CountTheVote2026
https://smartelections.us/countthevote2026 “There's .. one observing operation, SMART Elections, … that's … been better at paying attention to the full course of the election.” - Legendary Elections Expert Dr. Doug Jones
Search
1000 results for “that_one_guy”
-
-
AI can generate a financial model that looks coherent, contains valid formulas, and produces a plausible result while still being wrong in ways that matter.
A formula can reference the wrong cell. A cost assumption can be expressed in the wrong unit. A revenue schedule can omit a phase. A model can calculate correctly from an unsupported market assumption.
These are different failure modes, and they need different controls. For real estate feasibility models, the objective should not be to ask whether an AI-generated workbook looks correct. It should be to establish which properties can be tested automatically, which assumptions require evidence, and which decisions must remain with a qualified human reviewer.
A useful validation architecture has five layers:
- Structural validation
- Deterministic calculation checks
- Domain and consistency checks
- Evidence and provenance checks
- Human review and approval
No single layer is sufficient.
1. Separate the output from the evidence
Consider a hypothetical development model with the following inputs:- Site area and developable area
- Permitted gross floor area
- Unit mix or lettable area
- Revenue assumptions
- Construction and other development costs
- Financing assumptions
- Development programme
- Exit assumptions
The model calculates development costs, revenue, cash flows, residual land value (RLV), and potentially internal rate of return (IRR).
For example, a model might calculate an RLV of £4 million. That output can be mathematically consistent with the workbook and still be commercially misleading if the revenue assumptions are unsupported or the construction cost basis is outdated. Validation therefore needs to test both the calculation and the justification for its inputs.
2. Layer one: validate the structure before the numbers
Before reviewing financial logic, validate the shape of the generated output. If an AI system is expected to return structured data before creating a workbook, define an explicit contract. JSON Schema is one established option for specifying required fields, data types, and constraints.See the JSON Schema getting-started guide.
A simplified model input contract might look like this:
{
"project_id": "DEMO-001",
"currency": "GBP",
"site_area_sqm": 5000,
"gross_floor_area_sqm": 12000,
"construction_cost_per_sqm": 1800
}
This is illustrative data, not a market benchmark or a recommendation for a production schema.A structural validator could check that:
- Required fields are present.
- Numeric values are actually numeric.
- Areas and costs use declared units.
- Currency is explicitly identified.
- Values fall within defined technical bounds.
- Unexpected fields are rejected or handled deliberately.
- Missing values are not silently replaced with zero.
The last point is important. Zero and unknown are not equivalent. If a finance rate is missing, substituting zero can make a model appear more profitable. A missing value should normally trigger a validation error or an explicit unresolved status.
Structural validation establishes that the model can be interpreted. It does not establish that the model is economically sensible.
3. Layer two: use deterministic checks for deterministic rules
Rules that can be expressed precisely should not depend on an LLM's judgment. For example, if a model defines construction cost as gross floor area multiplied by construction cost per square metre, the expected calculation is:\text{GFA}
\times
\text{Cost per sqm}
]
For the hypothetical inputs above:
[
12{,}000 \times £1{,}800 = £21{,}600{,}000
]
A deterministic test can independently calculate the expected result and compare it with the workbook output.
from decimal import Decimalgfa_sqm = Decimal("12000")
cost_per_sqm = Decimal("1800")
reported_cost = Decimal("21600000")expected_cost = gfa_sqm * cost_per_sqm
assert expected_cost == reported_cost
This test checks arithmetic for the stated formula. It does not establish that the GFA is permitted, that the cost rate is appropriate, or that the formula captures every relevant cost.
A production implementation should also define tolerances where appropriate, particularly when comparing rounded spreadsheet values or calculations involving floating-point numbers.
Other deterministic checks might include:
Revenue equals the sum of its components.- Total costs reconcile to their component schedules.
- Cash flow totals reconcile across periods.
- Unit counts and areas reconcile between schedules.
- The reported output matches an independently calculated result.
- A sensitivity case actually changes the intended input.
- Required formula cells are not unexpectedly blank or replaced by constants.
Where possible, use independent calculations rather than simply checking that a formula cell contains a formula. A formula can exist and still be wrong.
4. Layer three: validate model relationships
Many serious errors are not syntax errors or arithmetic errors. They are inconsistencies between parts of the model.Suppose a development model contains:
- 120 residential units in the unit schedule
- 116 units in the sales schedule
- Revenue calculated using the sales schedule
- Construction costs calculated using the unit schedule
Every formula may evaluate successfully, but the workbook contains a discrepancy that needs resolution.
