BestHub
Sign in
Architecture Development Notes
Author

Architecture Development Notes

Focused on architecture design, technology trend analysis, and practical development experience sharing.

109
Articles
0
Likes
876
Views
0
Comments
Recent Articles

Latest from Architecture Development Notes

100 recent articles max
Architecture Development Notes
Architecture Development Notes
Oct 29, 2026 · R&D Management

Claude Code's Partial Load Bug: How Write Overwrites Unseen File Content

An analysis of a Claude Code bug where rule files exceeding context limits were only partially loaded via instruction injection, yet the Write tool's pre-check consulted a different registry — allowing full overwrites of unseen content until version 2.1.312 moved the integrity check to the write moment, requiring full reads or in-place edits.

Claude CodePARTIAL viewRead tool
0 likes · 19 min read
Claude Code's Partial Load Bug: How Write Overwrites Unseen File Content
Architecture Development Notes
Architecture Development Notes
Oct 28, 2026 · Industry Insights

Claude Code Compact Window: Config Accepted ≠ Effective — Merging Rules & 3 Checks

Claude Code's auto-compact window can be set in six different places, each with distinct parsing rules, priority levels, and direction constraints (only lowering, never raising). Invalid values are silently ignored without errors. The article breaks down the merging logic, version-specific changes, and three verification methods: startup warnings, debug logs, and transcript events.

Claude Codeauto-compactconfiguration merging
0 likes · 14 min read
Claude Code Compact Window: Config Accepted ≠ Effective — Merging Rules & 3 Checks
Architecture Development Notes
Architecture Development Notes
Oct 28, 2026 · Backend Development

MCP Tool Schemas Are Untrusted: Validators Must Enforce Limits Against SSRF and DoS

The MCP 2026-07-28 spec relaxes tool schemas but adds constraints on external references and combinatorial keywords; testing shows jsonschema defaults to fetching remote refs (violating spec) while Ajv complies, and a tiny 1.3KB schema with nested anyOf can cause 10-second validation delays, so validators must enforce time budgets and reject external refs.

AjvDoSJSON Schema
0 likes · 13 min read
MCP Tool Schemas Are Untrusted: Validators Must Enforce Limits Against SSRF and DoS
Architecture Development Notes
Architecture Development Notes
Oct 27, 2026 · Backend Development

Why MCP's readOnlyHint Can't Be Trusted: Enforce Read-Only at the Database Layer

The article explains that MCP's readOnlyHint is a server-declared hint, not an enforceable guarantee; clients must treat annotations as untrusted unless from verified servers, and true read-only enforcement requires execution-layer permissions like database roles, while also noting data exfiltration risks via openWorldHint.

MCPPostgreSQLdatabase permissions
0 likes · 8 min read
Why MCP's readOnlyHint Can't Be Trusted: Enforce Read-Only at the Database Layer
Architecture Development Notes
Architecture Development Notes
Oct 27, 2026 · Artificial Intelligence

Claude Code's Silent Feature Downgrade for Unrecognized Model IDs

When Claude Code cannot parse a model ID string, it silently disables advanced capabilities like effort and extended thinking, assumes a 200K context window with early compression, and switches to a shorter system prompt — requiring explicit configuration via modelOverrides, capability declarations, or version suffixes to restore full functionality.

BedrockClaude CodeFoundry
0 likes · 28 min read
Claude Code's Silent Feature Downgrade for Unrecognized Model IDs
Architecture Development Notes
Architecture Development Notes
Oct 26, 2026 · Operations

Claude Code's Permission Audit Blind Spot: Why Rejection Counts Don't Reveal the Blocker

Claude Code's tool_decision events only capture accept/reject with a generic source field merging eight judgment sources, while the newer safety_event adds 14 categories but suffers from join gaps, attribute truncation, and missing events for unattended rejections, requiring joined audit tables and CI validation to identify actual blockers.

CI testingClaude CodeOpenTelemetry
0 likes · 20 min read
Claude Code's Permission Audit Blind Spot: Why Rejection Counts Don't Reveal the Blocker
Architecture Development Notes
Architecture Development Notes
Oct 25, 2026 · Backend Development

Claude Code MCP Tasks: Four Gates Control Creation, Persistence & Elicitation

This article details the four conditional gates—client capability extension, feature flags, session type, and call origin—that determine whether an MCP tool call becomes a persistent task in Claude Code, explaining why tasks work in terminal CLI but silently degrade in CI, VS Code, or subagents, and provides decision tables for deployment scenarios.

CI/CDClaude CodeMCP
0 likes · 38 min read
Claude Code MCP Tasks: Four Gates Control Creation, Persistence & Elicitation
Architecture Development Notes
Architecture Development Notes
Oct 23, 2026 · Information Security

Claude Code's allowNestedUserNamespaces: Fixing Chromium Breaks Outer Sandbox File Boundary

This article analyzes Claude Code's allowNestedUserNamespaces setting, explaining how enabling it to support Chromium and rootless Podman weakens the outer sandbox's file protections, compares three workarounds with different security trade-offs, and provides a decision framework based on asset sensitivity and trust domains.

ChromiumClaude CodeConfiguration
0 likes · 28 min read
Claude Code's allowNestedUserNamespaces: Fixing Chromium Breaks Outer Sandbox File Boundary
Architecture Development Notes
Architecture Development Notes
Oct 22, 2026 · Backend Development

Claude User Profiles: Per-Client Enforcement Only on Platforms Verifying IDs Per Request

Anthropic's user profiles shift enforcement from organization to end-client level, but only on platforms that verify profile IDs per request; gateways must create profiles at registration, store IDs on customer records, inject headers at the sole egress point, and handle platform-specific gaps like Bedrock's format-only validation and AWS's missing enforcement reporting.

API gatewayAnthropicBedrock
0 likes · 25 min read
Claude User Profiles: Per-Client Enforcement Only on Platforms Verifying IDs Per Request