Dane's Gate Walkthrough — James Cooper Pack (2026-06-10, evening run)

For: Dane Cooper, at the home terminal, executing every human gate this workflow needs — in order, with verification at each step.
Companion: CONTINUATION-JAMES-PACK-2026-06-10.md (same folder) boots the NEXT Claude session; THIS document is YOUR runbook tonight. Open the .html in Chrome — checkboxes persist.
Time budget: Gates 1–4 ≈ 35 minutes tonight. Gates 5–6 are scheduled items (15 min + 45 min). Gate 7–8 are conditional.
Rule for every gate: do the steps, run the VERIFY line, check the box only when the verify passed. If anything fails, the TROUBLE line says what to do — and Claude is one Telegram reply away ([james-pack] ACTION: question DETAIL: …).

Gate map (what stands between here and "James is answering")

GATE 1 — Deploy james.cooperluxe.com (~10 min)

STATUS — DONE (by Claude, not you), verified live 2026-06-11: the portal is up at https://james-cooperluxe.pages.dev — D1 created + schema applied (james-questionnaire), Pages deployed, ADMIN_KEY set (rotated once after a leak; old key verified dead 401). Live receipts: landing 200 · /api/whoami 200 · /overall/ 200. Steps 1.1–1.6 are kept for the record — skip them. Step 1.7 (the pretty domain) moved into Gate 9 v2 and is deliberately deferred; today's canonical links are Gate 9's ?view= table. Read the VERIFY block's james.cooperluxe.com URLs as james-cooperluxe.pages.dev.

Same muscle memory as your Yana questionnaire deploy. From PowerShell or Git Bash:

• [ ] 1.1 cd ~/ecosystem-cooperluxe/james-portal
• [ ] 1.2 wrangler d1 create james-questionnaire — copy the database_id it prints.
• [ ] 1.3 Open wrangler.toml, replace the zeros line with that database_id, save.
• [ ] 1.4 wrangler d1 execute james-questionnaire --remote --file=schema.sql
• [ ] 1.5 wrangler pages deploy public --project-name james-cooperluxe
• [ ] 1.6 wrangler pages secret put ADMIN_KEY --project-name james-cooperluxe — pick a strong string; it's how YOU read answers in a browser.
• [ ] 1.7 Cloudflare dashboard → Pages → james-cooperluxe → Custom domains → add james.cooperluxe.com. (DNS on Cloudflare = automatic; DNS elsewhere = add CNAME james → james-cooperluxe.pages.dev.)

VERIFY (all three, ~2 min):
- [ ] https://james.cooperluxe.com/⧉ renders the landing; both cards click through.
- [ ] Open /abkc/, tap any answer → header shows "saved ✓" (that's the POST hitting D1; "saved on this device" means the Function/D1 isn't wired — recheck 1.2–1.4).
- [ ] https://james.cooperluxe.com/api/answers?key=YOUR_ADMIN_KEY⧉ shows the answers view (your test tap appears).

TROUBLE: deploy errors → run from the james-portal dir, not public/; domain not resolving → DNS propagation, retry in 10 min; D1 binding error → the database_id in wrangler.toml doesn't match 1.2's output.

THEN: reply [james-pack] ACTION: deploy-done DETAIL: live — the next Claude session logs it and the SPAs' send path is canonical.

GATE 2 — Drive tidy (~3 min, optional but tidy)

The connector's transport ceiling kept four binaries off Drive; they're full-fidelity in OneDrive.

• [ ] 2.1 Open OneDrive\James-Cooper-Pack-2026-06-10\ABKC\ and drag into the Drive ABKC folder (https://drive.google.com/drive/folders/1CI_eixXHU4xy-LxW7KeTGSa4M4u9LjGh): ABKC-JAMES-QUESTIONNAIRE-APP-2026-06-10.html, the .docx, the print-copy .pdf, and (if you want them cloud-visible) the walkthrough zip + 2 demo videos.
• [ ] 2.2 Same for Dane-UserGates\ → the Drive "Dane — User Gates" folder (created this morning but still empty — the connector ceiling kept its files out; this drag-drop fills it).
• [ ] 2.3 Delete upload-capability-probe.pdf from the Drive parent folder (it was a connectivity test).

VERIFY: the Drive ABKC folder shows the app .html alongside the README. (Alternative: skip this gate and let the next Claude session run resume-step R2 by slice-upload.)

