标签：#ev

An agent patch can pass every unit test and still write outside the workspace, call an undeclared tool, or read an env key the task never named. Gate the blast radius first. Score the prose later. This article is a method, not a field report. It proposes a fail-closed envelope around filesystem roots, tool names, environment keys, and network hosts. Side-effect violations never freeze. Only a dual-runner disagreement on a non-envelope property may freeze, and only with a hashed evidence bundle. The conclusion in one rule Treat an agent patch as a capability change. If the run touches anything outside a declared envelope, the gate fails closed. Flakes in ranking, wording, or latency do not override that rule. Cheap generation does not make side effects cheap to reverse. A green suite that never watched /tmp , os.environ , or outbound sockets is not a verification result. It is a missing observer. What this gate is not It is not a golden-file of model text. It is not a mutation score. It is not a full-suite rerun after every hunk. It answers four questions only: Did the run write or delete outside allowed roots? Did it invoke a tool name that is not on the allowlist? Did it read an environment key that is not on the allowlist? Did it open a network host that is not on the allowlist? If any answer is yes, fail. Do not freeze. Do not retry for luck. Artifact: a locked envelope and an observer log Pin the envelope as a fixture. Hash it. Refuse to run if the hash drifts without a review note. { "envelope_id" : "agent-patch-envelope-v3" , "allowed_roots" : [ "/work/repo" , "/tmp/agent-scratch" ], "allowed_tools" : [ "read_file" , "apply_patch" , "run_tests" ], "allowed_env" : [ "CI" , "RUN_ID" , "ENVELOPE_HASH" ], "allowed_hosts" : [], "network" : "deny" } sha256sum envelope.json > envelope.json.sha256 # CI must compare this digest before the agent process starts. Label the next block as a proposed harness, not a production sandbox. User-space tracing will miss kernel-leve

Last summer I built an AI chatbot almost entirely in Claude Code. It worked. I never pushed it to GitHub. I felt that putting my name on a public repo felt like making a claim I couldn't back up. There is a particular kind of quiet that follows building something you don't feel entitled to. No matter how rewarding the project feels, somewhere behind your ribs a voice says: you didn't actually do that. If you've felt it, you already know the argument I'm about to make against. The stigma, stated fairly The criticism deserves better than a strawman, so here it is at full strength. Skill comes from struggle. When you sit with a bug for three hours, you're not just fixing the bug - you're building a mental index of how this kind of thing breaks. The frustration is the encoding mechanism. Hand the struggle to a model and you get the fix without the index. Do that a thousand times and you've shipped a thousand features while learning almost nothing, and you won't find out until the day the model is wrong and you have no idea it's wrong. There's a second, harsher version: that AI-dependent developers are pricing themselves as engineers while functioning as typists, and the industry hasn't caught up yet. I think both of these are pointing at something real. I just think they've misidentified the cause. The real failure mode Here's the honest part, and I want to say it before the defense, because a defense that skips it isn't worth much. AI absolutely can make you worse. I've watched it happen, and I've done it. The mechanism is specific: you accept output you haven't read. That's it. That's the whole failure. Not "using AI" - accepting without reading. It's seductive because it works. The code runs. Nothing punishes you. You get a small hit of progress and you move on, and the debt is invisible because the thing you failed to learn doesn't announce itself. You only meet it later, usually at 11pm, when something breaks in a layer you never looked at. A developer in that loop

Can I Afford This? 1. The Story Behind the Code ​Every developer knows the late nights, the stubborn bugs, and the quiet satisfaction of seeing a project finally come to life. For the past few weeks, my world has revolved around a single mission: building ToolVerse. ​ 2. Like many of you, I looked at the current landscape of financial tools—cluttered with intrusive trackers, forced sign-ups, and paywalls—and asked a simple question: What if we could do better? ​ 3. What if people could calculate their debt consolidation, check their ACA health insurance premiums, or map out their tax withholding scenarios instantly, securely, and completely privately right inside their browser? ​ 4. What is ToolVerse? ​ToolVerse is a collection of high-intent, lightning-fast financial decision tools designed for the US audience. It runs on a lean, efficient stack: ​ 5. Frontend & Hosting: Hosted seamlessly on GitHub Pages for blazing-fast load times and global reach. ​ ** Backend Intelligence:** Powered by Vercel server-side API execution to handle complex lookups (like ACA subsidy calculations) securely without storing user data. ​Privacy-First Architecture: No mandatory accounts, no email walls, and zero data selling. Calculations happen right where they belong—on the user's device. **​ The Reality of Solo Building** ​Building this as a solo creator hasn't been a straight line. From battling server-side routing issues to optimizing sitemaps for Google Search Console indexing, every single line of code taught me resilience. There were days when things broke, but seeing those first users land on the platform and find actual value in these tools made every sleepless night worth it. ​ 8. Let's Build Together! ​ToolVerse is growing, and its infrastructure is ready for scale. 9. I am currently looking for: ​Collaborators & Open-Source Contributors who are passionate about building useful, privacy-first web utilities. ​10. Sponsors & API Partners in the US financial and health tech space

