Cloudflare Alpha Setup

Environments

Verified on 2026-10-20. The hosted alpha is alpha.goldieblocks.ai.

Both projects belong to the shanti team. Project display names may differ from their slugs. Local development uses bun run dev and the existing cloud development backend, not a database running on the laptop.

The alpha Cloudflare Worker is goldie-blocks-staging in account d056c47af0f5dd2b92fab9367b9bf3d9. It uses only https://polished-camel-476.convex.cloud and the corresponding .convex.site endpoint. Deployment references are editable labels; generated names and URLs did not change when these references were renamed.

Never deploy, seed, reset or copy production data as part of this workflow. The existing production deployment resilient-peccary-558 is unchanged. The alpha is early testing: use synthetic or anonymised documents, keep independent copies, and expect that test data may be reset. Authentication has been verified; an invitation-only access restriction has not been audited.

Custom domain cutover

alpha.goldieblocks.ai is attached to the alpha Worker. On 2026-10-20, HTTPS passed with certificate verification enabled, the WorkOS sign-in round trip returned to /app on this hostname, and authenticated Convex workspace, project and library data loaded. The session also survived a page reload.

WORKOS_REDIRECT_URI on the alpha Worker is now https://alpha.goldieblocks.ai/callback. The WorkOS sandbox allowlist retains both this callback and the previous workers.dev and localhost callbacks. The workers.dev address remains attached, but new sign-ins return to the custom domain. The root domain and production remain unchanged.

Public DNS resolves the hostname. Some local resolvers may still cache the initial negative response; do not disable certificate validation to work around DNS caching. The staging worktree's Wrangler source records the custom-domain route.

Authentication and secrets

Hosted alpha uses the existing WorkOS sandbox application. Its allowed callback includes https://goldie-blocks-staging.shanti-d05.workers.dev/callback; retain the existing localhost callbacks. Login starts at /auth/sign-in. The local test-user door /dev/sign-in is absent from hosted alpha.

Cloudflare stores WORKOS_CLIENT_ID, WORKOS_API_KEY, WORKOS_REDIRECT_URI and WORKOS_COOKIE_PASSWORD as protected bindings. Use sandbox credentials and a separate cookie password. Never publish them in Git, browser code or documentation.

The alpha Convex deployment stores WORKOS_CLIENT_ID, an empty DEV_LOGIN_JWKS (disables the local test-login issuer), and OPENAI_API_KEY. Add or rotate the AI key only in alpha environment variables. The OpenAI key belongs to a dedicated alpha OpenAI project. AI runs in Convex, so the key does not belong in Cloudflare or any VITE_* variable. Do not read or print secret values to check whether they are configured.

Testing costs

The owner configured an enforced US$25 monthly OpenAI project limit and an email alert at US$20. The intended US$2 daily cap is not implemented. Verify the key belongs to that budgeted project after rotation; a successful AI response alone does not prove which OpenAI project owns the key.

OpenAI project settings → Limits → Spend contains the monthly limit and its enforcement switch. Alerts alone do not stop traffic. Enforcement can lag slightly, so the monthly figure is not an exact maximum to the cent. See OpenAI spend limits.

Alpha calls OpenAI directly. Convex AI Gateway dollar limits do not cover these calls. The agent has bounded tool steps, but no verified dollar budget guard. Do not describe the US$2 daily target as enforced.

Cloudflare remains on Workers Free; no paid plan was enabled. Convex alpha has function-call disable thresholds of 10,000 per day and 100,000 per calendar month. Those thresholds limit backend calls, not OpenAI dollars. Convex allowances are shared by the team. Cloudflare, Convex and OpenAI are separate cost categories; do not enable paid upgrades automatically.

Verification and deployment status

The hosted landing page, static assets, documentation with TOC, sign-in redirect, rejected invalid callback and missing local test-user door passed HTTP checks. Browser checks confirmed WorkOS sign-in, session persistence after reload, and authenticated workspace/project/library reads. The alpha user record was also confirmed in polished-camel-476.

After the owner rotated the alpha key, one short browser chat request returned “Alpha key test passed.” No production changes were made. Cloudflare accepted the upload with an 8 ms startup time; this does not prove all future requests fit every free-plan CPU or resource limit.

The Workers integration is available through wrangler.jsonc, build:staging, preview:staging, smoke:staging and deploy:staging. Copy .env.staging.example to the ignored .env.staging.local for the public Convex selector and URLs. The build refuses another backend target. Use ignored .dev.vars.staging for local sandbox WorkOS credentials; never upload its localhost callback as the hosted callback. The Cloudflare plugin is enabled only for Vite staging mode; ordinary dev keeps its Node runtime.

bun run build:staging
bun run preview:staging
bun run smoke:staging # local preview on :3100
bun run smoke:staging https://alpha.goldieblocks.ai
bun run deploy:staging

A frontend deployment does not publish Convex functions. Existing unit, Steiger and Knip failures were reproduced on the baseline during preparation; the full story suite was not run for this integration. Build, TypeScript, local and hosted HTTP checks passed, with browser verification as above.

Automatic alpha releases

Cloudflare Workers Builds uses the existing Cloudflare Workers and Pages GitHub App installation for boomercoded/goldie-blocks. Its release branch is main; preview builds are disabled. This is configured on the alpha Worker, not GitHub Actions. No Cloudflare API token is stored in GitHub.

The build command is:

cp .env.staging.example .env.staging.local && bun run build:staging

The deploy command is:

bunx convex dev --once --tail-logs disable && bunx wrangler deploy --env staging && bun run smoke:staging https://alpha.goldieblocks.ai

Cloudflare's encrypted build secret CONVEX_DEPLOY_KEY must belong only to polished-camel-476. The build target guard rejects a key for another backend. CI intentionally omits --env-file from the Convex command: that flag makes this CLI version read credentials only from the file, bypassing the encrypted build environment secret. WorkOS runtime secrets stay on the Worker and the OpenAI key stays in Convex. Neither belongs in the repository or build output.

The frontend build must succeed before backend publication; backend failure prevents the Worker upload. Publishing is not an atomic transaction: a Worker upload failure can leave the new backend serving the previous frontend. Keep backend changes compatible with the previous frontend during releases. HTTP smoke checks do not replace browser sign-in or feature-specific tests. Cloudflare build minutes and provider resource allowances still apply.

Automatic alpha deployments are active. Cloudflare build 64ad0e9f-bdab-4143-a2aa-6440c3ec9ad9 successfully built commit d8066433, published the alpha backend, deployed Worker version afd3b690-c692-4dbe-9970-dca0b0c6f85c, and passed all hosted HTTP smoke checks on 2026-10-20. The first attempt stopped before deployment because of the --env-file credential behavior described above; the corrected run passed end to end. Existing Cloudflare build credentials are reused; no new Cloudflare API token was created. The temporary GitHub Actions secret was removed because this pipeline runs in Cloudflare, not GitHub Actions. Production is not a target of these commands.

For backend operations, announce the explicit target first and use the stable deployment name polished-camel-476 (or full reference shanti:goldie-blocks-staging:dev/alpha). Do not use the obsolete dev/staging reference. A frontend upload does not deploy Convex functions. Read the deployment guard before any backend change; production requires separate explicit authorisation.