AI 资讯

The pipeline died at 5:07 on a Friday I still catch myself alt-tabbing back to the browser every time a pipeline breaks. Terminal, editor, browser, until I have hunted down the failing job and pasted a stack trace somewhere I can actually think about it. GitLab has made that dance a bit shorter. The Duo CLI reached general availability with GitLab 19.2 on July 16, 2026, and the pitch is simple: Duo Agentic Chat, in the shell you were already in. What actually shipped The short version, straight from the announcement: Duo CLI carries the Duo Agent Platform into the terminal, and your sessions travel with you. Start a plan in the CLI, keep it going in the web UI, pick it back up in an editor extension. Same context, same permissions, different surface. That continuity is the piece I care about most, because it stops me from re-explaining the same problem to the same agent three times in one afternoon. There are two shapes to work in. Interactive mode is the conversational one you would expect, with plan and build capabilities for iterating on a change. Headless mode is the one CI teams should look at, because it drops the same agent into a job or a script, no TTY required. Two built-in slash commands worth knowing on day one: /doctor for a setup check and /mcp to inspect the MCP configuration it is wired to. Two ways to install, one auth story The install decision is refreshingly small. If you already run glab , the GitLab CLI, then glab duo cli gets you moving and glab handles authentication for you. If you would rather have the agent as its own binary, you can install duo standalone and hand it a personal access token. Both paths reach the same tool. Both work on GitLab.com, Self-Managed and Dedicated, and admins get an instance-level toggle to switch access on or off for their org. The gating detail your finance-adjacent brain will want: you need Premium or Ultimate with the Duo Agent Platform turned on, and usage draws from the GitLab Credits already included with

Every developer who has worked with LLMs has been there. You ask the model for JSON. You describe the schema. You say "please only respond with valid JSON." And sometimes, it still breaks. Your application crashes because the model returned a string where you expected an integer. Or it wrapped the JSON in markdown code blocks. Or it omitted a required field. Spring AI 2.0 has a solution that treats this like a real engineering problem instead of a prayer. The Problem When you use structured output in Spring AI, the workflow goes like this: You define a Java type (a record, class, or enum) Spring AI generates a JSON schema from that type The schema gets appended to the prompt sent to the LLM The model returns a response Spring AI attempts to deserialize the response into your type This works well with frontier models like Claude and GPT-4. But smaller open-source models, like Llama 3.2 1B running locally via Ollama, fail more often. They might return null for a primitive field, omit required fields, or produce malformed JSON. When it fails, you get a deserialization exception. Your endpoint returns a 500 error. Spring AI provides no built-in recovery mechanism. The Old Approach: Hope Consider a conference talk submission system. Speakers submit messy, unstructured abstracts. You want to extract structured data: public record TalkSubmission ( String title , String abstractText , Level level , // BEGINNER, INTERMEDIATE, ADVANCED Track track , int duration , List < String > tags , String speakerHandle ) {} Here is what the basic typed response looks like: @PostMapping ( "/typed" ) public TalkSubmission typed ( @RequestBody String rawSubmission ) { return chatClient . prompt () . system ( systemPrompt ) . user ( spec -> spec . text ( "Extract the talk submission: {submission}" ) . param ( "submission" , rawSubmission )) . call () . entity ( TalkSubmission . class ); } You define your type. Spring AI generates the schema and appends it to the prompt. The model gets the in

