# AIVIS Edge Lab — Cloudflare account & test zone setup

**A Cowork runbook.** Open this file in a Cowork session with browser access and work through it top to bottom with Claude. Estimated time: 45–70 minutes, most of it waiting for nameservers.

> **What this produces:** AIVIS's own Cloudflare lab account, a live test domain serving four
> prepared pages, a scoped API token, and an AIVIS business whose JSON-LD covers those pages —
> everything the edge-connector build session needs to finish issue
> [#9](https://github.com/epoint-digital/aivis-edge-connector/issues/9) (deploy + end-to-end drills).
>
> **Ownership note (decision 2026-09-07):** customer accounts NEVER grant AIVIS deployment
> rights — customers deploy the packaged connector themselves; AIVIS provides assistance,
> support, and new versions. The full-scope token in Phase E is acceptable **only because this
> lab account is AIVIS's own property.**

## Who does what

| Marker | Meaning |
|---|---|
| 🧑 | **Human only.** Account credentials, payment, CAPTCHA, and the final "Create token" click. Claude must never enter passwords, card numbers, or solve CAPTCHAs — don't paste them into chat either. |
| 🤖 | **Claude (browser).** Navigation, form-filling of non-sensitive fields (with your approval), verification, reading values back. |

## Prerequisites

- An email address for the lab account — recommended: `danielbanica+aivislab@gmail.com` (plus-alias keeps it separate).
- A payment card **only if** buying a fresh domain (~$10/yr via Cloudflare Registrar). Reusing a spare epoint/marketos domain avoids payment entirely.
- Login for the AIVIS dev app: `https://aivis-new.dev.onepoint.ro` (Phase F).
- This repository checked out at `/Users/dob/Documents/projects/aivis-edge-connector` (the test pages live in `ops/test-origin/` — see its README).

## End-state checklist (verify before closing the Cowork session)

- [ ] Cloudflare account exists; zone is **Active** (nameservers switched)
- [ ] `https://<lab-domain>/`, `/about`, `/products/widget`, `/origin-block` all load over HTTPS
- [ ] Scoped API token created (Phase E recipe) and copied
- [ ] AIVIS business for `https://<lab-domain>` has all four URLs `jsonLd.ready = true` (Phase F check)
- [ ] Hand-off block (Phase G) pasted back into the edge-connector build session

---

## Phase A — Cloudflare account 🧑

1. 🧑 Go to `https://dash.cloudflare.com/sign-up`, register with the lab email, verify the email, log in. (Free plan — no payment.)
2. 🤖 Once logged in, Claude confirms the dashboard loads and notes the **Account ID** (dashboard URL: `dash.cloudflare.com/<account-id>` — also shown on any zone's Overview, right column).

## Phase B — The lab domain

Pick ONE:

**Option 1 — buy a fresh domain (recommended; ~$10/yr, cleanest):**
1. 🤖 Navigate: dashboard → **Domain Registration → Register Domain**. Search a name — suggestions: `aivis-lab.com`, `aivis-edge-lab.com`, `aivislab.dev` (any cheap TLD is fine; avoid `.ro`/country TLDs with special rules).
2. 🧑 Complete the purchase (registrant details + payment). Registrar domains are on Cloudflare's nameservers automatically — the zone is **Active immediately**, no waiting.

**Option 2 — reuse a spare domain you already own:**
1. 🤖 Dashboard → **Add a domain** → enter the domain → choose the **Free** plan → Cloudflare shows two nameservers.
2. 🧑 At the current registrar, replace the nameservers with the two Cloudflare gave you.
3. ⏳ Wait for the zone to flip to **Active** (minutes to a few hours). 🤖 Claude can re-check the dashboard periodically.

> Don't use a domain with live email/production DNS — this is a disposable lab.

## Phase C — Test origin on Cloudflare Pages

The test pages are prepared in the repo: `ops/test-origin/` (see its README —
`index.html`, `about.html`, `products/widget.html`, `origin-block.html`, `style.css`;
fictional Meridian Widgets SRL content, and `origin-block.html` deliberately ships its own
`data-aivis` block to test idempotency).