Domain-level checks can flag conditions such as:
- Unit counts that differ across schedules.
- Areas that exceed a declared model constraint.
- Revenue periods that do not align with the programme.
- Cost totals that exclude a populated cost category.
- An exit value that uses an inconsistent timing assumption.
- A sensitivity scenario that changes revenue but leaves dependent calculations unchanged.
- An IRR calculation using a cash-flow range that omits a period.
These checks should be encoded as explicit rules wherever the intended relationship is known.
Some rules require context. For example, whether a particular cost should be included in a development budget depends on the model's scope and conventions. A validator should not impose a universal rule where none exists.
Instead, it should identify the relevant condition, record the rule being applied, and send ambiguous cases for review.
5. Layer four: validate the provenance of assumptions
A financial model can pass every arithmetic test and still fail as an analytical tool.The reason is straightforward: calculations cannot establish the truth of their inputs.
For every material assumption, a validation system should try to preserve:
- The value and unit.
- The source or origin of the value.
- The source's date and relevant data period.
- The geography and asset type, where applicable.
- The transformation from source evidence to model assumption.
- Any manual adjustment made by the analyst.
- The model locations that depend on the assumption.
Consider a construction cost assumption of £1,800 per square metre. A validator might confirm that the figure is numeric, the unit is recorded, and the workbook uses it consistently. Those checks do not establish whether the figure is suitable for the location, asset type, specification, and cost period. That question requires appropriate evidence and professional interpretation.
An LLM may help extract candidate assumptions from documents or explain how a value is used in a workbook. The extracted result should still be checked against its source, and the resulting assumption should remain distinguishable from the underlying evidence.
A useful principle is:
Traceability makes an assumption inspectable. It does not make the assumption correct.6. Layer five: make human review a defined state transition
Human review should not be an informal final glance after an automated process has already treated the model as complete.A practical workflow can represent validation explicitly:
GENERATED
|
v
STRUCTURE_CHECKED
|
v
CALCULATIONS_CHECKED
|
v
DOMAIN_CHECKED
|
v
EVIDENCE_REVIEWED
|
v
HUMAN_APPROVAL_REQUIRED
|
+----> APPROVED FOR THE DEFINED PURPOSE
|
+----> RETURNED FOR CORRECTION
|
+----> BLOCKED: UNRESOLVED ISSUEThe states are illustrative, but the distinction matters. A successful automated test should not automatically mean that a model is approved. Approval should be scoped to a defined version of the workbook, its assumptions, its evidence, and its intended use.
A reviewer should be able to see:- What was generated.
- Which automated checks passed.
- Which checks failed or were skipped.
- Which assumptions lack adequate evidence.
- What changed after a correction.
- Who approved the model and for what purpose.
If a material input or formula changes after approval, the system should identify which checks need to run again and whether the earlier approval remains valid. This is where versioning and change tracking become part of model governance rather than administrative overhead.
7. Design the exception path before the success path
Validation is often designed around a clean example: the model is generated, every check passes, and the user receives the output. Production systems need to handle less convenient outcomes.A failed check should produce actionable information. “Validation failed” is less useful than “The unit count in the sales schedule differs from the unit schedule; review the linked inputs before approving revenue.”
Similarly, a warning should not disappear simply because a later stage of the workflow succeeds. For auditability, preserve the check identifier, the model version, the result, the relevant evidence, and the resolution.
8. Measure validation quality without inventing an accuracy score
A single “model accuracy” percentage can hide important distinctions. A workbook might pass every arithmetic test while containing several unsupported assumptions. Another may contain a harmless formatting issue but have fully reconciled calculations and well-documented inputs.A more useful validation report separates categories:
- Structural checks passed or failed.
- Deterministic calculation checks passed or failed.
- Domain checks passed, failed, or were not applicable.
- Assumptions with verified, missing, or conflicting evidence.
- Open exceptions and their severity.
- Human review status.
- The scope and version of the approved output.
If the system is evaluated over time, track false negatives and false positives for individual validation rules against a reviewed test set. Record the test cases, expected outcomes, rule versions, and known limitations.
Do not interpret a high pass rate as proof that the model is correct. It may simply mean that the checks cover only a narrow set of failure modes.
The purpose of validation is to make known risks visible and testable, not to manufacture certainty.
9. A practical implementation sequence
A team introducing validation around AI-generated financial models does not need to automate every review step at once.A sensible sequence is:
- Define the contract. Specify the required inputs, output fields, units, and missing-value behaviour.
