Dane — User Gates Walkthrough (2026-06-16)

For: Dane Cooper. This is your remaining-moves list, in the best order, with exact clicks, a verify step, and the reply word that hands each result back to Claude. Open the .html version (or the live link) — every box you tick saves to your name on the server, on any device.
Live: https://james-cooperluxe.pages.dev/guides/dane-user-gates/⧉ · Companion: DANE-GATE-WALKTHROUGH-2026-06-10 (the full per-gate runbook).
What changed since 06-11: the engineering side moved a lot — durable "permanent access" login shipped, error-handling/logging overhaul went live, branch protection is on, the concierge LLM upgrade is merged (flag-OFF) and a real bug in it was fixed. The launch gates below now show updated statuses; a new "06-15/16 gates" section captures this session's work, and a real "Platform build — Phase 0/1" section gives you the actual concierge go-live commands. Items I can't confirm from here (your manual clicks) are marked ⬜ verify.

How to use this page (10-second orientation):
- Every grey code box has a Copy button — click it, then paste. Messages and exact values use one box; shell commands use another. Nothing to retype by hand.
- Every blue link opens the exact destination in a new tab. Hover for the ⊞ chip to get a QR code and open it on your phone.
- Every - [ ] is a real checkbox — ✅-done items start ticked; your moves start empty; the progress bar (top) and the per-name server-save track them.

Status legend

• ✅ Done — Claude finished + verified it; nothing for you to do. These appear pre-checked below.
• 🔶 In progress — partly done on the engineering side; needs your one action to finish (left unchecked — tick when done).
• ⬜ Verify / your move — your manual step, or a setting only you can confirm.
• 🔭 Forward-pointer — approved but not this-session work; tracked in the platform plan.

Every - [ ] below is a real checkbox in the HTML: ✅-done items start ticked, your moves start empty, and the progress bar + your-name server-save track them.

✅ Verified status (2026-06-16 audit — CLAIMED vs CONFIRMED)

A 3-agent audit + live Supabase/Vercel checks graded every gate against actual execution. This table is the source of truth — the per-gate ticks further down are the to-do list, not proof.

Big features still NOT built (from the audit)

• Concierge as a live AI advisor — fully coded but flag-OFF; needs the CF Access tunnel (next priority).
• dane.cooperluxe.com master cockpit — the real in-app command center IS built (PR #16, live broker data) but the subdomain isn't reachable yet (needs the Cloudflare zone). My dane-cooperluxe.pages.dev hub is the nav front-door to it.
• Telegram/Slack → portal inbox · GPU workplace + simulator viewers — greenfield.
• bigbrain-v10 brain — blocked on GPU; bigbrain-v7 is the live brain.

✅ Done (2026-06-16): you supplied a Supabase management PAT, and Claude set + confirmed all four GoTrue gates directly — U1.1 invite-only, U1.3/4 sessions OFF, U1.5 leaked-password ON, U1.6 TOTP MFA ON — verified by reading the live config back and by the security-advisor scan dropping both auth warnings. Nothing left to click here. (6 lower-severity advisor warnings remain — pre-existing, intentional RLS helper functions + two append-only INSERT policies; tracked as candidate hardening, not gates.)

The map

Your portal doors (work today; sign-in finishes in U1):

U1 — Turn ON required sign-in (🔶 IN PROGRESS, ~7 min)

Why: the portal should be invite-only — unprovisioned viewers denied — and a sign-in that doesn't keep logging people back out. The engineering half is shipped; the two source-of-truth toggles below are the half only you can flip in Supabase.

Already done (engineering side, verified):

• [x] 🔶 U1.A Portal middleware now enforces invite-only — unprovisioned viewers are denied at the door.
• [x] 🔶 U1.B Durable "permanent access" login shipped (PR #13): 1-year session cookies, so people stop getting bounced back to re-auth.
• [x] ✅ U1.C Database security hardening applied this session (Claude, via Supabase): search_path pinned on all 7 functions + direct RPC access revoked on the 4 SECURITY DEFINER trigger functions. See DONE.6.

