byForja Infra Tree 09-09-2026 — verified live

Drag the boxes to reorganise. Arrows stay connected. Positions are saved in your browser.

The two Cloudflare Pages projects are the core of the system (white outline): byforja serves the public site, byforja-tools serves this admin surface behind Cloudflare Access. Colours = category. Dashed lines = monitoring or indirect link.

Double-click a box to rename it. Use + Add independent node to drop in custom nodes, then drag them anywhere.

Read back on 09/09/2026 from the Cloudflare API, not declared: Workers and their schedules, Pages projects, D1 tables, R2, KV, zones and routes.

Drag-and-drop · double-click to edit

Storage Auth Network Email Booking Automation Operator Business tooling (not wired) Independent Pending (not in service)

What each box is

One line per box of the tree above, in plain words. The small text under each name is what the box does for this business.

Box	Type	What it is
Brevo magic-link mail	Email	Brevo, the transactional email service of this business: the magic-link login mails and the client mails.
Resend admin transactional	Email	Resend, the transactional email service: one-off mails sent by code (magic links, alerts, reports).
Google Workspace MX · SPF · DKIM · DMARC	Email	Google Workspace, the mailboxes of the business (the MX, SPF, DKIM and DMARC records in DNS point to it).
Google Postmaster Tools sender reputation · v2	Email	Google Postmaster Tools, the Google dashboard that shows how Gmail rates the domain as a sender.
Cloudflare DNS zone byforja.com	Network	The Cloudflare DNS zone of the domain: the records that say where the site, the mail and the subdomains live.
Cloudflare D1 byforja · 21 tables	Storage	Cloudflare D1, the SQL database of this business, shared by the public site, the intranet and the backup worker. One table per kind of record (contacts, events, bookings…).
R2 · user-toolkit client documents	Storage	Cloudflare R2 bucket (file storage, like a Dropbox folder) holding the documents shared with clients through their toolkit page.
R2 · backups dumps + archives	Storage	Cloudflare R2 bucket where the backup worker drops the nightly database dumps and the monthly archives.
byforja-backup-worker 9 crons	Automation	A Cloudflare Worker (a script that runs in the cloud on a timer): the nightly backup and every other scheduled robot of this business, listed on /crons.
byforja-net-redirect .net + .org · 301	Network	A Worker that sends the .net and .org domains to the .com site with a permanent redirect.
Cloudflare Access eo-team SSO	Auth	Cloudflare Access, the login wall in front of the intranets and the admin routes: only the eo-team emails get in, Claude uses a service token.
Pages · byforja byforja.com · public	Core	The public website, hosted on Cloudflare Pages: the pages visitors see, plus the small server functions behind its forms.
Pages · byforja-tools tools.byforja.com · admin	Core	This intranet, hosted on Cloudflare Pages: the admin pages and the /api routes they call, behind Cloudflare Access.
Google Calendar availability sync	Booking	Google Calendar, AL's calendar, read for availability or by the board.
Cal.com digital-offensive	Booking	Cal.com, the booking page prospects use to book a call; its webhook writes each booking in D1.
GitHub 4 private repos	Operator	GitHub, where every repository of the business lives; the Mac pushes there after each deploy (rule 14).
Terminal (macOS) operator CLI	Operator	The Terminal on AL's Mac, where Claude Code and the deploy chains run.
Wrangler (CF CLI) deploy · D1 · secrets	Operator	Wrangler, the Cloudflare command-line tool used from the Terminal to deploy, run database migrations and set secrets.
Loom outreach video	Not wired	Loom, the screen-recording tool used for the outreach videos sent to prospects.
Mockup render node render.js · local	Not wired	The mockup renderer, a local Node script that produces the site mockups shown to prospects.
Notion outreach prospects db	Not wired	Notion, the workspace where the doctrine, the planners and the CRM databases live; read by scripts, not wired to the sites.
Yousign contract signature	Not wired	Yousign, the electronic signature service used for client contracts, by hand.
Stripe first transfer · manual	Not wired	Stripe, the card payment service; on EO its webhook tells the site about each purchase.
Finder · ~/Projects local repos on the Mac	Operator	The Finder folder ~/Projects on AL's Mac, one sub-folder per repository: the working copy of the code before it is pushed to GitHub and deployed.
Claude Code agent in the Terminal	Operator	Claude Code, the agent running in that Terminal: it reads and writes the files of ~/Projects and runs the deploy chains, with AL's own accounts on this Mac.
Shell CLIs gh · op · ffmpeg · codex…	Operator	Any command-line tool installed on the Mac. Claude Code can call one the way a human types it in the shell: there is no integration behind it, the tool runs under the account it is already signed into on this machine.
1Password secrets vault · pending	Operator · pending	1Password, the planned vault for the secrets that today live in a file on the Mac; not in service yet.

