The system
How the system worksThe DirectoryDispatchThe LedgerAI modelsAI agentsYour installationThe appThe research libraryWhat changes for your businessUse it from your softwareEverything it can do
Messaging
iMessageWhatsApp
Ads and leads
AdsCreativeLeads
Devices
Devices
Industries
RealtorsRestaurantsHome services
Explore
How it worksPermissions and limitsCompareSet upQuestionsText me

Cloudflare OS XL: the platform this build has not installed yet

Cloudflare OS XL: the platform this build has not installed yet

This build runs on Cloudflare. Not "hosted on" — runs on. The site is Cloudflare Pages. The content spine is D1. The ledger is D1 and R2. The agent memory is Durable Objects with SQLite. The models are called through Workers AI and the AI Gateway. Long jobs are Workflows. Fan-out is Queues. Page-fetching is Browser Rendering. Outbound mail is a send_email binding. Secrets are in Secrets Store.

That is thirteen Cloudflare products, bound and in production, doing real work every hour.

It is also less than a third of what the account can hold.

This series is the inventory of the rest: every Cloudflare product that is not installed here, what it would actually do for this specific build, and — this matters more — an honest verdict on whether it should be installed at all. A list of everything a vendor sells is a brochure. This is not that. Several entries below end in "no", and the reasons are given.

What is already here

Verified against the account and every wrangler.toml in the repo on 6 August 2026, not from memory:

ProductState in this build
Workers + PagesThe site, the API, the admin surface
D14 databases: content spine, shared events, storage index, previews
KV1 namespace: settings, freeze flags, snapshots
R22 buckets: ledger, store
Durable Objects (SQLite)3 classes: DirectoryDO, ExpertDO, AgentDO
Queues3: loop-tasks, loop-ingest, loop-ingest-dlq
Workflows10, across two Workers
Workers AIBound on Pages and on the sibling Worker
AI GatewayEvery model call routes through it
Browser RenderingMYBROWSER binding on the sibling Worker
Email (outbound)send_email binding
Secrets StoreMeta credentials, bound by reference
Service bindingsSTORE, META_BRIDGE
Cron triggersEvery minute, and 04:00 daily
ObservabilityEnabled on every Worker

What is empty

Four products were checked directly against the account rather than inferred from config. All four returned nothing:

shell
wrangler vectorize list   →  You haven't created any indexes on this account.
wrangler hyperdrive list  →  (empty)
wrangler pipelines list   →  No pipelines found.
wrangler containers list  →  No containers found.
Line 4, Column 1Shell Script

Everything else in this series is absent by config scan: no binding, no route, no reference anywhere in the repo that does more than mention the name in a documentation row.

That distinction is worth stating plainly, because this build has a directory of roughly nine hundred callable rows and several of them describe products that are not installed. A row that documents Turnstile is not Turnstile. The inventory below counts bindings and provisioned resources, not documentation.

The ten parts

Part 1 — Search and retrieval Vectorize, AI Search (formerly AutoRAG), and D1 read replication. The corpus is 1,171 articles and is queried with SQL LIKE. This is the largest single gap in the build.

Part 2 — The ledger as a queryable table Pipelines, R2 Data Catalog, R2 SQL, R2 event notifications, Analytics Engine. Audit questions are currently answered by pulling files and counting in a script.

Part 3 — Running real code Containers, the Sandbox SDK, and Code Mode. Every heavy tool in this build shells out to the owner's laptop. That is the single biggest reliability liability in the system.

Part 4 — Agents as infrastructure The Agents SDK, remote MCP servers with OAuth, hibernatable WebSockets. Two Durable Object classes already do a hand-rolled version of this.

Part 5 — Media Images, Stream, Realtime. Hero images are generated externally and stored as raw R2 objects with no variants.

Part 6 — The edge in front of the Worker Snippets, the rate-limit binding, Turnstile, Cache Reserve. The admin key and the token-mint endpoint are rate-limited by nothing.

Part 7 — Seeing what happened Logpush, Log Explorer, Tail Workers, Workers Builds, gradual deployments. A Tail Worker is the missing mechanical link between "it broke" and "a task row exists".

Part 8 — Reaching private things Hyperdrive, Workers VPC, Tunnel, mTLS certificates. The honest fix for the local bridge.

Part 9 — The security surface Access, WAF custom rules, inbound Email Routing, API Shield. Only half of email is installed.

Part 10 — Hosting other builds Workers for Platforms, Terraform, Radar. The ceiling: the point where this stops being one site.

The two that fix existing failures

Everything in this series is new capability except two entries, and those two are different in kind because they close failure classes already written into this build's failure vault.

Tail Workers (Part 7). When a Worker throws, the trace goes to observability and a human has to go look. A Tail Worker is a Worker that consumes another Worker's invocation logs, so a thrown exception can append a task row naming the failure class without anyone reading a dashboard. This build's central rule is that a failure becomes a child task rather than a sentence in a report. Right now that rule depends on an agent noticing. A Tail Worker makes it mechanical.

Code Mode (Part 3). A model calling nine hundred single-purpose tools spends most of its calls discovering contracts rather than doing work — measured on the misc agent, roughly fourteen of twenty calls. Code Mode inverts it: the model writes TypeScript against a generated API and runs it in a sandbox, so discovery happens once, at codegen time, instead of once per call.

Those two are not enrichment. They are repairs.

How to read the verdicts

Each part ends with a table of the same three columns: the product, what it would replace here, and a verdict of install, later, or no. "No" is used honestly — Waiting Room, Load Balancing and Spectrum are all real products that this build has no business installing, and saying so is more useful than listing them as opportunities.

References (3)
  1. Cloudflare D1 documentation“Build serverless SQL databases on Cloudflare's global network and query them from Workers and Pages projects.”
  2. Cloudflare Queues documentation“Send and receive messages with guaranteed delivery using Cloudflare Queues integrated with Workers.”
  3. Workers for Platforms documentation“Run untrusted code from your customers or AI in secure, isolated sandboxes on Cloudflare's global network.”