How to revert any phase, in any order, without breaking anything.

What lives where (state snapshot)

Current canonical sources for every credential and config

bt-notify Bearer (NOTIFY_TOKEN, BT_NOTIFY_TOKEN, REGISTRY_TOKEN)

351222a9a17e40cb5154cd7ec21bc1480b5be2d8ffb3bf816112e661371ac052

· Apple Note

"BT Notify Token" (title may show first content line; lookup by the title or by the long-form name with the prior cf15bdaf… prefix)

· CF KV

BOSSTORQUE_CONFIG (id fc91179257c34d0ca13af644aa4f3f81) → key bt_notify_token

· Bound on

bt-notify, bt-email-monitor, bt-tree-care-copilot, bt-registry-sync, bt-tenant-hub, sperry-tenant-hub, giftcue-tenant-hub, trnka-tenant-hub, personal-tenant-hub

CF admin token (withered-poetry-d166, rolled by Jason 2026-05-13)

cfat_2KhI8ZseoSlZleebNGqKaaU057NTRbvwsbwUWq15de4b6b15

· Apple Note

"CF Withered Poetry Token"

· CF KV

BOSSTORQUE_CONFIG → cf_admin_token

· Scopes

Workers, KV, R2, D1, DNS, Pages, Stream, Images, all major Workers products. MISSING: Cloudflare Access (Apps + Service Tokens).

Anthropic API key (working — different from the "Anthropic API Key" note)

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

· Apple Note

"BT Tree Care Copilot API"

· CF KV

BOSSTORQUE_CONFIG → anthropic_api_key

· Bound on

bt-chat, bt-tree-care-copilot

Deploy relay token (UNROTATED, embedded in global rules)

Dtr1oXnkX4sA_AvexQwwlLFCaedgjmWQQ_oPByo4aj8

· Worker

mdp-api-proxy-may2026 (CALLER_TOKEN secret)

Backup location (12 MB, every worker source pre-sprint)

/Users/Jason/My Drive (jason@bosstorque.ai)/4_Strategy & IP/Internal Tech Stack/BT Hub/cf-baseline-may2026/

Registry D1

UUID 36578b81-7532-4fac-bf4e-57c4423493f4 · name bt-registry · 155 artifacts · FTS5 search · url_references table

Tenant model (corrected)

5 tenants, 4 personal/internal, 1 client (Sperry)

Worker visibility — public vs internal

44 public, 118 internal

Critical for Phase 1 (Cloudflare Access). PUBLIC workers MUST stay reachable without authentication — they serve customer emails, public marketing, embedded asset URLs, and infra relays. INTERNAL workers go behind Access on canonical .bosstorque.ai URLs. The classification is stored on artifacts.visibility in bt-registry D1.

Phase-by-phase rollback matrix

Every change reversible independently

Specific rollback scenarios

What to do in each likely failure mode

Scenario A — Bosstorque-hub renders blank or broken after a 1.0a patch

1. Open plan.bt.bosstorque.ai or https://bt-cf-restructure-plan-may2026.jason-8ce.workers.dev to verify the hub URL is the only thing broken.
2. Run the panic-button restore command #4 from the top of this page — redeploys bosstorque-hub from baseline snapshot.
3. Hub is restored within ~30 sec.

Scenario B — Customer email images break (sperry-assets returning 401)

1. This means sperry-assets accidentally went behind Access or was misclassified as internal.
2. Check artifacts.visibility for sperry-assets: should be public.
3. Detach any Access policy on the worker.
4. Verify curl https://sperry-assets.jason-8ce.workers.dev/sperry-logo-oval-crop.png -I returns 200.
5. Apologize to Sperry; the email images were down for <15 min.

Scenario C — Token thrash returns

1. If a session starts auto-rotating bt-notify again, it's not following the global rules. First action: ping #bt-ops with the rotation source so we know which task did it.
2. Re-set bt-notify NOTIFY_TOKEN to the canonical value from BOSSTORQUE_CONFIG KV.
3. Update the offending session/task with a hard reminder of the policy in its system prompt.

