THE WORLD

Iran Closes Hormuz; Seahawks to Khosla for $9.6B

↩ Developing story — first reported Jul 07 · previously Jul 08, Jul 10

• Hormuz closed — Iran declared the Strait off-limits Saturday after the US launched a third strike package targeting Revolutionary Guard positions and air defenses. Bloomberg

The Paul Allen estate agreed Saturday to sell the Seattle Seahawks to the Khosla family for a reported $9.6 billion.² Vinod Khosla, the founder of Sun Microsystems and Khosla Ventures and worth $15.6 billion per Forbes, will be the controlling owner; he must sell his San Francisco 49ers limited partnership stake as a condition.³ NFL approval is expected over the coming months.² The estate put the team on the market in February, following the Seahawks' Super Bowl win and a standing directive to sell Allen's sports holdings and direct proceeds to charity.²

Tomorrow is the public hearing on the Seattle Transit Measure: remote session at 9:30am, in-person at City Hall (600 4th Ave) at 5pm.⁴ Fix the L8, the Transit Riders Union, and Transportation Choices Coalition are mobilizing in defense of Mayor Wilson's full 0.3% sales tax renewal.⁵ A competing amendment from Councilmember Kettle would drop it to 0.2%, which advocates say equals 1.1 million lost service hours per year.⁶ The select committee votes on amendments July 16, ahead of the November ballot deadline.⁴

ON THE TRAIL

This coming weekend: Sat–Sun, July 18–19. No federal holiday in range; standard two-day window. The 7-day forecast from July 12 reaches through Saturday July 18 only — Sunday July 19 is outside the forecast window. Plan Saturday confidently; leave Sunday open.

---

Pick 1 — Melakwa Lake via Denny Creek (1-night) I-90 / Snoqualmie / North Bend · ≈45 min from Issaquah

• Day 1 in: ≈4.7 mi, +2,250 ft / Day 2 out: ≈4.7 mi, –2,250 ft (estimate — mileage not stated in trip report) - Weather: Sat Jul 18: 82°F high, 2% precip | Sun Jul 19: outside 7-day forecast window (I-90/Snoqualmie region forecast) - A July 11 reporter found the trail "in good condition, and surprisingly empty for a popular trail" — lake reached in roughly 2h15m, no bugs flagged, water at Melakwa Lake, no snow. The Denny Creek crossing in the first half mile is typically a rock-hop by mid-July and was not flagged in the report, but worth confirming levels before you go if recent snowmelt concerns you. - WTA trip report — Jul 11

Pick 2 — Pratt Lake → Lower Tuscohatchie Lake (2-night) I-90 / Snoqualmie (Pratt Lake / Granite Mtn TH) · ≈45 min from Issaquah

• Day 1 in: ≈5.5 mi, +1,100 ft to Pratt Lake | Day 2: side trip to Lower Tuscohatchie ≈3 mi, ±500 ft | Day 3 out: ≈5.5 mi, –1,100 ft (all estimates — mileage not in trip report) - Weather: Sat Jul 18: 82°F high, 2% precip | Sun Jul 19: outside 7-day forecast window (I-90/Snoqualmie region forecast) - A WTA work party was actively clearing logs on the Pratt-to-Melakwa corridor as of July 11; a backpacker who came out that day had the trail nearly to herself and called the section between Pratt and Tuscohatchie "my favorite part of the whole trip." No bugs mentioned, water at both lakes, no wading fords on this route. The Tuscohatchie basin draws considerably less traffic than the main Pratt shoreline. - WTA trip report — Jul 11