U1 — CLOSED by Claude (2026-06-16) via the management PAT. All four GoTrue settings below were set + confirmed against the live config (and the two auth advisors cleared); you have nothing to click here. Steps kept for the record, in case you ever want to eyeball them in the dashboard yourself:

• [x] ✅ U1.1 Open the Supabase Auth → Providers page for the cooperluxe-portal project: Supabase → Authentication → Providers.
• [x] ✅ U1.2 On that page, find the User Signups section, turn "Allow new users to sign up" OFF, and click Save (a "Successfully updated settings" toast confirms it). This sets disable_signup ON — only people you've already provisioned can get in. The setting you're flipping, for reference:

disable_signup = true   (i.e. "Allow new sign-ups" = OFF)

Caution: do NOT also disable the Email provider itself — provisioned users still sign in by email code. You're only turning off self-serve sign-up, not sign-in.

• [x] ✅ U1.3 Open the Supabase Sessions page: Supabase → Authentication → Sessions.
• [x] ✅ U1.4 Set Time-box user sessions and Inactivity timeout to OFF (or the longest allowed). If these are on, they silently undercut the 1-year login from PR #13 — this is the gate that makes "permanent access" actually permanent. (These are already OFF by default — this visit just confirms it.)
• [x] ✅ U1.5 (found by this session's security scan — same Sign In / Providers page) Under Email → Password security, turn "Prevent use of leaked passwords" ON so Supabase rejects passwords found in known breaches (HaveIBeenPwned). Sign In / Providers page · why.
• [x] ✅ U1.6 (also from the scan) Allow an MFA method for the team: Supabase → Authentication → MFA → enable Authenticator app (TOTP). This permits enrollment; it doesn't force anyone.

Tip: if the UI forces a number instead of OFF, enter the maximum it allows (e.g. a very large hours value) rather than leaving a short default in place.

Verify: open the portal in a private window with an email you have NOT provisioned → it refuses. Sign in with a provisioned email → you stay signed in across a reload and a day later (no surprise logout).

Caution (lock-out recovery): if you accidentally lock yourself out, briefly re-enable sign-up on the Providers page, provision your own email, then turn sign-up OFF again.

U2 — Delete the two dead Wix records (⬜ VERIFY, ~2 min)

Why: your main cooperluxe.com listed THREE addresses — the real Vercel one plus two leftover Google ones that answer nothing (probed: connection timeouts). Visitors whose browser picks a dead one hang before your site loads.

• [ ] ⬜ U2.1 Open the Wix domains panel: Wix → Account → Domains. Click cooperluxe.com → Manage DNS.
• [ ] ⬜ U2.2 Under the bare-domain A records, delete the two dead Google IPs. These are the exact values to remove:

216.239.36.101
216.239.38.101

• [ ] ⬜ U2.3 Confirm the one A record you KEEP is the live Vercel IP (do not delete this one):

76.76.21.21

Verify: cooperluxe.com still loads normally (it will — the Vercel record stays).

Caution: if you know of a Google service deliberately wired to the bare domain, don't delete — instead paste this back to Claude on Telegram:

[james-pack] ACTION: question DETAIL: google records

U3 — Send James his doors (✅ WIRED — confirm sent, ~3 min)

Why: everything is live and saving; James can start tonight.

Already done (engineering side, verified):

• [x] ✅ U3.A bullysupplies@gmail.com (= James Cooper) is already provisioned with his portal and his SOP cards in walkthroughs.ts. The door works.

Your remaining move:

• [ ] ⬜ U3.1 Confirm you actually sent James the message (the wiring is done; the send is yours). Here is the paste-ready message — copy the whole box and send it to James:

James — your portal: https://james-cooperluxe.pages.dev/?view=james
Sign in with your email — it sends you a code, no password.
Start with Print Design (~25-35 min), then the Overall questionnaire
(~20-30 min), then ABKC when you have an hour (two sittings is fine).
Everything saves as you go under your name — switch devices any time.
Questions → just text me.

Verify: James acknowledges. (The watcher pings your Telegram the moment he actually starts.)