What Claude Code can reach from the shell — the field of possibilities

Claude Code works inside the Terminal on the Mac. Anything AL can type in that Terminal, it can run: a deploy, a git command, a database migration, or any other command-line tool installed on the machine.

This is not an integration. Calling another vendor's CLI does not connect Claude to that vendor. The binary runs locally under the account it is already signed into on this Mac, and Claude only reads what the command prints.

Measured on the Mac, 11/09/2026. On the PATH: git, gh (signed in as alexandrecorne), wrangler, op (1Password), node, npx, python3, ffmpeg, whisper-cli, rtk, claude. Off the PATH but callable by its full path: /Applications/ChatGPT.app/Contents/Resources/codex, the ChatGPT app's own CLI, which answers with AL's ChatGPT account.

Two limits. A tool that is not installed cannot be called, and the Claude Code permission layer can refuse a command (it blocks some of them, wrangler d1 among others, and each refusal is reported).

The types, in one line each

Core	The two Cloudflare Pages projects everything else plugs into: the public site and this intranet.
Storage	Where data and files live (databases, buckets).
Auth	Who is allowed in, and how bots are kept out.
Network	Domains, DNS, redirects, monitoring: the plumbing between the internet and the sites.
Email	Everything that sends or receives mail, and the tools that watch mail reputation.
Payment	Services that take money and tell the site about it.
Booking	Calendars and appointment pages.
Automation	Robots that run on a schedule without anyone clicking.
Operator	The tools AL and Claude use from the Mac to build and deploy.
Not wired	Services used by hand or by a script, with no live link to the sites.
Independent	Boxes added by hand on this diagram, not read from the account.
Pending	Planned, not in service yet.

The 9 branches of the trunk

Each branch groups services by function. The trunk is the pair of Cloudflare Pages projects. Both projects read and write the same D1 database, which is why a schema change is never a single-repo decision.

Storage branch

Cloudflare D1 byforja ↔ both Pages projects (27 live tables, densest link)

R2 byforja-user-toolkit ← both projects (client documents, binding USER_TOOLKIT)

R2 byforja-backups ← backup worker only (D1 dumps + event archives)

Auth branch

Cloudflare Access → byforja-tools (team eo-team, gates every route)

Defense in depth: functions/_middleware.js re-checks the Access JWT against ADMIN_EMAIL on /api/admin/*, fail-closed

Magic link → public site (D1 tables magic_link_tokens + pending_logins, no third-party identity provider)

Network branch

Cloudflare DNS, zone byforja.com → routes both Pages projects

Mail records: SPF v=spf1 include:_spf.google.com ~all, DKIM google._domainkey, DMARC p=quarantine

Brevo DKIM: brevo1 + brevo2._domainkey CNAMEs delegated to Brevo

Zones byforja.net + byforja.org → Worker byforja-net-redirect, 301 to byforja.com (routes read back, added 02/09/2026)

Email branch

Brevo ← public site (magic-link mail, sender contact@byforja.com)

Resend ← tools (brand-swipe invite, sender al@byforja.com)

Google Workspace ← DNS (mailboxes on byforja.com, MX on Google)

Google Postmaster Tools ··· Workspace (reputation + compliance monitoring)

Hunter.io ← sourcing agent (domain search: address pattern + named decision-maker). Free tier 25 searches + 50 verifications a month. FINDS the address.

ZeroBounce ← byforja-backup-worker, src/email-verify.js (deliverability gate before every cold first email). Free tier 100 credits on signup. VERIFIES the mailbox.

One credit per address, ever: the verdict is written to the Email check column of the Outreach Prospects DB at sourcing time and read from cache at send time. A dead address blocks the send instead of burning the domain's reputation.

