Cloudflare routes its engineering standards through agents and reports 16,000 blocked merges in four months

Sources: primary, discussion
Summary: Timo Reimann describes the Cloudflare Codex, a governed body of engineering standards written as RFCs using the RFC 2119 SHOULD and MUST keywords, with front-matter metadata, per-domain owners and a merge-request proposal path. Cloudflare reports the AI code reviewer has flagged close to 230,000 violations since the Codex started this year, that almost 16,000 caused approval to be withheld, and that a separate spec reviewer has evaluated close to 600 technical designs. To keep 60-plus RFCs out of the context window, a purpose-built agent extracts the SHOULD and MUST statements into JSON with a stable slug per statement. Cloudflare also reports two escape hatches for review latency, Codex-aligned linter packages starting with TypeScript on oxlint, and a local CLI that runs the same agents against a computed diff without the CI round trip.
Why it matters: The approved-versus-enforced split is the transferable design, because an approved RFC produces only non-blocking findings and a separate promotion step is what turns an unmet MUST into a withheld approval, so a new standard never blocks merges the day it lands.