{"title":"Andre Lustosa writing","id":"https:\/\/alustos.us\/","link":[{"@attributes":{"href":"https:\/\/alustos.us\/feeds\/all.atom.xml","rel":"self","type":"application\/atom+xml"}},{"@attributes":{"href":"https:\/\/alustos.us\/"}}],"updated":"2026-09-27T00:00:00.000Z","author":{"name":"Andre Lustosa"},"entry":[{"title":"tongs 1.0: Every Forge, One Place","id":"https:\/\/alustos.us\/blog\/2026\/tongs-1-0.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/tongs-1-0.html"}},"updated":"2026-09-27T00:00:00.000Z","published":"2026-09-27T00:00:00.000Z","summary":"tongs reached 1.0 with split diffs, crash-safe review drafts, an MCP server, a desktop beta, signed releases, a trailer, and a new home at tongs.tools.","category":[{"@attributes":{"term":"python"}},{"@attributes":{"term":"tui"}},{"@attributes":{"term":"github"}},{"@attributes":{"term":"gitlab"}},{"@attributes":{"term":"code-review"}},{"@attributes":{"term":"mcp"}}]},{"title":"When Code Is Cheap, Review the Claims","id":"https:\/\/alustos.us\/blog\/2026\/review-the-claims-not-the-prose.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/review-the-claims-not-the-prose.html"}},"updated":"2026-09-26T00:00:00.000Z","published":"2026-09-26T00:00:00.000Z","summary":"Agents made code and the claims about it cheap to produce. Review has to move from reading prose to checking evidence that could have failed.","category":[{"@attributes":{"term":"agents"}},{"@attributes":{"term":"code-review"}},{"@attributes":{"term":"testing"}},{"@attributes":{"term":"quality"}}]},{"title":"AI Agents in CI\/CD: Security, Robustness, and Productivity","id":"https:\/\/alustos.us\/blog\/2026\/ai-agents-in-ci-cd.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/ai-agents-in-ci-cd.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"A graduate-level study of agentic CI\/CD: authority and prompt injection, bounded verification, distributed recovery, test oracles, and causal measurement of productivity.","category":[{"@attributes":{"term":"agents"}},{"@attributes":{"term":"ci"}},{"@attributes":{"term":"security"}},{"@attributes":{"term":"reliability"}},{"@attributes":{"term":"measurement"}}]},{"title":"Build Pipelines Should Explain Their Decisions","id":"https:\/\/alustos.us\/blog\/2026\/build-pipelines-produce-evidence.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/build-pipelines-produce-evidence.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"A pipeline becomes more useful when each stage records the evidence behind release, rejection, and later maintenance decisions.","category":[{"@attributes":{"term":"ci"}},{"@attributes":{"term":"build-systems"}},{"@attributes":{"term":"observability"}},{"@attributes":{"term":"reliability"}},{"@attributes":{"term":"automation"}}]},{"title":"Bounded Autonomy Requires Separate Control Planes","id":"https:\/\/alustos.us\/blog\/2026\/designing-agentic-ci-bounded-autonomy.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/designing-agentic-ci-bounded-autonomy.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"Agentic automation remains governable when model choice, execution, policy, and evidence are separate interfaces with independent owners and tests.","category":[{"@attributes":{"term":"agents"}},{"@attributes":{"term":"ci"}},{"@attributes":{"term":"security"}},{"@attributes":{"term":"architecture"}},{"@attributes":{"term":"automation"}}]},{"title":"Hermetic Builds Begin at the Acquisition Boundary","id":"https:\/\/alustos.us\/blog\/2026\/hermetic-builds-trust-boundary.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/hermetic-builds-trust-boundary.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"A build becomes explainable when every network-dependent input is acquired explicitly, recorded, and separated from the steps that construct the artifact.","category":[{"@attributes":{"term":"build-systems"}},{"@attributes":{"term":"hermeticity"}},{"@attributes":{"term":"containers"}},{"@attributes":{"term":"supply-chain"}},{"@attributes":{"term":"openshell"}}]},{"title":"A Linux Updater Is a Deployment Transaction","id":"https:\/\/alustos.us\/blog\/2026\/linux-updater-preserve-last-working-install.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/linux-updater-preserve-last-working-install.