chore(wzdx): remove two dead config fields

Both were fully plumbed and read by nothing.

api_key -- self-documented as dead at config.py ("Keyless: api_key is
retained but unused"), yet wired end-to-end: a GUI ManagedSecret field, a
SECRET_FIELDS entry, an EXPECTED_SECRETS entry, a secrets_store mapping and
label, and a line in .env.example. env/wzdx.py assigned self._api_key and
never read it again. So an operator could go get an API key, paste it into
the secure secrets manager, and have it do precisely nothing -- the ritual
looked complete end to end, which is what made it worth removing rather
than leaving.

endpoints -- default ["/get/event"], exposed as an editable list in the
dashboard, never read. Copy-paste from Roads511Config.endpoints (which IS
read, at env/roads511.py; Roads511 is untouched here). WZDx discovers feeds
via the FHWA registry_url/states instead.

WZDx's actual fetch behavior is unchanged; this removes dead config only.

Note for existing installs: anyone with WZDX_API_KEY set in
/data/secrets/.env will simply have an ignored env var. Harmless -- it was
already ignored.

Suite: 2337 passed, 6 failed (the pre-existing set: stale SCHEMA_VERSION x3,
expired TLE fixtures x2, one order-dependent), 72 skipped -- exact baseline
match, no new failures.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

work/config/.env.example

@@ -15,7 +15,6 @@ MQTT_PASSWORD=
 TOMTOM_API_KEY=
 FIRMS_MAP_KEY=
 ROADS511_API_KEY=
-WZDX_API_KEY=
 
 # Notification Credentials
 SMTP_PASSWORD=

work/dashboard-frontend/src/pages/Environment.tsx

@@ -31,7 +31,7 @@ interface EnvConfig {
  usgs_quake: { enabled: boolean; tick_seconds: number; feed_url: string; min_magnitude?: number; bbox?: number[]; global_mag_floor: number; regional_mag_floor: number; regional_radius_mi: number; escalate_mag_floor: number; broadcast_pager_alerts: string[]; region: string; feed_source?: FeedSource }
  traffic: { enabled: boolean; tick_seconds: number; api_key: string; corridors: { name: string; lat: number; lon: number }[]; feed_source?: FeedSource }
  roads511: { enabled: boolean; tick_seconds: number; api_key: string; base_url: string; endpoints: string[]; bbox: number[]; feed_source?: FeedSource }
- wzdx: { enabled: boolean; tick_seconds: number; api_key: string; base_url: string; endpoints: string[]; bbox: number[]; states: string[]; registry_url: string; registry_ttl?: number; feed_source?: FeedSource }
+ wzdx: { enabled: boolean; tick_seconds: number; base_url: string; bbox: number[]; states: string[]; registry_url: string; registry_ttl?: number; feed_source?: FeedSource }
  firms: { enabled: boolean; tick_seconds: number; map_key: string; source: string; bbox: number[]; day_range: number; confidence_min: string; proximity_km: number; feed_source?: FeedSource }
  // Native satpass (SGP4) YAML layer — drives env/satpass.py + env/tle_fetch.py.
  // Distinct from the Central adapter_config/satpass layer (see SatpassConfig
@@ -1362,9 +1362,7 @@ const save = async () => {
     {env.wzdx?.feed_source !== 'central' && (
      <>
       <TextInput label="Base URL" value={env.wzdx?.base_url ?? ''} onChange={(v) => up({ wzdx: { ...env.wzdx!, base_url: v } })} placeholder="https://511.yourstate.gov/api/v2" />
-      <ManagedSecret envVar="WZDX_API_KEY" label="API Key" helper="Leave unset if not required" />
       <NumberInput label="Tick Seconds" value={env.wzdx?.tick_seconds ?? 300} onChange={(v) => up({ wzdx: { ...env.wzdx!, tick_seconds: v } })} min={60} />
-      <ListInput label="Endpoints" value={env.wzdx?.endpoints ?? ['/get/event']} onChange={(v) => up({ wzdx: { ...env.wzdx!, endpoints: v } })} helper="e.g., /get/event" />
       {scopedByCoverage('wzdx') ? (
        <div className="text-xs text-[#666] bg-bg-hover px-3 py-2 border border-border/50">
         Bounding box and states are set by the{' '}

work/meshai/config.py

@@ -478,14 +478,12 @@ class WZDxConfig(_SourcedFeed):
     Native adapter discovers state DOT WZDx v4 GeoJSON feeds via the FHWA
     WZDx Feed Registry (keyless), filters to `states`, then polls each
     matching feed and parses ``work-zone`` road_events into canonical
-    ``work_zone`` events. Keyless: ``api_key`` is retained but unused.
+    ``work_zone`` events.
     """
 
     enabled: bool = False
     tick_seconds: int = 300  # per-feed poll interval
-    api_key: str = ""  # unused (keyless); retained for parity / ${ENV_VAR}
     base_url: str = ""  # optional single-feed override (skips registry when set)
-    endpoints: list = field(default_factory=lambda: ["/get/event"])
     bbox: list = field(default_factory=list)  # [west, south, east, north] optional filter
     # FHWA WZDx Feed Registry (Socrata) — rows describe every state DOT feed.
     registry_url: str = (

