Elite Outsiders Infra Tree 09-09-2026 — verified live

Drag the boxes to reorganise. Arrows stay connected. Positions are saved in your browser.

The two Cloudflare Pages projects are the core of the system (white outline): eliteoutsiders-site serves the public site, eliteoutsidersintranet serves this admin surface behind Cloudflare Access. Colours = category. Dashed lines = monitoring or indirect link.

Double-click a box to rename it. Use + Add independent node to drop in custom nodes, then drag them anywhere.

Read back on 09/09/2026 from the Cloudflare API, not declared: Workers and their schedules, Pages projects and their bindings, D1 tables, R2, KV, Access apps, zones and public DNS. Repos scanned with git remote -v the same day.

Drag-and-drop · double-click to edit

Storage Auth Network Email Payment Booking Automation Operator Disconnected cluster (not wired) Independent Pending (not in service)

What each box is

One line per box of the tree above, in plain words. The small text under each name is what the box does for this business.

Box	Type	What it is
Resend transactional · alerts	Email	Resend, the transactional email service: one-off mails sent by code (magic links, alerts, reports).
Kit newsletter · V4 API	Email	Kit (ex ConvertKit), the newsletter platform: subscribers, broadcasts, sequences, read through its V4 API.
Google Workspace MX · SPF · DKIM · DMARC	Email	Google Workspace, the mailboxes of the business (the MX, SPF, DKIM and DMARC records in DNS point to it).
Google Postmaster Tools sender reputation · v2	Email	Google Postmaster Tools, the Google dashboard that shows how Gmail rates the domain as a sender.
Postmark DMARC monitoring #2	Email	Postmark DMARC Digests, the second reader of the same DMARC reports, one weekly email.
CF DMARC Mgmt monitoring #1	Network	Cloudflare DMARC Management, the first dashboard that reads the DMARC reports and shows who sends mail in the name of the domain.
Cloudflare DNS zone eliteoutsiders.com	Network	The Cloudflare DNS zone of the domain: the records that say where the site, the mail and the subdomains live.
Cloudflare Turnstile anti-bot on forms	Auth	Cloudflare Turnstile, the invisible anti-bot check on the public forms (the replacement for a captcha).
Cloudflare D1 eliteoutsiders · 51 tables	Storage	Cloudflare D1, the SQL database of this business, shared by the public site, the intranet and the backup worker. One table per kind of record (contacts, events, bookings…).
R2 · eo-backups dumps + archives	Storage	Cloudflare R2 bucket where the backup worker drops the nightly database dumps and the monthly archives.
eo-backup-worker 18 crons	Automation	A Cloudflare Worker (a script that runs in the cloud on a timer): the nightly backup and every other scheduled robot of this business, listed on /crons.
eo-shortener go. · 302 · link_clicks	Network	The go. short-link Worker: turns short links into 302 redirects and counts the clicks in D1.
Cloudflare Access eo-team SSO · 5 apps	Auth	Cloudflare Access, the login wall in front of the intranets and the admin routes: only the eo-team emails get in, Claude uses a service token.
Pages · eliteoutsiders-site eliteoutsiders.com · public	Core	The public website, hosted on Cloudflare Pages: the pages visitors see, plus the small server functions behind its forms.
Pages · eliteoutsidersintranet tools.eliteoutsiders.com · admin	Core	This intranet, hosted on Cloudflare Pages: the admin pages and the /api routes they call, behind Cloudflare Access.
R2 · user-toolkit client documents	Storage	Cloudflare R2 bucket (file storage, like a Dropbox folder) holding the documents shared with clients through their toolkit page.
KV · BACKUP_STATE worker run state	Automation	Cloudflare KV, a tiny key-value store: a scratch memory the worker uses between two runs (last run state, a cached line-up).
YouTube Data API social analytics	Network	YouTube Data API, read by a robot to pull channel and video numbers for the social analytics.
Google Calendar OAuth · alsboard	Booking	Google Calendar, AL's calendar, read for availability or by the board.
Cal.com eoascension · webhook	Booking	Cal.com, the booking page prospects use to book a call; its webhook writes each booking in D1.
Stripe coaching webhook	Payment	Stripe, the card payment service; on EO its webhook tells the site about each purchase.
LemonSqueezy Manifesto webhook	Payment	LemonSqueezy, the checkout used for the Manifesto; its webhook tells the site about each sale.
GitHub 4 private repos	Operator	GitHub, where every repository of the business lives; the Mac pushes there after each deploy (rule 14).
Terminal (macOS) operator CLI	Operator	The Terminal on AL's Mac, where Claude Code and the deploy chains run.
Wrangler (CF CLI) deploy · D1 · secrets	Operator	Wrangler, the Cloudflare command-line tool used from the Terminal to deploy, run database migrations and set secrets.
whisper-cli local transcription · free	Operator	whisper-cli, a free local transcription tool used on the Mac for video transcripts.
UptimeRobot HTTP monitoring	Network	UptimeRobot, an outside service that pings the site every few minutes and emails when it is down.
Substack RSS · Library	Not wired	Substack, the newsletter archive read through its RSS feed for the Library page.
Notion docs · planner API	Not wired	Notion, the workspace where the doctrine, the planners and the CRM databases live; read by scripts, not wired to the sites.
n8n VPS automations	Not wired	n8n, the automation tool on the VPS; its workflows are dormant or run by hand.
PostFast shorts publishing	Not wired	PostFast, the scheduling tool that publishes the shorts; its API only keeps 30 days of history.
Finder · ~/Projects local repos on the Mac	Operator	The Finder folder ~/Projects on AL's Mac, one sub-folder per repository: the working copy of the code before it is pushed to GitHub and deployed.
Claude Code agent in the Terminal	Operator	Claude Code, the agent running in that Terminal: it reads and writes the files of ~/Projects and runs the deploy chains, with AL's own accounts on this Mac.
Shell CLIs gh · op · ffmpeg · codex…	Operator	Any command-line tool installed on the Mac. Claude Code can call one the way a human types it in the shell: there is no integration behind it, the tool runs under the account it is already signed into on this machine.
1Password secrets vault · pending	Operator · pending	1Password, the planned vault for the secrets that today live in a file on the Mac; not in service yet.

