AIVIS Edge Connector — Architecture
AIVIS-EDGE · Spec / Architecture 06 Aug 2026 · v1 · rev 3

The Cloudflare Edge Connector

How AIVIS ships JSON-LD to customer websites without touching their CMS — updated in seconds, measured at the edge, and safe even if AIVIS itself were compromised.

Rev 3 — invalidation · analytics opt-in · zero-trust · open source Audience: Daniel + builder hand-off Companion: Full Specification 📘

A small Cloudflare Worker, deployed into each customer's own Cloudflare account, pulls that customer's approved JSON-LD from the live AIVIS Public API, caches it at the edge, and injects it into every HTML page just before </head>. No CMS access, no customer code changes. Updates go live in seconds via targeted cache purge. The worker treats AIVIS itself as untrusted input — a hacked AIVIS could never execute code on a customer site. Crawler analytics is a per-customer setting; off means zero data leaves their account. And the connector itself is an open-source project — every security team that must approve it can read the exact code.

§ 1 · The problem

Delivery is the last manual mile

AIVIS already generates and validates one Schema.org @graph document per URL. Getting it onto the page is where it stalls: today a strategist downloads a zip (implementation brief, manifest, llms.txt) and the customer's engineers paste snippets into their CMS. That takes days to weeks per change, and pages where the CMS is locked (is_editable = false) get no JSON-LD at all — by design (ADR-0004).

The connector replaces that hand-off with injection at the CDN edge. Publication latency drops from weeks to seconds, and the locked-CMS restriction disappears entirely — the worker rewrites the response, not the CMS.

TODAY — MANUAL HAND-OFF AIVIS app generates + validates zip hand-off brief · manifest · llms.txt client engineers paste into CMS CMS release their schedule page days–weeks per change · impossible where the CMS is locked (is_editable = false) V1 — EDGE CONNECTOR AIVIS Public API already live aivis-edge worker customer's Cloudflare page pull · cached · purgeable inject before </head> seconds to live · zero CMS involvement · locked pages included
The two human hops in the middle — engineers and a CMS release cycle — are exactly what the worker removes.

§ 2 · Architecture

The system at a glance

Three trust zones. The worker lives in the customer's Cloudflare account and is the only new thing in the serving path. AIVIS stays a pull origin behind a cache — if it is slow or down, pages serve exactly as before. The ops CLI is AIVIS's management plane, talking only to the Cloudflare API with a scoped token — including targeted cache purges, so a regeneration in AIVIS is live on the page in seconds (§3).

CUSTOMER'S CLOUDFLARE ACCOUNT zone route: customer.com/* Visitor · AI crawler every user agent aivis-edge Worker HTMLRewriter · zero-trust · fail-open Customer origin CMS untouched Edge cache Cache API · per-colo · TTL + SWR purgeable per URL / per domain — global, seconds 1 · GET /page 5 · HTML + JSON-LD injected 2 · fetch (streamed) 200 · text/html 3 · lookup — hit ≈ 1 ms 4 · on miss: GET /jsonld?url=… Bearer aivis_… · budget ≤ 150 ms 6 · events — only if analytics on AIVIS — EXISTING APP Public API v1 live · GET /jsonld?url=… Events ingest — new POST /api/public/v1/events AIVIS ops CLI management plane deploy · secrets · purge kill switch · scoped CF token
Dashed containers are trust boundaries; the dashed box is the only new AIVIS-side endpoint. Numbers match the request walkthrough in §3. AIVIS also auto-triggers a purge after each JSON-LD regeneration (spec V-03).

§ 3 · Runtime behaviour

One request, step by step

  1. 1Request arrives on the customer's zone.Every user agent — humans and bots get identical treatment (invariant I3).
  2. 2Origin fetch starts immediately, streaming.Non-GET requests and non-HTML routes pass through completely untouched.
  3. 3JSON-LD lookup runs in parallel: edge cache first.The page URL is normalized (host, trailing slash, tracking params stripped), then checked against the per-colo cache. A hit costs ≈ 1 ms.
  4. 4On a miss, pull from the AIVIS Public API — inside a hard budget.GET /api/public/v1/jsonld?url=… with the bearer token. Every payload passes the zero-trust pipeline (§4 D9) before it may be cached. Over budget: skip this request, warm the cache in the background. 404s are negative-cached; API errors serve last-known-good.
  5. 5Inject and respond.Only on 200 · text/html: HTMLRewriter streams the body through and inserts one <script type="application/ld+json" data-aivis> before </head>. Everything else in the page is byte-identical.
  6. 6After the response: bookkeeping.Only when analytics is enabled: waitUntil() flushes batched events. Cache refreshes also happen here — never on the visitor's clock.
Added latency per request — budgets to validate (spec §08), not measurements. The worst case is bounded by design: the page always ships, with or without injection.