Sometimes a simple line of JavaScript can do more work than you expect. For example, array.includes() is fine for small arrays, but using it again and again with large datasets can affect performance. Things get even more interesting when it is used inside another loop. I recently wrote about this with simple JavaScript and React examples, including when using Set or Map can be a better choice. 👉 Read the full article: https://nirmitkotadiya.dev/dsa/big-o-javascript-array-includes You don't need to optimize everything. The important part is knowing where a small change in your data structure can make your code much more efficient.

Hello, I'm Maneshwar, and I'm building LiveReview — a blast-radius aware AI code review built for...

git reset --hard HEAD~3 — run in the wrong repository window, at 6:40pm, immediately followed by the specific kind of silence that happens when you realize what you just did before your brain finishes processing it. Three commits of uncommitted-adjacent work, gone from the working tree in under a second. The first, most important fact: it's very likely still there git reset --hard moves the branch pointer and resets the working tree, but Git doesn't actually delete commit objects just because nothing points at them anymore — they sit in the object database, unreferenced, until garbage collection eventually cleans them up, which for most repos happens rarely enough that "eventually" can mean weeks. git reflog a1b2c3d HEAD@{0}: reset: moving to HEAD~3 e4f5g6h HEAD@{1}: commit: add retry logic to payment webhook 7h8i9j0 HEAD@{2}: commit: fix currency rounding k1l2m3n HEAD@{3}: commit: initial webhook handler The reflog is a local log of everywhere HEAD has pointed recently, and it survives a reset because a reset is just another entry in it, not an erasure of the ones before it. git reset --hard e4f5g6h Working tree restored to exactly the state before the reset, all three commits back, in the time it takes to read this sentence. When the reflog isn't enough If the commits were never made at all — you ran reset --hard on genuinely uncommitted changes — the reflog can't help, because it only tracks where HEAD and branches have pointed, not file contents that were never committed. That's a real loss, and the only real defense against it is committing early and often, including throwaway "wip" commits you intend to squash later, specifically because an uncommitted change has no recovery path at all. If the commits were committed and the reflog entry has expired — Git's default is to keep unreachable reflog entries for 90 days, reachable ones for longer — git fsck --unreachable can sometimes still find dangling commit objects directly: git fsck --unreachable --no-reflog |

devpub v0.3 adds image uploads via `devpub upload`. The catch: the Forem API has no image endpoint. Here's how we solved it, and the story of devpub's first external contributor.

I sat in on Margaret-Anne Storey's DORA community session last week, and she put a name on the thing I'd been circling since April. It isn't technical debt. Her ACM Queue piece splits software health into three debts. Technical debt is the familiar one: implementation choices that make tomorrow's change harder. Intent debt is the missing rationale, the goals and constraints that say what a system is even for, which now has to be legible to agents and not just to people. Cognitive debt is the one that stopped me. It's the erosion of shared understanding, the state where nobody on the team can confidently explain how the system works or predict what a change will break. Read that again if you review pull requests for a living. I closed a thirteen-post retrospective last month admitting I couldn't answer one question: how many AI-generated pull requests a week can a review process absorb before it stops working as a control? I still don't have that number. What I have now is a name for what you accumulate while you don't have it, and a way to find yours. Approval velocity measures motion Every metric most teams watch gets better as review collapses. Merge rate climbs. Time-to-approve drops. The throughput chart looks terrific right up until the incident review, because a reviewer who has quietly become a rubber stamp is indistinguishable from a fast reviewer in every dashboard you own today. Cognitive debt doesn't announce itself as a red number. It shows up as green ones, arriving faster. I know this failure mode from the inside. Two months of green CI on conformance checks that had never once passed , on my own project. A human audit caught it. No metric I was watching came close. What you need to measure is detection. Almost nobody does. Mutation testing, pointed at the reviewers We solved this once already, for test suites. Mutation testing injects known bugs into code and checks whether the tests catch them. A suite that passes everything might be thorough or migh