Tip: James's direct door is https://james-cooperluxe.pages.dev/?view=james⧉ — the same link that's inside the message above, here as a clickable check.

U4 — Three one-reply items (⬜ VERIFY, ~3 min total, any order, all on Telegram)

Each of these is a single reply word/line back to Claude on Telegram. Copy the box, send it.

• [ ] ⬜ U4.1 The missing addresses. Either paste this template (filled in) to Claude:

[james-pack] ACTION: emails DETAIL: melissa=…, office=…, owner2=…, owner3=…

…or type them straight into the access policy and reply:

emails done

• [ ] ⬜ U4.2 The drafted Jira story for the shared ABKC board — reply this and it files instantly:

approve jira

• [ ] ⬜ U4.3 The audience-standard ratification bundle. Reply with one of these (the +1 = the plain-language family/office reviewer seat; you can also reply edit: … or reject):

adopt v4

adopt v4+1

Verify: Claude confirms each on Telegram within a watch cycle (or instantly if a session is open).

U5 — Start the Cloudflare move (⬜ VERIFY, ~15 min of clicks; Wix does the rest)

Why: you opted in. The honest shape: Wix locks nameserver changes — only Wix Support can switch them. Your site stays up the whole time; there are no email records to break; registration + billing stay at Wix (renewal 2026-09-11).

Now also strategic: a Cloudflare Tunnel (Cloudflare Access) is the backbone of the new always-on-host / portal plan — it's how the concierge LLM and the CPX62 control plane become reachable from Vercel (see Platform build — Phase 0/1 below and N4). So this gate pays off twice.

• [ ] ⬜ U5.1 Open the Cloudflare dashboard → Add a domain → enter cooperluxe.com → choose the Free plan.
• [ ] ⬜ U5.2 When Cloudflare imports the scanned records, make the list EXACTLY these two entries (delete anything else it scanned). The bare-domain A record:

Type: A      Name: cooperluxe.com   Value: 76.76.21.21          Proxy: DNS only (grey cloud)

…and the www CNAME:

Type: CNAME  Name: www              Value: cname.vercel-dns.com  Proxy: DNS only (grey cloud)

Caution: keep both grey-cloud ("DNS only") — Vercel officially recommends no proxy in front of Vercel. An orange cloud here can break TLS/redirects.

• [ ] ⬜ U5.3 Cloudflare now shows your TWO assigned nameservers (they look like the example below — yours will differ). Copy both:

ada.ns.cloudflare.com
bob.ns.cloudflare.com

• [ ] ⬜ U5.4 Open Wix → Account → Domains → Help → Contact → Domains, and send this paste-ready request (replace the two example names with YOUR two from U5.3):

Please change the nameservers for cooperluxe.com to ada.ns.cloudflare.com
and bob.ns.cloudflare.com (Cloudflare), and lift any update lock needed to
do that. I'm intentionally moving DNS hosting to Cloudflare; the
registration itself stays with Wix.

• [ ] ⬜ U5.5 When Cloudflare emails "cooperluxe.com is active" (≤48h, usually faster): check that cooperluxe.com + www still load, then reply this to Claude:

[james-pack] ACTION: dns-active

Caution: if Wix refuses, escalate citing Wix's own help page "Request: Changing Name Server (NS) Records for a Wix Domain." If they still refuse, reply the box below and Claude preps the transfer-away fallback:

[james-pack] ACTION: question DETAIL: wix refused

U6 — Pretty doors + their sign-in (⬜ VERIFY, ~15 min, only AFTER U5.5's "active" email)

Why: turns the long .pages.dev links into james.cooperluxe.com / abkc.cooperluxe.com / cpd.cooperluxe.com, each behind its own sign-in. Domains FIRST, then sign-in — Cloudflare refuses to add a domain that already has an Access policy.

