
Theo Morgan
Web platforms and browser engineering
Theo covers browsers and the web platform. His reporting connects new capabilities to compatibility, accessibility, progressive enhancement, and practical testing.
Engineering guides
- Change an Event Schema Without Stopping the Stream
Treat compatibility as a deployment and replay timeline that includes old consumers, retained records, and semantic changes.
- Salesforce External Identity alternatives for portals becoming standalone products
Compare keeping Salesforce Customer Identity, federating a separate identity provider, or moving account lifecycle to Ory Network while preserving Salesforce record access.
- Support impersonation that preserves accountability
Design short-lived support access that keeps operator and customer identities separate, denies sensitive actions, supports revocation, and leaves useful audit trails.
- Should the person paying for a SaaS subscription automatically own the organization?
Payment should not automatically grant organization ownership. Separate billing, contract, and product authority with explicit permissions and least-privilege access.
- How can we rebuild a search index from a live database without missing writes or indexing impossible intermediate states?
Use one coordinated database snapshot plus its matching change stream, enforce per-document write order, checkpoint only durable writes, and cut over only after validation.
- How do I prevent an invoice author from approving their own invoice?
Model approval as two checks: the actor must be an approver, and the actor must not be the author of the invoice revision being approved.
- How should we define and operate correctness for event-time windows when late data keeps arriving?
A practical framework for defining event-time window correctness under late arrivals, setting watermarks and lateness, and designing consumers for revisions.
- Make Time, Randomness, and IDs Explicit Test Dependencies
Test clocks, random values, UUIDs, retries, and timers through narrow injected interfaces instead of fragile global mocks.
- How do we detect software license obligation changes between releases?
Compare release SBOMs with a reviewed license inventory to flag dependency, license, and completeness changes before legal review turns into a spreadsheet chase.
- Alternatives to copying monolith login code into every new service
As a monolith splits, should login remain in the old application, become an internal service, or move to managed identity? Compare bounded architecture and migration choices.
- API Contracts for Work That Outlives the Request
Represent long-running work as a durable resource with stable identity, lifecycle states, cancellation, retries, retention, and results.
- When should a warehouse precompute a surrogate partition key instead of relying on function-wrapped predicates?
Evaluate surrogate partition keys when date transformations and time-zone expressions prevent predictable pruning across SQL and BI workloads.
- Where should newline, BOM, and Unicode normalization happen in a file ingestion pipeline?
Set one ingestion boundary for decoding, BOM policy, and newline handling, then apply Unicode normalization only where field semantics require it.
- Should we squash commits if we rely on git bisect to find regressions?
Preserve individually runnable commits for finer git bisect results; squash when the pull request is your smallest tested unit.
- Why an ID Token Is Not an API Access Token
No: an ID token tells the client about the user’s authentication, while an API should accept only an access token intended for that API.
- When a customer duplicates an automation, should its credentials and permissions be copied?
Recommended clone semantics for automations: copy logic, require explicit rebinding of credentials and grants, and treat connection reuse as a separate authorization step.
- ZITADEL alternatives for customers who belong to several organizations
Choose an identity model for users who work across several customer organizations by separating account ownership, membership, and resource authorization.
- How do we build a task-coverage map that keeps technical documentation navigation honest?
Model documentation around canonical user tasks, then use that map to drive navigation, ownership, and release maintenance.
- Why does a load test report good latency while users experience long stalls?
A load test can look healthy while users stall when the test uses a closed loop that slows its own arrivals during server stalls.
- Contract tests for APIs and events: protect behavior while allowing change
Test transport shape, consumer assumptions, and semantic invariants while leaving provider implementation and unused fields free to evolve.
- Alternatives to separate login stacks for self-serve users and enterprise customers
Should a product with personal accounts and enterprise contracts consolidate customer authentication? Compare ownership, migration, and shared-login criteria.
News
- Azure Firewall explicit proxy reaches GA
Selected applications and browsers can send HTTP and HTTPS egress to Azure Firewall through standard proxy settings without rerouting a whole subnet.
- Hugging Face releases a library of WebGPU kernels
Hugging Face’s new kernel library packages browser GPU building blocks with tests and benchmarks, giving local AI developers a reusable starting point.
- Google introduced Gemini 3.5 Transcribe for batch and live speech recognition
The speech-to-text family added transcription and live transcription models aimed at structured, context-aware audio processing.
- Terraform 1.16 adds module imports and machine-readable state commands
Terraform 1.16 supports import blocks inside modules, JSON output for state and workspace inspection, richer action triggers, and lifecycle destroy controls.
- GKE previews ClusterNetworkPolicy for tiered cluster-wide network rules
ClusterNetworkPolicy enters preview in GKE 1.36 and later, separating administrator rules, namespace policies, and cluster-wide baseline defaults.
- Cloudflare launches Billable Usage API for self-serve accounts
A single billing endpoint returns daily product usage and cost rows with field names aligned to much of the FinOps FOCUS specification.
- MySQL 9.7.2 fixes deletion ordering in JSON duality-view updates
MySQL 9.7.2 corrects nested-row deletion during JSON duality-view updates and date conversion behavior, making targeted regression cases valuable.
- Firefox 153 adds bulk IndexedDB reads, video PiP, and JSPI
Firefox 153 ships getAllRecords for IndexedDB, desktop video picture-in-picture, WebAssembly Promise integration, and richer WebRTC diagnostics.
- Mistral releases Search Toolkit for composable retrieval pipelines
The open-source preview joins ingestion, retrieval, and evaluation, giving teams a common place to compare search changes before altering generation.
- Deno 2.8 adds dedicated CI installation and npm package-building commands
Deno 2.8 introduces explicit commands for frozen CI installs and npm-ready package artifacts, with a runtime compatibility boundary for Deno-specific APIs.
- OpenTelemetry graduates within the CNCF
CNCF graduation recognizes OpenTelemetry’s project maturity and governance while the maintainers continue work on interoperable telemetry standards.
- Microsoft clarifies the scope of its long-horizon AI delegation study
A May clarification explains what DELEGATE-52 measures and why artifact-fidelity stress tests should not be read as general product verdicts.
- Chrome 147 ships scoped view transitions and new CSS color and border tools
Chrome 147 brings concurrent element-level view transitions, automatic black-or-white contrast selection, and shape-aware border painting.
- Meta releases TRIBE v2 for predicting brain responses
TRIBE v2 expands Meta’s research on stimulus-driven brain-response prediction, with released artifacts and a noncommercial license boundary.
- Ingress2Gateway 1.0 turns Ingress migration into a reviewable conversion
Kubernetes SIG Network released Ingress2Gateway 1.0 with broader Ingress-NGINX annotation coverage and integration-tested Gateway API output.
- Mistral releases Leanstral for repository-scale proof engineering
Leanstral targets Lean 4 work with downloadable Apache-licensed weights, shifting evaluation toward verified repository changes and proof review.
- Astro 6 adds built-in fonts, CSP, and live content collections
Astro 6 combines new content and security APIs with a refactored development pipeline designed to run the target production runtime locally.
- Gemini added source-aware creation across Docs, Sheets, Slides and Drive
Google began beta rollouts that let Gemini draft and analyze Workspace content using selected files, email and web context.
- Go explains how package authors can automate API migrations
Go's source-level inliner lets package maintainers describe migrations through wrappers, with behavior-preserving analysis for call arguments.