技述 — JS.GRIPE

One firewall, several business origins

toewpq — Thu, 29 Oct 2026 00:00:00 GMT

EdgeAegis runs native OWASP CRS before a request reaches your business. Configure multiple internal functions, VPS origins and load-balancer hostnames in one routing file, with separate credentials for each trust boundary.

Real terminal, real HTTP responses

The isolated VM recording uses curl against two functions and three authenticated HTTPS origins. A SQL injection receives 403 without another origin access; a five-second demonstration ban then expires. The five-second TTL is for this lab, not the production default.

Rules and routing stay separate

rules/config.yml selects native rules, policy and your allowlist. origin/config.yml maps public hostname/path patterns to destinations. secret/credentials.yml holds independent origin keys in your private deployment repository.

npm exec --package=edgeaegis -- edgeaegis init my-firewall
cd my-firewall
npm install

routes:
  - pattern: api.example/shop/*
    origin: function:shop
  - pattern: api.example/orders/*
    origin: https://192.0.2.10
    key: orders-vps
  - pattern: api.example/search/*
    origin: https://lb.example
    key: search-lb

Internal functions stay behind inspection

A configured function: selects origin///index.js. The shared firewall entry point inspects the request before calling the function, then inspects its response. External origins must verify their own selected key.

Measure the boundaries

Complete CRS compilation and execution are checked before rule updates. Unknown semantics fail visibly. Resource bounds and platform limits still apply; upgraded WebSocket payloads are opaque to SecLang and Worker-only counters are local to an engine instance.

Vibe Coding and Agent reports are welcome. Run the relevant tests before submitting code. Sensitive findings need a private report with an affected version, sanitized reproducer, impact and actual verification evidence.

Explore EdgeAegis · README

Building AMA-1: a clean baseline and two rounds of unseen tests

toewpq — Sat, 17 Oct 2026 18:11:40 GMT

I want to explore a local assistant that gradually learns about the world, recognizes its own limits and grows through tools and checked observations. The AMA experiments begin with clean data and random initialization, keep resource use modest and preserve failures alongside successful runs.

AMA-1 Genesis started from a small v0.1 prototype. Codex launched AGY to implement changes and independently reviewed the work. After two test rounds exposed repairs that covered only known paths, I authorized Codex to contribute separately identified patches. The result is a runnable foundation. The full capability target is still unfinished.

The goal and the current system

The six directions are training from scratch, a truthful self-model and stable personality, world and object knowledge, reviewed continual learning, lightweight tool use, and trustworthy networking. The intended order is self-model, objects, tools, correction and learning, followed by more natural conversation and multimodal perception.

The component actually trained here is a 516-parameter linear routing classifier using character bigrams. Its 24 synthetic examples distinguish self, world, search and other requests. It is not a language model. Object attributes in SQLite do not constitute visual recognition.

The personality contract takes inspiration from Kal’tsit’s calm, rational independence while AMA-1 keeps its own identity. Subjective consciousness remains an open research question. Functional state reporting does not establish subjective experience.

Implementation and review had separate jobs

The original files were inventoried and frozen before a clean Git baseline was saved. No old project code, datasets or model weights were transplanted. Review used source code, actual command output and checkpoint provenance; historical writeups were not accepted as evidence of a new run.

The initial 16 tests passed. Additional checks found malformed checkpoints being accepted, contradictory knowledge surviving correction, unsafe URL handling and CAPTCHA pages being counted as successful searches. AGY added typed object records, episodic events, a tool registry, candidate manifests and rollback operations, together with tests.

Those additions had their own gaps. Redefining an object could discard its identity. New property APIs bypassed review. A matching hash could still describe an invalid model. A corrupt backup could replace a valid model. Even a fixed search endpoint could redirect toward a private address. The network reproduction used a mocked transport and made no actual private-network request.

How the two corpora were separated

Both corpora were frozen and hashed before evaluation, and the implementer was explicitly prohibited from reading them. The original 24 training rows stayed unchanged. Review checked literal and Unicode/case-normalized overlap and inspected visible tool traces.

This was an implementer-hidden independent evaluation, not a formal double-blind experiment. There was no OS access-control separation, and the reviewer knew the questions. The classification task also shares intent labels and domain semantics across its splits.