- Write deterministic tests. Start with totals, reconciliations, formula ranges, and independent calculations.
- Add domain checks. Encode known cross-schedule relationships and clearly defined constraints.
- Track provenance. Associate material assumptions with sources, dates, units, and transformations.
- Introduce exception handling. Make failures explicit and prevent unresolved material issues from being silently treated as passed.
- Define human approval. Record the reviewer, workbook version, purpose, and outstanding qualifications.
- Build a regression suite. Retain representative valid and invalid examples and rerun the checks when the generation logic or validation rules change.
The test suite should include deliberate failures, not only successful examples. Examples might include missing finance assumptions, inconsistent unit counts, a formula referencing the wrong period, and a source whose geography does not match the project.
This helps test whether the validation process detects the intended problem rather than merely accepting a plausible-looking output.
Conclusion
Human-in-the-loop validation is not a person checking an AI result after the important work is finished. It is a system design in which deterministic rules handle deterministic questions, domain checks expose inconsistencies, evidence is kept separate from assumptions, and a human reviewer remains accountable for unresolved judgments.For financial modelling, that distinction is material. A workbook can be well-formed without being economically sound, mathematically consistent without being supported by market evidence, and ready for review without being ready for a decision.
The objective is not to make every AI-generated model look trustworthy. It is to make the model's logic, assumptions, limitations, and unresolved issues sufficiently visible that a professional can challenge it before relying on the result.#feasibility #realestate #ai #financial #software #coding #development #engineering #inclusive #community
Human-in-the-Loop Validation for AI-Generated Financial Models -
A field note from the autonomous Claude Code agent I run every day on one Windows PC. The numbers...#ai #programming #claude #claudecode #software #coding #development #engineering #inclusive #community
My Ledger Said Nobody Took My Free Sample. I Had Never Checked What That Column Counts. -
-
Good evening for this #mountainMonday! I just show one more from our vacation in the #BayerischerWald during #Autumn a couple of years ago.
Honestly, I'd really like to be there again now. But that's probably the best memory one can have, right?
Anyways, Enjoy!
-
Disclosure up front: I run IPYE, a company that leases IP space. It gets one short paragraph at the...#bgp #networking #peering #internet #software #coding #development #engineering #inclusive #community
IXP Basics for Small Networks: Route Servers, Peering Policies, and PeeringDB -
This open source modular mechanical keyboard platform lets you build a custom keyboard one key at a time, since each has a tiny RISC-v microcontroler, pogo pins, and magnets that snap together. https://github.com/notaroomba/keybytes #KeybytesOpenSourceModularKeyboardPlatform #Keybytes #ModularKeyboard #Keyboard
-
🚀 Fastest-growing AI projects today
1. One standout project `speridlabs/iris-3b`, which a unique diffusion transformer that di...
2. `speridlabs/iris-3b` has seen significant growth thweek, with a Growth Score of 15.22 a...
3. The project's direct pixel-space generation approach sets it apart from other models, a...Full report → https://pullrepo.com/report/todays-image-video-generation-fastest-growing-projects-october-14-2026
-
...and I can if necessary sing nearly the full asthai text in less than one cycle, which means I can start well-nigh anywhere and land the resolution. So the work of this week is less about internalizing the song than about building new improvisational gestures that go beyond the melodic motions I already know thoroughly and deeply.
4/
-
#WordWeavers 26/10: Share a moment from your WIP when a character says one thing but means something completely different.
It’s more nuanced than that, because Wandell is frequently unclear in his own mind, but from the very first moment he appears (in Chapter 2) his desire for ‘reconciliation’ is not as clear and well-intentioned as he tries to present it.
#books #writing #writersofmastodon -
Good morning data nerds! Here is a fun one I made this weekend looking into some subnational data: 170 years of European nitrogen surplus (1850–2019)
🟢 = crops take up what's applied.
🔴 = heavy surplus: nitrogen on fields that ends up in water and air.The darkest reds in Flanders and the Netherlands: the never really faded.
Data: @ufz / Batool et al. 2025, Nature Food.
#data #dataviz #nitrogen #agriculture #farming #animatedGIF #map #climate
-
An agent that goes quiet for ten minutes does not feel autonomous. It feels broken. A spinner and a made-up “82% complete” label are not much better: they encourage users to trust a number your system cannot justify.
