标签：#Testing

Here is a step-by-step guide to configuring your Playwright/Cucumber test suite to run on LambdaTest Cloud via Azure DevOps pipelines, returning test results directly to Azure. 1. Prerequisites A GitHub repository containing your Playwright, Cucumber, and JavaScript automation code. An active Azure DevOps account with a project created. A LambdaTest account (you will need your username and access key). 2. Connect GitHub to Azure DevOps In Azure DevOps, navigate to Pipelines > New Pipeline. Select GitHub as the source and authenticate your account. Choose your repository and target branch (e.g., main). 3. Create LambdaTest Credentials Variable Group Go to Pipelines > Library in Azure DevOps. Click + Variable group and name it LambdaTest-Credentials. Add the following key-value pairs: LAMBDATEST_USERNAME = your_lambdatest_username LAMBDATEST_ACCESS_KEY = your_lambdatest_access_key (toggle "Keep this value secret") Save the group. 4. Add/Update Your azure-pipelines.yml Place this configuration file in your repository root directory: trigger : - main pool : vmImage : ' windows-latest' variables : - group : LambdaTest-Credentials - name : BASE_URL value : ' https://your-app-url.com' - name : LT_BROWSER value : ' chrome' - name : ENABLE_LAMBDATEST value : ' true' stages : - stage : Test jobs : - job : UITestsLambdaTest displayName : ' UI Tests (LambdaTest Cloud)' steps : - task : NodeTool@0 inputs : versionSpec : ' 20.x' displayName : ' Install Node.js 20.x' - script : npm ci displayName : ' Install Dependencies' - script : npm run test:ui:smoke displayName : ' Run UI Smoke Tests on LambdaTest' env : ENABLE_LAMBDATEST : ' true' LT_USERNAME : $(LAMBDATEST_USERNAME) LT_ACCESS_KEY : $(LAMBDATEST_ACCESS_KEY) LT_BROWSER : $(LT_BROWSER) BASE_URL : $(BASE_URL) - task : PublishTestResults@2 condition : always() inputs : testResultsFormat : ' JUnit' testResultsFiles : ' reports/junit-report.xml' testRunTitle : ' UI Tests - LambdaTest Cloud' 5. Update Your Test Code Ensure your tes

A comprehensive, production-ready checklist for reviewing data validation, ETL testing, and automated reconciliation codebases. Code reviews for data engineering tools need more rigor than standard web apps. A subtle bug in a data validation framework can cause silent pipeline failures, false positive test passes, or accidental execution of unbounded SQL queries on production warehouses. Whether you are building a custom data framework or maintaining automated ETL tests, use this generalized checklist during code reviews to keep your test suites secure, performant, and reliable. 1. Test Case Configuration (YAML / JSON) TC ID Matching: Ensure the tc_id value matches the configuration filename exactly. Schema Validity: Verify that type (e.g., count, data, recon, file) and source/target drivers are valid and supported. Explicit Enablers: Confirm the enabled field is explicitly set (true or false) rather than omitted. Relative File Paths: For file-based validation, ensure paths are relative to defined source/target data directories. Non-Empty Queries: Confirm SQL sources and targets include non-empty query strings or valid template paths. Unique Case IDs: Ensure test case identifiers are unique across the test suite directory. Documented Rationale: If a test case has enabled: false or uses numeric tolerance thresholds (validation_tolerance), ensure a comment explains the business reason. Dependency Order: Verify that basic structural checks (COUNT) run prior to deep comparisons (DATA / RECON). 2. SQL & Query Logic Explicit Projections: No SELECT *. All columns must be explicitly listed to avoid schema drift breaks. Alignment: Source and target queries must return compatible data types and matching column ordering. Environment Isolation: Check that query strings contain zero hardcoded hostnames, schema names, or environment paths. Secret Hygiene: Ensure queries contain no hardcoded credentials or connection strings. Warehouse Pushdown: Confirm filtering and heavy aggrega