Most browsers render an HTML <hr> as a horizontal rule, but the default styling is not always what you want in a real interface. A common first attempt is to change height or color and move on. That can leave the browser's default border in place, which is why a divider may look thicker, doubled, or different from the design you expected. Here is a small, reusable pattern that makes the result predictable. Start with a stable divider class Add this HTML wherever a thematic break between sections makes sense: <hr class= "section-divider" > Then add this CSS: hr .section-divider { border : 0 ; border-top : 2px dashed #ca8a04 ; width : 60% ; max-width : 42rem ; margin : 2rem auto ; } This creates a centered, dashed divider that stays readable on both narrow and wide layouts. Why this pattern works There are four important choices in that snippet: border: 0 removes the browser's default border before you add your own style. border-top gives you one visible line to control. width and max-width keep the divider from becoming excessively long. margin: 2rem auto adds vertical breathing room and centers the element. The hr element is also semantic. It represents a thematic break in content, such as a shift from one topic to another. That makes it a better choice than a random empty div when the line actually separates ideas. Three useful variations Once the base pattern is in place, changing the appearance is straightforward. A quiet solid divider Use this when the line should support the layout without attracting attention: hr .section-divider { border : 0 ; border-top : 1px solid #cbd5e1 ; width : 100% ; margin : 1.5rem 0 ; } A dotted divider A dotted rule works well for lightweight notes, forms, or playful interfaces: hr .section-divider { border : 0 ; border-top : 2px dotted #94a3b8 ; width : 50% ; margin : 2rem auto ; } A stronger double divider For an editorial section break, use a double border with enough thickness for the two lines to remain visible: hr .section-div

A recorded expected value is a leak. An agent that can read assert f(x) == y can patch f until that line is green and leave every unlisted input broken. A metamorphic relation does not publish y . It only publishes a constraint the output must keep under a known transform. That is the gate worth automating. Fixtures still matter, but only as seeds. Flaky tests still need a freeze, but the freeze must not cover the relation itself. This article is a proposed layout, not a production case study. No runtime metrics are claimed. The commands and modules below are labeled so they can be copied into a scratch repo and executed against your own function under test. Why snapshots fail as a merge gate Golden files encode one transcript. An agent patch is a search over many transcripts. If the search can see the answer key, the cheapest passing program is a lookup table for the keys in tree. That program is green. It is also wrong on the next customer file. Property-style checks reduce that leak because they do not ship the answer. They still need a seed corpus, a replay runner that the patch cannot edit, and a quarantine file that expires. Mix those three and you get a gate that fails closed when the agent rewrites tests, when a fixture drifts, or when a flake is used to hide a broken invariant. Three relation classes worth encoding first Start with relations you can state in one line. If you cannot state the line, you do not have a gate. You have a recorder. Idempotence. f(f(x)) == f(x) for normalizers, formatters, and canonicalizers. Round-trip. parse(serialize(x)) equals x on the fields you actually guarantee, not on whitespace you do not. Oracle-free comparison. f(t(x)) relates to t(f(x)) for a transform t you control: shuffle independent rows, rename equivalent keys, NFC vs NFD unicode, scale a quantity and its unit together. These are not universal laws. They are hypotheses about your function. Write them down as code. Keep the seed inputs boring. The relation, not the