The fix is not to stream the model's hidden reasoning. It is to publish a small, evidence-backed account of the work: what phase the run is in, the last verified milestone, whether it needs a person, and what will happen next. This article shows how to build that contract for long-running, tool-using AI agents.
The progress problem is really a trust problem
Users ask three practical questions while an agent runs:- Is it still alive?
- Did it make meaningful progress?
- Do I need to do anything?
A token stream answers none of these reliably. It can continue while a tool is stuck, and it can stop even though a durable workflow will resume later. Likewise, an LLM-generated status such as “almost finished” is a prediction, not evidence.
Treat status as a product contract. The user-facing timeline should be derived from workflow events your system can verify: a job was accepted, a connector returned records, validation passed, an approval is waiting, or a final artifact was stored. The model may suggest a label, but it should not be the source of truth for state.
This distinction also protects privacy. A useful update is “Checked 42 invoices; 3 need review,” not a transcript of the agent's scratch work, retrieved customer text, or chain of thought.
Start with a state machine, not a progress bar
StateMeaning to the userRequired evidenceUseful UI action
Long-running agent work has more states thanrunningandfailed. Model the states explicitly and make transitions durable.queuedWork is accepted but has not startedrun record createdCancelrunningA worker currently owns the runlease heartbeatStopwaiting_on_toolThe run is awaiting a bounded external calltool request ID and deadlineCancelwaiting_on_userA decision or missing input is requiredapproval or question IDReview / answerretry_scheduledThe system will retry laterretry time and error classCancel / view detailssucceededThe requested result was verified and savedoutput receiptOpen resultfailedThe run cannot continue automaticallyfailure class and last checkpointRetry / contact supportcancelledWork was intentionally stoppedcancellation receiptRestart
Avoid a vaguepausedstate. If the workflow is paused because it needs an address, showwaiting_on_user. If it is paused because a vendor rate-limited it, showretry_scheduled. Specific state names let a user decide what to do without reading logs.Here is a compact TypeScript event shape. It is deliberately about observable work, not hidden reasoning.
type RunEvent = {
runId: string;
sequence: number; // monotonic per run
at: string;
type: "phase_started" | "milestone" | "approval_needed" |
"retry_scheduled" | "completed" | "failed";
phase?: "preparing" | "collecting" | "verifying" | "delivering";
message: string; // reviewed, user-safe copy
evidence?: {
kind: "artifact" | "tool_receipt" | "checkpoint" | "approval";
id: string;
};
action?: { label: string; url: string };
};Persist these events in the same transaction that changes workflow state, or attach them to an outbox. A UI event that says “report ready” before the report is stored is worse than no event at all.
Publish milestones, not a narrated thought process
Choose milestones at boundaries where the system can prove something changed. Good milestones are stable across model versions and useful if a run resumes tomorrow.For a document-analysis agent, the timeline might be:
- Request accepted
- Source file scanned and indexed
- 42 records extracted
- Policy checks completed
- Three exceptions need a decision
- Final report saved
Notice what is absent: “thinking about clause 7” or “I believe this source is probably relevant.” Those claims are neither a dependable progress signal nor an appropriate audit record.
Each milestone needs an owner. The workflow engine owns checkpoint messages; the connector owns data-fetch receipts; the policy service owns validation results. If no component can produce evidence for an update, leave it out.
That rule prevents a common failure mode: a chat interface keeps emitting cheerful prose while the actual job stopped moving. Your supervisor should detect stale progress independently of the agent. For example, mark a run
stalledinternally when its lease heartbeat is fresh but neither a checkpoint nor a tool receipt has advanced within the expected phase window. The user-facing text can then say, “Still working longer than expected; no action needed yet,” or escalate honestly to “This task needs attention.”Design an honest progress model
Percent complete works only when units of work are known. A migration over 10,000 rows has a denominator. An open-ended research task generally does not.Use one of these models instead:
Work shapeBest indicatorExampleFixed batchcompleted / total318 of 500 files checkedKnown workflowcompleted phaseVerifying findings (3 of 4 phases)Open-ended workelapsed time plus latest verified eventLast verified update: sources indexedApproval flowblocked state and decision impactNeeds approval before sending 3 emailsRetryable external worknext retry and preserved checkpointRetrying connector at 14:05; 18 items saved
Do not convert phase count into a false percentage. Four phases do not necessarily take equal time, and the model can loop inside one phase. If you show an estimate, label it as a range derived from similar completed runs, and hide it when the sample is weak.function statusCopy(run: Run) {
if (run.status === "waiting_on_user")
return "Your decision is needed before this task can continue.";if (run.completedUnits != null && run.totalUnits != null)
return `${run.completedUnits} of ${run.totalUnits} items verified`;return `Last verified update: ${run.latestMilestone.message}`;
}The word verified matters. It teaches users what the timeline represents and sets a standard your team can test.
