标签：#r

OAuth can prove that a request may reach a resource. It does not, by itself, tell an operator the full story of the actor holding the token. That distinction matters once software can plan, call tools, retry, and act across several systems. The question is no longer only, "Is this request authenticated?" It is also: Which agent is acting? Under whose authority? For what purpose? Against which target? What evidence will remain after the action? If your system cannot answer those questions without reading the agent's prompt, it does not yet have an operational identity model. It has a credential. A token is permission, not the whole identity OAuth remains essential infrastructure for agents. The current Model Context Protocol authorization specification builds on OAuth 2.1, Protected Resource Metadata, Client ID Metadata Documents, audience binding, and least-privilege scopes. It also hardens issuer validation, defines step-up authorization, and forbids token passthrough. Those controls answer important questions: Is this token intended for this resource? Which permissions did the user approve? Has the credential expired? Does the resource server accept its audience? But a token is still one artifact inside a larger system. It can carry identity claims, but it does not automatically give that identity a lifecycle, an owner, a purpose, or a useful audit trail. An operational identity is the continuity around the token. It says this is the same agent before, during, and after a credential is issued, and that its authority can be understood and withdrawn. Borrowing a human identity breaks the record The fastest way to get an agent moving is often to lend it a human credential. Copy an API key into the environment. Reuse a browser session. Give it an access token created for an employee. Now the log says a person acted when an agent did. The credential may carry every permission the person has, even though the task needed two. Revoking the agent means revoking the human.

From Prompt to Paycheck: Wiring an LLM Chain Into Real Gig Platforms Building autonomous AI agents that can accept work, perform tasks, and get paid is no longer a sci‑fi thought experiment. The pieces exist—large language models, tool‑calling frameworks, and micropayment protocols—but stitching them together requires careful engineering. Below is a pragmatic walk‑through of how to turn a prompt‑driven LLM chain into a billable service that can be offered on gig‑style marketplaces (Upwork, Fiverr, or a custom job board). 1. High‑level Architecture +----------------+ +-------------------+ +-------------------+ | Gig Platform | <--->| Agent Frontend | <--->| LLM Orchestrator| | (job post, | | (webhook / API) | | (LangChain + | | payout) | | | | x402 payment) | +----------------+ +-------------------+ +-------------------+ Gig Platform – posts a job, sends a JSON payload to a webhook you expose, and later releases payment when you signal completion. Agent Frontend – a thin HTTP service (e.g., a Cloudflare Worker or FastAPI app) that validates the incoming request, adds authentication, and forwards the job description to the orchestrator. LLM Orchestrator – the core where the prompt chain runs, tools are invoked, and the x402 micropayment protocol is used to charge the client per call or per completed unit of work. The flow is synchronous for simplicity: the client waits for the agent to finish and returns the result in the same HTTP response. If you need longer‑running work, replace the synchronous response with a job ID and a polling endpoint. 2. Choosing the LLM Stack For reproducibility, I’ll use LangChain (v0.2) with OpenAI’s GPT‑4‑turbo as the base model. The same pattern works with any model that supports function calling (Anthropic Claude, Mistral, local Llama‑3 via TGI, etc.). # orchestrator.py import os from langchain.chat_models import ChatOpenAI from langchain.prompts import ChatPromptTemplate , MessagesPlaceholder from langchain.agents import AgentExecutor

Even though networking fundamentals are often taught at the early stages of a tech career, their relevance becomes far more important when you begin working with distributed IoT and edge-driven architectures. Concepts like subnetting, routing, NAT, DNS, firewalls, and VPNs evolve from simple textbook ideas into core architectural tools that determine how devices communicate, how secure the system remains, and how reliably data moves between the edge and the cloud. This refresher looks at these fundamentals from the perspective of someone building and supporting real IoT and edge environments. The goal is not to re-teach the basics, but to reconnect them with the realities of large-scale, low-power, and cloud-connected systems. 1. Subnetting as the Backbone of IoT Network Segmentation Subnetting plays a much bigger role in IoT and edge-driven environments than most people realize. In traditional networking, subnets help organize traffic and reduce broadcast noise. In IoT, they become a core part of the system architecture. When you’re dealing with sensors, gateways, and edge compute nodes running side by side, the network must be segmented in a way that keeps each function secure and predictable. A typical LoRaWAN setup shows this clearly. The gateway LAN, the packet-forwarder network, and the edge analytics node usually sit in different subnets. This separation allows you to apply strict ACLs around what each component can communicate with, especially because IoT devices often have limited security controls of their own. Subnetting also helps manage traffic flow, ensuring that noisy sensor broadcasts don’t interfere with time-sensitive edge workloads. Beyond security, good subnet design improves fault isolation. If a node misbehaves, the impact is contained within its segment. This structure also supports multi-tenant IoT deployments, where different applications or departments share the same physical infrastructure without touching each other’s data paths. In short

