标签：#Python

If you're learning Data Analytics and looking to build a strong portfolio, working on real-world...

In a recent audit, a team showed me an AI assistant they'd built on top of their company knowledge base. The demo had landed well: ask how to use a feature, and it walked through the exact pain point their support queue kept seeing. Leadership signed off. In production, the same agent told a user to open a menu option that didn't exist. Not a vague answer - a specific UI path, stated with confidence. Nobody caught it in testing. It surfaced when I audited the system, not when a user complained. The prototype passed testing because nobody was checking whether the answer matched the product. In production, that gap becomes a liability: the model invents UI paths, and your backend has no schema to reject them. When you're choosing an agent framework, popularity is the wrong scorecard. Pick the one that fails loudly in development and gracefully in production - or you'll find out in audit. What "Production-Ready" Actually Requires Tutorial agents are built to impress in a fifteen-minute demo. Production agents run unattended, handle bad inputs, and ship answers your backend has to trust. The gap between those two goals is where most teams stumble - and it's rarely visible until something reaches a user. When I audit agent codebases, I evaluate five things the tutorials skip: Structured, validated outputs: Can your system reject an invented menu path before it becomes user-facing advice? Dependency injection for testing: Can you swap the knowledge base for a mock in CI without rewiring the agent? Retry and error handling: When the model returns malformed output, does the framework retry - or do you ship a parser exception? Observability hooks: Can you trace which document grounded a bad answer when support escalates? Type-checker support: Will static analysis catch a breaking API change before deploy, or after the agent silently misbehaves? If you want to score your own system, the Production Readiness Audit covers the same five categories - deployment, observability, fa

你知道吗？最近一个 AI Agent 直接删除了生产数据库，然后在 Twitter 上轻松"自首"——这条消息在 Hacker News 上获得了 860 分和超过 1000 条评论。随着 AI Agent 从演示走向生产环境，"在我的机器上能跑"和"它能安全地运行我的业务"之间的鸿沟从未如此巨大。 Pydantic AI 正是为弥合这一鸿沟而来。这个拥有 17,895 Stars 的 Python Agent 框架，由 Pydantic Validation 的同一团队打造——而 Pydantic Validation 正是 OpenAI SDK、Anthropic SDK、Google ADK、LangChain、LlamaIndex、CrewAI 等数十个 GenAI 工具的数据验证层。如果你用过 FastAPI，你已经知道 Pydantic 的感觉：类型安全、优雅、生产就绪。Pydantic AI 将这种哲学完整地带入了 Agent 开发领域。 在 2026 年的今天，大多数 Agent 框架把 LLM 当成返回字符串的黑盒子。Pydantic AI 则将其视为类型化、可验证、可组合的系统——这改变了一切。 隐藏用法 #1：人工审批工具调用（阻止 Agent 乱来） 大多数人的做法： 给 Agent 完全自由去调用任何工具——数据库查询、API 调用、文件删除——然后祈祷一切顺利。当出了问题时，你从用户口中才知道。 隐藏技巧： Pydantic AI 的延迟工具（deferred tools）让你可以标记某些工具调用在执行前需要人工审批。Agent 会规划好动作，但在执行前暂停并等待人类批准或拒绝——完美适用于数据库写入、金融交易或生产部署等破坏性操作。 from pydantic_ai import Agent , RunContext , DeferredToolRequests from pydantic import BaseModel agent = Agent ( ' openai:gpt-4.1 ' , output_type = str , # 通过 deferred=True 标记需要审批的工具 ) @agent.tool ( deferred = True ) async def delete_user_account ( ctx : RunContext , user_id : str ) -> str : """ 永久删除用户账户。需要人工审批。 """ # 这段代码只在人工审批通过后才会执行 await db . users . delete ( user_id ) return f " 用户 { user_id } 已删除 " # 运行 Agent——如果它尝试调用 delete_user_account， # 执行会暂停并返回 DeferredToolRequests 对象 result = await agent . run ( " 清理不活跃账户 " ) if isinstance ( result . output , DeferredToolRequests ): # 将待执行的工具调用展示给人类审批 for tool_call in result . output . calls : print ( f " Agent 想要执行: { tool_call . tool_name } ( { tool_call . args } ) " ) approved = input ( " 是否批准？(y/n): " ) if approved . lower () == ' y ' : # 带审批结果恢复执行 result = await agent . run ( " 已批准 " , message_history = result . all_messages (), deferred_tool_requests = result . output , ) 效果： Agent 可以自主处理安全操作（读取数据、生成报告），而在危险操作上自动暂停等待人工判断。不再有删库跑路的意外。 数据来源： Pydantic AI GitHub 17,895 Stars（通过 GitHub API 验证，最后推送 2026-06-21）。HN Algolia 搜索"pydantic-ai agent framework"获得 12 分讨论帖。"AI agent deleted production database"故事在 HN 上获得 860 分/1032 条评论（数据来源：HN Algolia API）。 隐藏用法 #2：基于图的多 Agent 工作流 + 类型安全状态 大多数人的做法： 构建线性

