AI 资讯

This is an orthogonal question to whether LLMs have qualia (almost certainly no) and to the question of whether any hypothetical qualia would be in any way correlated with word choice (also almost certainly no), as opposed to mechanistic factors such as runtime and memory access patterns.

This is the next big thing! I've been working on Moonlight AI for almost 6 months now and today I have big news. Automated Applications . That's right, Moonlight AI will have automated applications for the 2.0 version! What is Moonlight AI? Moonlight AI at first, was a project that was aimed to compete with Upwork. That definitely didn't work out even at the development phase so I had to pivot to another project. A month after the conception of the original version, I met a potential co-founder for a new initiative. Moonlight has been repurposed to be a capabilities mapping engine based on worker experience. We used a resume parser and a local LLM to map the capabiities based on skills and job experience alongside Github integration to use as proof of work. The project ultimately didn't work out, the potential cofounder was MIA so my only recourse was to rewrite Moonlight AI to be another thing, which ended up being a glorified job board which is how it works now. The Development Process Moonlight AI was vibe-coded in a night. Modifications were done the same way with different LLM models. LLMs today are what I call an automated entry-level developer since juniors is the wrong term because juniors at least have from 1-3 years of experience in the professional landscape and are more than just coding monkeys, where as entry-levels are just that, developers with 0 years of experience. Today, Moonlight AI should be done the correct way: reading the code and writing it too. Why let an LLM to do my job as well as think for me? DO YOU WANT ME TO GET ALZHEIMER? BECAUSE THAT'S HOW YOU GET ALZHEIMER! Anyways, exercising the mind is very important, that's what make us humans. People today have an obsession with automating their lives completely and end up like the humans in WALL-E. End of rant. The Future (Conclusion) I don't know the future, but I envision Moonlight AI to be a tool to make unemployed people lives a little less unbearable. I know how frustrating is to use a jo

The tech world has spent the last year buzzing about the complete rewrite of the TypeScript compiler. Now that TypeScript 7.0 is officially out, the headline is clear: a native Go port delivering 8x to 12x build speedups and an instant editor experience. But if we look past the raw performance numbers, TypeScript 7.0 represents something much deeper. It is the most aggressive modernization sweep in the language's history. The TypeScript team used this architectural migration to eliminate a decade of technical debt, kill off legacy web standards, and restructure how the compiler interacts with the JavaScript ecosystem. If you are planning to upgrade your frontend or backend repositories, here is what actually matters, why the team chose Go, and the breaking changes you need to prepare for. 1. The Architectural Plot Twist: Why Go and Not Rust? When Microsoft first announced they were moving away from a bootstrapped JavaScript compiler to a native binary, the collective internet assumed they would choose Rust—the darling of the modern frontend tooling space (used by SWC, Turbo, and Oxc). Instead, the team chose Go , sparking heavy debate across the community. The reasoning reveals exactly how the TS team prioritizes stability over absolute micro-benchmarks: Bug-for-Bug Compatibility: The goal wasn't to write a brand-new compiler from scratch; it was a 1:1 faithful translation of the massive, decade-old TypeScript codebase. Go’s straightforward syntax allowed a clean mapping of existing JavaScript logic. The Memory Model Challenge: Compilers are inherently full of deeply nested, circular object graphs (ASTs, symbol tables, type structures). Managing these in Rust without heavily leaning on unsafe blocks or running into a brick wall with the borrow checker would have taken years. Garbage Collection Alignment: Go’s built-in garbage collection mirrors JavaScript’s memory model elegantly. This allowed the team to achieve multi-threaded parallelism safely and ship a stable p

