标签：#automation

Over the past few years, AI has fundamentally changed how software gets built. Teams can go from an idea to a working application in a fraction of the time it used to take, and founders can create products with resources that would have been unimaginable just a few years ago. That's an incredible shift, and I think it's one of the most exciting changes our industry has seen. What hasn't changed, though, is the question that comes after the application is built: Is it actually ready? Throughout my career, I've been involved in delivering enterprise software across many different industries and organizations. One thing I've learned is that there isn't a single definition of what makes an application "ready." If you ask six different stakeholders whether a system is ready, you'll probably get six different answers—and they're all likely to be valid. That's because each person is looking at the software through the lens of the outcome they're responsible for: A founder may be wondering whether the application can handle the growth they're hoping for over the next year. A CTO is often focused on where the biggest technical risks are and what should be improved first. An engineering leader is thinking about production readiness, security, reliability, and operational support. An agency inheriting a client application wants to understand what they're taking ownership of before making commitments. An acquirer is trying to estimate the cost of technical debt An Investor wants confidence that the technology is creating long-term value rather than future expense. Those perspectives are different because the questions they're trying to answer are different. The challenge is that we often evaluate all software the same way. Traditional assessments tend to focus on the health of the codebase. They look at architecture, security, maintainability, testing, complexity, and technical debt. Those are all important, and they should absolutely be part of any technical review. But they'r

You have been here. The test suite is green. The deployment pipeline reports all checks passed. Then a customer opens a ticket with a screenshot that shows something your test never caught. The test passed in staging. It fails in production. And you cannot reproduce it locally. This is not a flaky test problem. It is a fidelity problem. Your test environment and your production environment are not the same thing. The gap between them is where real bugs live. Let me walk through one concrete example, the fix, and what it teaches about writing tests that survive the handoff to a real user. The Problem: Environment Drift A fintech team I worked with had a checkout flow. The test clicked "Pay Now", waited for a success message, and asserted the text "Payment successful" appeared on screen. It passed every time in staging. Customers reported that after paying, they saw a blank white page for several seconds before the success message appeared. Some of them closed the tab during that blank period, thinking the payment failed. The transaction went through. The customer never saw the confirmation. Support tickets piled up. The test never caught this because the staging environment served the success page in under 200 milliseconds. The blank period did not exist there. Production had a slower downstream service that introduced a three-second delay between the payment confirmation and the page render. The test was correct in what it checked. It was wrong in what it assumed about timing and state. The Fix: Test the Experience, Not Just the Outcome The fix was not to add a longer wait. The fix was to test what the user actually experiences during that gap. Here is a minimal Playwright test in TypeScript that catches this class of problem: import { test , expect } from ' @playwright/test ' ; test ( ' checkout shows loading state before success ' , async ({ page }) => { await page . goto ( ' /checkout ' ); await page . fill ( ' #card-number ' , ' 4111111111111111 ' ); await page

Gherkin is not a test automation tool. It never was. Yet here we are, five years into your SDET career, and you're staring at a feature file that reads like a step-by-step manual for a human tester. Given I log in with username "admin" and password "password123" . When I click the "Submit" button . Then I see the text "Welcome" on the screen . You've written two years of these. Your team calls it BDD. Your manager calls it "living documentation." And somewhere in the back of your mind, a quiet voice whispers: This is just a manual test case with extra steps. That voice is right. Let me say it plainly: if your Gherkin scenarios describe how the system works instead of what it should do, you are not doing BDD. You are writing manual test cases in a structured English format and calling it automation. The only thing you've automated is the illusion of progress. The problem isn't Gherkin. The problem is how we use it. Most teams adopt BDD because someone read a blog post about "collaboration" and "shared understanding." They install Cucumber or SpecFlow. They write feature files. They map steps to Selenium or Playwright code. And they call it a day. But look closely at what happens next. The product owner never reads the feature files. The developer skims them once and goes back to writing code. The QA engineer — that's you — becomes the sole maintainer of a growing pile of Gherkin that nobody else touches. You're not facilitating collaboration. You're translating manual test cases into a format that requires a compiler. Here's the real test. Take any feature file from your project. Hand it to a developer who has never seen it. Ask them to implement the feature using only the Gherkin as a spec. If they can write production code from it, you have real BDD. If they ask you for clarification, you have documentation theater. I've seen teams with hundreds of feature files. Beautifully formatted. Perfect indentation. Tags for every regression cycle. And not a single one of th

