Phase 5 — FIN Central Intranet Bootstrap Runbook

Date: 2026-05-15 Status: Draft v0.1 (ready to execute after Phases 1-4 of demarcation) Related: docs/runbooks/PHASE_1_DEMARCATION_PROVISIONING_RUNBOOK_2026-05-15.md, docs/architecture/FIN_CENTRAL_TENANT_DEMARCATION_PLAN_2026-05-15.md Time budget: 4-8 hours for first stand-up Outcome: intranet.fin.app serves a Quartz-rendered FIN Central intranet behind Cloudflare Access, accessible to Rob + Josh + Jake (full) and Alex (scoped). Initial content seeded from existing canonical docs.

0. Pre-Flight

Confirm completed:

Phase 1 provisioning done (fin-central-prod Neon, fin-central CF Worker, fin-central-intranet GitHub repo)
Phase 2 code demarcation done (DEPLOYMENT_ROLE wiring active)
Phase 4 Taproot sync working (or at least the vault-webhook receiver is wired)

If Phases 2-4 aren’t complete, you can still bootstrap the static intranet now — Quartz doesn’t require the Worker pipeline to serve markdown. This runbook is staged so it can run partially.

1. Quartz Setup (1-2 hours)

Quartz is the v1 renderer. It’s a static-site generator for Obsidian-style markdown vaults. It produces a navigable, graph-view- enabled site from a folder of markdown files.

1.1 Clone Quartz

In a new workspace folder (not inside fin-agentic):

# Anywhere outside fin-agentic
cd ~/Projects/FIN/_03_Dev/
git clone https://github.com/jackyzha0/quartz.git fin-central-intranet-render
cd fin-central-intranet-render
npm install

1.2 Configure Quartz for FIN Central

Edit quartz.config.ts:

const config: QuartzConfig = {
  configuration: {
    pageTitle: "FIN Central — Food Intelligence Inc.",
    enableSPA: true,
    enablePopovers: true,
    analytics: null, // no third-party trackers in v1
    locale: "en-US",
    baseUrl: "intranet.fin.app",
    ignorePatterns: ["private", "templates", ".obsidian"],
    defaultDateType: "modified",
    theme: {
      fontOrigin: "googleFonts",
      cdnCaching: true,
      typography: {
        header: "Schibsted Grotesk",
        body: "Source Sans Pro",
        code: "IBM Plex Mono",
      },
      colors: {
        lightMode: {
          light: "#faf8f8",
          lightgray: "#e5e5e5",
          gray: "#b8b8b8",
          darkgray: "#4e4e4e",
          dark: "#2b2b2b",
          secondary: "#284b63",
          tertiary: "#84a59d",
          highlight: "rgba(143, 159, 169, 0.15)",
        },
        darkMode: { /* match */ },
      },
    },
  },
  plugins: {
    transformers: [
      Plugin.FrontMatter(),
      Plugin.CreatedModifiedDate({ priority: ["frontmatter", "filesystem"] }),
      Plugin.SyntaxHighlighting({ theme: { light: "github-light", dark: "github-dark" } }),
      Plugin.ObsidianFlavoredMarkdown({ enableInHtmlEmbed: false }),
      Plugin.GitHubFlavoredMarkdown(),
      Plugin.TableOfContents(),
      Plugin.CrawlLinks({ markdownLinkResolution: "shortest" }),
      Plugin.Description(),
    ],
    filters: [Plugin.RemoveDrafts(), Plugin.ExplicitPublish()],
    emitters: [
      Plugin.AliasRedirects(),
      Plugin.ComponentResources(),
      Plugin.ContentPage(),
      Plugin.FolderPage(),
      Plugin.TagPage(),
      Plugin.ContentIndex({ enableSiteMap: true, enableRSS: true }),
      Plugin.Assets(),
      Plugin.Static(),
      Plugin.NotFoundPage(),
    ],
  },
};

1.3 Point at the FIN Central vault

Quartz expects the vault at content/. Symlink or copy:

# Option A: symlink to the cloned vault
cd fin-central-intranet-render
rm -rf content
ln -s ../fin-central-intranet content
 
# Option B: subtree pull (preferred for production)
# Don't do option B until you've validated locally

1.4 Local test build

npx quartz build --serve
# Open http://localhost:8080 in your browser

You should see the FIN Central vault folder structure as a site. If content is empty (only .gitkeep files), the site will show empty folders. That’s expected pre-seeding.

