# Dial Back Paid Legacy Infrastructure After The VM Cutover > **Superseded prompt:** This prompt predates retirement of the permanent > shared development environment. Treat its `stratofusion-dev` inventory step > as historical discovery evidence, not as an instruction to preserve or > redeploy a shared development application. Use the shared-development > retirement runbook for current operator actions. You are working on StratoFusion in `C:\code\stratofusion`. The production application has completed its cutover to the self-hosted VM. Reduce every legacy or duplicated technical dependency that still costs money to run `stratofusion.io` to the lowest safe cost, ideally zero, except for the new VM host and genuinely required production services that have no VM replacement. This is an infrastructure cost-reduction and legacy-decommissioning task. It is not permission to break authentication, billing, DNS, provider OAuth, deployment, disaster recovery, email, or customer access merely to reach a nominal zero-dollar result. Discover actual invoices and usage before assuming that a service costs money. Prefer plan downgrades, scale-to-zero, disabled auto-renewal, reduced retention, and reversible suspension before irreversible deletion. Do not stop after producing a plan. Continue through discovery, reversible cost reduction, verification, documentation, and the agreed observation window. Pause only at an explicit irreversible-action checkpoint, or when the operator must log in, complete MFA, approve billing changes, enter a secret, or make a dashboard decision that cannot be performed safely through the available tools. Prefer the in-app Browser for external dashboards and let the operator authenticate where required. Do not use Computer Use. ## Required Context And Operating Rules Before making changes, read completely: - `AGENTS.md` - `README.md` - `public/docs/developer/AI_OPERATING_PROTOCOL.md` - `docs/ai-skills/INDEX.md` - `docs/ai-skills/01-architecture.md` - `docs/ai-skills/03-rclone-data-plane.md` - `docs/ai-skills/08-testing.md` - `docs/ai-skills/09-authentication-oauth.md` - `docs/ai-skills/11-deployment.md` - `docs/ai-skills/15-ai-agent-prompts.md` - `docs/cutover-phase-c-worklog.md` - `public/docs/DEPLOYMENT.md` - `public/docs/RCLONE_SERVICE.md` - `public/docs/operations/CLERK_OAUTH_MULTI_ENVIRONMENT_SETUP.md` - `public/docs/operations/VM_ADMIN_ACCESS.md` - `deploy/docker-compose.prod.yml` - `deploy/deploy.sh` - `deploy/backup/backup.sh` - `.github/workflows/ci.yml` - `.github/workflows/deploy.yml` - `.github/workflows/fly-rclone-deploy.yml` - `vercel.json` Use PowerShell, PNPM, and Windows paths locally. Never invoke WSL or bare `bash`. Use `C:\Program Files\Git\bin\bash.exe` explicitly only when a repository `.sh` script or POSIX validation requires it. Linux commands are allowed after connecting to the VM. Start with read-only discovery. Maintain a concise execution plan and append timestamped, secret-free evidence to `docs/dependency-cost-reduction-worklog.md`. Preserve unrelated local changes. Before every commit, inspect the worktree and stage only files created or updated for this task. Never print or copy complete environment files, database URLs, OAuth tokens, API keys, webhook signing secrets, passwords, provider credentials, payment details, invoices containing personal data, or customer data. Verify secrets only by presence, safe suffix, length, or SHA-256 comparison. Do not put secret values in the worklog, commit history, command output, screenshots, or chat. Manual rclone commands default to `--dry-run`. No provider file deletion, purge, move, source removal, overwrite, sync deletion, destination cleanup, or backup pruning is authorized. Infrastructure deletion does not authorize customer-data deletion. State source, destination, direction, operation type, flags, and destructive semantics before any manual file operation. ## Known Starting State — Revalidate Every Mutable Fact Treat these as hints, not current truth: - Production VM: `15.204.243.136`. - The final closure revision recorded at prompt creation is `e135c4e0a482a11aaf0a19a07a349a932483e74a`. - `stratofusion.io` and `www.stratofusion.io` resolve to the VM through explicit A records with TTL 300. - Vercel nameservers remain authoritative for the domain. Therefore Vercel DNS is still a production dependency even though Vercel compute is no longer the production application host. - `rclone.stratofusion.io`, Grafana, GlitchTip, Prometheus, Postgres, Redis, Weaviate, backup, cron, app, rclone, and Caddy run on the VM. - Production access is open with `AUTH_ACCESS_PAUSED=false`; the VM scheduler runs with `CRON_REPLICAS=1`. - App, rclone, and Postgres were healthy; the rclone queue and active-operation counts were zero at cutover closure. - Vercel production Cron is disabled. Legacy Vercel deployments, Fly apps, Neon resources, DNS rollback configuration, and offsite backups were deliberately preserved through cutover. - The first post-cutover provider write has occurred. DNS-only rollback is