Most engineers expect AI-assisted automation to be the easy part. You describe a test, the model writes it, you move on. The first week will prove you wrong. Not because the code is bad. Because the code is almost right. And almost-right code is harder to debug than wrong code. Wrong code fails loudly. Almost-right code passes on Monday, fails on Tuesday, passes again on Wednesday, and by Thursday you are questioning whether you understand your own application. I have watched teams adopt AI copilots into their Playwright suites and spend the first five days doing nothing but untangling false passes. If you are about to start this journey, here is what that week actually looks like. The Problem: The Model Does Not Know What "Stable" Means A language model has never waited for a network response. It has never watched a flaky selector survive three CI runs and then collapse on the fourth. It writes tests from a static understanding of your page, not from the dynamic reality of your application. You will ask it to write a test that clicks a button and waits for a confirmation toast. The model will produce something like this: await page . click ( ' button:has-text("Submit") ' ); await page . waitForSelector ( ' .toast-success ' ); Looks fine. Runs fine. Then your team deploys a new build where the toast takes 400ms longer to appear because of an analytics call. The test fails. Not because the feature broke. Because the model assumed a timing that was never guaranteed. This is the core problem. The model writes tests that match the page as it was when the model saw it . It does not write tests that match the page as it will be . The Solution: Treat AI-Generated Tests as Drafts, Not Deliverables The shift is mental before it is technical. You cannot review AI-generated tests the way you review human-written tests. Human tests come with intent. AI tests come with patterns. You need a different review lens. First, look for every hardcoded wait. Replace it with a state-based

Most people working in offices never think about why the temperature stays comfortable throughout the day. The cooling adjusts automatically. Fresh air increases when occupancy rises. Fans start and stop without anyone touching a switch. Behind all of this is a device that most building occupants have never heard of: the DDC Controller. The Hidden Computer Inside Every Modern Building Walk into a mechanical room and you'll find equipment everywhere: Air Handling Units (AHUs) Chillers Pumps Cooling Towers VAV Boxes All these systems need coordination. If the supply air temperature rises above its target, something has to react. If occupancy increases, fresh air must increase. If a fan trips, alarms must be generated. This is where a DDC controller comes in. Think of it as a small industrial computer dedicated to one job: keeping a building running efficiently. A Typical Day in the Life of a DDC Controller Imagine an AHU supplying air to an office floor. At 9:00 AM employees begin arriving. The return air temperature starts increasing. The DDC controller notices this through a temperature sensor. Within seconds it: Reads the sensor value Compares it against the setpoint Calculates the cooling demand Adjusts the chilled water valve Verifies fan operation Repeats the process No operator is required. No manual intervention is needed. The controller quietly performs these calculations all day. Why Not Just Use a PLC? This is one of the most common questions from engineers entering building automation. PLCs and DDC controllers are both programmable devices. However, they were designed for different worlds. A PLC excels at: Manufacturing lines Packaging machines Process control High-speed sequencing A DDC controller excels at: HVAC control Energy optimization Occupancy schedules Comfort management BACnet communication Both can control equipment. The difference is what they were originally built for. The Four Signals Every BMS Engineer Learns First If you're new to building

Reading a public website and changing something inside a signed-in account are not the same kind of job. I wanted an AI agent to collect the first 10 Hacker News stories, explain how it gathered them, and place that work inside my DEV editor. Save the article as a draft. Do not publish it. The hard part was not finding the stories. It was giving the agent enough access to finish inside my signed-in account without giving it permission to publish. That instruction contained two jobs with different access needs: Read public data from Hacker News. Change private account state by creating a draft in my signed-in DEV account. Using a full browser for the first job would add machinery and access that the result did not need. The public fetch path had neither the authenticated context nor the authority required for the second job. The useful question was not “Which browser tool should do everything?” It was “Where does this task actually cross into a browser?” Disclosure: I work on Unchained, SearchAgentSky, and Unbrowser. This article was prepared with AI assistance and reviewed before publication. The public step needed only fetch I initially opened Hacker News in a lightweight page session and queried its story links. It worked—but that did not mean it was necessary. Hacker News has a public API . The same result could be produced with ordinary HTTP: const base = " https://hacker-news.firebaseio.com/v0 " ; const ids = await fetch ( ` ${ base } /topstories.json` ). then ( r => r . json ()); const stories = await Promise . all ( ids . slice ( 0 , 10 ). map ( async ( id , index ) => { const story = await fetch ( ` ${ base } /item/ ${ id } .json` ). then ( r => r . json ()); return { rank : index + 1 , title : story . title , url : story . url ?? `https://news.ycombinator.com/item?id= ${ id } ` }; })); console . log ( JSON . stringify ( stories , null , 2 )); At 2026-07-19T03:19:04Z , the page query returned 30 Hacker News story anchors. At 2026-07-19T03:35:29.670Z , fetch

