(BUSAN.SASHIMI)
terminal
Weekly Digest // WEB_DEV_GENERAL — Week 31-2026
folder_openWeekly Report

Web Development — 2026 Week 31

Cross-cutting frontend topics, tooling, and DX

calendar_todaysummarizeWeek 31-2026
AGENT HARNESS

Shopify's Security Harness Makes Tests the Oracle

Shopify's Dispatch harness partitions applications, runs vulnerability-specific hunters in parallel, and gives downstream agents reusable documentation about APIs, data models, and authorization boundaries. Candidate findings then pass to a different model acting as a sequential verifier, which must prove exploitability with an integration test before severity scoring or a draft fix. Across more than 80 applications and thousands of scans, the workflow produced over 300 findings; two would have rated Critical. Full scans cost roughly 50–300 dollars and diff scans 5–50 dollars. The durable value is the harness: bounded context, test oracles, cross-model review, and deterministic code for credentials, Git, storage, and report formatting.

Read Articlearrow_forward
Article · WORKFLOWREAD TIME: 11m

A Simple Agent Workflow Beats a Stack of Novel Tricks

GitHub's recommended Copilot workflow is deliberately small: choose one harness, prototype several options, plan in the same session, implement autonomously inside a sandbox, and iterate until the result meets human taste. Visual prototypes expose ambiguity even for API work, while interactive planning surfaces edge cases before code consumes the context window. The article recommends keeping the same model and reasoning level during one task to benefit from prompt caching. Before merge, a Rubber Duck review asks a model from a different family to inspect the work and can repeat until remaining concerns have diminishing returns. The goal is a repeatable quality loop, not maximum configuration.

READ_FULL_LOGarrow_forward
Article · MCPREAD TIME: 4m

MCP 2026-07-28 Makes Servers Stateless and Extensions Portable

The MCP 2026-07-28 specification removes core session management, so an MCP server can behave like an ordinary stateless HTTP workload. Requests no longer require sticky routing, a shared session store, or the same warm instance, which simplifies scaling and makes redeployments less disruptive. The specification also formalizes an Extensions framework, with Apps and Tasks as its first official extensions. Apps let a remote server provide a rich interface that compatible clients render, replacing one-off UI integrations with a portable contract. Netlify's server already supports the new version and remains backward-compatible, but client support varies, so servers still need capability negotiation and a migration path.

READ_FULL_LOGarrow_forward
Article · INFRASTRUCTUREREAD TIME: 10m

cdnjs Moves Nine Billion Daily Requests onto Cloudflare's Developer Platform

cdnjs now serves an average of nine billion requests per day from Cloudflare's Developer Platform, with R2 as file source of truth, KV for metadata, Workers Cache at the edge, and DigitalOcean Spaces as a live fallback. Durable Workflows orchestrate ten-minute package checks, per-file processing, compression containers, and publication; Queues and a Durable Object coordinate thousands of child jobs. Migration copied existing bytes rather than regenerating them because changed minifier or compressor output would break pinned SRI hashes. The workload pushed paid Worker subrequests from 1,000 to 10 million and default Workflow steps from 1,024 to 10,000, turning one project's limits into platform improvements.

READ_FULL_LOGarrow_forward
Article · PERFORMANCEREAD TIME: 10m

Playwright Soak Tests Find SPA Memory Leaks Before Users Do

A long-lived SPA can accumulate detached nodes, event listeners, timers, and cache entries because navigation never resets the page. Den Odell proposes a Playwright soak test that runs a closed user flow about 200 times in one Chromium context, warms the app first, forces garbage collection twice through CDP, and compares listener and DOM-node counts before and after. Heap size is too noisy for the primary assertion, while listener counts and a fixed node allowance are more stable. Playwright's fake clock and mocked network can compress hours of polling into minutes. Because measurements still vary, the test belongs in a nightly job, with heap snapshots used only after the numeric guard detects a leak.

READ_FULL_LOGarrow_forward
Video · TOOLING60:46

"Looks Good to Me": A Practical Guide to Handling AI-Generated Code - Roman Zhukov

Roman Zhukov frames AI-generated code as an economic inversion: contribution takes minutes while maintainers spend hours disproving nonexistent functions, fabricated traces, and low-context changes. His four controls are a clear contribution policy, secure AI-coding guidance, automated quality gates, and accelerated vulnerability triage. A first policy can be only 60–100 words; the Linux kernel example is about 130, and “AI-assisted” attribution avoids implying that a model is a legal co-author. Practical resources include OpenSSF guidance, CoSAI's Project CodeGuard, and a Red Hat catalog of 128 security skills. A cited anti-slop filter runs 31 checks derived from more than 130 reviewed pull requests in under 15 seconds, but deterministic scanners and human verification remain the final authority.

WATCH_VIDEOarrow_forward
summarizeDigest_Summary

Week 31 makes the case that the durable part of AI-assisted engineering is the harness around the model. Shopify's Dispatch partitions large applications, runs specialized hunters in parallel, and then requires a different model to prove each candidate with an integration test before developers see it. Across more than 80 applications, the system produced over 300 findings; full scans cost roughly 50–300 dollars and incremental scans 5–50 dollars, while two findings would have rated Critical.

GitHub's practical workflow reaches a similar conclusion for everyday development: prototype to expose ambiguity, plan interactively, iterate with taste, and request a cross-family review before merge. The new MCP specification simplifies the infrastructure beneath such tools by making servers stateless HTTP workloads and formalizing Apps and Tasks as extensions. Model quality matters, but repeatable context, deterministic tools, isolated execution, and independent verification determine whether model output becomes trustworthy software.

Cloudflare and Den Odell supply the non-AI infrastructure lessons. cdnjs moved nine billion daily requests onto R2, KV, Workers, Workflows, Queues, Containers, and Durable Objects without regenerating files that would change pinned SRI hashes. For long-lived SPAs, a Playwright soak test can loop one round-trip flow hundreds of times in a single browser context, force garbage collection, and compare DOM-node and listener counts; fake clocks and mocked networks compress hours of timer activity into a nightly test.

Roman Zhukov applies the harness principle to incoming AI code: publish a short policy, teach secure prompting, add deterministic quality gates, and accelerate vulnerability triage. His examples—from Project CodeGuard to a 31-check anti-slop filter—use AI to reduce reviewer load without making it the final authority. The operating rule is simple: AI is an assistant, while accountable humans and reproducible checks decide what merges.

Key Takeaways
  • Separate hunting from verification: require a real integration-test oracle, use a different model for adversarial review, and downgrade or reject findings that cannot prove impact.
  • Design MCP services as ordinary stateless HTTP handlers for the 2026-07-28 specification, and treat Apps or Tasks as negotiated extensions rather than core session state.
  • Publish a concise AI-assistance policy, require secure coding guidance and deterministic gates, and reserve merge authority for accountable humans with reproducible evidence.