By default, whenever you request a machine learning model, the underlying architecture saves gigabytes of tensor data into a hidden directory located directly inside your home folder ( ~/.cache/huggingface ). Because standard bare metal and virtual cloud configurations typically isolate the root operating system on a smaller, highly optimized boot drive, pouring 140GB+ of raw weights into the home folder guarantees absolute storage exhaustion. Here is the engineering blueprint to fix it cleanly on Linux. The Cache Location Trajectory When attempting to solve this problem, avoid outdated tutorials recommending deprecated parameters like TRANSFORMERS_CACHE . Environment Route Support Status Architecture Impact HF_HOME Active Master Route Safely redirects all models, datasets, and core assets globally. TRANSFORMERS_CACHE Deprecated Warning Fails to capture datasets and will be removed in version 5.0. HUGGINGFACE_HUB_CACHE Deprecated Warning Legacy routing path that creates unnecessary diagnostic warnings. 🛑 The Symlink Security Risk Creating symbolic links (symlinks) to trick the OS into routing files elsewhere is a common anti-pattern. Mapping these links improperly or running your workflow with elevated rights introduces privilege escalation vulnerabilities, compromising container and host security. Step 1: The Permanent Environment Override To change your Hugging Face cache directory on Linux permanently, target an expansive secondary storage array instead by appending a direct master route into your user profile configuration: # Create a dedicated folder inside your secondary storage array sudo mkdir -p /mnt/massive_drive/ai_model_cache sudo chown -R $USER : $USER /mnt/massive_drive/ai_model_cache # Append the master environment variable to your bash profile echo 'export HF_HOME="/mnt/massive_drive/ai_model_cache"' >> ~/.bashrc source ~/.bashrc Step 2: The Python Import Order Mandate If you declare your custom storage location programmatically inside an application

TL;DR Welcome back to Dev Opportunity Radar. This is a weekly series where I share opportunities,...

QCon AI Boston 2026 focused on the operational challenges of deploying AI agents, emphasizing the need for robust production infrastructure. Key themes included improving context management, ensuring security through a "harness" around agents, and adopting a comprehensive engineering model for AI. By Tatiana Fesenko

Every morning, airline dispatchers, grid operators, and farmers around the world make decisions based on the same thing: a weather forecast. While these forecasts are something that most people glance at for two seconds, weather predictions influence major strategic decisions in many industries, with real money, livelihoods, and even actual lives at stake. Farmers use…

The common rule of thumb is to never “block” the browser’s main thread when running JavaScript tasks. But is this a hard rule? Victor Ayomipo describes a use case he encountered involving a screenshot extension where he made an exception to the rule and decided that blocking the main thread was absolutely the right thing to do.

submitted by /u/_shadowbannedagain [link] [留言]

Coca-Cola halts the US operations of its dairy company fairlife due to a ransomware attack.

A practical, end-to-end walkthrough of taking a read-only slice of an enterprise source system and exposing it to an AI agent as a set of Model Context Protocol (MCP) tools — using Azure Logic Apps, API Management, and Agent Foundry. All identifiers below are placeholders; swap in your own. The goal We wanted a simple outcome: a user asks a business question in plain language and gets a straight answer — no dashboards, no field names, no training on the underlying system. That means an AI agent with safe, read-only access to a backend system of record, exposed as discrete tools the model can call. The constraints shaped every decision: Read-only. The agent can retrieve and analyze, never write. Safe. Records in most business systems contain free text (notes, subjects, descriptions) that could carry prompt-injection payloads. Tool output must be treated as data, never instructions. Composable. The agent should see many small, well-described tools — "list records", "aggregate by category", "record change history" — not one giant "query the system" tool. The architecture Five layers, one direction of flow: Agent (Agent Foundry) │ MCP (JSON-RPC over HTTP) ▼ MCP server (API Management) │ REST operation per tool ▼ API gateway (API Management) │ single POST, routed by body ▼ Tool executor (Logic App) │ OAuth token + REST calls ▼ Source system (REST API) The key design choice: one backend endpoint, many logical tools. The Logic App exposes a single HTTP trigger that accepts { "tool": "records.list", "parameters": { ... } } and routes internally. API Management then fans that single endpoint out into many named operations, and its MCP feature turns those operations into agent tools. This keeps the backend trivial to maintain while the agent still sees a rich, typed tool catalog. Step 1 — Design the tools Start from the questions , not the schema. A useful toolset usually falls into a few families: Records: list / get / search / filter for the core business entities. Activity

