What problem does it solve? It prevents accidental production deploys and OAuth authentication loops when deploying the Notary-log Cal multi-tenant app to Cloudflare Workers staging, enforcing API-token auth and staging-only wrangler config. ## Core Features & Use Cases - Staging-only deployment guardrails: Mandates wrangler.cal.toml for all deploys and blocks merging feature/cal-multi-tenant to main without explicit user approval. - API-token-first Cloudflare auth: Uses CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID with D1 Edit permissions instead of fragile OAuth flows, with documented anti-loop rules for OAuth fallback. - D1 provisioning and verification: Creates the D1 database, applies the schema, sets webhook secrets, deploys the staging Worker, and runs an 18-check verification script. - Use Case: A user asks the agent to deploy the Cal booking feature to Cloudflare staging; the agent sources the credentials file, runs the staging deploy command, and verifies the live Worker URL without touching production. ## Quick Start Deploy the Notary-log Cal app to Cloudflare Workers staging using the wrangler.cal.toml config and verify the staging URL with the verification script.