GATE 3 — Send the pack to James (~5 min)

• [ ] 3.1 Text/email James (bullysupplies@gmail.com) — ready-to-paste:

James — two things to work through when you have time, both self-explanatory:
1) Cooper Print Design (~25–35 min): https://james.cooperluxe.com/print-design/ — answer and tap SEND at the end.
2) ABKC (~60–75 min, two sittings is fine): https://james.cooperluxe.com/abkc/
Everything also lives in this folder (read the START HERE doc first): https://drive.google.com/drive/folders/13q-M7D8fGWRWo29ddj5WasE4cxATFUu9
Start with Print Design — it's shorter and it's the one blocking me. Questions → just text me.

• [ ] 3.2 If Gate 1 isn't done yet, send the Drive link only and tell him to start with the CPD app file in the CooperPrintDesign folder (download → double-click → EXPORT at the end → email back).

VERIFY: James acknowledges receipt (his §"My ask" step 1 from the handoff note).

GATE 4 — One-reply ratification bundle (~2 min)

Three standing proposals collapse into one Telegram reply:

• v4 audience standard (13 seats, consolidated today by the panel session — awaiting you)
• +1 conditional seat from this thread: plain-language / non-technical-stakeholder lens for family/owner intake docs (grounded in the Gemini review catching jargon in the James pack)

• +4 seats proposal from 2026-06-09 (fraud/chargebacks · finance/payment-ops · records-IG · customer-ops) — already folded into the v4 consolidation question

• [ ] 4.1 Reply exactly one of: [james-pack] ACTION: adopt v4 · ACTION: adopt v4+1 · ACTION: edit DETAIL: … · ACTION: reject

VERIFY: next Claude session confirms the standard's Amendments Log was updated to match your verdict. Until then v3 stays canonical — nothing drifts by default.

GATE 5 — ABKC-14 sign-off run (~15 min; inherited from the sibling thread)

• [ ] 5.1 Open ecosystem-abkc\abkc-website\.ai-notes\abkc-payment-walkthrough-2026-05-28\ABKC-PAYMENT-WALKTHROUGH-SINGLE-OWNER-V2-2026-06-09.html in Chrome.
• [ ] 5.2 Run Gates 1→3 with test-fixtures/ (the four stand-in uploads).
• [ ] 5.3 Sign §17, then tell any Claude session "ABKC-14 signed" → it transitions Jira to Done (id 41).
• [ ] 5.4 While you're in Jira mood: "close 18 through 22" ratifies the five documented ADRs (no work attached).

VERIFY: https://kaaterskillsawmill.atlassian.net/browse/ABKC-14 shows Done.

GATE 6 — Joint co-owner session (45 min, after James answers)

• [ ] 6.1 James's questionnaire answer ABKC-D-021 gives you his preferred window — book it.
• [ ] 6.2 Prereqs (his ABKC-V-018 checklist): his own machine, Chrome/Edge non-incognito, live email, phone for SMS, 45 uninterrupted minutes.
• [ ] 6.3 Run ABKC-PAYMENT-WALKTHROUGH-CO-OWNER-V1-2026-06-09.html live together; record step 2.6 (payment before vs after co-signature) — it resolves the documented unknown and unblocks the ABKC-12 automated spec.
• [ ] 6.4 Dual sign-off §17; evidence per its 14-screen manifest.

GATE 7 — ABKC-17 merge decision (conditional)

• [ ] Only if PR #192's 3-dispatch gate shows honestly met (3× green cross-browser runs, first-attempt passes on the 4 target specs) AND no Claude session is mid-flight on it: squash-merge, then say "ABKC-17 merged". As of this artifact it is draft / gate-unmet — the firefox registration flake is a real layout bug (a "Notes" element overlapping controls on Gecko), parked for the Grok/Codex debugging lane. Don't force it.

GATE 8 — Git sweep authorization (~5 min, when trees free)

• [ ] When ecosystem-cooperluxe is off cooperluxe/canonical-backfill-2026-06-07 (your other session's branch): either run resume-step R3 yourself or tell the next Claude session "run R3". It branches claude/james-portal-2026-06-10, commits james-portal/ + the dispatch matrix, pushes, returns to main. (abkc-website + cooperprintdesign need NO sweep — .ai-notes is gitignored there by design; OneDrive/Drive are the durability lane.)