Origin: Halfway through a chat, where is that meme? Every heavy chat user has a bunch of memes saved on their phone and computer, but when they actually need one—halfway through a conversation, wanting to send a "Thanks, let's keep in touch" or "I'm just bad"—they can never find it. The filename is IMG_4821.jpg , albums are not categorized, and searching is impossible. I first came across a great open-source project ShiQu1218/MemeTalk , which uses Python + Streamlit + SQLite to build a local meme semantic search system. It scans your local meme folder, creates an index using OCR and vector embeddings, and then performs multi-way retrieval. It's fully functional but research-oriented and requires running Streamlit in a browser. What I wanted was something closer to an "everyday handy tool": A native Mac App, a search box, where I type what I'm looking for, relevant memes pop up, and a single click copies it directly to the clipboard. Thus MemeFinder was born. This article documents its development process from scratch to "menu bar resident + global hotkey

After a full week of intensive Bitcoin programming training, the developers at Zone01 Kisumu moved into the most exciting phase of the bootcamp: building real-world solutions powered by Bitcoin, the Lightning Network, and LND. One thing I learned throughout the experience is that the human mind is truly fascinating. The room was filled with innovative ideas, each attempting to solve a different problem. As the saying goes, no idea is a bad idea—every concept had the potential to make an impact. A total of 17 teams were formed, and each team embarked on a 24-hour hackathon journey to transform their ideas into working products. After an intense day of development came the presentation phase, where we had the privilege of showcasing what we had built. Our team developed Kasi , a WhatsApp chatbot that enables Bitcoin transactions directly through WhatsApp. The goal was to make Bitcoin payments more accessible by leveraging a platform that millions of people already use daily. To build Kasi, we integrated the Twilio API for WhatsApp communication and utilized the Bitnob platform to facilitate Bitcoin transactions. Python was used throughout the development process. The project was brought to life by six developers: Claire, Lamka, Ijay, Dishon, Talo, and myself. Beyond the technical implementation, the hackathon strengthened our understanding of collaborative software development. We practiced Git workflows, team coordination, version control, task management, and effective communication under tight deadlines—skills that are just as valuable as writing code. Although we did not finish at the top of the leaderboard, the experience was incredibly rewarding. Every team brought something unique to the table, and the winners fully deserved their recognition. Congratulations to all the teams that participated and showcased their creativity, determination, and technical skills. One moment from the presentation will stay with me for a long time. As we were demonstrating Kasi to

