Cross-cutting frontend topics, tooling, and DX Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 28-2026
article
Your Worker Can Now Have Its Own Cache in Front of It
TAG: INFRASTRUCTURE
Cloudflare is launching Workers Cache, a tiered cache that sits in front of your Worker and is configured via a single Wrangler config block plus standard Cache-Control headers. On a cache hit the Worker never runs, eliminating CPU billing for that request; on a miss the Worker renders once and populates a two-tier cache covering Cloudflare's entire global network. The feature supports stale-while-revalidate for instant background refreshes, full Vary-header content negotiation, and tag-based purging via ctx.cache.purge(). Crucially, the cache belongs to the Worker rather than the zone, so it follows the Worker across custom domains, workers.dev, preview URLs, and Workers for Platforms tenants. Per-user multi-tenancy is achieved by keying cache entries on ctx.props, and caching can be toggled independently per named WorkerEntrypoint, enabling a single deployable unit to contain both uncached gateway logic and cached backend logic.
Addy Osmani argues that the skills most durable in the age of coding agents are judgment, problem selection, and verification — not raw implementation speed. He draws on 14 years at Google leading Chrome and Gemini AI teams to make the case that taste cannot be outsourced: agents automate the reps that used to build intuition, so engineers must pursue deliberate practice on hard problems without agents, treat every agent diff as a human review requiring justification, and build deep mental models end-to-end. Autonomy should be calibrated per task — high for small reversible actions, low for hard-to-undo changes. The biggest risk is not agents writing bad code but engineers losing the ability to detect bad code. Osmani frames the career edge as the 30% that remains after an agent produces a 70% draft: debugging gnarly edge cases, making architectural calls, and finishing to a standard past the median agent output.
Why We Cannot Wait for Better Post-Quantum Signature Algorithms
TAG: SECURITY
Cloudflare argues that next-generation post-quantum signature schemes will not be ready in time for the 2029 migration deadline, so ML-DSA must serve as the first wave despite its larger wire footprint. The post benchmarks nine candidates advancing to NIST's third signature on-ramp round: lattice schemes (FN-DSA, HAWK), hash-based (SLH-DSA), isogeny (SQIsign), proof-of-knowledge (FAEST, MQOM, SDitH), and structured multivariate (MAYO, SNOVA, QR-UOV, UOV). FN-DSA offers compelling size advantages but requires timing-side-channel-safe floating-point arithmetic that is difficult to standardize and is unlikely to see wide deployment before 2033. MAYO shows the most mature security track record among multivariate candidates, while SNOVA's structure has been revised repeatedly after attacks. The authors project that even the earliest new standard (a proof-of-knowledge scheme) will not achieve broad availability before 2030, making ML-DSA the only practical option for organizations targeting 2029 compliance.
A Microsoft engineering team ran 150 agent tasks across 15 scenarios comparing Claude Sonnet 4.6 and Claude Sonnet 5 via GitHub Copilot Chat in VS Code, covering Azure architecture design and SharePoint Framework (SPFx) upgrade tasks. Despite Sonnet 5 carrying a 33% lower per-token price, architecture tasks saw a 12x median token increase with Sonnet 5, making it 3.7x more expensive per run on code upgrades ($2.01 vs $0.55). Output quality on architecture also dropped from 90% idiomatic correctness with Sonnet 4.6 to 78% with Sonnet 5. Code upgrade tasks reversed the picture: Sonnet 5 achieved 100% task completion vs 60% for Sonnet 4.6, but configuration correctness was 0% for both models because undocumented migration steps — seven specific file and config changes — were absent from the documentation entirely. Token variance was also a risk: Sonnet 5 swung from 16K to 6.6 million tokens on the same prompt, making cost budgeting unreliable.
Better Tools Made Copilot Code Review Worse. Here's How We Actually Improved It.
TAG: AI-AGENTS
GitHub replaced Copilot code review's bespoke exploration tools with the shared Unix-inspired grep, glob, and view tools from the Copilot CLI harness — and benchmarks showed higher review cost with fewer issues caught. Trace analysis revealed the agent was browsing the repository broadly instead of working diff-first: it searched widely, read more file context than needed, and carried that extra context forward, inflating token cost. The fix was not in the tools themselves but in rewriting their instruction prompts to encode a reviewer's workflow — start from the diff, narrow with grep and glob before reading, batch focused view calls, and recover from failed searches with a single corrected query rather than widening exploration. The result in production was approximately 20% lower average review cost with no degradation in review quality, demonstrating that tool instructions for agents function more like API documentation than implementation details.
Swizec Teller applies Goldratt's Theory of Constraints to explain why AI-driven individual productivity gains have not translated into organizational shipping velocity. Studies show average economic output gains of only 0.4-1.3% across rich countries, even though individual engineers write code 50% faster and finish 26% more tasks. The argument is that code review has become the bottleneck: AI floods the pipeline with PRs faster than humans can review them, and work-in-progress kills throughput. Teller describes code review not primarily as a bug-catching mechanism but as a sociotechnical practice for knowledge dissemination, domain-model alignment, and codebase health. His prescription is to subdue the rest of the process to the bottleneck — spend less time generating code and more time clearing the review queue, working one PR to done before starting the next. He cautions that offloading review to LLMs risks losing the mentoring and architectural pattern-recognition that senior engineers provide through human review.
