Skip to content

Infrastructure Reference

Canonical reference for all external platform accounts, entity details, and infrastructure IDs. This doc is the single source of truth — if a value appears here and somewhere else, this doc wins.

Last updated: 2026-07-09 (TERRAFORM-VERSION-ALIGN-01)

UCCA Inc (US)

  • Legal name: UCCA Inc
  • DBA: Universal Capability Certification Authority
  • Structure: Delaware C-Corp
  • EIN: 84-4522608
  • Role: Parent / platform entity. US-facing. Holds US software subscriptions, US credit program enrolments, US-denominated contracts.

⚠️ "United Community Colleges of America Inc" is dead. Do not use it anywhere.

United Central Colleges of Australia Pty Ltd (AU)

  • Legal name: United Central Colleges of Australia Pty Ltd
  • ABN: 59 168 872 535
  • Trading as: RTOpacks
  • Role: Australian operating entity. Trades as RTOpacks. Holds AU customer contracts, AU-denominated invoicing, AU regulatory exposure.

Entity separation principle

US-centric credit programs and subscriptions → UCCA Inc. AU-facing commercial activity → RTOpacks / UCCA Australia Pty Ltd. Do not mix invoicing or subscriptions across entities without a clear reason.

Cloudflare

Accounts

  • RTOpacks CF account ID: f95d45376ebeeeaf011a4f0ec0fb7b38
  • Legacy UCCA CF account ID: e5a9830215a8d88961dc6c80a8c7442a (connected via MCP; limited active use)

Platform migration from UCCA account → RTOpacks account completed early April 2026. 9 D1 databases migrated to APAC, 25+ Workers deployed, DNS migrated, CF Access policies established, security audit completed (SEC-AUDIT-MIGRATE-01, 40 checks, 0 failures).

API tokens

  • Account-owned cfat_ tokens validate via a scoped live call, NEVER /user/tokens/verify. Cloudflare's account-owned API token format (cfat_…, ~53 chars) returns Invalid API Token (code 1000) from /user/tokens/verify even when the token is valid and active — that endpoint only verifies user tokens. To check an account token, make a real scoped call (e.g. GET /zones/<zone>/rulesets) — success: true is the authoritative signal. (Cost ~hours during FLAG2-IAC-01, 2026-06-03, before this was understood — the terraform import 401 was the real signal, not user-verify.)
  • R2 S3 credentials (Access Key ID + Secret Access Key, for the Terraform state backend) come from the R2 → Manage R2 API Tokens creation screen, not the generic Account API tokens page. The cfat_ "Token value" shown there is the Bearer form and is NOT what the S3 backend uses. Need Object Read & Write (Object Read only can read state but can't write the lock/state → 403 on terraform import).

DNS zones

  • rtopacks.com.au — Zone ID: 691d4282eaafd5ab612da6a2204b5729
  • staging.rtopacks.com.au is the production front-page surface — served by rtopacks-site-prod (not a dev surface), CF Access–gated until go-live. The apex rtopacks.com.au/www are served by rtopacks-prelaunch-prod until cutover. Cutover landmine: rtopacks-site-prod already holds custom-domain bindings on the apex + www beneath the prelaunch route; removing/repointing prelaunch could promote the site onto the live apex immediately, so treat cutover as one deliberate, sequenced action. (Confirmed live, PUBLIC-FRONT-PAGE-AUDIT-01.) See infrastructure/cloudflare-resource-inventory.md.

D1 databases

Categorised per MANDARIN DATA TAXONOMY (see standing-rules.md). Per-env Peel + Intake DBs have dev twins (D1 names retain -staging suffix per ADR-027 D1-name lag).