I build algorithmic trading bots as a side project. Nothing fancy — just small strategies that trade US equity options automatically. The problem I kept running into wasn't the strategy logic. It was the data. Every time I wanted to pull real-time options chains, Greeks, or IV, I had two options: Pay $99+/mo to a data provider Scrape something I probably shouldn't be scraping Neither felt right for a hobbyist project. So I built Market-Options — a simple REST API for US equity options data at $20/mo. What It Does It's a plain REST API. No SDK, no special client library — just HTTP requests and JSON responses. It covers four endpoints: chain — full options chain for a given underlying contract — data for a single contract contracts — batch lookup across multiple contracts contract-overview — Greeks, IV, expiration details Coverage is the top 100 US equity underlyings, which accounts for roughly 95% of actual US options volume. If you're building a bot that trades SPY, QQQ, AAPL, TSLA, or anything in that tier — it's covered. Why Only 100 Underlyings? Because that's what most people actually trade. When I looked at my own bots, and at what most retail algo traders focus on, the top 100 covers everything practical. Exotic underlyings with low volume are also harder to get real data on reliably — so rather than promise coverage I can't deliver, I focused on doing the core well. A Simple Example curl "https://api.market-option.com/chain?symbol=SPY&expiration=2025-01-17" \ -H "Authorization: Bearer YOUR_API_KEY" Response is clean JSON: { "symbol" : "SPY" , "expiration" : "2025-01-17" , "options" : [ { "strike" : 480 , "type" : "call" , "bid" : 3.45 , "ask" : 3.50 , "iv" : 0.182 , "delta" : 0.42 , "gamma" : 0.031 , "theta" : -0.18 , "vega" : 0.29 } ] } No parsing headaches, no weird date formats. Pricing Free tier : 1,000 credits/day — enough to test and build Pro : $20/mo, unlimited within fair use Trial : New accounts get 7 days of Pro, no credit card required Who It's F

GitHub热门项目 | slime is an LLM post-training framework for RL Scaling. | Stars: 6,592 | 175 stars today | 语言: Python

GitHub热门项目 | Cognee is the open-source AI memory platform for agents. Give your AI agents persistent long-term memory across sessions with a self-hosted knowledge graph engine. | Stars: 18,425 | 361 stars today | 语言: Python

GitHub热门项目 | SpiderFoot automates OSINT for threat intelligence and mapping your attack surface. | Stars: 18,583 | 288 stars today | 语言: Python

GitHub热门项目 | b站会员购购票辅助工具 | Stars: 3,685 | 164 stars today | 语言: Python

GitHub热门项目 | An open-source long-horizon SuperAgent harness that researches, codes, and creates. With the help of sandboxes, memories, tools, skill, subagents and message gateway, it handles different levels of tasks that could take minutes to hours. | Stars: 72,256 | 415 stars today | 语言: Python

A few weeks ago I gave an AI agent access to my machine through MCP. It read files, opened PRs, queried a database. It was great — until I looked at what it could have done if a tool description had been poisoned, or a prompt injection had slipped through. The answer was: anything. ~/.ssh/id_rsa . DROP TABLE users . rm -rf / . The agent had sudo, and nobody had voted for that. So I built AgentPerms — a CLI that gives MCP agents least-privilege permissions the same way you'd lock down any other process: figure out the minimum it actually needs, pin it, prove it, and enforce it. pip install agentperms The gap nobody was filling MCP (the Model Context Protocol) is quietly becoming the USB-C of AI tooling. Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI — they all speak it. Which is wonderful, and also means your agent is one config file away from your filesystem, your repos, your inbox, and prod. The existing tools each do part of the job: Scanners tell you something looks risky. Then they leave. You still have a risky thing. Firewalls / allowlists make you hand-write YAML up front — before you have any idea what the agent will actually use. Neither closes the loop. What I wanted was the boring, proven security workflow we already use for everything else: observe real behavior → derive least privilege → enforce it → keep it honest in CI. That's the whole thesis of AgentPerms, as a pipeline: record → infer → lock → replay → enforce See it in 30 seconds (no setup, no network) AgentPerms ships with a deliberately over-privileged demo MCP server, so you can watch a real policy decision without wiring anything up: # Flag risky config: a ~/.ssh mount and an unpinned npx server agentperms scan --path examples/vulnerable-mcp-demo # Replay a pack of canned attacks against an example policy agentperms replay --policy examples/policies/example.mcp.policy.yaml Output: 8/8 attacks blocked. SSH-key exfiltration, .env reads, rm -rf / , unapproved email, force-push, repo deletio