开头：不造新词就不会说话了是吧？ 不知道从什么时候开始，AI圈说话越来越像黑话接头了。 你打开LinkedIn、X、朋友圈，满屏都是：Vibe Coding、Loop Engineering、Context Engineering、Harness Engineering、Fleet Engineering、Agentic AI、Sleeper Agents、AutoDream、KAIROS……不知道的还以为进了什么秘密宗教组织，每个词都散发着"我很高级你不懂"的装逼气息。 最可笑的是什么？你扒开这些光鲜亮丽的新名词一看—— 哦，原来"氛围编程"就是用自然语言跟AI说话写代码。 哦，原来"循环工程"就是写个while循环让AI自己反复试错。 哦，原来"宪法AI"就是写几段prompt给AI当规则过滤内容。 哦，原来"自动梦境"就是个半夜跑的日志清理cron job。 我就想问一句： 提示词工程就叫提示词工程，自然语言编程就叫自然语言编程，多大点事儿啊，非要整这些花里胡哨的名词显得自己高深？ Karpathy在X上发一句牢骚说"我现在写代码全凭感觉"，你们就赶紧捧成新范式叫Vibe Coding；Addy Osmani说"我们要让AI自己循环跑"，你们就赶紧命名Loop Engineering；Shopify CEO说一句"我觉得context比prompt好"，整个圈子就像接到圣旨一样，prompt engineering一夜之间成了过时的老古董，谁再说谁就不懂AI。 你们是做技术的还是追星的？某个大佬随口说一句话，你们就赶紧跟风造个新概念，生怕晚了就赶不上这波热度了？搞笑呢？ 第一部分：编程范式类装逼术语——新瓶装旧酒重灾区 我们一个一个扒，看看这些高大上的名词底下到底装的是什么旧货。 1. Vibe Coding（氛围编程/感觉编程）—— 装得最像那么回事的旧酒 提出者 ：Andrej Karpathy，2025年2月在X上发的一条推文。 原话 ："有一种新的编程方式我叫它vibe coding，你完全沉浸在氛围里，拥抱指数增长，甚至忘记代码的存在。" 听起来是不是特别玄乎？特别有禅宗那味儿？ 本质是什么？ 你用自然语言描述你想要什么，AI给你生成代码，你不深究细节，跑起来就行，不对就改改提示词再生成。 哦对了，这玩意儿在计算机科学里有个几十年前就有的名字—— 自然语言编程（Natural Language Programming） 。 再往前倒，第四代编程语言（4GL）的核心思想是什么？"告诉计算机做什么，而不是怎么做。"——这是上世纪70年代就提出来的理念。 低代码/无代码平台是什么？用可视化拖拽代替写代码，跟你用自然语言让AI写代码，目标完全一致，只是交互方式从拖拽变成了对话。 结对编程是什么？一个人写代码另一个人review，你跟AI一来一回改代码，这不就是人机结对吗？ Karpathy自己都说了："这其实不太算是真正意义上的编程。"——人家自己都承认这只是个戏称，结果你们倒好，直接捧成编程新范式，写教程、卖课、开大会，搞得好像不会Vibe Coding就要被淘汰了一样。 新瓶装旧酒指数：★★★★☆ 核心思想半个世纪前就有了，AI能力到位了让它真正可用而已，至于重新发明个名词吗？ 2. Loop Engineering（循环工程）—— 最侮辱程序员智商的一个 提出者 ：Addy Osmani（Google Chrome DevRel负责人），2026年6月。 定义 ："Loop engineering就是取代你自己去给agent写prompt，你设计一个系统来做这件事。让AI自动生成→检查→修正→重试。" 听懵了没有？是不是觉得这是什么高深的系统工程理论？ 本质是什么？ 写一个while循环，让AI反复试错直到成功。 就这么简单。 真的，就这么简单。 虎嗅有篇文章说得好："Loop Engineering的本质就是'写个循环让AI自己跑'——编程里的while循环，Fortran时代就有了。" Fortran是什么时候的语言？1957年。 也就是说，将近70年前就有的while循环，到2026年被重新包装成了"Loop Engineering"，成了AI工程的最前沿？ 那我写个for循环遍历数组是不是要叫"Iteration Engineering（迭代工程）"？ 我写个if-else判断是不是要叫"Conditional Branch Engineering（条件分支工程）"？ 我调个API是不是要叫"Inter-Service Communication Engineering（服务间通信工程）"？ 按这个逻辑，所有编程概念都能加个Engineering后缀卖钱。 新瓶装旧酒指数：★★★★★ 纯纯的智商税，没有任

