{"service":"algoblocker-enterprise-onboard","kind":"algoblocker-cf-one-onboard","persist":"none","mutate":"none","tracks":{"consumer":"WARP without a Zero Trust org. Closes IP/ASN/DNS-to-ISP. No Gateway.","traffic-dns":"Cloudflare One default. Full tunnel + optional HTTP inspect + posture. Matches warp-setup.md.","dns-only":"Cloudflare One DNS filtering only. No HTTP inspect, no posture, origin JA3 unchanged."},"steps":[{"id":"cf-account","n":1,"title":"Cloudflare account","owner":"dashboard","required":true,"tracks":["consumer","traffic-dns","dns-only"],"dash":"https://dash.cloudflare.com/sign-up","docs":"https://developers.cloudflare.com/cloudflare-one/setup/","cli":null,"detail":"Free tier. No card. Email verify only."},{"id":"zt-org","n":2,"title":"Zero Trust organization (team name)","owner":"dashboard","required":true,"tracks":["traffic-dns","dns-only"],"dash":"https://dash.cloudflare.com/one/","docs":"https://developers.cloudflare.com/cloudflare-one/setup/","cli":null,"detail":"Team name becomes YOURTEAM.cloudflareaccess.com. Used by deploy-vpn -Team / warp-cli teams-enroll. Skip for consumer WARP."},{"id":"login-method","n":3,"title":"Login method","owner":"dashboard","required":true,"tracks":["traffic-dns","dns-only"],"dash":"https://dash.cloudflare.com/one/","docs":"https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/","cli":null,"detail":"One-time PIN is enough for a single operator. Third-party IdP is optional."},{"id":"enrollment-rules","n":4,"title":"Device enrollment permissions","owner":"dashboard","required":true,"tracks":["traffic-dns","dns-only"],"dash":"https://dash.cloudflare.com/one/","docs":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/device-enrollment/","cli":null,"detail":"Who may enroll a Cloudflare One / WARP client into the org. CLI cannot create these rules."},{"id":"root-cert","n":5,"title":"Cloudflare root certificate","owner":"dashboard","required":false,"tracks":["traffic-dns"],"dash":"https://dash.cloudflare.com/one/","docs":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/","cli":null,"detail":"Needed only if Gateway TLS inspection (HTTP policies) is on. Without it, origin JA3 stays the browser's."},{"id":"warp-client","n":6,"title":"Install and connect WARP / Cloudflare One Client","owner":"cli","required":true,"tracks":["consumer","traffic-dns","dns-only"],"dash":"https://1.1.1.1/","docs":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/set-up/","cli":".\\deploy-vpn.ps1                 # consumer\n.\\deploy-vpn.ps1 -Team YOURORG  # Zero Trust\n./deploy-vpn.sh --team YOURORG","detail":"Automates warp-setup.md steps 1–6. Prefer mode warp (Traffic + DNS). Mode doh is DNS-only."},{"id":"verify-tunnel","n":7,"title":"Verify the tunnel","owner":"browser","required":true,"tracks":["consumer","traffic-dns","dns-only"],"dash":"https://1.1.1.1/help","docs":null,"cli":".\\deploy-vpn.ps1 -Status","detail":"1.1.1.1/help should show 1.1.1.1, WARP, and DoH = Yes. This API reports only THIS request's ASN / WARP tag — not your device."},{"id":"audit-worker","n":8,"title":"Deploy your /whoami audit Worker","owner":"cli","required":false,"tracks":["consumer","traffic-dns","dns-only"],"dash":null,"docs":null,"cli":".\\deploy-vpn.ps1 -Worker","detail":"Your Worker. This site never proxies /whoami and never stores an IP. Paste the origin into the extension Options."},{"id":"extension","n":9,"title":"Point the extension at the Worker","owner":"browser","required":true,"tracks":["consumer","traffic-dns","dns-only"],"dash":null,"docs":null,"cli":null,"detail":"Options → VPN health check → paste Worker URL → Capture baseline. Kill-switch is DNR, not an OS firewall."},{"id":"gateway-dns","n":10,"title":"Gateway DNS policies","owner":"dashboard","required":false,"tracks":["traffic-dns","dns-only"],"dash":"https://dash.cloudflare.com/one/","docs":"https://developers.cloudflare.com/cloudflare-one/traffic-policies/dns-policies/","cli":null,"detail":"warp-setup.md step 7. CLI cannot set this. Block Advertising / Surveillance / Malware categories."},{"id":"gateway-http","n":11,"title":"Gateway HTTP policies (TLS inspect)","owner":"dashboard","required":false,"tracks":["traffic-dns"],"dash":"https://dash.cloudflare.com/one/","docs":"https://developers.cloudflare.com/cloudflare-one/traffic-policies/http-policies/","cli":null,"detail":"Optional. Can break sites. Origin JA3 becomes Cloudflare's only when TLS inspection is actually on."