Developer Finds Silent Test Flaw in Reversibility Plugin for Agent File Writes

·1 views

A developer building a reversibility plugin called gx for OpenClaw's before_tool_call hook discovered that initial tests were passing for the wrong reason. The test only verified that a file contained the correct content after a write, which would be true whether gx acted or not, since OpenClaw's native write tool would also complete the write independently. The real fix involved checking the file's contents before the native tool ran, confirming gx had already applied the change first — a check that would fail if the plugin were merely a passive logger. The developer also highlighted the importance of distinguishing an 'Unknown' verdict, meaning the membrane was unreachable, from a deliberate 'Deny', noting that collapsing the two would mask instrumentation failures. This distinction proved useful early on when a misconfigured CLI caused gx to fail silently, which the Unknown state correctly surfaced rather than hiding as a false denial.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Design Secure Server-Rendered Login Sessions for EdTech Apps

A software developer has outlined a structured approach to handling authentication in server-rendered educational applications, emphasizing that session creation, verification, refresh, and logout should each be treated as distinct state transitions. The design recommends issuing a short-lived session cookie only after a phone verification code is confirmed, with the server maintaining full control over the session lifecycle and audit trail. A key concern addressed is account recovery in school settings, where a learner may lose their phone while a parent, teacher, or administrator still needs safe access to recover the account. The browser receives only an opaque HttpOnly cookie, keeping the underlying session store — whether SQL, Redis, or another service — invisible to the client. The article also provides a Python transport adapter that centralizes endpoint logic and ensures the application, not the auth provider, determines when each session transition is permitted.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Security Teams Must Shift From Gut Instinct to Metrics-Driven Decisions

Security programs have long relied on intuition rather than measurable outcomes, but growing attack surfaces and tighter budgets are forcing a change in approach. Metrics-driven security means defining success numerically before deploying controls, tracking the same data consistently over time, and actually letting those numbers drive program decisions. Common pitfalls include measuring activity instead of outcomes, using vanity metrics, and tracking too many numbers without clear ownership. Key areas worth monitoring include mean time to detect and respond to incidents, vulnerability patching speed, privileged account MFA coverage, and phishing simulation trends. Organizations are advised to select a small set of metrics aligned to their specific threat model and business priorities rather than adopting a one-size-fits-all list.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Founder Grows SaaS Product Buildside to 130 Users in Two Weeks via Public Building

Entrepreneur Uriel Bitton shared how he grew his SaaS product Buildside to 130 users within just two weeks of launch. His primary growth strategy centered on building in public, openly documenting his development journey on social media. The approach attracted an early user base without relying on traditional paid marketing. Bitton published his experience on DEV Community in early September, tagging it under topics including SaaS, founder journeys, and social media growth. His story highlights how transparency and community engagement can serve as effective tools for early-stage startup traction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Measure Your Team's Code Review Limits Before AI Pull Requests Overwhelm Them

Researcher Margaret-Anne Storey recently introduced the concept of 'cognitive debt' — the gradual erosion of shared understanding about how a system works — during a DORA community session. A software developer writing on DEV Community argues this debt is quietly accumulating in teams that review AI-generated pull requests at scale, without realising their review process has become ineffective. The author warns that standard delivery metrics like merge rate and time-to-approve can appear healthy even as review quality collapses, masking real risk behind green dashboards. Drawing a parallel to mutation testing in software quality assurance, they propose seeding review queues with known-defective 'canary' pull requests to measure how reliably reviewers catch real problems. They recommend starting with one canary per twenty pull requests, tracked over four-week windows, to establish a statistically meaningful detection rate before cognitive debt causes a serious incident.

0 comments Read more at DEV Community