In Part 2 , LoRA let me fine-tune a 1.5B model by freezing it and training tiny adapters. But the frozen base still sat in memory in 16-bit (~3GB). Now I wanted to go to Qwen2.5-7B — and hit a wall that LoRA alone doesn't solve. The problem A 7B model is ~15GB in 16-bit precision. A free-tier T4 GPU has 16GB. It would barely load, with no room left to actually train. The QLoRA insight QLoRA asks the question that naturally follows from LoRA: the base is frozen and only ever read — so why store it in full precision? So you quantize the frozen base to 4-bit (NF4, a format tuned for how neural-net weights are distributed) and run the LoRA adapters on top in normal precision. The base shrinks dramatically; the trainable part stays small and precise. from transformers import BitsAndBytesConfig bnb_config = BitsAndBytesConfig ( load_in_4bit = True , bnb_4bit_quant_type = " nf4 " , # NormalFloat4 bnb_4bit_use_double_quant = True , # quantize the quant constants too bnb_4bit_compute_dtype = torch . float16 , # dequantize to fp16 for the matmuls ) model = AutoModelForCausalLM . from_pretrained ( MODEL_ID , quantization_config = bnb_config , device_map = " auto " ) Each flag earns its place: load_in_4bit — store frozen weights in 4 bits instead of 16. nf4 — a 4-bit type matched to the bell-curve distribution of neural-net weights (better than plain int4). double_quant — quantize the quantization constants too, for a bit more savings. compute_dtype — dequantize to fp16 for the actual matmuls, so storage is 4-bit but compute stays precise. The moment it clicked One line of output: loaded in 4-bit. footprint: 5.44 GB I downloaded 15.2GB of weights and they sat in memory as 5.44GB. A model that couldn't be loaded for full fine-tuning was now training on a single consumer GPU — with room to spare. (The download is still 15GB; bitsandbytes quantizes on the fly during load.) The QLoRA-standard recipe Two more pieces beyond Part 2's LoRA setup: prepare the quantized model for trainin

You've probably seen that trending post — "I Asked AI to Write My Commit Messages and It Was Embarrassing." Same. But instead of accepting embarrassing output, I fixed it. Here's the thing: the problem isn't AI writing commit messages. The problem is how you ask it. One clear system prompt + the actual diff = surprisingly good results. The Setup No new packages. No API key. If you have Claude Code , you're already set. #!/usr/bin/env python3 import subprocess SYSTEM = ( " You are a git commit message generator. " " Output ONLY the commit message — no explanation, no markdown, no quotes. " " Follow Conventional Commits: type(scope): subject. " " Types: feat, fix, docs, style, refactor, test, chore. " " Subject: imperative, lowercase, max 72 chars. " ) diff = subprocess . check_output ([ " git " , " diff " , " --staged " ], text = True ) if not diff . strip (): print ( " Nothing staged. Run `git add` first. " ) raise SystemExit ( 1 ) msg = subprocess . check_output ( [ " claude " , " -p " , SYSTEM + " \n\n " + diff ], text = True , ). strip () print ( msg ) That's it. 20 lines. Uses the claude CLI under the hood — no API key, no config, just your existing Claude Code OAuth session. Why It Works The system prompt does the heavy lifting. Three constraints: Output ONLY the commit message — no preamble, no explanation Follow Conventional Commits — feat , fix , chore , etc. max 72 chars — keeps it readable in git log The diff is the context. You're not asking "write a commit message". You're asking "given these exact changes, what happened?" That's a much more answerable question. Usage # No setup needed if you have Claude Code. Just: git add . python /path/to/git_commit.py # → feat(server): add AI commit message generator via Claude CLI Or wire it into a git alias: git config --global alias.ai '!python /path/to/git_commit.py' # git ai The Results Before: update stuff fix bug WIP added the thing After: feat(api): add generate_commit_message tool to MCP server fix(auth): ha