Booking branch

Cal.com ← public site, embedded on /call since 02/09/2026 (event digital-offensive)

Google Calendar ← Cal.com (availability sync, schedule "Disponibilite Forja", Europe/Paris)

No Cal.com webhook is wired yet — /bookings is still a placeholder waiting on the schema.

Automation branch

byforja-backup-worker → D1 + R2 (9 cron triggers on the schedules API, incl. 0 6 1 * * unused-pages added 09/09/2026)

Gmail API ← byforja-backup-worker, OAuth on al@eliteoutsiders.com (send-as al@byforja.com), added 24/08/2026 for the outreach follow-up sender (T2/T4/T5)

Notion API ← byforja-backup-worker, direct REST (Outreach Prospects DB read + Status writes)

byforja-cron-purge: Worker absent from the account on 09/09/2026 (deleted 28/08/2026, repo kept). The backup worker is the only scheduled writer on D1.

Standalone Worker, not a Pages Function.

Operator branch

Terminal (macOS) → Wrangler (deploy, D1 queries, Pages secrets)

Terminal → GitHub (git push/pull on 4 private repos)

Wrangler → both Pages projects + D1. It is the only write path to production.

1Password ··· Terminal (secrets vault, pending CLI installed, account registered, integration not verified)

Video branch — local, on AL's Mac

Loom (record + AL's own trim) → looms/clients/<slug>/raw/ → build_episode.py → enhance.sh → remux.sh → final/

Installed 27 and 28/08/2026, all local, no service, nothing leaves the Mac:

ffmpeg 8.1.1 and ffprobe — cutting, assembly, subtitle overlay, loudness. Note: this build has no drawtext, subtitles or ass filter, so all text goes through PNG rendering then overlay.

whisper.cpp (whisper-cli) with ggml-medium.en and ggml-small.en in ~/.cache/hyperframes/whisper/models/ — word level transcription, drives both the hesitation cuts and the subtitles.

DeepFilterNet 3 (~/.local/bin/deep-filter, native aarch64 binary, 27 MB) — neural denoise. Replaces Adobe Podcast Enhance, which has no public API: the Firefly Audio and Video API only exposes speech generation and dubbing. Measured RTF 0.025, so about 13 s for a 9 minute episode.

Real-ESRGAN via spandrel + PyTorch 2.13 on MPS (venv at ~/.config/eo/venvs/img, weights in ~/.local/share/realesrgan/) — 4x image upscale on the Apple GPU, used on thumbnail backgrounds and brand assets. The ncnn-vulkan build was tried first and does not initialise on macOS.

ElevenLabs — the only remote call in this branch, and only once: the series voice-over was generated on 26/08 and is now a frozen asset in looms/assets/. Episodes reuse the file, they never re-call the API.

Nothing here touches D1, the sites or the tools. If this whole branch disappears, the infra keeps running and byForja simply stops publishing video.

Business tooling — not wired to the code

Notion (Outreach Prospects DB) → Loom + mockup render → Yousign → Stripe

This is the human sales chain. None of it calls the site or the tools at runtime.

If you cut this cluster the infra keeps running — you just lose the way byForja sells.

Quick read — who's connected to whom

7 services touch the code directly: D1 (read/write from both projects), R2 user-toolkit (uploads), Cloudflare Access (gates tools), Cloudflare DNS (routes), Brevo (magic-link API), Resend (admin transactional API), Cal.com (via the /call redirect).

5 peripheral services: R2 backups (downstream of the backup worker), byforja-backup-worker (the one scheduled writer on D1), byforja-net-redirect (301 from the .net and .org zones), Google Workspace (mailboxes on the zone), Google Postmaster Tools (reputation monitoring on the sending domain).

3 operator tools: Terminal (macOS) drives Wrangler and GitHub. It is the human control layer — if Terminal breaks, no more deploys and no more admin work, but the live sites keep serving.

D1 is the silent hub: 3 pieces of code write to it (public site Functions, tools Functions, backup worker). A schema change touches all three. There is no staging copy — byforja is the only database.

DNS is the second silent hub: Pages routing, Access, Google Workspace mail and Brevo DKIM all resolve through the same zone. Break the zone and mail plus hosting fail together.

Cloudflare inventory

Read live from the Cloudflare API on 09/09/2026, not declared: Workers, schedules, Pages, D1 sqlite_master, R2, KV, zones and routes.

