Topic
Provenance and attestation practices including SLSA, SBOMs, and the argued need for function-level origin records in ported code.
Version 1.0.0 landed as one signed commit into an empty repository, with CI-built binaries. When agents write most of the code, the release becomes the only boundary a reviewer can hold.
Reality
A 40-character SHA-1 string printed in Slovak certification paperwork matches an entry in Russia's state register of measuring instruments. The comparison cost nothing to run.
Reality
Google says the first version of its Advanced Flow is rolling out for installs from unverified developers. The reported announcement carries no criteria, no dates and no scope.
Reality
A one-person project translates Go's scheduler, channels, net/http and crypto/tls into Rust with no GC, no glibc and no Tokio, and stamps every function with its Go source line.
Reality