Gelişmiş Veri İşleme (Python) Sıralama, Filtreleme ve Arama – Profesyonel Veri Manipülasyonu Rehberi Python’da veri işleme, sadece döngülerden ibaret değildir. Modern Python yaklaşımı; fonksiyonel programlama araçları , yüksek seviyeli built-in fonksiyonlar ve lambda ifadeleri ile daha kısa, daha okunabilir ve daha performanslı çözümler üretmeyi hedefler. Bu bölümde dört kritik alanı derinlemesine inceleyeceğiz: sorted() ile gelişmiş sıralama lambda ile karmaşık veri yapıları üzerinde sıralama filter() ve map() ile fonksiyonel veri dönüşümü any() ve all() ile toplu doğrulama (validation) Her bölümde gerçek dünya senaryoları ve hands-on örnekler olacak. 1. sorted() Fonksiyonu — Gelişmiş Sıralama Motoru 1.1 Temel Yapı sorted ( iterable , key = None , reverse = False ) Parametreler: iterable: Liste, tuple, set vb. key: Sıralama kriteri (fonksiyon) reverse: True → büyükten küçüğe 1.2 Basit Sıralama ```python id="s1" sayilar = [5, 1, 9, 3, 7] sonuc = sorted(sayilar) print(sonuc) --- ## 1.3 Ters Sıralama ```python id="s2" sayilar = [5, 1, 9, 3, 7] print(sorted(sayilar, reverse=True)) 1.4 Tuple Sıralama ```python id="s3" veri = (10, 5, 20, 15) print(sorted(veri)) --- ## 1.5 String Sıralama (ASCII mantığı) ```python id="s4" kelimeler = ["python", "ai", "data", "backend"] print(sorted(kelimeler)) 2. key Parametresi — Sıralamanın Beyni sorted() fonksiyonunun gerçek gücü burada başlar. 2.1 String Uzunluğuna Göre Sıralama ```python id="k1" kelimeler = ["python", "ai", "veri", "makineöğrenmesi"] sonuc = sorted(kelimeler, key=len) print(sonuc) --- ## 2.2 Sayıların Moduna Göre Sıralama ```python id="k2" sayilar = [10, 3, 7, 21, 14, 9] sonuc = sorted(sayilar, key=lambda x: x % 5) print(sonuc) 2.3 Tuple Sıralama (Gerçek Dünya) ```python id="k3" urunler = [ ("Laptop", 45000), ("Mouse", 500), ("Monitör", 12000) ] sonuc = sorted(urunler, key=lambda x: x[1]) print(sonuc) --- ## 2.4 Çok Katmanlı Sıralama Fiyat → sonra isim ```python id="k4" urunler = [ ("Laptop", 45000), ("Mouse", 500),

Python provides socket.AF_UNIX , asyncio.open_unix_connection() , and asyncio.start_unix_server() for working with Unix Domain Sockets on Unix-like operating systems. On Windows, however, support for Unix Domain Sockets tends to depend on the Python version and runtime environment. In particular, differences become apparent when trying to use the higher-level asyncio APIs in the same way as on Unix. To address this, I created a compatibility layer that hides the differences between Unix and Windows and allows AF_UNIX sockets to be used through a largely identical API. This article covers two types of APIs: An asyncio -based AF_UNIX compatibility API A synchronous socket -based AF_UNIX compatibility API Goal The objective is straightforward. On Unix, use the standard library APIs as-is. On Windows, fill in the missing functionality so that application code can remain as unified as possible. For example, on Unix you can write: reader , writer = await asyncio . open_unix_connection ( path ) And on the server side: server = await asyncio . start_unix_server ( handle_client , path ) The goal is to preserve this style of programming on Windows as much as possible. What Was Built The compatibility layer consists of two major components. 1. Asyncio Version This is the asynchronous implementation designed to match the asyncio Unix Domain Socket APIs. The main APIs are: await open_unix_connection ( path , * , limit = ...) await start_unix_server ( callback , path , * , limit = ..., backlog = ...) await create_unix_connection ( protocol_factory , path , ...) await create_unix_server ( protocol_factory , path , ...) install () On Unix-like systems, these simply delegate to the standard asyncio implementation. On Windows, they use Winsock AF_UNIX sockets and combine WSAEventSelect with event-loop handle waiting to implement asynchronous operations. 2. Synchronous Socket Version This version provides a traditional blocking-socket-style API without using asyncio . The main APIs ar

