PERFORMANCEFront-End's Missing Metric: The TBT Window
Harry Roberts introduces the concept of the TBT Window — the interval between First Contentful Paint and Time to Interactive during which Total Blocking Time counts blocking work. A client's TBT spiked from 495 ms to 5,789 ms not because JavaScript got worse, but because a preload hint added for LCP optimization introduced an extra network request, violating TTI's five-second quiet-window condition (no long tasks, no more than two in-flight GET requests). The window expanded, pulling previously out-of-scope long tasks into the metric. Roberts argues that synthetic tools should expose the TBT Window alongside TBT scores so teams can distinguish genuine blocking regressions from windowing artifacts caused by FCP or TTI movement. His recommendation: track TBT and TTI together, and only treat divergence beyond a threshold as an actionable regression.
Read Articlearrow_forward Article · AI-ENGINEERINGREAD TIME: 11m
Loop Engineering
Addy Osmani describes loop engineering — the practice of designing autonomous systems that prompt and orchestrate coding agents rather than prompting them manually turn by turn. A loop is built on five primitives: automations (scheduled discovery and triage), worktrees (isolation for parallel agents), skills (codified project context in SKILL.md files), plugins and MCP connectors (tool integrations), and sub-agents (separate maker and checker roles). Both Codex and Claude Code now ship all five primitives, making the loop design largely tool-agnostic. Osmani warns that loops surface three compounding risks: unattended mistakes, comprehension debt from code you didn't write, and cognitive surrender where engineers stop forming independent opinions. The practical conclusion is that loop design demands more judgment, not less — the leverage point shifted, but human accountability for correctness and quality did not.
READ_FULL_LOGarrow_forwardArticle · AI-ENGINEERINGREAD TIME: 8m
The Intent Debt
Addy Osmani applies Margaret-Anne Storey's Triple Debt Model to the agentic coding era, distinguishing technical debt (in code), cognitive debt (in people's understanding), and intent debt (in externalized artifacts). While AI can refactor technical debt and restore comprehension on demand, it cannot generate genuine intent — the goals, constraints, and rationale behind decisions. In an agentic workflow, every agent session starts cold with no shared context, so un-externalized intent now compounds as a per-session tax multiplied across every parallel agent run. Osmani recommends writing intent into specs that capture goals and non-negotiables, treating AGENTS.md as a living intent ledger rather than auto-generated config, recording decisions as lightweight ADRs at the moment they are made, and closing feedback loops by having agents write learnings back into persistent files after each session.
READ_FULL_LOGarrow_forwardArticle · TOOLINGREAD TIME: 7m
GitHub Copilot App: The Agent-Native Desktop Experience
GitHub announced the GitHub Copilot app at Microsoft Build, a desktop control center for managing multiple parallel agent sessions from a single My Work view. Each session runs in an isolated git worktree, removing manual branch juggling. The new Canvases feature provides bidirectional work surfaces where agents update plans, pull requests, terminals, and deployment dashboards, and developers can edit or redirect work on the same surface. Agent Merge automates the pull-request lifecycle: it monitors CI, tracks required reviewers, addresses failing checks, and merges when configured conditions are met. Local and cloud sandboxes bound agent execution environments, while Copilot code review now offers a medium-tier mode routing pull requests to a higher-reasoning model for improved precision. The Copilot SDK is now generally available in six languages — Node.js/TypeScript, Python, Go, .NET, Rust, and Java — enabling teams to build custom tools on the same agentic runtime.