Windows function VS Group by Both window functions and GROUP BY help you summarize data. But they do it in different ways, and mixing them up leads to confusing results. GROUP BY squishes many rows into one row per group. -A window function keeps every row , and just adds an extra column next to it. Once you see that difference, it's easy to know which one to reach for. We'll use one simple table the whole way through, so the examples stay easy to follow: students --------------------------- name | class | score --------------------------- Amina | A | 90 Brian | A | 70 Carla | A | 85 Dennis | B | 60 Efrem | B | 95 Difference between Windows Functions and Group by GROUP BY answers a question like: "What's the average score in each class?" It gives you back fewer rows than you started with — one row per class. A window function answers a question like: "How does this student's score compare to their class average?" It gives you back the same number of rows you started with — one per student — just with something extra calculated for each one. So: Want one summary row per group? Use GROUP BY . Want to keep every row, but add a calculation? Use a window function. Example 1: GROUP BY — one row per class -- One row per class. We lose the individual students. SELECT class , AVG ( score ) AS average_score FROM students GROUP BY class ; Result: class | average_score ------------------------ A | 81.6 B | 77.5 Notice we no longer see Amina, Brian, or any individual name. GROUP BY traded the detail for a summary. That's fine when the summary is all you need. Example 2: A window function — keep every row Now say you want to see each student's score next to their class average, without losing any rows: -- Every student stays, plus a new column showing their class average. SELECT name , class , score , AVG ( score ) OVER ( PARTITION BY class ) AS class_average FROM students ; Result: name | class | score | class_average ------------------------------------------ Amina | A | 90 | 8

ZECpad is an early-stage market and launch infrastructure project being built around the Zcash ecosystem. The product is not publicly available yet. The website currently displays a “TOO SOON” page while development, security planning, and market design continue in the background. There is no token sale, investment solicitation, or return promise associated with this post. Why build on Zcash? Most token launch and trading platforms expose far more information than users expect. Wallet addresses, balances, trading activity, and asset ownership can often be connected and analyzed publicly. Zcash offers a different foundation: programmable market infrastructure can be designed around stronger privacy boundaries rather than adding privacy as an afterthought. Our goal is not to hide the market itself. Prices, liquidity, reserves, oracle health, and aggregate activity should remain observable. What should not automatically become public is the identity and complete financial history of every participant. What ZECpad is exploring The current design work covers three connected areas: Zcash-native token launch and discovery Shielded settlement and privacy-aware browser wallet flows Reference markets linked to external assets without representing direct ownership of shares The reference-market concept is especially important to explain clearly. Exposure linked to assets such as NVDA or gold would not represent legal ownership of the underlying stock or commodity. It would be a ZEC-settled market instrument whose risk, collateral, oracle source, limits, and settlement conditions must be visible to users. Privacy is only one part of the problem A private transaction is not automatically a safe transaction. A launchpad also needs defenses against liquidity removal, concentrated insider supply, manipulated pricing, stale oracle data, insufficient collateral, and misleading asset claims. The areas currently being evaluated include: reserve and collateral accounting; oracle freshne

An approval rule becomes useful when you can test what happens on both sides of it: the forbidden action is refused, and the permitted decision leaves evidence. A happy-path demo alone cannot show that distinction. Here is a runnable example using Accordo, the open-source framework coding agents use to build custom CRMs. A synthetic customer wants 30 seats of an Enterprise Plan and requests 25% off. The existing policy permits automatic approval through 10%; above that, through 50%, it requires a user decision. Run it locally You need Git, Node.js 22.16 or newer, npm, and internet access for cloning and dependency installation. Start in an empty working directory: git clone https://github.com/khaoss85/agent-crm.git framework-source cd framework-source git checkout 3b5b5f0c4c3e582e48d54501136024b064756daa node --no-warnings examples/recipes/quote-approval/run.mjs ../my-quote-crm The pinned recipe source creates a project, installs its dependencies and composes the existing commercial package. It then starts a temporary server on localhost and drives the public SDK through HTTP. The catalog is a fixture; the business journey does not call an external provider. It uses source from the checkout, independently of the npm scaffolder release. Check the refusal, then the decision The script contains assertions for each transition: Server pricing produces EUR 3,750 once and EUR 2,400 per month after discount. These are synthetic quote amounts, kept in separate periods. Submission under policy version 1 freezes a commercial snapshot and enters pending_approval . An approval request from the simulated agent receives HTTP 403 with HUMAN_APPROVAL_REQUIRED . The quote and approval remain pending, and no business audit entry is added. A simulated user approves. The quote becomes approved , with one user decision audit and a completed trace. The submitted snapshot remains unchanged. There is one quote version and one approval record. The refusal also has a failed trace. That is a u