Once first-round feedback guided repairs, that corpus became regression data. The second round used a different, previously undisclosed corpus. Repairs after those rounds were evaluated as regression work, not fresh blindness.

Routing evaluation	Correct	Accuracy	Majority baseline
Round 1	9/24	37.5%	25%
Round 2	8/24	33.3%	25%

The training-majority baseline is 25% in both rounds. These are routing results, not measures of object recognition or language understanding. An emoji input could still be classified as search, and reported confidence had no independent calibration. A prediction therefore cannot grant tool permissions.

Passing repairs must not erase failures

The second round found invalid training schedules, partial weight mutation before a later bad sample was rejected, control characters in URLs, truthy string authorization, alias shadowing and missing backup lineage checks. AGY handled routing and URL validation. Codex separately patched knowledge review, permissions, typed corrections, transactions and rollback checks.

The final full regression run passed 85 tests, with zero failures, errors or skips and exit code 0. Another 17 actual CLI invocations exercised candidate properties, approval, aliases, correction, arithmetic and default network denial.

Codex-authored patch checks are author regression evidence, not an independent audit of those patches. Both rounds’ failures, predictions and false positives remain in the repository. Training accuracy reached 100%, but unseen results still show inadequate competence. The actual checkpoint remains a candidate and was not promoted into production.

Resource and network claims stay within the evidence

The observed peak RSS was about 17.72 MiB in the standalone training process and 25.34 MiB in a separate CLI process. These are single samples from different processes. RSS did not fall after object unloading, so the experiment does not establish that memory returned to the operating system.

The 6GB VRAM budget is still a target. CUDA allocations, reserved memory, global GPU footprint and future perception-model requirements were not measured.

Networking is denied by default. Explicit consent is required before sending a query. Search results remain untrusted links: no automatic knowledge promotion, downstream fetching or CAPTCHA bypass. Live provider success was not verified. Independent-source checks, ownership clustering and complete GEO defenses remain unfinished.

What is available for analysis

The source and audit snapshot are published in jsw-teams/train. A successor commit replaces the current tree while retaining the previous remote history. Public evidence redacts machine paths; full raw execution records remain local. Exact dataset, checkpoint and frozen-corpus bytes are preserved so newline conversion cannot invalidate their hashes.

The next stage needs representative material with traceable sources and licenses, plus a new isolated evaluation corpus. The complete learning loop, a scratch language model, natural conversation, photo recognition and speech are not implemented. Published or feedback-exposed questions must not become the next model’s supposedly unseen test.

See the AMA model family page, audit report, executed test results and training-data manifest. Release of the final capability target remains blocked.

Develop a theme for EdgePress

toewpq — Sun, 11 Oct 2026 00:00:00 GMT

A theme changes how the site is presented while article and page files keep their content. Start with a local theme, get the shared layout right, and check the same content in both wide and narrow windows.

Create and select a theme

npx edgepress theme list
npx edgepress theme create my-theme
npx edgepress theme use my-theme
npm run dev

theme create copies the default layout scaffold and creates an empty assets/style.css for your styles. It does not create a finished visual design. Select an installed theme with theme use, or install a published theme package with npx edgepress theme install <package>. If the site has a root theme: entry in config.yml, that selects the theme; older projects can use paths.theme in the build configuration.

themes/my-theme/
  theme.json
  layouts/layout.html
  layouts/partials/head.html
  layouts/partials/header.html
  layouts/partials/footer.html
  assets/style.css
  assets/data-saver-theme.css
  package.json
  README.md

Build the shared layout first

<html lang="{{site.language}}">
<head>{{> head}}</head>
<body>
  <a class="skip-link" href="https://www.js.gripe/2026/10/edgepress-theme-development/#main">{{site.skipToContent}}</a>
  {{> header}}
  <main id="main">{{{page.content}}}</main>
  {{> footer}}
  <script defer src="https://www.js.gripe/edgepress/language-select.js"></script>
</body>
</html>

Templates are HTML partials. {{page.title}} and other ordinary placeholders are escaped; {{{page.content}}} inserts the framework's already-rendered content. Keep the head partial, consent support, language navigation and the framework's local runtime. A theme should not copy those browser implementations.

