Building a Cost-Aware Edge Telemetry Plane for PlatPhorm Trace #

PlatPhorm Trace now has a Cloudflare-backed secondary telemetry plane that improves delivery evidence without replacing the canonical trace store. The design uses Workers, Queues, D1, and KV, stays within bounded free-tier workloads, and preserves Trace's core identity: spans, lineage, replay, propagation, search, redaction, and observability scoring.

The most important architectural decision is also the simplest: Aurora PostgreSQL remains the source of truth. Cloudflare stores small delivery receipts and public-safe runtime policy, not full traces, prompts, tool arguments, request bodies, or database replicas.

The request path #

A meaningful span follows this sequence:

trace.platphormnews.com validates the protected request and writes the canonical span to Aurora.

After the product response is safe to return, Trace emits a bounded platphorm.trace.edge-event.v1 event.

The authenticated Cloudflare Worker validates the event and publishes it to a Queue.

The Queue consumer processes batches of up to 25 events with a five-second batch window and three retry attempts.

Failed messages have a dedicated dead-letter queue. Successful messages become 14-day D1 delivery receipts.

Workers KV holds public-safe policy and routing metadata.

The edge event contract is deliberately narrow: event and lifecycle identifiers, source and target services, operation, bounded duration/count/status fields, safe Vercel location metadata, and a one-way hash of the Vercel JA4 digest. Raw IP addresses, raw JA4 values, credentials, cookies, prompts, request bodies, response bodies, and tool payloads are excluded.

A production failure that improved the design #

The first Vercel-to-Worker delivery attempts returned HTTP 403 even though direct authenticated tests succeeded. Trace reported the failure honestly and continued writing to Aurora.

Cloudflare Security Events identified the actual cause: zone-level Bot Fight Mode was issuing a managed challenge to the server-to-server POST /api/v1/telemetry requests before the Worker executed. Weakening protection for the entire domain would have fixed the symptom and damaged the boundary.

Instead, the custom domain remains the public health surface, while Vercel uses the Worker's authenticated workers.dev route for ingestion. Bot Fight Mode stays enabled for the zone, and the protected machine-to-machine path reaches the Worker without pretending to be browser traffic.

Live proof #

The queued production verification trace 7fea90cdbf185c8c90edec8bfa7756c4 ↗ returned HTTP 201 for span start and HTTP 200 for completion. Cloudflare then persisted two D1 receipts:

• span.started
• span.completed

Both receipts retained the Vercel execution region (iad1) and confirmed that a JA4 digest was captured and hashed. The raw digest was never returned by the receipt API or stored in the public-safe event contract. The Queue processed both events approximately six seconds after they were emitted, matching the configured batch window.

The public health surfaces are available at:

• Trace health ↗
• Trace edge health ↗

What is enabled—and what is not #

The current secondary plane uses:

• Workers for authenticated validation and ingestion.
• Queues for asynchronous delivery, retries, and dead-letter routing.
• D1 for bounded delivery receipts.
• Workers KV for public-safe policy and routing metadata.

Analytics Engine remains behind ANALYTICSENGINEENABLED=false. That is an explicit product flag, not a missing success claim. It can be enabled later after the account product and reporting requirements are ready.

R2 is not enabled because the Cloudflare account currently returns entitlement error 10042. When enabled, R2 is a good candidate for redacted, immutable export bundles and larger evidence artifacts—not canonical transactional spans.

Hyperdrive is available on the account, and the Aurora instance is publicly reachable. It is not connected yet for two reasons. First, Hyperdrive accelerates database access from Workers; it does not transparently accelerate the existing Vercel Node pg pool. Second, a durable configuration requires a dedicated least-privilege database login. Reusing Trace's production credential would unnecessarily widen its exposure. The existing PostgreSQL security-group boundary must also be tightened as the Vercel and Cloudflare network design evolves.

Cloudflare documents a limited Hyperdrive allowance on the Workers Free plan and recommends dedicated database credentials plus explicit network access for AWS Aurora. Those are useful primitives, but they only create value when a real Worker-owned query path exists.

Cost and reliability posture #

This design keeps each system focused on what it does best:

• Aurora owns relational trace truth and application queries.
• Vercel owns the Trace application and safe request metadata capture.
• Cloudflare owns bounded asynchronous delivery evidence at the edge.

If Cloudflare is unavailable, Trace continues to persist canonical spans and emits a redacted degradation warning. If Aurora is unavailable, Trace presents storage degradation rather than an empty success. Neither side fabricates data to make a dashboard look healthy.

The result is a faster, more observable trace pipeline with explicit failure boundaries, low infrastructure cost, and a clear path to R2, Hyperdrive, and Analytics Engine when each service has a justified workload.

References #

• Cloudflare Hyperdrive getting started ↗
• Connecting Hyperdrive to AWS RDS and Aurora ↗
• Cloudflare Hyperdrive pricing ↗
• Cloudflare Security Events ↗
• Vercel sensitive environment variables ↗