What Claude Code can reach from the shell — the field of possibilities

Claude Code works inside the Terminal on the Mac. Anything AL can type in that Terminal, it can run: a deploy, a git command, a database migration, or any other command-line tool installed on the machine.

This is not an integration. Calling another vendor's CLI does not connect Claude to that vendor. The binary runs locally under the account it is already signed into on this Mac, and Claude only reads what the command prints.

Measured on the Mac, 11/09/2026. On the PATH: git, gh (signed in as alexandrecorne), wrangler, op (1Password), node, npx, python3, ffmpeg, whisper-cli, rtk, claude. Off the PATH but callable by its full path: /Applications/ChatGPT.app/Contents/Resources/codex, the ChatGPT app's own CLI, which answers with AL's ChatGPT account.

Two limits. A tool that is not installed cannot be called, and the Claude Code permission layer can refuse a command (it blocks some of them, wrangler d1 among others, and each refusal is reported).

The types, in one line each

Core	The two Cloudflare Pages projects everything else plugs into: the public site and this intranet.
Storage	Where data and files live (databases, buckets).
Auth	Who is allowed in, and how bots are kept out.
Network	Domains, DNS, redirects, monitoring: the plumbing between the internet and the sites.
Email	Everything that sends or receives mail, and the tools that watch mail reputation.
Payment	Services that take money and tell the site about it.
Booking	Calendars and appointment pages.
Automation	Robots that run on a schedule without anyone clicking.
Operator	The tools AL and Claude use from the Mac to build and deploy.
Not wired	Services used by hand or by a script, with no live link to the sites.
Independent	Boxes added by hand on this diagram, not read from the account.
Pending	Planned, not in service yet.

The 9 branches of the trunk

Each branch groups services by function. The trunk is the pair of Cloudflare Pages projects. Both projects read and write the same D1 database, which is why a schema change is never a single-repo decision.

Storage branch

Cloudflare D1 eliteoutsiders ↔ both Pages projects (51 table names in sqlite_master at build time, densest link) · eliteoutsiders-preview bound on the backup worker only for dry runs

R2 eo-user-toolkit ← both projects (client documents, binding USER_TOOLKIT)

R2 eo-backups ← backup worker only (D1 dumps + event archives, binding BACKUP_BUCKET)

R2 eo-narrative-renders + umbra-renders: on the account since 18-20/08/2026, bound to no EO project or Worker on the API

Auth branch

Cloudflare Access → eliteoutsidersintranet (app "Elite Outsiders — Tools", every route 302 without a session, measured 09/09/2026) and → the site's gated routes (apps Admin /admin/* + /api/admin/*, Dashboard /api/analytics, Manifesto /manifesto/read*, Members /api/me)

Shared: the Access team eo-team gates the four intranets (byForja, byCaliber, Alexandre Corne reference it by one line each). Defense in depth: ADMIN_EMAIL re-checked by the Functions on both projects.

Cloudflare Turnstile ← public site (anti-bot on the trauma-map forms, secrets TURNSTILE_SITE_KEY / TURNSTILE_SECRET_KEY). Magic link → public site (AUTH_SECRET, D1 tables magic_link_tokens + pending_logins).

Network branch

Cloudflare DNS, zone eliteoutsiders.com → routes both Pages projects, go. to the shortener Worker

Mail records (public DNS, 09/09/2026): MX on Google, SPF v=spf1 include:mx.ovh.com include:_spf.google.com -all, DKIM google._domainkey + resend._domainkey, DMARC p=quarantine with reports to Cloudflare DMARC Management and Postmark, MTA-STS id=20260830000000, TLS-RPT to al@eliteoutsiders.com

eo-shortener ← DNS (Worker on the custom domain go.eliteoutsiders.com, 302 to the target, logs every hit to D1 link_clicks; measured go.eliteoutsiders.com/ → 302 → eliteoutsiders.com)

mta-sts-policy ← DNS (shared Worker, serves mta-sts.<zone>/.well-known/mta-sts.txt on the 5 zones of the account, testing mode, measured 200; folder ~/Projects/mta-sts-policy, not a git repo). Documented here, referenced by one line on the other three trees.