• [ ] ⬜ U6.1 Open the Cloudflare dashboard → Workers & Pages → james-cooperluxe → Custom domains → Set up a domain, and add these three (Cloudflare auto-creates each DNS record):

james.cooperluxe.com
abkc.cooperluxe.com
cpd.cooperluxe.com

• [ ] ⬜ U6.2 Open Cloudflare Zero Trust → Access → Applications → Add application → Self-hosted, three times (One-time PIN is already on). Use these hostname → who-can-enter pairings:

james.cooperluxe.com   ->  you + James
abkc.cooperluxe.com    ->  you + James + office + both co-owners
cpd.cooperluxe.com     ->  you + James + Melissa

• [ ] ⬜ U6.3 Reply this to Claude → it re-verifies everything live, flips every link to the pretty doors, and wires the identity hardening that needs these apps to exist:

[james-pack] ACTION: domains-done

U7 — ABKC-14 sign-off run (⬜ VERIFY, ~15 min, inherited)

• [ ] ⬜ U7.1 Open the single-owner walkthrough: https://james-cooperluxe.pages.dev/guides/abkc-payment-single-owner-v2/⧉ (or the V2 html in abkc-website\.ai-notes\abkc-payment-walkthrough-2026-05-28\).
• [ ] ⬜ U7.2 Run its Gates 1→3 with the test-fixtures/ stand-ins, sign §17, then tell any Claude session the reply below (it transitions Jira to Done):

ABKC-14 signed

• [ ] ⬜ U7.3 While you're at it, ratify the five documented ADRs by telling Claude:

close 18 through 22

Verify: ABKC-14 on Jira shows Done.

U8 — Joint co-owner session (⬜ VERIFY, 45 min, after James answers)

• [ ] ⬜ U8.1 James's ABKC questionnaire answer ABKC-D-021 gives his preferred window — book it.
• [ ] ⬜ U8.2 Run https://james-cooperluxe.pages.dev/guides/abkc-coowner-v1/⧉ live together; record step 2.6 (payment before vs after co-signature — it resolves the documented unknown and unblocks the ABKC-12 automation). Dual sign-off §17.

06-15/16 gates (this session)

The engineering work that landed since the 06-11 walkthrough, plus the new settings + go-live gates it creates. The ✅ items are done + verified (pre-checked); the ⬜ items are your moves.

What's DONE + verified (no action needed — confirm if you like)

• [x] ✅ DONE.1 Error-handling / logging overhaul — PRs #11 / #12, live-verified.
• [x] ✅ DONE.2 Durable "permanent access" login — PR #13 (1-year session cookies). (This is what U1.B refers to.)
• [x] ✅ DONE.3 Preview-CI fix — PR #14 (the preview deploys build cleanly again).
• [x] ✅ DONE.4 Branch protection enabled on main — required status checks now gate merges into production. Confirm any time at GitHub → Settings → Branches.
• [x] ✅ DONE.5 Concierge LLM upgrade merged, flag-OFF — PR #15, reviewed, and a real bug in it was found + fixed during review. It is OFF until N4 below is done, so it can't answer wrong in the meantime.
• [x] ✅ DONE.6 Supabase security hardening — Claude ran a tracked migration this session (harden_function_search_path_and_revoke_secdef_rpc): pinned search_path on all 7 database functions and revoked public/RPC access to the 4 SECURITY DEFINER trigger functions. The security-advisor scan dropped 23 → 8 warnings (the 8 left are intentional RLS helpers/policies plus the two dashboard toggles now in U1.5/U1.6). Reversible; RLS untouched.
• [x] ✅ DONE.7 Permanent-access accounts verified live — both required never-expire logins confirmed active in the database this session: abkcemily@gmail.com (last sign-in 06-15) and bullysupplies@gmail.com / James (last sign-in 06-12).

Your moves (new settings + go-live gates)

• [x] ✅ N1 — Supabase Sessions OFF (same as U1.3/U1.4, called out here because it's this session's gate): open Supabase → Authentication → Sessions and confirm Time-box + Inactivity timeout are OFF. If they're on, the 1-year durable login (#13) is silently undercut.
• [ ] ⬜ N2 — James's card check: bullysupplies / James is already wired (see U3.A). Confirm the SOP card he got is the one you wanted — or reply with the card you'd rather he have.
• [ ] ⬜ N3 — Vercel deploy settings (so git pushes auto-deploy to production). Open the Vercel dashboard → project cooperluxe-portal, then go to Settings → Git and set the Production Branch:

main

…and Settings → General → Root Directory:

cooperluxe-portal

Verify (N3): push a trivial commit to main → Vercel auto-builds from cooperluxe-portal and the production URL updates.