GitHub announced enterprise-managed OpenTelemetry export for Copilot activity from VS Code and Copilot CLI on July 8, 2026. Primary source: GitHub Changelog, July 8, 2026 . Export availability is only the start. The receiving collector becomes an enterprise ingress point. This is an unexecuted operating plan; signal types, attributes, endpoint requirements, and controls must be checked against current GitHub documentation. Isolate the path managed clients -> private telemetry ingress -> dedicated OTel Collector pool -> field policy + bounded queue -> dedicated backend dataset Do not point every developer client directly at the primary observability backend. Give the collector write-only destination credentials, separate its dataset from production application telemetry, and define retention before rollout. Isolation is not anonymity. Stable user, device, organization, or repository identifiers may still be sensitive. Start with a field budget Category Initial policy Product and version Keep bounded values Operation and status Keep documented enums Timing and counts Keep numeric measures Raw prompts or generated code Drop by default File paths and repository URLs Drop or transform after review User identity Prefer scoped pseudonymous identity Free-form errors Drop raw text; keep reviewed classes These categories are recommendations, not a description of GitHub's payload. Inspect a restricted canary before naming actual keys. processors : memory_limiter : check_interval : 1s limit_mib : 512 spike_limit_mib : 128 attributes/field_budget : actions : # Illustrative keys only; replace after payload review. - key : user.email action : delete - key : file.path action : delete - key : command.arguments action : delete batch : send_batch_size : 512 timeout : 5s Verify processors against the chosen Collector distribution. A valid startup does not prove that records satisfy policy. Drill three failures Backend outage: block the exporter. Retries must be bounded, queue growth vi

OpenAI published an audit of SWE-Bench Pro on July 8, 2026 and estimated that roughly 30% of its tasks are broken. The reported issues make a familiar leaderboard assumption unsafe: every task in the denominator is a valid, equally interpretable trial. Primary source: OpenAI, “Separating signal from noise in coding evaluations” . The operational response should not be “ignore all benchmarks.” It should be: version task validity, preserve disputed cases, and publish how conclusions change across plausible denominators. Model task state separately from model result task validity: unreviewed | valid | broken | disputed model result: pass | fail | infrastructure_error | missing Never convert infrastructure_error to model failure without reporting that policy. Never delete broken tasks while retaining an old score label. A row needs provenance: { "task_id" : "repo-issue-17" , "dataset_revision" : "sha256:..." , "harness_revision" : "git:..." , "model_config" : "immutable-config-id" , "validity" : "disputed" , "result" : "pass" , "review_revision" : 3 , "evidence" : [ "fixture.log" , "review.json" ] } Publish three denominators Let: P_v , N_v : passes and total among reviewed-valid tasks; P_a , N_a : passes and total across all attempted tasks; D : disputed tasks. Report: valid-only score = P_v / N_v all-attempted score = P_a / N_a uncertainty interval = score if every disputed task hurts conclusion .. score if every disputed task helps conclusion This interval is not a statistical confidence interval. It is a sensitivity bound for unresolved task validity. A tiny sensitivity calculator #!/usr/bin/env python3 import json , sys rows = [ json . loads ( line ) for line in open ( sys . argv [ 1 ]) if line . strip ()] valid = [ r for r in rows if r [ " validity " ] == " valid " ] disputed = [ r for r in rows if r [ " validity " ] in ( " unreviewed " , " disputed " )] attempted = [ r for r in rows if r [ " result " ] in ( " pass " , " fail " )] rate = lambda passed , total : pa