Preserve the skip link, one main landmark, visible keyboard focus and one page-level H1. Use a full-height body and a growing main so the footer stays at the bottom on short pages. Test long titles, articles, project lists, empty states and the localized 404 page.

Style real page elements

Use assets/style.css for your palette, typography, spacing and responsive rules. Built-in font variables are --edgepress-font-sans, --edgepress-font-serif and --edgepress-font-mono; font assets remain local. Style the page-builder rows and cells, article body, navigation, tables, code, project recordings and notices. Avoid fixed desktop widths that overflow on phones.

Keep editorial images in content/assets/ and only theme-owned decoration in the theme assets. Local CSS and JavaScript and their dependencies receive content hashes at build time. The output preserves one-year immutable caching for those hashes while HTML and unversioned metadata revalidate.

Add behavior without changing the publishing model

Small local theme interactions can live in assets/. Build-time plugins belong in the paths listed in edgepress.config.mjs; they are trusted Node code. Optional external services belong in the flat plugins.consent.services list in config.yml, with a name, purpose, data disclosure and current service consent before requests. Keep comments in iask rather than building a separate comment system into the theme.

Images, media galleries and document elements use the existing reusable viewers. Preserve their focus handling, consent gates and lazy loading. Do not copy a player or document engine to adjust its colors.

Check the theme with actual content

Run npm run build and npm run check, then inspect light and dark palettes, keyboard navigation, translated menus and mobile layouts. Test an article with code and tables, a two-column page, a recording with its seek bar and a document preview. A successful build checks structure; you still need to look at the resulting page.

A lightweight text variant is optional. If you add one, test its actual request behavior as well as its layout: text-view configuration.

Writing and Pages · Theme element reference

Configure optional text view in EdgePress

toewpq — Sun, 11 Oct 2026 00:00:00 GMT

Text view is useful when the full page takes too long to load or when a reader wants to save data. It is optional, and a theme must provide a readable lightweight variant before the site enables it. The default view stays full; the reader chooses whether to switch.

Enable it in site configuration

Merge this into the existing site object in config.yml rather than adding a second site key:

site:
  dataSaver:
    enabled: true
    debug: false
    mode: auto
    detectSlowConnection: true
    respectBrowserPreference: false
    promptAfterMs: 5000

Setting	What it does
`enabled`	Enables the optional loading and text-view flow. Default: false.
`mode: auto`	Starts with full view unless the reader has made an explicit choice.
`detectSlowConnection`	Offers text view while the first screen waits for resources. It does not switch automatically from a network speed label.
`promptAfterMs`	Sets the delayed offer threshold; 5000 means five seconds. Valid range: 100–60000.
`respectBrowserPreference: false`	Keeps the initial choice independent of browser data-saving hints.
`debug: false`	Keeps the empty `?data-save` preview entry disabled on the public site.

A saved reader choice takes precedence over the site's automatic starting mode. mode: text or mode: full changes the configured starting preference; neither is needed for the flow above.

Let the theme define the lightweight presentation

Merge dataSaver into the active theme's theme.json:

{
  "name": "my-theme",
  "renderer": "layouts/layout.html",
  "templateEngine": "edgepress-partials-v1",
  "dataSaver": {
    "stylesheet": "data-saver-theme.css",
    "scripts": [],
    "layoutStyles": ["style.css"]
  }
}

The stylesheet and scripts are paths relative to the theme's assets/ directory. layoutStyles lists shared published CSS; the build compiles it with font-face rules and URL declarations removed. This helps retain real navigation, rows, cards and footer geometry without downloading decorative assets. The variant stylesheet supplies its own typography and colors. Keep titles, article excerpts, timestamps, captions and visible focus usable.

Text view uses system fonts and defers pictures, project clips, document engines and optional service widgets. Readers can request individual media or return to full view. Charts and screenshots still need useful descriptions; saving data should not remove the explanation that makes an article understandable.

Keep service choice separate from media loading

Accepting consent does not download every optional widget. A service request still needs current per-service consent and a reason to load that widget. For a remote document, the source must also permit CORS. Keep the flat service list and each service's disclosures; there are no category switches to enable whole groups.