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"Safe self-updates preserve a compatible installed set through staging, validation, privileged activation, startup checks, and recovery.","category":[{"@attributes":{"term":"linux"}},{"@attributes":{"term":"deployment"}},{"@attributes":{"term":"desktop"}},{"@attributes":{"term":"reliability"}},{"@attributes":{"term":"open-source"}}]},{"title":"Serving llama.cpp Across My Home Network and Tailscale","id":"https:\/\/alustos.us\/blog\/2026\/llama-cpp-home-network-tailscale.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/llama-cpp-home-network-tailscale.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"Building llama.cpp on Fedora with Vulkan, then sharing a 27B model with friends and other machines across my home network and Tailscale.","category":[{"@attributes":{"term":"llama.cpp"}},{"@attributes":{"term":"local-llm"}},{"@attributes":{"term":"tailscale"}},{"@attributes":{"term":"inference"}},{"@attributes":{"term":"self-hosting"}}]},{"title":"When Repeated Release Work Deserves a Shared Stream","id":"https:\/\/alustos.us\/blog\/2026\/maintenance-pressure-release-stream-redesign.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/maintenance-pressure-release-stream-redesign.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"A worked release example shows how to separate shared build policy from product decisions, preserve immutable identity, and decide whether the added platform is worth owning.","category":[{"@attributes":{"term":"releases"}},{"@attributes":{"term":"maintenance"}},{"@attributes":{"term":"architecture"}},{"@attributes":{"term":"automation"}},{"@attributes":{"term":"platform-engineering"}}]},{"title":"The Case for Publishing a Useful Package Early","id":"https:\/\/alustos.us\/blog\/2026\/publishing-a-useful-package-early.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/publishing-a-useful-package-early.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"PyPI names are scarce, pending publishers do not reserve them, and active conflicts are hard to unwind. A small working release can be the responsible first public commitment.","category":[{"@attributes":{"term":"python"}},{"@attributes":{"term":"pypi"}},{"@attributes":{"term":"packaging"}},{"@attributes":{"term":"open-source"}},{"@attributes":{"term":"releases"}}]},{"title":"How to Trace an Agent That Can Crash or Be Killed","id":"https:\/\/alustos.us\/blog\/2026\/reconstructing-agent-traces.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/reconstructing-agent-traces.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"The supervisor must own trace identity, timeouts, and final status because the agent may never get a chance to report how it stopped.","category":[{"@attributes":{"term":"observability"}},{"@attributes":{"term":"opentelemetry"}},{"@attributes":{"term":"agents"}},{"@attributes":{"term":"reliability"}}]},{"title":"A Release Has Three Trust Decisions","id":"https:\/\/alustos.us\/blog\/2026\/release-identity-publishing-integrity.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/release-identity-publishing-integrity.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"Version identity, permission to publish, and artifact integrity answer different questions. A release pipeline is trustworthy only when it connects all three.","category":[{"@attributes":{"term":"releases"}},{"@attributes":{"term":"python"}},{"@attributes":{"term":"oidc"}},{"@attributes":{"term":"attestations"}},{"@attributes":{"term":"supply-chain"}}]},{"title":"Testing the Package Beyond the Source Tree","id":"https:\/\/alustos.us\/blog\/2026\/source-trees-are-not-packages.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/source-trees-are-not-packages.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"Several upstream fixes point to one packaging rule: exercise built artifacts, disabled paths, and dependency boundaries directly.","category":[{"@attributes":{"term":"python"}},{"@attributes":{"term":"packaging"}},{"@attributes":{"term":"build-systems"}},{"@attributes":{"term":"open-source"}}]},{"title":"One Review Inbox for Two Forges","id":"https:\/\/alustos.us\/blog\/2026\/tongs-one-review-inbox.html","link":{"@attributes":{"href":"https:\/\/alustos.us\/blog\/2026\/tongs-one-review-inbox.html"}},"updated":"2026-09-06T00:00:00.000Z","published":"2026-09-06T00:00:00.000Z","summary":"tongs treats code review as one terminal workflow across GitHub and GitLab, then designs each layer around the differences that remain.","category":[{"@attributes":{"term":"python"}},{"@attributes":{"term":"tui"}},{"@attributes":{"term":"github"}},{"@attributes":{"term":"gitlab"}},{"@attributes":{"term":"code-review"}}]}]}