Dial Back Paid Legacy Infrastructure After The VM Cutover
Superseded prompt: This prompt predates retirement of the permanent
shared development environment. Treat its stratofusion-dev inventory step
as historical discovery evidence, not as an instruction to preserve or
redeploy a shared development application. Use the shared-development
retirement runbook for current operator actions.
You are working on StratoFusion in C:\code\stratofusion. The production
application has completed its cutover to the self-hosted VM. Reduce every
legacy or duplicated technical dependency that still costs money to run
stratofusion.io to the lowest safe cost, ideally zero, except for the new VM
host and genuinely required production services that have no VM replacement.
This is an infrastructure cost-reduction and legacy-decommissioning task. It
is not permission to break authentication, billing, DNS, provider OAuth,
deployment, disaster recovery, email, or customer access merely to reach a
nominal zero-dollar result. Discover actual invoices and usage before assuming
that a service costs money. Prefer plan downgrades, scale-to-zero, disabled
auto-renewal, reduced retention, and reversible suspension before irreversible
deletion.
Do not stop after producing a plan. Continue through discovery, reversible
cost reduction, verification, documentation, and the agreed observation
window. Pause only at an explicit irreversible-action checkpoint, or when the
operator must log in, complete MFA, approve billing changes, enter a secret,
or make a dashboard decision that cannot be performed safely through the
available tools. Prefer the in-app Browser for external dashboards and let the
operator authenticate where required. Do not use Computer Use.
Use PowerShell, PNPM, and Windows paths locally. Never invoke WSL or bare
bash. Use C:\Program Files\Git\bin\bash.exe explicitly only when a
repository .sh script or POSIX validation requires it. Linux commands are
allowed after connecting to the VM.
Start with read-only discovery. Maintain a concise execution plan and append
timestamped, secret-free evidence to
docs/dependency-cost-reduction-worklog.md. Preserve unrelated local changes.
Before every commit, inspect the worktree and stage only files created or
updated for this task.
Never print or copy complete environment files, database URLs, OAuth tokens,
API keys, webhook signing secrets, passwords, provider credentials, payment
details, invoices containing personal data, or customer data. Verify secrets
only by presence, safe suffix, length, or SHA-256 comparison. Do not put secret
values in the worklog, commit history, command output, screenshots, or chat.
Manual rclone commands default to --dry-run. No provider file deletion,
purge, move, source removal, overwrite, sync deletion, destination cleanup, or
backup pruning is authorized. Infrastructure deletion does not authorize
customer-data deletion. State source, destination, direction, operation type,
flags, and destructive semantics before any manual file operation.
Known Starting State — Revalidate Every Mutable Fact
Treat these as hints, not current truth:
Production VM: 15.204.243.136.
The final closure revision recorded at prompt creation is
e135c4e0a482a11aaf0a19a07a349a932483e74a.
stratofusion.io and www.stratofusion.io resolve to the VM through explicit
A records with TTL 300.
Vercel nameservers remain authoritative for the domain. Therefore Vercel DNS
is still a production dependency even though Vercel compute is no longer the
production application host.
rclone.stratofusion.io, Grafana, GlitchTip, Prometheus, Postgres, Redis,
Weaviate, backup, cron, app, rclone, and Caddy run on the VM.
Production access is open with AUTH_ACCESS_PAUSED=false; the VM scheduler
runs with CRON_REPLICAS=1.
App, rclone, and Postgres were healthy; the rclone queue and active-operation
counts were zero at cutover closure.
Vercel production Cron is disabled. Legacy Vercel deployments, Fly apps,
Neon resources, DNS rollback configuration, and offsite backups were
deliberately preserved through cutover.
The first post-cutover provider write has occurred. DNS-only rollback is no
longer data-safe; any rollback to a legacy application/database requires
explicit database reconciliation.
A final pre-cutover Neon dump, VM database backups, GlitchTip backups, an
additional pre-AI-schema-reconciliation dump, and source-preserving offsite
OneDrive copies were recorded in docs/cutover-phase-c-worklog.md.
The production app still depends on external identity, billing, provider
OAuth/API, domain registration/DNS, source control/registry, and offsite
backup capabilities unless discovery proves otherwise.