Kevin Powell builds a real F1-themed landing page in Astro and walks through the core GSAP patterns he used to bring it to life. Starting with gsap.from() tweens, he covers stagger timing, ScrollTrigger with custom start points and per-element triggering via querySelectorAllforEach, and easing functions including the elastic-out bounce used for character-by-character text entry. He uses the SplitText plugin to animate individual characters with GSAP.timeline() orchestrating the full hero entrance sequence. A custom ScrollTrigger with GSAP.to() and an onUpdate callback powers a number-counting animation that uses the targets[0].val accessor to read live tween values. The video also covers GSAP's ticker API for building a frame-rate-independent infinite-scroll carousel with drag-and-throw velocity, using delta ratio normalization to ensure consistent speed across 60 Hz and 120 Hz monitors. The project is deployed via Webflow's new app-hosting feature.
Your Worker Can Now Have Its Own Cache in Front of It
Cloudflare is launching Workers Cache, a tiered cache that sits in front of your Worker and is configured via a single Wrangler config block plus standard Cache-Control headers. On a cache hit the Worker never runs, eliminating CPU billing for that request; on a miss the Worker renders once and populates a two-tier cache covering Cloudflare's entire global network. The feature supports stale-while-revalidate for instant background refreshes, full Vary-header content negotiation, and tag-based purging via ctx.cache.purge(). Crucially, the cache belongs to the Worker rather than the zone, so it follows the Worker across custom domains, workers.dev, preview URLs, and Workers for Platforms tenants. Per-user multi-tenancy is achieved by keying cache entries on ctx.props, and caching can be toggled independently per named WorkerEntrypoint, enabling a single deployable unit to contain both uncached gateway logic and cached backend logic.
Kevin Powell builds a real F1-themed landing page in Astro and walks through the core GSAP patterns he used to bring it to life. Starting with gsap.from() tweens, he covers stagger timing, ScrollTrigger with custom start points and per-element triggering via querySelectorAllforEach, and easing functions including the elastic-out bounce used for character-by-character text entry. He uses the SplitText plugin to animate individual characters with GSAP.timeline() orchestrating the full hero entrance sequence. A custom ScrollTrigger with GSAP.to() and an onUpdate callback powers a number-counting animation that uses the targets[0].val accessor to read live tween values. The video also covers GSAP's ticker API for building a frame-rate-independent infinite-scroll carousel with drag-and-throw velocity, using delta ratio normalization to ensure consistent speed across 60 Hz and 120 Hz monitors. The project is deployed via Webflow's new app-hosting feature.
Addy Osmani argues that the skills most durable in the age of coding agents are judgment, problem selection, and verification — not raw implementation speed. He draws on 14 years at Google leading Chrome and Gemini AI teams to make the case that taste cannot be outsourced: agents automate the reps that used to build intuition, so engineers must pursue deliberate practice on hard problems without agents, treat every agent diff as a human review requiring justification, and build deep mental models end-to-end. Autonomy should be calibrated per task — high for small reversible actions, low for hard-to-undo changes. The biggest risk is not agents writing bad code but engineers losing the ability to detect bad code. Osmani frames the career edge as the 30% that remains after an agent produces a 70% draft: debugging gnarly edge cases, making architectural calls, and finishing to a standard past the median agent output.
Why We Cannot Wait for Better Post-Quantum Signature Algorithms
Cloudflare argues that next-generation post-quantum signature schemes will not be ready in time for the 2029 migration deadline, so ML-DSA must serve as the first wave despite its larger wire footprint. The post benchmarks nine candidates advancing to NIST's third signature on-ramp round: lattice schemes (FN-DSA, HAWK), hash-based (SLH-DSA), isogeny (SQIsign), proof-of-knowledge (FAEST, MQOM, SDitH), and structured multivariate (MAYO, SNOVA, QR-UOV, UOV). FN-DSA offers compelling size advantages but requires timing-side-channel-safe floating-point arithmetic that is difficult to standardize and is unlikely to see wide deployment before 2033. MAYO shows the most mature security track record among multivariate candidates, while SNOVA's structure has been revised repeatedly after attacks. The authors project that even the earliest new standard (a proof-of-knowledge scheme) will not achieve broad availability before 2030, making ML-DSA the only practical option for organizations targeting 2029 compliance.
