Part II · §4–6 · Cloudflare-First

One edge-native platform.
Every workload on the right primitive.

Workers at the edge for API and runtime · PostgreSQL via Hyperdrive for transactional truth · Durable Objects for realtime state · Workflows for long processes · R2 for artifacts · Queues for events · Vectorize for RAG · Agents SDK for persistent AI departments.

§4 · Cloudflare topology

The production topology.

Internet → Edge security → Gateway → Domain services → Event/durability → Data → AI. Every request follows this path. Every service knows where it sits.

7 TIERS

◉ Internet

↓

Cloudflare Edge

DNS

WAF

Turnstile

Rate Limiting

Bot Mgmt

Access

↓

FM1 Edge API Gateway · Workers

Auth/Policy

API Router

Tenant Resolver

↓

Domain Services

CRM

Funding

Messaging

Workflow

Partners

↓

Event + Durability

Queues

Workflows

Durable Objects

↓

Data Layer

PostgreSQL · Hyperdrive

Cloudflare R2

Vectorize

D1 (edge)

KV (cache)

↓

AI Gateway

Workers AI

External providers

Agents SDK

§5 · Cloudflare responsibility map

Every requirement · a Cloudflare service.

Where each workload runs. What primitive owns what job. No overlap, no ambiguity.

20 SERVICES

Requirement	Cloudflare service	Class
API / runtime	Workers	CORE
Web application	Workers + React	CORE
Main relational database	PostgreSQL + Hyperdrive	DATA
Edge/isolated SQL cases	D1	DATA
Object storage	R2	DATA
Live conversations / presence	Durable Objects	REALTIME
Agent runtime	Agents SDK + Durable Objects	AI
Long business processes	Workflows	ORCHESTRATION
Async event processing	Queues	ORCHESTRATION
Semantic retrieval	Vectorize	AI
AI gateway / policy	AI Gateway	AI
Cloudflare inference	Workers AI	AI
Custom domains	Cloudflare for SaaS · Custom Hostnames	EDGE
User-code isolation (later)	Workers for Platforms	EDGE
Cache / config	KV	DATA
Security	WAF · Turnstile · Rate Limiting · Access	SECURITY
Logs / telemetry	Workers Observability + external SIEM	OBS
Secrets	Workers Secrets · approved secret store	SECURITY

§9 · Tenant isolation rules

10 rules · zero-trust by construction.

Not enforced by developer discipline. Enforced by the framework. Every repository query, every AI retrieval, every signed URL — tenant-scoped.

MULTI-TENANCY

01Every repository query requires tenant context — no exceptions.

02Cross-tenant admin access requires privileged capability + audit event.

03All impersonation is audited with reason capture.

04Partner portal receives field-level filtered projections only.

05Applicant portal only accesses linked business/application.

06Signed R2 URLs are tenant-scoped and short-lived.

07AI retrieval filters on tenant + authorization before vector search.

08Tenant export is explicit, authorized, and audited.

09Cross-tenant aggregates use sanitized warehouse views.

10Production support impersonation requires reason capture + expiry.

§8 · Tenant hierarchy · row contract

Every tenant-scoped row · the same contract.

No tenant-scoped API accepts tenant_id from client. Tenant context is always resolved from authenticated identity.

PLATFORM HIERARCHY§8

PLATFORM
  │
  ├── FUNDING MACHINE INTERNAL
  │
  ├── OPERATOR COMPANY
  │     ├── LOCATION
  │     │    ├── TEAM
  │     │    └── USERS
  │     ├── PARTNERS
  │     └── CLIENTS
  │
  └── ENTERPRISE / WHITE LABEL
        ├── BRAND
        ├── LOCATION
        └── USERS

REQUIRED COLUMNSEVERY BUSINESS ROW

// Every tenant-owned row must include:
tenant_id       uuid   -- not null
location_id     uuid   -- where relevant
created_at      timestamptz
updated_at      timestamptz
created_by      uuid
updated_by      uuid
row_version     bigint   -- optimistic concurrency

§7 · Repository structure

Monorepo · 8 top-level trees.

Apps → Workers → Agents → Workflows → Packages → Database → Contracts → Infrastructure. Every code change belongs somewhere obvious.

funding-machine-one/

apps/

User-facing applications

8 apps · operator-web · admin-web · applicant-portal · partner-portal · lender-portal · public-forms · page-builder · developer-portal

workers/

API + domain services

44+ workers · api-gateway · auth · crm · applications · credit · underwriting · fundability · lender-intelligence · funding-plans · offers · documents · esign · conversations · workflows · partners · commissions · migration · ai-orchestrator

agents/

AI departments

15 agent teams · sales · credit · underwriting · bank-statements · documents · fundability · lender-match · funding-strategy · client-success · reactivation · compliance · partner-success · marketing · revenue · executive

workflows/

Durable business processes

8 workflows · applicant-intake · funding-process · document-collection · requalification · invoice-collection · partner-onboarding · reactivation · verticals

packages/

Shared libraries

13 packages · domain · events · authz · database · ui · validation · crypto · observability · ai · workflow-sdk · integration-sdk · test-fixtures · generated-api-client

database/

Schema authority

migrations · seeds · schemas · views · policies · never modify prod schema ad hoc.

contracts/

Machine-readable interfaces

openapi · events · webhooks · agent-tools. Every service publishes contracts here.

infrastructure/

Deployment + monitoring

cloudflare · terraform · environments · dashboards · alerts. IaC first.

One edge-native platform.Every workload on the right primitive.