Option B — AWS custody-first Gateway egress

Option B — AWS custody-first Gateway egress An architecture diagram generated by Archify. Room coordinator · Architecture component Room coordinator Cloudflare control plane · Architecture component Cloudflare control plane ze-harness · Architecture component ze-harness AWS Gateway and Custody · Architecture component AWS Gateway and Custody DynamoDB key store · Architecture component DynamoDB key store KMS root key · Architecture component KMS root key Credential vault · Architecture component Credential vault Provider · Architecture component Provider binding ID and turn ID memory-only turn lease call identity and lease branch-key lookup decrypt branch material credential by binding ID provider request and stream Legend Backend Database Cloud Security External

Gateway player

  • • AWS Custody is the Gateway to ze-harness and providers. Cloudflare admits turns and returns leases only.

Custody boundary

  • • AWS owns KMS, DynamoDB, credential resolution, and provider calls.

Cache boundary

  • • Only AWS caches branch material; prompt affinity is per binding revision and harness session.

Trade-off

  • • Independent custody and KMS policy, with a cross-cloud streaming boundary.