A Java Geek weekly 159

8 Programming Concepts That Look Useless Until Something Breaks. Yandex outage: Data shows that instead of going dark, malicious bots went on the move. What I Self-Host, What I Don’t, and Why. Grafana Tempo 3.1 Adds Query-Based Trace Redaction and Sampling-Aware TraceQL Metrics. Variance in Generics, Phantom and Existential types with Java and Scala. Adding features to the Claude Code harness. HACS is moving to Home Assistant as Marketplace. The Golden Path to Become an Agentic Enterprise.

• 2 min read
8 Programming Concepts That Look Useless Until Something Breaks
  • Invariants: The Rule You Assumed the Code Would Somehow Preserve
  • Idempotency: The Protection You Do Not Need Until "Once" Happens Twice
  • Atomicity: The Bug Lives Between Two Successful Lines
  • Optimistic Concurrency: "Last Write Wins" Is Still Data Loss
  • Backpressure: “Process It Later” Stops Working When Later Never Catches Up
  • State Ownership: Two Copies Can Both Be Correct and Still Make the System Wrong
  • Immutability: The Object Changed After You Thought You Had Already Read It
  • Structured Concurrency: The Request Ended. Its Work Did Not.
Yandex outage: Data shows that instead of going dark, malicious bots went on the move
  • Search indexing dropped
  • Malicious automation migrated instead of stopping
What I Self-Host, What I Don’t, and Why

That’s 17 native services and 11 Podman services, all managed by systemd. htop currently shows about 7.5 GB of memory in use, and CPUs fluctuating between 30% and 40%. It turns out this Mini PC can run a lot! Given how expensive computer hardware has become due to the AI crunch, I hope we’ll continue to see self-hostable projects that prioritize simplicity and efficiency.

Grafana Tempo 3.1 Adds Query-Based Trace Redaction and Sampling-Aware TraceQL Metrics
4image 1791965675784
Variance in Generics, Phantom and Existential types with Java and Scala

When I taught Java, covariance and contravariance was one of the hardest topics for the students.

Adding features to the Claude Code harness

Ok, that’s my next step. And I already have a feature in mind. I have set up the starship prompt on my terminal:

family-tree on  master [$] is 📦 v0.1.0 via 🐍 v3.15.0 on ☁️  nicolas@frankel.ch(europe-west1) took 2s

I hate to lose it when Claude Code runs.

HACS is moving to Home Assistant as Marketplace

HACS stands for Home Assistant Community Store. I find it interesting that this community-led marketplace is being "officialized" by Home Assistant. I hope HA will grade the extensions, and vet the best (and more secure!) ones.

The Golden Path to Become an Agentic Enterprise
golden path diagram selection V2

Step

 Description

 What it gets you 

Goal

1

Sanctioned access

One safe, attributable way for employees to use AI; everything else blocked

Efficiency

2

Safe general-purpose use

Guardrails and cost controls on general AI tools (ChatGPT, Claude, Gemini)

Efficiency

3

Grounded enterprise knowledge

AI answers grounded in your own data, with access control enforced at query time

Efficiency

4

Central governance

One policy, enforced everywhere, with a shared catalog instead of every team rebuilding

Efficiency

5

Governed coding agents

The same governance model applied to coding agents and AI-assisted development

Efficiency

6

Expose capabilities

Your capabilities published as governed MCP servers for external agents to consume

Growth

7

Monetize capabilities

Metering and billing on the capabilities you’ve exposed

Growth

8

Automate processes

Whole operational workflows running agent-first, not just agent-assisted

Efficiency

9

Delegate to agents

Agents acting under a user’s delegated authority, not a standing service account

Efficiency

10

Monetize agents

Agents themselves packaged as products, with outcome-based pricing

Growth
How the Claude Code team does code review

If you wonder how to prevent the review bottleneck, this article is for you.

TL;DR:

  • Before the pull request
    • Give your agent checks it can run, listed in a short CLAUDE.md, plus hooks that run formatters and linters.
    • Run /code-review and /security-review locally, or a fresh-context subagent review.
    • Add a REVIEW.md, and move repeated review comments into it.
  • On every pull request
    • Require CI, and add "Testing", "Risk" and "How to revert" to your PR template.
    • Add an AI reviewer (Code Review for Claude Code, or the Claude Code GitHub Action) on one repo, tune REVIEW.md for a few weeks, then widen.
    • Add automated security review, and require every review thread resolved before merge.
    • Match review effort to risk: a quick pass on routine changes, a deep one where a missed bug is expensive (Quick, Standard or Deep in Code Review).
    • Cap review rounds; after the first few, re-review only the new diff.
  • Approval
    • Write down risk tiers, set from the change rather than the author; start strict and loosen with evidence.
    • Keep the lighter approval paths for authors you trust.
    • Use CODEOWNERS and branch protection so auth, billing, CI and release workflows, and installers always need a person.
    • Never let a bot’s approval replace a required human’s; dismiss approvals on new commits.
  • Merge and after
    • Use a merge queue, feature flags, internal use first, staged releases and one-step rollback.
    • Turn incidents and reverts into an eval set, and rescore the reviewer whenever its prompts, tools or model change.
    • Measure human time, with revert and incident rates as the guardrail.
How I Scaled Agents Beyond My Home Server

I’m very happy to hear a prominent Cloud/DevOps voice mention the harsh reality. Cloud is good for elasticity when you have usage peaks. For the baseline, it’s cheaper to buy a box tailored for your regular usage. Please listen to this!