Using AI to chart a course for our post

* Cloudflare aims for a 2029 target deadline for full post-quantum readiness.
* The goal is to ensure customer traffic is future-proofed against quantum adversaries by adopting a "PQ everything!" stance.
* Three goals for the migration are: understanding cryptographic usage and upgrades, providing progress metrics, and surfacing prerequisites early.
* CryptoLabe is an internal tool designed to discover cryptography in code, understand its use, and chart migration paths.
* The discovery stage of CryptoLabe scans source, configuration, manifests, lockfiles, scripts, tests, and documentation for cryptographic elements.
* The analysis stage re-checks findings against source code and investigates runtime usage and dependencies across repositories.
* Findings are classified into categories such as Classical encryption, Classical signature, Classical token, PQ-ready hybrid key exchange, and PQ-ready.
* Prerequisites highlight blockers, such as dependencies on unmigrated standards or library support.
* Hard cases focus on custom protocols or cryptography built into hardware lacking ecosystem support.
* The system uses Cloudflare Workers and Durable Objects for orchestration, utilizing isolated sandboxes for code scanning.

The narrative constructs a powerful argument for using advanced AI not just for pattern matching, but for complex, multi-layered contextual reasoning across massive, decentralized systems. The core tension lies between the scale of the problem (cryptography woven into vast codebases) and the practical difficulty of manual, exhaustive auditing. The structure moves from an aspirational goal to a concrete, albeit iterative, solution (CryptoLabe). The definition of "prerequisites" versus "hard cases" is a crucial analytical move; by segregating findings based on whether they are solvable by local teams (prerequisites) or require external coordination (hard cases), the system attempts to manage complexity. This approach implicitly recognizes that migration is less about a singular technical upgrade and more about coordinating a dependency chain across disparate software layers and external standards bodies. The reliance on iterative prompting and external validation underscores a necessary acknowledgment of epistemic uncertainty inherent in using AI for such foundational, high-stakes work. The implied challenge for any organization adopting this methodology is shifting focus from an exhaustive inventory (which is deemed impractical) to prioritizing system criticality based on dependency risks.
Bridge Questions: How can organizations systematically define the threshold between a "prerequisite" that requires immediate internal action and a "hard case" that demands external lobbying or ecosystem engagement? What metrics are most effective for measuring the ROI of surfacing prerequisites versus tracking hard cases? If AI-driven discovery is insufficient, what alternative human-centric verification loops can reliably validate the nuanced classifications assigned by the model?