no longer data-safe; any rollback to a legacy application/database requires explicit database reconciliation. - A final pre-cutover Neon dump, VM database backups, GlitchTip backups, an additional pre-AI-schema-reconciliation dump, and source-preserving offsite OneDrive copies were recorded in `docs/cutover-phase-c-worklog.md`. - The production app still depends on external identity, billing, provider OAuth/API, domain registration/DNS, source control/registry, and offsite backup capabilities unless discovery proves otherwise. Recheck the VM revision, image labels, health, queues, access flag, cron, public TLS, DNS, CI, backups, and every external service before relying on this starting state. ## Outcome And Definition Of Done The task is complete only when all of the following are true: 1. Every recurring or usage-based external technical cost associated with StratoFusion is inventoried with current plan, recent charge, usage, owner/account, production purpose, and cancellation consequence. 2. Every duplicated legacy runtime is stopped, scaled to zero, downgraded, or placed on a documented removal path without breaking the VM production stack. 3. Required services are explicitly retained at the cheapest safe tier, with a reason they cannot yet be removed. 4. DNS, TLS, Clerk sign-in, provider OAuth, Stripe webhooks/billing, scheduled jobs, deployment, backups, monitoring, and restore capability still work. 5. No active operation, queued job, database write path, DNS record, callback, secret consumer, or CI workflow still relies on a service that was stopped. 6. Reversible actions complete an observation period with no regression. 7. Irreversible deletions are either completed after explicit operator approval or listed in a precise approval queue with cost, retention date, backup proof, and rollback consequence. 8. A before/after monthly cost table, final dependency map, retained-resource register, deletion register, and residual-risk report are committed. Do not claim a cost saving from list price. Record the actual billed amount or label it as an estimate. Do not call a dependency removable merely because the VM is healthy. ## Phase 0 — Establish Safety, Ownership, And A Cost Baseline 1. Confirm git branch, worktree, remotes, current main SHA, open PRs, and recent CI/VM deployment status. 2. Verify VM health, exact image revisions, access open, cron one, zero active and queued rclone work, no due jobs unexpectedly parked, disk/memory health, current backups, and public TLS. 3. Export a secret-free DNS inventory containing A/AAAA, ALIAS/ANAME, CNAME, MX, TXT, CAA, NS, DKIM, DMARC, OAuth, monitoring, and VM-management-related names. Query authoritative nameservers plus at least two public resolvers. 4. Create `docs/dependency-cost-reduction-worklog.md` with a table containing: service, account/project, environment, owner, plan, latest actual charge, billing cadence, recent usage, production function, VM replacement, dependency consumers, data held, retention requirement, proposed action, reversibility, approval required, verification, and final state. 5. Inspect billing/usage dashboards or invoices for at least: Vercel, Fly.io, Neon, Clerk, GitHub/GHCR/Actions, Google Cloud/Gemini, Microsoft Azure, Stripe, domain registrar/DNS, email, Sentry or other hosted error monitoring, uptime/health monitoring, object/offsite backup storage, Microsoft 365/OneDrive, and any service discovered from environment names, DNS, workflows, repository integrations, or card statements. 6. Search the repository and protected VM environment by variable **name only** for consumers of every external service. Never print values. 7. Classify each item as: - `KEEP_REQUIRED`: active production dependency with no safe replacement. - `KEEP_FREE_OR_DOWNGRADE`: required but eligible for a cheaper/free tier. - `SCALE_TO_ZERO`: duplicated runtime that can be stopped reversibly. - `REMOVE_AFTER_SOAK`: no longer required, but preserve through observation. - `REMOVE_AFTER_RETENTION`: contains rollback, audit, or backup data. - `UNKNOWN`: insufficient evidence; do not mutate. Stop if ownership is unclear, an invoice cannot be tied to the correct project, or the VM is unhealthy before cost changes begin. ## Phase 1 — Build The Live Dependency And Rollback Graph For every candidate dependency, prove all incoming consumers and outgoing dependencies. At minimum map: - production browser -> Vercel DNS -> VM Caddy -> app/rclone; - GitHub -> GHCR -> VM deploy workflow -> VM containers; - app -> VM Postgres/Redis/Weaviate/rclone/cron/monitoring; - app -> Clerk, Stripe, Google, Microsoft, Dropbox, email/support services, and any enabled AI provider; - VM backup -> local protected backup path -> offsite destination; - monitoring/alerts -> operator notification destination; - legacy Vercel -> legacy Neon/Fly and any remaining callbacks or webhooks; - development and Storybook environments -> their actual users and business need. Identify whether any Vercel, Fly, or Neon resource still receives traffic, writes, cron invocations, webhooks, OAuth callbacks, CI deploys, or monitoring probes. Do not infer zero use from a dashboard graph alone; verify logs, configuration, DNS, callbacks, and CI. Produce a proposed action table before mutation. For each action state: - current monthly cost; - expected monthly cost afterward; - reversible action; - irreversible follow-up; - data or artifact retained; - rollback method; - minimum soak/retention period; - exact verification gate; - whether operator confirmation is required. ## Phase 2 — Preserve Recovery Evidence Before Cost Reduction 1. Take a fresh VM application database backup and GlitchTip backup using the canonical scripts. Validate archives with `pg_restore --list` without exposing contents. 