Pages projects (3)

byforja
- byforja.pages.dev · byforja.com · www.byforja.com
- bindings: DB → d1 byforja, USER_TOOLKIT → r2 byforja-user-toolkit
- secrets: AUTH_SECRET, BREVO_API_KEY
- 14 Functions endpoints under /api
byforja-tools
- byforja-tools.pages.dev · tools.byforja.com
- bindings: DB → d1 byforja, USER_TOOLKIT → r2 byforja-user-toolkit
- secrets: ADMIN_EMAIL, RESEND_API_KEY
- 20 Functions endpoints under /api/admin, all behind CF Access
byforja-500-demos
- byforja-500-demos.pages.dev only, no custom domain · last deploy 03/09/2026
- source: ~/Projects/byforja-500usd-site-offer, local git, no GitHub remote

D1 databases (1)

byforja
- id ff9f3527-bcc5-454b-88e1-c26420688b06 · created 03/05/2026
- 27 live tables on 09/09/2026, shared by site + tools + backup worker
- analytics: events, error_events, analytics_snapshots
- auth: magic_link_tokens, pending_logins
- contacts: contacts, toolkit_resources
- client model: client_brand_bible, client_brand_options, client_brand_swipes, client_contract, client_discovery, client_monthly_plans, client_plan_comments
- journey: journey_state, journey_tasks, journey_events
- tooling: pricing_calculations, board_state, page_inventory, button_inventory
- email: email_sends, email_opens, email_clicks, email_links
- outreach: leads (one row per Notion prospect, the /leads grid)
- intranet usage: tools_pages, tools_visits (unused-pages report)

R2 buckets (2)

byforja-backups · created 04/05/2026
- private, reached only through the worker binding BACKUP_BUCKET
- prefix YYYY-MM/d1-byforja-DATE.sql (monthly D1 dump)
- prefix events-archive/YYYY-MM/ (monthly events archive)
byforja-user-toolkit · created 23/05/2026
- bound as USER_TOOLKIT on both Pages projects
- client documents uploaded from the admin, served through /api/me/toolkit

Workers (4 on the account)

byforja-backup-worker
- 9 crons on the schedules API: 0 2 1 * * events archive · 0 3 1 * * D1 backup · 0 4 1 * * URL audit · 0 4 * * 1 page-flow crawl · 0 5 1 1,7 * analytics-map refresh · 0 6 * * * error watchdog · 0 6 1 * * unused-pages (added 09/09/2026) · 0 8 * * 1 weekly snapshot · 3,17,29,43,51 * * * * outreach follow-up sender
- bindings: DB (byforja), BACKUP_BUCKET (byforja-backups)
- secrets on the settings API: ADMIN_TOKEN, NOTION_API_KEY, CALCOM_API_KEY, GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, GMAIL_REFRESH_TOKEN, HUNTER_API_KEY, ZEROBOUNCE_API_KEY, RESEND_API_KEY
- 9 endpoints: /run, /backup/last-run, /admin/events-archive-now, /admin/url-audit-now, /admin/page-flow-crawl-now, /admin/error-events-watchdog-now, /admin/weekly-snapshot-now, /admin/analytics-map-refresh-now, /admin/gmail-followup-now
- alert mail goes out through Brevo; outreach follow-ups go out through Gmail API, same thread as AL's manual T1
byforja-net-redirect
- routes byforja.net/*, www.byforja.net/*, byforja.org/*, www.byforja.org/* · 301 to byforja.com, path and query kept
- no cron, no binding · created 02/09/2026 · no local repo found
byforja + byforja-worker
- 0 crons, 0 bindings, no route, empty script body on the API · last modified 26/04/2026 · role unknown, AL call
byforja-cron-purge: absent from /workers/scripts on 09/09/2026 (deleted 28/08/2026, repo kept)

KV namespaces (0)

none for byForja
- the account holds two namespaces, BACKUP_STATE (Elite Outsiders) and LIVE (Alexandre Corne)
- no byForja wrangler.toml declares a KV binding — cron run history is not persisted yet

Domains

Custom domains (3)
- byforja.com → Pages project byforja
- www.byforja.com → Pages project byforja
- tools.byforja.com → Pages project byforja-tools, CF Access gated
Platform domains (4)
- byforja.pages.dev · byforja-tools.pages.dev · byforja-500-demos.pages.dev
- byforja-backup-worker.alexandre-corne-ac.workers.dev
Zones (3)
- byforja.com (Pages) · byforja.net + byforja.org (Worker byforja-net-redirect, 301)
- mta-sts.byforja.com → cross-brand Worker mta-sts-policy, listed on the EO infra tree

Two orphan Workers still sit in the account on 09/09/2026: byforja and byforja-worker, both last modified 26/04/2026, empty on the API, neither has a local repo. They predate the move to Pages and look like leftovers — confirm before deleting. byforja-cron-purge was deleted on 28/08/2026, its script copy sits in ~/Projects/_deleted-workers-backup-2026-08-28/.