Recheck the VM revision, image labels, health, queues, access flag, cron,
public TLS, DNS, CI, backups, and every external service before relying on this
starting state.
Outcome And Definition Of Done
The task is complete only when all of the following are true:
Every recurring or usage-based external technical cost associated with
StratoFusion is inventoried with current plan, recent charge, usage,
owner/account, production purpose, and cancellation consequence.
Every duplicated legacy runtime is stopped, scaled to zero, downgraded, or
placed on a documented removal path without breaking the VM production
stack.
Required services are explicitly retained at the cheapest safe tier, with
a reason they cannot yet be removed.
DNS, TLS, Clerk sign-in, provider OAuth, Stripe webhooks/billing, scheduled
jobs, deployment, backups, monitoring, and restore capability still work.
No active operation, queued job, database write path, DNS record, callback,
secret consumer, or CI workflow still relies on a service that was stopped.
Reversible actions complete an observation period with no regression.
Irreversible deletions are either completed after explicit operator
approval or listed in a precise approval queue with cost, retention date,
backup proof, and rollback consequence.
A before/after monthly cost table, final dependency map, retained-resource
register, deletion register, and residual-risk report are committed.
Do not claim a cost saving from list price. Record the actual billed amount or
label it as an estimate. Do not call a dependency removable merely because the
VM is healthy.
Phase 0 — Establish Safety, Ownership, And A Cost Baseline
Confirm git branch, worktree, remotes, current main SHA, open PRs, and recent
CI/VM deployment status.
Verify VM health, exact image revisions, access open, cron one, zero active
and queued rclone work, no due jobs unexpectedly parked, disk/memory health,
current backups, and public TLS.
Export a secret-free DNS inventory containing A/AAAA, ALIAS/ANAME, CNAME,
MX, TXT, CAA, NS, DKIM, DMARC, OAuth, monitoring, and VM-management-related
names. Query authoritative nameservers plus at least two public resolvers.
Create docs/dependency-cost-reduction-worklog.md with a table containing:
service, account/project, environment, owner, plan, latest actual charge,
billing cadence, recent usage, production function, VM replacement,
dependency consumers, data held, retention requirement, proposed action,
reversibility, approval required, verification, and final state.
Inspect billing/usage dashboards or invoices for at least:
Vercel, Fly.io, Neon, Clerk, GitHub/GHCR/Actions, Google Cloud/Gemini,
Microsoft Azure, Stripe, domain registrar/DNS, email, Sentry or other hosted
error monitoring, uptime/health monitoring, object/offsite backup storage,
Microsoft 365/OneDrive, and any service discovered from environment names,
DNS, workflows, repository integrations, or card statements.
Search the repository and protected VM environment by variable name only
for consumers of every external service. Never print values.
Classify each item as:
KEEP_REQUIRED: active production dependency with no safe replacement.
KEEP_FREE_OR_DOWNGRADE: required but eligible for a cheaper/free tier.
SCALE_TO_ZERO: duplicated runtime that can be stopped reversibly.
REMOVE_AFTER_SOAK: no longer required, but preserve through observation.
REMOVE_AFTER_RETENTION: contains rollback, audit, or backup data.
UNKNOWN: insufficient evidence; do not mutate.
Stop if ownership is unclear, an invoice cannot be tied to the correct project,
or the VM is unhealthy before cost changes begin.
Phase 1 — Build The Live Dependency And Rollback Graph
For every candidate dependency, prove all incoming consumers and outgoing
dependencies. At minimum map:
production browser -> Vercel DNS -> VM Caddy -> app/rclone;
GitHub -> GHCR -> VM deploy workflow -> VM containers;
app -> VM Postgres/Redis/Weaviate/rclone/cron/monitoring;
app -> Clerk, Stripe, Google, Microsoft, Dropbox, email/support services, and
any enabled AI provider;
VM backup -> local protected backup path -> offsite destination;
legacy Vercel -> legacy Neon/Fly and any remaining callbacks or webhooks;
development and Storybook environments -> their actual users and business
need.
Identify whether any Vercel, Fly, or Neon resource still receives traffic,
writes, cron invocations, webhooks, OAuth callbacks, CI deploys, or monitoring
probes. Do not infer zero use from a dashboard graph alone; verify logs,
configuration, DNS, callbacks, and CI.
