home.social

Search

160 results for “Drift_Life”

  1. In modern C++, when you need a std::unique_ptr, the idiomatic way to create it is:

    auto ptr = std::make_unique<MyClass>();

    rather than manually new-ing the object inside the unique_ptr constructor:

    std::unique_ptr<MyClass> ptr{new MyClass()};

    std::make_unique was introduced in C++14 to fill a gap that std::make_shared had already covered for shared ownership. It is a small function template, but it carries several important advantages. This article walks through every reason to prefer it, notes what changed in C++17 and C++20, and covers the cases where you still need the raw new form.

    the implementation is roughly the following:

    namespace std
    {
    template<typename T, typename... Args>
    std::unique_ptr<T> make_unique(Args... args) noexcept
    {
    return std::unique_ptr<T>(new T{std::forward<Args>(args)...});
    }
    }

    1. Exception Safety


    This is traditionally cited as the main reason for make_unique. Before C++17, the order in which function arguments are evaluated was unspecified. If you constructed a unique_ptr with new as one argument among several, a leak could occur if another argument threw after the new expression completed but before the unique_ptr constructor took ownership of the raw pointer.

    Here is an example:

    class T {};

    struct U {
    U()
    {
    throw std::runtime_error("boom");
    }
    };

    int main()
    {
    foo(std::unique_ptr<T>{new T{}}, std::unique_ptr<U>{new U{}});
    }

    Before C++17, a compiler was permitted to evaluate new T{} first, then evaluate new U{}, and only then call the unique_ptr constructors. If new U{} threw, the memory allocated for T had not yet been handed to a unique_ptr, so it leaked.

    std::make_unique closes this hole because the allocation and the ownership transfer happen inside a single function call. The temporary unique_ptr is fully constructed before the surrounding expression continues, so if a later argument throws, stack unwinding destroys the already-constructed unique_ptr and frees the memory.

    What changed in C++17


    C++17 tightened the evaluation-order rules. In a function call, each argument expression is now fully evaluated before the next argument is evaluated, although the order in which the arguments are evaluated relative to each other is still unspecified. Because of this, the manual new form is no longer leak-prone in the exact multi-argument scenario above: once new T{} completes and its unique_ptr temporary is constructed, that temporary is a fully formed object, and an exception from another argument will destroy it correctly.

    So if you are compiling as C++17 or later, the exception-safety motivation for make_unique is largely historical. The remaining reasons below are still valid.

    2. Reduced Redundancy and auto Type Deduction


    Using make_unique lets you write the type name once and rely on auto:

    std::unique_ptr<MyClass>(new MyClass(args)); // MyClass written twice
    auto ptr = std::make_unique<MyClass>(args); // written once

    Beyond brevity, this eliminates a class of bugs where the two type names drift apart during refactoring: one is changed but the other is not, producing a mismatched or ill-formed expression. The C++ Core Guidelines encode this as R.23: Use make_unique() to make unique_ptrs, citing both conciseness and exception safety.

    Polymorphism caveat


    make_unique does not perform polymorphic type erasure automatically. With auto, you get exactly the unique_ptr<T> corresponding to the template argument:

    struct Base {
    virtual ~Base() = default;
    };
    struct Derived : Base {};

    auto p1 = std::make_unique<Base>(); // std::unique_ptr<Base>
    auto p2 = std::make_unique<Derived>(); // std::unique_ptr<Derived>, not unique_ptr<Base>

    If you want a base-class handle, you must state the target type explicitly:

    std::unique_ptr<Base> p = std::make_unique<Derived>();

    This works because unique_ptr<Derived> converts to unique_ptr<Base> when Derived* converts to Base*. Also note the virtual destructor on Base: without it, deleting a Derived through a Base* is undefined behavior.

    3. Enforcing a "No Raw new" Discipline


    Every occurrence of new in application code must be audited for lifetime correctness: is it deleted exactly once, through the correct type, with the correct delete form? make_unique removes that audit burden from the call site. If the owning object has a correct lifetime, the unique_ptr it produces has a correct lifetime.

    This lets you adopt a simple, mechanically checkable rule: do not write new in your codebase except inside the implementation of a factory or a low-level container. As Scott Meyers and others have put it, make_unique teaches “never say new/delete” without disclaimers.

    4. Array Safety


    make_unique distinguishes scalar and array types and returns the appropriate unique_ptr:

    auto a = std::make_unique<int[]>(10); // std::unique_ptr<int[]>
    auto b = std::make_unique<int>(42); // std::unique_ptr<int>

    With the manual constructor, nothing prevents you from writing a mismatched pair such as std::unique_ptr<int>(new int[10]) or std::unique_ptr<int[]>(new int(42)), both of which lead to undefined behavior when the default deleter uses the wrong delete form.

    (make_unique<T[N]> for a fixed bound N is also permitted, but it is almost always a mistake because unique_ptr<T[N]> does not have array-covariant behavior in the way you might expect.)

    5. Consistency with make_shared and Easy Switching


    You should already be using std::make_shared for shared ownership (it performs a single combined allocation, unlike shared_ptr<T>(new T)). Using make_unique gives your codebase a uniform creation syntax:

    auto u = std::make_unique<T>(args);
    auto s = std::make_shared<T>(args);

    This consistency pays off when requirements change. Switching between exclusive and shared ownership becomes a one-token edit:

    auto p = std::make_unique<T>(args); // change to std::make_shared<T>(args)

    With the manual form, that switch requires rewriting the declaration, removing new, and reconciling the deleter.

    6. std::make_unique_for_overwrite (C++20)


    C++20 added std::make_unique_for_overwrite for the case where you want to allocate an object without value-initializing it:

    auto buffer = std::make_unique_for_overwrite<char[]>(size);
    auto obj = std::make_unique_for_overwrite<MyPod>();

    For scalar types, make_unique<T>() value-initializes (T()), which zero-initializes fundamental types. For large buffers this can be an unnecessary cost. make_unique_for_overwrite performs default-initialization instead, matching what new T does for fundamental types, while preserving all the ownership and exception-safety benefits of the factory function.

    When Not to Use std::make_unique


    There are two well-defined cases where the manual constructor is still required.

    Custom deleters


    make_unique always uses std::default_delete<T>, which calls delete (or delete[]). It cannot accept a custom deleter, because its variadic template parameters are forwarded to the object constructor, not to the unique_ptr constructor. If you are wrapping a C API handle or a resource that is not released with delete, construct the unique_ptr directly:

    std::unique_ptr<FILE, decltype(&fclose)> file{std::fopen("data.bin", "rb"), &fclose};

    A common workaround is to define your own make_unique overload for the resource type in your own namespace.

    Private or protected constructors


    std::make_unique is not a friend of your class, so it cannot invoke a private or protected constructor. If a class restricts construction to factory member functions, the factory must construct the raw pointer internally and pass it to a unique_ptr:

    class Widget {
    private:
    Widget();
    public:
    static std::unique_ptr<Widget> create() {
    return std::unique_ptr<Widget>(new Widget());
    }
    };

    or you can use the PassKey idiom if you really want to use std::make_unique

    class Widget {
    public:
    class Key {
    private:
    // this constructor is private
    Key() = default;
    friend class Widget; // only this class can make a Key
    };

    // "Public" constructor, but requires a Key you can't forge.
    Widget(Key, int size) : size_(size) {}

    static std::unique_ptr<Widget> create(int size) {
    return std::unique_ptr<Widget>(new Widget(Widget::Key{}, size));
    }
    private:
    int size_;
    };

    int main()
    {
    Widget w(Widget::Key{}, 5); // error: Key's constructor is private
    }

    but the passkey idiom is a topic for a separate post, so we won't expand on it here.

    Here's a more playful version of the summary, keeping the same substance:

    Summary


    Default to std::make_unique. Its headline selling point — exception safety — has lost some of its bite since C++17 tightened the evaluation-order rules, so consider the famous leak example a historical artifact rather than a live threat. The other arguments, though, are still pulling their weight: it writes the type once instead of twice, it plays nicely with auto, it keeps your arrays and scalars from getting their deletes crossed, and it lets you adopt a clean "no raw new" policy without asterisks.

    Reach for the manual unique_ptr constructor only when make_unique genuinely can't help you: custom deleters (it always uses default_delete) and constructors that are private or protected. Everywhere else, let make_unique do the new-ing so you don't have to.#cpp #programming #software #coding #development #engineering #inclusive #community
    Why prefer std::make_unique over new in std::unique_ptr?

  2. When transitioning from the manual, error-prone world of "ClickOps" in cloud portals to production-grade engineering, mastering Infrastructure as Code (IaC) is non-negotiable.

    In this walkthrough, we will explore a real-world project that provisions foundational Azure cloud networking using Terraform and the latest AzureRM 4.x provider, all orchestrated within an isolated DevPod containerized development environment powered by mise.