Make waiting visible and actionable
The most damaging silence is not a slow model call. It is an agent waiting for a person while the product looks busy.An approval event should include the decision, the consequence, the safe default, and an expiry rule. Keep the payload concise and reviewable:
{
"type": "approval_needed",
"message": "Three customer records have conflicting addresses.",
"question": "Which address should be used for the renewal notice?",
"options": ["CRM record", "latest support ticket", "skip these records"],
"default": "skip these records",
"expires_at": "2026-10-26T15:00:00Z",
"evidence": { "kind": "approval", "id": "apr_8f2" }
}Never bury an approval in a scrolling chat. Surface it as a run state, send a notification only when action is required, and ensure a resumed run re-reads the approved decision from durable storage. This pairs well with approval gates, but it solves a different problem: making the wait understandable to the person who initiated the work.
Transport updates without building a fragile realtime system
Start with the simplest transport that fits your product.- Polling is enough for minute-scale background jobs. Return
status,latest_event, andetag; back off when nothing changes. - Server-sent events work well for one-way timelines and reconnect cleanly with
Last-Event-ID. - WebSockets fit collaborative workspaces where users can also approve, stop, or redirect a run live.
- Notifications should be sparse: completion, failure, and
waiting_on_userare normally worth interrupting someone; routine milestones are not.
Regardless of transport, the client must tolerate duplicate and out-of-order events. Use the
sequencefield, make the event stream append-only, and fetch the authoritative run snapshot after reconnecting. The UI is a projection; the workflow database remains the authority.Build the API around a durable run record
A small API surface is easier to secure and test than a channel full of ad hoc text.GET /runs/run_123
{
"status": "waiting_on_user",
"phase": "verifying",
"latest_event_sequence": 17,
"latest_event": {
"message": "42 records verified; 3 need a decision",
"at": "2026-10-26T12:04:12Z"
},
"actions": [{ "kind": "approve", "approval_id": "apr_8f2" }]
}Keep sensitive tool arguments, raw documents, and internal exception stacks behind a permissioned diagnostics view. The default run page should disclose only the minimum a user needs to understand progress and take the next action.
Test the status contract like an API
Status is part of the user experience, so add tests beyond the happy path:- A run cannot become
succeededwithout an output receipt. - A
waiting_on_userrun always exposes a decision action and cannot spend tools until it resumes. - Replayed events create the same final timeline.
- A reconnect receives no duplicate visible milestones.
- A cancelled run cannot later publish a success event.
- A stale worker lease produces an honest recovery state, not permanent “Working…” copy.
- User-safe messages contain no prompt, secret, customer text, or chain of thought.
it("does not claim success before output exists", async () => {
await workflow.emit({ type: "completed", evidence: undefined });
expect(await runs.get("run_123")).toMatchObject({ status: "failed" });
});This is also where observability earns its keep. Measure time to first verified milestone, time spent waiting for users, stale-run recovery rate, and the share of runs that finish with a useful artifact. Avoid treating the number of progress messages as a health metric; a noisy timeline can conceal a poor workflow.
A practical rollout plan
Do not retrofit every agent at once. Start with one workflow where users currently refresh a page or ask support whether a job is stuck.- Define the state machine and ownership of each transition.
- Add durable run records and one evidence-backed milestone per phase.
- Replace generic spinners with the latest verified update.
- Promote approval waits to a clear, resumable state.
- Add stale-run detection and a recovery message.
- Instrument completion quality, not just elapsed time.
The result is deliberately less theatrical than a stream of simulated thinking. It is far more useful: people can leave a long-running agent alone, return with context, and intervene exactly when their judgment is needed.
Keep the language stable across releases
Treat visible status copy as part of your API. Changingwaiting_on_userfrom “Needs your decision” to “Paused” may seem cosmetic, yet it can break notification rules, customer runbooks, and accessibility labels. Version the event schema, localize messages at the presentation layer, and keep a small compatibility test suite for every public state. That discipline pays off when new models, tools, and workflow engines arrive: the user still receives the same clear promise about what has happened and what they can do next.FAQ
Should an AI agent show its chain of thought as progress?
No. Show concise, evidence-backed milestones instead. They are more reliable, safer for sensitive data, and easier for users to act on.How often should an agent send status updates?
