Tech News — 2026-09-21

Cloudflare Introduces the Agent Development Lifecycle to Replace Traditional SDLC

Cloudflare introduced the Agent Development Lifecycle (ADLC) to replace traditional SDLC, moving from human-in-the-loop CI/CD to autonomous agent factories using programmatic, event-driven platforms. Their Workflows product orchestrates dynamic container spawning and subagent dispatch, with @cloudflare/ci enabling autonomous failure handling and remediation, while preview deployments for every agent eliminate staging bottlenecks. Observability via an OpenTelemetry-compatible dashboard traces model calls and tool executions, and the Agent Access Model secures autonomous operations, with self-improving feedback loops driven by production data.

Why it matters

For a solutions architect focused on agent orchestration and cloud infrastructure, this matters because Cloudflare is proposing a fundamental shift from human-centric pipelines to fully autonomous, event-driven factories that require new observability and security models—directly impacting how you design and deploy multi-agent systems at scale.

AI/ML / infoq.com

Presentation: The Agent Harness: Control Planes, Invariants, and Approval Boundaries for Production AI Agents

OpenAI's Vinoth Govindarajan argues that production AI agents fail most dangerously from silent state corruption, not model hallucination. Using the OpenClaw case study, he advocates for explicit state ownership, serialized concurrent mutations, scoped execution authority, and validation at the user-visible edge to ensure durable memory and action consistency. These principles form an agent harness with control planes and approval boundaries that catch failures before they become invisible data holes.

Languages / infoq.com

Bun Rewrites 535K Lines of Zig into Rust in Four Months, Eliminates Numerous Memory Leaks

Bun rewrote 535K lines of Zig into Rust in four months using an AI-assisted multi-agent system with Claude Fable 5, eliminating memory leaks via Rust's borrow checker. The process used PORTING.md and LIFETIMES.tsv for mapping, adversarial reviewer agents, and 64 parallel Claude instances across 4 shards, achieving 1,300 lines per minute and passing over a million test assertions.

Cloud / infoq.com

Kubernetes 1.37 Released: Stable Metrics API and Rootless Kubelet in Beta

Kubernetes 1.37 "Garhwal" stabilizes the Metrics API for HPA/VPA autoscaling and graduates rootless kubelet (KubeletInUserNamespace) to beta, reducing container escape risks. Alpha features include workload-aware scheduling (InPlacePodVerticalScalingSchedulerPreemption) for preempting low-priority pods and pod-level checkpoint/restore for debugging. The release also enables HPA scale-to-zero by default for AI/ML GPU cost savings, makes resilient watchcache initialization GA to prevent etcd floods, and adds pod certificates for native mTLS—totaling 67 enhancements.

Cloud / dev.to

Building Bivack: A Cloud Dev Sandbox for Coding Agents on AWS Lambda MicroVMs

Bivack gives each user a dedicated AWS Lambda MicroVM (Firecracker snapshot) with a persistent home directory on S3 Files, accessible via browser terminal or full VS Code workbench—one machine per user, not per agent, so multiple agents share the same files. The VM suspends after two hours idle, stays resumable for 30 minutes, and costs nothing while suspended, enabling mobile-first coding sessions that survive device switches without context loss. Network storage (S3) is slower than local disk, but the trade-off buys instant boot, isolation, and the ability to hand tasks to agents and walk away.

Cloud / dev.to

One Iceberg MCP Server, Seven Catalogs: What It Takes to Reach Each One

An MCP server for Apache Iceberg tables connects to seven REST catalogs—Polaris, BigLake, OneLake, AWS Glue, S3 Tables, Snowflake Horizon—by swapping a single environment variable and a YAML config file. It exposes four read-only tools (list_tables, describe_table, count_rows, scan_table) over stdio JSON-RPC without an MCP SDK. The guide starts with a local Polaris catalog in Docker, then adds each managed catalog with its own login and storage package; Databricks Unity was not tested due to expired trial.

DevTools / maharship.com

MCP was always a bad idea?

MCP, released by Anthropic in November 2024 and later donated to the Linux Foundation's Agentic AI Foundation, is now obsolete as LLMs have become capable of directly calling APIs and using CLIs via --help, eliminating the need for MCP servers. The protocol's context bloat from multiple tool schemas is a persistent issue, with temporary workarounds like generic search/execute patterns from platforms like Composio and Pipedream. The author recommends deleting most MCP servers and standardizing direct HTTP API usage with agent-identifying headers, as demonstrated by Cloudflare's Code Mode.

Open Source / dev.to

Share State Across Dart Isolates Without Losing Your Mind: Enter shared_map

Dart isolates' share-nothing model forces costly serialization or brittle message-passing for shared state. Graciliano M. Passos' shared_map package offers a zero-dependency, 160/160 pub point solution using a SharedStore and .sharedReference() pattern to transparently synchronize async Map operations across isolates, eliminating manual port plumbing.

AI/ML / dev.to

Stop Whitelisting Port 22: SSH into Private EC2 from GitHub Actions via AWS SSM 🔐

AWS SSM Session Manager eliminates the need for port 22 whitelisting by having the SSM agent initiate an outbound connection, with IAM as the auth layer. The ankurk91/setup-ssh-over-ssm-action GitHub Action automates ephemeral SSH key generation via EC2 Instance Connect (60-second validity) and configures the runner's SSH config, using OIDC for short-lived AWS credentials. No secrets, no static keys, no security group rules.

AI/ML / buchodi.com

ChatGPT now knows what you do on other websites via ad collector

OpenAI's ad platform, bazaar, uses a cross-site cookie __obi (domain .openai.com, SameSite=none, Secure, 1-year expiry) to link ChatGPT accounts to browsing behavior on advertiser sites. The cookie is set via a JWT sync from chatgpt.com to bzr.openai.com, and is automatically sent on script-load requests for the SDK, even on its 'no credentials' path. The SDK scrapes identity from tag managers and form fields—email/phone hashed, postal codes in clear—with scraped data (685 events) outpacing advertiser-supplied (255) across 936 pixels on 1029 hostnames.