1.5 Adjust look-and-feel

A few minutes spent on:

Replace default Quartz logo with FIN brand mark (drop into quartz/static/)
Set the homepage to a index.md in your vault (otherwise Quartz shows a default landing)
Confirm dark/light mode toggle works
Confirm graph view is enabled and renders

2. Content Seeding (1-2 hours)

The FIN Central vault starts empty. Seed it with existing canonical docs and an entry-point index.md.

2.1 Create root index.md

---
title: FIN Central
description: Internal control plane of the Food Intelligence platform
---
 
# FIN Central
 
The internal intranet of Food Intelligence Inc. This site is the
control plane that operates FIN's multi-tenant produce intelligence
platform. It is the company's canonical documentation, decision log,
projection catalog, and partner communication surface.
 
## Quick Navigation
 
- [Decisions](./decisions/) — architectural and strategic decisions
- [Design](./design/) — design docs for the platform
- [Planning](./planning/) — GTM, strategy, fundraising
- [Proof](./proof/) — Nathel proof ledger, federal evidence
- [Runbooks](./runbooks/) — operational runbooks
- [Reference](./reference/) — glossary, founder bio, conventions
- [Canon](./canon/) — FIN-as-Tenant-Zero entity profiles
 
## Recent Updates
 
(Generated by the doc ingest pipeline; updates as docs change.)
 
## How To Use This Site
 
- All content is Obsidian-compatible markdown
- Wikilinks resolve to other pages: `[[design/some-doc]]`
- Citations are visible on every page
- Source attribution is preserved through the projection pipeline
- Edit content via Pull Request to the `fin-central-intranet` GitHub
  repo

2.2 Copy existing canonical docs

Copy (or symlink, then later sever) the canonical docs from fin-agentic/docs/ into fin-central-intranet/:

cd ~/Projects/FIN/_03_Dev/fin-central-intranet
 
# Copy reference content
cp ../fin-agentic/docs/reference/FIN_FOUNDER_BIO_2026-05-15.md reference/founder-bio.md
 
# Copy strategic docs
cp ../fin-agentic/docs/product/FIN_PRODUCT_TIER_ARCHITECTURE_2026-05-15.md planning/product-tier-architecture.md
cp ../fin-agentic/docs/product/FIN_DATA_SIGNAL_OFFERINGS_2026-05-15.md planning/data-signal-offerings.md
 
# Copy architecture
cp ../fin-agentic/docs/architecture/FIN_MCP_SURFACE_ARCHITECTURE_2026-05-15.md design/mcp-surface-architecture.md
cp ../fin-agentic/docs/architecture/FIN_CENTRAL_TENANT_DEMARCATION_PLAN_2026-05-15.md design/demarcation-plan.md
 
# Copy engineering specs
cp ../fin-agentic/docs/engineering/FIN_INTRANET_HUMAN_AGENT_PROJECTION_ENGINEERING_SPEC_2026-05-13.md design/projection-engineering-spec.md
cp ../fin-agentic/docs/engineering/FIN_AGENTIC_HARNESS_SPEC_2026-05-15.md design/agentic-harness-spec.md
cp ../fin-agentic/docs/engineering/FIN_API_LAYER_SPEC_2026-05-15.md design/api-layer-spec.md
 
# Copy projection catalog
cp ../fin-agentic/docs/projections/PROJECTION_CATALOG_2026-05-15.md reference/projection-catalog.md
 
# Copy policies
cp ../fin-agentic/docs/policies/anonymization/FIN_ANONYMIZATION_POLICY_V1_2026-05-15.md planning/anonymization-policy-v1.md
 
# Copy runbooks
cp ../fin-agentic/docs/runbooks/PHASE_1_DEMARCATION_PROVISIONING_RUNBOOK_2026-05-15.md runbooks/phase-1-provisioning.md
cp ../fin-agentic/docs/runbooks/PHASE_5_FIN_CENTRAL_INTRANET_BOOTSTRAP_RUNBOOK_2026-05-15.md runbooks/phase-5-intranet-bootstrap.md

After copying, commit:

cd ~/Projects/FIN/_03_Dev/fin-central-intranet
git add .
git commit -m "Seed initial canonical docs from fin-agentic/docs/"
git push origin main

2.3 Bootstrap canon entity profiles

In canon/:

`canon/companies/food-intelligence-inc.md`

---
doc_id: company_food_intelligence_inc
entity_type: company
title: Food Intelligence Inc.
status: canonical
---
 
# Food Intelligence Inc.
 
**Incorporated:** February 2026
**Founder & 60% Majority Owner:** Rob Garcia
**Partners (minority):** Joshua Gatcke, Jacob Gatcke
**Designation:** VOSB (Veteran-Owned Small Business)
**Mission:** Build the produce industry's system of intelligence —
agentic, federated, citable, federal-ready.
 