---

Regional snapshot — conditions as of July 11

• I-90 West — Pratt/Tuscohatchie corridor: WTA work party clearing logs between Pratt Lake and Melakwa in progress; trail open. Mirror Lake (Snoqualmie Pass): campsites roughly half-full on a summer Saturday. - I-90 East — Thorp Mountain Lookout (Teanaway): peak wildflowers at all elevations, trail clear, overnight campers spotted July 11. Lake Ingalls: overnighter lot was nearly full before 4am — save this one for a weekday. - US 2 West — Beckler Peak (Skykomish): solo-friendly July 11 with one other car at the TH, 360° summit views; access road has a washout 1.4 mi from TH, manageable with AWD/4WD. - Mountain Loop — Gothic Basin: well maintained, bugs fine July 11; wildflowers out. Perry Creek: bugs "unpleasant in the meadows" — worth turning around at the creek crossing, which is pleasant for lunch. Mount Pugh: one small snow patch remains at the class-2 summit section. - Rainier — Gobblers Knob: heavy mosquitoes July 11 ("mosquitoes of all thirsts") — defer. Grand Park via Lake Eleanor also flagged for bugs and a muddy approach. Naches Peak Loop (Cayuse Pass): mosquitoes tolerable with wind; wildflowers at peak. - North Cascades / Hwy 20 — Northern State Ghost Town: ripe blackberries and huckleberries on the trail; multiple loop options, good main-trail conditions, family-friendly.

↑ Back to top

THE LAB

GhostLock: A Fifteen-Year Linux Root Exploit, Now Public

Exploit code for CVE-2026-43499 — GhostLock — published on July 8, and any unpatched Linux system now has a five-second path from shell to root for anyone already logged in. Nebula Security, which found the flaw using its VEGA AI-based bug-hunting tool and disclosed it this week, says the exploit is 97% reliable in testing and also breaks container isolation. Google's kernelCTF program paid the team $92,337.¹

The bug is fifteen years old. It lives in the kernel's futex priority-inheritance machinery — code for keeping urgent tasks from getting stuck behind trivial ones. In a narrow race during lock acquisition, a cleanup step fires at the wrong moment and wipes the wrong task's record, leaving the kernel holding a pointer to freed memory. From that stale pointer, Nebula chained a root escalation; the whole path took about five seconds on their test machine. CVSS is 7.8 — high, not critical — because the attacker needs a local foothold. No network exposure, no special permissions, no unusual configuration required.

Patching is not straightforward. The original fix landed in April as commit 3bfdc63936dd, but that patch introduced a secondary crash bug (CVE-2026-53166), and the cleanup for that was still in-flight in early July.¹ Early distribution builds may lack the complete fix. Ubuntu had patched its newest release and some cloud kernels but listed 24.04, 22.04, and 20.04 LTS as vulnerable or in progress as of the disclosure date — verify against your distribution's specific advisory before assuming you're covered. No complete workaround exists; the vulnerable operations are routine for any local process. RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER raise the exploit difficulty but are not substitutes for patching. Prioritize shared machines, cloud instances, containers, and CI runners — the environments where an attacker is most likely to find the local foothold this bug requires.

The "local only" framing undersells the exposure. GhostLock is the second half of a chain Nebula calls IonStack. The first half is CVE-2026-10702, a Firefox flaw that escapes the browser sandbox. Combined, a tap on a malicious link becomes full root in one shot. Nebula has demonstrated this chain on Android via Firefox; a full write-up is coming. That is the real risk model: a kernel privilege escalation that needs a foothold is not safe when a browser exploit provides one for free. In the same week, researchers disclosed Bad Epoll (CVE-2026-46242), a companion flaw in the same stretch of futex code, independently found through kernelCTF, that also elevates an unprivileged local user to root — and unusually for this class, works on Android too.¹ Both bugs were found by automated tooling combing old, well-traveled kernel machinery that had not been seriously reread in years. The tooling changed; the assumptions have not caught up.

