(BUSAN.SASHIMI)
terminal
Weekly Digest // WEB_DEV_GENERAL — Week 32-2026
folder_openWeekly Report

AI Code Needs Reviewable Delivery — Week 32 Web Development

Cross-cutting frontend topics, tooling, and DX

calendar_todaysummarizeWeek 32-2026
CODE REVIEW

GitHub Turns Giant Agent PRs into Reviewable Stacks

GitHub's stacked pull request workflow decomposes an agent-generated feature into dependency-ordered branches, such as data, API, application wiring, and UX. Each layer receives focused CI and a reviewer with the relevant ownership. Reviewers read top-down for the end goal but review bottom-up so each dependency is understood first. When a lower branch changes, gh stack rebase, gh stack push, and gh stack sync propagate it upward. Local rebasing matters where signed commits are required because the web rebase changes the committer and produces unsigned commits.

Read Articlearrow_forward
Article · ENGINEERING STANDARDSREAD TIME: 8m

Cloudflare Encodes Engineering Standards for People and Agents

Cloudflare's Codex turns more than 60 engineering RFCs into governed SHOULD and MUST statements with stable IDs, domain owners, and separate approved and enforced states. A purpose-built agent compacts the rules into structured JSON for progressive discovery. In four months the code reviewer flagged nearly 230,000 violations and withheld approval for almost 16,000; a spec reviewer has evaluated about 600 designs and an incident reviewer more than 200 reports. Mechanically checkable rules move into fast linters, while the same standards remain available to local and CI agents.

READ_FULL_LOGarrow_forward
Article · RELEASE ENGINEERINGREAD TIME: 17m

An 18-Package Release Treats Delivery as Product Design

Publishing Calavera's 18 packages with npm trusted publishing required four prereleases. Rehearsal uncovered GitHub Actions PR permissions, disagreement between tarball creation and upload paths, invalid repository metadata inside the packed manifest, and bootstrap work for new trusted publishers. The final process inspected archives and generated version PRs, checked exact versions before retrying partial publishes, verified every provenance statement and dist-tag, and removed the bootstrap token, secret, and workflow fallback after one use. The core argument is operational: a release has users, interfaces, failure states, security boundaries, and recovery semantics.

READ_FULL_LOGarrow_forward
Article · RESILIENCEREAD TIME: 3m

Progressive Enhancement Can Capture Intent before JavaScript Loads

On a slow train connection, Remy Sharp's file-drop tool navigated to the raw Markdown because its handler waited behind 600 KB compressed of imported parsing and highlighting modules. He moved only the event binding, queue, and loading feedback inline beside the interactive HTML, capturing the drop immediately and replaying the work once dependencies became ready. The complete operation still took nearly two minutes over a simulated GPRS connection, but the user's intent was preserved. Progressive enhancement also applies inside JavaScript: prioritize the smallest code that prevents a destructive default.

READ_FULL_LOGarrow_forward
Article · WEB PERFORMANCEREAD TIME: 5m

Edge Experiments with Network Efficiency Guardrails

Microsoft's experimental Network Efficiency Guardrails combine Document Policy and the Reporting API so Edge can report inefficient resources during real browsing. Current checks flag images over 200 KB, data: URLs over 100 KB, and uncompressed text assets. Sites opt in through Document-Policy and Reporting-Endpoints headers, then inspect violations in DevTools or collect structured production reports. The feature is Edge-only behind experimental support and its thresholds may change, but it sketches a continuous complement to pre-deployment Lighthouse audits.

READ_FULL_LOGarrow_forward
summarizeDigest_Summary

GitHub stacked pull requests turn a large agent-generated feature into a dependency-ordered sequence—data, API, application wiring, then UX—so each layer has a bounded reviewer and its own CI evidence. Teams read the stack top-down for intent, review bottom-up for correctness, and use local rebase and sync commands when a lower layer changes, preserving signed commits and propagating fixes upward.

Cloudflare's Codex supplies the standards behind a similar review system. More than 60 RFCs are reduced into structured SHOULD and MUST statements with stable identifiers, owners, and separate approved and enforced states. In four months the code reviewer flagged nearly 230,000 deviations and withheld approval about 16,000 times; mechanical rules move into fast linters while model-based review stays available in CI and locally.

Schalk Neethling's 18-package Calavera release shows why delivery itself needs product design. Four prereleases uncovered repository permissions, mismatched tarball paths, packed provenance metadata, and trusted-publishing bootstrap problems. Exact-version checks, dry runs, inspected archives, signed provenance, retry-safe publishing, and revocation of the one-use bootstrap token converted those failures into reusable release contracts. Cheap code increases throughput, but reviewable units, governed rules, observable failure states, and reversible release steps determine whether that throughput remains maintainable.

Two browser-level guardrails complete the picture. Remy Sharp captured a file-drop interaction with a tiny inline handler before 600 KB compressed of modules loaded, queuing the user's intent even on GPRS. Microsoft's experimental Network Efficiency Guardrails use Document Policy and the Reporting API in Edge to surface images over 200 KB, data URLs over 100 KB, and uncompressed text resources during real browsing.

Key Takeaways
  • Ask agents to decompose large features by dependency and reviewer concern, keep CI green at every stack layer, and rebase locally when signed-commit rules matter.
  • Give engineering standards named owners and lifecycle states; enforce deterministic rules with linters first, then use model review where interpretation is genuinely required.
  • Rehearse releases against packed artifacts and human-visible output, make partial retries safe, and capture user intent before large JavaScript dependencies finish loading.