## Founder
 
See [[reference/founder-bio]].
 
## Partners
 
- [[canon/people/joshua-gatcke|Joshua Gatcke]] — Nathel VP, FIN partner
- [[canon/people/jacob-gatcke|Jacob Gatcke]] — Nathel GM, FIN partner
 
## Anchor Customer
 
[[canon/companies/nathel-and-nathel|Nathel & Nathel Inc.]] — Tier 2
Produce Agent Pro pilot, beginning 2026.
 
## Strategic Sponsor
 
[[canon/people/ira-nathel|Ira Nathel]] — Nathel owner, FIN's produce
industry sponsor.
 
## Build Status
 
See [[planning/product-tier-architecture]] for tier strategy.
See [[planning/data-signal-offerings]] for offering catalog.
See [[design/demarcation-plan]] for current architecture.
 
## Federal Pipeline
 
VOSB credentials confirmed. SDVOSB consideration pending counsel
review. See [[planning/data-signal-offerings]] §4 for federal lane
status.

`canon/companies/nathel-and-nathel.md`

---
doc_id: company_nathel_and_nathel
entity_type: company
title: Nathel & Nathel Inc.
status: canonical
---
 
# Nathel & Nathel Inc.
 
**Location:** Hunts Point, NY
**Owner & President:** Ira Nathel
**VP:** Joshua Gatcke (FIN partner)
**GM:** Jacob Gatcke (FIN partner)
**Technical Liaison to FIN:** Alex Cohen
 
## Role For FIN
 
Tier 2 (Produce Agent Pro) anchor customer. The first commercial
deployment of the FIN platform, beginning 2026.
 
## Integration Status
 
Phase 1 demarcation provisioning: see
[[runbooks/phase-1-provisioning]].
 
Current state: Nathel testing environment is `nathel-prod` (Neon) +
`nathel.fin.app` (Cloudflare). FIN Central separation in progress.
 
## People
 
- [[canon/people/ira-nathel|Ira Nathel]] — Owner, sponsor
- [[canon/people/joshua-gatcke|Joshua Gatcke]] — VP
- [[canon/people/jacob-gatcke|Jacob Gatcke]] — GM
- [[canon/people/alex-cohen|Alex Cohen]] — Technical Liaison

`canon/people/*.md`

Create stub profiles for Rob, Josh, Jake, Ira, Alex with appropriate fields. Keep them brief; flesh out later.

2.4 Commit and push seeded content

cd ~/Projects/FIN/_03_Dev/fin-central-intranet
git add .
git commit -m "Seed canon entity profiles for FIN, Nathel, partners"
git push origin main

3. Cloudflare Pages Deployment (45-60 minutes)

Quartz output is a static site. Cloudflare Pages serves it from the GitHub repo.

3.1 Create Pages project

Cloudflare console → Workers & Pages → Create
Connect to Git → Select fin-central-intranet-render (the Quartz build repo, NOT the vault repo)
Build settings:
- Build command: npx quartz build
- Build output directory: public
- Root directory: /
Environment variables:
- NODE_VERSION = 20
Branch: main
Deploy

After first deploy, Cloudflare Pages gives you a URL like fin-central-intranet-render.pages.dev. Confirm it serves correctly.

3.2 Connect the vault repo

The build repo (fin-central-intranet-render) needs to pull the vault repo (fin-central-intranet) at build time. Add as a Git submodule OR a build-time clone in package.json scripts.

// In fin-central-intranet-render/package.json
{
  "scripts": {
    "prebuild": "rm -rf content && git clone https://${GITHUB_TOKEN}@github.com/food-intelligence-inc/fin-central-intranet.git content"
  }
}

Add GITHUB_TOKEN as a Pages environment variable. Use a fine-scoped PAT with read access to the vault repo only.