Scenario D — Cloudflare Access locks Rob/Michele out of sperry.bosstorque.ai

1. Most likely cause: their email isn't on the allowlist, or they're using a different email (work vs personal).
2. Open CF Zero Trust → Access → Applications → sperry.bosstorque.ai → Policies → Allow.
3. Add the email they actually used. Save.
4. Have them retry within 60 sec. Refresh clears the prior 403.
5. If still locked out: temporarily remove the Access policy. Sperry hub is then public — patch & re-enable Access after their email is confirmed.

Scenario E — Registry D1 corrupted or wrong data

1. D1 is reconciliable. bt-registry-sync cron rebuilds the artifacts table from CF workers_list every hour.
2. Manual trigger: curl -X POST https://bt-registry-sync.jason-8ce.workers.dev/sync -H "Authorization: Bearer <sync_token from KV>"
3. If a destructive op happened (UPDATE without WHERE): D1 has point-in-time recovery; restore via dashboard.

What CANNOT be rolled back

Be aware before proceeding

• Token rotations (bt-notify rolled to 351222a9). The prior values are revoked. If a long-running scheduled task somewhere still has the old token cached, it'll 401 forever until you push the new value to it. The global rules now say "do not rotate" — but the prior 3 rotations already happened during the sprint.
• Customer emails already sent. Sperry's email campaigns embed workers.dev URLs in image src tags. Those emails are out. We must keep those URLs serving forever (which is why sperry-assets etc. are classified public).
• Search engine indexing. Any URL Google has indexed will stay indexed until we add X-Robots-Tag (which the new tenant hubs already do). For old public workers, indexing decay takes weeks.
• Apple Note titles. The "BT Notify Token" note's title shifted twice as I tried to update its first line. Use the note IDs (p4529, p4530, etc.) for definitive lookups, not titles.

Verification commands after any rollback

Run these to confirm clean state

TOK=$(curl -s "https://api.cloudflare.com/client/v4/accounts/8cef3a20d2c22491d2bbbc594cf4865d/storage/kv/namespaces/fc91179257c34d0ca13af644aa4f3f81/values/cf_admin_token" \
  -H "Authorization: Bearer cfat_2KhI8ZseoSlZleebNGqKaaU057NTRbvwsbwUWq15de4b6b15")

# 1. All 144 original workers still alive?
curl -s "https://api.cloudflare.com/client/v4/accounts/8cef3a20d2c22491d2bbbc594cf4865d/workers/scripts?per_page=200" \
  -H "Authorization: Bearer $TOK" | python3 -c "import sys,json; print('Workers in CF:', len(json.load(sys.stdin)['result']))"

# 2. Original bosstorque-hub responds?
curl -s -o /dev/null -w "bosstorque-hub: HTTP %{http_code}\n" https://bosstorque-hub.jason-8ce.workers.dev

# 3. Customer-facing public URLs responding?
for HOST in sperry-assets sperry-spring-lp-apr2026 bosstorque-site mothers-day-picker-may2026; do
  curl -s -o /dev/null -w "$HOST: HTTP %{http_code}\n" https://$HOST.jason-8ce.workers.dev/
done

# 4. bt-notify still functional?
NOTIFY=$(curl -s "https://api.cloudflare.com/client/v4/accounts/8cef3a20d2c22491d2bbbc594cf4865d/storage/kv/namespaces/fc91179257c34d0ca13af644aa4f3f81/values/bt_notify_token" \
  -H "Authorization: Bearer $TOK")
curl -s -X POST https://bt-notify.jason-8ce.workers.dev/send -H "Authorization: Bearer $NOTIFY" \
  -H "Content-Type: application/json" \
  -d '{"channel":"bt-ops","text":"rollback verification probe","source":"rollback"}'