UptimeRobot ··· Pages (external HTTP monitoring) · CF DMARC Management ← DNS (DMARC dashboard #1)

Email branch

Resend ← public site (trauma-map results, confirmations, secrets RESEND_API_KEY + RESEND_WEBHOOK_SECRET) · ← backup worker (alerts and digests)

Kit ← public site (newsletter + post-quiz sequences, V4 API, secrets KIT_API_KEY, KIT_FORM_ID, KIT_WEBHOOK_SECRET, UNSUBSCRIBE_SECRET) · ← tools and worker (deliverability, sync check)

Google Workspace ← DNS (mailboxes on eliteoutsiders.com, MX on Google) · Google Postmaster Tools ··· Workspace (reputation + compliance, see the status section)

Postmark DMARC ← DNS (weekly digest, monitoring #2) · Postmark Spam Check ··· AL (manual SpamAssassin test before a Kit broadcast)

Payment branch

Stripe → public site (coaching webhook, STRIPE_WEBHOOK_SECRET, functions/api/webhooks/stripe.js)

LemonSqueezy → public site (Manifesto webhook, LEMONSQUEEZY_WEBHOOK_SECRET, functions/api/webhooks/lemonsqueezy.js)

Booking branch

Cal.com → public site (booking webhook, CAL_WEBHOOK_SECRET; /call is an EO page with the calendar embedded, no longer a 301 since 20/09/2026) + → Google Calendar (sync) · ← backup worker (slot watcher 0 7 * * *, weekly randomiser 0 21 * * SUN, secret CAL_API_KEY)

Google Calendar ← tools (OAuth, GOOGLE_OAUTH_CLIENT_ID / _SECRET, upcoming meetings on alsboard) · ← backup worker (gcal-scan every 30 minutes)

Automation branch

eo-backup-worker → D1 + R2 + KV (18 cron triggers on the schedules API, incl. 0 6 1 * * unused-pages added 09/09/2026; full list in the inventory)

KV BACKUP_STATE ← the worker persists its run state; /crons reads it through the tools Functions (BACKUP_HEALTH_TOKEN)

eo-cron-purge and eo-url-audit-worker: absent from the account on 09/09/2026 (script copies in ~/Projects/_deleted-workers-backup-2026-08-28/). The backup worker is the only scheduled writer on D1.

Standalone Worker, not a Pages Function.

Operator branch

Terminal (macOS) → Wrangler (deploy, D1 queries, Pages secrets) · → GitHub (git push/pull on 4 private repos) · → whisper-cli (word-level transcription of the long-forms, local and free)

Wrangler → both Pages projects + D1 + the two Workers. It is the only write path to production.

Mac agents (launchd, exit 0 on 09/09/2026): com.eo.v-folder-sync, com.eo.wip-autosave, com.eo.backup-git; com.eo.downloads-cleanup exits 1. Listed on /crons.

Shared routine: the quarterly rotation of API keys, Claude Code scheduled task eo-rotate-api-secrets-quarterly, cron 0 9 1 */3 *, next run 01/10/2026, covers the four brands from AL's Mac.

1Password ··· Terminal (secrets vault, pending CLI installed, account registered, integration not verified)

Disconnected cluster — not wired at runtime

Notion ↔ n8n (personal VPS) ↔ PostFast (shorts publishing)

Two thin threads reach the code: the tools planner endpoints read Notion (NOTION_API_KEY, NOTION_TOKEN) and the backup worker scans Notion freshness daily. Substack ← public site (RSS read for the Library).

No runtime-critical link to the site. If you cut this cluster the site still runs — the Library loses its Substack feed and the planner pages lose their Notion rows.

Quick read — who's connected to whom

11 services touch the code directly: D1 (read/write from both projects), R2 user-toolkit (uploads), Access (gates), Turnstile (calls), DNS (routes), Resend (API), Kit (API), Stripe (webhook), LemonSqueezy (webhook), Cal.com (webhook), Google Calendar (OAuth API); plus Substack (RSS read), the YouTube Data API and Notion on the tools side.

3 Cloudflare Workers: eo-backup-worker (18 crons on D1 + R2 + KV BACKUP_STATE), eo-shortener (go.eliteoutsiders.com, D1), mta-sts-policy (shared, 5 zones). Read back from /workers/scripts on 09/09/2026: eo-cron-purge and eo-url-audit-worker no longer exist on the account.

7 peripheral tools: R2 backups (downstream of the worker), CF DMARC Mgmt + Postmark DMARC (monitor Resend and Kit), Postmark Spam Check (manual before Kit broadcasts), Google Postmaster Tools (Gmail-side reputation), UptimeRobot (external HTTP monitoring), the renders buckets (bound nowhere).

4 operator tools: Terminal (macOS) drives Wrangler (deploy, D1, secrets), GitHub (private repos) and whisper-cli (local transcription). It is the human control layer — if Terminal breaks, no more deploys or admin work, but the live sites keep serving.