For dynamic theme media, call window.edgepressDataSaver?.deferMedia(element, activate, description) before assigning a URL. Make activate assign the URL only when requested, and provide a fallback when data-saving support is disabled. Mark nonessential full-view scripts with data-data-optional. Hiding an image after setting src is too late to save its request.

Test the waiting screen and navigation

Throttle actual resource transfers to about 100 KB/s, open a fresh page, and switch to text view while full styles and media are still pending. Check that the waiting screen's controls are keyboard accessible, progress reflects completed resources, late resources do not replace the chosen view, and article navigation preserves the choice. Inspect request logs for fonts, pictures, clips and widgets; hidden pixels are not proof that a request was avoided.

Also test the return to full view, mobile footer boundaries and a page without JavaScript. debug: true permits the empty ?data-save test entry; when it is disabled, that entry goes to the localized static 404 page. This client navigation does not prove an HTTP 404 from the host. Keep debug false after testing.

Each site keeps command entries under its own tools/ and regression cases under tests/. This site provides npm run test:data-saver and npm run verify:performance. The benchmark uses a cold cache, gzip, 100 KB/s and 150 ms latency, reporting first contentful paint separately from readable content. Shared implementations come from the pinned EdgePress dependency. Theme developers can follow the public tool guide with their own paths and locales, without access to this site's source. Anonymous local fixtures do not verify live services or publishing accounts.

Writing and Pages · Theme development

Read documents inside an EdgePress page

toewpq — Sun, 11 Oct 2026 00:00:00 GMT

The document viewer lets a reader open Word, PDF, PowerPoint and Excel content inside an article or page. I keep the source document under content/assets/documents/ and use its site path. The preview opens in place without moving keyboard focus; a title belongs to the document element and appears once.

An article uses a standalone line in its Markdown body. Replace this example with a file you have added to the site:

!document[Project report](/documents/project-report.pdf)

For a JSON Page, place a document element inside one of the cell's element arrays:

{
  "type": "document",
  "title": "Project report",
  "src": "/documents/project-report.pdf"
}

The preview shows separated pages in a continuous reading area. Spreadsheets retain worksheet navigation; the surrounding controls follow the site palette while the document keeps its own colors. These formats have different parsing costs, so I check the actual sample instead of assuming every file streams with constant memory.

Text view defers the viewer until the reader requests it. A remote direct-file URL needs current service consent and permission from the source's CORS policy. Granting consent does not mean loading every document or widget. Check scrolling, keyboard focus, narrow screens and switching between full and text view with npm run build and a local preview.

Document viewer and samples · JSON Pages

Website submissions and review guidelines

toewpq — Fri, 09 Oct 2026 00:00:00 GMT

The Links page is a small collection of personal websites, thoughtful blogs and independent projects. It is not a ranking, a paid placement program or an automatic link exchange. I would like to discover sites with a point of view, whether they are about software, writing, science, art or something else.

Submit a website in the comments

Leave a comment below this article with:

Website name — the name you want shown in the directory.
URL — a public website address beginning with https:// or http://.
Short introduction — a sentence or two about what you publish or create.
Optional icon information — only if you own the image or have permission for it to be used.

To comment, enable iask (the article discussion service) in Privacy settings and sign in with GitHub if prompted. Comments are visible to other readers: please do not post private contact details, passwords or other sensitive information. If comments are unavailable, you can also use the contact page.

You may recommend your own site or one you genuinely enjoy. Please do not submit someone else's logo as though you have the right to license it.

How I review submissions

I review submissions manually. I look for authentic content, a clear purpose and something useful, distinctive or interesting to explore. There is no traffic threshold, technology requirement or obligation to link back to JS.GRIPE.

I may decline or remove sites primarily used for spam, misleading impersonation, malicious downloads, intrusive redirects or content unsuitable for this directory. Submitting a link does not guarantee publication, and I cannot promise a review or response time.

Approved entries are maintained as static content. If an icon is used, it is stored locally after its rights are checked; the directory does not fetch a submitted site's icon when visitors view the page.

Corrections and removals

Websites change. If a listing has the wrong name, leads somewhere unexpected or should be removed, please use the contact page. You can also leave a follow-up comment, but avoid posting private details publicly.

External links lead to independently operated websites with their own privacy practices. JS.GRIPE shows a destination prompt before an ordinary external click.

Thanks for sharing a corner of the web worth exploring.