RTOpacks account (10):

  • rto-nrt-db — Pith — nationally recognised training data (TGA corpus, AQF quals). Post NRT-DB-DEPOLLUTE-01 (18 May 2026): contains only TGA reference + sync-pipeline support tables.
  • rto-abs-db — Sync-output — ABS labour-force / reference data (abs-sync pipeline)
  • rto-licensing-db — Sync-output — licensing / entitlements (teqsa-sync)
  • rto-radar-db — Sync-output — digital footprint intelligence (radar-crawl)
  • rto-ops-db — Peel — internal business ops (UCCA staff, internal-ops surface only)
  • rto-workspace-db — Peel — workspace / studio / canvas / RTO end-user identities
  • rto-landscape-db — Peel — VET vendor competitive intelligence
  • rto-calendar-db — Peel — scheduling / calendar
  • rto-micro-db — Peel — microcredentials (non-accredited) content
  • rto-intake-db — Intake — public-form submissions (contacts, contact_enquiries, subscribers). Post INTAKE-DB-EXTRACTION-01 (16 May 2026).

UCCA account (1):

  • ucca-mcp-db — MCP integration data

HARD SEPARATION RULE reminder

  • Regulated training → rto-nrt-db
  • Non-regulated training → rto-micro-db
  • Business ops → rto-ops-db (never surfaced)

See standing-rules.md for full rule.

Worker inventory (as of March 2026)

28 Workers on RTOpacks account, 20 on UCCA account.

Scheduled Workers:

  • tga-sync — Sat 16:00 UTC / Sun 2am AEST (0 16 * * SAT)
  • cricos-sync — 1st of month, 07:00 UTC (0 7 1 * *). Cron restored 2026-07-03 (SYNC-REVIVAL-01) — was never configured our side after the 2026-04-08 migration, so it silently stopped producing (last write 2026-03-02).
  • ops-tender-sync — daily 6pm + Sat 8pm AEST
  • stats-cache — every 6 hours (0 */6 * * *)
  • enrich-sync — Sat 12:00 UTC (0 12 * * SAT); RTO enrichment (writes rtos.enriched_at). CORRECTED (SYNC-REVIVAL-01, 2026-07-03): it had never run on cron — the cron was deployed but the scheduled() handler was left commented out (commit 0526f948, a "wire up later" TODO never completed), so every weekly fire errored. 100% RTO coverage was reached by manual /trigger (Apr-13, May-25). Handler restored 2026-07-03; liveness is now run-gated (a 0-candidate run still writes complete steps). Registered in the stall detector (9d).
  • ~~qual-enrichment — daily 3am AEST~~ CORRECTED (SYNC-REVIVAL-01, 2026-07-03): there is no deployed qual-enrichment worker. Units/qualification KN enrichment (the 15,128→15,200 sacred set) has no writer in this repo — it was an external process that ceased at the migration (last write 2026-04-02). Rebuild tracked as KN-WRITER-01.
  • rtopacks-internal-api — hourly (0 * * * *); invite-expiry sweep (BRIEF-INVITE-EXPIRY-01, 2026-06-26) — lapses pending portal_invites past the 7-day window to status='expired', freeing the reserved seat (ADR-058 "or expired" release path)
  • rtopacks-db-backup-tooling — weekly Sun 04:00 UTC (0 4 * * SUN); off-substrate rto-nrt-db backup (KN-BACKUP-AND-REGIME-AUDIT-01, live 2026-07-03).
  • rtopacks-stall-detector-tooling — hourly (0 * * * *); liveness sweep — alarms when any registered scheduled worker has no successful run within its window (SYNC-REVIVAL-01 §2.3).

All 5 stat-sync scheduled Workers need ops.ucca.online status stubs (pending).

Artefact-carry proxy (OUTPUTS-PROXY-01, 2026-07-03)

