Hi HN! I've been working on Bor, an open-source system for centralized Linux desktop management. Bor consists of a lightweight Go agent and a central server. Policies are streamed to clients over mTLS/gRPC in real time—no polling—and currently support Firefox, Chrome, KDE, dconf, polkit and package management, with more coming. Version 0.8 introduces several new policy types - Thunderbird, Microsoft Edge for Business and FirewallD zones, along with a number of improvements and fixes. I'd love fe

Finding the right API project ideas is one of the fastest ways to turn a thin resume into a portfolio hiring managers actually stop to read. Building and consuming APIs proves you understand authentication, data modeling, error handling, and the kind of real-world messiness that tutorials tend to skip. This list covers eighteen projects ranked roughly by difficulty, from weekend builds to systems worth putting at the top of your GitHub profile. Why API Projects Move the Needle A to-do list app tells an employer you can follow instructions. An API project tells them you can design a system. Every API you build forces decisions about status codes, rate limiting, pagination, and versioning — the exact vocabulary that shows up in technical interviews. Consuming third-party APIs adds a second skill: reading documentation, handling flaky responses, and caching data so you're not hammering someone else's server on every page load. The projects below split into three buckets: building your own API from scratch, consuming an existing API to create something useful, and full-stack projects that do both. Pick a few from each bucket rather than eighteen shallow clones of the same idea. Beginner Builds: Your Own First APIs Start by designing and shipping a REST API before you touch anyone else's data. A personal blog API with endpoints for posts, comments, and tags teaches CRUD operations and basic authentication without much domain complexity. A recipe box API that stores ingredients, steps, and cook times works well because the data model has natural relationships worth practicing on. A habit tracker API, where users log daily check-ins against goals, adds a light analytics layer once you start returning streaks and completion rates. Here's a minimal example of what a habit tracker endpoint might look like in Express: app . post ( ' /habits/:id/checkins ' , async ( req , res ) => { const { id } = req . params ; const { date } = req . body ; const habit = await Habit . findById

When I published v2.0.0 , I thought the hard part was over. The CLI could turn Claude artifacts into native Windows applications in a single command. It worked on my machine, the demos looked great, and I was excited to share it. Then people started using it. That's when I realized the difference between building software and shipping software . The bugs only users can find Most of the problems weren't visible in a five-minute demo. Some applications worked perfectly. Others silently lost all of their data after being closed. Some builds succeeded exactly once. The second build failed unless the runtime cache was manually deleted. Everything looked correct... until someone actually tried using it. The rabbit hole What I thought would be a quick patch became a deep dive into things I'd never touched before. Over the course of v3 I ended up learning far more than I expected: Git branching and release workflows Semantic versioning GitHub Actions npm packaging npm pack Runtime integrity verification SHA-256 checksums Neutralino runtime management JavaScript debugging Integration testing None of those were part of the original project idea. Persistent storage finally works This was the biggest challenge. Artifacts using localStorage behaved differently depending on where they were running. Inside Claude everything worked. Inside the generated desktop application... not always. Tracking this down took far longer than writing the original feature. The result is that applications now persist their data correctly across launches without requiring any code changes. If your artifact uses localStorage , it should simply work. Runtime improvements The runtime layer also received a major overhaul. Version 3 now handles: automatic runtime downloads integrity verification cache recovery consecutive builds without manual cleanup Those aren't exciting features to demo, but they're exactly the kinds of improvements that make a tool feel dependable. Better testing I also spent a lot mo

Yesterday, backend-reviewer inspected pull requests with one model, read only the repository and public documentation, and stopped for human approval before proposing any change. Today it has exactly the same name. The model has changed, the system instructions have been rewritten, incident history is now available as a context source, memory persists between tasks, and database migration changes no longer require approval before they are proposed. The dashboard still shows the same team member. The engineer responsible for quality and risk is looking at a different agent. The identifier stayed. The behavior moved. That distinction is what NexFlow , an open specification for AI developer teams, is trying to make visible. The project does not currently provide a production runtime, a production CLI, or model-provider integrations. Its present job is narrower and, in my view, more important: give teams a language for reviewing agent changes before anything executes. A name answers the wrong question Agent names are useful to people. They distinguish a code reviewer from a documentation writer and establish a long-lived role inside the team. A name says very little about the configuration that produced a particular result. A model change can affect code quality, cost, latency, and the way uncertainty is handled. New instructions alter the order of analysis and the criteria for an acceptable answer. An additional source expands both available knowledge and the exposure surface. Memory carries the consequences of one task into another. A new permission changes more than output style: it changes what an error can damage. For audit purposes, “Which agent did the work?” is therefore incomplete. A second question matters just as much: which version of that agent's definition was active? In draft RFC-0004 , NexFlow separates stable agent identity from a versioned agent definition. Identity contains the role, description, and long-lived responsibility. The definition captures