D1 is the silent hub: 4 pieces of code write to it (site Functions, tools Functions, backup worker, shortener). A schema change touches all four; eliteoutsiders-preview exists for dry runs, not as staging.

DNS is the second silent hub: Pages routing, Access, Google Workspace mail, Resend DKIM, both DMARC monitors, the shortener and MTA-STS all resolve through the same zone. Break the zone and the order of damage is not obvious.

Cloudflare inventory

Read live from the Cloudflare API on 09/09/2026, not declared: Workers, schedules, Pages, D1 sqlite_master, R2, KV, Access apps, zones.

Pages projects (2)

eliteoutsiders-site
- eliteoutsiders-site.pages.dev · eliteoutsiders.com · www.eliteoutsiders.com · last deploy 01/09/2026
- bindings: DB → d1 eliteoutsiders, USER_TOOLKIT → r2 eo-user-toolkit
- 14 secrets: ADMIN_EMAIL, AUTH_SECRET, CAL_WEBHOOK_SECRET, KIT_API_KEY, KIT_FORM_ID, KIT_WEBHOOK_SECRET, LEMONSQUEEZY_WEBHOOK_SECRET, RESEND_API_KEY, RESEND_WEBHOOK_SECRET, STRIPE_WEBHOOK_SECRET, TRIGGER_MAP_HMAC_SECRET, TURNSTILE_SECRET_KEY, TURNSTILE_SITE_KEY, UNSUBSCRIBE_SECRET
- 66 Functions files under functions/, 44 D1 migrations
eliteoutsidersintranet
- eliteoutsidersintranet.pages.dev · tools.eliteoutsiders.com · last deploy 09/09/2026
- bindings: DB → d1 eliteoutsiders, USER_TOOLKIT → r2 eo-user-toolkit
- 9 secrets: ADMIN_EMAIL, BACKUP_HEALTH_TOKEN, CF_WORKERS_READ_TOKEN, GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, KIT_API_KEY, NOTION_API_KEY, NOTION_TOKEN, YT_DATA_API_KEY
- 65 Functions files, all behind CF Access, 18 D1 migrations

D1 databases (2)

eliteoutsiders
- id e136cee8-b0d8-412f-b4a7-b20d53ab6933 · created 15/04/2026
- 51 names in sqlite_master at build time on 09/09/2026 (48 on the morning audit), shared by site + tools + backup worker + shortener
- analytics: events, error_events, signins, experiments, experiment_assignments, social_snapshots, social_posts, social_post_snapshots, video_runs
- auth + members: magic_link_tokens, pending_logins, contacts, oauth_tokens, tm_sessions, trauma_map_results
- content: article_comments, article_likes, ratings, submissions, manifesto_annotations, toolkit_resources, toolkit_annotations
- commerce + booking: purchases, bookings, kit_consents, kit_email_opens, email_events
- links: links, link_clicks · crawl: page_inventory, button_inventory
- ops + steering: ops_decisions, ops_morning_checkins, ops_weekly_reviews, goals_monthly, weekly_steering, steering_notes, cadence_week_snapshot, eisenhower_archive, skincare_routine_checks, skincare_routine_notes, alert_debounce
- intranet: intranet_state, intranet_state_history, home_layout, home_sections, page_titles, tile_order, tools_pages, tools_visits · plus d1_migrations
eliteoutsiders-preview
- id d6e348a3-7e38-487a-9934-c2b18fd71018 · created 30/04/2026 · bound as EO_DB_PREVIEW on the backup worker for dry runs

R2 buckets (4)

eo-backups · created 30/04/2026
- private, reached only through the worker binding BACKUP_BUCKET
- monthly D1 dump (0 3 1 * *) and events archive (0 2 1 * *)
eo-user-toolkit · created 01/05/2026
- bound as USER_TOOLKIT on both Pages projects
- client documents uploaded from /clients-detail, served through /api/me/toolkit/file/<id> after an ownership check
eo-narrative-renders · created 20/08/2026 and umbra-renders · created 18/08/2026
- no binding on any EO Pages project or Worker on the API; written from outside the code, AL to confirm

Workers (3)

