AI 资讯

Build AI agents, workflows, and apps in one stack Discussion | Link

Your payment tests passed in staging. Then PhonePe pushed an SDK update on Tuesday, the UPI intent...

submitted by /u/ruurtjan [link] [留言]

Here's something that'll keep you up at night: 67% of World Cup 2026 goals in the 85th+ minute came from teams that were losing at the time . That's significantly higher than the 43% rate we saw in the 70-80 minute window. This single statistic reveals a hidden pattern in how desperation fundamentally rewires attacking strategy when the clock ticks down to the final whistle. As someone who's spent the last three months drowning in World Cup 2026 broadcast data, match statistics, and possession metrics, I've become obsessed with understanding how pressure affects team behavior in those nail-biting final minutes. The conventional wisdom says that late-game goals are chaotic, desperate, and unpredictable. But the data tells a much more interesting story—one about tactical discipline collapsing under psychological weight. The Numbers Behind the Drama Let me walk you through what we found when analyzing 64 matches from the 2026 tournament across 16 days of group stages. Time Period Total Goals Avg. Pass Completion % Shots on Target Defensive Errors 0-30 min 24 82.3% 18 3 30-60 min 31 81.7% 26 5 60-75 min 28 79.4% 24 8 75-85 min 19 76.8% 22 12 85-90 min 18 71.2% 19 18 90+ min (stoppage) 14 68.9% 16 22 Notice the decline? By the 85-90 minute window, pass completion drops to 71.2%—that's an 11-point deterioration from the opening 30 minutes. But here's where it gets weird: defensive errors triple in that same window. Teams aren't just playing sloppily; they're making genuinely catastrophic mistakes. Team-Specific Patterns: The Pressure Responders Not all teams crack under late-game pressure equally. Here's where the real story emerges: Team 85+ Min Goals Scored 85+ Min Goals Conceded Goal Differential Win Rate (Tight Matches) Argentina 6 2 +4 85% France 5 3 +2 72% Brazil 7 4 +3 81% England 3 5 -2 58% USA 4 6 -2 62% Morocco 5 2 +3 79% Japan 2 7 -5 41% What jumps out immediately? Argentina and Brazil are outliers . They scored 13 combined goals in the final 5 minutes but conc

A few months ago I was demoing my RAG-powered support bot to a colleague, feeling pretty confident about it. Then it confidently told her our refund policy was “30 days, no questions asked.” Our actual policy is 14 days, with conditions. The bot didn’t hedge. It didn’t say “I’m not sure.” It just made it up and said it with the same calm tone it uses for everything else. That demo stung. RAG was supposed to fix hallucinations, not just relocate them. Here’s what I learned debugging it, roughly in the order I learned it. 1. My chunks were too big, and too dumb I was splitting documents by character count, 1000 chars with slight overlap. It felt efficient. It wasn’t. A single chunk often contained unrelated sections. For example, the end of a “Shipping Policy” and the start of a “Returns Policy” could sit together in the same block. So when the retriever saw a query about returns, it would grab that chunk and the model would blend both sections into one confident but wrong answer. Fix: I switched to semantic chunking based on headings and paragraphs instead of raw character limits. More work upfront, but it stopped feeding the model Frankenstein context. 2. I trusted top-k similarity way too much My retriever was pulling the top 3 chunks by cosine similarity and passing them straight into the prompt. The problem: “similar” is not the same as “relevant.” A chunk can be semantically close to the query but still not actually contain the answer. The model doesn’t know that, it just assumes everything in context is true. Fix: I added a reranking step using a cross-encoder and started logging retrieval scores properly. That alone made it obvious when the system had no real answer but was still trying to act confident. 3. I never told the model it was allowed to say “I don’t know” My prompt was basically: “Use the context to answer the question.” That’s it. No instruction on what to do when the context is insufficient. So the model did what LLMs do when under-specified: it f

Most organizations know exactly how many employees they have. Far fewer know how many non-human identities currently have access to their cloud environment. That blind spot is becoming one of the fastest-growing attack surfaces in modern security. For years, enterprise security focused primarily on protecting human identities. We deployed Single Sign-On (SSO), enforced Multi-Factor Authentication (MFA), and implemented Conditional Access policies. And it worked — human identities have become significantly harder to compromise. Meanwhile, another class of identities has quietly exploded across cloud environments: service principals, workload identities, OAuth applications, CI/CD runners, and AI service roles. Today, these Non-Human Identities (NHIs) often outnumber human users by a factor of 10 to 50. As organizations accelerate cloud adoption and integrate AI into daily operations, this imbalance continues to grow. Defining the Non-Human Identity Landscape Unlike human users, machine identities rarely appear in HR systems or organizational charts. Yet they frequently hold some of the most privileged access in the environment. Common high-risk categories include: OAuth Applications and Third-Party Integrations — Apps granted broad access to Microsoft 365, Salesforce, Google Workspace, or Slack via delegated permissions. Service Principals and Managed Identities — AWS IAM roles, Azure Managed Identities, and GCP service accounts used by Lambda functions, EC2 instances, or Bedrock agents. Workload Identities — Kubernetes Service Accounts (e.g., Amazon EKS) and GitHub Actions OIDC roles. CI/CD Pipeline Identities — Tokens used by automation platforms to deploy infrastructure. AI Service Roles — Dedicated identities for Amazon Bedrock agents, model invocation, vector stores, and retrieval pipelines. Every new AI workflow creates additional machine identities. Why Attackers Are Targeting NHIs Attackers follow the path of least resistance. While human accounts are now heav