STATUS 2026-06-11 (jolly-turing session): unblocked WITHOUT waiting — Claude commits james-portal/ + the dispatch matrices + the overall-questionnaire registry to branch claude/james-portal-2026-06-10 via an isolated temp-index commit based on origin/main; your other session's checkout and its governance.yaml edit stay untouched. Push receipt (SHA) lands in the close Telegram ping + session plan. Nothing left for you here.

GATE 9 — Portals & required sign-in (v2, corrected 2026-06-11 — ~7 min; domains deferred)

Why v2: v1 assumed cooperluxe.com's DNS lives on Cloudflare. It doesn't — it lives at Wix (ns12/ns13.wixdns.net), and the main cooperluxe.com site runs LIVE on Vercel. Cloudflare's sign-in (Access) can only guard web addresses that are fully managed inside your Cloudflare account, so v1's "attach domains + 3 Access apps" path cannot work today — and the three pretty subdomains don't resolve at all yet. The good news: required sign-in CAN go live in minutes on the portal's real address, with zero DNS risk. (Official-docs receipts in the footer note.)

Every guide still saves progress server-side under each person's name; the admin view at /admin/progress.html?key=YOUR_ADMIN_KEY shows who is doing what, where. The portal's one address for now — per-person doors that remember each person's choice on their device:

• [ ] 9.1 Verify (1 min): open the ?view=james door → only the overall room shows; /overall/, /abkc/, and /admin/progress.html?key=YOUR_ADMIN_KEY all render.
• [ ] 9.2 Turn ON required sign-in (~5 min, one-time):
• Cloudflare dashboard → Workers & Pages → james-cooperluxe → Settings → Enable access policy. Out of the box this guards only the random preview links.
• Cover the REAL address too: Zero Trust → Access → Applications → open the app the toggle just created → Configure → look under Public hostname. If you see a * wildcard, delete it and click Save. If you instead see checkboxes asking which URL types to protect, tick both Production and Preview and click Save. (Cloudflare reworked this screen in Dec 2025 — you'll have one or the other.)
• In the app's policy: Allow → Include → Emails → add bullysupplies@gmail.com, kaaterskillsawmill@gmail.com, plus Melissa's, the office's, and the two co-owners' addresses (whichever you have — the rest can be added any time).
• Login method: Zero Trust → Settings → Authentication → make sure One-time PIN is on (a code by email — nobody needs a password).
• [ ] 9.3 Send Claude the missing addresses (or type them straight into the policy): reply [james-pack] ACTION: emails DETAIL: melissa=…, office=…, owner2=…, owner3=…
• [ ] 9.4 Pretty domains — you opted in on 2026-06-11: the full move is now spec'd as GATE 10 below (investigated same day: Wix needs a support request for the switch; your live site stays up the whole time). Until Gate 10 completes, the ?view= doors above remain canonical — do Gate 9 first either way, since it puts sign-in live today and Gate 10 reuses its policy recipe.

VERIFY: open the portal in a private window → it asks for an email code before showing anything; after signing in, check any box in any guide (then uncheck it — it's just a test) → the bottom-left badge reads "saved ✓ as your@email" (not "unverified"), and your admin dashboard rows show verified identities.

TROUBLE: private window still opens the portal unchallenged → the wildcard-delete (9.2, second bullet) hasn't taken, or only Preview URLs got protected — re-open the Access app and confirm the hostname is exactly james-cooperluxe.pages.dev with no *. Locked yourself out → Zero Trust → Access → Applications → disable/remove the app (everything reverts to link-private; nothing is lost).

GATE 10 — Move cooperluxe.com's DNS to Cloudflare (opted in 2026-06-11 — ~20 min of clicks + one Wix support request + up to 48h wait)

The honest shape of this: Wix will NOT let you change nameservers yourself — Wix's own help pages say NS editing is locked for Wix-registered domains, so only Wix Customer Support can point your domain at Cloudflare (citations in the footer note). So this gate is: one Cloudflare setup pass (~10 min), one Wix support request (~5–10 min chat), then waiting for the switch to land. Your live cooperluxe.com site keeps working the whole time — we replicate its records on Cloudflare BEFORE anything switches, and rollback is just asking Wix to point back. Your domain has no email records, so nothing mail-related can break. Registration + renewal billing stay at Wix (renewal due 2026-09-11).

