Architecture
Cloudflare-native — Workers at the edge, a Durable Object per Workspace, R2 + D1, Containers for the Workshop.
The platform is Cloudflare-native — coherence over multi-cloud insurance — with one deliberate exception for execution locality.
| Layer | Where |
|---|---|
| Edge API (HTTP+SSE+MCP), View rendering, artifact delivery | Workers |
| Workspace control plane | Durable Object (SQLite) per Workspace |
| Global stub (payment-id uniqueness, payer→workspace, catalog, rollups) | D1 |
| Workshop: judge + grade farm + ETL cutter | Cloudflare Containers (pinned Bun) |
| Lake + artifacts + receipts | R2 (zero egress) |
| Execution module (live order path) | standalone colocated VM, NYC/EWR metro |
| Web (landing, docs, blog) | one static site — Next.js static export on Workers static assets |
Why a Durable Object per Workspace
The Workspace is single-writer by construction, so the DO's serialized execution gives the Operation lifecycle — resume-across-claim, idempotent provider callbacks, single-use Offers, root-grant replacement — race-free semantics. DO alarms are the native primitive for Envelope / Offer / trial expiry.
The serving discipline
Materialize at publish, serve from artifacts; the query engine never runs at request time and is out of the certified path entirely. The judge always runs pinned Bun in containers (float determinism); receipt signing happens in the control plane — certification keys never enter an ephemeral grade-farm container.
The web tier
Per ADR-0008 the web is a single static export served from Workers static assets — no SSR, no framework runtime. The one request-time addition is a thin edge Worker for agent-first markdown negotiation (ADR-0011).