studio status report: 2026-10
Month 10 of 2026:
- converting (too slowly) the Songhay Player back-end to S3 storage
- being introduced to Claude in a new day job
This month required the following Studio releases:
Selected notes of this month detail:
SQLite: “Conflict Free Replicated Data types (CRDTs)” 😐❓
Looks like a novel way to avoid or delay concurrency issues:
Conflict Free Replicated Data types (CRDTs) can be tricky. You may spend months reading papers and implementing different algorithms before they finally click and become simple. That or they'll seem simple out of the gate and you'll be missing a bunch of nuance.
…
CRDTs are needed in situations where you want multiple processes to modify the same state without coordinating their writes to that state.
Imagine a situation where you have a shared business document. Ideally you, and others, can modify your copies of that document even when internet access is down. When internet is restored, you and your peer's changes can all be merged together without conflict.
Publications: “The <time> element should actually do something”
If you’re a pedant about HTML though (like me), then you might use the
<time>element:
Post published
<time datetime="2025-12-14T19:30:00.000Z">
4 hours ago
</time>
This is great! We now have a semantic way to express the exact timestamp of a date. So browsers and screen readers should use this and give us a way to avoid those annoying manual tooltips and… oh wait, no. The
<time>element does approximately nothing.
Azure Kubernetes Service: “APIM Hotrod S2E04 - Azure Kubernetes Service with Richard Hooper”
APIM Hotrod S2E04 - Azure Kubernetes Service with Richard Hooper
The AKS Architecture Map is featured:
Tools mentioned:
Azure Kubernetes Fleet Manager
Azure Kubernetes Fleet Manager enables at-scale management of multiple supported Kubernetes clusters. Fleet Manager provides platform administrators with access to automated safe multi-cluster updates, intelligent Kubernetes resource placement, and a centralized location to access monitoring data for their clusters.
Headlamp
Headlamp is an easy-to-use and extensible Kubernetes web UI.
Headlamp was created to blend the traditional feature set of other web UIs/dashboards (i.e., to list and view resources) with added functionality.
Inspektor Gadget
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. It manages the packaging, deployment and execution of Gadgets (eBPF programs encapsulated in OCI images) and provides mechanisms to customize and extend Gadget functionality.
Note: Major new functionality was released in v0.31.0. Please read the blog post for a detailed overview.
AKS Automatic
Automatic is a new experience for Azure Kubernetes Service (AKS) that lets you create and manage production-ready clusters with minimal effort and added confidence. This means you can focus on developing and running your applications, while AKS handles the rest for you.
AKS: “AKS on bare metal now on Ubuntu”
Today, we are announcing the public preview of AKS on bare metal Ubuntu. Customers can now deploy AKS directly on their Ubuntu infrastructure, without installing or operating a hypervisor between Kubernetes and the underlying hardware.
This release extends the AKS experience to organizations that need Kubernetes close to their applications, devices, and data. It is designed for environments such as retail locations, factories, branch sites, telecommunications infrastructure, and on-premises AI systems, where performance, latency, hardware access, or data residency are critical.
Songhay Data Access (C♯): why is CommonDbms a sealed class?
CommonDbms contains members like GetSql and SetSql that are just waiting to be inherited by a domain-specific subclass but the sealed specifier prevents this:
I am not seeing Joplin notes for this; I am not seeing CommonDbms mentioned in the issues. So, today, I propose the following:
- [x] define
SqlStatementCollection: Dictionary<string, string>🚜✨ - [x] migrate
GetSqlandSetSqltoSqlStatementCollection🔨 - [x] migrate
GetProviderNotSupportedException()to an extension method 🚜✨
New issue: https://github.com/BryanWilhite/Songhay.DataAccess/issues/16
Let’s Encrypt: “Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027”
Let’s Encrypt is continuing a push toward tighter security by reducing free SSL/TLS certificate lifetimes from 90 days to 64 days, starting February 10, 2027. For administrators already implementing modern ACME clients that support ARI (ACME Renewal Information), the change should be seamless. For those still relying on hardcoded renewal schedules or manual processes, February will be the deadline to update before certificates start expiring unexpectedly.
—“Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027”
RBAC is Linux 😐😲
- RBAC, abbreviated from Role-Based Access Control was released in December 22, 2000; as part of SELinux project which is an abbreviation of Security-Enhanced Linux that is a security architecture for Linux® systems that allows administrators to have more control over who can access the system. ==It was originally developed by the United States National Security Agency (NSA) as a series of patches to the Linux kernel using Linux Security Modules (LSM).== In Kubernetes RBAC is a term that is used to determine the control model of organization operators and applications. Of course there is other control models such as ABAC and PBAC which are not delegated into Kubernetes ecosystem.