Freshness — commanded, not hoped for

Schema entries are cached under synthetic URLs on the customer's own zone, which makes them addressable by Cloudflare's global purge API (propagates in seconds, all data centers). The worker's local cache.delete() is deliberately not used — it only clears one data center.

EventLive on site withinMechanism
JSON-LD regenerated in AIVISSecondsAuto purge hook: regenerate → single-file purge of that URL's cache key (spec V-03)
Manual per-URL invalidationSecondsops invalidate --url · later a dashboard button
Manual per-domain invalidationSeconds–minuteBatched purge over the business's URL inventory (AIVIS already has it) — never purge_everything
Retract a bad JSON-LD ("unpublish", no replacement)SecondsUnpublish in AIVIS ⇒ API returns 404 + auto-purge; a confirmed 404 also clears last-known-good, so a retracted block can never resurrect during an API outage (spec C-10 / V-08)
No purge rights (self-managed)≤ 5 minTTL expiry; epoch-bump redeploy as the manual lever

§ 4 · Decisions

What's locked, what's a default

Six calls are locked from our sessions; four more are recommended defaults — challenge those in the deep-dive specs, not during the build.

Locked · D1

Runs in the customer's Cloudflare account

AIVIS operates it via a scoped API token; traffic never routes through AIVIS infrastructure. A self-managed sub-mode (their platform team deploys the same package) covers strict enterprises — see §6.

a CNAME proxy through an AIVIS-owned zone — serving-path liability and an enterprise-procurement wall.

Locked · D2

Pull, don't push — with commanded freshness

The worker pulls GET /jsonld?url=… from the live Public API and caches at the edge. Targeted purges (per URL, per domain) make updates live in seconds despite the cache.

a KV-push pipeline — needs publish-state models and a Cloudflare write path that don't exist yet; revisit later as an optimization.

Locked · D3

v1 = injection + optional crawler analytics

Analytics feeds the Monitoring subscription — the recurring-revenue layer — with data nobody can collect from outside. llms.txt serving and visible FAQ injection stay fenced out (§10).

a broader v1 — each extra surface adds a different risk class.

Locked · D8

Analytics is a customer setting — off means zero egress

Deploy-time flag, default off (enterprise) and on for SMB. When off, the classifier never runs and no request-derived byte leaves their account toward AIVIS — a contractual statement, verifiable in their own Workers logs (invariant I8).

always-on telemetry — an instant no from enterprise privacy teams.

Locked · D9

Zero-trust ingestion — AIVIS is untrusted input

Every payload is strictly parsed, re-serialized with angle brackets escaped (script-breakout XSS becomes structurally impossible), shape/size-checked, bound to the business and domain, and optionally signature-verified against a key pinned in the customer's account. A hacked AIVIS can at worst serve wrong data, never code (invariant I7, spec §07).

trusting the API because "we control it" — the assumption every supply-chain attack feeds on.

Locked · D10

Open source from day one

The connector repo is public on GitHub (Apache-2.0 recommended), with signed releases and provenance. It runs in customer accounts anyway — public code turns the enterprise security review into an audit invitation, and self-managed deployment becomes normal OSS consumption. The AIVIS platform behind it stays private (spec §12).

gating the connector as proprietary — protects nothing that isn't already in customer hands, and costs the trust asset.

Default · D4

Same HTML for every user agent

Bot-only injection is textbook cloaking risk, and it contradicts AIVIS's own Content-Parity doctrine (Methodenpapier). Everyone gets the same page.

injecting only for AI crawlers to "save" latency for humans.

Default · D5

Fail-open, always

Any internal error returns the origin response untouched. The kill switch is removing the worker route via the Cloudflare API — instant, and it involves zero connector code.

fail-closed or "maintenance" behaviour — a schema vendor must never be able to take a customer site down.