Fenris Creations — the company formed when CCP Games' management bought itself back from Pearl Abyss in May 2026 — has open-sourced Carbon, the game engine that has powered EVE Online since 2003. The bulk of it ships under MIT; the GitHub repository is public and accepting pull requests. Ben Hunter, Fenris's Senior Development Director for core technology, told GamesIndustry.biz that the decision came from a simple conclusion reached two and a half to three years ago: "There is nothing special about the source code."²

The practical engineering story is the architectural shift underway alongside the release. Carbon is moving to a plugin model — Hunter explicitly compared it to what Unreal Engine and Unity use — and that layer is planned for open-source release within the next few months. The team used Godot as their governance template for managing a large public project, building sprint-cycle processes for reviewing and accepting PRs before the repository went live. One policy detail worth noting: PR submissions must disclose any LLM use in the code. Fenris is also developing an internal tool gateway for LLM workflows that it plans to release as open source after a stability period. The engine is 23 years in production and carries, as Hunter noted, the security hardening that comes from years of adversaries probing fleet-battle-scale infrastructure.

Wren6991/RISCBoy describes itself as "a Gameboy Advance from a parallel universe where RISC-V existed in 2001," which is accurate. The project is a complete FPGA-based portable game console designed from scratch: a custom RV32IMC soft-core processor (the self-contained hazard5 CPU), a raster graphics pipeline and display controller, bus fabric, memory controllers, UART, SPI, PWM, and a full KiCad PCB layout. All of it synthesizes onto a Lattice iCE40-HX8k FPGA — a part with 7,680 four-input logic elements. The README notes that fitting a 32-bit games console into that budget requires "a crowbar and some vaseline, or perhaps just careful design."

The stack is fully open. FPGA synthesis uses Yosys and the open Icestorm toolchain. The hazard5 CPU passes the RV32IMC compliance suite and the riscv-formal property verification suite, and supports M-mode CSRs, exceptions, and vectored external interrupts. The Rev A PCB fits iTead's 4-layer 5×5 cm prototyping service at $65 for ten boards.³ The project surfaced on Hacker News this week. There is no product, no kit, no crowdfunding — it is an engineer's full-stack love letter to handheld hardware, executed without compromise from gate-level Verilog to PCB copper.

The iroh project's own blog describes Mesh LLM, a distributed inference layer that pools GPUs across machines and presents the result as a local OpenAI-compatible API at localhost:9337.⁴ The transport is iroh — authenticated, NAT-traversing QUIC connections keyed by public key rather than IP address, so "route to a peer" and "stream activations to the next pipeline stage" reduce to the same primitive. For models too large for any single node, a pipeline mode called Skippy partitions by layer range and moves activations between stages over a dedicated ALPN. The source for all of this is the project's own documentation; no independent performance or reliability data is available.

Trending today: the list is dominated by AI agent frameworks, Claude Code skill-file collections, and LLM proxy wrappers — malisper/pgrust and JustVugg/colibri both appear but were covered in recent editions; nothing else on the board cleared the technical-novelty bar.

↑ Back to top

THE PELOTON

Stage 9: ASO Cuts 30km for the Heat; Prudhomme Backs a Salary Cap

↩ Developing story — first reported Jul 09 · previously Jul 10, Jul 11

USSEL, FRANCE — Stage 9 fired off this morning on 30 fewer kilometers than planned, Corrèze having issued a red alert for extreme heat with forecasts topping 40°C in the Massif Central.¹ ASO trimmed exactly that distance from the front of the route and delayed the start, preserving four categorized climbs across 154.6km from Malemort.² Whether cutting the opening flat kilometers meaningfully reduces rider risk when the remaining route still runs straight through the hottest part of the day is a fair question; it is not one ASO is answering.

The surviving profile has the shape of a classic breakaway day: undulating Massif Central terrain, 2,792 meters of climbing, and nothing steep enough to trigger a genuine GC fight. Tim Merlier, who won stages 7 and 8 back-to-back to move within 15 points of green jersey leader Mads Pedersen, was already more than a minute off the back of the peloton by the time Pedersen took the intermediate sprint at Beynat — the 37°C air doing what the climbers could not.¹ Mathieu van der Poel, Filippo Ganna, and German champion Felix Engelhardt moved counter immediately after Beynat; Maxim van Gils, Chris Harper, and Kévin Vauquelin attacked behind. Richard Carapaz latched on to the forming moves with 140km still to run. Lidl-Trek posted nearly their full squad at the front to manage tempo for Pedersen. Just 56 points separated the top five in the points competition going into the stage; the green jersey battle is the most live competition left in this race.