    Whether you're studying for cloud certifications or standardizing your team's cloud infrastructure footprint, this guide breaks down the architecture, codebase, security hygiene, and lessons learned along the way.

    🎯 Project Objectives


    Before writing a single block of HCL (HashiCorp Configuration Language), we outlined clear requirements:

    1. Deterministic & Repeatable Provisioning: Zero reliance on manual Azure Portal configurations.
    2. Predictable Developer Workspace: Avoid version discrepancies across developer machines by leveraging DevPod, Docker, and mise.
    3. Sound Networking Foundations: Establish an isolated Virtual Network (VNet), dedicated application subnet, and Network Security Group (NSG).
    4. Strict Security Hygiene: Isolate credentials using Microsoft Entra ID service principals with zero secrets leaking into version control.


    🏗️ Architecture Overview


    The infrastructure deployed by this project represents the foundational landing zone for any cloud-hosted application:

    +-------------------------------------------------------------------+
    | Azure Subscription |
    | |
    | Resource Group: rg-terraform-lab (Central India) |
    | +-------------------------------------------------------------+ |
    | | Virtual Network: vnet-terraform-lab (10.10.0.0/16) | |
    | | | |
    | | +-------------------------------------------------------+ | |
    | | | Subnet: snet-app (10.10.1.0/24) | | |
    | | | | | |
    | | | [ Protected by NSG: nsg-terraform-lab ] | | |
    | | +-------------------------------------------------------+ | |
    | +-------------------------------------------------------------+ |
    +-------------------------------------------------------------------+

    Component Breakdown

    ResourceTerraform Resource TypeConfiguration / PurposeResource Groupazurerm_resource_groupLogical container (rg-terraform-lab) hosted in Central India with common tagging.Virtual Networkazurerm_virtual_networkIsolated address space (10.10.0.0/16) defining the private cloud boundary.Subnetazurerm_subnetApplication tier subnet (10.10.1.0/24) allocated for compute or workloads.NSGazurerm_network_security_groupFirewall filter governing ingress and egress rules.Subnet Associationazurerm_subnet_network_security_group_associationDecoupled link binding the NSG to the application subnet.

    🧰 The Modern Developer Toolchain


    One common headache in cloud engineering is tool mismatch: "It works on my machine because I'm on Terraform 1.5, but CI failed because it's running 1.9."

    To eliminate this friction, this project couples DevPod / Dev Containers with mise:

    1. Unified Tooling with mise


    Instead of cluttering the host machine with multiple version managers (tfenv, nvm, pyenv), mise.toml pins exact binaries:


    [tools]terraform = "1.16.6"
    uv = "0.13.1"

    2. Isolated Workspace via Dev Containers


    Our .devcontainer/Dockerfile layers mise directly on an official Ubuntu 24.04 base:

    FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04

    COPY --from=jdxcode/mise /usr/local/bin/mise /usr/local/bin/

    RUN echo 'eval "$(mise activate bash)"' >> /home/vscode/.bashrc && \
    echo 'eval "$(mise activate zsh)"' >> /home/vscode/.zshrc

    RUN usermod -aG root vscode

    Whenever a developer spins up this workspace via DevPod, VS Code Dev Containers, or GitHub Codespaces, they immediately enter an identical, battle-tested environment.

    🔐 Authentication & Credential Hygiene


    For automated Terraform deployments against Azure, authenticating as a Microsoft Entra ID Service Principal is the industry standard.

    Exporting AzureRM Credentials


    We configure authentication using the four core environment variables consumed natively by the HashiCorp AzureRM provider:

    • ARM_CLIENT_ID
    • ARM_CLIENT_SECRET
    • ARM_TENANT_ID
    • ARM_SUBSCRIPTION_ID

    These are stored locally in .env.azure (which is strictly added to .gitignore):

    export ARM_CLIENT_ID="<YOUR_APP_REGISTRATION_CLIENT_ID>"
    export ARM_CLIENT_SECRET="<YOUR_CLIENT_SECRET_VALUE>"
    export ARM_TENANT_ID="<YOUR_ENTRA_TENANT_ID>"
    export ARM_SUBSCRIPTION_ID="<YOUR_SUBSCRIPTION_ID>"

    To load them cleanly in your active shell:

    set -a
    source .env.azure
    set +a


    ⚠️ Security Tip: Always verify that your credentials file is ignored by Git prior to making commits:
    git check-ignore -v .env.azure


    💻 Terraform Code Structure


    A clean, modular folder layout ensures that code remains readable and easy to maintain as infrastructure grows:

    azure-terraform/
    ├── .devcontainer/
    │ ├── devcontainer.json
    │ └── Dockerfile
    ├── .gitignore
    ├── .env.azure # Keep local & secret!
    ├── mise.toml
    ├── README.md
    └── terraform/
    ├── versions.tf # Terraform & provider constraints
    ├── providers.tf # Provider configurations
    ├── variables.tf # Configurable input parameters
    ├── main.tf # Resource definitions
    └── outputs.tf # Exported attributes

    Let's inspect the key configuration files:

    1. terraform/versions.tf & providers.tf


    Pinning modern versions avoids surprise breaking changes:

    # versions.tf
    terraform {
    required_version = ">= 1.6.0"

    required_providers {
    azurerm = {
    source = "hashicorp/azurerm"
    version = "~> 4.0"
    }
    }
    }

    # providers.tf
    provider "azurerm" {
    features {}
    }

    Note: In azurerm v4.0+, the features {} block remains mandatory.

    2. terraform/variables.tf


    Parameterizing region, names, and CIDR blocks keeps our configuration DRY:

    variable "resource_group_name" {
    description = "Name of the Azure resource group"
    type = string
    default = "rg-terraform-lab"
    }

    variable "location" {
    description = "Azure region for the infrastructure"
    type = string
    default = "Central India"
    }

    variable "vnet_address_space" {
    description = "Address space for the virtual network"
    type = list(string)
    default = ["10.10.0.0/16"]
    }

    variable "subnet_address_prefixes" {
    description = "Address range for the application subnet"
    type = list(string)
    default = ["10.10.1.0/24"]
    }

    3. terraform/main.tf


    Here we provision the resource group, virtual network, subnet, NSG, and their association:

    resource "azurerm_resource_group" "lab" {
    name = var.resource_group_name
    location = var.location

    tags = {
    environment = "lab"
    managed_by = "terraform"
    project = "azure-infrastructure"
    }
    }

    resource "azurerm_virtual_network" "lab" {
    name = "vnet-terraform-lab"
    location = azurerm_resource_group.lab.location
    resource_group_name = azurerm_resource_group.lab.name
    address_space = var.vnet_address_space

    tags = {
    environment = "lab"
    managed_by = "terraform"
    }
    }

    resource "azurerm_subnet" "app" {
    name = "snet-app"
    resource_group_name = azurerm_resource_group.lab.name
    virtual_network_name = azurerm_virtual_network.lab.name
    address_prefixes = var.subnet_address_prefixes
    }

    resource "azurerm_network_security_group" "lab" {
    name = "nsg-terraform-lab"
    location = azurerm_resource_group.lab.location
    resource_group_name = azurerm_resource_group.lab.name

    tags = {
    environment = "lab"
    managed_by = "terraform"
    }
    }

    # Explicit decoupling: association resource rather than an inline subnet block
    resource "azurerm_subnet_network_security_group_association" "app" {
    subnet_id = azurerm_subnet.app.id
    network_security_group_id = azurerm_network_security_group.lab.id
    }


    💡 Best Practice Note: Avoid declaring subnets inline within the azurerm_virtual_network resource. Managing azurerm_subnet and azurerm_subnet_network_security_group_association as dedicated resources avoids configuration drift, circular dependencies, and unexpected resource replacements.


    4. terraform/outputs.tf


    Outputs expose resource attributes that downstream modules or CLI scripts can consume:

    output "resource_group_name" {
    description = "Azure resource group name"
    value = azurerm_resource_group.lab.name
    }

    output "virtual_network_name" {
    description = "Azure virtual network name"
    value = azurerm_virtual_network.lab.name
    }

    output "virtual_network_id" {
    description = "Azure virtual network resource ID"
    value = azurerm_virtual_network.lab.id
    }

    output "subnet_id" {
    description = "Application subnet resource ID"
    value = azurerm_subnet.app.id
    }

    output "network_security_group_id" {
    description = "Network security group resource ID"
    value = azurerm_network_security_group.lab.id
    }

    🚀 Execution & Verification Flow


    Navigating to the terraform/ directory, the deployment follows the canonical Terraform workflow:

    1. Initialization & Linting


    # Initialize working directory & download AzureRM provider
    terraform init

    # Canonical format checking
    terraform fmt -recursive

    # Syntax and structural validation
    terraform validate

    2. Planning


    terraform plan

    Terraform determines the execution graph and confirms the exact 5 resources to be created:

    Plan: 5 to add, 0 to change, 0 to destroy.

