Option A — Cloudflare-native Gateway egress

Option A — Cloudflare-native Gateway egress An architecture diagram generated by Archify. Room coordinator · turn admission · Architecture component Room coordinator turn admission ze-harness · GatewayProviderDefinition · Architecture component ze-harness GatewayProviderDefinition TAP Gateway · Cloudflare Worker · Architecture component TAP Gateway Cloudflare Worker Provider · OpenAI, OpenRouter, Anthropic · Architecture component Provider OpenAI, OpenRouter, Anthropic Credential vault · D1 ciphertext and delegation · Architecture component Credential vault D1 ciphertext and delegation memory-only turn lease call identity and lease provider request and stream authorize and decrypt Legend Backend Database External

Gateway player

  • • The Cloudflare Worker is the Gateway: it admits turns, resolves D1 credentials, and calls providers.

Admission

  • • Gateway issues the short-lived lease after binding and turn admission.

Custody

  • • D1 stores ciphertext; a Cloudflare secret-backed application key protects records.

Trade-off

  • • One operational plane; moving custody later migrates storage and crypto.