3.3 Wire custom domain

Cloudflare console → fin.app zone → DNS
The central.fin.app record from Phase 1 step 3.6 can be reused or you can use a separate intranet.fin.app. Recommendation: use intranet.fin.app so the public Tier 0 surface can use a different subdomain later.
Pages project → Custom domains → Add intranet.fin.app
Cloudflare handles SSL automatically

3.4 Confirm serving

Visit https://intranet.fin.app. You should see the seeded content.

4. Cloudflare Access (Auth Gate) (30-45 minutes)

The intranet is private. Cloudflare Access controls who can reach it.

4.1 Set up Cloudflare Access

Cloudflare console → Zero Trust → Access → Applications → Add an application
Type: Self-hosted
Application name: FIN Central Intranet
Session duration: 7 days
Application domain: intranet.fin.app

4.2 Define identity providers

Zero Trust → Settings → Authentication → Login methods → Add
Recommended: Email (one-time PIN) for simplicity in v1
Future: Google Workspace or GitHub SSO if FIN org has a domain

4.3 Define access policies

Create three policies for the application:

Policy 1: Full access (Rob, Josh, Jake)

Name: FIN Central Full Access
Action: Allow
Include: Emails are equal to:
- <rob's email>
- <josh's FIN partner email>
- <jake's FIN partner email>
Session duration: 7 days

Policy 2: Scoped access (Alex)

Name: FIN Central Scoped Access (Integration)
Action: Allow
Include: Emails are equal to:
- <alex's email>
Require: Path is one of:
- /runbooks/*
- /canon/companies/nathel-and-nathel
- /design/demarcation-plan
(Cloudflare Access policy + a path-aware Worker middleware enforces the path scoping. For v1, scope-by-policy may not handle nested paths well; consider using a separate Pages project for the scoped subset.)

Name: FIN Central Sponsor View
Action: Allow
Include: Email is ira@nnproduce.net
Require: Path is one of:
- /canon/companies/nathel-and-nathel
- /canon/people/nathel-relationship-summary (placeholder doc to create)
(Same path-scoping caveat as Policy 2.)

4.4 Test access

From an incognito window, visit https://intranet.fin.app
Cloudflare Access should prompt for email + PIN
Confirm that only configured emails can reach the site
Confirm that Alex/Ira emails are scoped (if path-scoping enabled)

5. Wire The Doc Pipeline (Optional, 2-4 hours, can defer)

The static Quartz site doesn’t yet feed events back to FIN Central’s projection pipeline. To complete the dogfood loop, wire the vault webhook receiver.

This is Phase 4 work primarily; if you’ve completed it, validate here:

Push a test commit to fin-central-intranet
Watch the webhook fire → FIN Central Worker receives it
The doc projection pipeline should:
- Parse the markdown
- Upsert knowledge.domain = doc
- Chunk to operational_memory
- Emit doc.indexed event

Verify in fin-central-prod Neon:

SELECT key, title FROM knowledge
WHERE tenant_id = 'fin-central' AND domain = 'doc'
ORDER BY updated_at DESC LIMIT 10;

Verify chunks:

SELECT chunk_index, content_node_type
FROM operational_memory
WHERE tenant_id = 'fin-central'
ORDER BY created_at DESC LIMIT 10;

If this works, the dogfood loop is real. Every FIN Central doc commit now flows through the same projection pipeline Nathel will use.

6. Partner Comms Subdirectory (30 minutes)

Create scoped partner-specific views:

canon/partners/
  anthropic.md
  nathel-and-nathel.md
  prospective-investors/
    template.md
  federal/
    usda.md
    fda.md
    cdc.md

These pages are scoped by Cloudflare Access policy (each partner can see only their own subdir + the canon-companies root). They’re the delivery surface for partner-specific projections.

For now, content them as placeholder briefs. As the relationship develops, they grow into living artifacts.

7. Verification Checklist

8. Common Pitfalls

Submodule auth issues. GitHub PAT for the build-time clone must have read access to the vault repo. Test in Pages logs.
Quartz wikilink resolution. Quartz prefers shortest link resolution; if links break after copy, rename to match Quartz conventions.
Cloudflare Access session bleeding. Different identities testing in the same browser session can confuse Access. Use incognito or different browsers per identity.
Path-scoping complexity. Cloudflare Access doesn’t natively enforce per-path access well at the Pages layer. For v1, accept imperfect scoping or run separate Pages projects per audience.
Public exposure. Don’t enable any “public” toggle. The whole domain is behind Access.