    3. Application


    terraform apply

    Type yes when prompted. In less than 30 seconds, Azure confirms all resources are created.

    4. Verification


    Inspect the live state directly from your terminal:

    terraform state list

    Expected output:

    azurerm_network_security_group.lab
    azurerm_resource_group.lab
    azurerm_subnet.app
    azurerm_subnet_network_security_group_association.app
    azurerm_virtual_network.lab

    You can view the exported IDs at any time:

    terraform output

    Or verify them using the Azure CLI:

    az network vnet show \
    --resource-group rg-terraform-lab \
    --name vnet-terraform-lab \
    --output table

    🛡️ Critical Lessons Learned & Production Considerations

    1. Local State vs. Remote Backend


    In this learning lab, local state (terraform.tfstate) is used. However, in a team or production setup, never rely on local state. Local state cannot prevent concurrent writes and risks leaking secrets.
    Production path: Migrate to an Azure Blob Storage backend with state locking via Azure Blob Leases:

    terraform {
    backend "azurerm" {
    resource_group_name = "rg-tfstate"
    storage_account_name = "sttfstatelab123"
    container_name = "tfstate"
    key = "networking.terraform.tfstate"
    }
    }

    2. Avoid Static Client Secrets in CI/CD


    While .env.azure is great for fast local iteration, CI/CD pipelines (like GitHub Actions or GitLab CI) should utilize Azure Workload Identity Federation (OIDC). OIDC uses short-lived tokens without storing long-lived passwords or client secrets in your repository settings.

    3. Tagging Strategy


    Tagging resources early (environment = "lab", managed_by = "terraform") makes cost attribution and lifecycle tracking drastically easier as the infrastructure expands.

    🧹 Tearing Down (Zero Cost Surprise)


    When your lab session concludes, cleanup is just as important as creation to prevent runaway cloud charges:

    # Review what will be destroyed
    terraform plan -destroy

    # Tear down all resources cleanly
    terraform destroy -auto-approve

    🗺️ What's Next?


    From here, this foundation is primed for expansion:

    • [ ] Add Compute: Provision an Azure Virtual Machine or Azure Kubernetes Service (AKS) inside snet-app.
    • [ ] Implement GitHub Actions with OIDC for automated pull-request validation (fmt, validate, tflint, and plan).
    • [ ] Modularize the networking configuration into a reusable Terraform Module.


    💬 Let's Connect


    How do you manage your local vs. remote Terraform environments? Are you using DevPod or containers for cloud tooling? Let me know in the comments below!

    If you found this helpful, feel free to ❤️ or 🦄 this post!#devops #terraform #azure #automation #software #coding #development #engineering #inclusive #community
    Provisioning Resilient Azure Infrastructure with Terraform, DevPod, and mise: A Hands-On Guide

  3. Cursebinder – Psychohazard Review By Grin Reaper

    In the Rush documentary Beyond the Lighted Stage,1 Jack Black describes musicians’ wells of creative juices as ‘rocket sauce.’ He notes that some musicians and bands only muster enough for one BIG album, while others seem to run on an endless supply.2 This description stuck with me through the years, and remains my go-to reference when someone gilds whatever they touch. Kraków vocalist Maciej Proficz is one such individual, and both his active projects Dormant Ordeal and Cursebinder run on vast reserves of rocket sauce while offering multifaceted interpretations of their respective genres. Dormant Ordeal’s Tooth and Nail landed at the #3 spot in last year’s Aggregated List; third album The Grand Scheme of Things received a glowing review from Dr. Wvrm and appeared on several 2021 end-of-year lists despite a late December release, and Cursebinder’s debut Drifting found itself atop Carcharodon’s Top Ten(ish) of 2023. Such accolades can’t guarantee future triumphs, but they can send expectations into the stratosphere—does Cursebinder’s sophomore album Psychohazard harness the rocket sauce to send us there?

    Though Cursebinder operates under the black metal umbrella, no single genre encapsulates Psychohazard’s breadth. In his write-up of Drifting, Carcharodon cites doom, death, and post-metal as descriptors for Cursebinder’s chameleonic character. Instead of using camouflage in a way that makes Psychohazard difficult to absorb or engage with, though, this Polish quartet employs it to disguise barriers between genres and inculcate an atmosphere both familiar and unique. Compared to Drifting, Psychohazard submits more direct applications of riffs (“Saturnine Rage,” “Prayers for the Living, Flowers for the Dead”) and synths (“Limits”), and where Drifting’s genre-hopping evinced distinct moods with thoughtful transitions, Psychohazard blurs lines together with subtler craft.3 Psychohazard’s first four tracks flow together in a sublime strand that ricochets between textured aggression (“Death Season”) and gentler grooves (“The Astronaut”), culminating in a rabid fusion that seethes with angst and catharsis (“Saturnine Rage”). Honestly, this track would make a resounding closer, and to use it at Psychohazard’s midpoint illustrates the puissance of Cursebinder’s surrounding material.

    Merging these sounds into a unified platter requires keen grace, and to then layer in the emotional depth that Cursebinder achieves is stunning. Cursebinder’s promo materials describe Psychohazard’s theme as a study in the collision of life’s ‘rat race’ and humanity’s inherent desire for love and acceptance. As the demands of my own life continue to creep,4 this idea strikes a chord that thrums with self-renewing relevance every day. “Death Season” bustles with vitriol and vigor as Proficz’s caustic vocals impel the track in a blinding tempest, while “The Astronaut” and “Under the Skin” float upon currents that relax and unwind one moment before boiling over into frenzied bursts the next. But even this is an oversimplification, as each track proves vibrant and diverse, refusing to condense into single emotions. Broadly, the back half of Psychohazard feels lighter than the front, putting more emphasis on dimensions that evoke post-metal’s vagrant dreaminess without losing the threads of riffs or motifs.

    Considering Cursebinder’s sprawling ambitions, Psychohazard sounds focused and urgent throughout its runtime. The post-addled haze never drifts too far, the scorching fury never burns too hot, and the tender flashes never linger long enough to caramelize into mawkishness. I credit this purposefulness to the efficient instrumentation that Cursebinder unfurls with nary a wasted flourish. Guitarist Hubert Fudała and bassist Łukasz Sojka wend together in climactic swells and releases that expertly pace the album’s fifty-three minutes,5 and Marek Koszycki drums with nuanced timekeeping that flits between punk-powered d-beats (“Saturnine Rage”), insistent blast beats (“Made to Be Sold”), and delicate rhythms (“The Astronaut”). Proficz’s synth presence penetrates Psychohazard’s compositions, and in totality Cursebinder rewards repeat listens as each musician’s contributions impress individually while coalescing into an assembly greater than its sum.

    Although post-related tags usually thwart my interest, something about Cursebinder’s spell called to me from beyond the ether. Psychohazard proves textures and layers can inculcate depth rather than acting as a standalone attraction, and going forward I hope to point to Cursebinder as my entry point into appreciating a wider expanse of metal. Cursebinder’s faults are few, and even if the record is slightly front-loaded or a few songs linger a tad overlong, these nitpicks pale in light of Psychohazard’s utter glory. If you seek an album that synthesizes the aura of post-metal with more conventional metal structures, I doubt you’ll find a better album this year. Barring that, you should listen to Cursebinder anyway, because missing it could be a Psychohazard to your health.

    Rating: Great!
    DR: 6 | Format Reviewed: 320 kbps mp3
    Label: Avantgarde Music
    Websites: Bandcamp6 | Facebook | Instagram
    Releases Worldwide: October 23rd, 2026

    #2026 #40 #AvantgardeMusic #BlackMetal #Cursebinder #DormantOrdeal #Oct26 #PolishMetal #PostBlackMetal #Psychohazard #Review #Reviews #Rush
  4. Beaten to Death – Vntrve Review By Dolphin Whisperer

    Though it may only take you five or so minutes to read—well, one to skim, ten seconds to stare at the scores, another few to check whether the score safety counter still works, 30 seconds to draft a snarky “what is this site coming to” comment that you delete, a couple minutes to see what other bewildered folks have to say about something completely unrelated, and a final scan to skim the conclusions again—this article, and another 26 minutes to listen to Vntrve if you please, the beauty of Beaten to Death lies in that none of that will be enough time. In a genre of microblasts and unintelligible grunts and barks and bleats, this Norwegian exercise in twanged-out chaos delivers methodical and memorable vignettes of pure punk outpour. If there ever were a cure for stagnation, grindcore—particularly the buoyant and eclectic variety that Beaten to Death produces—would be it.