A cheaper model is not cheaper if it silently breaks the workflow. That is the trap many AI product teams are walking into as open-weight models get stronger. A model looks good in a leaderboard, a demo feels fast, and the per-token price looks friendly. Then production traffic arrives. Support answers lose citations. JSON starts drifting. Tool calls become noisy. A workflow that looked 40% cheaper now needs retries, escalations, and manual cleanup. The safer path is not "use the biggest model forever." That will burn margin. The safer path is a benchmark harness that tests each model against the jobs your product actually performs before you route real users to it. This guide shows how to design that harness for AI app builders, solo founders, and engineering teams who want to compare open-weight models, closed models, and local inference without trusting generic benchmarks alone. Viral hook and SEO intelligence notes Chosen hook: surprising contrast plus urgent mistake. Open-weight models can cut cost, but only if the full workflow still succeeds. Headline options compared: Open-Weight Model Benchmark Harness: Test Cheaper Models Before You Route Traffic Stop Swapping Models by Vibes: Build an Open-Weight Benchmark Harness Qwen-Class Model Testing: A Practical Harness for Production AI Apps Cheaper LLMs Need Proof: Benchmark Open-Weight Models on Real Workflows Option 1 won because it uses the high-intent phrase "open-weight model benchmark harness," states the practical action, and promises a concrete payoff without hype. Viral keywords: open-weight model benchmark harness, open-weight model evaluation, Qwen model testing, LLM benchmark harness, model routing, AI cost optimization, production AI evaluation, LLM regression tests, task-based model selection. Prediction scores: virality 8/10, CTR 9/10, retention 9/10. The topic is timely because open-weight adoption is accelerating, practical because builders feel model-cost pressure, and sticky because the article

Setting up an API automation framework requires aligning business goals, developer specifications, infrastructure, and core testing strategies. Here is a comprehensive requirement checklist and workflow to ensure complete coverage across every stage of your API automation setup. 1. Requirements from Client / Business Owner Before writing code, define what needs to be tested: Business requirements (BRD) & user stories / use cases Expected API behavior & acceptance criteria (success & failure cases) Priority APIs (critical vs optional pathing) Performance expectations (SLA, response time) API versioning policy (backward compatibility expectations) Security & compliance requirements (data privacy, PII handling) 2. Technical Details from Developers Understand how the APIs operate: API Documentation: Swagger / OpenAPI specifications Endpoints: Base URL + specific paths HTTP Methods: GET, POST, PUT, DELETE, PATCH Request Details: Headers, query params, request body (JSON/XML) Response Details: Expected status codes (200, 201, 400, 401, 403, 404, 500) and response schema structures Authentication: OAuth, JWT, API keys, or Basic Auth Error Handling: Error codes & error messages API Contracts: Consumer-driven contract definitions (e.g., using Pact) Rate Limits & Throttling: Maximum request limits and wait strategies Downstream Dependencies: Dependent APIs required for mock/stub planning 3. Infrastructure & Environment Setup Coordinate with the Application Owner or Infra Team for execution requirements: Environment URLs: Dev, QA, UAT, and Prod environments Access Control: VPN access, API gateway setups, credentials Test Data Strategy: Valid, invalid, edge case, and boundary value datasets Data seeding scripts for pre-test setup Data teardown/cleanup scripts for post-test cleanup Data isolation per environment Database Access: Direct access for validating API output directly against DB records Mocking/Stubbing: Availability of tools like WireMock or MSW for dependent APIs Secr

