In September we wrote about the first typed decision models, and the piece ended with an insistence: calibration is a property of a model against a distribution, the distribution that matters is yours, and only your own logs can check it. That framing assumed a division of labor. The vendor owned the weights, and our job was measurement, a standing audit of stated confidence against actual outcomes.
On October 1, Cloudflare collapsed that division. The company released two of its own decision models, Clef and Clef-flash, with the announcement opening plainly: “Today, we’re releasing two Cloudflare-trained decision models, Clef and Clef-flash, hosted on Workers AI.” The weights are on Hugging Face under an Apache 2.0 license, built on open Qwen base models. The outputs are strictly typed distributions over declared options, API-compatible with the interface the first decision model defined, with median response times around 209 milliseconds for the larger model and under 40 for the smaller one, and a vision encoder for image classification. The post-training recipe is public too: label-smoothed cross-entropy for schema validity, paired with a Brier loss and a reinforcement learning stage aimed specifically at probability calibration.
And then the part that actually changes our job. Alongside the models, Cloudflare is offering a fine-tuning service built from its own stack: route your AI traffic through its gateway and it “automatically create[s] a dataset of your use case,” rollouts run on the serving platform, reinforcement learning runs in sandboxed containers, a trainer component updates the weights, and you can deploy the result as your own model. Hands-on with their engineers today, self-serve later. The named use cases are the unglamorous decisions that fill every real pipeline: ticket routing, bot classification, trust and safety triage, domain classification.
Two readings follow from this, and we hold both.
The first is about what commoditized, and how fast. When the first decision model launched in mid-September, it was proprietary, early access, and its central training claim could not be verified by anyone outside the company. Within days, an independent demo showed the interface was portable to small local weights. Sixteen days after the launch, a second vendor has shipped the same contract as open weights with a published training recipe. Whatever else is true, the typed calibrated decision is not one company’s product anymore. It is a primitive, and primitives get cheap. That resolves one worry from September, because a claim you could not verify becomes a recipe you can read, and it sharpens a different question: if the interface is portable and the weights are free, what is actually scarce?
Our answer is the second reading. What is scarce is the labeled history of your own decisions, because that history is now the fuel. In September, the honest posture toward a decision model was audit: log every decision with its stated confidence, join against what actually happened, watch whether ninety percent means ninety percent. Open weights plus a tuning loop turn the same logs into something more powerful and more dangerous. The traffic that checks the gate becomes the curriculum that shapes it. In one direction this is exactly what we asked for. Calibration against a benchmark was always a proxy, and now the model can be fit to the distribution that matters, which is ours. In the other direction, a loop has appeared where there used to be a one-way measurement, and loops have failure modes that measurements do not.
The core trap is that your decision logs are not a sample of the world. They are a record of what your previous policy let you see. The tickets your old router misfiled and nobody corrected sit in the dataset with wrong labels that look like right ones. The requests your old gate blocked never produced an outcome at all, so the new gate learns nothing about the blocked side of the line, which is precisely the side where its judgment matters most. Train on that record and selection bias stops being a caveat in an analysis and becomes a property of the weights. Each generation of the gate learns from a world filtered by the last generation, and nothing in the loss curve will tell you.
So before we would put our own traffic through a loop like this, four things would have to be true, and all four are our responsibility now, not a vendor’s.
The evaluation slice has to be held out by construction. Once logs become training data, the standing measurement we argued for in September only means something if it runs on data the trainer provably never saw, with the separation enforced in the pipeline rather than promised in a document. We have written before that the agent that does the work should not grade it. The same separation now applies to datasets.
Outcome labels need independent provenance. A gate that routes a ticket also influences whether anyone ever looks at that ticket again. If the signal for “this decision was right” flows through paths the gate itself controls, the loop confirms itself. The corrections that matter come from outside: a human overriding, a downstream process failing, a customer escalating.
The blocked side needs an exploration budget. Data about rejected requests only exists if some deliberate fraction of them gets through anyway, or gets a second look by a different judge. Letting a sample cross the gate against its own verdict is a real risk taken on purpose for the sake of the data, which is exactly why it belongs in a written policy rather than in whoever configures the trainer.
And drift is in-house now. A vendor’s model shifts under you when the vendor retrains, which is a known annoyance with a known defense. A gate tuned on your own traffic shifts when your traffic shifts, silently, and no one outside your team is even positioned to notice.
There is also a quieter dependency decision inside the convenience. The pitch is that the gateway you route traffic through produces your dataset for free. That is true, and it means the routing layer and the training-data supply are now the same piece of infrastructure, owned by the same vendor that trains and serves the gate. None of that is sinister, and all of it should be chosen with eyes open rather than inherited from a default.
September’s lesson was that a schema cannot catch a confident wrong answer, and only your logs can. October’s addendum is that the logs got a second job. A gate trained on your own record is a mirror. It will be exactly as good as the history you kept, including the gaps your old decisions carved into that history. The model was never the scarce asset. The scarce asset is a decision log with honest labels, outcomes that arrive from outside the loop, and a slice nobody is allowed to train on.