P2 — Cloudflare API + VM pipeline services

Edge API on Workers (Hono); pipeline on the Netcup VM; Workflows orchestrates via Cloudflare Tunnel.

flowchart LR
    WEB[Vercel web] --> API[Workers - Hono API]
    API --> M[(MongoDB Atlas - tenants, runs, jobs)]
    API --> WF[Workflows - run orchestration]
    WF --> Q[Queues]
    WF -->|Tunnel| VM[Netcup VM - pipeline + LiteLLM]
    VM --> O[(Hetzner OBJ - media)]
    VM --> LLM[LiteLLM - agent-agnostic LLM + BYOK]

Steps

1. Workers API (Hono + Zod + mongoose): /runs, /projects, /tenant/config, /media, HITL approve/reject — WorkOS JWT at the edge, MongoDB-backed
2. Cloudflare Workflows + Queues orchestrate runs (durable steps, step.waitForEvent at HITL checkpoints, format_direction branch)
3. MongoDB Atlas (mongoose): tenants, projects, runs, jobs, meters
4. Hetzner Object Storage (S3 API) media with per-tenant prefixes + signed URLs
5. Netcup VM Docker Compose stack: pipeline container (FastAPI entrypoints reusing existing python/ code), LiteLLM container, cloudflared — zero public ports
6. LiteLLM: agent-agnostic LLM layer, per-tenant virtual keys, hosted + BYOK
7. HITL checkpoints as API endpoints — replaces state/pipeline.json

Acceptance criteria

• Full pipeline runs headless via API with job status tracking, all format_direction values
• HITL approvals flow through the API
• Artifacts land in Hetzner OBJ; run state survives restarts in MongoDB

Full detail + mermaid diagrams: PLAN.md, docs/lld.md

Start with PLAN.md and docs/lld.md, then inspect the existing python/ code and the planned service boundaries. Trace how the Workers API, Workflows, VM pipeline, HITL checkpoints, and MongoDB state fit together. Done means the listed acceptance criteria pass: headless runs and status tracking, HITL approvals, artifact storage, and restart-safe run state.