eo-backup-worker
- 18 crons on the schedules API: 0 2 1 * * events archive · 0 3 1 * * D1 backup · 0 4 1 * * URL audit · 0 4 * * 1 page-flow crawl · 30 4 * * 1 quotes trigger · 0 5 * * 1,4 Kit sync check · 0 5 1 1,7 * analytics-map refresh · 0 6 * * * error watchdog · 0 6 1 * * unused-pages (added 09/09/2026) · 30 6 * * * newsletter dispatch · 0 7 * * * Cal monitor · 0 7 * * SUN personal ops · 0 8 * * 1 weekly snapshot · 0 9 * * 1 content sync check · 0 10 * * * Notion freshness · 0 21 * * SUN Cal randomiser · 0 2 * * SUN social snapshot · */30 * * * * gcal scan
- bindings: EO_DB (eliteoutsiders), EO_DB_PREVIEW, BACKUP_BUCKET (eo-backups), BACKUP_STATE (KV) · plain vars BRAND, SITE_HOST, TOOLS_HOST, RETENTION_MONTHS, DRY_RUN_QUARTERLY_MONTHS, N8N_WEBHOOK_HEADER_NAME, D1_*_ID
- 12 secrets on the settings API: BACKUP_HEALTH_TOKEN, CAL_API_KEY, GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, KIT_API_KEY, NOTIFY_FROM, NOTION_API_KEY, NOTION_ARCHIVE_PARENT_ID, NOTION_DASHBOARD_AL_ID, NOTION_WEEKLY_PARENT_ID, RESEND_API_KEY, YT_DATA_API_KEY
- 31 endpoints: /backup/last-run, /archive/last-run, /weekly/last-run, /wip/last-pulse, 6 under /ops/* (check-ins, decisions, reviews), 21 under /admin/*-now plus /admin/events-archive-list, /admin/events-archive-restore, /admin/wip-pulse
- 24 job modules · created 30/04/2026, modified 09/09/2026
eo-shortener
- custom domain go.eliteoutsiders.com · no cron · binding DB (eliteoutsiders) · created 02/05/2026
- source eliteoutsiders-tools/worker-shortener/ · /<slug> 302 to links.target_url, unknown slug and / 302 to the homepage, every hit logged to link_clicks
mta-sts-policy (shared)
- routes mta-sts.<zone>/* on the 5 zones (eliteoutsiders.com, alexandrecorne.com, bycaliber.work, byforja.com + .net/.org) · no cron, no binding · created 29/08/2026
- serves /.well-known/mta-sts.txt in testing mode, measured 200 on 09/09/2026 · folder ~/Projects/mta-sts-policy, not a git repo
eo-cron-purge, eo-url-audit-worker: absent from /workers/scripts on 09/09/2026 (script copies in ~/Projects/_deleted-workers-backup-2026-08-28/)

KV namespaces (1)

BACKUP_STATE
- id 09082b50… · bound as BACKUP_STATE on eo-backup-worker
- run state of the 18 robots, read by /crons and /coredata through the tools Functions

Domains and Access

Custom domains (4)
- eliteoutsiders.com + www → Pages project eliteoutsiders-site
- tools.eliteoutsiders.com → Pages project eliteoutsidersintranet, CF Access gated (302 measured)
- go.eliteoutsiders.com → Worker eo-shortener (302 measured)
Platform domains (2)
- eliteoutsiders-site.pages.dev · eliteoutsidersintranet.pages.dev
Access apps (5, team eo-team, shared)
- Elite Outsiders — Tools (tools.eliteoutsiders.com) · Admin (/admin/*, /api/admin/*, + pages.dev) · Dashboard (/api/analytics) · Manifesto (/manifesto/read*, /manifesto/content/*) · Members (/api/me)
Zone (1)
- eliteoutsiders.com, active · MX Google · SPF, DKIM, DMARC, MTA-STS, TLS-RPT records above
- mta-sts.eliteoutsiders.com → shared Worker mta-sts-policy (listed above)

Three items on this page are shared by the four brands and documented here only: the Worker mta-sts-policy, the Access team eo-team, and the quarterly rotation routine eo-rotate-api-secrets-quarterly. The other three infra trees reference them by one line each. API token eo-tools-workers-read (2026-09-09) lets /crons list the Workers live.

The two repos

Repo	Serves	Gate	Contents
eliteoutsiders-site	eliteoutsiders.com + www — the public site	Public. Access on `/admin/`, `/api/admin/`, `/api/me`, `/manifesto/read*`; magic link on the member area	15 pages at the root of `public/` (29 in total), 66 Functions files, 44 D1 migrations, smoke test script, auto commit + push after deploy
eliteoutsiders-tools	tools.eliteoutsiders.com — the admin intranet, this page included	Cloudflare Access SSO (team `eo-team`) + `ADMIN_EMAIL` check on the API	69 pages in the inventory, 65 Functions files, 18 D1 migrations, the shortener Worker in `worker-shortener/`, auto commit + push after deploy
eo-backup-worker	Scheduled jobs against D1, R2 and KV	Worker default domain, admin endpoints behind `BACKUP_HEALTH_TOKEN`	24 job modules, 18 crons · manual commits, `wrangler deploy`
eo-highlights-system	Nothing served: local scripts and assets for the highlights system	n/a	GitHub remote present (last commit 27/08/2026)
eo-cron-purge	Nothing: Worker absent from the account on 09/09/2026	n/a	Folder without git, script copy in `_deleted-workers-backup-2026-08-28`
mta-sts-policy	mta-sts.<zone> on the 5 zones (shared Worker)	n/a	Folder without git, no remote
eliteoutsiders-archives	Nothing served: local data archive (events dumps)	n/a	Folder without git
eo-quote-formats-test	Nothing served: quote format experiments	n/a	Folder without git

The first four repos are private on GitHub under alexandrecorne/, all on branch main, verified with git remote -v on 09/09/2026. The site and tools repos both bind the same D1 and the same R2 toolkit bucket — that coupling is deliberate and it is the main reason a migration has to be run once and smoke-tested twice. The repos of byForja, byCaliber and Alexandre Corne are listed on their own infra trees.