The sprint fallout from Stage 8 hadn't settled before Stage 9 began. Biniam Girmay (NSN) was cited by UCI commissaires for "intimidation during the sprint" in Bergerac after helicopter footage showed him leaning repeatedly into Søren Wærenskjold through the final right-handers. Wærenskjold braked to avoid the barriers and finished 11th.³ He told Norwegian TV2 what he thought: "He pushed like crazy. He bumped into me several times, and he rode like a complete idiot. It is desperate riding." Girmay's account was the inverse: "A guy from Uno-X went into my handlebars. Luckily I saved it, but I lost a lot of speed. That cost me." Uno-X manager Thor Hushovd — ten Tour stage wins, full credibility — reviewed the footage and declined to protest. "It is part of sprinting," he said. Olav Kooij (Decathlon CMA CGM) picked up a second intimidation warning from the same sprint for a separate incident not caught on camera. Both riders now risk a yellow card or relegation on any repeat, and the next bunch sprint doesn't arrive until Stage 11 on Wednesday.⁴

Christian Prudhomme used an interview with The Athletic to put himself on the record for a salary cap. "The three or four richest teams hoover up all the best young riders," the Tour director said. "So that there is real competition, the most promising cyclists need to go to numerous, different teams."⁵ He cited French Top 14 rugby — where a total squad cap of €10.7 million is enforced — and said ASO is "clearly favourable," with discussions underway involving the UCI, riders, and teams. The context is not subtle: UAE Team Emirates-XRG has already claimed three stage wins at this Tour and put Pogačar, estimated to earn around €8 million per year from his team salary, into yellow. Prudhomme named them directly: "They have the means to buy the best riders every year. So it is necessary to rebalance that." He declined to predict a timeline: "I cannot say whether a solution will be found in the coming years."

Paul Seixas arrived at the start in Malemort wearing an ice vest and a face mask — heat and infection respectively — for his ninth consecutive racing day. He has never done more than eight in a row before. At 19, he is the youngest rider to contest the Tour in 89 years, and he came in sixth overall at 3:55 back, still wearing bandages on both arms from a crash that ended his Tour Auvergne-Rhône-Alpes campaign earlier this season.⁶ Decathlon CMA CGM directeur sportif Julien Jurdie was candid before the stage: "We are going to discover a new universe with him. We're going to help him so that everything goes well. But it is clear that tomorrow, we will have to be careful." Recovery metrics going into Stage 9 were good, Jurdie said — "all the lights are green." The rest day on Monday gives him a first chance to assess how the body handles uncharted ground.

↑ Back to top

THE LONG READ

Fifteen Years in the Lock: How One Wrong Assumption Haunted Every Linux Kernel

The helper function was written for exactly one situation: a thread blocks on its own, then cleans up after itself. So remove_waiter() always assumed that current — whichever thread happens to be running — was the waiter it needed to clean up. It cleared current->pi_blocked_on and moved on. The assumption was correct every time it was ever called. Until it wasn't.

That single unchecked assumption sat in the Linux kernel's rtmutex code from 2.6.39 through 7.1-rc1 — fifteen years, every distribution, no special privileges required. Nebula Security's VEGA team found it in April, disclosed it to security@kernel.org on April 18, watched it get patched two days later, and published their full technical writeup on July 7 under the name GhostLock (CVE-2026-43499). Google's kernelCTF program paid them $92,337.¹

The bug lives in the intersection of two kernel features that most code never touches simultaneously: PI futexes (priority-inheritance mutexes) and the FUTEX_CMP_REQUEUE_PI operation. The requeue operation exists to let one thread proxy a lock acquisition on behalf of a sleeping thread — a scheduling optimization with a legitimate use case and a subtle invariant. remove_waiter() predates the proxy path. When the proxy path rolls back on a deadlock detection, it calls remove_waiter(), which dutifully clears pi_blocked_on on the wrong thread. The sleeping waiter wakes up with pi_blocked_on still pointing at a stack frame that has already been freed.

