Disable public Worker preview URLs

CONTRIBUTING.md

@@ -97,7 +97,7 @@ The single source of truth for the registries is `docs/quality-registries.toml`.
 
 ## Secrets and deploy configuration
 
-Deployment uses repository secrets: `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID` (Preview workflow), plus optional `PBE_SMOKE_BYPASS_SECRET` so deploy smoke tests can run edited-code POSTs past the Turnstile challenge. Runtime Worker secrets (`TURNSTILE_SECRET_KEY`, `TURNSTILE_CLEARANCE_SECRET`, `PBE_SMOKE_BYPASS_SECRET`) are managed with `wrangler secret put`; see `docs/turnstile-runner-protection-spec.md`.
+Production deployment is manual through an authenticated Wrangler session with `make deploy`; public `workers.dev` and version preview URLs are disabled. Runtime Worker secrets (`TURNSTILE_SECRET_KEY`, `TURNSTILE_CLEARANCE_SECRET`, `PBE_SMOKE_BYPASS_SECRET`) are managed with `wrangler secret put`; see `docs/turnstile-runner-protection-spec.md`.
 
 Generated output is prevented from drifting before merge: install the local hooks with `scripts/install-git-hooks.sh`, and keep `main` protected so pull requests require the `verify` status check to pass against the current base. CI enforces the same `make check-generated` contract for contributors without local hooks.
 

README.md

@@ -228,7 +228,7 @@ Use the active Cloudflare-supported Python version.
 
 ## Cloudflare notes
 
-- `wrangler.jsonc` enables `python_workers` and `python_dedicated_snapshot`.
+- `wrangler.jsonc` enables `python_workers` and `python_dedicated_snapshot` while disabling both public `workers.dev` and version preview URLs.
 - The parent Worker uses a `LOADER` Worker Loader binding.
 - Dynamic Worker IDs include Python version, example slug, and submitted code hash.
 - Dynamic Workers run with `globalOutbound: null` and tight CPU/subrequest limits.

docs/turnstile-runner-protection-spec.md

@@ -404,8 +404,8 @@ this rule, record its zone, rule ID, plan, expression, characteristics,
 threshold/period, mitigation/action, deployment date, and a controlled 429
 Security Events result in the release record. `wrangler.jsonc` deploys the
 Worker only; it cannot declare or verify zone WAF rate-limiting rules. The
-production configuration disables `workers.dev` so the custom-domain WAF rule
-is not bypassed by a public fallback hostname.
+production configuration disables `workers.dev` and version preview URLs so the
+custom-domain WAF rule is not bypassed by a public fallback hostname.
 
 Cloudflare Dashboard:
 

tests/test_app.py

@@ -432,9 +432,10 @@ def test_generated_drift_is_blocked_before_commit_and_merge(self):
         self.assertIn("make verify", verify_workflow)
         self.assertIn("uv sync --locked --all-groups", verify_workflow)
         self.assertIn("npm ci --ignore-scripts", verify_workflow)
-        preview_workflow = (ROOT / ".github" / "workflows" / "preview.yml").read_text()
-        self.assertIn("uv sync --locked --all-groups", preview_workflow)
-        self.assertIn("npm exec -- wrangler whoami", preview_workflow)
+        self.assertFalse((ROOT / ".github" / "workflows" / "preview.yml").exists())
+        wrangler_config = (ROOT / "wrangler.jsonc").read_text()
+        self.assertIn('"workers_dev": false', wrangler_config)
+        self.assertIn('"preview_urls": false', wrangler_config)
         package = json.loads((ROOT / "package.json").read_text())
         lock = json.loads((ROOT / "package-lock.json").read_text())
         self.assertEqual(package["devDependencies"]["wrangler"], "4.110.0")

wrangler.jsonc

@@ -8,7 +8,7 @@
     "python_dedicated_snapshot"
   ],
   "workers_dev": false,
-  "preview_urls": true,
+  "preview_urls": false,
   "routes": [
     {
       "pattern": "www.pythonbyexample.dev",