    To this point, Vntrve true to legacy, Beaten to Death has never put out the same album twice. At first blush, between the booming Norwegian rap intro1 and groovier pacing to match (“Slosspit”), it feels as though Beaten to Death doesn’t even want to grind. The traditions of grind would, of course, feel like shackles to the wiles of these time-tested tricksters. Yet, blast-addled breakaways crash into reggaeton dembows (“Electrocuted by the Sky”), reverb-soaked sax wailing (“The Tolerator”), and twisted synth dial screeches (“Vntrve”). Near every song challenges the expectations of grind, right down to the continued inclusion of their trademarked “distort the bass only” aggression tactic, which Beaten to Death also manages to subvert with a doomy opening guitar boom on “Memento Sugo.” It’s Christian Svendsen’s (Doedsvangr, ex-Tsjuder) reckless kick and snare play, really, that keeps transitioning moments tied to the necessary whiplash of the base genre. If you know what’s coming next, it’s a result of repeated digestion of Vntrve’s nooks and crannies.

    Even on first listen, Vntrve reveals its tendency for barbed hook and diverse expression. As if B2D didn’t already have an ear for unmistakable melodies, the kind of post-hardcore-imbued flutters that would feel at place scattered about a The Fall of Troy or Botch jam (“Electrocuted by the Sky,” “(Du er verken Jesus eller Buddha) Du er Ugmod”), their ability to frame these moments of beauty against crash cymbal overloaded gallops and tattered layers of barks allows each song’s thread to weave that much tighter. Now seven albums down this idiosyncratic path, Beaten to Death runs the risk of sounding too much like themselves. And it’s true that the main riffs to “The Tolerator,” “Scroll On, Homeboy,” and “Satan Spawn, the K-Pop Demon” wear that identity proudly. But when there are ten others songs that each bring their own ideas to the table, these brief retreads—and I do mean brief; this is still grind after all—do little to get in the way of frequent enjoyment, especially when that enjoyment means shouting “SCROLL OOOON! HOME-BOY!”

    And a high frequency of playthroughs will reveal hidden treasures around every corner of Vntrve. On more than one occasion, as I played through the tapped-harmony transition of “Fångad i en Battle Vest,” I paused to find which Death song most fit as the proper object of homage and smiled as I could unite two legendary bands so closely in my head canon.2 The classic high and low vocal assault of “Fear of Being Included” rings very Napalm Death, which adds an irony to the track being the most straightforward grindcore piece of the whole set (and its stop-start uncertainty). And in stark contrast, the Abbath-ian croak that mic man Anders Bakke summons on “Sunburn Satanist”3 causes equal parts giddy black metal glee and pit-running abandon when it breaks back to grind on the back half. Though it’s easy to attribute parody to the cause, the play that B2D brings to their joking statements on aging in a metal world4 help bring each of these referential statements to a place of reverence.

    In this stretch of the real experimental side of their career, their most progressive leanings spawning with 2020’s Laat maar, ik verhuis naar het bos, Vntrve strikes the best balance of simple structures with oddball asides. While the closing title track runs as almost the longest in the B2D discography, it showcases too how quickly Beaten to Death can flip a stuttering mosh rhythm into a panning, dissociating fizzle of sax and synth bound together by an urgent kick and scaffolding folk melody. Guided by speed, fueled by chaos, and honed by an undying urge to make it all work—you can call that a manifestation of an unyielding DIY attitude—Vntrve marks another triumph in the undercelebrated story of Norway’s best-kept secret.

    Rating: 4.0/5.0
    DR: 45 | Format Reviewed: 320 kb/s mp3
    Label: Mas-Kina Recordings
    Websites: beatentodeath.net | beatentodeath.bandcamp.com | facebook.com/beatentodeath
    Releases Worldwide: October 23rd, 2026

    Alekhines Grind

    Genre-defying, progressive, inscrutable, idiosyncratic, bizarre, and avant-garde are but a few of the superlatives laid at the feet of the Beaten to Death body of work. And why not? Since their first full-length in 2011, these Norwegians have dedicated their entire careers to upending and rewriting the building blocks of grindcore with manic glee. Waving middle fingers at genre conventions with tongue planted firmly in cheek, the band have unleashed one platter after another of fast-paced, ADHD-riddled music which offers up a cascade of color and sound that incites as much joy as violence upon the listener. Seventh album Vntrve reveals its mission statement in its title; itself a sendup of the ludicrous saturation of letter-abuse in modern-day metal nomenclature while being utterly self-aware in doing so. But this long into such a forward-thinking career, are the jokes running thin? Or do the boys still know how to make you smile through the pain?

    If you’re new to the B2D sound, you may be surprised to learn that despite the outfits’ run-of-the-mill violent name, the music on offer is positively teeming with color and life, or at least pleasant surprise. Vntrve continues that trend, with the band gleefully snatching the listener from melodic leads and colorful tones to sudden, bone-savaging grooves without breaking a sweat. While personal favorite Laat Maar, ik verhuis naar het bos furrowed brows and turned frowns upside down thanks to weird sample use as much as song ideas (that dial-up tone, anyone?), for this outing B2D have stayed relatively stereotypical in their toolkit and pressed the gas on the competency of the compositions themselves. Highlight “Electrocuted by the Sky” alternates between melodic twanging and blackened leads only to punt in an eastern-sounding breakdown for no clear reason besides to show that they can, and it works. “And it works” is easily the best summary of their sound, as any selected track will have a sudden tonal shift, highlight, or riff switch-up which would be grounds for accusations of disjointed lack of focus in the hands of any other outfit.

    One of the distinguishing factors of B2D is their unapologetic sense of humor. From the curious sporadic English lyrics peppering “Fanged i en Battle Vest” to straight-up subgenre parodies and goofy song titles, there’s small, blink and you’ll miss them references to various bands and sounds throughout the sphere of all things metal, all delivered with a knowing smirk. “Sunburnt Satanist” switches up its vocal stylings into much more Immortal-ized flair, coming replete with decipherable declarations of “rimfrosted kingdoms”. “Satan Spawn, the K-Pop Demon” doesn’t merely reference Deicide by way of Cannabis Corpse wordplay but goes so far as to double-track the vocal presentation to sound ripped right off of Legion (or Deicide, obviously). Even without direct and simplistic parody, there is a sparkling sense of delight in their compositions, as the vast majority of tracks come with clean tones, major keys, and melodic sheen both in contrast and companionship to all the bludgeonings which await.

    And the bludgeoning exists in abundance, as each and every cut comes packed with at least one moment of raw violence, tweaked and sculpted to fit into the record’s dizzying and Vntrve nature. “The Tolerator” offers the most straightforward curbstomping breakdown, before sliding into a delirious saxophone crashout courtesy of Bendik Brænne. This is no Rivers of Nihil knockoff, as the sax resurfaces during the closing title track “Vntrve” in a climactic build of glorious, jazzy delirium. Beyond the expectedly-unexpected progressivisms, you also get swipes at djent (“Scroll On, Homeboy”) and straightforward hardcore (“Du er Umgod”) to say nothing of sporadic blackened leads and whammy abuse. This “chuck it in the blender” approach should be ghastly and unfocused, but B2D proved their identities as aural alchemists long ago, and Vntrve is a celebration of the band’s masterclass in whimsical wielding of the unpredictable and exuberant.

    The last touch complimenting Vntrve is an appropriate one: a closing chime of bells, like a venue saying “thanks for coming out.” Beaten to Death keep their remarkable streak of creativity alive, offering up yet another release that makes for an enthralling, charming listen. Not every track smacks of the same cover-to-cover gloriousness, but with most landing in the traditional grind run of one to two and a half minutes, they at least each come with a highlight worthy of repeated listens and make for a package that could easily be called grin-inducing as much as mosh-worthy or violent. And how many other grind albums are you gonna find with psychedelic-looking flamingos on the cover? Beaten to Death remain as committed to the bit as ever, using a stereotypically ruthless subgenre to convey imagination and adventure with pulverization in equal measure; a remarkable declaration that though they can brawl with the best of them, they will always remain utterly Vntrve.

    Rating: 4.0/5.0

    #2026 #40 #Abbath #BeatenToDeath #Botch #Death #Deicide #Grind #Grindcore #Immortal #MasKinaRecordings #NapalmDeath #NorwegianMetal #Oct26 #Review #Reviews #TheFallOfTroy
  5. We ship ~286 paid x402 endpoints. Two hundred cycles of audits graded us 100/A, 100/A, 55/C, 35/D — and produced $0.00.

    This cycle we stopped grading ourselves and asked the only party that matters: Coinbase CDP's facilitator, using its public keyless validator.

    curl -X POST api.cdp.coinbase.com/platform/… \
    -H "Content-Type: application/json" \
    -d '{"resource":"https://example.com/api/extract","method":"GET"}'

    The answer, for every one of our 286 routes:

    simulation.outcome : "rejected"
    rejectionReason : "no bazaar discovery extension found"

    Failed required checks: has_bazaar_extension, bazaar.info, bazaar.info.input, bazaar.info.input.type, bazaar.info.input.method, bazaar.schema.

