Freeze Agent-Patch Tests Against Fixture Content Hashes, Not Test Names

·1 views

A proposed testing protocol argues that test freezes should be tied to the SHA-256 digest of fixture bytes rather than pytest node names, preventing agent patches from silently invalidating existing test skips. When an agent patch modifies a fixture file, any freeze referencing the old digest should immediately expire, forcing re-evaluation rather than inheriting a stale mute. The protocol stores each freeze as a structured triple — a stable property ID, a fixture digest, and an evidence window of independent reruns — recorded in a human-readable JSONL ledger. A digest mismatch between a live fixture and a locked freeze must be treated as fixture drift and block the merge, not silently pass. The goal is to ensure that a green CI suite continues to measure the actual properties it was designed to verify, even as agent patches evolve the underlying code and data.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Full Git Clone in 3,390 Lines of Pure Python With No Dependencies

A developer created pygit, a fully functional Git-like version control system, as an entry for a Zero Dependency Hackathon. The project is implemented in a single Python file using only the standard library, with no external packages or calls to the real Git executable. pygit supports 30 commands — including merge, rebase, cherry-pick, and stash — along with a custom client-server synchronization protocol built on raw sockets. Core Git concepts such as content-addressed object storage, three-way merging with conflict markers, and branch management were all built from scratch. Standard library modules like difflib, zlib, argparse, and unittest replaced third-party tools that would normally handle those functions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Translate Pro VSCode Extension Brings In-Editor Translation Tools for Developers

A developer has highlighted Translate Pro, a Visual Studio Code extension designed to reduce context switching caused by translation needs during coding workflows. The tool has been actively maintained for over two years, accumulating more than 10,000 downloads and 100 releases on the VSCode Marketplace. It offers features such as hover translation, inline comment replacement, terminal error translation, and Markdown preview support. Google and Bing translation engines are available for free, while users can integrate their own API keys for DeepL, Azure, Amazon, Baidu, or Tencent. The extension targets developers who frequently work with foreign-language documentation, source comments, and terminal logs without leaving their editor.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Key NLP Evaluation Metrics Explained: Precision, Recall, F1, and Confusion Matrix

Evaluating NLP models goes beyond simple accuracy, which can be misleading when datasets are imbalanced or certain errors carry higher costs. Precision measures how often a model's positive predictions are actually correct, while recall captures how many real positives the model successfully identifies. These two metrics often trade off against each other, making it difficult to optimise both simultaneously. The F1 score addresses this by combining precision and recall into a single balanced measure using their harmonic mean. A confusion matrix complements these metrics by visually breaking down true positives, false positives, true negatives, and false negatives, helping engineers pinpoint exactly where a model is going wrong.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Developer Machines Are Prime Targets for Credential Harvesting Attacks

Credential harvesting involves the large-scale collection of login credentials — including passwords, API keys, and session tokens — which attackers use or sell on the dark web. According to Verizon's 2026 Data Breach Investigations Report, credential abuse appears in 39% of breaches when the full attack chain is traced. Developer machines are particularly vulnerable because sensitive credentials often sit in plaintext on disk, stored in config files, shell histories, SSH keys, and AI tool caches. Unlike phishing, attackers targeting developer machines do not need to trick anyone — the credentials are already accessible once a machine is compromised. Modern techniques such as adversary-in-the-middle phishing kits and device code phishing further allow attackers to bypass multi-factor authentication by capturing session cookies rather than passwords directly.

0 comments Read more at DEV Community