Tool pages on tools.eliteoutsiders.com (69)

One line per page, from public/pages.json (rewritten by scripts/pages-inventory.js at every deploy). "Live" means the page is in the inventory and serves; "Placeholder" was flagged from a placeholder block in the markup, the rest was not audited page by page.

Page	What it is	State
/index	Home. The hub that links every page below.	Hub
/alllinks	All links audited	Live
/alsboard	AL's Board	Live
/alsboard-v2	AL's Board, v2	Live
/architecture	Architecture	Live
/backdata	Back data	Live
/backdata/analytics-map	Analytics map	Live
/backdata/content-system	Content System	Live
/backdata/content-system-feeds-test	Feed grids TEST — TikTok, Instagram, Facebook, YouTube	Live
/backdata/content-system/carousel	Carousel Planning	Live
/backdata/content-system/lifestyle	Lifestyle Planning	Live
/backdata/content-system/linkedin	LinkedIn Planning	Live
/backdata/content-system/long-form	Long-Form Planning	Live
/backdata/content-system/newsletter	Newsletter Planning	Live
/backdata/content-system/pinterest	Pinterest Planning	Live
/backdata/content-system/planner-a	Planner A, Weekly calendar	Live
/backdata/content-system/planner-b	Planner B, Timeline	Live
/backdata/content-system/planner-c	Planner C, Board preview	Live
/backdata/content-system/planner-d	Planner D, Per format	Live
/backdata/content-system/planner-e	Planner E, Run sheet	Live
/backdata/content-system/planners	Planner proposals	Live
/backdata/content-system/quotes	Quotes Planning	Live
/backdata/content-system/shorts	Shorts Planning	Live
/backdata/content-system/substack	Substack Planning	Live
/backdata/content-system/threads	Threads Planning	Live
/backdata/content-system/x	X Planning	Live
/backdata/display-doctrine	Display Doctrine	Live
/backdata/display-doctrine-doc	Display Doctrine Doc, 31/07/2026 update	Live
/backdata/email-system	Email system	Live
/backdata/lf-cross-platform-content	Long Form and Cross Platform Content Process	Live
/backdata/lf-cross-platform-content-doc	LF and Cross Platform Content Process Doc, 29/07/2026 update	Live
/backdata/notion-vs-tools	Notion ↔ Tools — source-of-truth split	Live
/backdata/old-gantts	Old Gantts — V1 Archive	Live
/backdata/quotes	Quotes	Live
/backdata/script-board-doc	LF Scripts Board Doc, 30/07/2026 update	Live
/backdata/videos	Video runs	Live
/backlog	Backlog	Live
/bank-board	Bank Board	Live
/bookings	Bookings	Live
/cal-questionnaires	Cal.com Questionnaires	Live
/click-analytics	Click analytics	Live
/clients	Clients	Live
/clients-detail	Client detail	Live
/coredata	Core data	Live
/crons	Robots	Live
/data	Data	Live
/data/experiments	Experiments	Placeholder
/eisenhower-traceability	Eisenhower Matrix — Traceability	Live
/email-deliverability	Email deliverability	Live
/heatmap	Heatmap	Live
/image-edit	Image Editor	Live
/infra-tree	Infra tree. This page.	This page
/og-preview	OG Preview	Live
/page-flow	Page flow	Live
/preview-clients-detail	Preview · Clients detail (V1)	Live
/public-site-deploy-process	Public site deploy process · Claude → AL	Live
/purchases	Purchases	Live
/ratings	Ratings moderation	Live
/script-board	LF Scripts Board	Live
/sessions	Sessions	Live
/showcase	AL's Board (showcase)	Live
/skincare-history	Skincare history	Live
/social-analytics	Social analytics	Live
/sources/email	Sources · Email	Live
/sources/external	Sources · External	Live
/system-overview	System Overview — 4 pillars + 5 HQs	Live
/trauma-map-analytics	Trauma Map analytics	Live
/umbra-planner	Umbra Planner	Live
/weekly-business-steering	Weekly Business Steering	Live

69 pages in the inventory on 09/09/2026, this hub included. 16 of them sit on scripts/mobile-allow.txt (boards and canvases that scroll inside by design, plus small overflows to fix).