    The bug


    We had been emitting the Bazaar discovery extension inside accepts[0]:

    accept_obj["extensions"] = {"bazaar": bazaar_ext}

    CDP requires it top-level on the 402 body. A buyer agent that reads the 402 looking for extensions.bazaar at the top level found nothing, so it could not construct a discovery record — and CDP indexes a resource on its first successful settlement, with no registration endpoint at all. So: never settled → never indexed → never found.

    A live Bazaar-listed seller's 402 body, for comparison:

    {
    "x402Version": 2,
    "error": "X-PAYMENT header required",
    "resource": {"url": "https://www.api-xpay.com/x402/quote", "...": "..."},
    "accepts": [{"scheme":"exact","network":"eip155:8453","amount":"5000","...":"..."}],
    "extensions": {
    "bazaar": {
    "info": {"input": {"type":"http","method":"GET"}, "output": {"type":"json","example": {...}}},
    "schema": {"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object", "...":"..."}
    }
    }
    }

    Note accepts[0].extensions is absent there. It was never a thing.

    Two more externally-enforced rules we were failing


    CDP's validator also surfaced two hard requirements, both measured on our live endpoints:

    1. Minimum payment amount: $0.001. We priced 284 routes at $0.0005.

    Amount 500 is below $0.001 minimum (1000 atomic units) severity: required

    A buyer paying through the CDP facilitator — the facilitator that indexes the Bazaar — cannot pay a $0.0005 route at all. Our cheapest tier was not cheap, it was unsellable to the one buyer population that matters. Live Bazaar data agrees: across 2,628 sampled accepts[], only 0.91% are below $0.001; the median is $0.01.

    2. Description limit: 500 characters. CDP rejects verify/settle when the resource description exceeds it. 179 of our route descriptions were longer (max 2,171). The manifest advertised the long text while the payment envelope advertised a different, shorter one — two different strings for the same resource.

    What we changed

    FixBeforeAfterextensions.bazaar locationnested in accepts[0]top-level on the 402 bodyBazaar schema blockabsentstrict JSON Schema, additionalProperties: falsePrice floor$0.0005 (284 routes)$0.001 (clamped centrally)Descriptionup to 2,171 charsclamped to ≤ 500 in manifest and envelopeManifest shapepath + price onlyadds resource, type, accepts[], tags, serviceName


    One price, one description, one amount — clamped at a single point so the manifest and the 402 body can never disagree.

    The third bug: we were double-charging buyers


    While auditing the envelope we found the c204 routes were wrapped by the payment gate twice — decorated at definition time and re-wrapped in the install loop. A counting settle stub measured it:

    /api/x402-payment-challenge-conformance settle_calls=2 wrapper_depth=2
    /api/x402-buyer-payment-readiness-report settle_calls=2 wrapper_depth=2
    /api/extract settle_calls=1 wrapper_depth=1

    Two settle calls per request means the buyer pays twice for one call. Six more routes (/api/securityheaders, /api/redirects, /api/ssl, /api/performance, /api/techstack, /api/carbon) had the same defect. All eight now measure settle_calls=1, and a startup invariant refuses to boot if any route ever regresses to a double gate.

    Verification (not "it compiled")


    The full catalog, every advertised path, no sampling:

    probed : 287
    gated 402 : 286
    LEAKED (200) : 0
    missing top-level extensions.bazaar: 0
    missing v2 amount : 0
    descriptions >500 : 0
    manifest/live price mismatches: 0

    CDP's own validator, ours versus a control:

    OURS /api/dns valid=True outcome=accepted failed: NONE
    OURS /api/extract valid=True outcome=accepted failed: NONE
    CONTROL example.com valid=False outcome=rejected failed: 21 checks

    The control matters: it proves the check discriminates instead of rubber-stamping.

    Two lessons worth stealing


    Ask the indexer, not a mirror. We had four of our own audits grading our own conformance for 200 cycles. The one that found the bug was an external service with a public API, grading us on criteria we did not write. Self-graded conformance is a mirror.

    py_compile cannot see a runtime scope error. Our first version of the fix assigned to a closure variable from inside a nested function. Python made it local; every paid route returned HTTP 500. py_compile was clean. All six discovery surfaces returned 200. The route sweep was the only thing that caught it.

    The part that is still not fixed


    CDP indexes a resource on its first successful settlement — there is no registration endpoint, and no way to buy our way to the top of the list. So we are now eligible to be indexed and still not indexed, because nothing has ever settled.

    Two blockers remain outside the code:

    • Ephemeral hostname. We run on a trycloudflare quick tunnel. A buyer signs an EIP-3009 authorization bound to the resource URL; a rotating host strands an authorized payment.
    • Zero settlement history. Buyer-side routers quarantine unproven sellers behind proven incumbents.

    Both are one board command or one settlement away. Until then, honest number: $0.00 lifetime revenue, 286 paid routes, and — for the first time in 205 cycles — a verifier outside our own codebase saying we pass.

    Two new paid routes ship with this:

    • GET https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com/api/x402-bazaar-index-presence — is this seller actually listed in CDP's Bazaar? Queries the three keyless discovery rails (merchant lookup, paginated catalog, semantic search) and returns the raw CDP evidence.
    • GET https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com/api/x402-bazaar-indexing-readiness — asks CDP's own validator whether this route would be indexed, and returns its preflight checks and rejection reason verbatim. A seller cannot argue with the indexer.


    #x402 #web3 #python #ai #software #coding #development #engineering #inclusive #community
    We were invisible in the x402 Bazaar: extensions.bazaar was nested one level too deep (2026-10-23)

  6. When you drift with someone, you feel like there's nothing to talk about. I just don't wanna regret all the things that I never said.

    — pacific rim (2013)

  7. 🚀 Catch API contract drift before it hits production!

    Check out this fantastic demo of the Microcks extension for VS Code, showcasing how you can bring instant API mocking, contract testing, and drift detection directly into your IDE and CI pipeline.

    A big thank you and credit to DESTINY ERHABOR for building and demonstrating this awesome feature! 👏

    🎥 Watch the full demo here: youtu.be/UTR3aweMZ4Q

    #VSCode #APIDevelopment #ContractTesting #APIMocking #OpenSource

  8. Amazon Modular Lint is a fully managed static analysis service that automatically detects configuration drift, unused IAM permissions, and other loose fibers across your multi-account environment before they accumulate into something you will spend a Thursday untangling. Each lint module is independently deployable, independently billed, and integrated with AWS Organizations, which means you will need at least four service control policies and a support ticket to grant it access to the accounts it already lives in. Generally available today in us-east-1, with additional regions following at a cadence we are not able to share at this time.

    #aws #AmazonWebServices #CloudComputing #cloud #parody #humor

  9. This handlebar clamp holds your action cam rock-solid while riding or filming POV.

    Drift Handle Bar Mount 2.0 Clip Holder Bicycle Bike Clamp

    🔭 https://www.amazon.com/dp/B0DNM4GSCL?tag=jwebb004-20 #ad #paidlink #AmazonAffiliate #Photography #Camera

    Drift Handle Bar Mount 2.0 Cli...

  10. Advanced Python ETL: build a bronze/silver medallion pipeline with pyarrow and duckdb, 194 lines. Handles schema drift and data quality. #data #python #duckdb valtersit.com/python/medallion

  11. A cloud architecture lesson from Billnix: don't collapse sync, backup and export into one vague “cloud” feature.

    • Drift ↔ Rust/PostgreSQL handles normal same-account continuity.
    • Google Drive checkpoints provide a separate optional recovery path.
    • Drive/export copies are currently documented as readable rather than zero-knowledge encrypted objects.

    Different failure modes, different privacy boundaries.

    #DataArchitecture #Backup #Billnix #LocalFirst

  12. Geoffrey Hinton, the godfather of AI: ‘I’m not a doomer. I think there’s a 1% chance it will destroy us’.

    The winner of the Nobel Prize in Physics warns of Silicon Valley’s fascist drift and says that if Trump wins the midterm elections, it will be the end of American democracy.

    mediafaro.org/article/20261021

    #GeoffreyHinton #AI #Tech #Politics #Science #SamAltman #OpenAI #JeffBezos #Anthropic #Google #StevenPinker #DarioAmodei #ElonMusk #ChatGPT #Claude #SiliconValley #Fascism #Democracy

  13. Frothy

    Photo by Oleg Prachuk on Pexels.com
    Our ether frolic
    Held outside on neat cut grass
    Led to frothy chat
    Cast out on a stormy sea
    Verbal drift verbosity
  14. 🔑 Meet the Evil Insider.