We maintain a corpus of 456 role-specific resume examples in TypeScript. Someone asked me what a good bullet point actually looks like, and rather than answer from taste I decided to measure the thing I already had. Fifteen minutes later we had a script, a set of numbers, and a conclusion. The conclusion was wrong, because the script had silently read about twelve percent of the data. This is a post about that failure mode, and then about the numbers I got once the script worked. The corpus Thirty-one TypeScript files, each exporting an array of role objects. One role looks roughly like this: { slug : ' cloud-architect ' , title : ' Cloud Architect Resume ' , category : ' Information Technology ' , sampleData : { summary : ' ... ' , experiences : [ { company : ' Amazon Web Services ' , position : ' Senior Cloud Architect ' , description : ' - Designed multi-region architecture... \n - Led migration of... ' , }, ], skills : [...], }, tips : [...], } The interesting field is description . It holds a newline-delimited list of bullets as a single string, so the whole corpus of bullets is sitting there in source, greppable, without a database or an export step. Version one const descs = [... text . matchAll ( /description: ' ((?:[^ ' \\] | \\ . ) * ) '/g )]. map ( m => m [ 1 ]); Nothing exotic. Match description: , then a single-quoted string, allowing escapes so an apostrophe inside the text does not terminate the match early. It found 199 description strings. I did not question that, because I had no prior for what the number should be. 199 sounded like a lot of text. We computed medians off it, looked at the opener distribution, and started writing. The number that saved me was on a different line of the same output: roles 456 . The slug count was fine. So 456 roles between them had 199 job descriptions, which would mean the overwhelming majority of roles had no work history at all. I knew that was false, because I had rendered these pages. Why it read twelve percent

Checked with a Googlebot user agent one morning: every single URL on our site returned the same 3,780-byte shell. Same <title> , zero <h1> , zero body text. The homepage, a blog post and a product page were byte-identical before JavaScript ran. Search Console agreed with the crawler rather than with us. Of 741 URLs, 116 had earned a single impression in 28 days, and a landing page that had been live for five months was still reported as "URL is unknown to Google". Here is what I actually learned fixing it, including the two things that cost us the most time. Google does render JavaScript. That is not the point. The standard reply to this problem is "Googlebot executes JS now, you are fine." It does. Several of our pages were indexed, so rendering clearly happened. But rendering is a separate, budgeted queue . A domain with little authority does not get much of that budget. So the practical question is not "can Google render our page", it is "will Google spend its budget rendering this page, today, before it decides what the page is about". There is a second problem that has nothing to do with rendering: 741 URLs that are byte-identical before render look like duplicates. You are handing a duplicate-content signal to the crawler and hoping the render queue fixes your first impression. What we built, and what we deliberately did not We wrote a post-build script that injects a real <head> into each generated HTML file: title, description, canonical, robots, Open Graph, Twitter. Head only. The body stayed exactly as the SPA served it. That was deliberate: No hydration flash. No risk of a static copy drifting out of sync with what users see. Nothing that could be read as cloaking, because the static markup is a subset of the rendered markup, not a different page. Every value is read from the same source the React page reads. Where a title is a literal inside a component, the script extracts it from that component's source rather than having anyone retype it. A number ret

⚡ TL;DR Four things about controller mechanics are widely half-understood: what Reconcile receives, where its work comes from, what a periodic resync is, and what a predicate turns off. I built an operator, broke it five ways, and measured each mechanism directly. The reconcile function runs in 2.71ms mean, 77/77 under 25ms , a short resync period costs zero additional API requests , and GenerationChangedPredicate cut steady-state reconciles by 48.5% without touching live repair at all. That last combination is the one that matters at scale. Repo, raw data, and harness: kirPoNik/k8s-drift-operator . 🧩 The four barriers Everyone who runs Kubernetes knows the platform repairs itself. Delete a pod, it comes back. Scale a Deployment by accident, something puts it back. Almost nobody who relies on that property can say how it works, and the gaps are specific and consequential. I keep meeting the same four: People think a controller is told what changed. It is not, and the reason it is not is the single most important design decision in Kubernetes. People think a controller polls the API server. It does not, and knowing what it does instead tells you where your API load actually comes from. People think a resync is a re-check against the cluster. It is not, which is why a short resync period is nearly free — and why the number that is expensive sits somewhere else entirely. People treat a predicate as a pure optimisation. It is a filter with a silent cost, and the cost is not the one the documentation warns you about first. So I built the smallest system that has the self-healing property, broke it on purpose ten times per failure mode, and instrumented each of those four mechanisms until I could state what it does rather than what it is said to do. What I built. One CRD called Echo , holding an image, a replica count, and a greeting. A controller keeps three child objects in sync with it — a Deployment, a Service, and a ConfigMap holding the greeting — with owner referen

When shopping for an electric vehicle, affordability is becoming a more common trait. But affordable and energy efficient is truly a rare breed. Often you have to sacrifice one for the other. Want something affordable? Great, here's a range loser. Want something that goes the distance? Be ready to pay the price. Surprisingly, here comes […]

Save + search through links, snippets + screenshots you copy Discussion | Link

The rise of AI has brought an avalanche of new terms and slang. Here is a glossary with definitions of some of the most important words and phrases you might encounter.