direction: right

host: "macOS workstation" {
  wrangler: "Wrangler\nbundle + deploy"
  client: "Worker client"
  browser: "Customer / admin browser"
}

control: "control-01" {
  identity: "Identity + RBAC\norganization state"
  access: "Access gateway\napplication policy"
  console: "Tenant + admin portals"
  api: "Control plane\ndeployment state + artifacts"
  certificates: "Certificate manager\nCertbot + desired tenant names"
  dataplane: "HAProxy Data Plane API"
  haproxy: "HAProxy\nhostname → Worker + version"
}

compute: "Schedulable compute capacity" {
  c1: "compute-01" {
    p1: "workerd pool 0..3"
  }
  c2: "compute-02" {
    p2: "workerd pool 0..3"
  }
  dispatcher: "Trusted runtime dispatcher\ncapability injection"
}

data: "Explicit data placement" {
  d1: "data-01\nobject storage + assets + Images"
  d2: "data-02\nqueues + key-value + databases\nshared native Durable Object members + Cron"
}

observe: "observe-01\nPrometheus · Loki · Tempo · Grafana"
network: "WireGuard private service network"
acme: "ACME CA + DNS provider\npublic hosting or private rehearsal"

host.wrangler -> control.api: "1  upload immutable version"
host.browser -> control.console: "organization + platform administration"
control.console -> control.identity: "session + RBAC"
control.console -> control.access: "groups · policies · service tokens"
control.console -> control.api: "authorized APIs"
control.api -> control.identity: "authorize credential + operation"
control.certificates -> control.identity: "authenticated organization inventory"
control.certificates -> acme: "DNS-01 issuance + renewal"
control.certificates -> control.haproxy: "atomic bundle publication\nvalidate then reload"
control.api -> data.d1: "resource lifecycle"
control.api -> data.d2: "resource lifecycle"
control.api -> control.access: "protection snapshot"
control.api -> control.dataplane: "2  publish complete route set"
control.dataplane -> control.haproxy: "atomic validated reload"
host.client -> control.haproxy: "3  tenant Worker hostname"
control.haproxy -> control.access: "protected hostnames"
control.access -> control.identity: "login + membership"
control.access -> control.haproxy: "private authenticated return path"
control.haproxy -> compute.c1.p1: "consistent-hash scheduling"
control.haproxy -> compute.c2.p2: "consistent-hash scheduling"
compute.c1.p1 -> compute.dispatcher
compute.c2.p2 -> compute.dispatcher
compute.dispatcher -> control.api: "authenticated artifact fetch\non immutable cache miss"
compute.dispatcher -> data.d1: "explicit storage / asset / image capabilities"
compute.dispatcher -> data.d2: "explicit queue / KV / database capabilities"
compute.dispatcher -> data.d2: "authenticated stateful Worker forwarding"
data.d2 -> compute.dispatcher: "alarm-driven scheduled invocation"
control -> network
compute -> network
data -> network
observe -> network

ownership: "Ownership" {
  ansible: "Ansible owns node placement, private networking, fixed runtime\ncapacity, HAProxy, certificate-manager configuration, services, portals, and observability."
  deploy: "Wrangler owns application versions and desired routes.\nA deployment never creates a VM or systemd unit."
  capacity: "Compute and native Durable Object pools use fixed members.\nAdditional members add placement capacity, not HA mirroring or state replication."
}