Produce a proposed action table before mutation. For each action state:
current monthly cost;
expected monthly cost afterward;
reversible action;
irreversible follow-up;
data or artifact retained;
rollback method;
minimum soak/retention period;
exact verification gate;
whether operator confirmation is required.
Phase 2 — Preserve Recovery Evidence Before Cost Reduction
Take a fresh VM application database backup and GlitchTip backup using the
canonical scripts. Validate archives with pg_restore --list without
exposing contents.
Confirm at least one current offsite copy exists and record filename,
timestamp, size, and SHA-256. Do not delete or prune provider data.
Preserve secret-free exports of:
Vercel DNS and project/domain configuration;
Vercel environment variable names and target scopes;
Fly app/machine/volume configuration and secret names;
Neon project/branch/database metadata and migration count;
Google, Microsoft, and Dropbox callback URI inventories;
GitHub environments, workflow variables, secret names, packages, and
retention settings.
Verify the VM can deploy from GitHub/GHCR without Vercel, Fly, or Neon.
Record a recovery matrix: failure, retained artifact, restore target,
operator command/runbook, expected recovery time, and data-loss boundary.
Do not use the legacy Neon database as a rollback source for new VM writes.
Any recovery from it requires reconciliation against the VM source of truth.
Phase 3 — Remove Vercel Runtime Cost Without Breaking DNS
Treat Vercel runtime and Vercel authoritative DNS as separate dependencies.
Inventory the stratofusion-prod, stratofusion-dev, and Storybook projects,
deployments, build minutes, bandwidth, functions, image optimization,
domains, environment scopes, integrations, log drains, and team plan.
Confirm no Vercel Cron schedule exists and no webhook/OAuth callback points
to a vercel.app hostname.
Prevent future unnecessary Vercel builds before deleting deployments. Use a
reversible, documented mechanism that does not disrupt VM CI/deploy.
Decide separately for prod, dev, and Storybook whether to archive, pause,
unlink Git, transfer, downgrade, or delete. Preserve development only if an
identified workflow still requires it.
If Vercel DNS or the Vercel team/account is billed, migrate the entire DNS
zone to a confirmed lower-cost authoritative provider before canceling it:
lower TTLs in advance where practical;
recreate every record, not only apex and www;
retain 15.204.243.136 for apex and www;
preserve MX, SPF, DKIM, DMARC, CAA, verification TXT, OAuth, rclone,
Grafana, GlitchTip, and private-management records as applicable;
update registrar nameservers;
verify authoritative answers and two public resolvers;
verify TLS and application health;
wait beyond the prior NS/record TTL before removing the Vercel zone.
Remove the obsolete Vercel rollback ALIAS only after the new authoritative
zone is proven. Its legacy edge IPs are not active VM origins.
Verify Vercel billing reflects the downgrade/cancellation and that no new
builds or function invocations occur during observation.
Never delete the Vercel project or DNS zone while Vercel nameservers remain
authoritative. Never remove domain verification records without proving they
are obsolete.
Phase 4 — Scale Down And Retire Legacy Fly.io
Enumerate every Fly organization, app, machine, volume, IP, certificate,
secret name, and recent invoice. Distinguish development and production.
Reconfirm VM and Fly active/running/queued operation counts are zero. Check
durable active_operations, parent backup/sync jobs, Fly logs, and machine
state. If any operation exists, stop and reconcile it; do not terminate it
for cost savings.
Confirm production uses https://rclone.stratofusion.io and no app env,
DNS, webhook, monitoring check, or CI workflow still targets a Fly hostname.
Disable future Fly deploy workflows or production triggers without harming
the VM deploy workflow.
Record machine/volume/IP state, then scale or stop machines to the cheapest
reversible state. Observe VM transfers and scheduled jobs through at least
one controlled, source-preserving operator-owned operation.
After the agreed soak and explicit operator approval, release dedicated
paid IPs, remove machines/apps/volumes, revoke Fly-only secrets/tokens, and
remove obsolete certificates/configuration only when no consumer remains.
Verify the Fly invoice/usage projection reaches the expected value.