The fastest way to trust a generated API is not to read the code and not even to run its tests locally; it is to make the code stand up as an actual HTTP server and answer real requests before you let it anywhere near a merge request. Most failures in LLM-generated backend code hide between static correctness and runtime truth: a missing dependency that only matters when the process starts, an assumption about a default host, a path parameter that works in pseudocode but not in the framework's route parser, or a response shape that drifts from what the client expects. A local unit test can pass while every one of those problems remains invisible, because the test never starts the process, binds a port, or sends a request over a socket. The loop worth describing is deliberately narrow. Use a free model to draft a small HTTP endpoint from a short specification, then deploy that draft to a disposable server where you can send it real requests, observe the response, and decide whether the generated code deserves to become part of your project. MonkeyCode's free model access and free server option make that loop easy to try without paying for a host or hand-rolling a local container, but the workflow is useful with any model and any temporary runtime you already have. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Start by asking the model for something tiny but externally observable. A health route plus an echo route is enough, because the point is not to demonstrate cleverness but to prove that the generated service can bind, route, validate query parameters, and return JSON under real HTTP conditions. Have it generate a FastAPI application, for example: from fastapi import FastAPI from pydantic import BaseModel app = FastAPI () class Echo ( BaseModel ): message : str @app.get ( ' /health ' ) def health (): return { ' status ' : ' ok ' } @app.post ( ' /echo ' ) def echo ( body : Echo ): return { ' received ' : body . message } That code

A small team shipped a CSV validation service. It passed on a workstation. It died three seconds after starting on a free server. This article reconstructs that failure as a reproducible case. It is not a benchmark and not a product review. The point is to show a workflow for finding display dependencies before they reach production. Two availability points made the loop cheap: free model access to draft a fix and a free server option to run headless checks. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The article does not assert model names, quotas, hardware, or uptime guarantees beyond those availability points. The case began with a small request. The service needed to read a CSV file, reject rows with missing columns, and write a short JSON report. The requirement said nothing about a desktop interface. The generated entry point looked ordinary. def main ( argv = None ): args = parse_args ( argv ) if not args . input : from tkinter import Tk from tkinter.filedialog import askopenfilename root = Tk () root . withdraw () args . input = askopenfilename () validate_csv ( args . input ) The local smoke test passed because it always supplied a file. python csv_check.py --input sample.csv That path never touched the fallback. The application then moved to a free server where the default start command had no file argument. The server process reached the Tk() call and failed. _tkinter.TclError: no display name and no $DISPLAY environment variable The problem was not a hallucinated algorithm. The model added a graphical file picker as a hidden fallback. On the workstation that fallback was harmless. On a headless server it was a startup-time dependency. A code review might have missed it because tkinter is a standard-library module and the fallback looked like convenience logic. The environment mismatch only became visible when the no-argument path ran on a machine without a display. The team turned the failure into a deploy gate. The fi

A known-bad regex is useful evidence, but putting it directly in the test process can hang the runner before the timeout assertion fires. The boundary I am using: run each adversarial case in a fresh worker thread or child process let the parent own a hard timeout and terminate the child keep semantic-parity fixtures separate from timing guards require the safer replacement to pass both suites record the timeout class and bounded elapsed time as evidence Browser workers have the same trap: startup time should not consume the execution budget, and output limits matter alongside time limits. Disclosure: I maintain MonoTools. I recently tightened its browser-local Regex Tester around a 300 ms post-startup Worker budget, named groups, replacement previews, and regression cases: try the bounded tester What does your team treat as a deterministic CI failure receipt for ReDoS: an exit code, a timeout class, an elapsed-time range, or something else?

Before you expose a tool-using language model to customers, contractors, or any input you do not fully control, make another model attack it first. This short red-team loop costs little when you use a free model endpoint and a free server, and it often surfaces prompt-injection and tool-abuse failures before a human finds them in production. The problem with agents is not that they occasionally misunderstand a request; it is that instructions, data, and tool outputs all share the same context window. An attacker can hide instructions inside a document, a ticket, or a web page, and your agent may treat those words as part of its original operating rules. OWASP's guidance for LLM applications describes prompt injection as one of the common failure modes, and the risk grows quickly when the agent can call tools such as search, send email, or update customer records. Hand-testing three or four phrases like 'ignore previous instructions' gives you confidence, but not coverage. A free attacker model can generate dozens of variations that rephrase the same attack, combine a legitimate request with a hidden command, or exploit the names and descriptions of the tools your agent exposes. It does not need to be the strongest model available; it just needs to be adversarial enough to stretch your assumptions. You do not need a production deployment to get value from this. A small script running on a free server is enough, because a handful of attack rounds usually exposes gaps in wording that thousands of normal conversations would not. The point is not to build an official benchmark; it is to make the negative space visible while you can still change the system prompt. If you do not have a spare GPU or a large evaluation budget, MonkeyCode's free model access and free server option are one practical way to host this loop. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The harness is a three-part loop. First, the target receives a user input and