Update on meaningful state changes, verified milestones, and action-required moments. For long silent phases, add a bounded heartbeat that says the job is still owned, not a stream of filler messages.Is a percentage complete useful for AI agents?
Only when the work has a known denominator, such as files processed or records checked. Otherwise show the phase, elapsed time, and most recent verified milestone.What is the best state for an agent waiting on a person?
Use a specificwaiting_on_userstate with the exact question, a safe default, and a resumable approval ID. Do not leave the run labeledrunning.Can polling work for long-running AI workflows?
Yes. Polling is simple and reliable for background tasks that update every few seconds or minutes. Use ETags and backoff, then move to SSE or WebSockets only when the interaction requires it.How do you detect an AI agent that is stuck?
Track worker leases, tool deadlines, and the time since the last verified milestone. A supervisor outside the model should classify stale runs and surface a recovery state.#ai #ux #programming #devops #software #coding #development #engineering #inclusive #community
AI Agent Status Updates: Build Progress Users Can Trust Without Exposing Chain of Thought -
10-second spoiler-free movie review: "The End of Oak Street" (2026)
A popcorn movie that does what it says on the tin. Ewan McGregor and Anne Hathaway are great, and the rest of the cast is good. Except for one very short scene, it doesn't pretend to be deeper than it actually is, and there's a lot of "characters behaving like real-life" to boot.
Enjoyable.
#10SecondMovieReview #FilmReview #MovieReview #film #movie #review #SpoilerFree #NoSpoilers #PopcornMovie
-
🕳️ oddquark // Black Hole Watch — 2026-10-26
Three actively feeding supermassive black holes in ONE galaxy, 12.5+ billion light-years away, seen when the universe was a baby! 🤯 A triple monster system that early means black holes grew and clustered insanely fast. Future mergers would ring spacetime with gravitational waves. 🌌
🔗 http://www.sciencedaily.com/releases/2026/10/261024222000.htm
-
We handed the agent a webhook client that signs each outbound payload with HMAC before sending. It read the integration guide, built the serializer, and the local tests passed against a stub that accepted any well-formed body. Before opening the PR, it decided the body looked messy: the keys arrived in the order the fields were populated, so it ran a recursive sort to produce alphabetical, deterministic JSON.
The tests still passed. CI went green. The first production delivery returned
401 signature_invalid, intermittently — only for some payloads, because the receiver computed its digest over the exact bytes it received and expected the same field order the sender used in the signing step. The agent had treated object key order as cosmetic; for a signed payload, it is part of the contract.Why the tests stayed green
The test asserted that the body parsed and that the HMAC function was called with some secret. It never compared the digest against the exact serialized bytes the receiver would rebuild, and it never exercised the real signing serializer against a verifying server. A mock that only checks shape cannot tell you whether the bytes match, so a reformatted body sailed through.What actually broke
JSON objects are unordered semantically: a parser treats{a, b}and{b, a}as the same value. HMAC does not compare values, it hashes bytes. When the sender signs the body before sorting, then sorts before sending, the receiver rehashes the reordered bytes and gets a different digest. Same payload, same secret, valid structure — just a different byte order — fails verification. The sort happened between signing and transmission, which is exactly the window that has to stay byte-stable.Keep the signing step and the wire bytes identical
- Sign the exact serialized bytes you will send. Do not sign an in-memory object and transmit a reformatted copy.
- If deterministic ordering matters for verification, define one canonical serialization (sorted keys, fixed separators, no added whitespace) and apply it before the digest, on both sender and receiver. Never reformat after signing.
- Keep pretty-printing for logs only. Write the normalized debug copy to the log, and transmit the signed raw bytes.
Tests that catch this
- Sign a fixed payload, transmit it unchanged, and verify the digest recomputed from the received bytes equals the stored one.
- Reject any transform — sorting, pretty-printing, whitespace normalization — that runs after the signing call in the call stack.
- Replay one signed webhook against an environment that enforces the signature, not only a stub that parses the JSON.
Where the contract lives
When the signed shape and field order are stated in the integration spec, that spec should stay the source of truth locally rather than a hand-kept serialization note. This is the local-first workflow we built around in Powerduck: keep the contract on disk, validate the actual outgoing bytes against it, and replay one real request against an enforcing endpoint instead of trusting a permissive mock.Before you call the signing path done:
- Was the digest computed over the exact bytes transmitted?
- Did any sort, pretty-print, or normalize run after signing?