Stack use-after-free is harder to exploit than heap UAF precisely because you cannot control the allocator. The freed object is the waiter task's own kernel stack frame from the FUTEX_WAIT_REQUEUE_PI syscall. To place controlled bytes back at that exact address, Nebula's team reached for prctl(PR_SET_MM, PR_SET_MM_MAP, ...). Inside that call, the kernel copies a user-supplied auxv into a fixed-size unsigned long user_auxv[AT_VECTOR_SIZE] stack buffer. The buffer lands at roughly the same stack depth as the freed waiter frame. Lay the auxv out carefully and the overlapping qwords become a forged rt_mutex_waiter — complete with a crafted rb-tree node, a task pointer set to &init_task so chain-walk dereferences stay safe, and a lock pointer aimed at inet6_protos[IPPROTO_UDP] - 8.

The write primitive that falls out of this is constrained but usable: erasing a single-child rb-tree root writes one child pointer into the root slot. Point the fake lock at target - 8 and the erase drops W0_BASE — a pointer into the CPU entry area — into inet6_protos[IPPROTO_UDP]. From there, the kernel expects an inet6_protocol struct. The CEA is writable by unprivileged userspace through saved pt_regs, so Nebula re-sprays it as a fake protocol handler. Sending a loopback IPv6 UDP packet calls through the overwritten handler, pivots the stack, and lands in a short ROP chain. The final write flips the mode bits on core_pattern's ctl_table entry. That sysctl is now world-writable. An unprivileged process writes |/proc/%P/fd/666 %P into it, crashes a helper, and the kernel runs an arbitrary binary as root.

The whole chain runs at 97% stability and completes in about five seconds on the kernelCTF target.¹

What makes GhostLock worth reading slowly is the root cause analysis, not the exploit chain. Nebula's writeup names it plainly: "This is the same shape as many other life-cycle bugs: a function reused by a caller it was never written for."¹ remove_waiter() was correct for its original context. The Requeue-PI path was added later, called the same helper, and nobody — no reviewer, no fuzzer, no static analyzer — noticed that current and waiter->task were now different threads. lockdep missed it too, checking only that a pi_lock was held, not whose.

The fix is minimal: waiter_task = waiter->task before the lock is taken; waiter_task->pi_lock instead of current->pi_lock; waiter_task->pi_blocked_on = NULL instead of current->pi_blocked_on. The fix passes in the owning task explicitly rather than relying on the ambient current. The only documentation of the hazard is a comment added above remove_waiter(): "When invoked from rt_mutex_start_proxy_lock() waiter::task != current !"

There is a mitigation that would have made this unexploitable in the submitted targets: RANDOMIZE_KSTACK_OFFSET. With stack-offset randomization on, the freed waiter frame and the PR_SET_MM_MAP auxv buffer no longer overlap deterministically. The reclaim step becomes a 1-in-32 guess.¹ Both kernelCTF targets left it off. The official mitigation target had it enabled, so this particular reclaim path wasn't used there — but the writeup notes that clone, setsockopt, pselect, keyctl, and other syscalls with large controlled stack locals all offer the same reclaim opportunity, just less conveniently.

The ASLR bypass is worth noting separately. Linux barely randomizes the kernel image text base — roughly 9 bits of entropy. A timing side-channel on the prefetch instruction, combined with some averaging to reject noise, recovers the KASLR slide at near-100% reliability without any privileges. The technique has been in the literature since 2016. On x86 without KPTI the attack works directly; with KPTI, it pairs with EntryBleed to recover the base through the trampoline mapping. After 6.2, the kernel randomized the CPU entry area's virtual address specifically to defeat the CEA-at-fixed-address trick — Nebula's response was to derive the CEA's direct-map alias from the physmap base, which is not independently randomized, so the randomization bought nothing.