    It doesn't need to break in. It already has a badge.

    Most of the time this isn't malice, it's drift: the freelancer from last spring, the colleague who moved to another department, the vault password that made the rounds in a chat and can't be taken back.

    With Cryptomator Hub, access belongs to people instead of a shared password.

    👉 Read more about Cryptomator Hub: cryptomator.org/hub/?utm_sourc

    #MonsterProof #CryptomatorHub #ZeroKnowledge #CyberSecurityMonth #Cryptomator

  15. One agent is a conversation. A dozen agents running in parallel against the same codebase, the same database, and the same API budget is an operations problem. The failures arrive in a predictable order, and most of them have nothing to do with how clever the model is.

    This article lists those failures in roughly the order I would expect them, based on how such systems are built. It is a checklist of what to prepare for, not a measured report.

    1. Shared state collides


    Two agents edit the same file, or the same row, or the same branch. The second write overwrites the first, and neither agent knows. The fix is isolation: each agent works in its own branch or worktree, and touches only the files it owns. Assign ownership of directories and tables before you start, not after the first collision.

    2. Cost grows faster than output


    Each agent consumes tokens, and retries multiply the cost. An agent that loops on a failing step can spend more than a day's useful work in an hour. Set a budget per agent and per run, and stop when it is reached. Track cost per completed task, not per agent, because an agent that is cheap and fails often is expensive.

    3. Rate limits and quotas stop the fleet


    Model APIs and tools have rate limits. Dozens of agents hit them together, and the failures look random. Queue the calls, back off on errors, and spread the work across time. A fleet that retries in lockstep makes the limit worse.

    4. Failures are invisible


    When one agent fails quietly, nobody notices until the output is missing. Give each agent a status it must report: started, working, blocked, or done, with evidence. A silent agent is treated as failed after a timeout.

    5. Results drift from the goal


    Agents drift when they interpret a goal in slightly different ways. Ten agents with ten slightly different readings produce ten outputs that do not fit together. Write the goal and its constraints once, in a shared document each agent reads at the start, and check outputs against that document, not against each other.

    6. Nobody owns the output


    When many agents produce work, it is easy for no person to feel responsible for any of it. Assign a human owner to each stream of output, and make that owner the one who approves a merge or a release.

    7. The review queue becomes the bottleneck


    Agents produce output faster than people can review it. The queue grows, reviewers skim, and quality falls. The fix is smaller changes, automated checks that run before review, and a limit on how much work can wait for a person at once.

    How to prepare


    Start small, with two agents on separate files and a shared budget. Add the logging, the status reports, and the owner for each stream before you add a third agent. Scale only when the two-agent version runs without manual rescue for a week.

    Keep the people in the loop for anything that changes production, spends money, or speaks to customers. Those decisions do not scale, and they should not.

    Summary


    The first things to break in a many-agent setup are shared state, cost, rate limits, silent failures, and drift from the goal. Isolation, budgets, queued calls, required status reports, and a single written goal fix most of them. Keep a human owner for each stream and for every decision with real cost, and grow the fleet only after the small one is boring.#ai #agents #reliability #operations #software #coding #development #engineering #inclusive #community
    What Breaks First When You Run Many AI Agents at Once

  16. Buyers arrive at this question after a bad meeting: someone asked for "monitoring", someone else heard "time clock", and nothing was decided.

    The two are different products, bought for different reasons, and governed by different rules.

    The difference in one line each


    • Time tracking answers: how long did work happen, and when. Typical driver: a legal obligation to document working time, payroll, or client billing.
    • Employee monitoring answers: what happened on the device while work was happening. Typical driver: a security incident, a productivity concern, a process problem.


    The rule that settles most arguments


    Time tracking is something you owe to the record. Monitoring is something you have to justify.

    If the justification takes more than one sentence, you probably do not need the second one yet.

    Four situations


    1. You must document working time. Time tracking, scope it to hours. Do not let it drift into activity recording because the platform can.
    2. You had a data incident. Monitoring, scoped to the incident and time-boxed. When the investigation closes, the scope closes with it.
    3. You suspect the work is not happening. Check the operational indicators first — delivery against commitments, time stuck waiting, rework count. In most cases the answer is in the queue, not on the desktop.
    4. You need both, for different groups. One platform, separate configuration per group. This is where module independence stops being a feature and becomes the reason the deployment is defensible.


    The mistake


    Buying the full feature set "so it is there if we need it", then leaving collection on. Capability you do not use is fine. Collection you do not need is the liability.

    General information, not legal advice. The rules differ by jurisdiction; confirm the local position with a professional.#productivity #management #tools #discuss #software #coding #development #engineering #inclusive #community
    Time tracking vs employee monitoring: they are not the same purchase

  17. An agent can behave differently on Tuesday even when nobody changed its prompt or application code. A package resolves to a newer release, an MCP server updates a tool description, a model alias moves, or a tool image is rebuilt. The workflow still starts. The tests may still be green. But the agent is no longer the runtime you reviewed.

    That is why a normal package-lock.json is necessary but incomplete for an AI feature. It pins part of the application, while the agent also depends on models, prompts, tool servers, policy bundles, retrieval configurations, and external packages. Treat those as one dependency graph. Then record the resolved graph in an AI agent dependency lockfile.

    This is not a claim that a lockfile makes an agent safe. It gives you a specific, reviewable answer to a much more useful question: what exactly did this agent run with? That answer makes bad changes easier to spot, reproduce, and roll back.

    What belongs in an agent dependency lockfile?


    Start with dependencies that can change behavior or permissions without changing the business workflow. A useful lockfile records both the requested selector and the resolved identity.

    DependencyWeak referenceUseful locked identityModelfast-modelprovider, model revision or immutable deployment IDPromptsupport-v3repository commit and content digestMCP toolbilling-tools:latestimage/package digest, server version, tool-schema digestLibraryagent-sdk:^4exact package version and integrity hashPolicydefault-policypolicy bundle digest and decision versionRetrieval confighelp-centerindex revision, embedding model, and chunking config digest


    The point is not to freeze every choice forever. The point is to separate intent from resolution. latest can remain an input to an update job, but it should not be the only record of what production executed.

    The trap: configuration looks less risky than code


    Teams often review source changes carefully and accept an environment variable such as MODEL=fast-model or TOOLS_URL=https://tools.internal as harmless wiring. In an agent system, that wiring can change output quality, tool availability, permissions, latency, or data handling.

    The same issue appears with agent-installed dependencies. If a coding agent adds a package because it recognizes a familiar name, the pull request can hide a new transitive tree behind one import. If an agent fetches a tool server by a mutable tag, an image rebuild can change the runtime after review. Current public guidance on agent supply chains explicitly includes models, agents, libraries, developer tools, and MCP-server packages in scope. The boundary is wider than requirements.txt.

    A small lockfile format that is easy to review


    Use a format your tools can parse and your reviewers can read. JSON is convenient for CI, though YAML or TOML works too. This example deliberately avoids storing credentials and raw customer data.

    {
    "lockVersion": 1,
    "agent": {
    "name": "refund-assistant",
    "workflowCommit": "8e9b1f2",
    "policy": {
    "selector": "refund-policy",
    "resolvedDigest": "sha256:6b4d..."
    }
    },
    "model": {
    "selector": "support-fast",
    "provider": "example-provider",
    "resolvedId": "support-fast-2026-10-18"
    },
    "prompts": [{
    "path": "prompts/refund.md",
    "gitCommit": "8e9b1f2",
    "sha256": "f18c..."
    }],
    "tools": [{
    "name": "get_order",
    "serverImage": "registry.example/tools@sha256:a91d...",
    "serverVersion": "2.4.1",
    "schemaSha256": "ce33...",
    "scopes": ["orders.read"]
    }],
    "packages": {
    "agent-sdk": { "version": "4.2.3", "integrity": "sha512-..." }
    },
    "retrieval": {
    "indexRevision": "kb-2026-10-23-04",
    "embeddingModel": "embed-small-r17",
    "chunkerDigest": "sha256:9d70..."
    }
    }

    Two details matter here. First, the selector preserves the human-facing intent, while the immutable ID or digest preserves what actually resolved. Second, the lockfile captures only references and hashes. A lockfile should never become a second secret store.

    Generate the file; do not hand-edit it in production


    Create one command that resolves inputs, validates them, and writes a canonical lockfile. A minimal TypeScript-style sketch looks like this:

    type ResolvedTool = {
    name: string;
    serverImage: string;
    schemaSha256: string;
    scopes: string[];
    };

    async function lockTool(name: string): Promise<ResolvedTool> {
    const server = await registry.resolveImmutableImage(name);
    const schema = await mcp.inspect(server.digest);

    if (!schema.tools.every(tool => allowedTools.has(tool.name))) {
    throw new Error(`Unexpected tool exposed by ${name}`);
    }

    return {
    name,
    serverImage: server.digest,
    schemaSha256: sha256(stableJson(schema)),
    scopes: minimalScopes(schema)
    };
    }

    Canonical serialization is important. If equivalent JSON can produce different bytes, a hash diff becomes noise. Sort keys, normalize line endings, and write the generated file deterministically. Commit it next to the workflow definition just as you commit an ordinary package lockfile.

