Lejiend NewsBuilding in PublicSystem 03

A useful architecture diagram explains where a system is going. A useful implementation guide helps someone sit down, write the first line and know what “done” means at every stage.

We have now documented the build path for api.lejiend.com. The guide translates our planned backend architecture into practical steps for Python, FastAPI and Cloudflare Workers, supported by D1, Queues and Turnstile.

This is also part of how we want to build in public: sharing not only what we intend to create, but practical knowledge about how we execute, validate decisions and reduce risk before changing a live customer journey.

What the guide covers

RuntimePython + FastAPIRoutes, validators and application services with clear responsibilities.
CloudflareWorkers + D1Serverless execution with separate development and production databases.
ReliabilityQueues + auditIdempotent processing, retries and delivery records for every destination.
ProtectionTurnstile + limitsOrigin checks, payload limits, bot protection and endpoint-specific rate limits.
OperationsFormSubmit + TeamsIndependent notifications after durable persistence, with failures isolated.
VerificationTests + cutoverLocal, development and production checks before forms change endpoint.
Presentation · 11 slides

Explore the implementation deck

Download PowerPoint

Scroll through the complete build guide directly here. Each slide expands the architecture, safeguards and controlled cutover sequence.

Slide 1 of 11: Build the API behind Lejiend's conversations
01 / 11Build the API behind Lejiend's conversations
Slide 2 of 11: One API boundary, two kinds of trust
02 / 11One API boundary, two kinds of trust
Slide 3 of 11: Accept quickly, process reliably
03 / 11Accept quickly, process reliably
Slide 4 of 11: Bad requests stop before the Queue
04 / 11Bad requests stop before the Queue
Slide 5 of 11: Three routes keep version one small
05 / 11Three routes keep version one small
Slide 6 of 11: D1 separates purpose, consent and delivery
06 / 11D1 separates purpose, consent and delivery
Slide 7 of 11: The email identifies the subscriber
07 / 11The email identifies the subscriber
Slide 8 of 11: Listeners fail independently and retry safely
08 / 11Listeners fail independently and retry safely
Slide 9 of 11: Personal data must not spread silently
09 / 11Personal data must not spread silently
Slide 10 of 11: Build confidence in four controlled stages
10 / 11Build confidence in four controlled stages
Slide 11 of 11: Start with the boundary, not the integrations
11 / 11Start with the boundary, not the integrations
Scroll horizontally to continue

One API boundary, two kinds of trust

The first version has three public routes: a health check, an enquiry endpoint and a subscription endpoint. Customer enquiries and marketing consent remain separate. Sending a question to Lejiend must never silently place someone on a promotional list.

Validated submissions will receive an event ID and enter a Cloudflare Queue. A consumer will persist them to D1 before independently notifying FormSubmit and Microsoft Teams. Because queue delivery can happen more than once, database writes and notification listeners are designed to be idempotent.

The database preserves purpose

01

Enquiries

Immutable customer or client questions, contact details, source and event identity.

02

Subscribers and consent events

One normalized subscriber identity with append-only records of consent, renewal and withdrawal.

03

Notification deliveries

An audit of attempts and outcomes so successful destinations are not called again during a retry.

Four controlled stages

01
FoundationCreate the Worker projects, environments, D1 migrations and Queue.
02
Core flowImplement contracts, validation, domain events and idempotency.
03
DeliveryAdd D1 persistence, FormSubmit, Teams and delivery audits.
04
CutoverEnable Turnstile, production secrets, DNS and frontend endpoints only after end-to-end verification.

The current forms will continue using FormSubmit until the new API passes its verification gates. Documentation is progress, but it is not production capability. We will keep that distinction visible as we build.

Our next move is deliberately small: create the Worker foundation, define the event envelope, apply the first local D1 migration and prove that one synthetic enquiry can safely reach the Queue.