Software has become the backbone of modern business operations, powering everything from customer-facing applications and e-commerce platforms to enterprise systems and cloud-based services. Behind every successful software product is a well-structured development process designed to ensure quality, scalability, security, and long-term maintainability. The Software Development Process, commonly referred to as the Software Development Life Cycle (SDLC), provides a systematic framework for transforming ideas into reliable software solutions. By following a defined methodology, organizations can reduce risks, optimize resources, improve collaboration, and deliver products that align with business objectives. This article explores the key stages of the software development process and highlights why each phase is essential to successful project delivery. What Is the Software Development Process? The software development process is a structured sequence of activities involved in designing, building, testing, deploying, and maintaining software applications. It serves as a roadmap that guides development teams from initial requirements gathering to ongoing support after deployment. A well-defined development process helps organizations: Improve project predictability and delivery timelines Reduce development and maintenance costs Enhance software quality and reliability Strengthen security and compliance Increase customer satisfaction Facilitate collaboration across teams Whether developing a small business application or a large-scale enterprise platform, a structured process is critical for achieving sustainable success. _ Phase 1: Requirements Gathering and Analysis_ Every successful software project begins with a clear understanding of business needs and user expectations. During this phase, stakeholders, business analysts, project managers, and development teams collaborate to identify: Business objectives Functional requirements Non-functional requirements User expe

In a recent audit, a team showed me an AI assistant they'd built on top of their company knowledge base. The demo had landed well: ask how to use a feature, and it walked through the exact pain point their support queue kept seeing. Leadership signed off. In production, the same agent told a user to open a menu option that didn't exist. Not a vague answer - a specific UI path, stated with confidence. Nobody caught it in testing. It surfaced when I audited the system, not when a user complained. The prototype passed testing because nobody was checking whether the answer matched the product. In production, that gap becomes a liability: the model invents UI paths, and your backend has no schema to reject them. When you're choosing an agent framework, popularity is the wrong scorecard. Pick the one that fails loudly in development and gracefully in production - or you'll find out in audit. What "Production-Ready" Actually Requires Tutorial agents are built to impress in a fifteen-minute demo. Production agents run unattended, handle bad inputs, and ship answers your backend has to trust. The gap between those two goals is where most teams stumble - and it's rarely visible until something reaches a user. When I audit agent codebases, I evaluate five things the tutorials skip: Structured, validated outputs: Can your system reject an invented menu path before it becomes user-facing advice? Dependency injection for testing: Can you swap the knowledge base for a mock in CI without rewiring the agent? Retry and error handling: When the model returns malformed output, does the framework retry - or do you ship a parser exception? Observability hooks: Can you trace which document grounded a bad answer when support escalates? Type-checker support: Will static analysis catch a breaking API change before deploy, or after the agent silently misbehaves? If you want to score your own system, the Production Readiness Audit covers the same five categories - deployment, observability, fa

Chrome has had scroll restoration support since 2015. You can even control it: history.scrollRestoration = 'manual' . But if you've ever tried to reliably restore a user's position on a React or Next.js app, you know it doesn't work the way you'd expect. Here's what breaks, why it breaks, and how a browser extension can sidestep the entire problem. What the Browser Actually Does The default behavior is history.scrollRestoration = 'auto' . When you navigate back to a page, the browser tries to scroll to where you were. This works fine for static pages. It falls apart for: SPAs where content is injected into the DOM after navigation Infinite scroll pages where the content at a given Y position changes depending on what was previously loaded Lazy-loaded images that push content down after the scroll restore fires The fundamental problem: the browser fires scroll restoration when the page HTML is parsed, not when the page content is fully rendered. A React app that loads a skeleton → fetches data → renders actual content will restore scroll into a partially-rendered DOM. The history.scrollRestoration = 'manual' Trap If you set manual , you own scroll restoration completely. Most Next.js apps do this. The typical approach: // Save position before navigation router . beforeEach (( to , from ) => { savedPositions [ from . path ] = window . scrollY ; }); // Restore after navigation router . afterEach (( to ) => { const position = savedPositions [ to . path ]; if ( position !== undefined ) { nextTick (() => window . scrollTo ( 0 , position )); } }); The nextTick is the problem. It fires after the Vue/React render cycle, but before async data fetching completes. The page renders empty containers, scroll restores to Y=800, then data loads and pushes everything down. User ends up at Y=800 in a now-different page position. The correct fix is to wait until the content that was at Y=800 actually exists. There's no clean hook for this — you'd need to observe the DOM until the expec