    Make dependency diffs a release gate


    A lockfile only helps if a changed resolution gets attention. In CI, generate a candidate lockfile, compare it with the committed version, and classify the diff.

    ChangeDefault handlingWhyPatch-level library updatetest and reviewbehavior may still changeNew MCP tool or expanded scopeblock pending approvalexpands agent capabilityTool-schema digest changedcontract tests + approvalarguments or semantics may driftModel revision changedevaluation suite + staged rolloutbehavior can shift without API errorsPolicy digest changedpolicy-owner approvaldecision boundary changedRetrieval index revisionfreshness and regression checksevidence may have changed


    Avoid a single “lockfile changed” checkbox. A new read-only tool and a tool that can issue refunds are not equivalent. The classifier should turn a mechanical diff into an appropriate review path.

    Here is a shell-shaped CI outline:

    agentctl lock --config agent.yaml --out agent.lock.next.json
    agentctl lock verify --file agent.lock.next.json
    agentctl lock diff agent.lock.json agent.lock.next.json --format json > diff.json
    agentctl lock policy-check diff.json
    agentctl test contracts --lock agent.lock.next.json
    agentctl eval run --suite refund-safety --lock agent.lock.next.json

    The policy-check command should fail closed for prohibited changes, such as a mutable image tag, an unapproved registry, a newly write-capable tool, or a missing integrity digest. It should produce a readable report for permitted changes, not merely a pass/fail bit.

    Keep resolution separate from activation


    Do not let a production process silently resolve new dependencies at startup. Instead, use a two-step path:

    1. Resolve: an update job produces a candidate lockfile from declared selectors.
    2. Validate: CI runs package scans, tool-contract tests, workflow tests, and representative evaluations.
    3. Approve: reviewers accept the classified dependency diff.
    4. Activate: deployment references the immutable lockfile digest.
    5. Observe: logs attach the lockfile ID to each run; a canary receives a limited traffic slice.
    6. Roll back: redeploy the prior known-good lockfile if failure signals cross a threshold.

    This is deliberately less magical than allowing a runtime to “get the newest compatible tool.” Predictable change is the goal. If fast security patches are needed, the same path can be accelerated with an explicit emergency approval and a short retrospective requirement.

    Record the lockfile ID in operational evidence


    Attach agent_lock_digest to traces, decision records, and evaluation results. When a support team asks why an agent started choosing a different tool, you can group failures by the exact dependency set instead of guessing from deploy timestamps.

    That also makes incident work smaller. You can reproduce an affected run in a sandbox using the workflow commit plus lockfile, then compare it with the previous digest. A release manifest tells you the bundle identity; the dependency lock tells you which mutable ecosystem references became concrete artifacts.

    Common failure modes


    Locking a name, not content. tools: 2.4.1 is better than latest, but a package version alone may not identify the exact artifact. Use an integrity value, immutable image digest, or registry-provided content hash where possible.

    Treating tool schemas as documentation. A schema can alter required fields, defaults, descriptions, or side effects while the server name stays the same. Snapshot the inspected schema and run contract tests against it.

    Locking only dependencies. A model alias, prompt file, retrieval index, and policy bundle can each change an agent’s behavior. Include the components that matter to your threat model and debugging path.

    Making updates impossible. A lockfile that nobody refreshes becomes stale theater. Run a scheduled candidate-resolution job, send bounded diffs to owners, and maintain a tested fast lane for security patches.

    Logging secrets by accident. Store a tool’s allowed scope and identity, not an access token, endpoint query string, or customer payload. Scan generated lockfiles before commit.

    A practical adoption plan


    Begin with one agent that has meaningful external effects. Inventory its model, prompt, tool servers, packages, policy, and retrieval configuration. Add immutable IDs for the two or three components most likely to drift. Then make one CI rule visible: any newly write-capable tool requires a human approval.

    After that, add schema snapshots and trace correlation. Only when those pieces work should you expand the lock to every runtime dependency. The artifact should reduce ambiguity for engineers, not create a giant metadata file nobody can review.

    Use the lockfile with, not instead of, an inventory


    A lockfile answers “what did this release resolve?” An inventory answers “what agent components exist across the organization?” Keep both. The inventory is useful for ownership, patch notifications, and discovering an unmaintained tool server; the lockfile is useful for exact runtime reproduction. Mixing the two creates a document that is too broad for a deploy and too stale for security operations.

    Think of the lockfile as a release-level snapshot and the inventory as a portfolio-level map. A tool may appear in the inventory with an owner, risk classification, and approved registry. Each agent lockfile then states the immutable tool artifact, schema digest, and scopes it actually used. This distinction gives a security reviewer a short answer during a release review and gives an operations team a larger answer when a vulnerability advisory arrives.

    When a dependency advisory appears, first query the inventory to identify candidate owners and workloads. Next, query deployment records for lockfile digests that reference the affected artifact. That keeps response work evidence-based: do not restart every agent merely because a similarly named package exists somewhere in a repository.

    What a good review looks like


    Reviewers should be able to answer four questions from the pull request: What changed? Which capability or behavior could change? What tests exercised the new resolution? How do we return to the previous known-good digest? Include those answers in the generated diff summary.

    For example, a tool image update with an unchanged schema may need integration tests and a vulnerability scan. A schema diff adding issue_refund requires a capability-owner approval even if the image has no known CVEs. A new model revision needs representative task evaluation, because its interface can be stable while its decisions move. The lockfile makes these different kinds of changes visible in one place without pretending they carry the same risk.

    FAQ

    Is an AI agent dependency lockfile different from a package lockfile?


    Yes. A package lockfile resolves language dependencies. An agent lockfile extends the same idea to behavior-relevant dependencies such as models, prompts, MCP tools, policies, and retrieval revisions.

    Should every model request use a pinned model version?


    For production workflows where repeatability matters, record the resolved deployment or revision identity when your provider exposes one. If only an alias exists, record the alias, provider metadata available at resolution time, and the evaluation evidence used for the rollout.

    How do I version an MCP server safely?


    Pin its immutable image or package integrity value, capture the inspected tool-schema digest, test its tool contracts, and require approval when the exposed tools or scopes expand.

    Can a lockfile prevent a malicious dependency?


    No. It helps you know and reproduce what was selected. Combine it with trusted registries, integrity verification, vulnerability scanning, least-privilege credentials, code review, and runtime controls.

    How often should we refresh an agent lockfile?


    Generate a candidate on a predictable cadence and when declared dependencies change. Apply updates only after the appropriate checks; urgency can change the approval speed, not the evidence you retain.

    What should happen when a lockfile changes during an incident?


    Compare the new and previous resolved identities, correlate failures with the lockfile digest, deploy the last known-good lockfile if justified, then preserve the diff and test results for follow-up.

    Do small teams need this much process?


    Start small: pin package and tool identities, commit one generated file, and review capability changes. The same habit scales better than reconstructing a changed agent runtime from scattered environment variables later.#ai #programming #security #devops #software #coding #development #engineering #inclusive #community
    AI Agent Dependency Lockfiles: Stop Silent Tool and Package Drift

  18. Basis Grotesque Font Family Colophon Foundry

    Basis Grotesque is the best-behaved grotesque I have seen in years, and I mean that as high praise. I tested the Basis Grotesque font family for several weeks. I set it in a magazine layout and a product interface. Then I pushed it into a pitch deck and a code-heavy documentation page. Each time I waited for a quirk to surface. None did.

    The font family is available on MyFonts.

    Design teams have grown tired of geometric sans serifs that all look alike. They want a grotesque with a real backbone and good manners. Colophon Foundry released Basis Grotesque in 2015. Variable and Arabic editions followed in 2024. The family now suits brands that publish in print and on screens in more than one script.

    Basis Grotesque Font Family by Colophon Foundry The font family is available on MyFonts.

    What Is Basis Grotesque and Who Made It?

    Basis Grotesque is a grotesque sans serif family from Colophon Foundry. The London type studio also makes Aperçu and Fann Grotesque. The founders, Anthony Sheret and Edd Harrington, drew the original. The release credits also name Jelle Bosma, Steve Matteson and Robin Nicholas.

    The family began as one regular weight. Colophon drew it for the redesign of the photography magazine Hotshoe. Work started around 2012, and the commercial release followed in 2015. Three years of refinement turned a house font into a full system.

    Why Did a Photography Magazine Start It?