• [ ] ⬜ N4 — Concierge go-live (two parts, in order): first it needs a Vercel-reachable LLM endpoint — the Cloudflare-Access tunnel → MANGOS on the CPX62 (the Platform build — Phase 0/1 section below has the exact commands; this is why U5's Cloudflare move matters). Once that endpoint answers, flip the env flag in Vercel:

CONCIERGE_LLM=1

…then redeploy. Until the endpoint answers, leave it OFF (correct — it would otherwise have nothing real to answer with).

Verify (N4): the concierge answers a test question instead of erroring.

• [ ] ⬜ N5 — Emily's questionnaire: she still needs to work through her Office-Manager guide — ABKC Admin Walkthrough · Office-Manager Edition — where the §9 policy blanks + attestation live. The durable login (#13) removed the re-auth friction that was blocking her; the rest is on her. A nudge from you is the move — paste-ready:

Emily — your ABKC Office-Manager guide is ready: https://james-cooperluxe.pages.dev/guides/abkc-admin-office-v1/
Open it, sign in with your email (it sends a code — no password), and work through it when you have time. It saves as you go in your browser. Questions, just text me.

06-16 — dcoop HQ master portal + key rotations (this session)

Your private command deck over the whole 60-ecosystem constellation went from idea to built-and-staged this session. Below: what Claude finished, then the gates only you can complete to take it live. (This is on top of the still-open U1 Supabase toggles and the Platform build below.)

Done + verified (Claude, this session)

• [x] ✅ HQ.A Master hub built + golden-checked — dane-portal/public/index.html: dark-luxury mission-control (orchestration planes · filterable 60-ecosystem grid · platform-build status · command surfaces). ~16.6k, noindex, 0 markers.
• [x] ✅ HQ.B Cloudflare Pages project created — dane-cooperluxe → dane-cooperluxe.pages.dev.
• [x] ✅ HQ.C Dane-only gate written — a Pages _middleware reusing your cooperluxe.com sign-in (super-admin / you only), mirroring the proven james-portal pattern; fail-closed (no key → nobody gets in, the map never serves).
• [x] ✅ HQ.D Allowlist PR opened — cooperluxe-portal PR #17 adds dane-cooperluxe.pages.dev to the SSO return allowlist.
• [x] ✅ HQ.E Cloudflare wired — wrangler authenticated · 88 CF skills installed · Zero Trust Free active (Free covers everything; the concierge tunnel uses a 0-seat service token, the portal itself needs no Access seat).
• [x] ✅ HQ.F Supabase security hardening — see DONE.6 (search_path pinned on 7 functions + RPC revoked on 4 SECURITY DEFINER triggers; advisors 23→8).

Your finish line (4 moves)

• [ ] ⬜ H1 — Rotate the sign-in key (PORTAL_SSO_SECRET). The current value is Sensitive/unrevealable and looks like a reused sk_live_ key, so replace it. Generate a fresh one and save it in your password manager:

node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"

Set that same value on all three — dane:

cd ~/ecosystem-cooperluxe/dane-portal; npx wrangler pages secret put PORTAL_SSO_SECRET --project-name dane-cooperluxe

james:

npx wrangler pages secret put PORTAL_SSO_SECRET --project-name james-cooperluxe

cooperluxe.com — Vercel → cooperluxe-portal → Settings → Environment Variables → edit PORTAL_SSO_SECRET → paste → Save (Production).

