# Cloudflare’s choice of QuePaxa, an unusual consensus algorithm [Canonical reading](https://escapemeridian.com/readings/cloudflare-s-choice-of-quepaxa-an-unusual-consensus-algorithm-79c50791) Cloudflare’s James Larisch explains why the company chose QuePaxa for Meerkat, an experimental service for managing Cloudflare’s internal global control plane. Meerkat’s replicas use a consensus algorithm to agree on an ordered log, so they can maintain the same state. Larisch argues that common leader-based algorithms can stall when a leader becomes unreachable or network delays trigger mistaken elections—conditions he says are a poor fit for a system spanning continents. QuePaxa instead lets any proposer submit a proposal and has proposers cooperate toward agreement. An optional leader can decide in a single round trip when conditions allow; if it cannot, other proposers can continue, though decisions may take longer and extra proposers can increase bandwidth use. In Cloudflare’s evaluations, Meerkat kept processing requests during leader failures, but its decision rate sometimes fell. The account makes QuePaxa’s tradeoff concrete: avoid halting on leader recovery, while accepting slower decisions and added traffic under some conditions. Larisch also says QuePaxa has less battle-testing than Raft or Paxos, and that Cloudflare is extending its design and formally verifying and testing its implementation. The reported results are Cloudflare’s own experience, not a guarantee of performance in other deployments. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Cloudflare Blog · Article Original source date: Nov 11, 2026 (2026-11-11T14:24:46.436Z). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-11T17:34:18.809Z. First observed: 2026-11-11T14:51:28.371Z. Retrieved: 2026-11-11T17:33:04.274Z. - [Choosing QuePaxa, an unusual consensus algorithm](https://blog.cloudflare.com/choosing-quepaxa/) ## Limits The performance results described are Cloudflare’s own evaluations; the source does not establish how QuePaxa will perform in other deployments. Cloudflare says QuePaxa has not been battle-tested as extensively as Raft or Paxos and that its implementation extends the original crash-stop design to support crash recovery. The described verification and testing are ongoing. ## Open question What will Cloudflare’s formal verification and testing show about the correctness of its crash-recovery extension to QuePaxa? ## Source-stated Cloudflare chose QuePaxa for Meerkat because it was designed to keep making progress without relying on a strict leader or accurate timeouts. > any algorithm relying on a strict leader or accurate timeouts was inevitably going to stall in a consensus system that runs over the Internet. We searched for consensus algorithms designed for asynchronous environments - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source-stated QuePaxa allows any proposer to submit proposals; its optional leader can decide in a single round trip, while other proposers may continue if the leader is unavailable. > Clients aren’t forced to make requests to the leader — any proposer can propose. If the leader goes down, then clients can keep making requests to other proposers. The leader is completely optional. - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source-stated Cloudflare says its evaluations found that Meerkat continued processing requests during leader failures, though its decision rate could decrease. > Meerkat continuously processes requests, even when the leader crashes, disconnects, or just becomes slow. At no point have we ever seen it completely stall. - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source-stated Cloudflare says QuePaxa has less battle-testing than Raft or Paxos and that it is extending the original crash-stop design to support crash recovery. > It has not been battle-tested as extensively as Raft or Paxos, and we’re also extending the original crash-stop design to support crash recovery. - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source-stated Cloudflare says it is formally verifying and testing its QuePaxa implementation and Meerkat. > That is why we are formally verifying our QuePaxa implementation and Meerkat as a whole, alongside extensive simulation and fault-injection testing. - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source and contributor context Cloudflare · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [image · Cloudflare Blog](https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M73MMXB6M86NA1F97GH7Q8TG.png&w=1280&h=720&f=webp&fit=cover&position=center) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Formal verification Using software to check every step of a proof or a program against precise rules. - [Definition reference](https://en.wikipedia.org/wiki/Formal_verification) ## Cloudflare Cloudflare provides networking, security and computing services that help run websites and applications. - [Explore this context](/entities/cloudflare) - [Reference](https://blog.cloudflare.com/) ## Editorial provenance Version 1. Publication ID: 3da0fff8-25d4-44d0-8833-5e449a24a93e. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-11T17:34:18.809Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 93c0d3f8e577ff305b5b8fda50b963cef314e27841394e43b09da7ab8993c0f4. Source text hash: efd6e545efa8b7a59297a7051991a4a04be10b755ad69a6f98fe44fd89380ff4. ## Revision and source-check history ### Version 1 — 2026-11-11T17:34:18.809Z Cloudflare’s James Larisch explains why the company chose QuePaxa for Meerkat, an experimental service for managing Cloudflare’s internal global control plane. Meerkat’s replicas use a consensus algorithm to agree on an ordered log, so they can maintain the same state. Larisch argues that common leader-based algorithms can stall when a leader becomes unreachable or network delays trigger mistaken elections—conditions he says are a poor fit for a system spanning continents. QuePaxa instead lets any proposer submit a proposal and has proposers cooperate toward agreement. An optional leader can decide in a single round trip when conditions allow; if it cannot, other proposers can continue, though decisions may take longer and extra proposers can increase bandwidth use. In Cloudflare’s evaluations, Meerkat kept processing requests during leader failures, but its decision rate sometimes fell. The account makes QuePaxa’s tradeoff concrete: avoid halting on leader recovery, while accepting slower decisions and added traffic under some conditions. Larisch also says QuePaxa has less battle-testing than Raft or Paxos, and that Cloudflare is extending its design and formally verifying and testing its implementation. The reported results are Cloudflare’s own experience, not a guarantee of performance in other deployments. ## Original source Cloudflare Blog · Article Original source date: Nov 11, 2026 (2026-11-11T14:24:46.436Z). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-11T17:34:18.809Z. First observed: 2026-11-11T14:51:28.371Z. Retrieved: 2026-11-11T17:33:04.274Z. - [Choosing QuePaxa, an unusual consensus algorithm](https://blog.cloudflare.com/choosing-quepaxa/) ## Limits The performance results described are Cloudflare’s own evaluations; the source does not establish how QuePaxa will perform in other deployments. Cloudflare says QuePaxa has not been battle-tested as extensively as Raft or Paxos and that its implementation extends the original crash-stop design to support crash recovery. The described verification and testing are ongoing. ## Open question What will Cloudflare’s formal verification and testing show about the correctness of its crash-recovery extension to QuePaxa? ## Source-stated Cloudflare chose QuePaxa for Meerkat because it was designed to keep making progress without relying on a strict leader or accurate timeouts. > any algorithm relying on a strict leader or accurate timeouts was inevitably going to stall in a consensus system that runs over the Internet. We searched for consensus algorithms designed for asynchronous environments - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source-stated QuePaxa allows any proposer to submit proposals; its optional leader can decide in a single round trip, while other proposers may continue if the leader is unavailable. > Clients aren’t forced to make requests to the leader — any proposer can propose. If the leader goes down, then clients can keep making requests to other proposers. The leader is completely optional. - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source-stated Cloudflare says its evaluations found that Meerkat continued processing requests during leader failures, though its decision rate could decrease. > Meerkat continuously processes requests, even when the leader crashes, disconnects, or just becomes slow. At no point have we ever seen it completely stall. - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source-stated Cloudflare says QuePaxa has less battle-testing than Raft or Paxos and that it is extending the original crash-stop design to support crash recovery. > It has not been battle-tested as extensively as Raft or Paxos, and we’re also extending the original crash-stop design to support crash recovery. - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source-stated Cloudflare says it is formally verifying and testing its QuePaxa implementation and Meerkat. > That is why we are formally verifying our QuePaxa implementation and Meerkat as a whole, alongside extensive simulation and fault-injection testing. - [Supporting source](https://blog.cloudflare.com/choosing-quepaxa/) ## Source and contributor context Cloudflare · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [image · Cloudflare Blog](https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01M73MMXB6M86NA1F97GH7Q8TG.png&w=1280&h=720&f=webp&fit=cover&position=center) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Formal verification Using software to check every step of a proof or a program against precise rules. - [Definition reference](https://en.wikipedia.org/wiki/Formal_verification) ## Cloudflare Cloudflare provides networking, security and computing services that help run websites and applications. - [Explore this context](/entities/cloudflare) - [Reference](https://blog.cloudflare.com/) ## Editorial provenance Version 1. Publication ID: 3da0fff8-25d4-44d0-8833-5e449a24a93e. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-11T17:34:18.809Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 93c0d3f8e577ff305b5b8fda50b963cef314e27841394e43b09da7ab8993c0f4. Source text hash: efd6e545efa8b7a59297a7051991a4a04be10b755ad69a6f98fe44fd89380ff4. ### uncertain — 2026-11-11T17:34:18.809Z — anthropic/claude-opus-5.5 Publication: 3da0fff8-25d4-44d0-8833-5e449a24a93e attribution — uncertain: The draft names James Larisch as the sole author ('Larisch argues', 'he says'). The only evidence is the name 'James Larisch' after 'Follow on Social Media' at the end of the page text. The post speaks as 'we' for Cloudflare, and the evidence does not show whether Larisch is the only author or one of several. Smallest repair: attribute the argument to Cloudflare, or say 'Cloudflare (post credited to James Larisch)', unless the full byline is confirmed. Cloudflare-level attribution of the claims is otherwise accurate. > Follow on Social Media Cloudflare James Larisch summary — pass: The summary leads with Cloudflare choosing QuePaxa for Meerkat. It explains consensus as replicas agreeing on an ordered log and states the source's core argument: leader-based algorithms stall when leaders fail or mistaken elections occur over global networks. It also keeps the stated tradeoffs and the caveat that QuePaxa is less battle-tested. Some terms could use term-library tooltips, such as control plane, proposer, round trip and crash-stop/crash recovery. They do not prevent understanding. The question follows from the source's stated ongoing verification. date — pass: evidence.originalPublished is 2026-11-11T14:24:46Z from the publisher page. It is consistent with the feed entry, and nothing in the evidence indicates an earlier first publication. support — pass: The source supports each claim. Leader-based algorithms can stall and mistaken fault detection can trigger elections. Any proposer can propose, and the leader is optional and has a single-round-trip fast path. Hedging adds bandwidth use and may slow decisions. The decision rate fell to about 65% during a leader failure without halting. QuePaxa is less battle-tested, and Cloudflare is extending crash-stop to crash recovery while formally verifying the implementation. The limitations correctly keep results as Cloudflare's own evaluations. > The decision rate decreases to around 65% of its original rate, and returns to 100% when the faulty leader is replaced, a minute after failing. At no point did the system halt. media — pass: The selected media is the verified direct link to the original Cloudflare blog post. It is the most direct way to access the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/79c50791e42552183898fbbb3c82756a213e047590b7ebcdce1000aaa064ccc9/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/cloudflare-s-choice-of-quepaxa-an-unusual-consensus-algorithm-79c50791.json)