Canonadr

ADR-2026-09-03-04 — Cloudflare + DigitalOcean hybrid infrastructure

Status: APPROVED — 2026-09-03 (founder ruling)

Ruling

Adopt a four-plane hybrid: Cloudflare for edge/AI, DigitalOcean for
stateful application infrastructure, Spine for business ontology, AI SDK for
agent execution. The infrastructure can change without changing the product
ontology.

EDGE PLANE          CLOUDFLARE       (DNS, WAF, CDN, Workers, R2, Pipelines,
                                     Realtime, AI Gateway, Vectorize, AI Search,
                                     Workers AI, Browser Run)

SPINE PLANE         DIGITALOCEAN     (PostgreSQL, Spine services,
                                     Valkey, MCP services,
                                     background workers, Docker)

AGENT PLANE         DIGITALOCEAN     (AI SDK Agent Runtime,
                                     long-running workflows,
                                     internal admin services,
                                     heavy background processing)

AI/RETRIEVAL PLANE  CLOUDFLARE       (Vectorize, AI Search, Workers AI,
                                     AI Gateway, R2)

The four principles

  1. Cloudflare ≠ Spine — Cloudflare is the edge/AI plane.
  2. DigitalOcean ≠ Spine — DigitalOcean is the stateful app plane.
  3. AI SDK ≠ Spine — AI SDK is the agent orchestration plane.
  4. PostgreSQL ≠ Spine — the database is the canonical store substrate.

Spine = architectural ownership of business truth/context/work.
The product ontology survives the infrastructure choice.

Storage transition (D1 → PostgreSQL)

Replace D1-as-canonical-truth with PostgreSQL as the canonical Spine
store (Neon in dev, DigitalOcean Managed Postgres in prod). D1 may
remain for Cloudflare-local edge projections, but never as the
authoritative business ontology.

Agent runtime (AI SDK, not Cloudflare Agents SDK)

AI SDK Agents is the run substrate for Twin and specialists. The AI
Agent Runtime lives on DigitalOcean (not as a Cloudflare worker).
Contextual memory continues to be served by the Memory Fabric; Cloudflare
Agent Memory is an optional native memory backend, not the
architectural foundation.

Network topology

Internet
   → Cloudflare DNS → WAF → CDN → Rate limiting → Edge routing
   → Cloudflare Worker (authenticated private service calls)
   → DigitalOcean VPC
      → Spine API · Agent Runtime · MCP services · workers
   → PostgreSQL (canonical)

Do not expose PostgreSQL, Valkey, or internal agent services directly
to the Internet.

Concrete consequences

  • Update ECOSYSTEM.md (v1.4.0) with the four-plane split, AI SDK Agent
    Runtime on DigitalOcean, and PostgreSQL canonical storage.
  • D1 → PostgreSQL migration: convert 25 D1-bound service tables in this
    repo; the database is the canonical Spine ontology, not a Cloudflare-local
    substrate.
  • AI SDK Agent Runtime lands on DigitalOcean, not in a Cloudflare worker.
  • Cloudflare Agent Memory becomes a Memory Fabric adapter (foundation no
    longer).
  • Network posture: Cloudflare is the public front door; DO is the
    private stateful plane.

Out of scope for this ADR

  • Specific DO droplet sizing, VPC layout, IaC tooling (separate ADRs).
  • Concrete D1→PG migration script ordering (doc 14 territory).
  • Real provider credentials, DNS, deploy pipelines (operational).