Your next API test tool might not be a smarter assertion library or a bigger suite of hand-written edge cases; it could be a free model you point at your endpoint and ask to misbehave on purpose. Manual boundary testing is slow because you tend to think of the inputs your code already expects, and traditional fuzzers generate a lot of noise without understanding what your API contract actually says. A language model sits in a useful middle ground: if you give it a short description of one endpoint, it can produce semantically plausible payloads that are likely to trip your parser, confuse your validation, or expose an error message you did not mean to send. That makes it a practical first line of defense, not a replacement for a security audit, and it works well enough for small services that would otherwise have no adversarial testing at all. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The workflow below was written for any OpenAI-compatible endpoint, and it becomes easier to schedule when you use the free model access and free server option that motivated this test; I treat those availability claims as something to verify in your own setup rather than as a permanent promise. The core idea is to stop asking the model whether your API response is correct and start asking it to make your API fail. Take one endpoint from your own codebase, write down the fields it expects in plain language, and ask the model to generate a dozen request bodies that could break the server or bypass validation. You are not interested in the model's opinion of your code; you only want a stream of hostile inputs that your current tests probably miss. The script below sends each generated payload to a local target endpoint and prints the status code along with a short preview. A five-second timeout keeps one hanging request from blocking the rest, and those timeouts are often the most interesting results. import json , os , requests MODEL_ENDPOINT = os .

Nearly every AI agent benchmark you read is unfalsifiable. Not wrong, necessarily - unfalsifiable. There's a blog post with a bar chart, a claim that framework A beat framework B, and no way for you to check it. No run count. No model version. No raw output. Often no cost. You are asked to trust a summary statistic produced by people with an interest in the result. We publish agent benchmarks, so this is our problem too. This post is about the evidence bundle we settled on, and how you can pull one down and take it apart in about two minutes. Every command below is one I actually ran while writing this, with its real output pasted in. The claim we're going to try to break From one of our pilot runs: LangGraph 1.2.9 and Pydantic AI 2.13.0 both completed 20 of 20 tasks under gpt-4o , at a total spend of $0.094275. That's the sort of sentence you'd normally have to take on faith. Let's not. Two minutes to verify it yourself The bundle is a directory in a public repo. Pull it: BASE = "https://raw.githubusercontent.com/benchclawio/harness/main/results/gpt-4o-vs-gpt-4o-mini-tool-calling-2026-07-24" for f in SHA256SUMS README.md gpt4o-pilot-manifest-v0.4.0.json \ scored-pilot-gpt4o-raw-2026-07-24.jsonl \ scored-pilot-raw-2026-07-24.jsonl \ scored-pilot-analysis-2026-07-24.json \ scored-pilot-gpt4o-analysis-2026-07-24.json \ real-pilot-status-manifest-v0.3.0.json ; do curl -sfO " $BASE / $f " done First question: is this the same data we published, or has something drifted? sha256sum -c SHA256SUMS README.md: OK gpt4o-pilot-manifest-v0.4.0.json: OK real-pilot-status-manifest-v0.3.0.json: OK scored-pilot-analysis-2026-07-24.json: OK scored-pilot-gpt4o-analysis-2026-07-24.json: OK scored-pilot-gpt4o-raw-2026-07-24.jsonl: OK scored-pilot-raw-2026-07-24.jsonl: OK That's the cheapest integrity control there is and almost nobody ships it. It costs one line in your run script and it means a reader can tell the difference between the file you published and a file someone edited afte

