direction: down

clients: "Wrangler + organization console"
control: "Control plane\nRBAC · ownership · immutable versions\ndurable cleanup outbox"
runtime: "Fixed workerd pool\ndynamic Worker isolates\nD1 + assets + AI + Vectorize clients\ntrusted resource-scoped capabilities"

database: "Shared database service\nSQLite file per database\natomic batch · authorizer · deadlines"
assets: "Shared assets service\nvalidated uploads · immutable manifests\nHTML routing · ETag · streaming · retention"
models: "Models service\nencrypted tenant credentials\nchat · embeddings · reranking"
vectors: "Vector search service\norganization-scoped SQLite indexes\nexact local similarity search"

storage: "Existing storage workerd\nprivate asset blobs\nnot tenant-visible R2 buckets"
quotas: "Quota service\norganization allowances + holdings"
telemetry: "Alloy → Prometheus / Loki / Tempo\nprovisioned Grafana diagnostics"

clients -> control: "organization credentials"
control -> runtime: "code + versioned capabilities"
control -> database: "manage / query"
control -> assets: "upload / publish / release"
control -> models: "provider lifecycle"
control -> vectors: "index lifecycle"
runtime -> database: "DB.prepare() · fixed org + database"
runtime -> assets: "ASSETS.fetch() · fixed org + version"
runtime -> models: "AI.run() · fixed organization"
runtime -> vectors: "Vectorize API · fixed org + index"
assets -> storage: "immutable bytes"
database -> quotas: "database count + allocated pages"
assets -> quotas: "unique bytes + upload sessions"
models -> quotas: "providers + inferences"
vectors -> quotas: "indexes + vectors + operations"
database -> telemetry: "duration · admission · commit · outcomes"
assets -> telemetry: "first byte · completion · failures"
models -> telemetry: "task · provider · outcome · duration"
vectors -> telemetry: "operation · outcome · duration · count"