How Cloudflare Enforces Engineering Standards Using AI

My notes

Summary

Cloudflare replaced scattered engineering documentation with the “Codex”, a single governed, machine-readable knowledge base of standards written as RFCs using RFC 2119 keywords (MUST/SHOULD). Three AI agents (code reviewer, spec reviewer, incident report reviewer) query this Codex to enforce standards automatically, and each rule only becomes merge-blocking after an explicit “approved to enforced” promotion step.

Key Insight

• Scale of impact (4 months of code reviewer): roughly 230,000 violations flagged, roughly 16,000 caused a blocked merge (only the ones tied to MUST statements on RFCs marked “enforced”, not merely “approved”).
• Compaction is the real engineering problem, not the LLM call. With 60+ RFCs and growing, feeding the full corpus into every review blew the context window and degraded results. Cloudflare built a dedicated extraction agent that compresses each RFC into a JSON structure of atomic statements (slug, section, level, text, href); full RFC bodies are loaded only when an agent needs more context. They started with a plain Markdown digest and moved to structured JSON specifically so agents could filter more precisely.
• Stable slug IDs per statement persist across RFC edits, which is what makes longitudinal tracking, analytics, and exception-handling possible. Otherwise every doc edit would orphan the enforcement history.
• A two-stage lifecycle (approved, then enforced) decouples publishing from blocking. New standards start as non-blocking recommendations the moment they are approved; someone must explicitly promote a rule to “enforced” before an unmet MUST can withhold approval or block a merge. This buys teams adaptation time without freezing standards adoption.
• Full agent review is slow (minutes), so they added two cheaper layers: language-specific linters (oxlint for TypeScript, Rust next) for standards that are mechanically checkable, giving millisecond feedback, and a local CLI that runs the same agent stack as CI against your diff, cutting the CI round-trip.
• Spec and incident reviewers run on shared infrastructure, not bespoke pipelines: Cloudflare Worker plus D1 for state plus AI Gateway for model routing plus Cron Trigger for scanning. Since May 2026: roughly 600 unique specs reviewed (3,200+ total invocations, including reruns), severity split 65% major, 29% minor, 6% critical. 200+ incident reports reviewed, 93% of those low-impact, internal, or preemptive. For high-severity incidents the reviewer is mandatory and reports are not “complete” until findings are addressed.
• Common failure modes the incident reviewer catches: missing follow-up action items, incomplete timelines, and omitted detection signals. The same three gaps that quietly erode postmortem quality in any org that does not check for them systematically.