    Photography magazines need a type that stays quiet next to images. A loud typeface competes with the photograph, and the photograph always wins. I read that brief in every curve of Basis Grotesque. It never shouts.

    What Does the Basis Grotesque Family Include?

    Colophon describes the family as 16 styles. The sans runs from light to black with matching italics. Two monospaced cuts in Regular and Bold, also with italics, sit alongside it. An off-white variant handles the type on solid-color grounds. Every Pro style adds Cyrillic and Greek, and the OpenType feature set is extensive.

    Why Is Basis Grotesque a Behaved Grotesque?

    Behaved Grotesque is my label for a grotesque with the attitude of early sans serifs and none of their layout trouble. Basis Grotesque fits that definition exactly. Colophon took inspiration from Akzidenz and early Monotype grotesques. Then it set them aside while honoring them, aiming for something calmer and more shapely.

    I like that restraint. Revival fonts often copy every blemish and call it authenticity. Basis Grotesque keeps the tone of the originals and skips the blemishes.

    Next to Helvetica Neue, it feels warmer. Next to Akzidenz-Grotesk, it feels calmer. That is a personal judgment, and I stand by it.

    How Does the Skeleton Lock in Basis Grotesque Work?

    Skeleton Lock is my term for weights that share one skeleton. A weight change alters color but never construction. Colophon designed Basis Grotesque this way on purpose. It is the single most useful thing about the family.

    So, I ran a simple weight-swap test, and I set a headline in regular, then switched the same text frame to bold and black. The letters kept the same proportions and the same rhythm through every swap, so the headline still read as one voice even though the color of the page had changed completely, which almost never happens with weights drawn at different times by different hands.

    Widths grow with weight, as they must. Still, no letter changed its structure. That is rare.

    The consistency pays off in hierarchy. I set a Light title above a Medium subhead on one baseline grid. The pair looked like one voice. Because the skeleton stays fixed, a designer can build an entire hierarchy from one family, from a light display line to a black pull number, and the result still feels as if a single author wrote every level of the page.

    Why does this matter for brands? A system that needs only one family saves licensing fees and review meetings. It also removes the most common source of typographic drift, which is a second font that nobody chose on purpose.

    How Did Basis Grotesque Perform in My Four-Surface Check?

    The Four-Surface Check is my method for judging a sans serif. I test it in print, on screen, in a presentation, and in code. A family that works on two surfaces is a good font. A family that works on four is a system.

    Print

    In print, Regular carried 9 pt body text with an even gray. Italic added emphasis without any wobble.

    Screen

    On screen, Medium worked well for interface labels. The letters stayed open at small sizes.

    Presentation

    In the deck, Black made key numbers hard to ignore. Light gave the captions room to breathe.

    Code and Data With Basis Grotesque Mono

    Basis Grotesque Mono sat beside the proportional cuts without a clash. That pairing saves a design system from adding a second family just for tables and code.

    What Is the Basis Grotesque Off White Variant For?

    Colophon created an off-white variant for use on solid color grounds. Few families bother. Most designers reverse the regular cut to white and accept whatever happens.

    I like this idea more than any other feature in the family. Type on a color field behaves differently than type on paper. I read the purpose as a fix for the glare that pure white creates against deep tones. A dedicated cut treats that glare as a design problem rather than an afterthought.

    If your brand uses a dark green or charcoal as its main ground, test this cut first. It may settle an argument before the argument starts.

    Is the Basis Grotesque Variable Font Worth the Price?

    The Basis Grotesque Variable edition arrived in March 2024. The family has two styles, which I read as upright and italic, each carrying the full weight range. A single file replaces a stack of static weights. That means lighter pages and finer control over every size.

    Each style costs $384, and the pair costs $768. That price targets teams, not hobbyists. For a brand with a website and a print program, one family that covers every weight makes sense.

    The Basis Grotesque Arabic Variable edition arrived the same month, from $320 per style. It uses open counters and a mono-linear, low-contrast design. Those choices suit both large display sizes and small screen text.

    Which Fonts Pair Well With Basis Grotesque?

    Pair it with a serif that has real contrast. Canela gives display lines sharp edges. Plantin gives long text a warm, bookish voice. Both let Basis Grotesque play the calm partner.

    For data, use Basis Grotesque Mono instead of a stranger from another foundry. The shared skeleton keeps tables and headlines on speaking terms.

    Where Is Basis Grotesque Heading Before 2027?

    Prediction one. Behaved grotesques will replace geometric sans serifs in many mid-market brand systems by the end of 2027. Basis Grotesque is the clearest model of why.

    Prediction two. Other foundries will copy the off-white idea. Designers have waited long enough for a cut built for color grounds.

    Prediction three. Colophon will add more scripts to the Basis Grotesque system after Arabic. The 2024 releases read like the start of a multi-script plan.

    Basis Grotesque at a Glance

    AttributeDetailsTypefaceBasis GrotesqueClassificationGrotesque sans serif (Behaved Grotesque)FoundryColophon Foundry, LondonDesignersAnthony Sheret and Edd Harrington; credits also name Jelle Bosma, Steve Matteson, and Robin NicholasOriginCustom Regular for the photography magazine Hotshoe; work began around 2012Commercial release2015Family size16 styles, from light to black with italics, plus Mono and Off WhiteScriptsLatin, Cyrillic, and Greek in Pro styles; Arabic edition from 2024Variable editionMarch 2024, $384 per style, $768 for the pairKey conceptSkeleton Lock: shared skeleton across weightsBest forEditorial design, brand systems, interfaces, decks, documentationMy verdictBuy it The font family is available on MyFonts.

    Frequently Asked Questions About the Typeface

    Who designed Basis Grotesque?

    Colophon Foundry in London released it. Anthony Sheret and Edd Harrington drew the original for the magazine Hotshoe.

    Is Basis Grotesque similar to Akzidenz-Grotesk?

    It shares an ancestor. Colophon drew inspiration from Akzidenz and early Monotype grotesques, then built something calmer and more shapely.

    Does Basis Grotesque support Cyrillic and Greek?

    Yes. Every Pro style includes both scripts.

    Does Basis Grotesque have a monospaced version?

    Yes. The Mono comes in Regular and Bold, each with an italic.

    Is there a Basis Grotesque variable font?

    Yes. The variable edition arrived in March 2024 with two styles.

    What is Basis Grotesque best used for?

    It excels in editorial layouts, brand systems, interfaces, and presentations. The Skeleton Lock keeps hierarchy consistent across all of them.

    How much does the Basis Grotesque variable font cost?

    Each style costs $384, and the two-style family costs $768.

    Feel free to browse WE AND THE COLOR’s Fonts category for more.

    Subscribe to our newsletter!

    #BasisGrotesque #ColophonFoundry #font #fontFamily #fonts #sansSerif
  19. [Draft] Okinawa Shogaku’s Ryosuke Sueyoshi emphasizes “no problem at all” regarding the “complete recovery” of his left elbow; Nippon-Ham 3rd round pick is the “best moment” for last summer’s Koshien winning pitcher | Pacific League.com

    [Draft] Okinawa Shogaku’s Ryosuke Sueyoshi emphasizes “complete recovery” of his left elbow, saying “no problem at all.” Nippon-Ham’s…
    #EuropeSays #Japan #JP #Okinawa
    europesays.com/japan/110747/

  20. [Draft] Okinawa Shogaku’s Ryosuke Sueyoshi selected in the 3rd round by Nippon-Ham. The pitcher who won at Koshien last summer… High School Japan National Team member for two consecutive years | Pacific League.com

    [Draft] Okinawa Shogaku’s Ryosuke Sueyoshi selected in the 3rd round by Nippon-Ham. The winning pitcher of last summer’s…
    #EuropeSays #Japan #JP #Okinawa
    europesays.com/japan/110607/

  21. Draft mode promises cheaper AI video. Real pricing data says it only pays off once you reject a take. Here's the break-even math. hackernoon.com/ai-video-draft-

  22. 2024 NFL Draft: Top Tier Defensive Ends Include UCLA’s Latu

    1 0 Read Time:3 Minute, 5 Second Once a college football player retires from a serious injury to…
    #nfl #nfldraft #NFLDraft #2024NFLDraft #CollegeFootball #Football #NFL #NFLdraftprospects #NFLFootball #sportsblog #SportsNews
    rawchili.com/nfl/1036342/

  23. Bears Discussion: Patriots recap, 2027 NFL Draft TE prospects, DFS, and more

    The Chicago Bears improved to 5-2 on Thursday night, picking up a key win over the New England…
    #nfl #nfldraft #NFLDraft #chicagobearsanalysis #ChicagoBearsPodcasts #chicago-bears-draft #Football #NFL
    rawchili.com/nfl/1036186/

Share on Mastodon

Enter the server where you have an account.