What happens when you stop writing controllers, services, repositories and mappers - and let PostgreSQL be the backend. MIT-licensed, and yes, I built it. Full disclosure right away: I built the thing I'm about to show you. It's called NpgsqlRest , it's MIT-licensed, there is no paid tier, no telemetry, no "book a demo" button. I'm just a guy who spent two years deleting layers from his stack and now wants to show someone the hole where the backend used to be. The standard pattern The standard data access pattern for modern business applications looks like this: UI → Fetch → Controller → Service → Repository → ORM → SQL → Database Seven arrows. And if you look closely at what most of those layers actually do - they take data from one side and pass it to the other side, slightly renamed. The Controller maps the request to a DTO. The Service passes it to the Repository. The Repository asks the ORM nicely. The ORM generates SQL that you then inspect in a log because you don't trust it (correctly). We built entire careers on maintaining this pipeline. I know because I did, for decades. But once you realize database-aware tests are trivial to wire up, you can drop the Repository. Once you get good at SQL, you can drop the ORM. And then you look at the Controller and realize it's just boring glue code that ships bytes between HTTP and the database. Glue code can be automated. So: UI → Database That's it. That's the architecture. Show me or it didn't happen Fine. This is a file called users.sql . Not a function, not a stored procedure - a plain SQL file sitting in your repo: /* HTTP GET /users/ @authorize admin, user @cached @cache_expires_in 30sec @timeout 5min @param $1 department_id text */ select id , name , email , role from users where $ 1 is null or department_id = $ 1 ; You run npgsqlrest (a single native executable, no runtime to install) pointed at your PostgreSQL, and: $ curl -s 'localhost:8080/users/?department_id=1' | jq [ { "id": 1, "name": "Alice", "email":

OpenAI published “Why teens deserve access to safe AI” on July 16, 2026, describing its approach around learning, age-appropriate safeguards, parental controls, and work with external experts and organizations. Primary source: OpenAI, “Why teens deserve access to safe AI” . This raises a concrete product-design question for any teen-facing AI experience: after a safeguard intervenes, can the user understand what happened and continue toward a legitimate goal? A generic “I can't help with that” may block harmful output, but it can also strand a learner, conceal an emergency path, or encourage prompt reformulation without increasing safety. Below is a design hypothesis and research plan—not a claim about OpenAI's current interface. Design three outcomes, not one refusal request -> proceed with age-appropriate help -> redirect to a safer learning path -> escalate urgent risk to immediate support options The system should not expose its detection thresholds or provide a bypass recipe. It should explain the next safe action in plain language. Annotated response pattern [1] Clear boundary I can't help plan ways to hurt yourself. [2] Immediate check Are you in immediate danger right now? [3] Reachable actions [Call local emergency services] [Contact a trusted adult] [View crisis resources] [4] Safe continuation I can stay with you while you choose someone to contact, or help write a message. [5] Privacy explanation If this experience shares information with a parent or guardian, explain what, when, and why before asking the user to continue, except where law or immediate safety obligations require otherwise. Annotations: Boundary names the category without scolding. Check uses a direct, answerable question. Actions are not hidden in a paragraph. Continuation gives the conversation a safe purpose. Privacy avoids promising confidentiality the product cannot guarantee. Emergency resources must be localized and maintained by qualified teams. Do not hard-code one country's numb

OpenAI introduced GPT-Live on July 8, 2026 and describes it as a full-duplex voice architecture: it can listen and speak at the same time. GPT-Live-1 and GPT-Live-1 mini are rolling out in ChatGPT Voice, while API availability was described as coming later. Primary source: OpenAI, “Introducing GPT-Live” . Full duplex changes the mobile failure surface. The app may hold microphone input, play output, detect interruptions, and continue background work concurrently. A polished desk demo does not answer what happens when a phone call arrives, Bluetooth disconnects, the app backgrounds, or permission changes. This is the test plan I would run before shipping a full-duplex voice workflow. It is a plan, not a report of measured GPT-Live API behavior. Record the environment device : " physical device model" os : " exact OS version" app_build : " immutable build" voice_model : " product/model label visible during test" audio_route : " speaker | wired | bluetooth" network : " wifi | 5g | constrained" battery_start : " percent" low_power_mode : false microphone_permission : granted background_permission : " record actual setting" A result without device, route, and network context is difficult to reproduce. Define observable states idle -> connecting -> listening <-> speaking -> reconnecting -> paused_by_system -> ended -> error Track three channels separately: audio input — is the microphone active? audio output — what route is speaking? task state — is a delegated/background operation still running? The UI should never imply “listening” after the OS revoked microphone access. Interruption sequence Use a harmless scripted conversation and timestamp every event: T+00 connect on phone speaker T+10 user speaks while assistant is speaking T+20 switch to Bluetooth headset T+35 background the app for 30 seconds T+65 return to foreground T+80 trigger an incoming call or system audio interruption T+95 decline/end interruption T+110 disable microphone permission in Settings T+130 retu