  • rtopacks-artefact-proxy-tooling — GET-only read proxy so Claude fetches gate-review bytes directly instead of Tim hand-carrying terminal output (the carriage was the bottleneck; one clipped-carry incident). Alex→Claude artefact carriage only — every instruction still travels Tim→Alex verbatim; FENCE-PROTOCOL-01 untouched.
  • Base URL: https://rtopacks-artefact-proxy-tooling.dark-firefly-3289.workers.dev. Routes: GET /{token}/manifest-<UTCstamp>.json (versioned), GET /{token}/{filename}. Anything else → 404 — including any _-prefixed key and any .. traversal. There is NO standing manifest.json (deleted 2026-07-03; a fixed URL is cache-pinned on Claude's side, so it inevitably lies).
  • The path token is a worker secret (ARTEFACT_TOKEN), not committed here — the full tokened URL lives in the reference_proxy_urls.md memory ref (docs-proxy convention) and is carried to Claude out-of-band by Tim.
  • Bucket rtopacks-gate-artefacts-tooling; publish is a deliberate per-file act via scripts/publish-artefact.sh (secret-scans, puts, appends {filename, sha256, bytes, published_at} to the manifest). Claude verifies the fetched digest against the manifest entry — digest check is structural.
  • Stale-manifest defence = unique paths, not ?cb=. Claude's fetch pipeline strips query params, so cache-busting a fixed URL fails. Each publish writes (a) an internal _manifest_base.json — the read-modify-write base, read by KEY (R2 GET is strongly consistent, so no list-race drops a rapid prior publish's entry) and unfetchable via the proxy (the worker 404s _-prefixed keys), so it can't lie to anyone; and (b) an immutable manifest-<UTCstamp>.json for Claude. At every gate close, carry the VERSIONED manifest URL plus each artefact's file URL — full, token and all — so one paste puts fetchable links into Claude's conversation. Guard keys/artefacts against re-use (an overwritten key is cache-pinned stale on Claude's side); PUBLISH_INSPECTED_OVERRIDE=1 skips the secret-scan for inspected false positives (e.g. a binding reference, not a value). The script prints the confirm-back URLs, reading the token from the rtopacks-artefact-proxy 1Password item.

R2 buckets

  • rtopacks-terraform-state — Terraform state backend (R2; renamed at STATE-MIGRATE-01 — ucca-terraform-state was stale). Backend creds in 1Password terraform-r2-backend (RTOpacks vault) via op run --env-file=infra/terraform/.env.op, NOT ~/.zshrc. Terraform ratified 1.15.8 (pin ~> 1.15.0, TERRAFORM-VERSION-ALIGN-01). 115 resources / 9 types (+78 parked v5 schema-rep changes → TERRAFORM-V5-RECONCILIATION-01).
  • rtopacks-llnd-instrument-assets-{dev,prod} — published instrument-asset custody (content-addressed audio/media referenced by pack audio_ref; served read-path-only through the tokened candidate session, GET /s/:token/asset/{digest}; never public, no signed URLs). Distinct custody class from evidence and capture — the classes do not mix. Created: LLND-LLN-ASSETS-01 (2026-07-11), dev at G3 / prod (empty, inert) at G5, outside Terraform (wrangler); IaC debt owed to TERRAFORM-V5-RECONCILIATION-01 (ADR-068).
  • Versioned snapshot buckets (see Observatory config).

CF Access bypasses

  • /billing/webhook — Stripe webhook endpoint
  • /billing/qb-callback — QuickBooks OAuth callback

Documentation surfaces

All Cloudflare-proxied.

  • knowledge.ucca.online — UCCA knowledge base
  • docs.ucca.online — UCCA docs
  • docs.rtopacks.com.au — RTOpacks product docs
  • trust.rtopacks.com.au — RTOpacks trust / compliance surface

Apple Developer

  • Team ID: B29TSCBPHD
  • Pass Type ID: pass.online.ucca.credential
  • Bundle ID: online.ucca.authenticator
  • Renewal: 2 March 2027
  • Entity name change: submitted

GitHub

  • Monorepo: uccaonline — contains ucca-project and rtopacks-project. Auth via gh CLI OAuth, auto-refreshes.
  • UCCO repo: ucco-project (on hold). Auth via PAT ucco-foundation-push, expires 14 March 2027.
  • 2FA: enabled (deadline was April 29 — met).

Project structure (local)

All projects under ~/projects/:

  • ucca-project/ — contains engine/ and ucca-docs/ (MkDocs)
  • rtopacks-project/
  • ucco-project/ (on hold)

ucca-project and rtopacks-project share one git repo (uccaonline). ucco-project has its own repo.

