SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

OpenWorkProof v0.5 Requires Dual Independent Verifiers to Close Agent Self-Reporting Loophole

0
·2 views

OpenWorkProof v0.5, an open-source agent tooling project, has introduced a dual-verifier mechanism to address two widely cited weaknesses in automated code verification. Previously, an agent could self-report passing test results without any external check binding that claim to what actually executed. The update requires two independent verifiers — with distinct keys, subjects, and execution contexts — to each run the work separately and sign their own results. Every conclusion-bearing field across both verifiers must match exactly, or no decision is recorded. The fix was validated through seven rounds of adversarial probing by separate specification and security reviewers before being committed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer finds his own security test passed while the prompt injection attack still worked

On 26 July, software developer Karim Hamidou discovered a prompt-injection vulnerability in his open-source CLI tool llm-council, which chains multiple AI models to rank and synthesise answers. The tool used fixed, publicly visible delimiter strings to fence untrusted model output, meaning any model that had seen the repository could write the closing marker mid-response and escape the sandboxed block. More troublingly, a unit test already existed that claimed to verify this boundary could not be forged, yet the test only checked string positions and occurrence counts — never whether a downstream model could actually be deceived. The test passed consistently and contributed to 100% code coverage, masking the unfixed vulnerability entirely. The developer resolved the flaw by replacing the static delimiters with a per-run random nonce, making the closing marker unguessable to any voter model.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer's monitoring stack silently failed for days due to a deduplication bug

A software developer running a self-hosted observability stack discovered on August 13 that Prometheus had stopped writing data to disk due to a full storage volume, yet all health checks and dashboards continued appearing normal. The failure went undetected because Prometheus was not scraping its own internal metrics, leaving no alert rules in place to catch the issue. After adding a watchdog to report errors to Sentry, the developer believed the problem was resolved when alerts went quiet — but the silence was misleading. A module-level deduplication set in the watchdog code meant the alert fired only once per process lifetime, masking dozens of ongoing failures per hour. The root cause was a deduplication window set to 'forever,' making a persistent, recurring fault look identical to a one-time resolved event.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How one engineer structured 7,798 React icon components to load only what you import

Design engineer James Coombs built an icon package used across roughly twenty frontend apps, with its largest set containing 7,798 generated React components as of August 2026. The core challenge was ensuring that importing a single icon never forces a consumer's build to process the remaining thousands. To achieve this, Coombs avoided the conventional barrel file approach, where a single index.ts re-exports everything, because at this scale it slows cold builds and hot reloads regardless of tree-shaking. Instead, each icon is its own standalone module of about 900 bytes, with a wildcard entry in the package's exports map allowing clean deep imports that resolve to exactly one file on disk. This architecture makes the bundler's job straightforward, since it is never handed the full icon set as a unit and has no reason to traverse components that were not explicitly requested.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How One PostCSS Plugin Solved a Four-CSS-System Migration Without Touching Components

Design engineer James Coombs faced the challenge of migrating a large frontend from Material UI to a custom design system built on Radix and Tailwind CSS 4, requiring four CSS systems to coexist simultaneously in the same bundles. Three component-level isolation approaches — manual class prefixing, runtime class modification, and Shadow DOM — were each considered and rejected before the team explored a solution at the CSS configuration level. Using the PostCSS plugin postcss-prefix-selector, every generated selector was scoped under a wrapper class during the build process, allowing the new design system's styles to win via CSS specificity without touching the roughly 960 existing component files. The approach required five PostCSS plugins running in sequence, including a step to strip @layer declarations so design-system rules could compete at normal cascade priority against unlayered legacy CSS. React portals — used by dialogs, tooltips, and dropdowns rendering outside the scope wrapper — were the one exception, each requiring a single targeted edit to maintain correct styling.

0 comments Read more at DEV Community