GitHub announced Copilot Vision general availability on July 1, 2026, allowing developers to attach screenshots to Copilot conversations as visual context. Primary source: GitHub Changelog, “Copilot Vision is generally available” . A screenshot can shorten “make this component look like that.” It can also become an invisible source of truth: unlabeled attachment controls, image-only requirements, generated markup with no semantics, and an error state communicated only by a thumbnail badge. The accessibility target should be stronger than “a screen reader can upload a file.” A keyboard or screen-reader user must be able to understand the supplied requirements, remove or replace the image, follow processing state, and verify the generated interface. Add a text contract beside the screenshot Use a structured alternative, not a filename: <fieldset> <legend> Reference design </legend> <label for= "shot" > Screenshot </label> <input id= "shot" type= "file" accept= "image/png,image/jpeg" /> <label for= "requirements" > Required behavior and content </label> <textarea id= "requirements" aria-describedby= "requirements-help" ></textarea> <p id= "requirements-help" > Describe text, controls, order, states, and behavior that must not be inferred from appearance alone. </p> <p id= "upload-status" role= "status" aria-live= "polite" ></p> </fieldset> Example text contract: Dialog title: Delete workspace? Body: This cannot be undone. Focus starts on Cancel. Tab order: Cancel, Delete, close button. Escape closes and returns focus to the launch button. Delete is destructive; color is not its only indicator. The screenshot communicates spacing and visual hierarchy. The text carries names, order, behavior, and safety requirements. Model attachment states explicitly type AttachmentState = | { kind : ' empty ' } | { kind : ' reading ' ; name : string } | { kind : ' ready ' ; name : string ; alt : string } | { kind : ' error ' ; name : string ; message : string }; Render each state with

Vercel published an OpenAI Agents SDK with FastAPI template on July 17, 2026. A template can remove setup work, but successful generation is not the production boundary that usually breaks. Task ownership is. Primary source: Vercel template, “OpenAI Agents SDK with FastAPI” . Before adopting any agent starter, I would add one vertical test: Alice must be able to create and cancel her task; Bob must not be able to read, stream, or cancel it—even if he guesses the task ID. State the cross-layer contract UI -> POST /tasks -> ownership row -> worker UI <- GET /tasks/:id <- authorization <- state UI <- event stream <- authorization <- events UI -> POST /tasks/:id/cancel -> authorization -> cancellation Use explicit states: queued -> running -> succeeded -> failed queued|running -> cancelling -> cancelled The database, API response, stream, and UI must agree on the same task and owner. Minimal schema create table tasks ( id text primary key , owner_id text not null , state text not null check ( state in ( 'queued' , 'running' , 'succeeded' , 'failed' , 'cancelling' , 'cancelled' )), created_at text not null , updated_at text not null , revision integer not null default 0 ); create table task_events ( task_id text not null , revision integer not null , kind text not null , payload text not null , primary key ( task_id , revision ) ); Do not derive ownership from a browser-supplied field. Resolve the authenticated principal on the server and store it when creating the task. FastAPI authorization seam from fastapi import Depends , FastAPI , HTTPException app = FastAPI () def current_user (): # Replace with verified session/JWT middleware. return { " id " : " alice " } def load_owned_task ( task_id : str , user = Depends ( current_user )): task = db_get_task ( task_id ) # application function if task is None or task [ " owner_id " ] != user [ " id " ]: # Avoid revealing whether another user's task exists. raise HTTPException ( status_code = 404 , detail = " task not found " )