Financial / accounting

  • Bank: Mercury (US, under UCCA Inc)
  • Accounting (AU): QuickBooks Online AU
  • QuickBooks sandbox company ID: 9341456854400409
  • Accountant: Kevin (CPA)
  • Stripe: integrated, webhook bypass configured

External APIs

All external APIs must have a reference doc in docs/ops/ before deploy (EXT-API RULE).

TGA (training.gov.au)

  • Reference doc: docs/ops/tga-api-reference.md
  • Swagger: https://training.gov.au/swagger/index.html
  • Unit content endpoint: GET /api/training/{code}/releases/{releaseNumber}/document-bundle
  • TLS note: Node.js fetch works. curl and CF Workers are blocked by TGA's TLS fingerprint. Use a Node-based Worker runtime or proxy if calling from CF.

Other APIs

Add entries here as they're integrated. Each entry must link to its reference doc in docs/ops/.

Machine / local setup

  • Primary machine: Mac Mini M2 Pro
  • Display: 49" Samsung ultrawide
  • Storage: LaCie external, Rclone + Spotlight configured
  • Shell env: no credentials in ~/.zshrc (emptied at ENV-TOKEN-HYGIENE-01/02); Terraform R2 backend creds in 1Password terraform-r2-backend via op run --env-file=infra/terraform/.env.op

Wrangler version operating constraint

The repo carries two wrangler versions:

  • Global install (used when running npx wrangler from any directory without a local node_modules/wrangler): currently 4.94.0.
  • Per-worker pinned: e.g. scripts/workers/tga-sync/ uses 3.114.17 via local node_modules; apps/admin/ uses 4.77.0.

Refined picture (post MANDARIN-VIOLATION-02-market-snapshot, 2026-05-24):

Wrangler v4's resource-by-name resolution is asymmetric between resource types:

Resource type v4 from project root v4 from worker dir w/ local config v3 from worker dir w/ local config
Queue (by name) ✅ resolves ✅ resolves ✅ resolves
D1 (by name) ❌ "Couldn't find DB with name X" ✅ resolves ✅ resolves

D1-by-name on v4 from project root fails even with --database-id alone — v4 wants both the positional name AND the --database-id flag, OR the local config context. The cleanest D1 command paths for ad-hoc remote queries:

  1. cd into a worker dir with the binding in local config + use wrangler 3.x pinned (e.g., scripts/workers/tga-sync/): 
    cd scripts/workers/tga-sync && npx wrangler d1 execute ops-db --remote --command "..."
  2. cd into a worker dir with the binding + use wrangler 4 (e.g., apps/admin/): 
    cd apps/admin && npx wrangler d1 execute rto-ops-db-staging --remote --env dev --command "..."
  3. D1 REST API or D1 MCP (skips wrangler discovery entirely — uses UUID directly).

Discipline note: when a prescribed wrangler command fails in a credential-touch flow, halt and surface with the working alternative — do not route around to a different tool on your own authority. The choice of execution path is part of the credential rule, not just the credential bytes.

D1 UUIDs are listed under the D1 databases section above for use with --database-id or for direct MCP/REST calls.

What goes where — quick reference

Item Entity / location
US software subscriptions UCCA Inc
US startup credit programs UCCA Inc
AU customer contracts RTOpacks / UCCA AU Pty Ltd
AU tax and accounting UCCA AU Pty Ltd (Kevin)
Regulated training data rto-nrt-db
Non-regulated training data rto-micro-db
Business ops data rto-ops-db (never surfaced)
Terraform state R2 rtopacks-terraform-state
RTOpacks DNS Cloudflare, Zone 691d4282eaafd5ab612da6a2204b5729
Primary docs surface docs.rtopacks.com.au
Trust / compliance surface trust.rtopacks.com.au

Change discipline

This doc is canonical. When IDs, entities, or infrastructure change:

  1. Update this doc first
  2. Then update anything that references these values
  3. Commit under docs/ops/infrastructure-reference.md
  4. Note the change date at the top of the doc

Never let this doc drift from reality. If you find a discrepancy, fix this doc before anything else.