A Microsoft engineering team ran 150 agent tasks across 15 scenarios comparing Claude Sonnet 4.6 and Claude Sonnet 5 via GitHub Copilot Chat in VS Code, covering Azure architecture design and SharePoint Framework (SPFx) upgrade tasks. Despite Sonnet 5 carrying a 33% lower per-token price, architecture tasks saw a 12x median token increase with Sonnet 5, making it 3.7x more expensive per run on code upgrades ($2.01 vs $0.55). Output quality on architecture also dropped from 90% idiomatic correctness with Sonnet 4.6 to 78% with Sonnet 5. Code upgrade tasks reversed the picture: Sonnet 5 achieved 100% task completion vs 60% for Sonnet 4.6, but configuration correctness was 0% for both models because undocumented migration steps — seven specific file and config changes — were absent from the documentation entirely. Token variance was also a risk: Sonnet 5 swung from 16K to 6.6 million tokens on the same prompt, making cost budgeting unreliable.
Better Tools Made Copilot Code Review Worse. Here's How We Actually Improved It.
GitHub replaced Copilot code review's bespoke exploration tools with the shared Unix-inspired grep, glob, and view tools from the Copilot CLI harness — and benchmarks showed higher review cost with fewer issues caught. Trace analysis revealed the agent was browsing the repository broadly instead of working diff-first: it searched widely, read more file context than needed, and carried that extra context forward, inflating token cost. The fix was not in the tools themselves but in rewriting their instruction prompts to encode a reviewer's workflow — start from the diff, narrow with grep and glob before reading, batch focused view calls, and recover from failed searches with a single corrected query rather than widening exploration. The result in production was approximately 20% lower average review cost with no degradation in review quality, demonstrating that tool instructions for agents function more like API documentation than implementation details.
Swizec Teller applies Goldratt's Theory of Constraints to explain why AI-driven individual productivity gains have not translated into organizational shipping velocity. Studies show average economic output gains of only 0.4-1.3% across rich countries, even though individual engineers write code 50% faster and finish 26% more tasks. The argument is that code review has become the bottleneck: AI floods the pipeline with PRs faster than humans can review them, and work-in-progress kills throughput. Teller describes code review not primarily as a bug-catching mechanism but as a sociotechnical practice for knowledge dissemination, domain-model alignment, and codebase health. His prescription is to subdue the rest of the process to the bottleneck — spend less time generating code and more time clearing the review queue, working one PR to done before starting the next. He cautions that offloading review to LLMs risks losing the mentoring and architectural pattern-recognition that senior engineers provide through human review.
Infrastructure and developer tooling led this week's general web dev coverage. Cloudflare launched Workers Cache, a tiered cache that sits in front of a Worker and is configured via a single Wrangler config block plus Cache-Control headers. On cache hits the Worker never executes, eliminating CPU billing entirely; on misses it renders once and populates a two-tier global cache. The cache is Worker-scoped rather than zone-scoped, following the Worker across custom domains, workers.dev, preview URLs, and Workers for Platforms tenants. Tag-based purging via ctx.cache.purge(), stale-while-revalidate, and per-entrypoint cache toggles enable fine-grained cache architecture within a single deployable unit. A separate Cloudflare deep-dive covered why ML-DSA must serve as the first post-quantum signature wave despite its larger wire footprint: NIST's nine third-round signature candidates — including lattice (FN-DSA, HAWK), hash-based (SLH-DSA), and multivariate (MAYO, SNOVA) schemes — are unlikely to achieve broad deployment before 2030, past the 2029 migration deadline.
AI agent tooling and engineering culture converged in several articles. GitHub's Copilot code review team discovered that switching to shared grep/glob/view tools actually raised costs until they rewrote the tool instruction prompts to encode a diff-first workflow — the result was approximately 20% lower review cost with no quality degradation, demonstrating that agent tool instructions function more like API documentation than implementation details. Microsoft ran 150 agent tasks comparing Claude Sonnet 4.6 and Sonnet 5 on Azure architecture and SPFx upgrade scenarios: Sonnet 5's token usage spiked 12x on architecture tasks, making it 3.7x more expensive per run despite a 33% lower unit price, while Sonnet 5 completed 100% of code upgrade tasks versus 60% for 4.6.
Addy Osmani, drawing on 14 years leading Chrome and Gemini AI teams at Google, argued that the durable engineering skills in the agent era are judgment, problem selection, and verification — not implementation speed. Swizec Teller applied the Theory of Constraints to explain why AI-driven coding productivity (50% faster code, 26% more tasks) has not translated into organizational shipping velocity: code review has become the pipeline bottleneck, and the prescription is to work one PR to done before starting the next rather than flooding the queue.
Key Takeaways
Cloudflare Workers Cache makes caching Worker-scoped rather than zone-scoped — on cache hits the Worker never runs, eliminating CPU billing, with tag-based purging via ctx.cache.purge() and per-entrypoint cache toggles.
GitHub Copilot code review saw ~20% lower cost after rewriting tool instruction prompts to encode a diff-first workflow — not by changing the tools themselves — proving agent instructions act more like API contracts than implementation hints.
Addy Osmani and Swizec Teller independently argue the agent era bottleneck is not code generation but code review and judgment: AI floods PR pipelines faster than humans can clear them, making review throughput the limiting constraint on shipping velocity.