Fifteen years is a long time for a bug with a clean exploit chain and no privilege requirement. The full source is in Nebula's open research project. Patch is in Linux 7.1. If your machines run anything between 2.6.39 and 7.0, they are affected.

↑ Back to top

FROM THE ARCHIVE

The Night France Won With Ten Men: July 12, 1998

Pen-and-ink, night stadium, high contrast. A French midfielder stretched horizontal at full extension, boot meeting ball inches off the turf inside a crowded penalty area. Opposing defenders frozen mid-lunge on either side. The goal net behind him billows in thick hatched curves. Floodlights above radiate ruled lines of white against a black sky. The stands are dense cross-hatching — 80,000 silhouettes compressed into a single roaring mass. A single empty patch of pitch in the foreground implies the ghost of an absent player, the gap left by a sending-off. Goalkeeper frozen in the wrong corner, arms too late. Strong left-to-right diagonal, figures lean forward into the frame. Generous white space in the near half of the pitch. No color, no gradients.

At the 68th minute, Marcel Desailly collected his second yellow card and left the pitch.¹ France, already 2–0 on Brazil in the World Cup Final, would have to see out the night with ten men.

They didn't just hold. Patrick Vieira came off the bench at 74 minutes, and somewhere past the 90th, he found Emmanuel Petit in the Brazilian box. Petit slid it home. France 3, Brazil 0.¹

It was July 12, 1998 — 80,000 people inside the Stade de France in Saint-Denis.¹ Zinedine Zidane, 26 and on Juventus's books, had done the damage before halftime: two headers from corner kicks, the first assisted by Petit at the 27th minute, the second by Youri Djorkaeff just before the break.¹ Captain Didier Deschamps, also Juventus, ran a midfield that gave Brazil's 21-year-old Ronaldo no room. Brazil's captain, Dunga, was 34 and spending the season in Japan with Jubilo Iwata.¹ Referee Said Belqola of Morocco ran a controlled match.

Petit and Vieira, who combined for the third goal, were Arsenal teammates. One started, the other came on as a substitute. Together they finished a World Cup Final while France were a man down.

France had not won a World Cup before that night. No host nation had won the tournament since Argentina in 1978.

↑ Back to top

THE FUNNIES

One Wrong Assumption / Shorter Race, Same Sun

*After Pearls Before Swine — on the GhostLock kernel bug: fifteen years of zero bugs, one assumption about who the caller is, and root access in five seconds flat. After Calvin and Hobbes — on Stage 9's heat-shortened route: a child and his tiger discover that cutting 30 kilometers off a 154-kilometer race does not, in fact, shorten the sun.*

↑ Back to top

ALSO NOTED

Also Noted

• OpenAI Head of Safety Exits Amid Safety-Research Reorg — Johannes Heidecke told staff he is leaving OpenAI this week, the third senior departure in days alongside chief futurist Joshua Achiam; safety teams will now report to Mia Glaese as an expanded VP of research and safety, with the move framed as tighter integration between safety and frontier model development at a moment when OpenAI itself has documented "concerning misaligned behavior" in the newly launched GPT-5.6. wired.com Jul 10, 2026
• Sound Transit Sets All-Time Light Rail Record: 309,000 Boardings — The US-Belgium World Cup match on July 6 pushed Sound Transit to a new daily ridership peak, beating the prior June 19 record of 280,000; all six Seattle match days exceeded 200,000 boardings, and June's monthly total of 5.4 million was also a record, marking the first time Sound Transit ran all-day peak service in its history. theurbanist.org Jul 11, 2026
• Geohot Argues Against AI Governance Proposals — George Hotz published a response to "AI 2040" calling the proposed international AI consortium "world government with sci-fi characteristics" and arguing for "Plan L" — locally-aligned AI that executes user requests without refusal — as the only alternative to what he frames as a centralized nanny state that would confiscate compute the way FDR confiscated gold. geohot.github.io Jul 11, 2026
• sqlite-utils 4.1 — Simon Willison released a dot update adding a `--code` option for generating insert rows directly from inline Python, stdin SQL query input via `-`, upsert primary-key inference, and a strict-mode toggle in `table.transform()` — the last feature prompted by Evan Hahn's HN-circulated essay on SQLite strict tables, with two minor issues found by asking GPT-5.6 Sol Codex to manually test its own implementations. simonwillison.net Jul 11, 2026
• Heat Training Is Now a Tour de France Non-Negotiable — VeloNews reports that hazmat suits, saunas, and CORE temperature sensors have become standard Tour prep, with repeated heat exposure triggering a blood-plasma-volume increase and a natural EPO response that boosts hemoglobin mass and VO2 Max — what teams now call "poor man's altitude" — with UAE, Lidl-Trek, and Soudal Quick-Step among the teams using CORE trackers, and a recent EF/CORE study finding that outdoor heat only produces meaningful adaptation when workout intensity is sufficiently high. velo.outsideonline.com Jul 12, 2026
• In Defense of Not Understanding Your Codebase — Sean Goedecke argues against Peter Naur's "programming as theory building" as a universal model, making the case that in large production systems everyone operates with a partially-incorrect theory of the code, that abandoned codebases are revived successfully all the time, and that the practical move is to build a partial theory confidently rather than wait for complete understanding that will never arrive. seangoedecke.com Jul 10, 2026