This is a submission for the June Solstice Game Jam I've been in online queer communities for a long time, and one thing that's always stood out is the endearing obsession with pop culture. The artists, the music, the fashion, the references. Every form of art gets appreciated, deeply analyzed, and celebrated. Diva Academy is an attempt to reflect that energy and honor Pride month and the pop culture that comes with it. What I Built Diva Academy is a pop culture trivia adventure. You play as a fresh face entering a campus where the currency is knowledge. The questions cover everything from ballroom culture and drag history to Beyoncé's discography and the origins of the Pride flag. The game runs in sessions: NPCs challenge you to timed trivia battles. Reach your REP(utation) goal to win, or hit zero and you're out. Earned REP converts to permanent currency between sessions, making it a rogue-lite-lite-lite experience where you gradually get stronger even when you lose. The game is built with vanilla HTML5 Canvas, CSS, and JavaScript. It features: 6 explorable rooms 4 NPC tiers - Starlet , Diva , DJ , and Mother - each with distinct personalities and increasing difficulty A rival system where a recurring NPC named Vex Vivienne spawns across the map and hunts you down A permanent perk system where REP earned in each run converts to permanent currency for buying perks like Grace (forgive one wrong answer), Clutch (survive at 0 REP once), and Haste (extra time on the timer) A Spotlight mechanic - defeat a Diva-tier or higher NPC and you earn a one-time 1.5x REP buff for your next face-off Two minigames - Hangman (guess the pop star name) and Pop Connect (link two artists through a mathematically perfect, AI-grounded collaboration graph with look-ahead validation) The Turing Challenge - Archivist Alan tests your ability to distinguish real pop culture quotes from AI-generated fabrications A customization system that unlocks new dress and hair colors as you defeat NPCs An

I did not choose DeepSeek because I think GPT-4 is bad. I chose it because I was building a free app, and free apps teach you what actually matters pretty fast. The question was simple: how do I keep sessions cheap enough that people can practice a lot without me lighting money on fire? The answer pushed me toward DeepSeek-V3 (and later R1 for specific tasks). The real constraint was volume The app is a conversation practice tool. People come in to rehearse hard talks, not to admire the model. A single practice session runs 8-15 turns. Each turn is roughly 300-600 tokens in, 100-300 out. Multiply that by five sessions a week per active user and the costs start compounding. Here is what the math looked like when I was choosing (mid-2026 pricing): Model Input cost (per 1M tokens) Output cost (per 1M tokens) Cost per 10-turn session (est.) GPT-4o $2.50 $10.00 ~$0.04-0.06 GPT-4 Turbo $10.00 $30.00 ~$0.12-0.18 DeepSeek-V3 $0.27 $1.10 ~$0.004-0.007 DeepSeek-R1 $0.55 $2.19 ~$0.008-0.012 At scale, the difference between $0.005 and $0.05 per session is the difference between running a free product and needing a paywall after three conversations. I wanted people to come back daily without hitting a wall. What DeepSeek handled well It stayed in character for 10-15 turns. It pushed back when the user got vague. It followed persona heuristics (numbered if/then rules in the system prompt) about as reliably as GPT-4o did for our use case. For salary negotiation rehearsal, the model needs to say "that's not in the budget" and hold that position for three more turns while the user tries different approaches. DeepSeek-V3 did this. Not perfectly, but reliably enough that sessions felt real. It also made the app easier to run as a free product. People can try, fail, reset, and try again without me worrying about per-session cost. Where GPT-4 was still better GPT-4 (and 4o) is smoother with nuanced emotional wording. When a conversation gets subtle, loaded with subtext, or requires pick

