Phase 1: created backend/config/auth-lib.php (cai_check_token/cai_require_token, reads array-based tokens.json) + backend/config/tokens.json (active token array). Locked both down via backend/config/.htaccess (Require all denied on .json/.php) after confirming they were briefly web-reachable (200) before the .htaccess landed -- fixed same session, verified 403 after. Phase 2 pilot: migrated verify_lib.php (function auth() now delegates to cai_require_token -- this covers OPEN/CLOSE/SYNC/BACKUP and other files that require verify_lib.php and call its auth()), CHECKPOINT.php (had its own separate inline $admin_token check, different shape), TASKGATE.php (had its own separate TOKEN constant-based check, a third shape). All 3 backed up before editing except TASKGATE.php -- process slip: deployed before confirming the backup succeeded (BACKUP.php was gated on TASKGATE.php itself needing a recent taskgate call, hadn't made one yet), caught immediately, backup retried successfully right after (though that capture is post-edit, not pre-edit -- true pre-edit content preserved separately). Live-tested all 3: valid token 200, bad/invalid token correctly 401/error with the exact original error shape preserved, and OPEN.php/CHECKPOINT.php/TASKGATE.php all confirmed still functioning normally with the current live token after each deploy. Key finding: NOT all ~800+ files share one auth pattern -- found 3 different shapes just among 6 sampled command files (function auth(), inline $admin_token variable, TOKEN constant define-and-compare). Full-platform migration needs per-file inspection, matches TOKEN-ROTATION-PLAN.md's own caution against batch-replacing blindly. No inventory of the true remaining file count yet -- next real step before continuing at volume.