External services wired

Service	Category	Role	If it breaks...
Cloudflare Pages	Cloudflare	Hosts eliteoutsiders.com and tools.eliteoutsiders.com	Everything goes dark — public site and admin at once
Cloudflare D1	Storage	Shared SQL database `eliteoutsiders`, 51 table names at build time, plus `eliteoutsiders-preview`	No more reads/writes, cascading failures across the stack
Cloudflare R2	Storage	Client documents (user-toolkit) and monthly backups; two renders buckets bound nowhere	Toolkit downloads break; backups stop accumulating
Cloudflare Workers	Automation	`eo-backup-worker` (18 crons, KV `BACKUP_STATE`), `eo-shortener` (`go.eliteoutsiders.com`), `mta-sts-policy` (shared). API token `eo-tools-workers-read` lets /crons list them live	Backups, audits and monitors stop; short links and MTA-STS policies answer 5xx. The sites keep serving
Cloudflare Access	Auth	Team `eo-team` (shared across the four intranets), 5 EO apps: Tools, Admin, Dashboard, Manifesto, Members	No more access to tools.eliteoutsiders.com nor to the gated site routes
Cloudflare Turnstile	Auth	Anti-bot filter on public forms	No bot protection, forms still work
Cloudflare DNS	Network	Zone eliteoutsiders.com — routing plus SPF/DKIM/DMARC/MTA-STS/TLS-RPT records, `go.` and `mta-sts.` Worker hosts	Cascade: Pages, Access, mail, monitoring — everything breaks
CF DMARC Management	Network	DMARC monitoring dashboard #1 (first `rua` address)	Loss of domain-spoof visibility (Postmark takes over)
Resend	Email	Transactional email (Trauma Map results, confirmations, worker alerts), DKIM on `resend._domainkey`	Visitors no longer receive their quiz results; alerts go silent
Kit	Email	Newsletter + post-quiz marketing sequences (V4 API), sync-checked by the worker on Monday and Thursday	Newsletter broken, sequences stop firing
Postmark DMARC	Email	DMARC monitoring dashboard #2 (second `rua` address, weekly digest)	No more weekly digest (CF DMARC Mgmt takes over)
Postmark Spam Check	Email	Manual SpamAssassin test before a Kit broadcast (score 0–10, target ≤2)	Not critical — ad-hoc tool, AL eyeballs the spam score otherwise
Google Workspace	Email	Mailboxes on eliteoutsiders.com. MX on Google, SPF `include:mx.ovh.com include:_spf.google.com -all`, DKIM `google._domainkey`, DMARC `p=quarantine`	Outbound mail stops and inbound replies bounce
Google Postmaster Tools	Monitoring	Gmail-side sender reputation, spam rate and compliance — dashboard for eliteoutsiders.com	Reputation drift stops being visible before Gmail starts filtering
Stripe	Payment	High-ticket coaching payments, webhook on the site	No more coaching revenue collected
LemonSqueezy	Payment	Manifesto info-product payments, webhook on the site	No more Manifesto revenue collected
Cal.com	Booking	Bookings from the site (`/call` → `eoascension`), webhook to the site, watched and randomised by the worker	No more bookings from the site
Google Calendar	Calendar	AL's admin calendar, read by alsboard through OAuth and scanned by the worker every 30 minutes	Alsboard no longer shows upcoming meetings
YouTube Data API	External	`YT_DATA_API_KEY` on the tools project and the worker: social analytics and the social snapshot (`0 2 * * SUN`)	Social analytics stop refreshing; the site is unaffected
Notion	Doc	Source-of-truth documentation, read by the planner endpoints and the daily freshness scan	You lose the docs and the planner rows, the code keeps working
n8n	Automation	Side automations (personal VPS)	Side workflows broken, the site keeps running
PostFast	Automation	Shorts publishing tool	Shorts publishing breaks, the site keeps running
Substack	Content	Long-form newsletter, RSS read by the site's Library	Library page goes empty (rest of the site still works)
UptimeRobot	Monitoring	External HTTP monitoring (alerts when the site goes down)	No automatic downtime alerts (the site itself still runs)
Terminal (macOS)	Operator	Local CLI — drives Wrangler, Git, npm, curl, plus the launchd agents	No more deploys or infra admin (live site continues)
Wrangler (CF CLI)	Operator	Deploys Pages and Workers, queries D1, manages secrets	No more deploys or manual DB queries
whisper-cli	Operator	Word-level transcription of the long-forms, once per video on the Mac (Homebrew, model `small.en` on Metal). Supplies the TIMES only: the words come from AL's script, since `small.en` mis-hears (it turned "shadow" into "shallow" on V9). Audio never leaves the machine	No new word timings, so no burned subtitles on a new video. Existing JSON files keep working, the live site is unaffected
GitHub	Operator	4 private repos (site, tools, backup worker, highlights system)	No more versioning or collaboration (live site continues)
1Password	Operator	Secrets vault: logins and API keys. pending CLI installed, account registered in the CLI on 09/09/2026, integration not verified. See the section below	Nothing today, it holds no live secret. Once activated, no `op read` means falling back to the local secrets file

Secrets vault · 1Password pending

Status on 09/09/2026: not in service. The CLI is installed on AL's Mac (op 2.39.0, via Homebrew, binary at /opt/homebrew/bin/op). op account list now returns one account on my.1password.com, so the account exists; whether the CLI integration is active was not read back. Nothing in this tree reads a secret from it today. This block records a decision that is taken, not a service that is running.

Role. Secrets vault: the place that holds the logins and the API keys, for this brand and for the three others.

What it replaces…

What it replaces. Today the secrets sit in clear text in one local file, ~/.config/eo/secrets.env, with dated copies beside it. That single file is the current point of truth for all four brands. The eo in the path is historic, like the shared eo-team Access team, not a brand boundary. 1Password does not remove it yet: it doubles it first, then replaces it.

