Agents that call tools over a network eventually retry a call they shouldn't have. If the tool isn't idempotent, that retry becomes a duplicate charge, a duplicate email, a duplicate order — quietly, with nothing in the logs to flag it. It's a decades-old distributed-systems problem wearing a new agent costume, and as far as I could tell, nobody had shipped a small, pip-installable fix for the agent-shaped version of it. So I built one. It's called latch . Worth saying up front: this is not a novel idea, and I'd rather say so myself than have someone point it out in the comments. The bug, live Here's the whole thing in one file, no library involved: def charge_card ( order_id , amount ): time . sleep ( 0.4 ) # the payment API is a little slow today ledger [ order_id ] += 1 return { " order_id " : order_id , " status " : " charged " } def agent_charge_with_naive_retry ( order_id , amount , max_retries = 2 ): for attempt in range ( max_retries ): thread = threading . Thread ( target = lambda : charge_card ( order_id , amount )) thread . start () thread . join ( timeout = 0.2 ) # the agent's own client-side timeout if thread . is_alive (): continue # "no response, let's retry" return # got a response The payment call takes 0.4s. The agent gives up waiting after 0.2s and retries. The first attempt is still running in the background — it wasn't cancelled, it can't be safely cancelled, Python threads don't work that way. So it finishes on its own time and charges the card. Then the retry charges it again. The agent's own view of the world is "everything's fine, got a response eventually." The ledger says otherwise. This is examples/naive_agent_example.py in the repo, if you want to run it and watch it happen rather than take my word for it. None of this is exotic. It's the same class of problem as "what happens when a payment gateway's webhook fires twice," which every backend engineer who's touched Stripe has dealt with. The fix has a name — idempotency keys — and it's b

If you have written enterprise Java in the last 20 years, you know the name Rod Johnson. He created Spring Framework back in 2003 - the thing that made Java dependency injection feel natural instead of like wrestling XML. Spring basically rewrote how enterprise Java works. Johnson stepped away from active Spring development years ago. But in early 2026, he returned - and he did not come back to build another IoC container. He built Embabel. An AI agent framework for the JVM. And it works nothing like Spring AI or LangChain4j. I have been running AI agents on my own VPS for months. Hermes Agent, Claude Code, custom MCP servers - the works. So when I heard Rod Johnson was back with a Java AI framework, I paid attention. Here is what I found. Spring AI and LangChain4j Are Great - but They Solve a Different Problem Over the last year, most Java developers entering AI have gravitated toward two frameworks: Spring AI - brings LLM integration into the Spring ecosystem LangChain4j - a Java port of LangChain's agent/tool patterns Both are excellent at what they do. You can build chatbots, RAG pipelines, tool-calling assistants, and AI-powered APIs in a few lines of code. But both treat the LLM as the center of the application. You send a prompt. The model responds. Maybe it calls a tool. Then it responds again. For question-answering or chat interfaces, that is fine. But what if you want the system to: Create a multi-step plan before taking any action Run for 10 minutes, not 10 seconds Check its own work and retry if it failed Coordinate multiple agents working on different parts of a problem This is where the chatbot pattern breaks down. And this is exactly what Embabel targets. What Is Embabel? Embabel (pronounced em-BAY-bel) is a framework for building goal-oriented AI agents on the JVM. It is written in Kotlin and works naturally from Java. It sits on top of Spring AI - Johnson described the relationship as "Spring AI is to Embabel as the Servlet API is to Spring MVC" [

1. Introduction Hello from Japan! 🇯🇵 I am an active truck driver in Japan self-studying Python, leveraging my logistics domain knowledge to become a Web Engineer. (English is my second language, but I'm excited to share my journey with developers around the world!) I started my self-study journey on May 12, 2026. In this article, I summarize the process of deploying Ruby on Rails 8 to a PaaS (Render Free Tier) and how I tackled the strict resource constraints I ran into. Check out my GitHub here👈️ (Note: Most repository documentation and commits are currently in Japanese.) 2. Environment Development : Lenovo G580 (Lubuntu 24.04 LTS / 16GB RAM / Upgraded SSD) Production : Render (Free Tier: 512MB RAM) Testing Device : Xiaomi 15T 3. Challenges & Solutions ① Git Repository Structure Inconsistency Issue : An unnecessary .git directory existed inside a subdirectory, causing errors during deployment. Solution : Deleted the nested .git directory to restore repository hierarchy integrity. ② Build Failure via Render Free Tier RAM Limit (512MB) Issue : Executing asset compilation on Render triggered Out-Of-Memory (OOM) crashes, forcibly killing the build process. Solution : Precompiled assets locally and committed the static files to the repository, significantly reducing memory usage on the production build server. ③ SQLite3 Write Permission Error Issue : Encountered database write permission errors during CRUD operations in production. Render's file system is read-only by default, except for designated directories (such as storage/ ). Solution : Updated config/database.yml to direct the SQLite3 database file to a path with write permissions (e.g., under storage/ ). 4. Conclusion By applying these workarounds, I successfully verified the deployment and operation of a Rails 8 application on Render's Free Tier. (Please note: Although production runtime works properly, because the setup prioritizes local configurations, some automated CI tests on GitHub currently report errors.