9. What Comes After Phase 5

After the static intranet is live:

Wave 2 — Workspace doc reader replaces Quartz for FIN team users (richer UI, live agent integration)
Quartz continues serving partner-specific subdirs (lighter weight, no auth complexity)
Wave 3 — Public Harvest Directory uses similar Quartz pattern at harvestdirectory.org against the public-anonymized projections
Wave 4 — Federal audience surface at FedRAMP-routed infra

10. Rollback

If the intranet bootstrap fails:

Delete the Pages project (no production impact)
Keep the fin-central-intranet vault repo (private; no downside)
The vault content can be re-rendered any time with a different static-site tool

The hard work is in the content (the canonical docs and entity profiles). The render is replaceable.

11. Success Criteria

Phase 5 is complete when:

The FIN Central intranet is live, gated, and accessible to the intended audience
Rob, Josh, Jake, Alex, and Ira can each access their scoped views
Canonical docs propagate to the intranet on commit
The dogfood discipline is real: FIN’s own docs flow through the same pipeline that will serve Nathel
Partner comms can begin pointing partners at scoped subdirs instead of email attachments

FIN Central

Explorer

Phase 5 — FIN Central Intranet Bootstrap Runbook

Phase 5 — FIN Central Intranet Bootstrap Runbook

0. Pre-Flight

1. Quartz Setup (1-2 hours)

1.1 Clone Quartz

1.2 Configure Quartz for FIN Central

1.3 Point at the FIN Central vault

1.4 Local test build

1.5 Adjust look-and-feel

2. Content Seeding (1-2 hours)

2.1 Create root index.md

2.2 Copy existing canonical docs

2.3 Bootstrap canon entity profiles

`canon/companies/food-intelligence-inc.md`

`canon/companies/nathel-and-nathel.md`

`canon/people/*.md`

2.4 Commit and push seeded content

3. Cloudflare Pages Deployment (45-60 minutes)

3.1 Create Pages project

3.2 Connect the vault repo

3.3 Wire custom domain

3.4 Confirm serving

4. Cloudflare Access (Auth Gate) (30-45 minutes)

4.1 Set up Cloudflare Access

4.2 Define identity providers

4.3 Define access policies

Policy 1: Full access (Rob, Josh, Jake)

Policy 2: Scoped access (Alex)

4.4 Test access

5. Wire The Doc Pipeline (Optional, 2-4 hours, can defer)

6. Partner Comms Subdirectory (30 minutes)

7. Verification Checklist

8. Common Pitfalls

9. What Comes After Phase 5

10. Rollback

11. Success Criteria

Graph View

Table of Contents

FIN Central

Explorer

Phase 5 — FIN Central Intranet Bootstrap Runbook

Phase 5 — FIN Central Intranet Bootstrap Runbook

0. Pre-Flight

1. Quartz Setup (1-2 hours)

1.1 Clone Quartz

1.2 Configure Quartz for FIN Central

1.3 Point at the FIN Central vault

1.4 Local test build

1.5 Adjust look-and-feel

2. Content Seeding (1-2 hours)

2.1 Create root index.md

2.2 Copy existing canonical docs

2.3 Bootstrap canon entity profiles

canon/companies/food-intelligence-inc.md

canon/companies/nathel-and-nathel.md

canon/people/*.md

2.4 Commit and push seeded content

3. Cloudflare Pages Deployment (45-60 minutes)

3.1 Create Pages project

3.2 Connect the vault repo

3.3 Wire custom domain

3.4 Confirm serving

4. Cloudflare Access (Auth Gate) (30-45 minutes)

4.1 Set up Cloudflare Access

4.2 Define identity providers

4.3 Define access policies

Policy 1: Full access (Rob, Josh, Jake)

Policy 2: Scoped access (Alex)

Policy 3: Read-only sponsor (Ira)

4.4 Test access

5. Wire The Doc Pipeline (Optional, 2-4 hours, can defer)

6. Partner Comms Subdirectory (30 minutes)

7. Verification Checklist

8. Common Pitfalls

9. What Comes After Phase 5

10. Rollback

11. Success Criteria

Graph View

Table of Contents

`canon/companies/food-intelligence-inc.md`

`canon/companies/nathel-and-nathel.md`

`canon/people/*.md`