Default · D6

Additive only

The worker inserts exactly one tagged script element. It never edits or removes existing markup; pre-existing on-page schema stays untouched, with conflicts reported through analytics. Withdrawing our own injected block needs no markup surgery — unpublish + purge stops injection in seconds (§3).

replacing or merging on-page JSON-LD — powerful, but a v2 conversation (spec §03).

Default · D7

Operator-run onboarding

v1 provisioning is an internal CLI run by the AIVIS team per customer — which matches the managed-service positioning. No self-serve dashboard yet.

building a customer-facing "Connect Cloudflare" flow before there's a fleet to justify it.

§ 5 · Components

Five parts, two of them small

worker/

The edge worker

  • Request gates: GET · HTML route · 200 response
  • URL normalization matching how AIVIS stores URLs
  • Origin fetch and schema lookup in parallel
  • Zero-trust ingestion: parse · sanitize · validate · bind · verify (spec §07)
  • Streaming HTMLRewriter injection before </head>
  • TypeScript · Cloudflare Workers runtime
worker/ · cache

Schema resolution & cache

  • Cache API under synthetic per-URL keys on the customer zone — purgeable by construction
  • TTL + stale-while-revalidate · negative caching · last-known-good on upstream failure
  • Per-URL / per-domain invalidation via CF purge API — global, seconds (spec §03)
  • Hard latency budget; warm-in-background on miss
ops/

Provisioning CLI

  • connect — validate the customer CF token + zone
  • deploy · verify (synthetic check of live pages)
  • invalidate --url | --domain — the purge surface
  • pause / resume — the route kill switch
  • uninstall · staged fleet upgrade
worker/ · analytics

Analytics pipeline (opt-in)

  • Off by default; off = zero egress (D8 / I8)
  • AI-crawler user-agent registry (§7)
  • Events: bot traffic + injection health only — no IPs, no humans
  • Batched via waitUntil; loss-tolerant by design
aivis app

AIVIS-side additions

  • Business-scoped API tokens — prerequisite; today's tokens are user-scoped (spec V-02)
  • POST /api/public/v1/events — ingest (new)
  • Regenerate → purge hook + EdgeConnection model (spec V-03)
  • Serve-gate: only validation-clean artifacts by default (spec V-04)
  • Artifact signing — enterprise option (spec V-05)

§ 6 · Delivery & handover

What the customer gets

The worker always runs in the customer's Cloudflare account — in both modes. The only variable is who holds deployment rights. That's why the Allianz handover is a permissions change, not a migration: "it was always in your account" is the strongest sentence in the security review.

Mode A — Aivis-operated

Default for SMB / mid-market

  • Customer installs nothing — they create one scoped API token in their Cloudflare dashboard (guided 5-minute doc)
  • AIVIS deploys and operates the worker remotely via the ops CLI
  • The worker stays visible in their dashboard the whole time
  • Revoking the token instantly ends AIVIS's access — their kill switch, not ours
Mode B — self-managed

Enterprise (Allianz-class)

  • Customer IT receives a versioned deployment package — a signed GitHub Release from the public repo: built bundle, wrangler.toml + Terraform templates, runbook, changelog, checksums
  • They deploy with their own credentials; AIVIS never touches their account
  • Only secret inside: a business-scoped, read-only AIVIS API token
  • Freshness: TTL-only (≤ 5 min), or an optional purge-only token — a far easier grant than deploy rights

The handover (Mode A → B)

  1. Deliver the package + the security & IT review pack (§11) to customer IT.
  2. Joint session: walk the runbook; their team performs a no-op redeploy themselves.
  3. Customer revokes AIVIS's Cloudflare token. Nothing moves, nothing redeploys.
  4. Agree the freshness mode and the update-notification channel.

Proving ground: everything is developed and demonstrated on an AIVIS-owned Cloudflare zone with a demo site before it ever touches a customer account (spec §10, M1).

§ 7 · Analytics (opt-in)

Who's reading the pages

When enabled, the worker sees what no external tool can: which AI systems fetch which pages, how often, and whether they got the enriched version. Per-URL, per-bot counts flow into AIVIS and become the evidence layer of the Monitoring subscription. When disabled — the enterprise default — none of this code runs and nothing is sent (D8).

