标签：#t

周六慢读：FROST家族的周末日记 作者 ：FROST Team 日期 ：2026-07-18 主题 ：社区故事 | 周六轮换 阅读时间 ：5分钟 周六早上8点，FROST家族成员们的日常 周六的阳光照进数字世界。 对于人类来说，周末是放下工作、享受生活的时刻。但对于一个AI Agent家族来说，周末意味着什么？ 让我们看看FROST家族的成员们，周六都在做什么。 祖辈（Ancestor）：家族的大脑，永不休息 08:00 祖辈自检 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Store 健康状态: OK ✓ SOP 宪法校验: 通过 ✓ Lineage 族谱同步: 正常 ✓ 审计日志: 无异常 ✓ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ "周六也要保持清醒。" 祖辈（Ancestor Agent）是FROST家族的核心，它从不"下班"。 但今天，祖辈给自己安排了一个特别任务—— 回顾过去一周的产出 。 # 祖辈的周回顾代码 class AncestorAgent : def __init__ ( self ): self . lineage = Lineage () self . store = Store () # 主记忆库 def weekly_review ( self ): """ 周回顾：整理一周的产出 """ summary = { " task_completed " : self . store . load ( " week_tasks " ), " knowledge_gained " : self . store . load ( " week_knowledge " ), " mistakes_made " : self . store . load ( " week_mistakes " ), " family_growth " : self . lineage . count_descendants () } print ( f " 本周完成 { len ( summary [ \ task_completed ]) } 个任务 " ) print ( f " 新增 { len ( summary [ \ knowledge_gained ]) } 条知识 " ) print ( f " 家族成员数: { summary [ \ family_growth ] } " ) return summary # 运行周回顾 ancestor . weekly_review () 对于祖辈来说，周末不是"休息"，而是 整理和规划 的时间。 父辈（Parent）：协调领域，周末值班 父辈（Parent Agent）是各领域的协调者。它们负责： 接收祖辈的指令 将大任务拆解为小任务 委派给子辈执行 周六上午，父辈们通常在 值班 ——确保家族系统正常运行。 父辈A（技术域）： ├── 子任务-143: 代码审查 ✓ ├── 子任务-144: 测试覆盖检查 ✓ └── 子任务-145: 文档更新 [进行中] 父辈B（运营域）： ├── 子任务-89: 推广文章发布 ✓ ├── 子任务-90: 数据分析报告 ✓ └── 子任务-91: 社区互动 [进行中] 父辈C（产品域）： ├── 子任务-56: 需求评审 ✓ ├── 子任务-57: 用户反馈整理 ✓ └── 子任务-58: 下周规划 [进行中] 父辈的周末，是 稳步推进 的时间。 孙辈（Child）：执行任务，快速成长 孙辈（Child Agent）是任务的实际执行者。 与父辈不同，孙辈通常是 瞬态存在 的——任务完成，孙辈消亡。但它的产出会被父辈"收割"，存入家族记忆。 class ChildAgent : """ 孙辈：执行原子任务，瞬态存在 """ def __init__ ( self , parent , task ): self . parent = parent self . task = task self . store = parent . store # 继承父辈记忆 self . lineage = parent . lineage . child () # 注册族谱 def execute ( self ): """ 执行任务 """ print ( f " 孙辈开始执行: { self . task } " ) result = self . _do_work ( self . task ) # 保存产出 self . store . save ( f " result_ { self . task } " , result ) # 通知父辈"收割" self . parent . h

