[bborbe]

The online leaderboard is on hold; its deployment is being torn down (nuke-prod ns driftline, the hetzner-1 vhost via bborbe/bw#53, the LE cert). server/ code and server/k8s/ stay.

• server/README.md: says the server is not deployed and what a redeploy needs
• .github/workflows/pages.yml: drops the VITE_LEADERBOARD_URL / VITE_LEADERBOARD_TOKEN env (never set; no dead secret wiring)
• CHANGELOG ## Unreleased bullet

Merge waits until the teardown steps have run, so the note does not precede the fact.

[github-actions]

Preview: https://bborbe.github.io/driftline/pr-170/
Commit: 5e334b1ab82e103513bfaeaa07fb60968bcbd443 (check <meta name="commit">). Updates on every push, removed when the PR closes.

[ben-s-pull-request-reviewer]

This is a docs-only PR. The coding plugin docs aren't available in this environment, but this is a straightforward documentation change. Let me complete the review.

Manual Review:

1. .github/workflows/pages.yml - The VITE_LEADERBOARD_URL and VITE_LEADERBOARD_TOKEN env vars are removed from the build step. This is correct — the leaderboard server is no longer deployed, so passing these vars is unnecessary.

2. CHANGELOG.md - The unreleased entry accurately describes the change: leaderboard server no longer deployed, namespace and vhost torn down, server/ stays, server/README.md § Deploy has redeploy instructions, Pages build no longer passes the leaderboard URL/token.

3. server/README.md - The description now says "Not deployed" with date and reference to § Deploy. § Deploy opens with a clear ⚠️ warning about the current state and what a redeploy needs (namespace, vhost, certificate, plus the Pages env lines). The final paragraph correctly states the Pages build no longer passes the env vars.

All three files are consistent with each other and with the stated intent. No issues found.

{
  "verdict": "approve",
  "summary": "Docs-only PR removes the leaderboard URL/token from the Pages workflow and documents the server's undeployed state consistently across CHANGELOG.md and server/README.md.",
  "comments": [],
  "concerns_addressed": []
}

superseded by new automated review

[ben-s-pull-request-reviewer]

The changes are all documentation-only. Let me verify the key facts:

1. .github/workflows/pages.yml: The VITE_LEADERBOARD_URL and VITE_LEADERBOARD_TOKEN env vars are removed from the build matrix — the game will be built without leaderboard config, making it offline-only.

2. CHANGELOG.md: A clear ## Unreleased entry documents the change: the leaderboard server is no longer deployed, namespace and vhost are torn down, but server/ and server/k8s/ remain.

3. server/README.md: The opening paragraph and § Deploy are updated to reflect the undeployed state, with a warning block and instructions for redeployment.

All three files are consistent. The factual claim ("not deployed since 2026-10-18") is stated consistently. No code is changed. No credentials are exposed — the vars were for a now-torn-down server.

Step 4 early exit: Changed files are .yml and .md. No .go, .py, .js, .ts, etc. files modified. The server/README.md is a README.md match but no rule targets README files. The mechanical funnel returned zero findings. This is docs-only — no automated rule checks apply.

Summary: This PR cleanly documents the leaderboard server decommission. No issues found.

{
  "verdict": "approve",
  "summary": "Pure documentation PR: removes leaderboard URL/token from the Pages build env, updates CHANGELOG, and updates server/README.md § Deploy to reflect the current undeployed state. All three files are consistent, no credentials exposed, no code changed.",
  "comments": [],
  "concerns_addressed": [
    {
      "concern": "correctness: are the factual claims in CHANGELOG and server/README consistent with what pages.yml actually does?",
      "disposition": "addressed",
      "detail": "Confirmed: pages.yml removes VITE_LEADERBOARD_URL and VITE_LEADERBOARD_TOKEN from the build env; CHANGELOG says 'no longer deployed'; server/README § Deploy says 'Not deployed since 2026-10-18'. All three align."
    },
    {
      "concern": "security: does removing the leaderboard env vars from the workflow expose any credentials?",
      "disposition": "addressed",
      "detail": "No. The vars VITE_LEADERBOARD_URL and VITE_LEADERBOARD_TOKEN pointed to a decommissioned server. Removing them from the workflow stops passing secrets to a non-existent endpoint."
    },
    {
      "concern": "correctness: does server/ or server/k8s/ need cleanup, or are they intentionally kept?",
      "disposition": "addressed",
      "detail": "Intentionally kept. CHANGELOG and server/README § Deploy both state this: server/ and server/k8s/ remain, with server/README.md § Deploy documenting what a redeploy needs."
    }
  ]
}