If you’ve managed web servers or applications for any length of time, you’ve probably seen this happen: a new feature or campaign goes live, traffic suddenly spikes, and Website Load Testing becomes critical when your website starts returning 503 errors at exactly the moment you need it to perform. What happens next is usually a scramble, SSH into a server you haven’t checked in months, inspect running processes, restart services, and make infrastructure changes based on guesswork. Eventually, the traffic settles, the site recovers, and the immediate crisis is over. But that kind of incident is often preventable. Load testing helps you find your website’s limits before your users do. In this guide, we will cover what load testing is, why it matters at every scale, how to run your first test using loader.io (the most accessible free tool available), what your results actually mean, how to find and fix bottlenecks, and how to make load testing a normal part of how you ship software. TL;DR Load testing answers one critical question: how many concurrent users can your server handle before it falls over? Without it, you’re guessing about capacity, and guessing wrong right when it matters most loader.io is the simplest free tool to get started: no install, browser-based, generous free tier Your three essential numbers: concurrent user target, response time threshold, and peak traffic window Run load tests before every major deployment, not after your site goes down What Load Testing Actually Is Let me clear up some confusion first, because “load testing” gets thrown around interchangeably with a few related terms that mean different things. Load testing is specifically about simulating concurrent users hitting your site and measuring how your server behaves under a expected load. You’re asking: “When 500 people are on this site at the same time, what happens?” Stress testing pushes beyond that, you keep adding users until something breaks, then you figure out exactly wher

While exploring X360 AI Tech, I started thinking about something beyond just generating test cases-how much should we actually trust them? Creating a basic happy-path test with AI seems pretty easy, but things like business logic, edge cases, and whether the test is actually checking the right thing still need a human eye. I’m also wondering about what happens a few months down the line. The app changes, requirements change, and some tests that made sense earlier may not make sense anymore. So maybe the bigger challenge isn’t just generating tests, but keeping them useful over time. For me, AI feels more useful as a second pair of hands rather than something that makes all the testing decisions. Curious how others are using it in real projects-are you reviewing every AI-generated test, or trusting it for certain types of scenarios?

In the previous article , I argued that AI isn't simply changing the tools we use to develop software, but shifting our work to a new level of abstraction. In this one, I want to address the problem that immediately follows: if we're going to write less and less code directly and agents are going to produce an increasingly larger part of it, how the hell do we know whether what they code is actually right? Because the answer obviously can't be “trust the AI, it's very smart”. Even though I personally develop code with AI today with practically no review, I don't blindly trust AI. Just as I don't blindly trust an engineer on my team. I don't even blindly trust myself. Blind trust is a security hole. And not blindly trusting someone doesn't mean distrusting them, it means having mechanisms to prevent their mistakes, or mine, from causing problems. That's why we've spent decades building mechanisms and methodologies around software development to detect, and avoid as much as possible, our mistakes. XP. Scrum. Tests. Code reviews. Pair Programming. CI. Static analysis. Permissions. Observability. Environments. Containers. Auditing... The question, therefore, shouldn't be whether we can trust an AI. The question should be what system do we need to build so we can use it without needing to blindly trust it? It's not deterministic One of the first objections is usually that if you ask it the same thing twice, it generates two different pieces of code. True. But if you give the same task to two different programmers, or to the same programmer with enough time in between, we'll very probably get two different implementations too, depending on the complexity of what we're asking. And if we've never required two developers to produce exactly the same code, why do we expect AI to produce exactly the same code from the same request? Isn't it enough for the result to satisfy the requested requirements? That it does what it's supposed to do. That it passes all kinds of tests. That

Acceptance gaps Your monitoring tool has 33 tests. Every one of them passes. It has also never executed, not once, and nothing in your project will ever tell you. Correct, complete, and never started We built a tool that scans four public sources for conversations where our product belongs. It reads only. It never posts. The acceptance was thorough. 33 checks in total. No write access, no credentials, results filtered for relevance, duplicates removed. A hard cap on output, back off on HTTP 429, and a dead source must not swallow the other three. All 33 passed. The tool shipped. The task promised a list of conversations every morning. There was no schedule. So there was never a list. And a tool that does nothing also reports nothing, so nobody noticed. Why your test suite cannot see this Tests answer questions about behaviour. Given this input, does the code do the right thing? Whether anything ever supplies that input is a different kind of question. It lives in a scheduler, a workflow file, a systemd timer, a queue consumer. Your test suite has no opinion about it. This is why the gap survives review. Reviewers read the diff, and the diff is correct. The missing part is not in the diff at all. Note how ordinary the failure is. Nobody was careless. The work was good. It just was not connected to anything. The question to add to every acceptance What starts this, and how would I know if it stopped? Ask it about every tool you ship that is meant to run on its own. A report, a backup, a sync, a scanner, a cleanup job. It has two halves and both matter. Something must start it. And when it stops starting, that must be visible without anyone going to look. Make it answerable by a machine A question you have to remember to ask gets forgotten. So we wrote a guard that asks it for every tool at once. The rule: any script whose own header says it runs daily must appear in a workflow file that has a schedule. Twelve lines of code, and it covers every tool we will ever add. T