work/meshai/config_loader.py

@@ -84,7 +84,6 @@ SECRET_FIELDS: set[str] = {
     "environmental.traffic.api_key",
     "environmental.firms.map_key",
     "environmental.roads511.api_key",
-    "environmental.wzdx.api_key",
     "notifications.rules.*.smtp_password",
     "notifications.toggles.*.smtp_password",
     "danger_zones.webhook_url",
@@ -100,7 +99,6 @@ EXPECTED_SECRETS: list[str] = [
     "TOMTOM_API_KEY",
     "FIRMS_MAP_KEY",
     "ROADS511_API_KEY",
-    "WZDX_API_KEY",
     "SMTP_PASSWORD",
 ]
 

work/meshai/env/wzdx.py

@@ -51,7 +51,6 @@ restart-seed all dedup on the same coalesced value).
 import calendar
 import json
 import logging
-import os
 import time
 from datetime import datetime
 from typing import TYPE_CHECKING, Optional
@@ -110,7 +109,6 @@ class WZDxAdapter:
     """FHWA WZDx work-zone polling adapter (native ``work_zone`` source)."""
 
     def __init__(self, config: "WZDxConfig", coverage: dict = None):
-        self._api_key = self._resolve_env(config.api_key or "")  # unused (keyless)
         self._base_url = (config.base_url or "").strip().rstrip("/")
         self._registry_url = (config.registry_url or "").strip()
         self._registry_ttl = config.registry_ttl or 21600
@@ -135,12 +133,6 @@ class WZDxAdapter:
 
     # ── helpers ────────────────────────────────────────────────────────────
 
-    def _resolve_env(self, value: str) -> str:
-        """Resolve ${ENV_VAR} references in value."""
-        if value and value.startswith("${") and value.endswith("}"):
-            return os.environ.get(value[2:-1], "")
-        return value
-
     def _wanted_states(self) -> set:
         """Lowercased set of accepted state tokens (abbrev + full name)."""
         wanted = set()

work/meshai/secrets_store.py

@@ -24,7 +24,6 @@ SECRET_FIELD_TO_ENV: dict[str, str] = {
     "environmental.traffic.api_key": "TOMTOM_API_KEY",
     "environmental.firms.map_key": "FIRMS_MAP_KEY",
     "environmental.roads511.api_key": "ROADS511_API_KEY",
-    "environmental.wzdx.api_key": "WZDX_API_KEY",
     "notifications.toggles.*.smtp_password": "SMTP_PASSWORD",
     "notifications.rules.*.smtp_password": "SMTP_PASSWORD",
     "mesh_sources.*.api_token": "MESHMONITOR_API_TOKEN",
@@ -51,7 +50,6 @@ SECRET_LABELS: dict[str, str] = {
     "TOMTOM_API_KEY": "TomTom API key",
     "FIRMS_MAP_KEY": "NASA FIRMS MAP_KEY",
     "ROADS511_API_KEY": "511 Roads API key",
-    "WZDX_API_KEY": "WZDx API key",
     "SMTP_PASSWORD": "SMTP password",
     "MESHMONITOR_API_TOKEN": "MeshMonitor API token",
     "MQTT_PASSWORD": "MQTT password",

work/tests/test_adapter_wzdx.py

@@ -35,7 +35,6 @@ def mock_config():
     return SimpleNamespace(
         enabled=True,
         feed_source="native",
-        api_key="",
         base_url="",
         registry_url="https://datahub.transportation.gov/resource/69qe-yiui.json?$limit=200",
         registry_ttl=21600,

work/tests/test_coverage_wiring.py

@@ -97,7 +97,6 @@ def test_roads511_fallback_to_config():
 
 def _wzdx_cfg(states=None, bbox=None):
     cfg = MagicMock()
-    cfg.api_key = ""
     cfg.base_url = ""
     cfg.registry_url = "https://example.test/registry.json"
     cfg.registry_ttl = 21600

work/tests/test_secrets_store.py

@@ -131,7 +131,7 @@ def test_env_to_fields_llm():
 def test_secret_labels_keys():
     expected = {
         "GOOGLE_API_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "LLM_API_KEY",
-        "TOMTOM_API_KEY", "FIRMS_MAP_KEY", "ROADS511_API_KEY", "WZDX_API_KEY",
+        "TOMTOM_API_KEY", "FIRMS_MAP_KEY", "ROADS511_API_KEY",
         "SMTP_PASSWORD", "MESHMONITOR_API_TOKEN", "MQTT_PASSWORD",
     }
     assert set(secrets_store.SECRET_LABELS.keys()) == expected

work/tests/test_wzdx_coalescing.py

@@ -25,7 +25,6 @@ def mock_config():
     return SimpleNamespace(
         enabled=True,
         feed_source="native",
-        api_key="",
         base_url="",
         registry_url="https://datahub.transportation.gov/resource/69qe-yiui.json?$limit=200",
         registry_ttl=21600,