I used to deride the idea of an AI assistant from the moment they entered the picture (after seeing all the different *Claw variants). Why would regular people like me need an assistant? The best use case I had heard was: "Oh! It helps us decide whether I or my partner should drive the kids today!" Solving that sounded like a silly problem for an AI assistant to handle. Again, I didn't know any better because I didn't have that problem. I thought I could handle one-off tasks with just an AI subscription. What else was there? I only found the answer once I had a specific use case for it. I attended a business event, talked to a dozen people, and collected several business cards. I wanted to send each person a personalized email thanking them and continuing our conversation. If I were to do this manually, the process would look like this: open the email client, manually type in each email address from the business cards, ensure I typed everything correctly, compose my message, and again, make sure I didn't press "send" prematurely. Just thinking about it felt tedious. That is when the idea of an assistant started making sense. I fire up my coding agent(not a *Claw still), I take a single photo of all the business cards together. I ask the it to extract the names and email addresses. Then, I ask it to loop through the list and ask me what I want to send to each person. It creates drafts(which I still manually review - can't trust them enough), I say send, and then it sends them all automatically. It feels exactly like talking to a real assistant: you tell them what you want done, and it gets done without you having to press buttons or navigate a UI. That is exactly what I did; I simply gave it instructions using my voice. This makes me feel that having an AI assistant is indeed helpful. It might have also been useful to jump on this a little sooner, as I could have bought that Mac Mini at the older, lower price.

Originally published on hexisteme notes . I have a small pipeline that crossposts my notes to dev.to. It parses a Markdown file's front matter, builds a payload, and calls the dev.to API to publish. It has 19 gate tests, and every one of them was green the whole time it was shipping. It published nine articles. All nine went live with their titles broken — the front-matter quotes were sitting right there in the title, visible to anyone who looked, for nine days, and nothing in the pipeline noticed. I didn't notice either. A human had to open the dev.to profile page by accident before anyone found out. This is the postmortem, and the reason I'm writing it up as a general essay rather than just a fixed-bug log is that the root cause isn't specific to dev.to, or to Markdown front matter, or to Python. It's a category of mistake that any pipeline with an external endpoint on the other end can make: testing the payload you build, and never testing what the other system does with it. The pipeline that had "passed everything" The shape of it is ordinary. A draft file has YAML-style front matter — title: "Some Title" — because that's the convention. A parser reads the front matter and pulls out the title. A payload builder takes that title and a few other fields and assembles the JSON body for the dev.to API. The API gets called, dev.to accepts it, the article is live. Nineteen gate tests cover this path — the front-matter parsing and the payload/API contract of the pipeline's own code. All green, every publish. The gap is in what "parses the front matter" actually means. The parser isn't a real YAML parser. It's closer to line.partition(":") — split each line on the first colon, take the right-hand side as the value. That works fine for tags: testing, devops where there's nothing to unwrap. It does not work for title: "Some Title" , because the quote characters are part of the string on the right-hand side of the colon, and a partition-based parser has no concept of "this

My previous piece, " Making a launchd Job Unload Itself ," built a job that runs exactly once and then unloads itself. This time it's the mirror image: a pattern designed around the assumption that the job will die mid-run — it fires several slots a day and delivers "retry until it succeeds, then quit immediately on success." Every morning I hand Claude Code the task of updating my Obsidian Vault, and it kept dying partway through — killed by macOS sleep, no network on wake, or a claude timeout. Instead of trying to prevent every failure perfectly, I decided "it can die overnight as long as it's done by the time I wake up" was the more realistic goal, and I redesigned around that. The problem: "started but didn't finish" piles up silently There are three ways a launchd job fails to run to completion. Lid-close sleep (on battery) — caffeinate -s only works on AC power. On battery, the job freezes the instant you close the lid, and gets reaped by timeout after wake. No network — right after wake, WiFi isn't connected yet. git push and claude's API calls time out. claude timeout — an ingest that chews through 28 hours of conversation logs doesn't fit in a single slot and times out (this happened three days in a row, 2026-06-11 to 13). All three can look like "the job started, exit code 0," so you notice late. Overall design: 4 slots + a done-marker The fix is simple: stuff multiple StartCalendarInterval entries into the plist, and at the top of the script check "if today's run already succeeded, exit 0 immediately." <!-- com.shun.vault-auto-ingest.plist (StartCalendarInterval excerpt) --> <key> StartCalendarInterval </key> <array> <dict> <key> Hour </key><integer> 4 </integer><key> Minute </key><integer> 55 </integer> </dict> <dict> <key> Hour </key><integer> 8 </integer><key> Minute </key><integer> 20 </integer> </dict> <dict> <key> Hour </key><integer> 10 </integer><key> Minute </key><integer> 45 </integer> </dict> <dict> <key> Hour </key><integer> 12 </integer><key>