How do you actually test an AI agent? Not "does it respond," but: does it route to the right tool, chain calls correctly, recover from failure, resist prompt injection, and stay within cost/latency budget? I spent weeks working through this on a running agent, and open-sourced the entire methodology — framework-agnostic , so it applies regardless of your language, runtime, or toolset. What's inside •⁠ ⁠ 61-source benchmark map — BFCL, GAIA, τ-bench, SWE-bench, WebArena, AgentDojo, LongMemEval and more, categorized by what they actually measure •⁠ ⁠ 58 universal test blocks across 7 tiers (L1–L4, Error Recovery, Multi-Turn, Security). Each block = a tool-agnostic capability definition + a concrete reference implementation •⁠ ⁠ Full OWASP Top 10 for Agentic Applications 2026 (ASI01–ASI10) mapped to 6 universal security test blocks •⁠ ⁠ Evaluation methodology — LLM-as-Judge biases, pass@k vs pass^k, trajectory vs end-state, observability (OpenTelemetry GenAI), automated red-teaming (garak, PyRIT, DeepTeam) •⁠ ⁠ Regulatory alignment — NIST AI RMF, MITRE ATLAS, EU AI Act, ISO/IEC 42001 How to use it Take Part II, replace the reference-implementation fields with your own agent's tool names and expected outputs. The universal capability definitions need no changes. Blank templates are included. PheronAgent (a macOS agent with 50+ native/MCP tools) is included as a real reference case study — but the methodology is the product, not the agent. No marketing narrative: ⁠ STORY.md ⁠ documents the real bugs, real test runs, and real corrections that shaped each version. Docs are CC BY 4.0, templates are MIT. Issues and PRs welcome. 👉 https://github.com/trgysvc/AgentTestMethodology

AboFlah talks about his new goals, streaming for charity, and when it’s time to log off.

You've learned not to trust the first answer. So you read it carefully. You spot two problems. You fix them yourself, ship it, and move on. That's a reasonable way to work, and it's what separates an engineer who uses these tools well from one who copies and pastes. But there's a step you skipped. You never asked Claude to find the problems, and asking produces a different kind of output than reviewing does. 🔍 What actually happens Here's a specific case. You ask for an incremental load. You get something clean: a watermark column, a filter on records newer than the last run, an upsert into the target. You review it. You notice it assumes source records arrive in order, which yours don't, so you add a buffer window. You notice it doesn't handle the first run when the watermark is null, so you add a default. Two fixes, maybe fifteen minutes, and now it's correct. What you didn't find was the third problem: the upsert assumes a stable business key, and in your source system that key gets reassigned when records are merged. That one surfaces in production six weeks later as duplicate rows nobody can explain. You caught the problems you were looking for. You didn't catch the one you weren't. This is the normal outcome of self-review. You check against your own mental list of things that go wrong, and your list is good but finite. The problems that hurt are the ones outside it. 🧠 Why intermediates specifically miss this Beginners don't review AI output much at all, so this isn't their failure mode yet. Seniors have usually developed the habit after being caught out by something their own review missed. Intermediates sit in an awkward middle. They have learned, correctly, that AI output needs questioning. And they have concluded, understandably, that the questioning is entirely their job. That conclusion makes sense. Reviewing is what you do with a junior's pull request. It's what you do with your own code before you push. Review is a human activity performed on work some

The problem is not the code I build Flutter apps. A normal feature touches four layers at once. Models and json parsing Repository and API client State management Screens and widgets When I ship that as one branch, the pull request is somewhere between 1,000 and 4,000 lines. And then one of two things happens. Either the reviewer opens 40 files, scrolls for ten minutes, and writes "looks good". That is not a review. That is a signature. Or the reviewer does the job properly, takes three days, and leaves a comment on the models file. Now every screen above it has to change. The writing was fast. The review was slow. That is the real bottleneck. The old workaround You already know it. Split the work into branches yourself. git checkout -b feat/booking-models git checkout -b feat/booking-repo # branched off models git checkout -b feat/booking-state # branched off repo git checkout -b feat/booking-ui # branched off state This works for about one day. Then a reviewer asks for a change in feat/booking-models , and you rebase three branches by hand. Then it happens again. Most people give up and go back to the giant branch. What stacked pull requests change On July 30 2026 GitHub put stacked pull requests into public preview. The idea is small. A stack is an ordered series of pull requests. Each pull request targets the one below it instead of targeting main . Only the bottom one targets main . PR #4 screens and widgets -> targets PR #3 PR #3 cubits and state -> targets PR #2 PR #2 repository and api -> targets PR #1 PR #1 models and parsing -> targets main Because each pull request only contains its own layer, opening PR #3 shows you the state management diff and nothing else. Not the models. Not the widgets. The Flutter example Say I am building a booking flow. Here is the same feature, sliced. PR 1 - models and json parsing. Around 190 lines. Targets main. class Booking { final String id ; final DateTime startsAt ; final BookingStatus status ; const Booking ({ required

submitted by /u/CGM [link] [留言]

I wrote this after noticing a recurring pattern across interfaces, component systems, ECS, domain entities, and distributed systems: an object’s state, capabilities, and implementation can change while its identity remains stable. I’d be interested to hear how others model identity separately from representation and where this distinction stops being useful. submitted by /u/CoronatedOrange [link] [留言]

Hi HN, TamedTable is an LLM harness for data ETL. And yes, it was developed using AI, meaning you can take the entire specification and recreate it to your desires: https://github.com/ZSvedic/TamedTable

New EU rules stipulate that people must be told when they’re interacting with AI or looking at AI-generated or -edited content, leading to fear of “disclosure fatigue.”