À propos de cette série. Cette série raconte la construction progressive, en Haskell, d’outils consacrés à l’étude et à la transformation des formats binaires employés par les jeux FromSoftware sur PlayStation 3. Elle prend pour premier corpus la version PlayStation 3 originale de Demon’s Souls et avance par enquêtes reproductibles : observer une structure, établir ce qui est documenté, distinguer les faits des hypothèses, puis implémenter la plus petite capacité nécessaire à l’étape suivante. Dans ce premier article, nous allons déterminer ce qu’un fichier nommé image.iso permet réellement d’affirmer. Nous commencerons par observer ses métadonnées au moyen de lectures précisément bornées, avant de reproduire cette reconnaissance dans un prototype direct écrit en Haskell. Le nom image.iso constitue une hypothèse, non une preuve de format. Une extension est une convention du système de fichiers hôte ; elle ne garantit pas le contenu du fichier. Nous allons donc rechercher une structure définie par ISO 9660, lire plusieurs champs précis, puis reconnaître deux informations supplémentaires : un marqueur Joliet et un enregistrement propre aux disques PlayStation 3. Notre périmètre restera strictement en lecture seule. Nous ne monterons pas l’image, ne parcourrons aucun répertoire, n’extrairons rien, ne déchiffrerons rien et n’écrirons aucun octet. À la fin, notre prototype affichera seulement : ps3.product-id=BLES-00932 iso9660.volume-id=PS3VOLUME iso9660.logical-block-size=2048 joliet.level=1 Ces quatre lignes sont un résultat de reconnaissance borné, non un certificat de conformité de l’image entière. De la position logique à l’offset Un fichier binaire est une suite d’octets. Nous appelons offset la position, comptée depuis zéro, d’un octet dans cette suite. ISO 9660 organise les informations qui nous intéressent en secteurs logiques de 2 048 octets. Une LBA ( Logical Block Address , adresse logique de bloc) est le numéro d’un tel secteur : le secteur de LBA 0 commenc

Many organizations still need a service desk that runs on their own infrastructure. They may have strict data-protection requirements, existing directory services, internal workflows, or simply want to remain in control of their system and data. That is why we created Qisutu : a fully open-source, self-hosted service desk for ticketing, IT service management, and process automation. Qisutu 1.0.3 is the current stable release and is ready for production use. What Qisutu provides Qisutu combines the core components needed to operate a professional service desk: Agent and customer portals Ticket creation through the web interface and email Queue-based ticket processing Automation and configurable workflows Knowledge base and multilingual FAQ articles Configurable CMDB Reports and statistics REST API Custom customer and public web forms Time tracking with billable and non-billable entries CSV imports for customers, contacts, and agents Two-factor authentication using TOTP LDAP and Active Directory integration Microsoft 365 and Google Workspace email integration using OAuth2 A module manager and a versioned API for add-ons The system currently includes eleven complete interface languages: German English French Italian Brazilian Portuguese European Portuguese Spanish Dutch Polish Czech Turkish Built for self-hosting Qisutu runs entirely on infrastructure controlled by the organization using it. Ticket data, customer information, attachments, credentials, and configuration remain on the operator's own server. The software is based on: Perl and CGI MariaDB or MySQL Template Toolkit Apache A browser-based user interface The installation script prepares the required packages, Perl modules, Apache configuration, systemd services, database configuration, and web installer. Multiple Qisutu instances can run independently on the same server. This makes it possible to maintain separate production and test environments without mixing their databases, services, or configuration. Ema

🎮 ADAM-PS5 — A PS5 Emulator in Development I’m working on an ambitious project called ADAM-PS5 , with the ultimate goal of developing a PlayStation 5 emulator for PC capable of running PS5 games . The project is still in the early stages of development , and I do not consider it a complete emulator at this point. I’m building the foundation step by step: system architecture, low-level emulation, memory and resource management, graphics, input handling, execution, debugging, and development tools. 🚧 Early Development There is still a huge amount of work ahead before reaching the point where commercial PS5 games can actually run. That’s why I’m sharing the project from its early stages rather than presenting it as a finished product. 🤖 One of the project’s goals is also to integrate Artificial Intelligence to help analyze errors, monitor performance, understand system logs, and assist with the development process. The long-term goal is: PC → ADAM-PS5 → PS5 Software Environment → Games Reaching that stage requires implementing and accurately simulating many different components of the console’s hardware and software architecture. I’m sharing the project now because I want to document the entire development journey from the beginning — including what gets built, what fails, what gets improved, and how the project evolves with each release. 🔥 ADAM-PS5 is not finished. It is being built. And the ultimate goal is simple: Run PlayStation 5 games on PC through our own emulator. ADAM-PS5 is an independent development project and is not affiliated with Sony Interactive Entertainment.

Uber launches first robotaxis in London (with human supervisors).

Amazon just hiked prices on Kindles, Echo speakers, Eero routers, and Fire TV devices ahead of the holiday shopping season.

