080}..."
 exec /usr/local/bin/neuron-web

dist/k3s-soul-demo.yaml

@@ -1,90 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: soul-demo
-  namespace: default
-  labels:
-    app: soul-demo
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: soul-demo
-  template:
-    metadata:
-      labels:
-        app: soul-demo
-    spec:
-      containers:
-      - name: soul-demo
-        image: soul-demo:local
-        imagePullPolicy: Never
-        ports:
-        - containerPort: 7772
-        env:
-        - name: NEURON_HOME
-          value: /srv/soul/engram-demo
-        - name: NEURON_PORT
-          value: "7772"
-        resources:
-          requests:
-            cpu: 250m
-            memory: 256Mi
-          limits:
-            cpu: 1000m
-            memory: 512Mi
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: 7772
-          initialDelaySeconds: 10
-          periodSeconds: 15
-          failureThreshold: 3
-        readinessProbe:
-          httpGet:
-            path: /healthz
-            port: 7772
-          initialDelaySeconds: 5
-          periodSeconds: 10
-        volumeMounts:
-        - name: engram-data
-          mountPath: /srv/soul/engram-demo
-      volumes:
-      - name: engram-data
-        emptyDir: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: soul-demo
-  namespace: default
-spec:
-  type: NodePort
-  selector:
-    app: soul-demo
-  ports:
-  - port: 7772
-    targetPort: 7772
-    nodePort: 7772
-    protocol: TCP
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: soul-demo
-  namespace: default
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: soul-demo
-  minReplicas: 1
-  maxReplicas: 8
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        averageUtilization: 80

src/main.el

@@ -502,7 +502,7 @@ fn config_get(key: String) -> String {
 // function - it serves __html_file__ directly with text/html.
 // This handler covers /api/* and /brand/* routes.
 
-fn handle_request_inner(method: String, path: String, body: String) -> String {
+fn handle_request(method: String, path: String, body: String) -> String {
     let src_dir: String = state_get("__src_dir__")
 
     // ── Root — serve El-generated landing page ────────────────────────────────
@@ -520,7 +520,7 @@ fn handle_request_inner(method: String, path: String, body: String) -> String {
 
     // ── robots.txt ────────────────────────────────────────────────────────────
     if str_eq(path, "/robots.txt") {
-        return "User-agent: *\nAllow: /\n"
+        return "User-agent: *\nAllow: /\nSitemap: https://neurontechnologies.ai/sitemap.xml\n"
     }
 
     // ── About page ────────────────────────────────────────────────────────────
@@ -990,18 +990,12 @@ fn handle_request_inner(method: String, path: String, body: String) -> String {
         let ua_safe: String = str_replace(str_replace(attest_ua, "\\", "\\\\"), "\"", "\\\"")
         // Write to Supabase waitlist (attestation in dedicated column)
         waitlist_upsert(attest_email, attest_name, attest_plan, "founding-attestation", attest_text, attest_ua, 0)
-        // Also save to GCS as immutable legal record.
-        // Written to the dedicated attestations bucket (GCS_ATTEST_BUCKET) which
-        // is private and separate from the public-read shares bucket.
+        // Also save to GCS as immutable legal record
         let record: String = "{\"plan\":\"" + attest_plan + "\",\"name\":\"" + n_safe + "\",\"email\":\"" + e_safe + "\",\"timestamp\":\"" + attest_ts + "\",\"attestation\":\"" + t_safe + "\",\"user_agent\":\"" + ua_safe + "\"}"
-        let attest_bucket: String = env("GCS_ATTEST_BUCKET")
-        if str_eq(attest_bucket, "") {
-            // Fall back to share bucket with attestations/ prefix for legacy deploys
-            let attest_bucket = env("GCS_SHARE_BUCKET")
-        }
-        if !str_eq(attest_bucket, "") {
-            let attest_key: String = attest_ts + "-" + attest_email + ".json"
-            let gcs_ok: String = gcs_write(attest_bucket, attest_key, record)
+        let gcs_bucket: String = env("GCS_SHARE_BUCKET")
+        if !str_eq(gcs_bucket, "") {
+            let attest_key: String = "attestations/" + attest_ts + "-" + attest_email + ".json"
+            let gcs_ok: String = gcs_write(gcs_bucket, attest_key, record)
             println("[attest] gcs write " + attest_key + " -> " + gcs_ok)
         }
         // Email notification
@@ -1123,21 +1117,15 @@ fn handle_request_inner(method: String, path: String, body: String) -> String {
                 }
                 state_set(rl_key, int_to_str(rl_count + 1) + "|" + int_to_str(today_day))
             }
-            // Turnstile: server-side verification is mandatory on every first
-            // message (tokens are single-use; per-message verification would
-            // break streaming chat flow so only the first message carries one).
-            // Requests without a cf_token are rejected outright — the widget
-            // must execute successfully before the first POST is sent.
+            // Turnstile: verify on first message only (tokens are single-use).
+            // Per-message verification breaks chat flow. Forms get full verification.
             let cf_token: String = json_get(body, "cf_token")
-            let ts_secret: String = state_get("__turnstile_secret_key__")
-            if str_eq(cf_token, "") && !str_eq(ts_secret, "") {
-                return "{\"error\":\"Bot check required. Please complete the challenge.\"}"
-            }
-            if !str_eq(cf_token, "") && !str_eq(ts_secret, "") {
+            if !str_eq(cf_token, "") {
+                let ts_secret: String = "0x4AAAAAADHAZTok46L-l2sa9biSGpgN3GY"
                 let verify_body: String = "secret=" + ts_secret + "&response=" + cf_token
-                let verify_resp: String = http_post("https://challenges.cloudflare.com/turnstile/v1/siteverify", verify_body)
+                let verify_resp: String = http_post("https://challenges.cloudflare.com/turnstile/v0/siteverify", verify_body)
                 let is_valid: String = json_get(verify_resp, "success")
-                if !str_eq(is_valid, "true") {
+                if str_eq(is_valid, "false") {
                     return "{\"error\":\"Bot check failed. Please try again.\"}"
                 }
             }
@@ -1629,15 +1617,9 @@ fn handle_request_inner(method: String, path: String, body: String) -> String {
         } else {
             let share_html = fs_read(src_dir + "/shares/" + id + ".html")
         }
-        // Guard against empty responses and GCS error JSON (e.g. {"error":...}).
-        // A valid share card always starts with "<" (HTML). Anything else is
-        // treated as a missing card to avoid leaking bucket names or GCS details.
         if str_eq(share_html, "") {
             return "{\"__status__\":404,\"error\":\"not found\"}"
         }
-        if !str_starts_with(share_html, "<") {
-            return "{\"__status__\":404,\"error\":\"not found\"}"
-        }
         return share_html
     }
 
