Launch: provisioning, legal review and map closeout #34

Everything that is left before Execile can go live and that only the account owner can do. No agent can complete any item here: each needs an account, a signature, or a human decision.

1. Provisioning

docs/provisioning.md is the runbook. Provisioning is complete. Three items
below were not done as written because their premise changed; each says how.

• Step 1 - Cloudflare account, then CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN as GitHub secrets. Changed. Deployment is Cloudflare Workers Builds connected to the repo, not GitHub Actions, so there is no API token and no GitHub secret. deploy.yml was deleted; ci.yml still runs format, lint, types, build and the placeholder report. The VITE_ values are Cloudflare build variables; RESEND_API_KEY and TURNSTILE_SECRET are runtime secrets. The two are different settings pages and putting a value in the wrong one fails silently.
• Step 2 - VITE_SITE_URL and VITE_CONTACT_EMAIL.
• Step 3 - mailbox. Hostinger, not Google Workspace. ASSESSMENT_TO is contact@execil.net.
• Step 4 - Email Routing on forms.execil.net, then SENDER_DOMAIN. Abandoned, and it would have broken the mailbox. Email Routing has no subdomain-only path: the dashboard reaches Settings › Subdomains through the apex, and onboarding the apex offers to remove the conflicting records "in place" - those being the Hostinger MX and SPF. Email Sending avoids the MX but writes an apex-wide _dmarc and needs a paid Workers plan. Delivery goes through Resend instead, sending from assessment@execil.net; Resend puts its own MX and SPF on send.execil.net, so the apex is untouched. docs/research/worker-to-workspace-email.md is marked superseded.
• Step 5 - verified destination address, then the EMAIL binding. Not applicable to Resend, which verifies the sender domain, not the recipient. RESEND_FROM and ASSESSMENT_TO are wrangler vars; RESEND_API_KEY is a runtime secret.
• Step 6 - Turnstile widget, sitekey as a build variable, TURNSTILE_SECRET as a runtime secret. The server now also verifies hostname and action, which Cloudflare's own flow requires and the original code did not do - hostname was read into the verdict type and ignored. That matters because Turnstile adds localhost to every widget automatically and the sitekey is public.
• Step 7 - PostHog. Running behind a reverse proxy at f.execil.net, cookieless. See the divergence note below.
• Step 8 - WAF rate-limiting rule. Free allows one rule per zone, matches Path and Verified Bot only (Method needs Business), and caps the period at 10 seconds. Rule is path-only on /api/assessment, 5 requests / 10s / IP, Block. Verified: five requests pass, the sixth returns 429. Zone rule, so it does not cover the workers.dev hostname, which remains enabled by choice.
• Step 9 - custom domain. execil.net and www.execil.net are Worker custom domains; both serve, both canonical to the bare domain.
• Step 10 - launch checks. Sitemap not yet submitted to Search Console. A real submission has been made end to end and arrived.

Verified live

Site on execil.net with correct canonicals · form submitted end to end (Turnstile, hostname and action checks, Resend, delivery to contact@execil.net) · PostHog ingesting through f.execil.net with no cookies · rate limit firing at the sixth request.

Mail was repaired along the way: the three Hostinger DKIM CNAMEs and the autoconfig/autodiscover CNAMEs existed in Hostinger's panel but had never been copied into the Cloudflare zone, so outbound mail was unsigned and mail-client autoconfig resolved to a web server. Both fixed. Baseline to protect: MX 5 mx1 / 10 mx2 .hostinger.com, SPF include:_spf.mail.hostinger.com, _dmarc p=none.

2. Legal review

The three legal pages were written from what the code actually does, and the site-facing claims are verified against it: the form is emailed through a Worker and never stored, logs carry field names and outcomes only, Turnstile loads on first interaction, PostHog runs cookieless if at all, and no cookies are set.

The operational commitments are not verified, because they are promises about how Execile runs rather than facts about the code.

• Read src/legal.json and confirm the HIPAA safeguards are true: annual training, per-person logins, MFA where the practice's systems support it, no PHI over ordinary email or removable media, breach notification within the BAA's window, and subcontractor BAAs.
• Confirm the Terms' governing law (New York) and the registered entity name (EXECIL PVT LTD).
• Have counsel review /privacy, /terms and /hipaa before launch.

Note: the page is a HIPAA Statement, not a Notice of Privacy Practices. Execile is a business associate; the Notice is what a covered entity gives its patients.

3. Map closeout

• Close Map: Execile landing page #1 (wayfinder:map) and Spec: Execile landing page #20 (spec). Every sub-ticket of both is closed.

Out of scope

Group 2 of the competitor research was declined for now and is not tracked here: the monthly-collections band on the Assessment Form, the in-house billing comparison in Why Us, and per-Specialty copy. They are recorded in docs/research/competitor-landing-pages.md if they are ever wanted.