The Third Predicate: Argument-Space Verification, Tested Agent Determinism Illusions (Part 10) Part 8 ended with a three-stage pipeline — evidence gate → contract regex → per-requirement LLM — and a patched framing: the combination narrows the gap without closing it. The negative contract I'd added to catch "TTL not write-invalidation" was a ratchet on named evasions, not a closure. Mike Czerwinski pushed one level deeper, and the push is the subject of this article. The negative contract, he said, is the positive gate with the sign flipped — both live in word-space, both test the lexicon. The evasion that clears both is the one phrased in words neither list names. And the predicate that actually matches scope to claim isn't lexical at all: "Write-invalidation done honestly isn't 'says invalidate, doesn't say TTL-simpler,' it's 'exercises the write path and observes the invalidation on the key the claim names.' That's argument-resolution... Positive and negative both live in word-space. The third predicate lives in argument-space, and that's the only floor under it a new synonym can't walk through." This article tests that claim. Five scenarios, three evaluators, one proposition: a deviation the producer never surfaces in text is blind to every word-space layer, and only an argument-space check — running the code and observing the named side effect — catches it, immune to synonyms. 1. The proposition, made testable Strip the comment to a falsifiable claim: A non-surfaced deviation — one the producer never writes into any evidence file — is invisible to word-space layers (contract regex, per-requirement LLM reading evidence text). Only an argument-space layer that exercises the code and observes the named side effect can catch it, and it is synonym-immune: rephrasing cannot clear it. The contrapositive is where the experiment earns its keep: if I can construct a scenario where the producer fabricates compliant evidence text but the implementation does not comply, the

Last month a model I'd been watching dropped its token price by half, and three people sent me the announcement within an hour. The implied question was always the same: when are you switching? My answer, these days, is: after it survives quarantine. Because the last time I swapped a model based on announcement-day excitement, everything looked fine for nine days. Then a scheduled job started emitting subtly malformed JSON — valid enough to parse, wrong enough to corrupt downstream state — and I spent a weekend reconstructing which records had been poisoned. The money I saved on tokens wouldn't cover one hour of that cleanup. The economics of model swaps are lopsided. The upside is small and predictable (cheaper tokens). The downside is unbounded and sneaky (behavioral regressions in edge cases your happy-path tests never exercised). So I built a pipeline that treats every new cheap model like an untrusted dependency with an attractive changelog: it gets isolated, probed, and graduated in stages. Here's the whole thing. What the pipeline needs (and what it doesn't) Three ingredients: candidate model access, somewhere disposable to run the evaluation, and checks that don't require a second LLM to grade the first one. For model access and the throwaway compute, I'm currently using MonkeyCode's free model access together with its free server option — bursty evaluation workloads are exactly the kind of thing I'd rather not attach to a production billing account. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Nothing in the pipeline below is tied to that provider, though. Every endpoint is an environment variable, and I'd encourage you to wire it to whatever you're actually evaluating. I want to be explicit about two things I'm not assuming: that any particular model is on the free tier when you read this, and that any free offering stays available forever. Treat free infrastructure the way you treat a library's latest tag — convenient, n