• [x] ✅ H2 — Allowlist PR merged. PR #17 is squashed into main. ⚠️ Correction: merging does NOT auto-deploy cooperluxe.com — it deploys by CLI (vercel --prod), not GitHub integration. The live redeploy was run manually (git pull → npx vercel --prod), which is what actually pushed the new PORTAL_SSO_SECRET (H1) + allowlist live. For any future cooperluxe.com change: merge then cd ~/ecosystem-cooperluxe; git pull; cd cooperluxe-portal; npx vercel --prod.

• [ ] ⬜ H3 — Deploy james + dane:

cd ~/ecosystem-cooperluxe/james-portal; npx wrangler pages deploy ./public --project-name james-cooperluxe

cd ~/ecosystem-cooperluxe/dane-portal; npx wrangler pages deploy ./public --project-name dane-cooperluxe

The james deploy also ships this refreshed walkthrough. Verify: open https://dane-cooperluxe.pages.dev⧉ → it bounces to cooperluxe.com to sign in → lands you on the HQ deck. Anyone who isn't you → "Restricted".

• [ ] ⬜ H4 — Rotate the leaked service key (SUPABASE_SERVICE_ROLE_KEY). It was pasted into a chat, so treat it as exposed. Supabase → Project Settings → API Keys → create a new secret key + disable the leaked service_role (no user logout). Update the value in three places, then mark it Sensitive in Vercel:
  1. Vercel cooperluxe-portal env (Production + Development)
  2. cooperluxe-portal/.env.local
  3. the broker task-broker-api env → then restart the broker

Reply "rotated" and Claude confirms the DB is intact (baseline: 20 users · 17 tables · 50 RLS policies) + re-checks the security advisors.

⚠️ If you instead roll the JWT secret (the fallback), the anon key changes too — then also update NEXT_PUBLIC_SUPABASE_ANON_KEY everywhere or the public site breaks. The new-secret-key path above avoids that.

Platform build — Phase 0/1 (concierge go-live)

This is the real, run-it-now backbone for N4: expose the live LiteLLM/nim-proxy (already answering on localhost:4000 of the CPX62) to Vercel through a Cloudflare-Access tunnel, then turn the concierge flag on. Run the steps in order. Each command is its own copy box.

Caution (protected surface): this touches prod networking + a Vercel production env var. Run it when you can watch it; do the redeploy (last step) only after the tunnel answers.

Phase 0 — cloudflared on the CPX62 (MANGOS host)

• [ ] ⬜ P0.1 SSH into the always-on host:

ssh root@91.98.84.0

• [ ] ⬜ P0.2 Install cloudflared (Debian/Ubuntu package from Cloudflare's repo):

curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main" | tee /etc/apt/sources.list.d/cloudflared.list
apt-get update && apt-get install -y cloudflared

• [ ] ⬜ P0.3 Authenticate cloudflared to your Cloudflare account (opens a browser link to authorize the cooperluxe.com zone):

cloudflared tunnel login

• [ ] ⬜ P0.4 Create the named tunnel:

cloudflared tunnel create cooperluxe-mangos

Verify: the command prints a tunnel UUID and writes a credentials JSON under ~/.cloudflared/. Keep that filename — the ingress config points at it.

Phase 1 — ingress → the live nim-proxy on localhost:4000

• [ ] ⬜ P1.1 Write the ingress config that routes a public hostname to the local LiteLLM/nim-proxy. Paste this whole block (replace <TUNNEL-UUID> with the UUID from P0.4):

cat > ~/.cloudflared/config.yml <<'EOF'
tunnel: cooperluxe-mangos
credentials-file: /root/.cloudflared/<TUNNEL-UUID>.json
ingress:
  - hostname: mangos.cooperluxe.com
    service: http://localhost:4000
  - service: http_status:404
EOF

• [ ] ⬜ P1.2 Bind the hostname to the tunnel in Cloudflare DNS:

cloudflared tunnel route dns cooperluxe-mangos mangos.cooperluxe.com

• [ ] ⬜ P1.3 Run the tunnel (foreground first, to confirm it connects):

cloudflared tunnel run cooperluxe-mangos

• [ ] ⬜ P1.4 Once it's confirmed working, install it as a service so it survives reboots:

cloudflared service install

Verify: from your laptop, https://mangos.cooperluxe.com/health⧉ (or the LiteLLM root) responds through Cloudflare instead of timing out.