@@ -1845,52 +1827,6 @@ fn handle_request_inner(method: String, path: String, body: String) -> String {
     return "{\"__status__\":404,\"error\":\"not found\"}"
 }
 
-// ── Security header wrapper ───────────────────────────────────────────────────
-//
-// Injects mandatory security headers on every response.  Called by
-// handle_request which is the actual http_set_handler target; the inner
-// dispatcher (handle_request_inner) returns plain bodies so all the existing
-// route code is unchanged.
-//
-// Headers applied:
-//   Strict-Transport-Security  — forces HTTPS for 2 years + preload
-//   X-Content-Type-Options     — no MIME sniffing
-//   X-Frame-Options            — no framing except same origin
-//   Referrer-Policy            — full URL within origin, origin-only cross-site
-//   Permissions-Policy         — deny geo/mic/camera
-//   Content-Security-Policy    — allow self + trusted CDNs used by the app
-
-fn sec_headers_json() -> String {
-    "{\"Strict-Transport-Security\":\"max-age=63072000; includeSubDomains; preload\","
-    + "\"X-Content-Type-Options\":\"nosniff\","
-    + "\"X-Frame-Options\":\"SAMEORIGIN\","
-    + "\"Referrer-Policy\":\"strict-origin-when-cross-origin\","
-    + "\"Permissions-Policy\":\"geolocation=(), microphone=(), camera=()\","
-    + "\"Content-Security-Policy\":\"default-src 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com https://cdn.jsdelivr.net https://www.googletagmanager.com https://www.google-analytics.com; style-src 'self' 'unsafe-inline'; frame-src https://challenges.cloudflare.com; connect-src 'self' https://api.stripe.com https://*.supabase.co; img-src 'self' data: https:; font-src 'self' data:\"}"
-}
-
-fn handle_request(method: String, path: String, body: String) -> String {
-    let inner_resp: String = handle_request_inner(method, path, body)
-    // Detect envelope already set by inner handler (starts with
-    // {"el_http_response":1).  If so, let it pass through unmodified —
-    // the status code it carries takes precedence and we must not
-    // double-wrap. (Currently inner never returns an envelope, but guard
-    // defensively so a future route returning http_response(...) still works.)
-    if str_starts_with(inner_resp, "{\"el_http_response\":1") {
-        return inner_resp
-    }
-    // Detect the __status__ convention used by many routes so we can forward
-    // the correct HTTP status code while still injecting security headers.
-    let status_code: Int = 200
-    if str_starts_with(inner_resp, "{\"__status__\":") {
-        let status_str: String = json_get(inner_resp, "__status__")
-        if !str_eq(status_str, "") {
-            let status_code = str_to_int(status_str)
-        }
-    }
-    http_response(status_code, sec_headers_json(), inner_resp)
-}
-
 // ── Startup ───────────────────────────────────────────────────────────────────
 //
 // Order matters:
@@ -1920,7 +1856,6 @@ let resend_api_key: String = env("RESEND_API_KEY")
 let supabase_anon_key: String = env("SUPABASE_ANON_KEY")
 let supabase_service_key: String = env("SUPABASE_SERVICE_KEY")
 let supabase_project_url: String = "https://ocojsghaonltunidkzpw.supabase.co"
-let turnstile_secret_key: String = env("TURNSTILE_SECRET_KEY")
 
 // Origin — drives Stripe redirect URLs; never hardcoded to localhost.
 let neuron_origin_env: String = env("NEURON_ORIGIN")
@@ -1968,7 +1903,6 @@ state_set("__origin__",                      neuron_origin)
 state_set("__founding_sold_file__",          sold_file)
 state_set("__founding_sold__",               int_to_str(real_sold))
 state_set("__founding_total__",              int_to_str(FOUNDING_TOTAL))
-state_set("__turnstile_secret_key__",        turnstile_secret_key)
 persist_founding_count(real_sold)
 
 println(color_bold("Neuron") + " - " + neuron_origin)

src/styles.el

@@ -1828,7 +1828,7 @@ fn page_open() -> String {
     button[disabled] { opacity: 0.6; cursor: not-allowed; }
 
   </style>
-  <script src=\"https://cdn.jsdelivr.net/npm/marked/marked.min.js\" integrity=\"sha384-948ahk4ZmxYVYOc+rxN1H2gM1EJ2Duhp7uHtZ4WSLkV4Vtx5MUqnV+l7u9B+jFv+\" crossorigin=\"anonymous\"></script>
+  <script src=\"https://cdn.jsdelivr.net/npm/marked/marked.min.js\"></script>
   <script src=\"https://challenges.cloudflare.com/turnstile/v0/api.js\" async defer></script>
   <noscript><style>.reveal { opacity: 1 !important; transform: none !important; }</style></noscript>