Do this 2-minute fix TODAY even if Gate 10 waits (defect found during the investigation):

• [ ] 10.0 Your bare cooperluxe.com currently lists THREE addresses: the real Vercel one plus two leftover Google ones (216.239.36.101, 216.239.38.101) that don't answer at all (probed 2026-06-11: connection timeouts) — visitors whose browser picks one of those first get a long hang or an error before the site loads. In Wix: Settings → Domains → cooperluxe.com → Manage DNS → in the A records for the bare domain, delete those two Google addresses (keep 76.76.21.21). If you know of a Google service deliberately wired to the bare domain, tell Claude instead of deleting. VERIFY: cooperluxe.com still loads (it will — the Vercel record stays).

The migration itself:

• [ ] 10.1 Cloudflare dashboard → Add a domain → cooperluxe.com → Free plan. When it imports records, make the list EXACTLY this (delete anything else it scanned):
• A · cooperluxe.com → 76.76.21.21 · grey cloud / "DNS only"
• CNAME · www → cname.vercel-dns.com · grey cloud / "DNS only"
• (no Google A records; nothing else — there are no email records to carry)
  Cloudflare then shows your TWO assigned nameservers (like ada.ns.cloudflare.com / bob.ns.cloudflare.com) — copy them. (Why grey: Vercel officially recommends NOT putting a proxy in front of Vercel; grey = pure address-book change, zero behavior change. If you ever turn the orange cloud on, SSL/TLS must be "Full (strict)" or the site loops.)
• [ ] 10.2 Contact Wix Support (Wix dashboard → Help → Contact → Domains) — paste-ready request:

  Please change the nameservers for cooperluxe.com to <nameserver-1> and <nameserver-2> (Cloudflare), and lift any update lock needed to do that. I'm intentionally moving DNS hosting to Cloudflare; the registration itself stays with Wix.
  Wix quotes up to 48 hours once actioned (usually much faster).

• [ ] 10.3 When the Cloudflare zone shows Active (it emails you): VERIFY cooperluxe.com + www.cooperluxe.com still load normally, then reply [james-pack] ACTION: dns-active.
• [ ] 10.4 Pretty doors (~5 min, only AFTER Active): Workers & Pages → james-cooperluxe → Custom domains → Set up a domain, three times: james.cooperluxe.com, abkc.cooperluxe.com, cpd.cooperluxe.com — Cloudflare auto-creates each DNS record (same account). Domains FIRST, sign-in SECOND — Cloudflare refuses to add a custom domain that already has a sign-in policy on it.
• [ ] 10.5 Sign-in on the pretty doors (~10 min): Zero Trust → Access → Applications → Add application → Self-hosted, three times (same recipe as Gate 9; One-time PIN is already on):
• james.cooperluxe.com — you + James
• abkc.cooperluxe.com — you + James + office + both co-owners
• cpd.cooperluxe.com — you + James + Melissa
• [ ] 10.6 Reply [james-pack] ACTION: domains-done → Claude re-verifies everything live, flips the artifact links to the pretty doors, and wires the identity hardening that needs these apps to exist first (the Codex-flagged JWT check).

OPTIONAL phase 2 — move the registration too (cheaper at-cost renewals at Cloudflare): only possible AFTER the zone is Active on Cloudflare. Wix → Domain Actions → "Transfer away from Wix" (turn OFF private registration first; Wix unlocks the domain + emails the transfer code, valid ~7 days; the move can take up to 8 days; the transfer itself ADDS a year to the expiry — do not renew at Wix right before transferring). With renewal due 2026-09-11, start phase 2 by mid-August if you want it. Reply [james-pack] ACTION: question DETAIL: prepare phase 2 and Claude stages it.

ROLLBACK: ask Wix Support to point the nameservers back to ns12/ns13.wixdns.net — Wix keeps its copy of your records, so everything reverts as-was.

TROUBLE: site down after the switch → the Cloudflare records don't match 10.1 — recheck the two records + grey clouds. Wix refuses the NS change → escalate citing Wix's own "Request: Changing Name Server (NS) Records for a Wix Domain" help page; if they still refuse, the escape hatch is the phase-2 transfer-away flow to a registrar that allows NS edits (the transfer code path is self-service and doesn't require an NS change first) — tell Claude and it preps that runbook.