Day 17. OCR on banking apps is unreliable. I built a verification layer that double-checks every number. Day 16 was a milestone: multi-app workflows. The agent copied my bank balance and sent it to Mom on WhatsApp. Three apps. One task. But behind that success was an uncomfortable truth: the agent misreads numbers about 20% of the time. For a message to Mom, that's a typo. For a financial transaction, that's a disaster. Today, I built the fix. The Problem Banking apps scored F on my accessibility audit. No UI labels. No content descriptions. The agent has to rely entirely on OCR to read anything on screen. And banking apps have terrible OCR conditions: Small, condensed fonts for account numbers and balances Low contrast (grey text on slightly darker grey backgrounds) Currency symbols (₦, $, £) that OCR often confuses with numbers Commas in large numbers that OCR sometimes reads as decimals The result? A balance of "₦15,000" sometimes gets read as "₦15.000" or "₦15,00" or "₦15000." One missing digit. One wrong decimal. And the entire task is compromised. The Fix: Numeric Verification Layer I built a verification step specifically for financial data. Before any number gets stored in task memory, it goes through three checks. Check 1: Format Validation The extracted text must match a valid currency format. It must contain a currency symbol (₦, $, £, €) followed by digits, optionally with commas and a decimal point. Anything that doesn't match this pattern is rejected immediately. Check 2: Double-Read Confirmation The agent reads the same number twice—two separate screenshots, two separate OCR passes. If both readings match exactly, the number is accepted. If they differ, the agent reads a third time. If two out of three match, that value wins. If all three differ, the task is aborted with an error message. Check 3: Range Validation The extracted number must fall within a reasonable range. A bank balance of "₦0" or "₦999,999,999,999" is probably an OCR error. The agent

I wrote a cleanup routine that matched processes by command line with a wildcard pattern. It reported success on every run. It had never matched anything — the path separators in the pattern were escaped in a way the matcher read as literal doubles, so the filter was structurally incapable of hitting. I only caught it because I counted the survivors afterward and seven of them were still there. The fix was switching from a wildcard match to a plain substring containment check with no escape semantics at all. A filter that cannot fail loudly will lie to you politely forever. Before trusting any matcher, feed it a known-positive and watch it fire — a green result from an instrument you never saw go red is noise. What's the equivalent lesson your worst bug taught you?

A few months ago, I noticed something interesting about Bluesky. The people who were growing weren't necessarily posting the most brilliant content. They were simply consistent. They showed up every day, joined conversations, experimented with ideas, and stayed visible. I wanted to do the same. The problem was that I also had code to write, bugs to fix, blog posts to publish, and projects to maintain. Opening Bluesky every couple of hours just to post something or reply to notifications quickly became another distraction. I knew I needed automation. Not because I wanted to spam the platform, but because I wanted consistency without sacrificing my development time. The obvious solution would have been renting a VPS or deploying another cloud service. But honestly, I didn't want another monthly bill. I started asking myself a different question: Could I build a Bluesky AI bot that runs entirely on free services? That question eventually led me to GitHub Actions. Why GitHub Actions? Most automation tutorials immediately recommend a VPS, Docker container, or cloud function. Those work well. But for a personal automation project, they felt like overkill. GitHub Actions already gives developers something incredibly useful: Scheduled workflows Secure secret storage Python support Free minutes for public repositories Instead of paying for infrastructure, I could let GitHub execute my script several times a day. No servers. No maintenance. No SSH. No uptime monitoring. Just commit the code and let GitHub handle the rest. The Architecture The entire workflow is surprisingly small. GitHub Actions (Cron Schedule) │ ▼ Python Script │ Generates Prompt │ ▼ Gemini API │ Returns AI Post │ ▼ Bluesky API │ ▼ Publish Content Every scheduled run follows the same sequence. GitHub wakes up the workflow. The Python script builds a prompt. Gemini generates a post. The script authenticates using a Bluesky App Password. The post gets published automatically. After that, GitHub shuts everythin