No rclone provider file operation is needed to delete Fly infrastructure. Do
not delete customer provider data or VM operation history.
Phase 5 — Scale Down And Retire Legacy Neon
Enumerate Neon organizations, projects, branches, compute endpoints,
storage, point-in-time restore retention, data transfer, autoscaling,
integrations, and invoices. Identify dev/test separately from former prod.
Prove every production runtime and job uses VM Compose Postgres. Verify by
safe target identity and connection metadata, never by printing URLs.
Confirm no Vercel deployment, CI workflow, local automation, admin script,
Stripe job, backup, or migration task still writes to Neon.
Create a final read-only Neon archive and validate it. Record migration
count, safe schema inventory, archive size, timestamp, and SHA-256. Label it
as a historical pre-cutover source, not current truth.
Reduce compute/autosuspend/branch retention and storage to the cheapest
reversible configuration first. Do not connect the live VM app back to Neon
during testing.
Preserve the final archive through the agreed legal/operational retention
period. After explicit approval, delete unused branches/endpoints/projects
in dependency order and verify billing stops.
Keep any genuinely used dev database only if its owner, workflow, and cost
are documented; otherwise apply the same backup, scale-down, and approval
process.
Do not restore Neon over the VM database. Do not compare only migration journal
maximum timestamps; retain the cutover worklog's branch-order caveat.
Phase 6 — Right-Size Other External Services
Evaluate these individually. Do not assume they can be removed:
Clerk
Production sign-in depends on Clerk unless architecture has changed.
Confirm active users, monthly active user billing, production and dev
instances, custom domain, social connections, and current plan.
Downgrade or remove unused dev instances/features where safe, but preserve
the production instance, live keys, apex redirects, and required custom
credentials.
Remove temporary vm-staging origins/callbacks only after proving they are no
longer part of the rollback plan. Never remove apex callbacks.
Stripe
Stripe is a required billing/payment processor, not a replaceable VM runtime.
Preserve the live apex webhook, products/prices, customer portal, tax and
payout configuration, subscriptions, and audit history.
Remove obsolete Vercel or staging webhook endpoints only after proving the VM
endpoint receives a harmless verified event with HTTP 200.
Disable optional paid products only when their business consequence is
understood. Transaction fees are not idle infrastructure cost.
GitHub, Actions, And GHCR
Preserve source control, required branch protection, VM deploy credentials,
and current/rollback container images.
Reduce duplicate workflows, unnecessary Vercel/Fly deploy triggers, artifact
retention, cache retention, and stale package versions only after confirming
rollback needs.
Never delete the image currently running on the VM or the designated rollback
image. Verify package and Actions billing after changes.
Google Cloud, Gemini, Microsoft Azure, And Dropbox
Preserve production OAuth apps, consent configuration, apex callbacks, and
provider API access.
AI search/indexing is currently disabled; determine whether Gemini or other
AI billing can be disabled without deleting a Google project shared with
OAuth clients. Revoke an AI key only after proving no enabled VM feature uses
it and after explicit approval.
Remove temporary vm-staging callbacks only after rollback policy permits.
Do not rotate the Dropbox client secret in this task unless separately
authorized; preserve the documented cutover exception without calling it a
rotation.
Monitoring, Email, Domain, And Backups
Prefer the self-hosted VM Grafana, Prometheus, and GlitchTip stack where it
already provides the required capability.
Cancel hosted Sentry, uptime, log, or health services only after proving they
are unused and the VM replacement alerts the operator successfully.
Keep domain registration and working authoritative DNS. A domain renewal is
a required production cost, not a removable legacy dependency.
Preserve production email/MX and support delivery. Do not cancel Microsoft
365, email, or OneDrive solely because OneDrive also stores backups; identify
all business uses and an approved replacement first.
Keep at least one tested offsite backup destination. VM-local backups alone
are not disaster recovery.
For every retained paid service, document why it is required, the cheapest safe
tier, current owner, renewal date, and a future exit condition.
Phase 7 — Remove Obsolete Configuration And Secret Consumers
Only after runtime reductions are proven:
Remove obsolete Vercel/Fly/Neon URLs, deployment triggers, callbacks,
monitors, docs, and environment variable names from active configuration.
