Cloud Four's code review guide is this week's featured piece, and its most useful insight is structural: every PR must explain not just what changed but why, with… Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 10-2026
article
TAG: GUIDEREAD_TIME: 7_MIN
How We Do Code Reviews at Cloud Four
Scott Vandehey outlines Cloud Four's code review culture, built for a small agency that frequently works with client developers and contractors. The core rule is strict: every change going to production requires a reviewed pull request, enforced through GitHub branch protection rules, with only senior developers allowed to bypass for safe changes like minor dependency updates. Vandehey pushes back hard on large PRs, asking contributors to split out lint rule changes, code moves, and unrelated bug fixes into separate requests. Each PR must explain not just what changed but why, and include step-by-step testing checklists written as if the reviewer has never touched that feature — a practice that has repeatedly caught bugs before review even begins.
Justin Duke details Buttondown's Stripe-inspired API versioning system, which uses date-based version strings (e.g., "2025-06-01") rather than semver. Each API request resolves its version by checking, in order, an "X-API-Version" header, the API key's pinned version, then the system default. A transformation pipeline applies chained migrations bidirectionally — converting requests up to the current schema before hitting route handlers, and converting responses back down to the client's expected format before serialization. Real-world migrations covered include field renames, structural changes from flat tag arrays to filter objects, a TypeID migration that recursively walks the entire response tree, and moving nested timing fields between levels. The system has run unchanged for 18 months while supporting major infrastructure changes.
Proxying fetch requests in server-side JavaScript - Human Who Codes
Nicholas Zakas surveys how to proxy fetch() requests across four major server-side JavaScript runtimes, noting the Fetch standard intentionally omits proxying as a browser-focused spec. Node.js gained native proxy support in v22.21.0 and v24.5.0 via HTTP_PROXY / HTTPS_PROXY environment variables when NODE_USE_ENV_PROXY=1 is set; programmatic proxying uses undici's ProxyAgent passed as a dispatcher option. Deno uses Deno.createHttpClient() with a proxy URL and passes the client via the client fetch option. Bun supports a direct proxy string on the fetch options object. Cloudflare Workers has no native proxy support, so Zakas demonstrates a workaround using his @humanwhocodes/proxy-fetch-server npm package running inside a Node.js Docker container bound as a Durable Object.
Platformatic introduces an experimental Skew Protection feature in its Intelligent Command Center (ICC), bringing Vercel-style version-pinning to Kubernetes without CI/CD pipeline changes. The problem it solves: when a new version goes live, users who loaded the old frontend can hit the new backend, causing hydration errors in React Server Components, API contract violations, and broken TypeScript type boundaries. ICC pins each browser session to the deployment version it started with via a "__plt_dpl" cookie and manages HTTPRoute rules through the Kubernetes Gateway API. Old deployments transition through Active → Draining → Expired states, with traffic monitored by Prometheus; expired versions scale to zero after a configurable grace period (default 24 hours) or when traffic drops to zero for 30 minutes.
Corbin Crutchley recounts stepping in as frontend lead at PDRT after their sole senior engineer left, leaving two junior engineers and a project rebuilt multiple times on a shaky foundation. Rather than a full rewrite or a split codebase, Crutchley chose incremental migration — merging old and new code into the same product through A/B delivery, view embedding, or page-by-page stack switching. To eliminate cross-platform code duplication across iOS, Android, and web variants for multiple clients, the team unified on web technologies (TypeScript, HTML, CSS) and consolidated everything into a monorepo with a shared component layer. Within six months the rewrite was complete, within a year the website shipped, and the primary client's app saw a 350% usage increase.
This post walks through building a TypeScript hook script that intercepts shell commands from both Claude Code and Cursor before they execute, enforcing a project's custom test runner instead of the agent reaching for npx vitest or npx playwright test. The core challenge is that the two platforms send different JSON shapes on stdin: Claude Code nests the command inside tool_input under a PreToolUse event, while Cursor's beforeShellExecution puts it at the top level. The hook normalizes both inputs, matches against blocked patterns using regexes, and returns platform-specific allow/deny responses with descriptive block messages pointing agents toward the correct yarn test:unit / test:e2e scripts. The script runs as a plain TypeScript file using Node.js 22.6+--experimental-strip-types, avoiding a build step entirely, and is designed to fail-open on parse errors.
