{"slug":"canonical/adr/ADR-2026-09-03-04-cloudflare-do-hybrid-infrastructure","title":"ADR-2026-09-03-04 — Cloudflare + DigitalOcean hybrid infrastructure","section":"canonical","sectionLabel":"Canon","status":"canon","type":"adr","path":"canonical/adr/ADR-2026-09-03-04-cloudflare-do-hybrid-infrastructure.md","bytes":3444,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** APPROVED — 2026-09-03 (founder ruling)\n\n## Ruling\n\nAdopt a **four-plane hybrid**: Cloudflare for edge/AI, DigitalOcean for\nstateful application infrastructure, Spine for business ontology, AI SDK for\nagent execution. The infrastructure can change without changing the product\nontology.\n\n```text\nEDGE PLANE          CLOUDFLARE       (DNS, WAF, CDN, Workers, R2, Pipelines,\n                                     Realtime, AI Gateway, Vectorize, AI Search,\n                                     Workers AI, Browser Run)\n\nSPINE PLANE         DIGITALOCEAN     (PostgreSQL, Spine services,\n                                     Valkey, MCP services,\n                                     background workers, Docker)\n\nAGENT PLANE         DIGITALOCEAN     (AI SDK Agent Runtime,\n                                     long-running workflows,\n                                     internal admin services,\n                                     heavy background processing)\n\nAI/RETRIEVAL PLANE  CLOUDFLARE       (Vectorize, AI Search, Workers AI,\n                                     AI Gateway, R2)\n```\n\n## The four principles\n\n1. `Cloudflare ≠ Spine`   — Cloudflare is the edge/AI plane.\n2. `DigitalOcean ≠ Spine` — DigitalOcean is the stateful app plane.\n3. `AI SDK ≠ Spine`       — AI SDK is the agent orchestration plane.\n4. `PostgreSQL ≠ Spine`   — the database is the canonical store substrate.\n\n**Spine = architectural ownership of business truth/context/work.**\nThe product ontology survives the infrastructure choice.\n\n## Storage transition (D1 → PostgreSQL)\n\nReplace D1-as-canonical-truth with **PostgreSQL as the canonical Spine\nstore** (Neon in dev, DigitalOcean Managed Postgres in prod). D1 may\nremain for Cloudflare-local edge projections, but never as the\nauthoritative business ontology.\n\n## Agent runtime (AI SDK, not Cloudflare Agents SDK)\n\n`AI SDK Agents` is the run substrate for Twin and specialists. The AI\nAgent Runtime lives on DigitalOcean (not as a Cloudflare worker).\nContextual memory continues to be served by the Memory Fabric; Cloudflare\nAgent Memory is an optional native memory backend, **not the\narchitectural foundation**.\n\n## Network topology\n\n```text\nInternet\n   → Cloudflare DNS → WAF → CDN → Rate limiting → Edge routing\n   → Cloudflare Worker (authenticated private service calls)\n   → DigitalOcean VPC\n      → Spine API · Agent Runtime · MCP services · workers\n   → PostgreSQL (canonical)\n```\n\n**Do not** expose PostgreSQL, Valkey, or internal agent services directly\nto the Internet.\n\n## Concrete consequences\n\n- Update `ECOSYSTEM.md` (v1.4.0) with the four-plane split, AI SDK Agent\n  Runtime on DigitalOcean, and PostgreSQL canonical storage.\n- D1 → PostgreSQL migration: convert 25 D1-bound service tables in this\n  repo; the database is the canonical Spine ontology, not a Cloudflare-local\n  substrate.\n- AI SDK Agent Runtime lands on DigitalOcean, not in a Cloudflare worker.\n- Cloudflare Agent Memory becomes a Memory Fabric adapter (foundation no\n  longer).\n- Network posture: Cloudflare is the public front door; DO is the\n  private stateful plane.\n\n## Out of scope for this ADR\n\n- Specific DO droplet sizing, VPC layout, IaC tooling (separate ADRs).\n- Concrete D1→PG migration script ordering (doc 14 territory).\n- Real provider credentials, DNS, deploy pipelines (operational).\n"}