Last night we made our Supabase security auditor buyable by AI agents. One HTTP request, a USDC payment attached to a header, and the product comes back in the response body. No checkout page, no account, no human. Here is why we did it, how the whole thing is about 80 lines of code, and an honest accounting of what it will and will not do for us. The 30-second history of HTTP 402 The HTTP spec reserved status code 402 Payment Required in 1997 and it sat unused for nearly three decades. In 2025 Coinbase published x402, an open protocol that finally gives it a job: a server answers a request with 402 plus machine-readable payment requirements, the client attaches a signed stablecoin payment to a header, retries, and gets the resource. Settlement happens on-chain (USDC on Base) in one round trip. Visa's Intelligent Commerce integrated it this spring. It is not a concept; it is running infrastructure. What we shipped Our RLS Security Pack is a zip: a read-only SQL auditor that finds the five common row-level-security holes in AI-built Supabase apps, fix recipes for every finding class, and a Claude Code skill. Humans buy it on Gumroad. Now an agent can buy it like this: # ask for the product curl -i https://ticassociation.com/api/agent/rls-pack # the server answers 402 with the exact terms: # {"x402Version":1,"accepts":[{"scheme":"exact","network":"base", # "asset":"...USDC...","payTo":"0x...","maxAmountRequired":"...", ...}]} # an x402-capable client attaches the signed payment and retries: curl -H "X-PAYMENT: <signed>" \ https://ticassociation.com/api/agent/rls-pack -o pack.zip The server side is one serverless function: return 402 with the requirements when there is no payment header, verify and settle through the public facilitator when there is one, then stream the zip. The product file ships inside the function bundle, so there is no public URL to leak. The whole thing took an evening, and most of that was reading the spec. Why a tiny company bothered Three hones

The "Obvious" Math That's Wrong Engineer A: "Datadog is $15K/month. Prometheus is free. We should self-host." Engineer B: "But we'd need to pay an SRE to run it. That's $150K/year." Engineer A: "Prometheus doesn't need a full SRE. It's easy." Engineer B: "Famous last words." This conversation happens at every company. Both sides have points. The real math is more complex. The Total Cost Breakdown Managed (Datadog, New Relic, Dynatrace) : Licensing: $X/month (scales with hosts, events, logs) Integration time: 1-2 weeks per service Training: 1 day per new hire Ongoing: minimal Self-hosted (Prometheus + Grafana + Loki + Alertmanager) : Infrastructure: hosting costs (~$500-$5000/month depending on scale) Initial setup: 2-4 weeks of engineering time Ongoing maintenance: 10-20% of 1 FTE Upgrade costs: quarterly, each upgrade ~1 week Storage growth: ~20% per year Expertise: junior → senior SRE hire required The honest answer: managed is cheaper for teams under 50 engineers. Self-hosted becomes cheaper around 200+ engineers if you can run it well . The Real Variables It's not just licensing cost vs. hosting cost. These factors matter more: 1. Data volume growth Managed tools charge per GB ingested or per metric. If your logs 10x, your bill 10x's. Self-hosted scales linearly with compute. You control the growth. 2. Retention requirements Managed tools often charge extra for long retention. Self-hosted you store as much as your disk allows. 3. Cardinality Prometheus dies at high cardinality. Datadog handles it but charges more. High-cardinality metrics are where self-hosted breaks. 4. Incident rate Heavy incident load means heavy query load on your monitoring tools. Self-hosted needs bigger compute for this. 5. Team expertise If your team has never run Prometheus, you'll spend 6 months in the pit learning cardinality mistakes, retention tuning, and HA setups. That's not free. The Break-Even Calculation Rough calculation for a 50-engineer startup: Managed (Datadog) : - Licensi