The two repos

Repo	Serves	Gate	Contents
byforja-site	byforja.com + www.byforja.com — the public bilingual FR/EN site	Public. Magic-link login on `/account` only	21 pages in `public/`, 14 Functions endpoints, 6 D1 migrations, Playwright smoke tests
byforja-tools	tools.byforja.com — the admin surface, this page included	Cloudflare Access SSO (team `eo-team`) + `ADMIN_EMAIL` allowlist on the API	38 pages in `public/`, 20 admin endpoints, 8 D1 migrations
byforja-backup-worker	Scheduled jobs against D1 and R2	Worker default domain, admin endpoints behind a shared secret	8 job modules, 9 crons
byforja-cron-purge	Nothing: the Worker was deleted on 28/08/2026	n/a	Single module, repo kept on GitHub
byforja-500usd-site-offer	byforja-500-demos.pages.dev, the 500 USD demo sites	Public, no custom domain	Local git, no GitHub remote

The first four repos are private on GitHub under alexandrecorne/; the demo folder has no remote yet. The site and tools repos both bind the same D1 and the same R2 toolkit bucket — that coupling is deliberate and it is the main reason a migration has to be run once and smoke-tested twice.

Tool pages on tools.byforja.com (38)

One line per page, taken from the page's own title and first heading. "Placeholder" means the page ships a placeholder block instead of a working dashboard.

Page	What it is	State
/index	byForja Tools — AL. The hub that links every page below.	Hub
/alllinks	All internal links — manual index of every page on tools.byforja.com	Live
/analytics-map	Analytics map — what we track. Source of truth for every event type captured by bf-tracking.js	Live
/architecture	Architecture. The long-form system map, the largest page in the repo at 161 KB.	Live
/bookings	Bookings — Cal.com bookings (slug: digital-offensive)	Placeholder
/brand-options-editor	Brand options · A vs B. Editor for the paired brand options served to clients.	Live
/cal-questionnaires	Cal.com Questionnaire — byForja source of truth. Offensive Digitale · 4 questions · exact wording	Live
/call-cockpit	Call Cockpit. Live surface used during a prospect call.	Live
/click-analytics	Click analytics — click events breakdown by page, target, and timing	Placeholder
/clients	Clients — byForja contact base, auto-added on magic-link login plus manual entries	Live
/clients-detail	Client detail. Per-client record with newsletter, booking, pricing, contract and journey tabs.	Live
/content-system	Content system — byForja content production system	Placeholder
/coredata	Core data — canonical KPIs and references for byForja	Placeholder
/crm	CRM · Client journey. Pipeline view over the journey tables.	Live
/crons	Crons — byForja automation surface, backup worker plus watchdog	Live
/customer-journey	Customer journey. Per-email journey timeline.	Live
/data	Data landing — raw data hub, pointers to D1 tables and dashboards	Placeholder
/discovery-questionnaire	Discovery questionnaire. Pre-engagement questionnaire filled with the client.	Live
/email-deliverability	Email deliverability — open rates, bounces, complaints	Placeholder
/email-system	Email system — transactional plus marketing email orchestration	Placeholder
/health	byForja health — aggregate status, D1 live counters plus crons plus last snapshot	Live
/heatmap	Heatmap — anonymous click coordinates per page	Placeholder
/infra-tree	Infra tree. This page.	This page
/lf-cross-platform-content	Actions board — cold to served client, one intent per line	Live
/lf-cross-platform-content-doc	LF cross-platform — canonical doc	Placeholder
/mockups	Mockups — the proof asset that rides with every Loom	Live
/monthly-output-preview	Monthly plan preview — pick a client and a month	Live
/monthly-plan-questionnaire	Monthly plan. Questionnaire that feeds the monthly deliverable.	Live
/notion-vs-tools	Notion vs Tools — source-of-truth split, which system owns what	Live
/og-preview	Open-Graph preview — quick preview of OG cards for byforja.com URLs	Placeholder
/onboarding-questionnaire	Onboarding questionnaire. Post-signature intake.	Live
/page-flow	byforja.com page flow — live inventory, refreshed weekly by the page-flow crawler	Live
/preview-clients-detail	Client detail (preview) — layout sandbox for the /clients-detail design	Placeholder
/pricing-calculator	Pricing calculator — profile × launch formula × monthly tier × market × revenue → launch + monthly	Live
/public-site-deploy-process	byforja-site deploy process — how to ship to byforja.com	Live
/purchases	Purchases — purchase log (Stripe / Lemon Squeezy / manual)	Placeholder
/videos	byForja videos — video index and LF cross-platform link	Placeholder
/weekly-business-steering	byForja weekly business steering — tracking pillars and deliverables, one entry per week	Placeholder