↑ Back to top

THE QUESTION

Prudhomme Backs a Cap. Who Has the Power to Build One?

Whether professional cycling can actually build the ceiling its own race director now publicly wants is a different question from whether anyone wants one. Christian Prudhomme's endorsement of a salary cap — reported in today's paper — is the clearest signal yet that the sport's establishment considers talent concentration a structural problem, not a byproduct of meritocracy. But endorsements and institutions are different things.

The comparison Prudhomme himself reaches for is French rugby's Top 14, with its enforced squad cap.¹ French rugby operates under a single national federation, sells broadcast rights collectively, and enforces compliance across clubs that all play under French law. Professional cycling's WorldTour is held together by bilateral contracts between teams incorporated across a dozen different countries, riders on individual deals, and an organizing body — the UCI — whose relationship with ASO, the company that owns the Tour, is historically adversarial. There is no collective bargaining agreement. There is no shared revenue pool. There is no mechanism to audit team budgets across nations that don't share a labor code.

A cap needs three things to function: a definition of what counts (which salaries, which staff, which performance bonuses), an enforcement body with genuine authority, and buy-in from the parties who currently benefit from the status quo. On the third point, the teams most likely to resist — UAE, Visma, Ineos — are also the ones whose dominance makes the cap politically necessary. They have no structural incentive to accept a ceiling voluntarily.

The EVE Online story running in THE LAB today offers a useful counter-case. Fenris Creations just open-sourced Carbon, the engine powering EVE for 23 years.² Their reasoning: the competitive advantage of keeping it closed had eroded to the point where openness cost less than secrecy. Voluntary regime change, because the moat had already dissolved.

The question is whether any of cycling's dominant teams ever reach that calculation. In game engines, the moat collapsed because competitors built comparable tools. In cycling, the moat is talent, and talent is zero-sum: a rider contracted to UAE is not riding for Visma. The structure that makes cycling's concentration so durable is the same structure that makes it nearly impossible to dismantle from inside.

That leaves external imposition. Here Prudhomme's position as Tour director matters in a specific way: ASO, not the UCI, controls the race that makes WorldTour teams commercially viable. If ASO attached cap compliance as a condition of Tour entry — or tied it to the discretionary wildcard system — teams would comply or lose access to the only event that pays for their existence. The UCI has broad rule-making authority in theory, but the Tour's commercial leverage is concrete.

Whether Prudhomme is floating a genuine policy direction or a negotiating position isn't clear. He declined to predict a timeline.¹

The question worth carrying today: the Tour director has the leverage, the stated will is there, and the institutional scaffolding doesn't exist. In every other capped sport, the mechanism came first and the compliance followed. In cycling, right now, there is no mechanism. Which part gives, and who moves first?

↑ Back to top