Lextract

The decision

On 2026-06-12, the entire backend moved from FastAPI, Celery, and Redis on Railway to Cloudflare Workers in a single day: 29 commits in the private development history, executed by coding agents against a 1,091-line written plan agreed in advance, with the Celery chain remapped onto Cloudflare Workflow steps and the API contract frozen so the frontend needed no changes.

The Railway backend had worked, but it billed for every hour it sat idle against traffic that was bursty by nature: a lease arrived, minutes of work happened, then nothing for hours.

The Python design it replaced ran a second, adversarial extraction pass that hunted for errors rather than confirmed them, a dual-extract judge that arbitrated genuine disagreements, a per-model pricing table maintained in the repository, and explicit prompt-injection defence around lease text an attacker could author. The Cloudflare orchestrator ran the extraction prompt twice against the same model instead, and the Python stack stayed in the repository, unported, so the two designs could be read side by side.

The new design ran only when a lease came in, matching the traffic pattern that had cost money to sit idle against on Railway.

Architecture

Production ran entirely on Cloudflare, with no container, VM, or always-on process anywhere in the request path. A Next.js 16 Worker served the app and reverse-proxied /api/v1/* to a second Worker holding the API.

Extraction and export ran as Cloudflare Workflows, so a transient model error retried only the failing step rather than the whole document. Extraction takes minutes and calls an unreliable third party, which is the whole reason it cannot live inside a request. Neon Postgres sat behind a Hyperdrive binding, since serverless functions and a fixed connection limit do not mix.

The extraction workflow was eight durable steps, with one compensating step catching a throw from any of them:

load PDF, run extraction
  persist extraction result
    mark scoring
      score confidence
        persist confidence
          detect red flags
            persist red flags
              mark complete, enqueue email
                                              -> on any throw: mark extraction failed

Each pass inside that first step was a model chain rather than a single model, and the third pass required both conditions at once: a field holding a non-null value scoring below the escalation threshold, and headroom still available under the cost ceiling.

The score itself did not take the model’s word for it. Cross-field validators re-derived what they could and penalised every field involved when the arithmetic disagreed, and fields genuinely absent from a lease were scored not_found and excluded from the overall denominator rather than counted as failures.

The design standards were agreed in writing before any code and were short enough to hold in mind: routes parse and delegate and do nothing else, SQL lives only in repositories, state transitions go through one module, R2 key construction goes through one module, and every external API sits behind an adapter.

The first Playwright end-to-end pass, on 2026-03-24, found the entire authenticated API returning 401 for every registered user: dashboard, profile, credit balance and upload all broken. The cause was the auth SDK’s session cache: it stored the session response in a signed cookie for five minutes, and a cached response carried no headers, so the header carrying the JWT was absent for the whole cache window after every login. The fix bypassed the cache entirely and asked a token endpoint directly.