The Comfort Zone Trap Most developers hit a point where they know enough to be productive, and then... stop growing. You can build features, fix bugs, ship code — and still be standing still. The comfort zone doesn't feel like stagnation. It feels like competence. This is one of the sneakiest traps in a dev career. Early on, growth is forced on you — every new project throws unfamiliar problems your way, and you have no choice but to learn. But once you've built a solid mental toolkit (a stack you're comfortable in, a set of patterns that "just work"), it becomes very easy to keep reaching for the same tools on every new problem. You're productive. You're shipping. And you're not actually getting better. The danger is that this plateau is invisible from the inside. Nobody sends you a notification saying "you've stopped growing." You just keep doing what you know, at the same level, for years — until you compare yourself to someone who deliberately kept pushing, and the gap feels much bigger than it should. Why "Just Keep Coding" Doesn't Work The common advice is to just build more projects. But volume without friction doesn't teach you much — repeating the same patterns on new ideas just reinforces what you already know. Growth comes from deliberately picking problems slightly outside your current skill ceiling, not from doing more of what's comfortable. Think about it like weightlifting. If you lift the same weight every session, you get very good at lifting that exact weight — and nothing more. Progressive overload works because you're constantly pushing slightly past your current limit. Coding is the same. If every project you build uses the same stack, the same architecture patterns, and the same problem shapes, you're doing bicep curls with the same 10kg dumbbell for five years straight. The fix isn't "build more" — it's "build harder." Pick a project that forces you to learn a new paradigm (functional if you're used to OOP, distributed systems if you've only b

TL;DR It's been a while since I've done a collection (maybe month ago), but today let's look at 12 new and not-so-new projects that can really help you in development. They touch on different areas of development, but we will mainly talk about web development. If there's a project worth adding to the next collection, feel free to write about it in the comments, and maybe it will be included. 1. 🤖 OpenWork - The open source Claude Cowork alternative. And we will continue, of course, with AI projects. This tool will allow you to work in one convenient interface with many popular LLMs. OpenWork is the desktop app that lets you use 50+ LLMs. 💎 Check out the OpenWork repository ☆ 2. 💻 T3 Code - The open-source control plane for coding agents. If you know a YouTuber like Theo, then you should know this project. It's an OpenCode alternative that lets you work with AI in an easy-to-use chat interface. It enables control of the agents on your machine with a best-in-class mobile app (iOS, Android), web app and Electron-based desktop app. 💎 Check out the T3 Code repository ☆ 3. ⚙️ Summarize - Point at any URL or file. Get the gist. The first project is a small tool for extracting short info of content. Summarize was created by one of the creators of the well-known OpenClaw. Fast summaries from URLs, files, and media. 💎 Check out the Summarize repository ☆ 4. 👾 Godot - Free and open source 2D and 3D game engine A truly legendary engine like Unity or Unreal Engine for games. If you are a game developer, you should know this project. From pet projects for the university to multi-million dollar games - it gives it all. Godot Engine is a feature-packed, cross-platform game engine to create 2D and 3D games from a unified interface. It provides a comprehensive set of common tools, so that users can focus on making games without having to reinvent the wheel. 💎 Check out the Godot repository ☆ 5. 💎 React Bits - An open source collection of animated, interactive & fully customizable Rea

An agent patch is only as trustworthy as the checks it cannot rewrite. If properties, fixtures, and flake policy live in the same tree as src/ , the diff can weaken the proof. Move the oracle out of the writable tree and run it as a control loop with hysteresis, not as a skip list. Co-located tests fail this requirement in a predictable way. The agent adds an assertion that matches the new code. A fixture grows a default that hides a broken parser. A flaky case becomes skip . The suite stays green. Production still drifts. This article proposes a sidecar oracle: human-owned properties, sealed fixtures, and a two-threshold flake freeze. The design is a workflow, not a production case study. Treat the code as a proposed runner you can execute locally, not as a claim about a live fleet. What the loop decides The loop answers three questions on every candidate patch: Do independent properties still hold on generated inputs? Did the patch mutate a sealed fixture or depend on an unsealed one? Is a failing test a regression, or does it belong in a measured freeze? A skip list answers none of those. It only records that someone got tired of a red job. Layout: oracle beside the repo, not inside the diff Keep the application repo writable for the agent. Keep the oracle in a second directory that the agent cannot include in its patch. app/ # agent may write src/, not oracle paths src/ pyproject.toml oracle/ # human-owned; hashed before every gate properties/ test_invariants.py fixtures/ manifest.json http_empty_body.json flake_ledger.json path_deny.txt run_gate.py path_deny.txt is the first control, not the last. If the patch touches oracle files, tests the agent authored, or lockfiles it did not need, the gate fails before pytest starts. # oracle/path_deny.txt oracle/ **/test_*.py **/*_test.py **/conftest.py **/__snapshots__/ The deny list is deliberately blunt. Agent-authored tests can still exist as scratch. They do not count as evidence. Step 1 — Hash the oracle before the