Microsoft: “Microsoft eXecution Container (MXC)”
MXC is a sandboxed code execution system for running untrusted code (model output, plugins, and tools) on Windows, Linux, and macOS. It provides multiple containment backends, from OS-native process sandboxes to full VMs, behind a unified containment model and typed SDKs.
Firefox: “Fingerprints are the new cookies”
See, we’ve made a lot of civilizational progress in making browsing safe. Long gone are the days when getting a virus just by visiting a website was a daily concern. The thing is, the definition of safety varies depending on who you ask. The broad consensus ends at isolation: a website’s code can’t see the data stored by other websites, and it can’t see your files or other applications without permission. Chrome and Edge stop here. Then you have Safari (especially on iOS/macOS 26+) and Firefox extending that definition to privacy, ==but they still don’t fully protect you from fingerprinting==. Brave and Tor are the leading privacy-first browsers, with up and coming Mullvad Browser (Mullvad being, in my opinion, one of the best VPN providers out there).
.NET: “How I Tamed Claude - Emmz Rendle - NDC Copenhagen 2026”
The speaker is spending $200/month on Claude “max”:
How I Tamed Claude - Emmz Rendle - NDC Copenhagen 2026
- spec before code
- separation of powers (no actor writes and approves its own work)
- objective definition of done
- the agent stops and asks instead of guessing (burning tokens doing the wrong work)
- curated context (keeping the model accurate and cheap)
OpenSpec is a lightweight and configurable framework for creating and managing software specifications.
With OpenSpec, you capture what you want to build in a spec and keep your team and coding agents aligned as the work evolves. We help you refine the requirements, validate that they describe the right thing, and verify that the implementation matches.
In essence, OpenSpec helps you build the right thing and build it right.
.NET: Common Vulnerabilities and Exposures (CVE)
CVE is an industry-wide acronym:
The mission of the CVE™ Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. There is one CVE Record for each vulnerability in the catalog. The vulnerabilities are discovered then assigned and published by organizations from around the world that have partnered with the CVE Program. Partners publish CVE Records to communicate consistent descriptions of vulnerabilities. Information technology and cybersecurity professionals use CVE Records to ensure they are discussing the same issue, and to coordinate their efforts to prioritize and address the vulnerabilities.
CVE Lightning Talk
dapr: the official docs and the official examples run workflows as console applications…
…which implies that there is no great concern or great story to tell about workflows operate across multiple containers. This explains, in part, why Google AI answered my previous question without any references at all.
What is quite disturbing is that, as of today, the official docs actually show a code block for ASP.NET:
But none of the dapr workflow code samples use ASP.NET 😐 Moreover, the official workflow walk-through is based on “a simple console application” 🤦 (also, see “Using the Dapr Workflow API with C#”)
Ubuntu will support Microsoft Entra ID going forward 😲
Microsoft single sign-on (SSO) for Linux is powered by the Microsoft Identity Broker, a software component that integrates Linux devices with Microsoft Entra ID. This solution enables users to authenticate once with their Microsoft Entra ID credentials and access multiple applications and resources without repeated authentication prompts. The feature simplifies the sign-in process for users and reduces password management overhead for administrators.
getting to know Claude #day-job
- I think Claude can contextualize from a central “workspace” repo and then run for each “code” repo with its individual
Claude.mdfile. (Update: I am working with a mono-repo and Claude is being used to setup child repos for dozens and dozens of solutions) - When encountering a repo cloned for the first time with an existing
Claude.mdfile, runningclaude initis not recommended; instead, consider running/doctor prompt-auditor just/doctorto get a status report of the quality of theClaude.mdfile and the understood context. - When changing terminals on the same desktop or restarting the desktop, use
claude -corclaude --continueto keep the current context. - When installing local plugins while a session is open, run
/reload-pluginsto refresh.
[!important] Claude can be asked about the repo in context as an on-boarding experience for a new developer. This is huge! This eclipses my desire to use automated testing to ‘self document’ a repo 😐
dapr Workflow integration testing means using Testcontainers for .NET 😐🔬
Integration testing requires Dapr.Testcontainers which depends on Testcontainers for .NET (see “Integration testing with Dapr.Testcontainers”); otherwise, research will lead you into somewhat useless mocking scenarios.
open pull requests on GitHub 🐙🐈
sketching out development projects
- use a Jupyter Notebook to track finding and changing Amazon links to open source links in the kinté space repo 📓⚙
- use a Jupyter Notebook to convert flickr links to Publications (responsive image) links in the kinté space repo 📓⚙
- convert Songhay Day Path Blog repo to the relevant conventions shown in the diagram above 🔨🚜
- start development of Songhay Publications Index (F♯) experience for WebAssembly 🍱✨
- start development of Songhay Publications - Data Editor to establish a GUI for
*Shelland provide visualizations and interactions for Publications data 🍱✨