READ_FULL_LOGarrow_forwardArticle · CAREERREAD TIME: 11m
Modern Engineering Values
Christoph Nakazawa (cpojer) reflects on engineering values that remain durable in an era where he reports shipping 770 commits in 30 days — more than 2x his output from two years prior, with 3x the lines of code — all AI-written across projects like Vite+, fate 1.0, Codiff, and Athena Crisis. He argues six values now define high-performance engineering: strong ownership and domain expertise (agents amplify context, not substitute for it); taste (the judgment of what is worth building); strict guardrails and fast feedback loops (lint, tests, and incremental tooling make agents faster); context in the repo (consolidating intent, conventions, and taste into local files accessible to every agent session); owning your stack rather than accumulating third-party dependencies; and preserving option value by avoiding decisions that foreclose future flexibility. On management, he contends that engineering managers must retain deep technical expertise as individual-contributor leverage grows, aligning with a tech-lead management model.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 12m
Everything You Need to Know About Sourcemaps
Neciu Dan provides a thorough walkthrough of sourcemap internals: the four key fields of a v3 sourcemap (sources, names, mappings encoded in base64 VLQ, and sourcesContent which inlines the full original source text), and the TypeScript-to-minified-bundle transformation pipeline that sourcemaps reverse. The security risk is concrete: Apple's November 2025 web App Store launch and Anthropic's March 2026 claude-code npm package (a 59.8 MB cli.js.map covering 1,900 files and 512,000 lines) both shipped production sourcemaps by accident. The Anthropic leak was permanent because npm packages are cached and mirrored. Dan recommends four defense layers: disable sourcemaps in production builds (false is already the default in Vite and Next.js), use hidden sourcemaps for error tracking only (Vite's sourcemap: 'hidden', Webpack's hidden-source-map), block .map requests at the server, and automate a postbuild CI check using a script that scans for sourcesContent in dist artifacts.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 28m
Making the OWASP Top Ten in the Vibe Code Era
Tanya Janka, co-author of the 2025 OWASP Top 10, explains two major changes in this cycle: expanding the vulnerable-components category to cover the entire software supply chain (IDE, CI, code repository), and replacing the vague "poor code quality" entry with mishandling of exceptional conditions — a narrower, actionable category. The list also adds two bonus entries covering memory safety and AI-generated ("vibe") code, the latter acknowledged without supporting data but included to raise awareness. Janka details supply-chain hygiene recommendations: pin dependencies that are seven days or older, use software composition analysis with reachability analysis, and evaluate dependency health beyond CVE counts. She also warns that AI coding assistants reliably introduce security vulnerabilities by default — including stripping error handling and exposing stack traces — and directs developers to her free securemyvibe.ca prompt library for embedding secure-coding guardrails into AI sessions.
READ_FULL_LOGarrow_forwardsummarizeDigest_Summary
This week's general web development coverage was anchored by two Addy Osmani articles on AI-assisted engineering. The first introduced loop engineering — designing autonomous systems that orchestrate coding agents rather than prompting them turn by turn — built on five primitives: automations, worktrees, skills, MCP connectors, and sub-agents. Both Codex and Claude Code now ship all five. Osmani warned that loops amplify three risks: unattended mistakes, comprehension debt from code you didn't write, and cognitive surrender. The second article applied Margaret-Anne Storey's Triple Debt Model to the agentic era, coining intent debt — the per-session tax of un-externalized goals and rationale that AI cannot generate. Recommendations included writing goals into specs, using AGENTS.md as a living intent ledger, recording lightweight ADRs at decision time, and having agents write session learnings back into persistent files.
GitHub announced the GitHub Copilot app at Microsoft Build, a desktop control center for managing parallel agent sessions from a single My Work view, with each session isolated in a git worktree. The Canvases feature provides bidirectional work surfaces for agents and developers on the same view. Agent Merge automates the PR lifecycle including CI monitoring, reviewer tracking, and conditional auto-merge. Copilot code review gained a medium-tier mode routing pull requests to a higher-reasoning model, and the Copilot SDK went GA in six languages: Node.js/TypeScript, Python, Go, .NET, Rust, and Java. Separately, Christoph Nakazawa (cpojer) reported shipping 770 commits in 30 days across Vite+, fate 1.0, Codiff, and Athena Crisis — 2x his prior output — and articulated six engineering values that remain durable in the AI era: domain ownership, taste, strict guardrails, context in the repo, owning your stack, and preserving option value.
Harry Roberts introduced the TBT Window concept — the FCP-to-TTI interval during which Total Blocking Time is measured — after diagnosing a client's TBT spike from 495ms to 5,789ms caused not by worse JavaScript but by a preload hint violating TTI's five-second quiet-window condition. OWASP Top 10 2025 co-author Tanya Janka explained two key changes: expanding the vulnerable-components category to the full software supply chain (IDE, CI, repo) and replacing vague "poor code quality" with mishandling of exceptional conditions. She also warned that AI coding assistants reliably introduce security vulnerabilities and directed developers to the free securemyvibe.ca prompt library. A thorough sourcemap security guide revealed that both Apple (November 2025) and Anthropic (March 2026, a 59.8 MB cli.js.map) shipped production sourcemaps by accident, with recommendations for hidden sourcemaps and postbuild CI scanning.
Key Takeaways- Intent debt — goals and rationale not written down — compounds across every parallel AI agent session; externalize intent into specs, ADRs, and AGENTS.md before spawning agents, not after.
- Harry Roberts' TBT Window analysis shows that adding a preload hint for LCP can paradoxically explode TBT by extending the measurement window — track TBT and TTI together and investigate divergences, not just absolute scores.
- Shipping production sourcemaps leaks your full source tree permanently (npm caches mirror everything); use Vite's sourcemap: 'hidden' or Webpack's hidden-source-map and add a postbuild CI check that scans for sourcesContent in dist artifacts.