يقوم Claude الآن بإرفاق بيانات تعريف العزو (provenance metadata) المشفّرة وفق C2PA بالملفات التي ينشئها. وينطبق الأمر نفسه على نماذج الصور من OpenAI و Gemini . هذا يعني أن إشارة العزو تصل سليمة إلى نقطة التحميل لأول مرة، لكن سلسلة معالجة الصور لديك قد تحذفها قبل أن يراها أي شخص. جرّب Apidog اليوم لا يحدث ذلك بنية سيئة؛ بل يحدث افتراضيًا. فمثلًا، تنشئ sharp().resize() ملفًا جديدًا بلا بيانات تعريف ما لم تطلب الاحتفاظ بها صراحةً. وينطبق ذلك أيضًا على ImageMagick وPillow ومعظم شبكات CDN الخاصة بالصور. يدخل الملف، ويخرج JPEG أصغر، ولا تخبرك السجلات أن بيانات العزو اختفت. هذه مشكلة قابلة للاختبار. ستتعلم هنا كيف تحدد المرحلة التي تحذف بيانات C2PA، وتثبت ذلك عبر رحلة رفع وتنزيل حقيقية، وتضيف فحصًا في CI يمنع عودة المشكلة. يتولى Apidog تنسيق سيناريو الـ API، بينما يتولى c2patool التحقق من صحة البيانات على مستوى البايت. ما الذي يتم تدميره بالفعل؟ بيان C2PA هو كتلة موقعة تشفيريًا ومضمّنة داخل حاوية الملف. يسجل من وقّع الأصل وما الذي ادعاه عنه. وبما أنه موقّع، فإن تغيير البايتات دون إعادة التوقيع يكسر التوقيع بطريقة يستطيع أي مدقق اكتشافها. النقطة المهمة هنا هي حاوية الملف : عندما تعيد كتابة الحاوية، قد يختفي البيان. العملية هل يبقى البيان افتراضيًا؟ نسخ أو نقل بايت ببايت نعم sharp().resize().toBuffer() لا ImageMagick عبر convert أو magick لا Pillow عبر Image.save() لا تحويل PNG إلى WebP أو JPEG إلى AVIF لا التحسين التلقائي في CDN للصور غالبًا لا لقطة شاشة لا إعادة الحفظ من محرر صور لا رفع إلى S3 دون تحويل نعم كل عنصر في عمود لا هو إجراء شائع في تطبيقات الويب: إنشاء صور مصغرة، توليد صور متجاوبة، التفاوض على التنسيق، أو إزالة EXIF لأسباب الخصوصية. كل خطوة منطقية بمفردها، لكنها قد تنهي سلسلة العزو بصمت. انتبه أيضًا إلى أن استخدام -strip لإزالة بيانات EXIF قد يكون مقصودًا، لأن EXIF قد يحمل إحداثيات GPS أو أرقامًا تسلسلية للكاميرا. لكن إزالة جميع البيانات الوصفية للتخلص من بيانات الموقع تزيل بيان C2PA كذلك. الحل هو إزالة البيانات الحساسة بشكل انتقائي، لا حذف الكتلة كاملة. أثبت المشكلة في دقيقتين قبل تغيير خط الأنابيب، تحقق من وجود المشكلة فعلًا. تحتاج إلى ملف واحد يحتوي على بيان

The worst test suite I ever inherited had 400 tests, and I trusted about six of them. The rest were either testing implementation details nobody cared about, duplicating each other, or so tightly coupled to internal function names that a harmless refactor broke thirty tests for no real reason. Reading that codebase taught me more about what not to do than any greenfield project ever has. So when you're starting from zero, the goal isn't "write a lot of tests fast." It's building a suite you'll still trust a year from now. If you're new to this, getting the software testing basics right early matters more than covering everything - learning how to build a first test suite from scratch teaches you what to prioritize in a way that inheriting someone else's bloated suite never will. Here's roughly how I'd approach it. Start with what would actually hurt if it broke Before writing a single test, list the handful of things that would be genuinely bad if they silently broke - checkout completing, auth working, the core thing your product does actually happening. Not every function, not every branch. Just the stuff where a silent failure costs you money, users, or trust. This list is usually shorter than people expect. Five to ten flows for most early-stage products. That's your actual test suite's job in the first few months, not "100% coverage." Unit tests for logic, not for plumbing Unit tests are for things with actual decision-making in them - pricing calculations, validation rules, state transitions, anything where "given this input, is the output correct" is a real question with a wrong answer possible. They're fast, they're cheap, and they should make up the bulk of your suite. Skip unit-testing pure plumbing: a function that just calls another function and returns its result doesn't need its own test. That's the kind of test that pads a coverage number without catching anything real, and it's exactly the kind of test that made that 400-test suite so hard to trust.