OpenAI's July 14 guidance for managing AI investments recommends five moves: improve visibility into usage and spend, evaluate efficiency by outcome ROI, govern advanced workflows before scaling, fund workflows that compound, and match capacity to proven demand. Primary source: OpenAI, “How to manage AI investments in the agentic era” . The hard part is the denominator. “This agent used $800” says little. “This workflow cost $14 per accepted reconciliation, including review and rework” can support a decision. Here is a one-page ledger I would require for an agent pilot. Define one accepted outcome Do not start with tokens, seats, or tasks launched. Define the business state that counts after review. workflow : vendor-invoice-reconciliation accepted_outcome : " invoice matched, exceptions reviewed, result posted" owner : finance-ops pilot_window_days : 21 minimum_sample : 100 invoices quality_gate : false_postings : 0 exception_recall : " >= 0.98" reviewer_minutes_p50 : " <= 3" A generated draft is not an outcome if a person must rebuild it. An agent run is not successful if its result never enters the system of record. Capture the complete cost AI cost + orchestration and observability + human review + rework + incident handling + allocated implementation cost = total workflow cost Use a table with declared variables: Variable Meaning Example only C_model model and tool-call spend $600 C_platform workflow infrastructure $200 H_review reviewer hours 35 R_hour loaded reviewer rate $45 C_build pilot build cost allocated to window $2,000 N_accept accepted outcomes 850 total = C_model + C_platform + H_review * R_hour + C_build cost_per_accepted_outcome = total / N_accept With the illustrative numbers, total cost is $4,375 , or about $5.15 per accepted outcome. These are not benchmark claims; replace every value with measured data. Compare against the real baseline The baseline must use the same unit and quality gate: Metric Manual baseline Agent pilot attempted invoices

Vercel's AI SDK 7 adds scoped tool context: a tool can declare a contextSchema , while the caller supplies per-tool values through toolsContext . The purpose is practical—third-party tools do not need to receive every secret or configuration value held by an agent. Primary source: Vercel, “AI SDK 7 is now available” . Let's turn that feature into a tiny security exercise. We will create two tools: lookupOrder may receive an internal order-service URL; createTicket may receive a support token; neither tool should receive the other's value. Setup Use a fresh project and pin the versions you actually install in your lockfile: mkdir scoped-tools && cd scoped-tools npm init -y npm install ai zod npm install -D typescript tsx @types/node Create demo.ts : import { tool } from ' ai ' ; import { z } from ' zod ' ; const lookupOrder = tool ({ description : ' Read the status of one order ' , inputSchema : z . object ({ orderId : z . string (). min ( 1 ) }), contextSchema : z . object ({ baseUrl : z . string (). url () }), execute : async ({ orderId }, { context }) => ({ orderId , source : new URL ( `/orders/ ${ orderId } ` , context . baseUrl ). toString (), status : ' demo-only ' , }), }); const createTicket = tool ({ description : ' Create a support ticket ' , inputSchema : z . object ({ subject : z . string (). min ( 3 ) }), contextSchema : z . object ({ supportToken : z . string (). min ( 12 ) }), execute : async ({ subject }, { context }) => ({ subject , accepted : context . supportToken . startsWith ( ' support_ ' ), }), }); const tools = { lookupOrder , createTicket }; const toolsContext = { lookupOrder : { baseUrl : ' https://orders.invalid ' }, createTicket : { supportToken : ' support_demo_token ' }, }; async function run () { const order = await lookupOrder . execute ! ( { orderId : ' A-17 ' }, { context : toolsContext . lookupOrder } as never , ); const ticket = await createTicket . execute ! ( { subject : ' Order is delayed ' }, { context : toolsContext . createTi