Research, experiments, and implementation notes filed under infrastructure.
Targeted Rebuilds Beat Full Recomputes—If You Can Prove Them Safe
Cloudflare cut DNS Zone Builder peak memory by 85% by planning the smallest safe rebuild, merging queued work, and proving targeted output against full recomputation.
The eMudhra CA Compromise Is a Runtime Patch Problem
Eight eMudhra intermediate CA keys were recoverable from public certificates. Browsers moved quickly, but runtimes, containers, proxies, and embedded clients need explicit trust-store updates and tests.
Cloudflare's Brotli WAF Rules Start in Log Mode for a Reason
Cloudflare added emergency WAF detections for Brotli request bodies and the Next.js image endpoint, but operators should audit inherited overrides before changing either rule from Log to Block....
Dynamic Workers Make Agent Sandboxes Cheaper To Throw Away
Cloudflare Dynamic Workers move agent code execution into short-lived isolates, which is a practical shape for sandboxing generated JavaScript with narrow capabilities.
gpt-oss-safeguard Makes Safety Policies Runtime Inputs
OpenAI's gpt-oss-safeguard release turns written safety policies into runtime classifier inputs, which is useful for teams that need adaptable Trust and Safety workflows.
TRL Async GRPO Can Sync LoRA Adapters Instead of Full Weights
TRL v1.14 adds adapter-only vLLM sync for AsyncGRPOTrainer, making distributed RL training less dependent on shared GPUs and full-weight transfers.
OpenAI's Agents API Turns the Harness Into a Product
OpenAI's public beta Agents API exposes the managed Codex harness, including sessions, sandboxes, compaction, tool search, and subagents.
AI Agent Benchmarks Need a Consistency Number
IBM's ALTK-Evolve team showed why average pass rates can hide unstable agent behavior, and how Pass^k gives builders a better reliability check.
Cloudflare Workers Access Can Now Be Scoped Per App
Cloudflare added resource-level roles for Workers, giving teams a cleaner way to give CI systems, teammates, and coding agents only the access one application needs.
GitHub Advanced Security Configurations Can Now Be Enforced
GitHub enterprise administrators can now enforce Advanced Security configurations against both repository and organization owners, closing a practical policy gap for large teams.
Cloudflare 1.1.1.1 Makes Post-Quantum DNSSEC Practical to Test
Cloudflare's 1.1.1.1 resolver now validates ML-DSA-44 DNSSEC signatures, exposing the real migration work: large packets, TCP fallback, downgrade policy, and parent-chain adoption.
OpenAI Habitat Shows Why Storage APIs Should Be Boring
OpenAI's Habitat storage platform is a useful reminder that predictable APIs, event-loop telemetry, and controlled escape hatches matter more than expressive queries on hot paths.
Cloudflare Workers Gets Closer To Real Node Module Semantics
Cloudflare rebuilt the Workers module registry around URL-based resolution, lazy compilation, shared code caches, import.meta support, and better Node.js compatibility.
Cloudflare Automatic Key Exchange Makes Post-Quantum Origin TLS Less Manual
Cloudflare's Automatic Key Exchange measures each origin's TLS 1.3 key agreement support, then leads with the strongest safe key share, including X25519MLKEM768 where origins support it.
Cloudflare Connects AI Vulnerability Hunting To Production Evidence
Cloudflare's Vulnerability Discovery and Remediation service is a useful pattern for AI security work: rank findings with production traffic, WAF context, validation, and human review.
OpenAI Agents SDK Makes Sandboxes A First-Class Boundary
OpenAI's Agents SDK update is a practical reminder that production agents need explicit workspaces, isolated compute, durable state, and credential boundaries.
Cloudflare Shows Why Cache Layout Still Matters
Cloudflare's 1.1.1.1 DNS cache work is a practical reminder that high-cardinality systems need memory layout reviews, not just bigger machines.
Cloudflare Workers Shows Why Isolation Needs Layers
Cloudflare's Workers Spectre reassessment is a practical reminder that isolate-based platforms need layered containment, not a single clever mitigation.
GPU Scheduling Is Becoming AI Infrastructure Work
A practical look at why GPU allocation order matters for AI teams running mixed training, inference, quantization, and batch workloads.