CATEGORY
OSS in regulated banking — supply-chain trust, Rust, MCP, the projects banks rely on and ship.
POLICY & RESILIENCE
Compile-time WCAG gates, SHA-384 SRI, CSP injection and a local-first LLM pipeline set this Rust engine apart, but incremental builds, native minification and AVIF are still aspirational. Here is the honest gap analysis and the road to 1.0.
APPLIED AI
Retail banking got its API standard a decade ago. Corporate banking never did — and now that AI agents and the Model Context Protocol have turned integration into a runtime decision, the gap has stopped being a nuisance and become a fault line. A concrete failure mode, the strategic choice it forces, and what a corporate banking API standard has to mandate.
PAYMENTS & MONEY
Morgan Stanley, JPMorgan and Citi are doubling down on FINOS and the Linux Foundation. A Rust-and-zero-dependency stack — noyalib, http-handle, hsh, KyberLib — shows what the cloud-native CIB stack looks like in 2026 under PSD3, FiDA and DORA.
APPLIED AI
Agentic treasury co-pilots are moving from controlled pilots into production in 2026. The pattern is consistent across CIB treasuries: agents read ISO 20022 cash data, call bounded tools, and rebalance liquidity inside policy bands — with SR 11-7, DORA, and EU AI Act controls wrapped around them.
PAYMENTS & MONEY
The 2026 global payments cycle is defined by three converging forces — agentic commerce, invisible embedded payments, and real-time execution — sitting on top of a tokenised unified ledger under Project Agorá and a hard November 2026 SWIFT structured-address cut-over. This piece synthesises the J.P. Morgan, Global Payments, HSBC and Payments Association 2026 outlooks into a four-pillar G-SIB operating model.
INFRASTRUCTURE & CRYPTOGRAPHY
In the era of GPU-accelerated decryption and DORA mandates, cryptographic rot is a systemic risk. Every legacy PBKDF2 or scrypt hash resting in a banking database is a countdown to compromise. hsh changes the paradigm with zero-downtime, memory-safe upgrades...
POLICY & RESILIENCE
In 2026, web content is consumed as much by AI search crawlers, LLM-backed search engines, and Retrieval-Augmented Generation (RAG) pipelines as by human readers. Flat or malformed HTML…
POLICY & RESILIENCE
The banking edge has a dependency problem. Every Nginx or Envoy instance that routes traffic between a client and a core banking service carries a dependency tree: OpenSSL builds, Lua modules,…
POLICY & RESILIENCE
NoyaLib is a safer Rust YAML stack — zero unsafe blocks, 406/406 YAML 1.2 spec compliance, lossless Concrete Syntax Tree, JSON-Schema (Draft 2020-12) validation, and MCP/WASM bindings — engineered for AI agents, Kubernetes, CI/CD, and the configuration control plane behind financial infrastructure.
OPEN SOURCE
AI-aware dotfiles in 2026 treat the developer workstation as supply-chain infrastructure — declarative chezmoi-managed configuration with MCP awareness, SLSA-signed releases, age/SOPS secrets, sub-second startup, and macOS/Linux/WSL parity.
INFRASTRUCTURE & CRYPTOGRAPHY
KyberLib turns the post-quantum banking migration from policy paper into inspectable Rust — FIPS 203 ML-KEM key encapsulation, hybrid classical-plus-quantum handshakes, no_std compilation for HSMs, crypto-agile abstraction boundaries, and the DORA Article 5 governance evidence boards now need.
APPLIED AI
CloudCDN is an open-source blueprint for the AI-native edge — a zero-trust MCP gateway with 42 tools, atomic Durable Objects rate limiting, WebAuthn passkeys, signed URLs, SLSA Level 3 provenance, and 3,185 tests at 100% coverage, mapped to DORA, BCBS 239, and Basel III.