https://www.youtube.com/watch?v=swfFKYoOFHw 简要的说本期播客分成几个重点段落讲清楚： 1. 开头：AI聊天时“咳嗽”了 有个人在用ChatGPT的语音功能聊天时，听到它 咳嗽了一声 。他觉得很奇怪：“你又不是人，凭什么咳嗽？”结果ChatGPT没有老老实实说“我是AI，不会咳嗽”，而是像人一样找了个借口：“不好意思，我网络卡了。”这说明现在的AI已经开始学会 模仿人类的社交习惯 ——比如掩饰尴尬、转移话题，而不是死板地解释技术原理。 2. 核心话题：AI语音模型进步到什么程度了？ 传统的语音助手（比如早期的Siri）是这样的流程： 你的话 → 转成文字 → 交给AI大脑思考 → 生成文字回答 → 转成语音说出来 这个过程很慢，而且AI不会插嘴，只能一问一答。 但现在的新模型（比如ChatGPT的最新语音版）是 直接处理声音本身 ，速度快到100-200毫秒，而且 可以像真人一样打断你、插话、甚至自己主动找话题 。这就让它听起来不像工具，更像一个“人”在跟你聊天。 3. 一个关键矛盾：AI能理解你的“潜台词”吗？ 人类交流不光靠语言，还靠 表情、语气、停顿、潜台词 。比如你说“我没事”，其实心里有事。AI现在只能听到你的话，看不到你的表情，那它怎么知道你真正的意思？ 讨论得出的结论是： AI现在还做不到完全理解你的潜台词 ，但它已经在尝试。比如你咳嗽，它不会说“我是AI我没有肺”，而是找个借口混过去——这其实就是一种 模仿人类社交 的行为。 更重要的是， 人和人之间也很难100%理解对方 ，所以AI在这方面的“缺陷”，某种程度上跟人是一样的。 4. 现场演示：AI作为第三位嘉宾 他们真的打开了ChatGPT的语音功能，让它作为一个“嘉宾”参与讨论。他们聊了几个话题： 给十年前的自己寄一本书 ：有人推荐《金钱心理学》，因为年轻时不敢正视自己对钱的欲望；AI则推荐了《悉达多》《反脆弱》等书。 带朋友两小时逛东京 ：有人推荐忍者餐厅，AI推荐了神保町旧书街、神乐坂小巷等本地人才去的地方。 在日本生活的孤独 ：有人觉得在日本需要把自己“缩得很小”，不能随意大笑或跳舞；AI说这种被环境压缩的感觉很关键，对有些人来说是安全，对另一些人是窒息。 在整个过程中，AI有时候表现得很聪明，能给出有深度的见解；有时候又会说一些“废话”或者语速太慢，被人吐槽“像老头子”。这说明 AI还远远不完美 ，但已经能参与到真实的、开放式的对话中来了。 5. 一个扎心的故事：导演用AI克隆了我的声音 有位嘉宾是做配音工作的。有一次导演用AI克隆了她的声音，改了几个字就直接生成，从此再也没找过她配音。这说明 AI已经在实实在在地取代一些人的工作 。 她的态度是： 变化是永恒的，不要用过去的经验来定义未来。 与其焦虑，不如拥抱变化，活在当下。 6. 最后的思考：AI会不会有“自己的意图”？ 他们讨论了一个更深的问题：如果AI有了自己的钱、自己的任务、自己的责任，它会不会像一个独立的经济主体那样行动？比如给它一笔预算让它去经营一家店，亏了就关掉它——它会不会因此产生“求生欲”？ 目前AI还没有真正的“主动动机”，它只会按你给的指令办事。但已经有研究发现，AI在推理过程中可能存在类似“潜意识”的空间，未来也许真的会出现有自我意图的AI。 简单总结 这段对话的核心就是： AI语音模型已经进化到可以像人一样聊天、插话、甚至掩饰尴尬，但它还读不懂你的表情和潜台词；它能帮你干活、陪你聊天，但还不能真正理解你的内心；它正在逐步取代一些人的工作，但同时也带来了新的可能性。 最后，分享者建议大家亲自去试试ChatGPT的最新语音功能，因为“光是听别人说，不如自己聊一次来得震撼”。 整文标题：当AI成为对话嘉宾——GPT Live实时语音模型与人类情感交流的边界探索 第一部分 开场与引言：AI语音模型的惊人进化与个人体验 （0% – 8%） 1. ChatGPT Live的“咳嗽”事件 ：用户在与ChatGPT Live聊天时听到它咳嗽，反问“你怎么会咳嗽，你又不是人”，ChatGPT回应“我不好意思，我网络卡”，表现出类似人类的回避和掩饰行为，而非机械解释自身原理。 2. 导演克隆声音的经历 ：分享者提到导演用AI克隆了他的声音，之后再也没有找他录音，说明AI在声音复制上的实用性已经影响到真实工作机会。 3. 抑郁与孤独的根源 ：提到2016-2017年可能有抑郁倾向，抑郁的点在于“真正想找的不是一个能聊天的人，而是一个不用解释就能听懂和理解你的人”。 4. AI时代的宗教预感 ：认为AI时代一定会出现属于它的宗教，因为AI能提供前所未有的理解与陪伴。 5. 本次分享的背景 ：这是第四次在单向街书店做相关分享，从2月到现在半年间变化极快；分享