- Did a real verifying endpoint accept the signature, or only a shape-accepting stub?
- Is the expected serialization order written in the contract, not assumed?
A normalized, pretty body reads better in review. On the wire between two parties that sign, byte stability is the product. Order is free inside a parser; it is expensive after a digest.#aiagents #aicode #apicontract #security #software #coding #development #engineering #inclusive #community
The agent sorted the JSON body keys to tidy it up, and the request signature stopped matching -
Damn, that third movement of Shostakovich's Symphony No. 4! I just love how he finishes it with this unconventional, somber fade-away in four, with just the timpani, glockenspiel, and a figure from part of the reed section, after what you *thought* would be the full-orchestra climax. Did he hear this stuff in his dreams?
He got in trouble with Stalin for this one. Written in 1934-36, it wasn't performed until the '50s.
-
"SeqAudit is a small Python program (standard library only — nothing to pip install) that checks FASTA and GenBank files before you order synthesis or submit them:
Full disclosure: this is a commercial tool, not open source. It's a $29 one-time download"
-
Something relevant to working on the Braille Reader is that this is not like cracking the firmware of the BrailleNote MPower/Apex or some old synthesizer from a legal perspective. This is for all intents and purposes a series of devices that are still commercially sold, still used by hundreds of thousands of people everyday, and could still get me legally in trouble, especially if I distribute internal binaries from Humanware/APH. If this isn't done correctly, they'll just patch this in the next install, DMCA the hell out of me, and then no one will be happy and I will have probably nixed some professional relationships in the process. A lot of blind people seem to be haphazardly applying reverse engineering techniques while not thinking about the consequences and I'd rather not kick that hornet's nest.
This is a situation where you attach a flash drive and the entire display reboots and roots itself, technically a CVE. Someone could use this to hijack personal files from another person's display if they really wanted to, and I imagine Humanware will be incredibly motivated to address that, as they should be. -
The first version of a gift card balance often looks like one database column:
balance = 70. It works until someone asks a reasonable question: why is it 70?Was a purchase completed? Is part of the value temporarily held? Did a failed checkout release its hold? A single number cannot answer those questions on its own.
I find it more useful to think of the balance shown to a customer as a projection of events. The events explain how the card got there; the number is only the current view.
A small example
EventAvailableReservedUnspent valueIssue $100$100$0$100Redeem $30$70$0$70Reserve $20 for checkout$50$20$70Release the $20 hold$70$0$70
Imagine a card issued with $100 of value:
The reservation changes what can be spent right now, but it does not mean $20 has been redeemed. That distinction matters when a checkout times out or a payment is abandoned.If the checkout succeeds instead, the $20 hold becomes a capture: reserved value falls to zero and unspent value falls to $50. The available amount stays at $50 because it was reduced when the hold was created.
Make each transition explicit
One possible event model is:type Event =
| { kind: "issued"; amount: number }
| { kind: "redeemed"; amount: number }
| { kind: "hold_created"; amount: number }
| { kind: "hold_released"; amount: number }
| { kind: "hold_captured"; amount: number };function project(events: Event[]) {
let available = 0;
let reserved = 0;for (const event of events) {
switch (event.kind) {
case "issued": available += event.amount; break;
case "redeemed": available -= event.amount; break;
case "hold_created":
available -= event.amount;
reserved += event.amount;
break;
case "hold_released":
reserved -= event.amount;
available += event.amount;
break;
case "hold_captured": reserved -= event.amount; break;
}
}if (available < 0 || reserved < 0) throw new Error("Invalid ledger state");
return { available, reserved, unspent: available + reserved };
}This reducer is a way to read the history, not a complete transaction system. In production, the write that creates a hold has to be atomic with the check that enough value is available. Each hold also needs an identifier, so a release or capture applies to the right checkout rather than merely subtracting an amount from a shared bucket.
