Follow the work through the platform.
Focused diagrams, from the full deployment to the individual workflows. Open a vector image for detail or download its editable Mermaid source.
Original Golf diagrams · reviewed October 14, 2026The native platform
How source, authority, execution and protected delivery connect.
The full Cloudflare architecture
The complete responsibilities and service boundaries.
Source, state and private outputs
Artifacts Git, D1 domain state, R2 outputs and managed registry.
The execution pipeline
Exact-source admission through queue, workflow, container and private evidence.
AI advice and proposals
Metadata-only Clef advice and separately tested code proposals.
Protected previews
Static and managed application delivery with current reader checks.
Identity, permission and secret release
Access enrollment, Golf grants and exact-approved workflow values.
Notifications and maintenance
D1 outboxes, accepted messages and maintenance fallback.
The change lifecycle
Current evidence and previews, with merge/CD acceptance boundaries.
The portable architecture
Forgejo, Go, separate PostgreSQL ownership and optional execution.
Docker placement and storage
Golf, Forgejo and PostgreSQL run as separate services. Named volumes retain state; execution is separately allocated.
Kubernetes placement and ownership
API replicas share one forge writer and retained PVCs. Spread and disruption controls protect API rollouts; whole-stack HA remains unqualified.
Native Cloudflare placement
Workers own the application, Artifacts owns Git, D1 owns collaboration, and configured provider services execute and deliver work.
See the architectural ideas.
Four original illustrations complement the exact diagrams. Service names, permissions and evidence stay in the accompanying text.
Artifacts source, D1 state, R2 private outputs and registry images have distinct responsibilities.
Open full-size illustration ↗
Admitted work moves through Queues, Workflows and Containers to private evidence.
Open full-size illustration ↗
Clef advice uses metadata. Code proposals use separate forks and tests before review.
Open full-size illustration ↗
Static and Worker previews have different serving paths, data scopes and expiration.
Open full-size illustration ↗