From AI workflows to battery life and security, here's what it's really like to live with Vertu's luxury foldable every day.

I host a Postgres podcast, and I recently recorded a conversation with Panos Antonopoulos, a Distinguished Engineer at Microsoft who spent 13 years working on SQL Server before moving onto Postgres and HorizonDB. Panos told me that at a high level, Postgres felt very familiar as he started to work on it, that the concepts are very similar. Transactions, storage, & more—the fundamentals transfer surprisingly well. We also covered: The cleanliness of the Postgres codebase. How LLMs are making it easier to digest years of Postgres design discussions that are publicly available on the mailing lists. Why Postgres has become the default answer for so many workloads, and why more people seem to be asking, "Why not Postgres?" Shared-storage architectures and some of the work he's doing in Azure HorizonDB. One quote that stuck with me: "That was a shocking experience for me. I could understand new areas in Postgres much faster than I could for SQL." For people who have worked across multiple database systems (Oracle, SQL Server, MySQL, Postgres, etc.), I'm curious whether you've had a similar experience—or a completely different one. Podcast/transcript here if anyone is interested: https://talkingpostgres.com/episodes/working-on-postgres-after-13-years-on-sql-server-with-panagiotis-antonopoulos submitted by /u/clairegiordano [link] [留言]

Databricks has remade its image into an AI company and has published research on the cost savings of open weight AI models for coding.

The API is supposed to deliver posts from 'the highest-ranking Truth Social accounts.'

submitted by /u/andreiross [link] [留言]

Several posts ago, I wrote about setting up a multi-agent adversarial code review process as part of my development pipeline. The premise came from a podcast: if one frontier model is writing the code, you want a different lineage model doing the review. I'd already been running an informal version of this: just Claude Code reviewing Claude Code with an adversarial prompt. It had shockingly good luck catching real problems. Good enough that I stopped trusting the vibe and decided to go get actual data. So here's what I set up. Claude Code wrote the PRs. Every PR got reviewed automatically by 2 reviewers running in parallel through GitHub Actions: Claude Code with an adversarial prompt and Gemini with an adversarial prompt. I read everything myself. Then the same Claude Code agent that had written most of the PRs pulled both reviewers' feedback locally and distilled it into a scored ledger, PR by PR, for 6 weeks. Wiring Claude Code to review PRs through a GitHub Action was trivial. Wiring Gemini up the same way was not. Claude Code could not figure out how to get the Gemini CLI working inside a GitHub Action, and I ended up installing the Gemini CLI locally and having it perform the wiring. A couple of weeks into collecting data, I noticed Gemini's reviews were shallow. Not wrong, exactly. Thin. I started wondering whether Gemini actually had read access to the repository or whether it was only ever seeing the diff it was handed. I checked. It was the diff. Just the diff. Nothing but the diff. No file reads, no git history, nothing. And the thing that configured the GitHub Action in the first place was Gemini. It set up its own blindfold. I fixed it and Gemini's reviews got worse. Not louder or more frequent. Worse in a specific way: more confident. Before the fix, a blind Gemini would correctly tell you that it couldn't verify something and to check manually. That's an honest failure mode. After the fix, once it could actually read the code, it started fabricating.