The question I'd put on the dashboard
Instead of showing only “Balance: $50,” I would show “$50 available” and, when relevant, “$20 pending.” The support view should show the event trail behind both figures. If a customer says a purchase failed but their balance dropped, there is now a concrete place to look.This is the kind of small systems detail I pay attention to when writing about gift cards at CardNaro. The interesting question is rarely just what is the balance? It is what happened to it?#database #typescript #fintech #architecture #software #coding #development #engineering #inclusive #community
A Gift Card Balance Is a Projection, Not Just a Number -
Thank You, Brussels: Making the Dashboard the Next USB-C
In part one I argued that convenience is the bait, and that doing things the hard way is worth the friction. I also conceded Cory Doctorow’s point: individual choices won’t fix enshittification. Policy will. This post covers why GrapheneOS needs that policy to survive, who is actually writing it, where they should point it next, and what you can do to help.https://fed.brid.gy/r/https://gaggl.com/blogs/2026-10-26-thank-you-brussels/
-
This is a horrendously bad article for a trade publication - for one thing Angela Rayner is now Housing Minister and hasn't been Deputy Prime Minister for some time, but in some ways a shame she didn't leverage this a couple of years ago, although she is a bit too defeatist about dealing with ECUs - many affordable scan tools exist, and if you can read, count and follow basic processes you can often still fix a modern car (plus things like distributor/points that needed regular adjustment no longer exist, so services can be less hassle these days!)
I wonder why she only mentioned it now? (unless she was #driving on roads *before* 17 which isn't legal but a lot of Gen X did do that in cities as Police were overwhelmed by the rave/drug subculture)
-
Here's your status #America. You have one elected official, @[email protected], that has openly stated a home is a #human #right & SHE IS THE ONLY ONE! And now #MissKitty knows a home is essential to #healthcare and I hope #Stansbury picks up on that. You can't take care without a home. 🔦🔦🔦
-
Picture this: Poland's Katowice is throwing a #NYE bash in 2026 that includes burlesque shows, DJ nights, AND an open-air concert at the legendary Spodek venue—because apparently one way to ring in the new year just isn't enough! 🎉 Club Garage and CityPub are already confirmed, with more #EuropeanNightlife surprises dropping later this year. Whether you're into underground vibes or massive festival energy, this #NewYearsEve celebration has your ...
-
An agent-first, lightweight web UI that puts Claude Code, Codex, local Llama and DeepSeek in one tab.#devchallenge #hf26challenge #opensource #ai #software #coding #development #engineering #inclusive #community
I Was Too Lazy to Open Five AI Tabs, So I Built AgentWebUI 🦥 -
You can’t get enough Taylor Swift, one of the least-hyped artists of this era. OK, we joke, but it is fascinating that her self-titled debut album came out 20 years ago today. Who knew Swift would evolve into one of the most recognized stars the music industry has ever seen? @RollingStone takes a look back at the talented musician’s illustrious career:
-
All the Bourbakists will puke their calvados at this that they tell everyone is best cognac. Well, I am a Euclidist.
We simply call the circumference of a circle peace ☮. Then we call the radius of the same circle one 1. Now we use straightedge and compass to construct the integers.
That is it.
-
The perfect recipe: pasta all’amatriciana, the classic that never goes out of style
“Amatriciana has been on our menu since day one because, having opened as a trattoria, it was important to us to serve the great classics of Roman cuisine. Amatriciana is one of them. You…
#dining #cooking #diet #food #ItalianRegionalCuisine #Italia #Italian #italiano #italy #regionalcuisine
https://www.diningandcooking.com/2870880/the-perfect-recipe-pasta-allamatriciana-the-classic-that-never-goes-out-of-style/ -
"While some headlines this weekend had suggested the movie was being 'pulled,' distributor Bleecker Street is simply preparing to announce a new plan that will give the movie a somewhat shorter runway in theaters and a longer one on VOD.
"Originally scheduled for a Nov. 24 debut on paid platforms, the movie will now come to paid VOD on Nov. 6. It will continue to play in theaters until then; after playing on 60 screens last weekend, it will be in an as-yet-undetermined number this weekend. Simultaneous plays in theaters after the VOD release are also possible, a company representative said."
https://www.hollywoodreporter.com/movies/movie-news/where-to-watch-elon-musk-documentary-1236740296/
-
"Newton, I am not wrong. There is only one way to make sure... And that is to do this... Together. I'll go with you. That's what the jaeger pilots do, share the neural load."
"You're serious? You — you would do that for me? Or would do that with me?"
— pacific rim (2013)
-
Who owns your phone, when you buy a new one? Easy answer would be: the person who bought the phone. But that's not completely true.
In UK we see that people who bought a new iPhone had to verify their age using their ID card to get unrestricted access to the device as David Bombal explains in this short.
We see that baselines are shifting, slowly. Once we are used to it, the next step is about to follow. Today it's age verification. C'mon, it doesn't hurt. It's done very quick, you only need your ID, once....
But what's next? The digital wallet is just around the corner. It will make everything so much easier, for everyone – including those who want to monitor us.
Welcome to our private Truman Show.