V6.0 Phase 3 - Add cloudflare tunnel. Remote access to app via the tunnel now working.

docs/production-runbook.md

@@ -25,6 +25,7 @@ This runbook is the operational checklist for releasing and monitoring the trans
    - `/healthz` responds `200`
    - if `RUN_EMBEDDED_WORKER=true`, `worker.state` is `running`
    - if `RUN_EMBEDDED_WORKER=false`, validate `worker` container is healthy/running in Compose
+   - validate `cloudflared` logs show active tunnel routes and no ingress errors
 3. Execute one smoke workflow:
    - create a document/job with at least one source
    - verify terminal job outcome updates
@@ -86,6 +87,13 @@ This runbook is the operational checklist for releasing and monitoring the trans
 2. Confirm failures are category-aligned (`external`/`timeout`/`internal`).
 3. Triage whether issue is source quality, provider, or runtime regression.
 
+### Cloudflare ingress/access failure
+
+1. Check `cloudflared` container logs for ingress parse, DNS, or auth failures.
+2. Confirm `deploy/cloudflared/config.yml` tunnel UUID and hostname mappings are correct.
+3. Confirm `deploy/cloudflared/credentials.json` matches the tunnel configured in Cloudflare.
+4. Confirm Cloudflare Access app policy includes the intended identity/group for that hostname.
+
 ## 6. Dependency upgrade policy
 
 Dependencies are declared in `pyproject.toml` and resolved through the committed