cld-flare-maxxing: Instructions file for Codex

cld-flare-maxxing — operating contract

This repo is a versioned, guardrailed control center for a Cloudflare account. Any AI coding harness working here follows the rules below. They override default behavior.

This file is the harness-neutral core. If you're Claude Code, also read CLAUDE.md for Claude-specific skills, agents, permissions, and hooks layered on top of these same rules.

What this is

• Snapshot the full account, DNS, zone, and security state into snapshots/ — a local, full-fidelity raw copy for your own tooling, plus a pseudonymized snapshot.public.json sibling that's the one actually committed (scripts/lib/idmap.mjs).
• Generate insight and security reports (reports/) from a 61-check heuristic catalog.
• Attribute changes ("who did what") via the Cloudflare audit log.
• Surface plan-limit utilization and beta features worth testing for this stack.
• Present all of it in a single dashboard (dashboard/).
• Take guarded, audited destructive actions only via break-glass.

Golden rules

1. Read-only by default. Routine work uses CF_READ_TOKEN only. Snapshots, reports, diffs, and the dashboard never mutate the account.
2. Secrets never get committed. .env and .env.break-glass are gitignored. Token values are never written into snapshots (only metadata). Never paste a token into any committed file, report, or chat artifact. The same goes for real account data: the raw snapshots/*/snapshot.json, config/backlog.json, config/token-capabilities.json, config/backlog-curated.json, and the alias vault secrets/alias-map.json are all gitignored — only the pseudonymized snapshot.public.json is committed.
3. All mutations go through scripts/actions/* with break-glass. Never make changes with ad-hoc curl/Invoke-RestMethod/wrangler delete, or with mcp__cloudflare__execute if you have it connected (Cloudflare's own "Code Mode" MCP server - it runs agent-written code against the live API with no fixed tool list, so treat every call through it like a raw API request: reads only, never a write). The enforcement lives in plain Node.js (scripts/lib/guard.mjs), so it holds regardless of which agent or harness is driving: every action script refuses to mutate unless CF_EDIT_TOKEN is set and CF_ALLOW_DESTRUCTIVE=YES_I_AM_SURE is armed. Claude Code additionally has a tripwire hook (.claude/hooks/guard.mjs) on both Bash and mcp__cloudflare__execute that blocks ad-hoc destructive commands/calls before they run; other harnesses don't get that extra layer yet, so hold yourself to rule 3 directly.
4. Confirm before any mutation. State exactly what will change, on which zone or resource, and why. Action scripts default to --dry-run; only add --commit after the human agrees.
5. Destructive actions require explicit break-glass (docs/SAFETY.md): a separate CF_EDIT_TOKEN plus CF_ALLOW_DESTRUCTIVE=YES_I_AM_SURE. Every attempt is written to reports/actions-audit.log (local-only, see rule 6).
6. Never delete saved state. snapshots/ (both the local raw snapshot.json and the committed snapshot.public.json), reference/, secrets/alias-map.json (the alias vault — losing it makes every already-committed alias unreversible even with the salt), and the real config/*.json are the point of the repo. reports/ is generated output (derived from the local snapshot + reference), local-only and gitignored; regenerate it anytime with npm run report.
7. GitHub changes via PR, never direct pushes to main (feature branch, PR, merge).