24 live pages, 14 placeholders. Two placeholders still carry copy inherited from the Elite Outsiders port: /email-deliverability names Kit and /purchases names Lemon Squeezy — neither is a byForja service. Worth rewriting when those pages are built.

External services wired

Service	Category	Role	If it breaks...
Cloudflare Pages	Cloudflare	Hosts byforja.com and tools.byforja.com	Everything goes dark — public site and admin at once
Cloudflare D1	Storage	Single shared SQL database, 21 tables	Login, client records, analytics and crons all fail together
Cloudflare R2	Storage	Client documents (user-toolkit) and monthly backups	Toolkit downloads break; backups stop accumulating
Cloudflare Access	Auth	SSO gate on tools.byforja.com, team `eo-team`	No access to the admin surface at all
Cloudflare DNS	Network	Zone byforja.com — routing plus every mail record	Cascade: hosting, Access and mail fail in the same minute
Brevo	Email	Magic-link sign-in mail and worker alerts, from `contact@byforja.com`	Nobody can sign in to /account and alerts go silent
Resend	Email	Admin-triggered transactional mail (brand-swipe invite), from `al@byforja.com`	Brand-swipe invitations cannot be sent from the admin
Google Workspace	Email	Mailboxes on byforja.com. MX on Google, SPF `include:_spf.google.com`, DKIM `google._domainkey`, DMARC `p=quarantine`	Outbound prospecting stops and inbound replies bounce
Google Postmaster Tools	Monitoring	Sender reputation, spam rate and compliance for the outbound prospecting domain — dashboard for byforja.com	Reputation drift stops being visible before Gmail starts filtering
Cal.com	Booking	Event `digital-offensive` (id 6614252), schedule "Disponibilite Forja" (id 1478988), Europe/Paris	No discovery calls can be booked from the site or from outreach mail
Google Calendar	Booking	Availability source synced by Cal.com	Cal.com offers slots that are already taken
GitHub	Operator	4 private repos (site, tools, backup worker, cron purge repo without its worker)	No versioning or history; the live sites keep serving
Wrangler (CF CLI)	Operator	Deploys both Pages projects, queries D1, manages secrets	No deploys and no manual DB work
1Password	Operator	Secrets vault: logins and API keys. pending CLI installed, account registered in the CLI on 09/09/2026, integration not verified. See the section below	Nothing today, it holds no live secret. Once activated, no `op read` means falling back to the local secrets file
Notion	Business	Outreach Prospects DB plus the byForja doctrine pages	You lose the prospect pipeline and the docs; the code keeps running
Loom	Business	Outreach video sent with every prospect mockup	Outreach loses its personalised video; nothing technical breaks
Yousign	Business	Contract signature at close, tracked as journey step `contrat_envoye`	No contract can be signed; no start date is announced
Stripe	Business	First transfer at close. No webhook and no secret on the Pages projects — it is manual today	No payment collected; the site is unaffected because nothing is wired
Canva	Retired	Retired on 09/08/2026 — mockups are now rendered by `node render.js` in headless Chrome, about 3.2 s per PNG	Nothing. Listed so nobody re-wires it by accident

Secrets vault · 1Password pending

Status on 09/09/2026: not in service. The CLI is installed on AL's Mac (op 2.39.0, via Homebrew, binary at /opt/homebrew/bin/op). op account list now returns one account, so the account exists; the CLI integration was not verified. Nothing in this tree reads a secret from it today. This block records a decision that is taken, not a service that is running.

