Appendix
Connection Matrix
Every connection between components, with protocol, direction, and purpose
Every connection between components, with its protocol, direction, and purpose. One row per arrow in the topology diagram.
| From | To | Protocol | Purpose |
|---|---|---|---|
| Browser | Cloudflare edge | HTTPS | Every app, editor and console request |
| Cloudflare Worker | ALB | HTTPS | Proxied app requests with host and path as query params |
| ALB | HTTP, WS, git, sandbox-proxy roles | HTTP | Routed by host |
| HTTP role | Aurora via RDS Proxy | PostgreSQL over TLS | Reads and writes |
| Every role | Valkey | RESP | Cache, events, coordination |
| Every role | S3 | HTTPS via gateway endpoint | Objects in the workspace's region |
| HTTP role | Sandbox orchestrator | HTTP, internal route | Provision, stop, pool state |
| Sandbox orchestrator | Untrusted Kubernetes API | HTTPS over peering | Create, watch, label, delete pods |
| HTTP role | Release sandbox | HTTP over peering, worker port | Execute a method |
| Release sandbox | HTTP role | HTTPS via callback origin | Database queries, hook endpoints, model calls |
| Sandbox-proxy role | Dev box | HTTP and WebSocket over peering, dev-box port | Preview, control channel, language server |
| Git role | S3 | HTTPS | Mirror every push |
| Git role | Job runner via orchestrator | HTTP | Compile a release |
| Worker roles | SQS | HTTPS | Long-poll queues |
| HTTP role | Firehose | HTTPS | Audit events |
| Model service | Bedrock | HTTPS over PrivateLink | Inference |
| Model service | First-party providers | HTTPS via NAT | Inference |
| Worker role | SES | HTTPS | Outbound email |
| Internet | NLB to mail-inbound role | SMTP | Inbound email |
| Voice worker | LiveKit | WebRTC and WebSocket | Media |
| S3 | SNS to SQS | Events | File scan triggers |
| Provisioner | Trusted Kubernetes API | HTTPS | Dedicated Qdrant StatefulSets |