What changes once the CLI integration is on. A secret is read with op read at the moment it is needed, and its value never has to transit in clear text through a file.

Rotation (shared). The quarterly rotation of API keys already exists as a Claude Code scheduled task, eo-rotate-api-secrets-quarterly, cron 0 9 1 */3 *, next run 01/10/2026. It is a routine on AL's Mac covering the four brands, not a Cloudflare cron, which is why it carries no card on /crons. 1Password becomes the place where that rotation is performed.

Plan, and the two moments it changes.

Plan	Price	Trigger
Individual	about 3 USD per month	The starting point. One operator, one vault.
Families	about 5 USD per month, up to 5 people	The day Ali, AL's associate, needs shared access.
Teams Starter	about 20 USD per month, flat	The day a key owned by a client enters the vault. Holding a third party's secrets inside a family plan does not hold up.

Next action, on AL: create the account, then activate the CLI integration. Nothing here changes state until both are done.

Google Postmaster Tools — status on 11/08/2026

Domain eliteoutsiders.com. Dashboard: postmaster.google.com/v2/sender_compliance?domain=eliteoutsiders.com

All 8 compliance requirements green: SPF/DKIM, From header alignment, DMARC, encryption, user-reported spam rate, DNS records, one-click unsubscribe, honour unsubscribe.

Deliverability analysis says "not enough outgoing email" — the sending volume is still too low for Google to score reputation. Expected at this stage, not a fault. It only becomes a real signal once Kit broadcast volume rises.

The legacy Postmaster interface is retired on 31 October. Use the /v2/ URL above — the old one will stop working.

Redirects

From	To	Code	Why
/call	https://eliteoutsiders.com/call	page	EO page with the calendar embedded, black, site chrome. Was a 301 to the booking tool from 02/09 to 20/09/2026, and that 301 went out with no Cache-Control, so browsers that saw it in those 18 days keep redirecting on their own. The page now ships Cache-Control no-store.
/coaching · /work	/workwithalex	301	Old offer URLs.
/product · /produit	/manifesto	301	Old product URLs, FR and EN.
/trigger-map · /me/trauma-maps	/trauma-map	301	Earlier names of the trauma map.
/trauma-map/*	/trauma-map.html	200	Rewrite: every sub-path serves the same page.
/admin	/	301	The admin moved to tools.eliteoutsiders.com.
/manifesto/welcome	/manifesto/read	301	Reader entry point.
go.eliteoutsiders.com/<slug>	links.target_url	302	Worker eo-shortener, click logged to D1. Root and unknown slugs go to the homepage. Measured 302 on 09/09/2026.
tools.eliteoutsiders.com/*	eo-team Access login	302	Every route of this intranet without a session. Measured 302 on 09/09/2026.

Site rules live in eliteoutsiders-site/public/_redirects (10 rules). eliteoutsiders-tools/public/_redirects carries 20 legacy 301s from renamed intranet pages (/page-analytics → /click-analytics, /others/* → /backdata/*, /cron-robots → /crons, and so on), kept so old links survive.

Links to the full documentation

→ Notion: Claude Code HQ — universal patterns · rules shared across all four verticals

→ Notion: Elite Outsiders — Claude Code HQ — specifics · posture, hub map, EO sub-pages

→ Notion: Infra EO — plain overview (for AL) · the 5-minute teaching brief

→ Notion: Infra EO — 3-layer reference · technical docs chaptered by service

→ /architecture · the long-form system map · → /crons · the automation surface · → /coredata · live counters

For Claude

Template. Since 09/09/2026 this page follows the byForja /infra-tree template (rule 15, Intranet structure): same markup, same CSS, same diagram engine as tools.byforja.com/infra-tree, Elite Outsiders data only. Edit the data (nodes, edges, inventory, repos, notes), never the engine; an engine change is made on the byForja page first and copied to the four. EO adds one category (Payment) to the byForja set of nine.

Audit of 09/09/2026, read back from the Cloudflare API, not declared. Workers from /accounts/{id}/workers/scripts with /schedules, /settings and /workers/domains, Pages projects and their production bindings from /pages/projects/{name}, D1 tables from a sqlite_master query at build time, R2 and KV from their list endpoints, Access apps from /access/apps, public DNS with dig, repos from git remote -v under ~/Projects. HTTP codes measured with curl --max-redirs 0.

What changed on this rebuild. The cross-brand repo table (21 repos of the account) is replaced by EO's own repos; the other three brands live on their own infra trees. The inventory now carries the secret names of both Pages projects and of the backup worker, the 18 cron names, the 31 worker endpoints, the 51 D1 table names (48 on the morning audit: home_layout, home_sections, page_titles landed during the day), the 5 Access apps, the two renders buckets and the YouTube Data API. Shared items stay documented here: mta-sts-policy, the eo-team Access team, the quarterly secret rotation routine.

Not read back. The Google Postmaster status keeps its 11/08/2026 date, the dashboard has no API. The 1Password CLI integration state needs op whoami in an interactive shell. Which project writes eo-narrative-renders and umbra-renders: no EO repo binds them. The tool-pages table comes from public/pages.json; the State column was not audited page by page.