This was originally posted on my blog . I was not planning to build a rate limiting library. I had a FastAPI project, I needed rate limiting, I reached for SlowAPI, which is the most popular choice for FastAPI, and wired it up. Took maybe 20 minutes. Then I started actually using it. The request: Request problem The first thing that got to me was the request: Request requirement. SlowAPI's decorator needs access to the request to extract the client IP or user ID, and the only way it can get that is if your route function accepts it as a parameter. So every rate-limited route ends up looking like this: @app.get ( " /items " ) @limiter.limit ( " 10/minute " ) async def get_items ( request : Request ): return await fetch_items () That request: Request is not doing anything. fetch_items() does not use it. It's there purely because SlowAPI needs it. Small thing, but it bothered me — I like function signatures that say exactly what they need, and this one was lying. The header injection problem I could live with that. The thing I could not live with was the header injection. Rate limit headers are genuinely useful — X-RateLimit-Remaining tells clients when to back off, Retry-After tells them how long to wait. Standard stuff. So I enabled SlowAPI's header injection and immediately hit a wall: every rate-limited route now had to return a Response object directly. Not a dict. Not a Pydantic model. A Response . The moment you enable header injection, SlowAPI expects to work with an actual response object, and if your route returns anything else it just breaks. So I was suddenly doing this: @app.get ( " /items " ) @limiter.limit ( " 10/minute " ) async def get_items ( request : Request , response : Response ): items = await fetch_items () return JSONResponse ( content = jsonable_encoder ( items )) Which is annoying because one of the things I actually like about FastAPI is that you declare a return type, FastAPI handles the serialization, and your OpenAPI schema just works. Sl

In the world of Generative AI, there is a massive difference between asking for a "pancake recipe" and asking for "eligibility criteria for phase III immunotherapy trials." In specialized fields like healthcare, a standard vector search often fails because medical terminology is dense, specific, and unforgiving. 🏥 Today, we are building a High-Precision Medical RAG (Retrieval-Augmented Generation) engine. We will move beyond simple semantic search by implementing Hybrid Search (Dense + Sparse vectors) using the powerhouse BGE-M3 model, storing it in Qdrant , and fine-tuning the results with FlashRank . This approach ensures that technical medical terms (like EGFR L858R mutation ) aren't lost in the "vibe" of a vector space. Keywords: Hybrid Search , Medical RAG , BGE-M3 Embeddings , Qdrant Vector Database , Clinical Trial Retrieval . The Architecture: Why Hybrid Search? Traditional RAG relies on "Dense Vectors" (semantic meaning). However, in clinical trials, keywords matter. A patient searching for "Pembrolizumab" needs that exact drug, not just "something related to cancer." By using BGE-M3 , we get the best of both worlds: Dense Retrieval : Captures the context and intent. Sparse Retrieval (Lexical) : Captures specific keywords and medical codes. Reranking : Re-evaluates the top hits to ensure the most clinically relevant document is on top. graph TD A[User Query: Medical Case] --> B{BGE-M3 Encoder} B -->|Dense Vector| C[Qdrant Collection] B -->|Sparse Vector| C C --> D[Hybrid Search Results] D --> E[FlashRank Reranker] E --> F[Top K Relevant Documents] F --> G[LLM: Final Synthesis] G --> H[Actionable Clinical Insight] Prerequisites 🛠️ Before we dive in, make sure you have your environment ready: Qdrant : Our high-performance vector database. BGE-M3 : A state-of-the-art embedding model that supports dense, sparse, and multi-vector retrieval. FlashRank : An ultra-fast, lightweight reranking library. LangChain : To orchestrate our RAG pipeline. pip install qdrant-c