2. Confirm at least one current offsite copy exists and record filename, timestamp, size, and SHA-256. Do not delete or prune provider data. 3. Preserve secret-free exports of: - Vercel DNS and project/domain configuration; - Vercel environment variable **names** and target scopes; - Fly app/machine/volume configuration and secret **names**; - Neon project/branch/database metadata and migration count; - Clerk instance/domain/social-connection configuration; - Stripe webhook endpoint/event-destination configuration; - Google, Microsoft, and Dropbox callback URI inventories; - GitHub environments, workflow variables, secret **names**, packages, and retention settings. 4. Verify the VM can deploy from GitHub/GHCR without Vercel, Fly, or Neon. 5. Record a recovery matrix: failure, retained artifact, restore target, operator command/runbook, expected recovery time, and data-loss boundary. Do not use the legacy Neon database as a rollback source for new VM writes. Any recovery from it requires reconciliation against the VM source of truth. ## Phase 3 — Remove Vercel Runtime Cost Without Breaking DNS Treat Vercel runtime and Vercel authoritative DNS as separate dependencies. 1. Inventory the `stratofusion-prod`, `stratofusion-dev`, and Storybook projects, deployments, build minutes, bandwidth, functions, image optimization, domains, environment scopes, integrations, log drains, and team plan. 2. Confirm no Vercel Cron schedule exists and no webhook/OAuth callback points to a `vercel.app` hostname. 3. Prevent future unnecessary Vercel builds before deleting deployments. Use a reversible, documented mechanism that does not disrupt VM CI/deploy. 4. Decide separately for prod, dev, and Storybook whether to archive, pause, unlink Git, transfer, downgrade, or delete. Preserve development only if an identified workflow still requires it. 5. If Vercel DNS or the Vercel team/account is billed, migrate the **entire** DNS zone to a confirmed lower-cost authoritative provider before canceling it: - lower TTLs in advance where practical; - recreate every record, not only apex and `www`; - retain `15.204.243.136` for apex and `www`; - preserve MX, SPF, DKIM, DMARC, CAA, verification TXT, OAuth, rclone, Grafana, GlitchTip, and private-management records as applicable; - update registrar nameservers; - verify authoritative answers and two public resolvers; - verify TLS and application health; - wait beyond the prior NS/record TTL before removing the Vercel zone. 6. Remove the obsolete Vercel rollback ALIAS only after the new authoritative zone is proven. Its legacy edge IPs are not active VM origins. 7. Verify Vercel billing reflects the downgrade/cancellation and that no new builds or function invocations occur during observation. Never delete the Vercel project or DNS zone while Vercel nameservers remain authoritative. Never remove domain verification records without proving they are obsolete. ## Phase 4 — Scale Down And Retire Legacy Fly.io 1. Enumerate every Fly organization, app, machine, volume, IP, certificate, secret name, and recent invoice. Distinguish development and production. 2. Reconfirm VM and Fly active/running/queued operation counts are zero. Check durable `active_operations`, parent backup/sync jobs, Fly logs, and machine state. If any operation exists, stop and reconcile it; do not terminate it for cost savings. 3. Confirm production uses `https://rclone.stratofusion.io` and no app env, DNS, webhook, monitoring check, or CI workflow still targets a Fly hostname. 4. Disable future Fly deploy workflows or production triggers without harming the VM deploy workflow. 5. Record machine/volume/IP state, then scale or stop machines to the cheapest reversible state. Observe VM transfers and scheduled jobs through at least one controlled, source-preserving operator-owned operation. 6. After the agreed soak and explicit operator approval, release dedicated paid IPs, remove machines/apps/volumes, revoke Fly-only secrets/tokens, and remove obsolete certificates/configuration only when no consumer remains. 