1. ✏️ **Before uploading:** each page hardcodes `<link rel="canonical" href="https://epointdigital.de…">`.
   If the lab domain is anything else, update the canonical host in all four HTML files first
   (find/replace `epointdigital.de` → `<lab-domain>`), commit, then upload. A wrong canonical
   confuses the AIVIS crawl in Phase F.
2. 🤖 Dashboard → **Workers & Pages → Create → Pages → Upload assets**.
3. 🤖 Project name: `aivis-edge-lab`. Upload the **contents** of `ops/test-origin/` (drag the folder in Finder — 🧑 does the drag if the browser blocks automated file pickers).
4. 🤖 Deploy; confirm the `*.pages.dev` preview URL serves the home page with styling.

## Phase D — Custom domain + verification

1. 🤖 In the Pages project → **Custom domains → Set up a custom domain** → add `www.<lab-domain>`. Cloudflare creates the DNS record automatically (zone is in the same account).
2. 🤖 Add the apex `<lab-domain>` as a second custom domain (or create a redirect rule apex → www; either is fine — **note which host is canonical**, the build session needs it for `PRIMARY_HOST`).
3. 🤖 Verify all four pages over HTTPS on the real domain:
   `/` · `/about` · `/products/widget` · `/origin-block`
   (Pages serves clean URLs for `about.html` → `/about` etc.)
4. 🤖 View source of `/origin-block` — it must contain exactly one `data-aivis` script (from the origin).

## Phase E — Scoped API token

> Lab-account only. This token lets the build session deploy the worker, manage its route,
> and purge cache. Recipe = spec P-02, least privilege. Menu names may differ slightly by
> dashboard version — match by meaning.

1. 🤖 Navigate: top-right profile → **My Profile → API Tokens → Create Token → Create Custom Token**.
2. 🤖 Fill (🧑 approves):
   - **Name:** `aivis-edge-lab-ops`
   - **Permissions:**
     - `Account` · `Workers Scripts` · `Edit`
     - `Zone` · `Workers Routes` · `Edit`
     - `Zone` · `Zone` · `Read`
     - `Zone` · `Cache Purge` · `Purge`
   - **Account Resources:** Include → the lab account
   - **Zone Resources:** Include → Specific zone → `<lab-domain>`
   - **TTL:** 90 days (lab hygiene; renew when it expires)
3. 🧑 **Continue to summary → Create Token.** Copy the token once — it is shown a single time.
4. 🧑 Keep it until Phase G; don't paste it anywhere except the build session.

## Phase F — AIVIS business for the lab domain

The worker's zero-trust binding (S-05) only injects artifacts whose URL host matches the zone —
so the lab domain needs its own AIVIS business with generated JSON-LD.

1. 🤖/🧑 Log in to `https://aivis-new.dev.onepoint.ro`.
2. Create a **Business**: name `AIVIS Edge Lab`, base URL `https://www.<lab-domain>` (use the canonical host from Phase D).
3. Create a chain (e.g. `Entire Website`) and run discovery/capture over the four pages, then run the pipeline the usual way (entities → graph → intent in **deployment** phase → generate JSON-LD) until the URLs report ready.
4. Verify from any terminal (token = the AIVIS dev token, `<AIVIS_DEV_TOKEN>`):

```bash
curl -s -H "Authorization: Bearer <AIVIS_DEV_TOKEN>" \
  "https://aivis-new.dev.onepoint.ro/api/public/v1/jsonld?url=https%3A%2F%2Fwww.<lab-domain>%2Fproducts%2Fwidget" | head -c 300
```

A JSON envelope (not a 404) for at least `/`, `/about`, and `/products/widget` means Phase F is done. (`/origin-block` may stay without an artifact — it tests idempotency, not delivery.)

## Phase G — Hand-off to the build session

Paste this block into the **edge-connector Claude Code session** (fill the values):

```text
Lab zone ready.
Domain (canonical host): www.<lab-domain>
Cloudflare Account ID: <account-id>
CF API token (aivis-edge-lab-ops): <token>
AIVIS business id: <business-id from the dev app or /businesses>
Pages project: aivis-edge-lab
```

The build session then deploys the worker, attaches the route, runs the T-04 drills
(injection, idempotency on `/origin-block`, purge timing, retraction, pause < 60 s), and closes #9.

## Safety notes for the Cowork session

- Claude never enters passwords, payment details, or CAPTCHA answers, and never clicks the final purchase/create-token confirmation — those are yours (🧑).
- The two secrets this runbook touches (CF token, AIVIS token) go only into the build session's chat, nowhere else. Rotate both when the lab phase ends.
- Everything created here is disposable and AIVIS-owned; deleting the Pages project + zone + token undoes it all.