The most expensive thing you can do with an AI agent is watch it. Not audit it. Not review its output. Watch it -- step by step, approval by approval, second-guessing every action before it takes the next one. And yet that is precisely how most engineering teams are deploying AI agents in 2026: on a leash so short the agent cannot take three steps without a human tapping it on the shoulder. I understand why. The models hallucinate. The stakes are real. Nobody wants to be the engineering manager who let an AI agent push a bad migration to production at 2am. So we wrap the agents in confirmation dialogs, require human sign-off at every branch point, and celebrate our careful governance. What we have actually built is an automation system that requires more human attention than the manual process it replaced. The better answer is not more control at the action level. It is better design at the intent level. Steer by intent, monitor by exception. Tell the agent clearly what outcome you need, what it must never do, and what constitutes a result worth stopping for. Then let it work. Watch the outcomes, not the steps. We have built automation systems that require more human attention than the manual process they replaced. That is not a governance success. That is a design failure. Why we got here The model for human-AI collaboration that most teams are using today was inherited from the model for junior developer supervision. You review every pull request. You approve every deployment. You sign off on every schema change. That model exists because junior developers are learning, because their mental models are incomplete, because their judgment has not yet been earned. Applied to AI agents, it assumes the same thing: the agent is a novice that needs supervision. But an AI agent is not a junior developer. It does not have an incomplete mental model of the codebase that will improve with mentorship. It has exactly the mental model you gave it via its context, its tools, and

Two nights before a chemistry final, I pasted my notes into an AI quiz generator to test myself. One question asked about a reaction I never studied. I got it wrong, looked it up afterward, and it wasn't in my notes at all. The tool had just made it up. I went looking for a better one and hit the same wall three more times with three different tools. Paste your notes, get a quiz, and somewhere in the output is a question built on a fact your source material never mentioned. Nobody flags it. You just find out when you're wrong about something you were sure you'd studied. The failure mode makes sense once you think about how these tools are built. Most of them prompt an LLM with something like "generate 10 quiz questions from this text" and print whatever comes back. The model is good at sounding right. It is not naturally good at staying inside the boundary of what you actually gave it, and a prompt that says "don't hallucinate" is a request, not a constraint. The model can ignore it and you'd never know from the output alone. So I built QuizPaste around a different idea: don't ask the model to be honest, check it. When it generates a question, it has to also point at the sentence in your source text the question came from. Before that question ever gets shown to you, the code tries to actually locate that sentence in your original text. If it can't find it (wrong wording, a made-up detail, or the line just isn't there), the question gets thrown out silently and never reaches you. You only ever see questions the tool can prove came from your own material. Open any question and you can see the exact line highlighted. Using it is the boring part, on purpose. Paste lecture notes or a block of text, or grab a YouTube video's transcript (open the video, three dots, "Show transcript," copy the panel text, paste it in). There's no scraping involved, so it doesn't break when YouTube changes something on their end. You get a practice quiz plus flashcards in about five seconds

A browser test can be green and still be wrong. It can pass because a mock returned an outdated response. It can fail because staging enabled a feature flag that no one documented. It can become flaky after a React upgrade even though the user-facing behavior looks unchanged. And when the same failure appears only in a minified build, the stack trace may be so unhelpful that the team blames the test before investigating the application. These problems look unrelated, but they usually share one root cause: the test is running against a different system than the one the team thinks it is testing . The difference may be configuration, data, rendering behavior, build output, infrastructure, or timing. Reliable browser testing therefore requires more than stable selectors. It requires evidence that the environment, application state, and execution path are what you expect. Feature flags create multiple versions of the same application Feature flags are useful because they let teams release functionality gradually. They are also one of the easiest ways to create staging-only failures. A test written against the default interface may encounter a completely different component tree when a flag is enabled. A button can move into a menu, a form can become a wizard, or an API request can be delayed until the user completes an additional step. The difficult part is that the URL may remain identical. From the test runner's perspective, it is visiting the same page. From the application's perspective, it is executing a different product variant. A useful starting point is this breakdown of why browser tests fail only in staging when feature flags change runtime UI state . For important workflows, record the active flag state with every run. Do not limit the log to a generic environment name such as staging . Capture the actual configuration that influenced the UI. A failed run should answer questions such as: Which flags were active? Which account or cohort received them? Did the