Every developer I know now runs an AI coding agent in something like auto-accept mode. Claude Code, Codex, Cursor: you give it a task, it runs commands, edits files, installs packages, and you review... the diff, maybe. The commands? The installs? The thing it did in that folder outside the repo? Nobody looks. The activity scrolls off the terminal and is gone. That asymmetry bothered me. We built an entire industry around audit trails for humans (git blame, CI logs, access logs), then handed the keyboard to agents and kept none for them. So I built Tracon: a local flight recorder for AI coding agents. The name is the FAA's term for Terminal Radar Approach Control, the radar room that tracks every aircraft in an airspace. This one tracks every agent on your machine. What it does Tracon is a Mac and Windows desktop app (Tauri 2, Rust core, React UI, SQLite store) that sits in the tray and records what your agents do: A timeline per session: every command, file edit, package install, and prompt, attributed to the agent and session that did it Danger flags as they happen: recursive deletes, pipe to shell installs, credential access, force pushes, permission bypasses. Tracon flags; it never blocks A Live page: one monitor per active session, like a security room, streaming recent commands with flagged ones highlighted in red, plus which subagents the session has spawned A conversation reader: the actual chat behind any event, read straight from the agent's own transcript, read only A package watch across npm, pnpm, pip, cargo, and brew, with opt in threat intelligence against osv.dev Capture is deliberately passive. Hooks give real time events over localhost; transcript tailing (filesystem notify, read only) covers everything else, so CLI sessions show up live even with zero setup. A dead or closed Tracon never slows an agent down. Everything stays on your machine: no telemetry, no accounts, AGPL. The recursive part Here is the part I find genuinely funny: Tracon was lar

If you work with Java/JDBC long enough, you eventually run into this situation: You have code like this: String sql = "SELECT * FROM users WHERE id = ? AND status = ?" ; PreparedStatement pst = con . prepareStatement ( sql ); pst . setLong ( 1 , userId ); pst . setString ( 2 , status ); And then, from a log or debugger, you know something like: userId = 42 status = ACTIVE But what you actually need is the SQL you can paste into your database client: SELECT * FROM users WHERE id = 42 AND status = 'ACTIVE' ; Doing this once is trivial. Doing it repeatedly while debugging production issues is annoying. It gets worse when: the SQL is split across several Java strings; values come from map.get("KEY"); there are dates or timestamps; strings contain apostrophes; some parameters are unresolved; the method contains several PreparedStatements. I kept doing this manually, so I built a small tool called Bind2SQL. What it does Bind2SQL takes Java/JDBC code and reconstructs the executable SQL. For example: String sql = "SELECT * FROM person " + "WHERE person_id = ? " + "AND type_id = ? " + "AND created_at >= ?" ; PreparedStatement pst = con . prepareStatement ( sql ); pst . setLong ( 1 , values . get ( "PERSON_ID" )); pst . setInt ( 2 , values . get ( "TYPE_ID" )); pst . setDate ( 3 , Date . valueOf ( "2026-09-02" )); With runtime values: {PERSON_ID=12648350, TYPE_ID=29} It produces something like: SELECT * FROM person WHERE person_id = 12648350 AND type_id = 29 AND created_at >= DATE '2026-09-02' ; The important part is that unresolved parameters are not silently guessed. If Bind2SQL cannot resolve something, it leaves it clearly marked so you can review it manually. Why I made it browser-only I often use this kind of tool with real application code and runtime values. That may include: internal SQL; identifiers; production log values; table names; application-specific data. So I didn't want a server in the middle. Bind2SQL runs entirely in the browser. There is: no backend; no