Build notes › topic

Cloudflare

Building on Workers, D1, Queues and Static Assets: what those primitives guarantee, what they do not, and how a failure inside them surfaces to the person running the software.

Covered here: agent-eval v1.0 · AI contact enrichment · cache busting · Cache-Control immutable · Cloudflare D1 correlated subquery ORDER BY · Cloudflare GraphQL Analytics · Cloudflare Queues dead letter queue · Cloudflare Worker voice AI agent · Cloudflare Workers Static Assets · Content Addressable Storage media pipeline

• 2 October 2026 · Live in production · recorded user test

  The WhatsApp follow-ups we tested like a shop owner

  Klaros now remembers what a business promises a customer in a WhatsApp chat: “I’ll send the photos tomorrow” becomes a follow-up, due at the right time, for whoever owes it. Before it shipped we used it the way a shop owner would, in six recorded scenes, with 33 checks read back from the real server. The recording caught a query Cloudflare D1 refuses, which would have broken the list for every business, and the customer’s name squeezed out of the chat header on laptops and phones.

• 23 September 2026 · Performance & media engineering

  The WhatsApp media pipeline that ran out of memory: Native HKDF Decryption, CAS Storage, and RFC 7233 Streaming

  Scraper bridges and naive BSP architectures serialize WhatsApp media into Base64 JSON strings over WebSocket IPC, creating 4x memory inflation and tab freezes. This note details our native HKDF-SHA256 key derivation engine, AES-256-CBC deciphering from mmg.whatsapp.net, Content-Addressable Storage (CAS), and RFC 7233 byte-range HTTP 206 partial streaming.

• 1 September 2026 · AI evaluation & reliability

  Engineering Klaros AI WhatsApp Agent with Diligent Evaluation

  Nuts and Bolts of Building a Production Grade Voice and Text Product Orchestrator. How we moved from basic prompt engineering to an enterprise-grade evaluation harness (agent-eval v1.0), F0-F5 Cloudflare infrastructure fidelity, micro-confidence voice safeguards (<0.70 handoff), synthetic mutation testing (20/20 detected), and an 8-step controlled rollout protocol (0% to 100%) backed by canonical RFC 8785 JCS SHA-256 evidence.

• 17 August 2026 · performance

  The WhatsApp inbox that re-downloaded itself every visit

  We were sure the WhatsApp inbox was slow because of the database. Two missing indices and a message-processing path re-fetching the same settings row up to five times, all real, all fixed, none of it the answer: a synthetic request touching no database at all cost the same 502ms as the real conversation list. Real Cloudflare RUM data put the dashboard's median load at 5.0 seconds. The actual cause: over 40 dashboard JavaScript files, every one served Cache-Control: no-cache, including files already carrying a cache-busting hash whose entire purpose was the caching that wasn't happening.

• 6 August 2026 · engineering

  The WhatsApp contacts we silently stopped scoring

  Our own health check found 68 dead-lettered enrichment messages, 100% one type, lined up exactly with two nights of the nightly cron. The cause was three UPDATE statements writing to a graph_contacts column that never existed. What broke, what it quietly cost every contact that should have been scored, and the regression tests we proved could catch the bug before trusting them, by reintroducing it first.

• In progress

  The half of a sale that nobody demos

  Every platform shows you the payment landing. Almost none show you the twenty minutes afterwards: who gets told, who packs it, what the buyer hears while they wait, and what happens when it ships four days later and the messaging window has closed.

• In progress

  Where the ask ends and the shop begins

  A payment request is messaging machinery. A product library is a commerce application, and the part most likely to be replaced by a real one. On finding that seam in our own code, and making it a documented extension point instead of a function that happened to sit in the middle of a file.

• In progress

  What a feature looks like when nothing consumes it

  Contact limits computed on every request and enforced nowhere. A tier ladder that is marketing copy at runtime. On the difference between building a capability and shipping one, found in our own codebase.