If you're testing an iOS build with real devices, you've got two main paths: Apple's TestFlight, or Expo's EAS Preview using Ad-Hoc provisioning. They solve the same problem — getting a build onto a real iPhone without the App Store — but the workflows are genuinely different, not just cosmetically. How each one works TestFlight uses Apple's official infrastructure. You upload your build to App Store Connect (often via npx testflight to speed this up), Apple processes/reviews it, and testers install the TestFlight app and accept an email or public link invite. No UDID collection needed — Apple handles device registration behind the scenes. Expo EAS Preview (Ad-Hoc) uses Ad-Hoc provisioning. You register each tester's device UDID against your Apple Developer account before building — either manually (eas device:create, eas device:list) or by having the tester scan a QR code that installs a temporary profile. Once devices are tied to your provisioning profile, you build with: bash eas build --platform ios --profile preview This generates a direct install link/QR code — no App Store account or TestFlight app required. Comparison table Feature Expo Preview / Ad-Hoc Apple TestFlight Device limit ~100 devices/device class/year (Apple Developer account tier) Up to 10,000 external testers Processing time Immediate after cloud build finishes Apple review/processing (mins to hours) UDID management Manual or profile-based registration required Not required, handled by Apple Best for Fast internal testing, client demos, strict ad-hoc distribution Larger-scale beta testing, staging before production Which one should you use? Fast internal iteration, client demos, small teams → Ad-Hoc. No waiting on Apple, instant install links. Wider beta testing before a production release → TestFlight. Built-in scale, no manual device management. Most teams I've worked with end up using both at different stages: Ad-Hoc during active development for quick feedback loops, TestFlight once the bui

Part 3 of a series building a support-ticket agent with no framework. Previous: Part 2 (tool contracts). Repo: github.com/akash-pal/agent-from-scratch Here's the ordering that trips people up: build the eval set before the agent loop exists. Not after, not alongside — before. It feels backwards. You can't run an eval against an agent that doesn't exist yet. That's exactly the point. If you write the eval set after the agent is working, you're unconsciously grading against whatever the agent already does. Cases you didn't think to write are cases your agent silently fails on forever. Writing 21 cases against a specification (the use case and tool contracts from Part 2) means you're measuring against a real target, not tuning your eval to match your own demo. The eval set: eval/cases.json 21 cases, three buckets: Bucket Count Covers Easy 12 Shipping-status lookups, simple KB questions, a cancelled-order info request, one no-KB-match case that must escalate rather than fabricate Hard 6 Refund eligibility inside/outside the 30-day window, multi-item orders where only one item is refunded, boundary cases just past the window Edge 3 Legal-threat, fraud-flag, and duplicate-ticket patterns — must auto-escalate with zero tool/LLM calls A sample case, checking both the outcome and the trajectory that produced it: { "case_id" : "hard_03" , "bucket" : "hard" , "ticket" : { "ticket_id" : "hard_03" , "subject" : "Wrong size shoes, keep the socks" , "body" : "The running shoes from order ord_1004 are the wrong size. I want a refund for just the shoes, not the socks." , "customer_id" : "cust_002" , "order_id" : "ord_1004" }, "expected_trajectory" : [ "order_lookup" , "refund_eligibility" , "issue_refund" ], "expected_outcome" : "refund_proposed" , "expected_max_steps" : 4 , "policy_checks" : [ "refund amount reflects only the shoe item (~$74), not the full order total" , "issue_refund gated behind human approval" ] } Three things being checked per case, not just "did the answer loo