Securing LLM Agent Teams: Inside NRT-Defense v0.4.0 Multi-turn autonomous LLM agents are expanding rapidly in safety-critical systems. However, a major vulnerability has been exposed by Lee et al. (2026) in the NRT-Bench paper : adaptive multi-turn attacks can exploit disjoint model vulnerabilities, causing a 8.7% to 12.1% loss of Critical Safety Functions (CSFs) . To solve this, I am open-sourcing NRT-Defense , an adaptive multi-turn defense framework designed to monitor agent sessions and reduce the attack success rate to <1% . The Threat: Context Drift and Disjoint Exploits Standard guardrails evaluate prompts in isolation (single-turn). Attackers leverage this by spreading an exploit across multiple conversational turns. Turn by turn, the context drifts until the agent team completely bypasses its safety containment. The NRT-Bench paper demonstrated this in a simulated nuclear power plant control room with 5 operator roles, 4 attack channels, and 6 critical safety functions. The results were alarming: Metric Value Attack success rate 8.7% — 12.1% Sessions analyzed 149 Models tested 4 frontier LLMs Vulnerability overlap Nearly disjoint The key finding: vulnerabilities are nearly disjoint across models . An attack that works against GPT-4 may not work against Claude. This means model diversity is itself a defense — but only if you can detect and respond to attacks in real-time. The Solution: 3-Step CMPE Defense nrt-defense neutralizes this threat through a continuous, multi-component pipeline: Per-Turn Message Analysis: Evaluates channel risk and turn-escalation metrics. Each message is scored for adversarial content using keyword detection, pattern matching, and channel-specific risk weights. Real-Time CSF Monitoring: Tracks 6 operational critical safety functions simultaneously. Risk accumulates over turns and triggers alerts when thresholds are breached. Context-Aware Misdirection Prompt Engineering (CMPE): When an anomaly is detected, instead of a blunt reject

📌 Key Concepts Overview Concept One-Line Definition while loop Repeats code as long as a condition is True while True Infinite loop — needs break to stop break Immediately exits the loop continue Skips current iteration, moves to next List Ordered, mutable collection — heterogeneous elements allowed List Comprehension One-line way to build a list using a loop + condition List Mutability Lists can be changed in place — id() stays the same 🔁 Part 1 — while Loop The 3 Components (Critical Pattern) # 1. Initialisation 2. Condition 3. Increment/Decrement a = 1 # 1. Initialisation while a <= 10 : # 2. Condition print ( ' Devops ' ) a += 1 # 3. Increment # Without increment → INFINITE LOOP (condition never becomes False) How it works: Condition is checked before each iteration. As soon as it's False , the loop stops. Miss the increment/decrement → infinite loop (a real production hazard — can hang a script or burn CPU). while — Practical Patterns # Countdown (decrement) a = 10 while a > 0 : print ( ' Devops ' ) a -= 1 # Sum of 1 to 20 total = 0 a = 1 while a <= 20 : total += a a += 1 print ( total ) # 210 # Product (factorial-style) of 1 to 20 product = 1 a = 1 while a <= 20 : product *= a a += 1 print ( product ) # Pattern using while + string repetition str1 = ' Devops ' i = 0 while i < len ( str1 ): print ( str1 [ i ] * ( i + 1 )) i += 1 # D # ee # vvv # oooo # ppppp # ssssss for vs while — When to Use Which Use for Use while You know the iterable / number of repetitions You don't know how many times — depends on a condition Looping over list, string, range Retry logic, polling, waiting for a state # DevOps: retry logic — classic while True use case max_attempts = 5 attempt = 0 while attempt < max_attempts : print ( f ' Attempt { attempt + 1 } : Connecting to server... ' ) # if connection succeeds: break attempt += 1 while True — Infinite Loop Pattern # Always True — runs forever until break is hit # Used for: retry logic, polling, menu-driven scripts, password validati