Role. Secrets vault: the place that holds the logins and the API keys.

What it replaces…

What it replaces. Today the secrets sit in clear text in one local file on the Mac, ~/.config/eo/secrets.env, with dated copies beside it. That single file is the current point of truth for all four brands, byForja included. The eo in the path is historic, like the shared eo-team Access team, not a brand boundary. 1Password does not remove that file yet: it doubles it first, then replaces it.

What changes once the CLI integration is on. A secret is read with op read at the moment it is needed, and its value never has to transit in clear text through a file.

Rotation. The quarterly rotation of API keys already exists as a Claude Code scheduled task, eo-rotate-api-secrets-quarterly, cron 0 9 1 */3 *, next run 01/10/2026. It is a routine on AL's Mac, not a Cloudflare cron, which is why it carries no card on the crons page. 1Password becomes the place where that rotation is performed.

Plan, and the two moments it changes.

Plan	Price	Trigger
Individual	about 3 USD per month	The starting point. One operator, one vault.
Families	about 5 USD per month, up to 5 people	The day Ali, AL's associate, needs shared access.
Teams Starter	about 20 USD per month, flat	The day a key owned by a client enters the vault. Holding a third party's secrets inside a family plan does not hold up, and byForja is the brand where client keys land first.

Next action, on AL: create the account, then activate the CLI integration. Nothing here changes state until both are done.

Google Postmaster Tools — status on 11/08/2026

Domain byforja.com. Dashboard: postmaster.google.com/v2/sender_compliance?domain=byforja.com

All 8 compliance requirements green: SPF/DKIM, From header alignment, DMARC, encryption, user-reported spam rate, DNS records, one-click unsubscribe, honour unsubscribe.

Deliverability analysis says "not enough outgoing email" — the sending volume is still too low for Google to score reputation. That is expected at this stage, not a fault. It becomes a real signal only once outbound prospecting volume rises.

The legacy Postmaster interface is retired on 31 October. Use the /v2/ URL above — the old one will stop working.

Redirects

From	To	Code	Why
byforja.com/call	serves `public/call.html`, Cal.com embedded	200	Since 02/09/2026 the page no longer redirects: the calendar is embedded so the URL stays on byforja.com through the booking. Measured 200 on 09/09/2026.
byforja.net/* · byforja.org/*	https://byforja.com/<same path>	301	Worker `byforja-net-redirect` on both zones, www included. Measured 301 on 09/09/2026.
/index-en.html · /index-en	/	301	EN became the default at root on 30/05/2026, FR moved to /index-fr.html. Kept so old external links survive.

The /index-en rule lives in byforja-site/public/_redirects; byforja-tools/public/_redirects is empty. Verified live on 09/09/2026: /call answers 200, tools.byforja.com answers 302 to the eo-team Access login.

Links to the full documentation

→ Notion: Claude Code HQ — universal patterns · rules shared across all four verticals

→ Notion: byForja — Claude Code HQ — specifics · posture, brand, offer, packages, contracts

→ Notion: byForja hub · business doctrine, leads, content, contracts, CRM

→ /architecture · the long-form system map · → /crons · the automation surface · → /health · live counters

For Claude

Audit of 09/09/2026, read back from the Cloudflare API, not declared. Workers from /accounts/{id}/workers/scripts and per-worker /schedules and /settings, Pages from /pages/projects, D1 tables from a sqlite_master query, R2, KV, zones and /zones/{id}/workers/routes. HTTP codes measured with curl --max-redirs 0.

What changed. byforja-cron-purge removed from the diagram, the automation branch and the inventory (Worker deleted 28/08/2026, repo kept). Added byforja-net-redirect (node, edge, routes, redirect row), the Pages project byforja-500-demos and its local folder, the 9th cron 0 6 1 * * unused-pages, the real outreach schedule 3,17,29,43,51 * * * *, 27 D1 tables incl. tools_pages and tools_visits, KV LIVE, /call now 200. The cross-brand mta-sts-policy Worker is documented on the EO infra tree.

Not read back. Google Postmaster keeps its 11/08/2026 status (no API). The tool-pages table (38) was not recounted.