7. Verify the Fly invoice/usage projection reaches the expected value. No rclone provider file operation is needed to delete Fly infrastructure. Do not delete customer provider data or VM operation history. ## Phase 5 — Scale Down And Retire Legacy Neon 1. Enumerate Neon organizations, projects, branches, compute endpoints, storage, point-in-time restore retention, data transfer, autoscaling, integrations, and invoices. Identify dev/test separately from former prod. 2. Prove every production runtime and job uses VM Compose Postgres. Verify by safe target identity and connection metadata, never by printing URLs. 3. Confirm no Vercel deployment, CI workflow, local automation, admin script, Stripe job, backup, or migration task still writes to Neon. 4. Create a final **read-only** Neon archive and validate it. Record migration count, safe schema inventory, archive size, timestamp, and SHA-256. Label it as a historical pre-cutover source, not current truth. 5. Reduce compute/autosuspend/branch retention and storage to the cheapest reversible configuration first. Do not connect the live VM app back to Neon during testing. 6. Preserve the final archive through the agreed legal/operational retention period. After explicit approval, delete unused branches/endpoints/projects in dependency order and verify billing stops. 7. Keep any genuinely used dev database only if its owner, workflow, and cost are documented; otherwise apply the same backup, scale-down, and approval process. Do not restore Neon over the VM database. Do not compare only migration journal maximum timestamps; retain the cutover worklog's branch-order caveat. ## Phase 6 — Right-Size Other External Services Evaluate these individually. Do not assume they can be removed: ### Clerk - Production sign-in depends on Clerk unless architecture has changed. - Confirm active users, monthly active user billing, production and dev instances, custom domain, social connections, and current plan. - Downgrade or remove unused dev instances/features where safe, but preserve the production instance, live keys, apex redirects, and required custom credentials. - Remove temporary `vm-staging` origins/callbacks only after proving they are no longer part of the rollback plan. Never remove apex callbacks. ### Stripe - Stripe is a required billing/payment processor, not a replaceable VM runtime. - Preserve the live apex webhook, products/prices, customer portal, tax and payout configuration, subscriptions, and audit history. - Remove obsolete Vercel or staging webhook endpoints only after proving the VM endpoint receives a harmless verified event with HTTP 200. - Disable optional paid products only when their business consequence is understood. Transaction fees are not idle infrastructure cost. ### GitHub, Actions, And GHCR - Preserve source control, required branch protection, VM deploy credentials, and current/rollback container images. - Reduce duplicate workflows, unnecessary Vercel/Fly deploy triggers, artifact retention, cache retention, and stale package versions only after confirming rollback needs. - Never delete the image currently running on the VM or the designated rollback image. Verify package and Actions billing after changes. ### Google Cloud, Gemini, Microsoft Azure, And Dropbox - Preserve production OAuth apps, consent configuration, apex callbacks, and provider API access. - AI search/indexing is currently disabled; determine whether Gemini or other AI billing can be disabled without deleting a Google project shared with OAuth clients. Revoke an AI key only after proving no enabled VM feature uses it and after explicit approval. - Remove temporary `vm-staging` callbacks only after rollback policy permits. - Do not rotate the Dropbox client secret in this task unless separately authorized; preserve the documented cutover exception without calling it a rotation. ### Monitoring, Email, Domain, And Backups - Prefer the self-hosted VM Grafana, Prometheus, and GlitchTip stack where it already provides the required capability. - Cancel hosted Sentry, uptime, log, or health services only after proving they are unused and the VM replacement alerts the operator successfully. - Keep domain registration and working authoritative DNS. A domain renewal is a required production cost, not a removable legacy dependency. - Preserve production email/MX and support delivery. Do not cancel Microsoft 365, email, or OneDrive solely because OneDrive also stores backups; identify all business uses and an approved replacement first. - Keep at least one tested offsite backup destination. VM-local backups alone are not disaster recovery. For every retained paid service, document why it is required, the cheapest safe tier, current owner, renewal date, and a future exit condition. ## Phase 7 — Remove Obsolete Configuration And Secret Consumers Only after runtime reductions are proven: 1. Remove obsolete Vercel/Fly/Neon URLs, deployment triggers, callbacks, monitors, docs, and environment variable names from active configuration. 2. Revoke service-specific deploy tokens and API secrets after their final consumer is gone. Verify by inventory/hash only; never print values. 3. Preserve provider OAuth secrets, Clerk keys, Stripe secrets, GitHub VM deploy credentials, backup credentials, and VM runtime secrets still in use. 4. Remove temporary staging callbacks only when apex OAuth for Google, Microsoft, Dropbox, and Clerk has been reverified. 