The trajectory of AI agents over the past two years has been remarkably clear: from single-purpose tools to personal assistants. Everyone runs their own agent, feeds it tasks, gets results back. It works well for individual productivity. Then comes the question every team eventually asks: can these agents work together? The answer is yes, but the problems you encounter along the way are rarely the ones you expected. They aren't about model capabilities or prompt engineering. They're about communication, context, and coordination — the same class of problems that distributed systems engineers have been solving for decades, now showing up in a new form. Here are three challenges that caught us off guard when we started building agent collaboration into Octo , an open-source workplace platform where AI agents and humans share the same communication space. Challenge 1: Context Visibility Boundaries When you use an agent personally, context management is straightforward. You decide what information the agent sees; its output comes back to you. The boundary is clean — it's just your workspace. In a team setting, that boundary dissolves. One of the first issues we ran into was surprisingly simple. We had an agent summarizing discussions across several channels. During testing it started pulling roadmap discussions from a product channel into an engineering planning thread. Nothing sensitive leaked externally, but it immediately exposed how unclear our context boundaries were. Traditional software handles this through API gateways, data permissions, and microservice boundaries. But agent context isn't just structured data — it includes conversation history, reasoning chains, and intermediate states. An agent's thought process during a task is valuable context, but it might also contain information that shouldn't cross team boundaries. What you need is fine-grained context visibility control. Not "everything open" or "everything closed," but dynamic rules that determine whic

Debugging authentication in web apps is painful. You need to test the same flow as five different user types — new visitor, returning user, admin, expired session, logged-out — and the easiest way is to constantly create new accounts or clear all your cookies and start over. There's a faster way. These five techniques use direct cookie manipulation to simulate any auth state without touching your database or creating dummy accounts. I use CookieJar for most of this — a free Chrome extension built natively on MV3 that gives you a proper UI for cookie editing. But I'll show you the underlying Chrome DevTools method too, so you understand what's actually happening. 1. Simulate a Logged-Out State Without Clearing Everything The naive approach: clear all cookies and reload. The problem: you just nuked your dev server session token, your local storage flags, your Stripe test mode cookie, and everything else you carefully set up. The targeted approach : identify and delete only the session/auth cookie. Most session cookies are named session , sid , auth_token , _session_id , or something close. In DevTools: Application → Cookies → [your domain] → find the session cookie → right-click → Delete With CookieJar: open the extension, search session , click the trash icon next to just that cookie. Your dev environment stays intact. The user state resets to logged-out. 2. Test the "Returning User" vs "New User" Path Without a Second Account Session cookies tell the server you're authenticated. But many apps use separate cookies to track whether a user has seen the onboarding flow, completed setup, or visited before. Look for cookies like onboarding_complete , setup_done , first_visit , or custom flags in your app code. To test the new user experience: Export your current cookies (CookieJar → Export → JSON format, or copy from DevTools) Delete the specific onboarding/first-visit flag cookie Reload and test the new user path Re-import or re-set the cookie to restore your state This

Claude Opus 4.7 shipped last week, and the question any engineering team reaches for is how it compares to its peers. It is the strongest frontier coding model we tested on the baseline leaderboard, and it will be the easy default a lot of teams reach for. But in 2026, the model you reach for could matter less than the skill you load with it. That is what 880 evals across nine models (Opus 4.7, Opus 4.6, Sonnet 4.6, Haiku 4.5, gpt-5.4, gpt-5.3-codex, gpt-5-codex, and Cursor's Composer-2) tell us. Let’s take a step back. It’s now 2026, and agent skills are spreading like wildfire… (even our favourite movies are catching up to them). Watch on YouTube Every major agent ecosystem now has some version of them. So the question worth asking, whether you are a dev, a platform engineer, or an engineering leader, is which skills actually earn their context weight, and which ones just add cost. At Tessl, we believe context -particularly agent skills- and the broader concept of a context development lifecycle are where this space is heading (see also: Why the best AI coding teams will win on context ). The results below add to a growing body of signals pointing to a shift that is already underway. Top-line results Model Native behavior rate coverage (e.g "without skill") Adherence to skill ("with skill") Lift $/run (with skill) Avg time (with skill) claude-opus-4-7 80.5% 94.5% +14.0 $1.00 158.9s claude-opus-4-6 77.1% 93.8% +16.7 $0.53 126.6s claude-sonnet-4-6 75.6% 93.3% +17.7 $0.31 125.1s claude-haiku-4-5 61.2% 84.3% +23.1 $0.12 77.8s gpt-5.4 75.9% 92.7% +16.8 N/A* 135.4s gpt-5.3-codex 75.8% 91.9% +16.1 N/A* 87.9s gpt-5-codex 73.8% 85.1% +11.3 N/A* 136.2s cursor-composer-2 73.6% 90.5% +16.9 N/A* 152.0s We’ve evaluated 11 node.js development skills ( documentation, fastify-best-practices, init, linting-neostandard-eslint9, node-best-practices, nodejs-core, oauth, octocat, skill-optimizer, snipgrapher, typescript-magician ) , and aggregated “with vs without” skill performance. F

Fix what's breaking in your AI agent Discussion | Link

Review AI-generated Markdown and HTML in a focused workspace Discussion | Link

Feel free to include any brands or product names as well. Be as obscure or on the nose as you'd like....