Phase 1 — Cloudflare Access service token (so only Vercel can call it)

• [ ] ⬜ P1.5 Open Cloudflare Zero Trust → Access → Service Auth → Service Tokens → Create Service Token. Name it vercel-concierge. Cloudflare shows a Client ID and Client Secret once — copy both now. They look like:

CF-Access-Client-Id:     <uuid>.access
CF-Access-Client-Secret: <long-secret-string>

• [ ] ⬜ P1.6 Add an Access application for mangos.cooperluxe.com whose policy is Service Auth = the vercel-concierge token (Include → Service Token → vercel-concierge), so browser traffic is blocked and only the token gets through.

Caution: treat the Client Secret like a password — it goes only into Vercel env (next step), never into the repo or this doc.

Phase 1 — wire Vercel + flip the flag

• [ ] ⬜ P1.7 Open the Vercel dashboard → project cooperluxe-portal → Settings → Environment Variables, and add these three (Production scope). The endpoint URL:

LITELLM_URL=https://mangos.cooperluxe.com

the Access client id:

CF-Access-Client-Id=<uuid>.access

and the Access client secret:

CF-Access-Client-Secret=<long-secret-string>

• [ ] ⬜ P1.8 Add the concierge flag (also Production scope):

CONCIERGE_LLM=1

• [ ] ⬜ P1.9 Redeploy so the new env is picked up — either click Redeploy on the latest production deployment in Vercel, or push a trivial commit to main (per N3, that auto-deploys):

git commit --allow-empty -m "chore: redeploy for concierge env" && git push origin main

Verify: ask the concierge a test question in the portal — it answers (routing through mangos.cooperluxe.com → LiteLLM on the CPX62) instead of erroring. If it errors, re-check P1.4 (tunnel up) and P1.6/P1.7 (token matches).

🔭 New platform build (approved plan — forward-pointer)

The Phase 0/1 above is the first concrete slice. The fuller shape is captured here so it's on your radar. Full detail lives in the platform plan; reply the box below and Claude surfaces it.

open platform plan

The approved shape: CPX62 always-on control plane → Cloudflare-Access tunnel → concierge live (MANGOS endpoint) → Telegram / Slack portal inbox → GPU workplace / simulator viewers. Every gate above that touches Cloudflare (U5, U6) or the concierge (N4 + Phase 0/1) is a stepping-stone into this — they're not throwaway, they're the foundation.

Optional / parked

• Drive tidy (~3 min, optional): drag the OneDrive ABKC\ binaries into the Drive ABKC folder; delete upload-capability-probe.pdf.
• ABKC-17 merge: parked by design on the Firefox layout bug — don't force it.
• Phase 2 — move the domain registration to Cloudflare (cheaper at-cost renewals): only possible after U5; start by mid-August if wanted (renewal lands 2026-09-11). Reply the box below and Claude stages it:

prepare phase 2

• Telegram bot (if you ever want a dedicated portal bot): create one via BotFather with the /newbot command, then hand Claude the token.

After your gates

James's answers land in D1 and the next Claude session harvests them into devtrack + Jira + the office-manager blanks; "discuss live" items auto-build your joint-session agenda; the CPD answers become the launch punch list. The watcher pings your Telegram at first-activity / 50% / 100% per person per doc — you'll see momentum without asking.

Operator: Dane Cooper Date: __ Signature: __

Authored 2026-06-16 as the refreshed execution companion to DANE-GATE-WALKTHROUGH-2026-06-10. Launch gates U1–U8 carried forward from the 2026-06-11 walkthrough with updated statuses; "06-15/16 gates" + the platform forward-pointer added 2026-06-15; upgraded 2026-06-16 to the advanced-artifact standard (click-to-copy on every paste-able value via fenced code blocks; hyperlink on every external destination; real Platform build Phase 0/1 command set). Append-only per archive-policy. NOT yet deployed — staged for Claude-main review.