Architecture Overview

Branch and runtime boundary

The deployed-engine lineage is son-of-anton-review on feat/cloudflare-native. The extended Cloudflare operator API is in son-of-anton-operator-parity on unmerged feat/greptile-operator-parity. The React parity dashboard is a third tree, anton-ui-trace-parity. These are not one deployable source tree.

The native Worker's public handler serves GET /health and POST /github/webhooks, not the parity /operator/api/* routes. The engine also contains a separate Node dashboard implementation in src/operator-dashboard.js; its GET-only API is not mounted by the native Worker.

Sources: engine cloudflare-native/src/ingress.js:264-273; parity cloudflare/src/worker.js:93-157; engine src/operator-dashboard.js:609-690. Deployment lineage is the supplied handoff, not a live deployment probe.

Native review flow

1. Ingress verifies the webhook signature, checks the delivery ID in KV, records the delivery and queues an intent. This is not review-key deduplication at ingress. KV is eventually consistent; duplicate enqueues remain possible.
2. The consumer hydrates oversized payloads from R2 and resolves a missing head SHA. Ordinary issue-comment chatter is acknowledged without a review dispatch.
3. A D1 compare-and-set lease selects a dispatcher for the review key and publish mode. The container is addressed by review key, not guaranteed to be a newly created process on every attempt.
4. The container hydrates run state, constructs CodexReviewRunner and ReviewService, and invokes analysis unless durable analysis already succeeded. The runner checks out the pinned head SHA.
5. ReviewService stores the analysis result and publishes through the selected publisher. Native publication claims go through an awaited D1 transport before GitHub writes. Model calls and publication are distinct failure stages.

Sources: engine cloudflare-native/src/ingress.js:295-346, cloudflare-native/src/consumer.js:331-419, cloudflare-native/container/entrypoint.mjs:82-157,234-313,345-385, src/codex-review-runner.js:2843-2844, src/review-service.js:342-464.

Identity and publication

A normal review key is owner/repo#prNumber@headSha. A manual comment can add :manual-<commentId> so a new command on an unchanged head is a distinct request. Redelivery of that same comment retains its identity. The dispatch action is container-dispatch for live publication and container-dispatch:shadow for shadow publication.

This reduces duplicate work; it is not a blanket exactly-once guarantee. A GitHub write and a D1 receipt cannot be committed atomically. An uncertain native publication is blocked pending reconciliation, rather than automatically retried after a timeout.

Check runs are created or patched when a check-run ID exists. PR reviews are POSTed, with an anton-review marker and the run's commit SHA; they are not updated in place. Receipt comments are a separate action. See Queue and durability.

Sources: engine cloudflare-native/src/consumer.js:33-37,287-304; cloudflare-native/src/state-transport.js:490-524; src/github-publisher.js:22-79; src/review-service.js:181-191.

Configuration versus optional features

OpenRouter is the recommended provider. The native container selects GILF_MODEL_PROVIDER, then GILF_CODEX_PROVIDER, then openrouter. Its checked-in Worker configuration selects OpenRouter and a model through GILF_MODEL. OpenAI, Anthropic and Codex paths are alternatives, not evidence that each is provisioned in a deployment.

Hypothesis-primary, the LLM planner and model inversion are optional runner paths, not mandatory stages of every native review. The runner's V5 configuration defaults these paths off, and their activation variables are absent from container-env.js's forwarding allowlist. Setting them only on the Worker does not enable them in the container. Shadow validation has separate configuration and is forwarded.

Sources: engine cloudflare-native/container/entrypoint.mjs:314-324; cloudflare-native/wrangler.jsonc:132-161; src/codex-review-runner.js:2303-2312; cloudflare-native/src/container-env.js:15-85.

Node self-host is a separate deployment shape

server.mjs receives requests and worker.mjs drains jobs. They use the same review-service module, but have different runtime wiring from the native container.

Worker queue selection is, in order: both GILF_QUEUE_URL and GILF_QUEUE_TOKEN, then SQLite at GILF_QUEUE_DB_PATH, then SQLite at GILF_DB_PATH, then an in-memory queue. Omitting persistence does not default to durable SQLite. Node processes can load the App private key locally; the native broker separation does not automatically apply to them.

Sources: engine src/worker-runner.js:29-39; server.mjs:27-59; worker.mjs:20-40.

Next pages

• Cloudflare-native runtime: bindings, container transport and cron schedules.
• Key broker: implemented token scoping and its remaining trust boundary.
• Security model: isolation controls, credentials and authorization limits.
• Observability and cost: traces, missing data and estimates.
• Operator API: the unmerged API contract, not native ingress routes.