There are 2 kinds of devs. One of them is screwed. Justin Searls interview [Podcast #210]
Justin Searls, co-founder of Test Double and now a solo developer in Japan, argues that Claude Code (released February 2025, meaningfully productive from Sonnet 3.7 onward) marks a genuine inflection point distinct from earlier copilot-style tools. He draws a dividing line between developers who are "order takers" — fulfilling specs, coding for coding's sake — and "ambitious" developers who think in terms of full software lifecycle and business value; he predicts the former group has roughly nine months to adapt. His central thesis is that verifiability, not raw generation speed, is the unsolved problem in agentic development: without fast, automated feedback loops, agents spin in circles. Searls recommends beginners use agents 100% of the time while simultaneously learning fundamentals, treating LLMs as personalized tutors, and advises anyone without a stable income to start building complete, valuable personal projects from scratch rather than waiting for a job.
Scott Vandehey outlines Cloud Four's code review culture, built for a small agency that frequently works with client developers and contractors. The core rule is strict: every change going to production requires a reviewed pull request, enforced through GitHub branch protection rules, with only senior developers allowed to bypass for safe changes like minor dependency updates. Vandehey pushes back hard on large PRs, asking contributors to split out lint rule changes, code moves, and unrelated bug fixes into separate requests. Each PR must explain not just what changed but why, and include step-by-step testing checklists written as if the reviewer has never touched that feature — a practice that has repeatedly caught bugs before review even begins.
There are 2 kinds of devs. One of them is screwed. Justin Searls interview [Podcast #210]
Justin Searls, co-founder of Test Double and now a solo developer in Japan, argues that Claude Code (released February 2025, meaningfully productive from Sonnet 3.7 onward) marks a genuine inflection point distinct from earlier copilot-style tools. He draws a dividing line between developers who are "order takers" — fulfilling specs, coding for coding's sake — and "ambitious" developers who think in terms of full software lifecycle and business value; he predicts the former group has roughly nine months to adapt. His central thesis is that verifiability, not raw generation speed, is the unsolved problem in agentic development: without fast, automated feedback loops, agents spin in circles. Searls recommends beginners use agents 100% of the time while simultaneously learning fundamentals, treating LLMs as personalized tutors, and advises anyone without a stable income to start building complete, valuable personal projects from scratch rather than waiting for a job.
Justin Duke details Buttondown's Stripe-inspired API versioning system, which uses date-based version strings (e.g., "2025-06-01") rather than semver. Each API request resolves its version by checking, in order, an "X-API-Version" header, the API key's pinned version, then the system default. A transformation pipeline applies chained migrations bidirectionally — converting requests up to the current schema before hitting route handlers, and converting responses back down to the client's expected format before serialization. Real-world migrations covered include field renames, structural changes from flat tag arrays to filter objects, a TypeID migration that recursively walks the entire response tree, and moving nested timing fields between levels. The system has run unchanged for 18 months while supporting major infrastructure changes.
Proxying fetch requests in server-side JavaScript - Human Who Codes
Nicholas Zakas surveys how to proxy fetch() requests across four major server-side JavaScript runtimes, noting the Fetch standard intentionally omits proxying as a browser-focused spec. Node.js gained native proxy support in v22.21.0 and v24.5.0 via HTTP_PROXY / HTTPS_PROXY environment variables when NODE_USE_ENV_PROXY=1 is set; programmatic proxying uses undici's ProxyAgent passed as a dispatcher option. Deno uses Deno.createHttpClient() with a proxy URL and passes the client via the client fetch option. Bun supports a direct proxy string on the fetch options object. Cloudflare Workers has no native proxy support, so Zakas demonstrates a workaround using his @humanwhocodes/proxy-fetch-server npm package running inside a Node.js Docker container bound as a Durable Object.
