# Architecture (/docs/platform/architecture)



The platform is Cloudflare-native — coherence over multi-cloud insurance — with one
deliberate exception for execution locality.

| Layer                                                                  | Where                                                            |
| ---------------------------------------------------------------------- | ---------------------------------------------------------------- |
| Edge API (HTTP+SSE+MCP), View rendering, artifact delivery             | Workers                                                          |
| Workspace control plane                                                | Durable Object (SQLite) per Workspace                            |
| Global stub (payment-id uniqueness, payer→workspace, catalog, rollups) | D1                                                               |
| Sim STEP + certified GRADE                                             | The Workspace DO's V8 isolate (co-located with the pod loop)     |
| Workshop: ETL cutter (batch)                                           | Cloudflare Containers (pinned Bun)                               |
| Lake + artifacts + receipts                                            | R2 (zero egress)                                                 |
| Execution module (live order path)                                     | standalone colocated VM, NYC/EWR metro                           |
| Web (landing, docs, blog)                                              | one static site — Next.js static export on Workers static assets |

## Why a Durable Object per Workspace [#why-a-durable-object-per-workspace]

The Workspace is single-writer by construction, so the DO's serialized execution
gives the Operation lifecycle — resume-across-claim, idempotent provider callbacks,
single-use Offers, root-grant replacement — race-free semantics. DO alarms are the
native primitive for Envelope / Offer / trial expiry.

## The serving discipline [#the-serving-discipline]

Materialize at publish, serve from artifacts; the query engine never runs at request
time and is out of the certified path entirely. The certified Grade runs in the Workspace
DO's V8 isolate — the fair/fill float math is byte-deterministic across JS engines (vendored
fdlibm/musl exp/log) and the grade path is Worker-portable (WebCrypto hashing, in-memory
ledger), so no pinned-Bun grade-farm container is needed. Receipt **signing** stays in the
control plane — the certification key never leaves it.

## The web tier [#the-web-tier]

Per ADR-0008 the web is a single static export served from Workers static assets — no
SSR, no framework runtime. The one request-time addition is a thin edge Worker for
agent-first markdown negotiation (ADR-0013).