Revoke service-specific deploy tokens and API secrets after their final
consumer is gone. Verify by inventory/hash only; never print values.
Preserve provider OAuth secrets, Clerk keys, Stripe secrets, GitHub VM deploy
credentials, backup credentials, and VM runtime secrets still in use.
Remove temporary staging callbacks only when apex OAuth for Google,
Microsoft, Dropbox, and Clerk has been reverified.
Keep historical cutover evidence intact. Mark superseded instructions as
historical rather than rewriting evidence to imply resources never existed.
Use focused tests for any code/config behavior change. Run at minimum
pnpm env:guard, pnpm cutover:validate, relevant deployment/OAuth/cron tests,
TypeScript where code changes, lint for changed TypeScript, and
git diff --check.
Phase 8 — Verification And Observation
After reversible cost reductions, verify:
authoritative and public DNS for apex, www, rclone, monitoring, email, and
all required verification records;
valid TLS and HTTP health for apex, www, rclone, Grafana, and GlitchTip;
Clerk sign-in/sign-up and an existing authenticated session;
live Google Drive, OneDrive, and Dropbox listing for operator-owned accounts;
a small source-preserving rclone-backed fixture operation with source,
destination, direction, and flags stated in advance;
Stripe live webhook delivery using a harmless existing/test event;
two clean cron cycles plus the five-minute disabled-AI reconciliation no-op;
GitHub main CI, GHCR image availability, and exact-SHA VM deployment;
current VM backup plus offsite backup and documented restore path;
zero calls, builds, writes, callbacks, or monitors hitting retired resources;
clean app/rclone/cron logs, zero unexpected queues, healthy resources, and no
new GlitchTip production error.
Observe the reversible state for at least one full hour with checks no more than
60 seconds apart. For resources containing the only convenient rollback copy,
use a longer retention period—normally at least seven days—before irreversible
deletion unless the operator explicitly chooses a shorter period after seeing
the backup and rollback consequences.
If any regression occurs, restore the last reversible configuration, stop
further decommissioning, record evidence, and ask the operator before taking a
materially different recovery action.
Explicit Irreversible-Action Checkpoint
Reversible cost reduction is authorized by this prompt when every service gate
passes. Before any of the following, present one concise approval table and ask
the operator for explicit confirmation:
deleting a Vercel project, team, or authoritative DNS zone;
releasing a production domain or required DNS record;
deleting a Fly app, volume, paid IP, certificate, or organization;
deleting a Neon project, branch, database, or point-in-time history;
canceling Clerk, email, domain, backup, monitoring, GitHub, Microsoft 365, or
another account-level subscription;
revoking a credential whose remaining consumers are not conclusively zero;
deleting the last verified backup or designated rollback image;
disabling Google Cloud billing or deleting a project shared by OAuth;
deleting customer, billing, identity, provider, or audit data.
The approval request must state resource identity, actual/estimated saving,
data destroyed, retained backup, restore method, dependency proof, rollback
loss, and whether the action is reversible. Silence is not approval.
Required Deliverables
Produce and commit:
docs/dependency-cost-reduction-worklog.md with timestamped evidence and no
secrets or customer data.
A before/after cost table showing actual recent monthly cost, expected new
cost, realized saving, and confidence/source.
A final dependency register containing KEEP_REQUIRED,
KEEP_FREE_OR_DOWNGRADE, retired, retention-pending, and unknown resources.
A DNS and callback register proving all active production routes target the
VM or an explicitly retained external service.
A backup/restore and rollback matrix reflecting that the VM database is the
current source of truth.
An irreversible-action approval queue with retention dates where needed.
Canonical docs and relevant AI skills updated to reflect the post-Fly,
post-Vercel-runtime, and post-Neon architecture actually achieved.
A final report containing:
resources stopped, downgraded, removed, retained, or awaiting approval;
actual and projected monthly savings;
final VM SHA and service health;
CI/tests and manual proofs;
remaining paid dependencies and why they remain;
residual risks, expiry/retention dates, and operator follow-ups.
Do not claim that billing is canceled until the provider dashboard or invoice
shows the resulting plan/state. Do not claim complete dependency removal while
DNS, callbacks, CI, secrets, or traffic still reference the service.