Platformatic introduces an experimental Skew Protection feature in its Intelligent Command Center (ICC), bringing Vercel-style version-pinning to Kubernetes without CI/CD pipeline changes. The problem it solves: when a new version goes live, users who loaded the old frontend can hit the new backend, causing hydration errors in React Server Components, API contract violations, and broken TypeScript type boundaries. ICC pins each browser session to the deployment version it started with via a "__plt_dpl" cookie and manages HTTPRoute rules through the Kubernetes Gateway API. Old deployments transition through Active → Draining → Expired states, with traffic monitored by Prometheus; expired versions scale to zero after a configurable grace period (default 24 hours) or when traffic drops to zero for 30 minutes.
Corbin Crutchley recounts stepping in as frontend lead at PDRT after their sole senior engineer left, leaving two junior engineers and a project rebuilt multiple times on a shaky foundation. Rather than a full rewrite or a split codebase, Crutchley chose incremental migration — merging old and new code into the same product through A/B delivery, view embedding, or page-by-page stack switching. To eliminate cross-platform code duplication across iOS, Android, and web variants for multiple clients, the team unified on web technologies (TypeScript, HTML, CSS) and consolidated everything into a monorepo with a shared component layer. Within six months the rewrite was complete, within a year the website shipped, and the primary client's app saw a 350% usage increase.
This post walks through building a TypeScript hook script that intercepts shell commands from both Claude Code and Cursor before they execute, enforcing a project's custom test runner instead of the agent reaching for npx vitest or npx playwright test. The core challenge is that the two platforms send different JSON shapes on stdin: Claude Code nests the command inside tool_input under a PreToolUse event, while Cursor's beforeShellExecution puts it at the top level. The hook normalizes both inputs, matches against blocked patterns using regexes, and returns platform-specific allow/deny responses with descriptive block messages pointing agents toward the correct yarn test:unit / test:e2e scripts. The script runs as a plain TypeScript file using Node.js 22.6+--experimental-strip-types, avoiding a build step entirely, and is designed to fail-open on parse errors.
Cloud Four's code review guide is this week's featured piece, and its most useful insight is structural: every PR must explain not just what changed but why, with a step-by-step testing checklist written as if the reviewer has never touched the feature. That discipline — splitting lint changes, code moves, and bug fixes into separate requests — is what keeps a small agency coherent across client developers and contractors alike.
Architecture thinking dominates the rest of the category. Corbin Crutchley's account of inheriting a shaky codebase at PDRT is a practical playbook for incremental migration over full rewrites — A/B delivery, view embedding, page-by-page stack switching — leading to a 350% usage increase in 18 months. Buttondown's date-based API versioning system, Stripe-inspired and running unchanged for 18 months, shows how a bidirectional transformation pipeline lets a product evolve its schema without breaking existing callers. Platformatic's Kubernetes Skew Protection brings Vercel-style version-pinning to self-hosted deployments, solving the hydration error problem that occurs when old frontends hit new backends.
Two more practical pieces close the week. Nicholas Zakas surveys fetch() proxy support across Node.js, Deno, Bun, and Cloudflare Workers — a useful reference as server-side runtimes diverge on this unglamorous but essential capability. Justin Searls' podcast interview raises the stakes: in his framing, the unsolved problem of agentic development is verifiability, not generation speed, and the divide between order-taker and ambitious developers is sharpening fast.
Key Takeaways
Every PR should explain the "why" and include a step-by-step testing checklist for reviewers unfamiliar with the feature — small structural habits catch bugs before review even begins.
Incremental migration beats full rewrites: A/B delivery, view embedding, and page-by-page stack switching let teams modernize without the risk of a flag-day cutover.
Verifiability — fast, automated feedback loops — is the unsolved bottleneck in agentic development; teams that invest in robust test infrastructure now will have a compounding advantage.
![There are 2 kinds of devs. One of them is screwed. Justin Searls interview [Podcast #210]](/_next/image?url=https%3A%2F%2Fbusansashimi-digest-media.s3.ap-northeast-2.amazonaws.com%2Fdigest%2Fweek-10-2026%2Fvideo-freecodecamp-org-hP931079TMw.jpg&w=3840&q=75)