},{"id":"device-posture","n":12,"title":"Zero Trust device posture","owner":"dashboard","required":false,"tracks":["traffic-dns"],"dash":"https://dash.cloudflare.com/one/","docs":"https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/","cli":null,"detail":"warp-setup.md step 8. This is not Access, and it is not the HMAC apex device-lock. Overkill for one device."},{"id":"security-audit","n":13,"title":"Run the local security audit","owner":"cli","required":false,"tracks":["consumer","traffic-dns","dns-only"],"dash":null,"docs":null,"cli":"py -3 scripts/cf-one-audit.py\npy -3 scripts/cf-one-audit.py --json","detail":"Read-only. Device + public site probes need no token. Zero Trust listings need CF_API_TOKEN + CF_ACCOUNT_ID (GET only)."}],"this_request":{"persist":"none","ip":"redacted","asn":16509,"asOrganization":"Anthropic, PBC","colo":"CMH","country":"US","tlsVersion":"TLSv1.3","httpProtocol":"HTTP/2","warpTagPresent":false,"isCloudflareAsn":false,"warp_verified":false,"warp_probable":false,"note":"Pages Function view of THIS request only. Not Access posture. Not a device-lock verdict. IP redacted."},"probes":{"site":[{"url":"https://algoblocker.com/","status":200,"type":"text/html","headers":{"content-security-policy":"default-src 'none'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'u...","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"DENY","x-content-type-options":"nosniff","referrer-policy":"no-referrer","permissions-policy":"geolocation=(), microphone=(), camera=(), interest-cohort=()"}},{"url":"https://algoblocker.pages.dev/","status":200,"type":"text/html","headers":{"content-security-policy":"default-src 'none'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'u...","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"DENY","x-content-type-options":"nosniff","referrer-policy":"no-referrer","permissions-policy":"geolocation=(), microphone=(), camera=(), interest-cohort=()"}},{"url":"https://algoblocker.com/.well-known/security.txt","status":200,"type":"text/plain","headers":{"content-security-policy":"default-src 'none'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'u...","strict-transport-security":"max-age=31536000; includeSubDomains","x-frame-options":"DENY","x-content-type-options":"nosniff","referrer-policy":"no-referrer","permissions-policy":"geolocation=(), microphone=(), camera=(), interest-cohort=()"}},{"url":"https://algoblocker.com/api/enterprise/posture","status":200,"type":"application/json","headers":{}}],"dns":[{"name":"algoblocker.com","type":"A","status":0,"answers":2,"verdict":"answers"},{"name":"www.algoblocker.com","type":"A","status":3,"answers":0,"verdict":"NXDOMAIN"},{"name":"auth.algoblocker.com","type":"A","status":3,"answers":0,"verdict":"NXDOMAIN"},{"name":"recover.algoblocker.com","type":"A","status":3,"answers":0,"verdict":"NXDOMAIN"},{"name":"mail.algoblocker.com","type":"A","status":0,"answers":0,"verdict":"NODATA"},{"name":"mail.algoblocker.com","type":"MX","status":0,"answers":0,"verdict":"NODATA"}],"expected":{"www.algoblocker.com":"NXDOMAIN until operator enables www","auth.algoblocker.com":"NXDOMAIN until operator enables auth","recover.algoblocker.com":"NXDOMAIN until operator enables recover","mail.algoblocker.com":"NODATA (webmail is workers.dev)","security_txt":"optional; missing is Low, not a WARP failure"}},"cli":{"install":".\\deploy-vpn.ps1   |   ./deploy-vpn.sh","team":".\\deploy-vpn.ps1 -Team YOURORG   |   ./deploy-vpn.sh --team YOURORG","status":".\\deploy-vpn.ps1 -Status","worker":".\\deploy-vpn.ps1 -Worker","audit":"py -3 scripts/cf-one-audit.py"},"dash":{"one":"https://dash.cloudflare.com/one/","signup":"https://dash.cloudflare.com/sign-up","help":"https://1.1.1.1/help","warp":"https://1.1.1.1/"},"docs":{"first_time":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/set-up/","zero_trust":"https://developers.cloudflare.com/cloudflare-one/setup/","warp_setup":"/enterprise/onboard"},"residuals":["WARP is unlinkability in a Cloudflare herd, not anonymity","Origin JA3 stays the browser unless Gateway TLS inspection is on","Kill-switch is extension DNR, not an OS firewall","This API cannot see Gateway rules, Access apps, or device posture without the operator's token — use scripts/cf-one-audit.py","HMAC apex device-lock is not Access posture and is not live until an explicit device-lock deploy","Cloudflare Access is a separate product; an account can have WARP/Gateway without Access enabled","NumericalOS boot remains unverified until numericalos-verify-boot observes an artifact"],"honesty":{"access_posture":false,"device_lock_is_access":false,"origin_ja3_closed_by_consumer_warp":false,"kill_switch":"partial-dnr"}}