Video at your pace, pictures in detail

toewpq — Tue, 06 Oct 2026 00:00:00 GMT

The seek bar occupies its own row. Current time and total duration remain together; dragging moves to a real position. The demonstration pauses to show the resulting timestamp and the selected 2× playback rate.

Original detail when you open a picture

Cards and posts request optimized previews. Clicking a detail image opens its unchanged original; zoom and drag to inspect it. The close control stays outside the picture, and closing returns focus to the image that opened it.

A component, rather than page-specific controls

Video.js 10 HTML components and hls.js are bundled locally. Gallery navigation mounts only the chosen attachment and disposes previous playback. The integrating website supplies sources, consent and theme colors. The library itself does not publish or store content.

Project and documentation

Photos and video in one story: publish, then share

toewpq — Tue, 06 Oct 2026 00:00:00 GMT

Write the story first. Add photos and video beneath it, then publish one post. The centered progress dialog distinguishes transferred bytes, media preparation and publication. On success, view the post, open its share sheet or visit your profile.

Share the complete story, or individual attachments

The Link tab gives a public post URL. Embed supplies an iframe containing the complete caption, author and gallery; compatible oEmbed hosts discover it from the link. Markdown gives each image its own link and videos a playback-page link. In EdgePress, register the service first; visible embeds load after visitor consent.

Put the post in an EdgePress article

Append the ishare entry to the existing services list in config.yml.

plugins:
  consent:
    services:
      - id: ishare
        provider: oembed
        enabled: true
        name: ishare
        backendUrl: https://ishare.js.gripe
        purpose: Display the shared photos and video after consent.
        dataCategories: Requested media and IP address.
        recipient: ishare
        retention: Until the publisher deletes the post.
        privacyUrl: https://ishare.js.gripe/privacy/

You can place the embed directly in the Markdown body with !embed[service](URL) syntax. Replace the example URL with the link copied from your post:

!embed[ishare](https://ishare.js.gripe/s/0123456789abcdef0123456789abcdef)

The page reserves a themed placeholder first, then loads the caption and attachment gallery after consent as it approaches the viewport. Save, run edgepress server, and open the article from the homepage to verify it.

!embed[ishare](https://ishare.js.gripe/s/0726bea158a144129dd3b70468f1a0fc)

History belongs on your profile

Open My profile from the avatar menu. Visitors see your published posts; only you see the deletion controls and homepage inclusion switches. The personal center separately handles your display name, biography and data rights.

Project and documentation

Use EdgePress for writing and Pages

toewpq — Tue, 06 Oct 2026 00:00:00 GMT

I use EdgePress to keep writing and layout in ordinary files. Articles are Markdown. Homepages and project pages are JSON layouts. The build produces static HTML and local assets in dist/; there is no site database to maintain for publishing an article.

Get a site running

For the current repository checkout, use Node.js 22.12 or newer and run these commands from the project root:

npm ci
npm run new -- post "A quiet afternoon"
npm run dev

The new-post command prints the path of the file it created. Open that file, keep the metadata between the two --- lines, and write below the second line. The preview rebuilds when source files change. Create an article with the CLI once; subsequent edits happen in the editor.

For a new site, install the published GitHub source commit used by this site and initialize an empty directory:

mkdir my-site
cd my-site
npm install edgepress@https://codeload.github.com/jsw-teams/edgepress/tar.gz/ac42e0046d022a318e4eef21e56e2e459584b2a5 --save-exact
npx edgepress init
npm install

The npm release and the latest GitHub checkout can differ. Keep the site's dependency version and lockfile together. A site that already depends on EdgePress should use its existing package scripts rather than install a global copy.

Know which file to edit

config.yml                    (site, theme, privacy, consent services)
edgepress.config.mjs           (paths, locales, permalink, build plugins)
content/posts/<post-id>/en.md   (article metadata + Markdown)
content/pages/<page-id>/en.json   (page metadata + rows and elements)
content/assets/images/walk.jpg (published as /images/walk.jpg)
themes/<name>/                 (shared layouts and visual styles)
dist/                         (generated output)

Set your title, canonical URL, navigation, footer and privacy details in config.yml. Enable languages and change build paths in edgepress.config.mjs. A locale filename is lowercase: Pages use en.json or zh-cn.json, while articles use en.md or zh-cn.md. Its lang must match an enabled locale. Each article or page gets a directory containing its translations.