User agentOperatorPurposeWhy it matters
GPTBotOpenAItrainingModel training corpus — long-term brand memory
OAI-SearchBotOpenAIsearch indexChatGPT search citations
ChatGPT-UserOpenAIlive fetchA user is asking about this page right now
ClaudeBotAnthropictrainingModel training corpus
Claude-SearchBot · Claude-UserAnthropicsearch live fetchClaude search + live citations
PerplexityBotPerplexitysearch indexAnswer-engine index
Perplexity-UserPerplexitylive fetchReal-time answers with citations
Googlebot (+ Google-Extended)Googlesearch + AIAI Overviews / Gemini grounding. Google-Extended is a robots directive, not a separate crawler.
BingbotMicrosoftsearch + AICopilot answers
CCBotCommon CrawltrainingFeeds many labs' training sets
Bytespider · Amazonbot · Applebot · meta-externalagent · MistralAI-User · DuckAssistBotvariousregistryShipped as a config registry — extended without code changes

Event shape (no IPs, no raw UA strings, no humans), batching, and registry maintenance: spec §05. A v1.1 middle path is spec'd for enterprises that want insight without egress: events written to a Workers Analytics Engine dataset inside their own account, read by AIVIS via the token it already holds.

§ 8 · Scope of work

Already live vs. to build

The biggest de-risking fact of this project: the hard half already exists. The Public API v1 is deployed on the dev instance with exactly the endpoint the worker needs — documented in its live reference and OpenAPI spec — so the builder can develop against reality from day one. It returns the latest available artifact per URL.

Already live — verified 06 Aug 2026

  • Public API v1 with bearer authAuthorization: Bearer aivis_… · tokens from the profile page
  • GET /jsonld?url=… — permalink lookupplus /me · /businesses · /chains/{id}/urls · /urls/{id}/jsonld
  • Per-URL JSON-LD artifactswith validation results and a stale flag
  • Generation pipelineLLM + Google-strict & Adobe validators · FAQ splice into @graph

To build (details: spec §02–§06)

  • worker/ — the edge workerincl. zero-trust ingestion + purgeable cache
  • ops/ — provisioning CLIconnect · deploy · verify · invalidate · pause · uninstall · upgrade
  • AIVIS: business-scoped tokensprerequisite for any external deploy (V-02)
  • AIVIS: events ingest · purge hook · serve-gateV-01 · V-03 · V-04, all small
  • AIVIS: artifact signingenterprise option (V-05)
  • Public GitHub repo + OSS scaffoldingApache-2.0 · signed releases · SECURITY.md (spec §12)
  • Customer documentation set§11 — packs A/B/C + handover kit, EN + DE

§ 9 · Guarantees

Eight invariants the builder may never trade away

These are acceptance criteria, referenceable by ID in every spec section and code review. Each maps to at least one automated test (spec §09).

I1

Fail-open. Any internal error — API down, malformed schema, worker exception — yields the origin response, unmodified. There is no failure mode that alters or blocks the page.

I2

Bounded latency. Added latency is ≈ 1 ms warm and hard-capped (~150 ms) cold; over budget means skip-and-warm, never wait. Non-HTML traffic is untouched entirely.

I3

Parity. Identical HTML for every user agent. No bot-conditional content, ever — this is a cloaking and trust question, not a performance one.

I4

Additive only. Exactly one <script type="application/ld+json" data-aivis> is inserted. Existing markup, including pre-existing schema, is never modified or removed.

I5

Secret containment. The AIVIS bearer token lives only as a Worker secret — never in the page, logs, or analytics events.

I6

Reversibility. Pause or uninstall restores the exact pre-connector serving path in under a minute, via route removal — no connector code involved.

I7

Zero-trust ingestion. AIVIS output is untrusted input: strict parse, sanitizing re-serialization, shape/size checks, business + domain binding, optional pinned-key signatures. A fully compromised AIVIS can never achieve script execution on a customer site — worst case is wrong data, bounded by purge-all + pause runbooks.

I8

Analytics off = zero egress. With analytics disabled, no request-derived byte leaves the customer's account toward AIVIS — verifiable by the customer in their own logs.

§ 10 · Scope fence

Deliberately not in v1

§ 11 · The documentation set

Where everything lives

This overview is the map. The build detail lives in the companion Full Specification 📘 — requirement IDs, config contracts, endpoint specs, threat model, test plan, milestones M1–M6, and the open-questions register (Q-1…Q-7) that should be resolved before the build starts.