Skip to main content

Architecture visual guide

Ten original SVG diagrams explain the system by responsibility and workflow. Open an image for full-size detail; each has an editable Mermaid source. These diagrams distinguish current, optional and in-development behavior, and do not grant access or prove new product acceptance.

The native platform​

How source, authority, execution and protected delivery connect.

How source, authority, execution and protected delivery connect.

Open SVG · Mermaid source.

The full Cloudflare architecture​

The complete responsibilities and service boundaries.

The complete responsibilities and service boundaries.

Open SVG · Mermaid source.

Source, state and private outputs​

Artifacts Git, D1 domain state, R2 outputs and managed registry.

Artifacts Git, D1 domain state, R2 outputs and managed registry.

Open SVG · Mermaid source.

The execution pipeline​

Exact-source admission through queue, workflow, container and private evidence.

Exact-source admission through queue, workflow, container and private evidence.

Open SVG · Mermaid source.

AI advice and proposals​

Metadata-only Clef advice and separately tested code proposals.

Metadata-only Clef advice and separately tested code proposals.

Open SVG · Mermaid source.

Protected previews​

Static and managed application delivery with current reader checks.

Static and managed application delivery with current reader checks.

Open SVG · Mermaid source.

Identity, permission and secret release​

Access enrollment, Golf grants and exact-approved workflow values.

Access enrollment, Golf grants and exact-approved workflow values.

Open SVG · Mermaid source.

Notifications and maintenance​

D1 outboxes, accepted messages and maintenance fallback.

D1 outboxes, accepted messages and maintenance fallback.

Open SVG · Mermaid source.

The change lifecycle​

Current evidence and previews, with merge/CD acceptance boundaries.

Current evidence and previews, with merge/CD acceptance boundaries.

Open SVG · Mermaid source.

The portable architecture​

Forgejo, Go, separate PostgreSQL ownership and optional execution.

Forgejo, Go, separate PostgreSQL ownership and optional execution.

Open SVG · Mermaid source.

Architectural illustrations​

These original illustrations show the architectural ideas in presentation form. Component names, authorization and operational evidence are in the exact diagrams and service reference above.

Four distinct storage responsibilities​

Canonical source in Artifacts, domain state in D1, private output in R2 and images in the managed registry each have a separate job.

Conceptual illustration: Canonical source in Artifacts, domain state in D1, private output in R2 and images in the managed registry each have a separate job.

From an admitted change to private evidence​

Queues deliver admitted work, Workflows coordinate its steps, Containers execute the checked source, and R2 retains private outputs.

Conceptual illustration: Queues deliver admitted work, Workflows coordinate its steps, Containers execute the checked source, and R2 retains private outputs.

Advice and proposals follow different paths​

Clef reads bounded metadata for advice. Code proposals use an independent Artifacts fork, isolated execution and a separate test before human review.

Conceptual illustration: Clef reads bounded metadata for advice. Code proposals use an independent Artifacts fork, isolated execution and a separate test before human review.

Protected previews have explicit boundaries​

Static and Worker previews use distinct serving paths. Worker previews have scoped data, authorization, outbound policy and expiration.

Conceptual illustration: Static and Worker previews use distinct serving paths. Worker previews have scoped data, authorization, outbound policy and expiration.