The extended pause will give time to hear cases for blocking the deal from states and the WGA.

Context-aware break reminders without invasive permissions Discussion | Link

I spent last month reviewing JWT implementations across 12 open-source Node.js projects on GitHub — ranging from starter templates with 2k stars to production boilerplates used by teams at real companies. I found the same 6 mistakes in almost every one. None of these projects are bad. The developers are skilled. The mistakes are subtle, copy-paste errors from tutorials that nobody questioned. Here they are. Mistake 1 — The Secret Is Literally "secret" I found this in three separate projects: const token = jwt . sign ({ userId : user . id }, " secret " , { expiresIn : " 1h " }); This secret is in every JWT tutorial on the internet. It is in the jwt.io documentation. It is in the jsonwebtoken README. Developers copy it and forget to replace it. A 6-character ASCII secret has approximately 42 bits of entropy. A GPU cluster cracks it from a dictionary in milliseconds. Generate a real secret here — it takes 3 seconds and produces a 256-bit cryptographically random key. Mistake 2 — jwt.decode() Used in Auth Middleware // DANGEROUS — this is in a production auth middleware const decoded = jwt . decode ( req . headers . authorization . split ( " " )[ 1 ]); if ( ! decoded . userId ) return res . status ( 401 ). send ( " Unauthorized " ); jwt.decode() does not verify the signature. It reads the payload regardless of whether the token is valid, expired, or forged. An attacker can craft any payload they want and it will pass this check. The fix is two characters: jwt.verify() . const decoded = jwt . verify ( token , process . env . JWT_SECRET , { algorithms : [ " HS256 " ] }); Mistake 3 — Algorithm Not Specified in verify() // Missing algorithms option jwt . verify ( token , secret ); Without { algorithms: ['HS256'] } , the library trusts whatever algorithm is in the token's header. An attacker can create a token with alg: none and an empty signature — and jwt.verify() will accept it. Always specify the expected algorithm explicitly. Mistake 4 — Secret Committed to Version Cont

When I started programming, Git was hard for me — like anything new is at first. Over time I noticed something: most of the best resources for learning it are in English. And for a lot of people just starting out, that's one more obstacle they shouldn't have to deal with. So in my spare time I built the thing I wish I'd had back then: Commitea . What is it? Two pieces, designed to complement each other: An open source repo with the full documentation in Spanish — from what a commit actually is, to how to get yourself out of trouble with rebase , a cherry-pick , or a push you regret. Every entry follows the same format: the concept in one sentence, a real example with commands, and "how this breaks" (the typical mistake people make). A web app with an interactive visualizer ( commitea-web.vercel.app ) where you type real Git commands and watch, live, what happens to the branch/commit graph. It doesn't touch any real repo — it's an in-memory simulator, but the engine actually replicates real Git behavior: fast-forward vs. merge commit detection, history rewriting on rebase, blocking a branch switch when you have uncommitted changes (just like real Git does), etc. What's in it right now 7 built-in scenarios you can run with one click and watch play out step by step: branch + merge, fast-forward, rebase, cherry-pick + reset --hard, fixing a commit made on the wrong branch, several branches merging in sequence, and stashing changes. Full command support : branch , checkout , commit , merge , rebase , cherry-pick , reset --hard , stash (with an edit helper command to simulate uncommitted changes, since the simulator has no real filesystem), status , and log . Site-wide search (⌘K), powered by Pagefind, indexing only the actual article content — not nav or boilerplate. A feedback widget on every article ("was this helpful?") that stores vote counts in Redis, so I know which content needs work without guessing. Light/dark mode , respecting system preference by default. A ch

The contract between the two companies ends in May 2028, Uber told TechCrunch.

Big Tobacco studied nicotine analogs like 6-methyl-nicotine for decades but never marketed them. Now, Chinese vape makers are using them to sidestep US regulations.

This was not supposed to become a product. When PaddleOCR-VL-1.6 dropped, independent benchmarks put it at the top of document parsing models. I had to try it. I needed a provider, but there simply isn't one ready for production that I would trust. So i set one up myself. I assumed that even after getting it running, serving a vision-language model would be expensive. It turns out the opposite is true. Once I had it running properly, the cost was absurdly low. At proper GPU utilization, the cost

The indictment, which was unsealed Friday, alleges the Volkswagen engineers used confidential insider information to buy stock in Rivian.