Skip to content

ADR-0004 — The engine spine runs on Cloudflare

Context

The skin/body split (thin edge, heavy Python behind) was validated platform architecture, but "behind" had no production address. The Mac Mini is dev-only by standing rule and never an operational dependency. A read-and-report recon (UCCA-RECON-CF-01 → UCCA-RECON-CF-FINDINGS-01, 2026-07-02) verified against live Cloudflare state and the engine's real footprint that the entire spine fits in the one UCCA account: the reasoner calls LLM APIs rather than running models locally, so it is wait-bound, not resource-bound; a real course job (25 LLM calls, ~19.6k in / ~19.7k out tokens) fits a standard-1 container with headroom; costs are LLM-dominated (~$0.11/course test-phase on GLM-5.2) with infra at cents-to-low-dollars; and a job-concurrency cap turns consumption billing into a computable monthly ceiling.

Decision

The engine spine runs in the one UCCA Cloudflare account (ADR-0003 boundary unchanged):

gate (Worker, edge) → Queue → reasoner (Container, standard-1, queue-drained, explicit destroy) → D1 (job state + the cognitive-cost ledger, append-only) → R2 (artefacts) → keys worker (signing) → provider-agnostic LLM adapter, direct-wire.

Adapter policy (recorded here as part of the ruling): - Direct API wiring to all external model providers with engine-owned keys. No AI Gateway middleware — first-party metering is future client-billing data and must be engine-owned; provenance requires unmediated calls (no silent cache/retry/reroute between reasoner and model). - Workers AI models are called via the binding (the host, not middleware). Test-phase default: GLM-5.2 CF-hosted (@cf/zai-org/glm-5.2) — credits-covered, ~1 free course/day on the daily neuron allowance, and payloads reach Cloudflare GPUs, not Z.ai's cloud. Z.ai direct (Anthropic-compatible endpoint) and Anthropic direct are wired as adapter providers; route selection is per-call. - The JSONL→D1 cost-ledger migration preserves append-only (insert-only; never UPDATE/DELETE).

Concurrency cap is a first-class control: the cap (initial proposal: 2) is the monthly cost ceiling. Raising it is a deliberate act, not a side effect.

Consequences

  • UCCA-INPUT-PATH-BUILD-BRIEF-01 now builds against a decided runtime, not a recommendation.
  • Portability is preserved by construction: the body is a Docker image and clients see only the gate (async job in, envelope out). If Cloudflare stops fitting, the identical image deploys elsewhere with zero client-visible change. This ruling is cheap to reverse, which is why it can bind pre-proof.
  • The AU-residency caveat is carried, not resolved: Cloudflare provides AU placement (R2 oc/apac location hints; OC container region, limited-capacity) but not AU data residency as a contractual jurisdiction (R2 jurisdictions are eu/fedramp only). Filed to STRATEGY-01's legal ledger; mitigant on record: only the conformed triumvirate payload crosses the gate — the raw client corpus never does.
  • Workers Paid is the standing base plan. The startup-credit application remains timed to ground-breaking (the one-year clock starts on approval).
  • Pre-production checklist (not gates today): split the broad deploy token from narrow runtime secrets before real client jobs flow; stand up 1Password CLI secret management on the UCCA side before build-time secrets multiply.

Mint condition

This ADR mints when the input-path proof job — a conformed payload exercised gate→engine→envelope to terminal effect — runs on this runtime. One proof event mints both ADR-0002's remedy and this ruling.

Mint annotation, 2026-07-04 (Class B)

max_instances=2 held through the wedge and its fix. The instance-cap-contention wedge was cured by prompt slot release (container self-stop on seal, 0.1.2-slotrelease), not by raising the cap — proving the cap's intent (two genuinely concurrent jobs) rather than escaping it. Burst proof: a 3-job burst completed clean with per-terminal handoff in seconds (103b3ae3 · 4c590523 · 55810eb3). Raising the cap remains a future cost ruling on real throughput evidence, per the seam ruling of 2026-07-04 (see ADR-0006 slot-release).

Ruled 2026-07-02. The body found its building: same roof as the gate, one account, one credit balance, a ceiling instead of an open bill, and an exit that costs one redeploy. Binds now; mints when the proof job runs.