The Frontier Has a Brake Pedal. The Floor Doesn't.
In June I asked whether Anthropic's warning was a brake pedal or a press release. The essay arrived — and it's a real mechanism, aimed one layer above where most of us actually ship agents.
#supply-chain-security
When One Transitive Dependency Shakes the Whole ISV Market: Lessons from Shai-Hulud
One compromised maintainer, 444+ packages, ~2B monthly installs. What the Shai-Hulud npm worm teaches platform teams about install-time trust — and how to harden against the next one.
FedRAMP, From the Platform Side — Part 3: Where FIPS Lives Inside FedRAMP Part 3
FIPS-validated crypto is a hard requirement inside a FedRAMP boundary — not a best practice. A practitioner's walkthrough of where FIPS lands across 800-53 control families, and how the Building for Compliance supply-chain work maps onto it.
Rebuilding for Compliance, Part 4: From Signed Image to Verified Pipeline Part 4
Wiring a signed Wolfi toolchain image into a real consumer pipeline, verifying it at deploy time with Sigstore policy-controller, and digest-pinning with Renovate — the series finale.
Rebuilding for Compliance, Part 3: Building Secure Containers on Wolfi Part 3
Part 3 — how I put Wolfi, syft, grype, and cosign to work in hagzag/tools: a CI toolchain image with SBOM validation, keyless signing, and a single-command local loop.
Rebuilding for Compliance, Part 2: Rebuilding on Wolfi OS Part 2
Wolfi OS, apko, melange, and Chainguard's daily rebuild model — a practitioner's evaluation of the open-source path to low-CVE, FIPS/FedRAMP-ready images.
Rebuilding for Compliance, Part 1: A Supply Chain Security Primer Part 1
SBOM, provenance, SLSA, cosign — and how FIPS 140-2/3 and FedRAMP land on your container images. A practitioner's map before the rebuild begins.