Write the article

---
title: A quiet afternoon
date: 2026-10-11T10:00:00+08:00
lang: en
category: blog
tags: [walk, photography]
---

We stopped by the water.

## A small detail

![Reflections by the shore](/images/walk.jpg)

The CLI supplies the current timestamp and site language; the example above shows the shape of the file. The theme renders the article title, so use ## for sections rather than repeating the title as an H1. Copy the photograph to content/assets/images/walk.jpg before building.

One category chooses the article's section. blog and uncategorized belong to this site's everyday observations; edgepress, ishare, iask and media-viewer belong to product notes. Tags describe the article and do not select its homepage list.

Read a page from the outside in

Page (rows) → row (columns, cells) → cell (ordered elements) → element (type, content). Here is a complete two-column page:

{
  "title": "Project notes",
  "lang": "en",
  "slug": "notes",
  "blocks": [
    {
      "columns": 2,
      "cells": [
        [
          {
            "type": "heading",
            "level": 2,
            "text": "What I am making"
          },
          {
            "type": "text",
            "text": "A small tool for everyday writing."
          }
        ],
        [
          {
            "type": "post-list",
            "title": "Notes",
            "category": "edgepress",
            "count": 3
          }
        ]
      ]
    }
  ]
}

Save it as content/pages/notes/en.json. Metadata and blocks share one JSON object; there are no YAML delimiters or Markdown body. VS Code can identify and fold blocks, each row, cells, each cell and its elements. The local $schema reference supplies field help and checks the structure. columns: 2 needs two cell arrays; their elements render in order. A section’s blocks contain child elements. Use paragraphs for separate prose paragraphs and \n inside code strings for line breaks. Legacy Markdown/YAML Pages still build, but keep one format per page language.

Preview, then publish the generated files

Run npm run build to validate and generate the website; npm run check writes the page report under tools/reports/. Inspect the homepage, article, language links and mobile layout locally. Publish dist/ through your existing host and deployment configuration. Generated HTML is output, so make corrections in the source files.

Theme development · Optional text view · Project and quick start

iask: optional website discussions

toewpq — Sat, 03 Oct 2026 00:00:00 GMT

iask owns the discussion interface and backend. Register it as an optional service in the website config.yml; readers decide whether to load it. GitHub sign-in is needed to publish, while public discussions remain readable without signing in. Pictures and bear or panda stickers accompany text, with stickers visible inside the editor.

The interface follows the website palette, available width and language. Cloudflare and Netlify have platform adapters; Vercel additionally requires persistent PostgreSQL. Check the deployment guide for current configuration and callbacks.

GitHub / Documentation

Markdown and embeds for an EdgePress article

toewpq — Wed, 30 Sep 2026 00:00:00 GMT

An EdgePress article has YAML metadata followed by Markdown. Use the CLI to create the file, then edit the body below the second ---. This example collects the syntax I use for a practical note:

## What I noticed

A paragraph with **emphasis**, a [link](https://example.org/) and `inline code`.

- A short list
- Another point

> A quoted observation.

| Step | Result |
| --- | --- |
| Build | Static HTML |

- [x] Draft
- [ ] Preview

![A photograph](/images/walk.jpg)

!document[Report](/documents/report.pdf)

!embed[ishare](https://ishare.js.gripe/s/EXAMPLE)

The site renders headings, paragraphs, emphasis, links, lists, quotations, fenced code, GFM tables and task lists. Put code inside triple backticks with a language name. The page already displays the article title; body sections start at ##.

Copy media into content/assets/ before referencing its site-root path. A picture opens the shared image viewer; an explicit original URL is requested on activation. A local document is previewed automatically by the reusable document viewer. External documents need a registered service, current consent and CORS.

!embed[ishare](URL) is a standalone line, using the real published share URL instead of EXAMPLE. Register the service in plugins.consent.services before using it; requests wait for consent and demand. The same extension can be used in a Pages text element. Do not put embeds into article front matter.

Pages use structured elements, so a whole Markdown article should not be pasted into a Pages text field. Use the complete Pages example for layout. Preview with npm run dev and build before publication.