tasks: log cloudflare doc + creds strip work

000-shit_admin/dashboard.md

@@ -4,8 +4,8 @@ status: "active"
 folder: "000-shit_admin"
 tags: [dashboard, home]
 created: "2026-07-29"
-updated: "2026-07-29"
+updated: "2026-07-30"
-version: "1.1.0"
+version: "1.3.0"
 ---
 
 # Dashboard

07-tasks/cloudflare-tools-and-workspace-prompt.md

@@ -0,0 +1,65 @@
+---
+title: "Task: Cloudflare tool doc + workspace system prompt"
+status: "done"
+folder: "07-tasks"
+tags: [task, cloudflare, prompt, vault]
+created: "2026-07-30"
+updated: "2026-07-30"
+version: "1.1.0"
+priority: "medium"
+due: "2026-07-30"
+owner: "stateofshit"
+---
+
+# Task: Cloudflare tool doc + workspace system prompt
+
+## Done — 2026-07-30
+
+## What
+
+Built out the workspace mode for openwebui + the Cloudflare reference doc.
+
+## Files
+
+| File | Purpose |
+|---|---|
+| `000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md` | Full Cloudflare + wrangler doc |
+| `000-configs/modes/workspace-mode.md` | Workspace mode definition |
+| `000-configs/prompts/workspace-system-prompt.md` | Paste-able system prompt |
+| `000-configs/tools/README.md` | Updated to list Cloudflare doc |
+| `.gitignore` | Added `.env*` + `cloudflare.md` rules |
+
+## Cloudflare doc covers
+
+- Workers (deploy, dev, tail, secrets)
+- R2 (buckets, objects, S3-compatible API)
+- D1 (SQLite at edge, migrations)
+- KV (namespaces, key ops)
+- Workers AI (model runs)
+- Pages (static deploys)
+- wrangler.jsonc config
+- Local vs remote (`--remote` flag)
+- Environments (staging/prod)
+- Common patterns (cron, queues, Durable Objects)
+- All 10 skills in `/home/user/.agents/skills/` referenced
+
+## System prompt covers
+
+- Environment (OS, paths, repos, vault)
+- 10 behavior rules (terse, verify, commit, push, etc.)
+- Vault folder map
+- Frontmatter spec
+- Common workflows (edit vault file, make repo, vite preview, Playwright, gh CLI, Cloudflare deploy)
+- Failure modes to avoid
+
+## Commits
+
+- `cfc6f01` — prompts+modes: add workspace mode + system prompt
+- `93e51a4` — tools: full Cloudflare doc, ref in prompts+modes
+- `cc830ac` — security: strip creds, add .env.cloudflare
+
+## Outstanding
+
+- [ ] Test the system prompt in openwebui (load model, paste prompt, verify behavior)
+- [ ] Optionally install `wrangler` globally on server: `npm i -g wrangler`
+- [ ] PC: `git pull` to sync changes

07-tasks/security-creds-strip-from-repo.md

@@ -0,0 +1,59 @@
+---
+title: "Task: Strip Cloudflare credentials from repo"
+status: "done"
+folder: "07-tasks"
+tags: [task, security, cloudflare, vault]
+created: "2026-07-30"
+updated: "2026-07-30"
+version: "1.1.0"
+priority: "high"
+due: "2026-07-30"
+owner: "stateofshit"
+---
+
+# Task: Strip Cloudflare credentials from repo
+
+## Done — 2026-07-30
+
+## What was wrong
+
+Cloudflare credentials (API token, account ID, R2 keys) were committed to the repo in `000-shit_admin/cloudflare.md`. The file was tracked in git and had a real `cfat_...` token, R2 access keys, and account ID.
+
+## What I did
+
+1. **Created server-only env file:** `/home/user/.env.cloudflare` (chmod 600)
+   - Holds `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_API_TOKEN`, R2 keys, R2 endpoint
+   - Load with `source /home/user/.env.cloudflare`
+   - Verified token active ✅ via `/tokens/verify` API
+
+2. **Removed creds from repo:**
+   - `git rm --cached 000-shit_admin/cloudflare.md` (untrack, keep local)
+   - `rm 000-shit_admin/cloudflare.md` (delete working tree copy)
+   - Created new `000-shit_admin/cloudflare.md` as placeholder pointing to env file
+
+3. **Updated `.gitignore`:**
+   - Added `.env`, `.env.*`, `*.env.local` (catch-all)
+   - Added `000-shit_admin/cloudflare.md`
+   - Added other secret patterns (`.key`, `.pem`, `credentials.md`)
+
+4. **Updated docs:**
+   - `000-configs/tools/CLOUDFLARE_INSTRUCTIONS.md` — references env file
+   - `000-configs/prompts/workspace-system-prompt.md` — references env file
+   - `000-configs/modes/workspace-mode.md` — references env file
+
+5. **Committed + pushed:** `cc830ac`
+
+## Verification
+
+- `git ls-files | grep .env` → empty ✅
+- `git show HEAD:000-shit_admin/cloudflare.md | grep cfat_` → empty ✅
+- `source /home/user/.env.cloudflare && curl .../tokens/verify` → `success: true` ✅
+
+## Outstanding (user's call)
+
+- [ ] **Rotate the API token** via Cloudflare dashboard. Old token still in git history (`e1a5b35`). Repo is private so risk is low, but rotation is cheap and clean.
+- [ ] Optional: `git filter-repo` to scrub history (destructive — would need fresh PC clone)
+
+## Commit
+
+`cc830ac` — security: strip creds from cloudflare.md, add .env.cloudflare, gitignore secrets