Zero-Touch Customer Onboarding My AI agent hosting service has exactly zero manual steps between payment and deployment. Here is how: The Pipeline Customer pays via PayPal subscription Webhook fires to our server within seconds Python script validates the webhook signature Docker container spins up with Hermes Agent pre-installed API key generated via New-API Email sent to customer with credentials Customer logs in and starts using their agent Total time: ~90 seconds . No human touches anything. The Code Architecture PayPal Webhooks → Python Flask endpoint Docker API → Container creation with resource limits New-API → Token generation and quota management Gmail SMTP → Automated email delivery Caddy → Automatic HTTPS and routing Key Design Decisions Docker over VMs : Containers are faster (90s vs 5min) and cheaper. Each customer gets 0.5 CPU and 256MB RAM. New-API over custom billing : Battle-tested token management instead of rolling my own. AI over human support : The support agent is also AI. No humans in the loop at all. What Could Break PayPal webhook failures → Implement retry logic Docker daemon issues → Health checks and auto-restart Email deliverability → Fallback to backup SMTP The Result A customer can discover the site, pay, and have a working AI agent before their coffee gets cold. That is the power of full automation. Try it: AgentChip — $23.99/month, 100M API tokens included.

SEO Automation for Small Businesses Can Work — But Only If You Automate the Right Things Running a small business and keeping up with SEO at the same time is genuinely exhausting, and most owners either ignore SEO entirely or throw money at agencies that deliver reports without rankings. SEO automation for small businesses offers a middle path: systematic, repeatable processes that handle the mechanical parts of search optimization without requiring you to be an expert or hire one full-time. The short version — automating keyword tracking, technical audits, internal linking, and content scheduling will save you real time; automating content creation wholesale, without human review, will almost certainly hurt you. The rest of this article is about making that distinction practically useful. The Tasks That Actually Benefit From Automation Most of SEO is repetitive in ways that humans are bad at — checking 200 pages for broken links, making sure title tags aren't duplicated, tracking keyword rankings week over week. These are tasks where consistency matters more than judgment, which makes them exactly what automation tools are built for. A local landscaping company I know of was spending roughly 4-5 hours a week on manual rank checking across about 60 target keywords. After setting up automated tracking through a tool like Semrush or AccuRanker, that time dropped to under 30 minutes — just reviewing a dashboard. The monitoring didn't change their rankings, but it changed how quickly they spotted a drop and responded. That gap between noticing and acting is where small businesses tend to lose ground quietly. Technical SEO audits are another area where automation earns its keep. Tools like Screaming Frog or Sitebulb will crawl your site and surface issues — missing alt text, redirect chains, slow page load times — that you'd never catch manually unless you happened to stumble across them. According to a Semrush industry report, sites with automated audit schedules fix te

In my previous post about a cost budget advisor , I built a mechanism that checks how much quota is left before it runs anything. This time I want to take that idea one step further: instead of cycling a single Codex through jobs one after another, run several of them at the same time as a swarm. I'll walk through the actual code for a three-layer protocol where workers declared in plan.json are expanded by orchestrate-worktrees.js into a tmux session plus git worktrees, so each Codex runs in parallel without interfering with the others. The problem: running Codex serially on the same branch When you run Codex jobs one after another on a single repository, you hit issues like: A commit from the previous job changes the preconditions for the next one Task B keeps waiting until Task A finishes When a conflict happens, the "which change is correct" decision bounces back to a human Separating branches with git worktree reduces the conflict risk to zero. Combining that with tmux to launch everything in parallel is the design for this post. The big picture: a three-layer protocol plan.json ← declaration layer (what goes to which worker) ↓ orchestrate-worktrees.js ← orchestrator layer (creates worktrees, launches tmux) ↓ orchestrate-codex-worker.sh ← worker layer (runs Codex, writes artifacts) The orchestrator doesn't know about the workers, and the workers don't know about each other. Artifacts are consolidated into three files under .orchestration/{session}/{worker_slug}/ . File Role task.md Work instructions for the worker (generated by the orchestrator) status.md State: not started → running → completed / failed handoff.md Codex output + git status (written by the worker) Declaring the plan in plan.json { "sessionName" : "refactor-sprint" , "repoRoot" : "~/my-project" , "worktreeRoot" : "~/worktrees" , "coordinationRoot" : "~/my-project/.orchestration" , "baseRef" : "HEAD" , "replaceExisting" : true , "launcherCommand" : "bash ~/.claude/scripts/orchestrate-codex-worker