After the gates: what happens with James's answers

1. Answers land in D1 (one row per questionnaire, re-sends overwrite cleanly). Read anytime: /api/answers?key=YOUR_KEY (add &format=json for raw).
2. Next Claude session (THE ONE PROMPT in the continuation doc) harvests them: policy answers → devtrack.md D-entries + Jira ABKC + the office-manager §9 blanks filled; every "not sure — discuss live" → your joint-session agenda, auto-built.
3. The CPD answers become the launch punch list (preview fixes → Stripe wiring → flip to public on the trigger James chose).

Honest notes

• Gates 1–4 have zero dependencies on each other except 3-wants-1 (live links beat file downloads). Order shown is the recommended order, not a hard chain.
• The two questionnaire apps are code- and smoke-verified; James's first pass is their first human run by design — the offline EXPORT path means nothing he types can be lost even if the live link hiccups.
• This artifact reflects state at ~17:05 ET 2026-06-10; live Jira/PR/Drive state at execution time wins.

Operator: Dane Cooper Date: __ Signature: ______

Authored by Claude Fable 5 at bubbly-goblet close; sibling to CONTINUATION-JAMES-PACK-2026-06-10. Append-only per archive-policy.

Currency verification — 2026-06-10 19:28 EDT (r2): re-verified against the Fable 5 canon (~/.claude/rules/fable-5-workflow-leverage.md) + live receipts by the successor session. Every gate command is model-independent and unchanged; no Fable-side drift since the morning baseline (free-on-Max ends 2026-06-22; Opus 4.8 remains the silent safety fallback). Host CLI now 2.1.172 (was 2.1.170 at authoring; claude --version receipt). No gate content changes required — this runbook is ready to execute as written.

Currency verification — 2026-06-11 (r4, jolly-turing session): Gate 1 closed (Claude deployed; live receipts: landing 200 / whoami 200 / overall 200). Gate 9 rewritten to v2 after a DNS reality-check: cooperluxe.com is on Wix DNS (ns12/ns13.wixdns.net) with the apex LIVE on Vercel — not on Cloudflare as v1 assumed; the three subdomains are NXDOMAIN. Sign-in now rides the Pages project's own address per official Cloudflare procedure — "Enable access policy" + wildcard-delete to cover production pages.dev (receipt: developers.cloudflare.com/pages/platform/known-issues/), self-hosted Access apps require a zone in the account (receipt: …/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/). Per-person ?view= doors shipped on the landing (precedence: explicit param → dedicated hostname → remembered choice → all; ?view=all resets). Custom domains deliberately deferred (a Wix-CNAME shortcut would create sign-in-bypassing side doors; full zone migration is a separate opt-in op touching the live Vercel site). Gate 8 unblocked via isolated-branch commit; watch re-armed as durable scheduled task JamesPortalWatch (every 30 min, D1-lane polling so Access can't break it). Pre-edit copy archived as archived-DANE-GATE-WALKTHROUGH-r3-pre-r4-2026-06-11.md.

Currency addendum — 2026-06-11 later same day (r4.2): Dane opted into the Wix→Cloudflare move; Gate 10 added from a same-day investigation (full receipts: wix-to-cloudflare-migration-receipts-2026-06-11.md, same folder). Load-bearing findings, all cited: Wix locks self-service NS changes on Wix-registered domains — only Wix Support can switch them (support.wix.com "Request: Changing Name Server (NS) Records for a Wix Domain"; corroborated by 2025–26 practitioner reports); the RDAP clientUpdateProhibited lock matches. Vercel officially recommends grey-cloud/DNS-only in front of Vercel (vercel.com KB "Cloudflare with Vercel"; Flexible-SSL proxying causes redirect loops). The apex's two extra Google A records (216.239.36/38.101) are NOT Google's published web-mapping set (…32/34/36/38.21) and answer nothing on probe (connection timeouts 2026-06-11) — vestigial, slated for deletion in 10.0. Pages custom domains auto-create DNS records when the zone is in the same account; domains must attach BEFORE Access apps exist for them (developers.cloudflare.com Pages custom-domains + known-issues). Registrar-transfer phase 2: zone must be Active on Cloudflare first; Wix transfer-out = unlock + EPP via "Transfer away from Wix", up to 8 days; transfers add a year — don't renew immediately prior; expiry 2026-09-11. Codex second-model QA also landed this session: admin attribute-escaping bug FIXED + redeployed; header-trust hardening queued behind Gate 9/10 (needs the Access apps' tags) — disposition: review-disposition-codex-qa-2026-06-11.md.