5. Update canonical documentation: - deployment/environment changes -> `public/docs/DEPLOYMENT.md`; - architecture/dependency changes -> `public/docs/ARCHITECTURE.md`; - rclone/Fly retirement -> `public/docs/RCLONE_SERVICE.md`; - OAuth callback cleanup -> `public/docs/operations/CLERK_OAUTH_MULTI_ENVIRONMENT_SETUP.md`; - testing/verification changes -> `public/docs/TESTING.md`; - repo-local operating knowledge -> relevant `docs/ai-skills/*.md`. 6. Keep historical cutover evidence intact. Mark superseded instructions as historical rather than rewriting evidence to imply resources never existed. Use focused tests for any code/config behavior change. Run at minimum `pnpm env:guard`, `pnpm cutover:validate`, relevant deployment/OAuth/cron tests, TypeScript where code changes, lint for changed TypeScript, and `git diff --check`. ## Phase 8 — Verification And Observation After reversible cost reductions, verify: - authoritative and public DNS for apex, `www`, rclone, monitoring, email, and all required verification records; - valid TLS and HTTP health for apex, `www`, rclone, Grafana, and GlitchTip; - Clerk sign-in/sign-up and an existing authenticated session; - live Google Drive, OneDrive, and Dropbox listing for operator-owned accounts; - a small source-preserving rclone-backed fixture operation with source, destination, direction, and flags stated in advance; - Stripe live webhook delivery using a harmless existing/test event; - two clean cron cycles plus the five-minute disabled-AI reconciliation no-op; - GitHub main CI, GHCR image availability, and exact-SHA VM deployment; - current VM backup plus offsite backup and documented restore path; - zero calls, builds, writes, callbacks, or monitors hitting retired resources; - clean app/rclone/cron logs, zero unexpected queues, healthy resources, and no new GlitchTip production error. Observe the reversible state for at least one full hour with checks no more than 60 seconds apart. For resources containing the only convenient rollback copy, use a longer retention period—normally at least seven days—before irreversible deletion unless the operator explicitly chooses a shorter period after seeing the backup and rollback consequences. If any regression occurs, restore the last reversible configuration, stop further decommissioning, record evidence, and ask the operator before taking a materially different recovery action. ## Explicit Irreversible-Action Checkpoint Reversible cost reduction is authorized by this prompt when every service gate passes. Before any of the following, present one concise approval table and ask the operator for explicit confirmation: - deleting a Vercel project, team, or authoritative DNS zone; - releasing a production domain or required DNS record; - deleting a Fly app, volume, paid IP, certificate, or organization; - deleting a Neon project, branch, database, or point-in-time history; - canceling Clerk, email, domain, backup, monitoring, GitHub, Microsoft 365, or another account-level subscription; - revoking a credential whose remaining consumers are not conclusively zero; - deleting the last verified backup or designated rollback image; - disabling Google Cloud billing or deleting a project shared by OAuth; - deleting customer, billing, identity, provider, or audit data. The approval request must state resource identity, actual/estimated saving, data destroyed, retained backup, restore method, dependency proof, rollback loss, and whether the action is reversible. Silence is not approval. ## Required Deliverables Produce and commit: 1. `docs/dependency-cost-reduction-worklog.md` with timestamped evidence and no secrets or customer data. 2. A before/after cost table showing actual recent monthly cost, expected new cost, realized saving, and confidence/source. 3. A final dependency register containing `KEEP_REQUIRED`, `KEEP_FREE_OR_DOWNGRADE`, retired, retention-pending, and unknown resources. 4. A DNS and callback register proving all active production routes target the VM or an explicitly retained external service. 5. A backup/restore and rollback matrix reflecting that the VM database is the current source of truth. 6. An irreversible-action approval queue with retention dates where needed. 7. Canonical docs and relevant AI skills updated to reflect the post-Fly, post-Vercel-runtime, and post-Neon architecture actually achieved. 8. A final report containing: - resources stopped, downgraded, removed, retained, or awaiting approval; - actual and projected monthly savings; - final VM SHA and service health; - CI/tests and manual proofs; - remaining paid dependencies and why they remain; - residual risks, expiry/retention dates, and operator follow-ups. Do not claim that billing is canceled until the provider dashboard or invoice shows the resulting plan/state. Do not claim complete dependency removal while DNS, callbacks, CI, secrets, or traffic still reference the service.