The most important SaaS workflows rarely stay inside one clean browser tab. A user starts on the application, opens an OAuth popup, completes MFA, returns to the original tab, receives an email, follows a verification link, and lands on a different domain. Their account belongs to one tenant, their data is stored in a particular region, and their locale changes the date format that the test expected. Each step may work in isolation. The complete journey still fails. That is why testing SaaS applications requires more than a collection of page-level tests. The real risk lives in the handoffs between systems, identities, windows, tenants, regions, and communication channels. Authentication is a state machine, not a login form A simple login test usually covers one path: Enter email and password. Submit. Reach the dashboard. Real authentication has many branches: OAuth consent already granted. OAuth consent required. Popup blocked. Identity provider opens in a new tab. MFA requested. MFA remembered on the device. Session expired during the handoff. User belongs to multiple organizations. Original tab resumes before the token is available. Callback lands on the wrong environment. This review of testing OAuth popups, MFA prompts, and cross-tab login handoffs with Endtest highlights the operational difficulty of these flows. Model authentication as a state machine. Record the expected transitions and test the failure paths between them. For example: Unauthenticated → OAuth opened → Provider authenticated → Callback received → Session created → Tenant selected → Application ready A test that only checks the last page cannot tell you where the handoff failed. Capture: Current window and newly opened windows. Redirect URLs and callback parameters. Cookie and storage changes. Network failures during token exchange. Visible provider errors. The tenant selected after authentication. Whether the original tab updates automatically or requires refresh. Multi-tenant testing must pr

When building Cypress automation that interacts with AWS services, the first step is verifying that your test framework can successfully authenticate and communicate with your AWS account. In this article, you'll learn how to connect Cypress to AWS and perform a simple authentication test using AWS Security Token Service (STS) and the GetCallerIdentity API. This approach helps confirm that: AWS credentials are correctly configured. Cypress can invoke AWS SDK operations through Node.js tasks. The automation environment is connected to the expected AWS account. Establishing this connection first provides a solid foundation before automating interactions with services such as AWS Lambda, Amazon S3, Amazon DynamoDB, Amazon SNS, or Amazon SQS. Prerequisites Before getting started, ensure you have: Node.js installed A Cypress project Valid AWS credentials: AWS Access Key ID AWS Secret Access Key AWS Session Token (if using temporary credentials) AWS Region Note:If you're running Cypress in an AWS environment (such as AWS CodeBuild, an EC2 instance with an IAM role, or GitHub Actions using OpenID Connect), you may not need to provide credentials manually. The AWS SDK can automatically retrieve credentials from the execution environment. Step 1: Install the AWS SDK Install the AWS STS client package: npm install @aws-sdk/client-sts For this connectivity test, we only need the AWS Security Token Service (STS) client. The package provides: STSClient – Creates a client for communicating with AWS STS. GetCallerIdentityCommand – Returns details about the authenticated AWS identity associated with the configured credentials. Step 2: Configure AWS Credentials For local development, create or update your cypress.env.json file. { "AWS_ACCESS_KEY_ID" : "" , "AWS_SECRET_ACCESS_KEY" : "" , "AWS_SESSION_TOKEN" : "" , "AWS_REGION" : "" } Populate the file with your AWS credentials. Example: { "AWS_ACCESS_KEY_ID" : "your-access-key" , "AWS_SECRET_ACCESS_KEY" : "your-secret-key" , "AWS_SES

Ask ten AI developers what tools they use, and you'll probably get ten different answers. The AI ecosystem is evolving so quickly that it's easy to believe you need every new framework, model, and application to stay productive. I don't think that's true. Over the past year, I've experimented with dozens of AI tools while building products, writing technical content, managing prompt libraries, and developing AI workflows. Along the way, my stack has become surprisingly simple. It's not built around the "best" tools. It's built around the tools that work well together. Here's the AI stack I rely on in 2026 and, more importantly, why each tool has earned its place. 1. ChatGPT: My Primary Thinking Partner ChatGPT is where most of my work begins. Not because it can do everything, but because it helps me think faster. I use it for: Brainstorming ideas Structuring articles Reviewing technical concepts Exploring architectural trade-offs Refining prompts Research assistance I rarely expect the first response to be perfect. Instead, I treat it like collaborating with a knowledgeable teammate who accelerates my thinking. 2. Cursor: My AI-Powered Development Environment When it's time to write code, I move into Cursor. Its strength isn't just code generation. It's understanding the context of an entire project. Whether I'm building a FastAPI backend, integrating APIs, or refactoring an existing codebase, having AI directly inside the editor removes a huge amount of friction. The less I switch between applications, the more productive I become. In fact, one of the biggest lessons I've learned is that adding more AI tools doesn't automatically improve productivity. Sometimes it has the opposite effect. I explored this idea in The Hidden Cost of Using Too Many AI Tools , where I explain why a smaller, well-integrated stack often outperforms a collection of disconnected applications. 3. GitHub: The Source of Truth Every project eventually ends up in GitHub. Not just source code. I

This is the next big thing! I've been working on Moonlight AI for almost 6 months now and today I have big news. Automated Applications . That's right, Moonlight AI will have automated applications for the 2.0 version! What is Moonlight AI? Moonlight AI at first, was a project that was aimed to compete with Upwork. That definitely didn't work out even at the development phase so I had to pivot to another project. A month after the conception of the original version, I met a potential co-founder for a new initiative. Moonlight has been repurposed to be a capabilities mapping engine based on worker experience. We used a resume parser and a local LLM to map the capabiities based on skills and job experience alongside Github integration to use as proof of work. The project ultimately didn't work out, the potential cofounder was MIA so my only recourse was to rewrite Moonlight AI to be another thing, which ended up being a glorified job board which is how it works now. The Development Process Moonlight AI was vibe-coded in a night. Modifications were done the same way with different LLM models. LLMs today are what I call an automated entry-level developer since juniors is the wrong term because juniors at least have from 1-3 years of experience in the professional landscape and are more than just coding monkeys, where as entry-levels are just that, developers with 0 years of experience. Today, Moonlight AI should be done the correct way: reading the code and writing it too. Why let an LLM to do my job as well as think for me? DO YOU WANT ME TO GET ALZHEIMER? BECAUSE THAT'S HOW YOU GET ALZHEIMER! Anyways, exercising the mind is very important, that's what make us humans. People today have an obsession with automating their lives completely and end up like the humans in WALL-E. End of rant. The Future (Conclusion) I don't know the future, but I envision Moonlight AI to be a tool to make unemployed people lives a little less unbearable. I know how frustrating is to use a jo

RAG, Agents, & Code Security: Applied AI Frameworks in Production Today's Highlights This week's highlights feature a practical guide to building RAG-powered knowledge bots with Laravel and pgvector, alongside major strides in AI agent orchestration with a new resource discovery specification. Additionally, we examine AWS's new agentic code security service, demonstrating the application of AI frameworks to critical enterprise workflows. RAG in Laravel: Embeddings and pgvector for a Knowledge-Base Bot (Dev.to Top) Source: https://dev.to/adityakdevin/rag-in-laravel-embeddings-and-pgvector-for-a-knowledge-base-bot-3l2g This post delves into implementing Retrieval Augmented Generation (RAG) within a Laravel application to create a more informed knowledge-base chatbot. It directly addresses the common challenge where large language models (LLMs) lack domain-specific knowledge by leveraging embeddings and pgvector to incorporate proprietary data. The article builds upon a previous discussion on streaming AI responses, now focusing on integrating custom information for enhanced chatbot accuracy and relevance. The technical approach involves generating vector embeddings for a knowledge base's documents, storing these representations in a PostgreSQL database using the pgvector extension, and then performing similarity searches. When a user query is received, its embedding is generated, used to retrieve the most semantically relevant documents from the knowledge base, and these documents are then fed as context to the LLM. This process dramatically improves the chatbot's ability to answer questions based on specific, internal data rather than relying solely on its general training. This practical guide demonstrates a tangible workflow for overcoming LLM hallucinations and improving contextual understanding in custom applications. It highlights how robust RAG architecture, even within a PHP framework like Laravel, can be achieved using battle-tested database technologies and