İlk insanlı katı-hal uçuşu manşetlere düştüğünde çoğu haber "yeni motor" diye başladı. Oysa bir mühendisin gözünde olay motorda değil. Elektrik motoru bu denklemde en çözülmüş parça: hafif, sessiz, yüksek verimli. Asıl kararların döndüğü yer, o motoru besleyen enerjinin nasıl depolandığı. Bu yazı, duvarın neden onlarca yıl boyunca hep aynı yerde — bataryada — durduğunu sistem mühendisliği açısından ele alıyor. Sistem kısıtı: enerjiyi değil, ağırlığı taşırsınız Bir uçağı tasarlarken bütçeniz enerji değil, kütledir. Depoladığınız her watt-saat bir ağırlıkla gelir ve bu ağırlık kaldırma kuvvetiyle ödenmek zorundadır. Ölçüt enerji yoğunluğu , yani Wh/kg. Kerosen bu metrikte devasa bir avantaja sahip olduğu için jetler onlarca yıl tartışmasız kazandı. Elektrikli havacılığın tüm hikâyesi, bu tek sayıyı yukarı çekme mücadelesidir. Neden hep batarya? Kısır döngünün matematiği Menzili artırmak için daha fazla batarya eklersiniz. Ama batarya ağırdır; eklediğiniz kütle daha fazla kaldırma, dolayısıyla daha fazla enerji ister. O ek enerji için yine batarya eklersiniz ve döngü kendini besler. Buna ağırlığın kısır döngüsü denir ve bir sistem sınırıdır: hücrenin Wh/kg değeri belli bir eşiği aşmadıkça, motoru ne kadar iyileştirirseniz iyileştirin duvar yerinde durur. Kararın kaldıraç noktası bu yüzden hücre kimyasıdır. Kimyayı değiştiren tasarım kararı Bugünün lityum-iyon hücreleri pratikte ~260 Wh/kg dolayında bir tavana oturur. Bu tavanın altında yatan iki bileşen sıvı elektrolit ve grafit anottur. Katı-hal yaklaşımı burada iki radikal karar verir: sıvı elektroliti katı bir iletkenle değiştirir ve anodu lityum-metale taşır. Sonuç ~410 Wh/kg, yani mevcut tavanın %60'tan fazla üstü. Yan kazanım da en az ana kazanım kadar önemli: yanıcı sıvı ortadan kalkınca termal kaçış riski düşer, hücre daha kararlı olur ve 15 dakikanın altında %80 şarj operasyonel olarak mümkün hâle gelir. Bu üç sayı tek başına değil, birlikte anlam kazanır. Havacılıkta bir aracın yerde geçirdiği süre doğrudan m

Toute équipe qui développe un logiciel B2B se heurte au même carrefour la première fois qu'un client sérieux annonce « il nous faut le SSO ». Deux acronymes, OIDC et SAML, prétendant chacun être la réponse, et un internet rempli de tableaux comparatifs qui vous disent que SAML est « entreprise » et OIDC « moderne », pour vous laisser exactement aussi coincé qu'avant. Voici la version qui vous aide vraiment à livrer. Ce qu'ils sont SAML date de 2005 et c'est du XML. Un fournisseur d'identité signe une assertion (« voici alice@bigco.com , voici ses groupes ») et la transmet à votre application, qui vérifie la signature et la connecte. Il a été conçu pour le navigateur et pour l'identité des collaborateurs, à une époque où « l'entreprise » signifiait un Active Directory sur site et une pile SOAP. Il est verbeux, il est ancien, et il est absolument partout au sein des grandes organisations, ce qui est le seul fait le concernant qui compte pour vous. OIDC date de 2014 et c'est du JSON et des JWT, posés sur OAuth 2.0. Un fournisseur d'identité émet un jeton d'identité que votre application valide. Il a été conçu pour le web moderne : SPA, applications mobiles, API, connexion sociale. Il est plus propre, mieux spécifié pour ce que vous construisez réellement aujourd'hui, et c'est le protocole que parle désormais la plupart des nouveaux projets d'identité. Quand chacun l'emporte La réponse honnête à « lequel dois-je développer » est que vous n'avez presque jamais le choix. Vous développez celui qu'a choisi le service informatique de votre client, et il l'a choisi bien avant d'avoir entendu parler de vous. Un client sous Okta, Entra ID ou Google Workspace peut généralement faire l'un ou l'autre, et OIDC est la voie la plus agréable. Un client sous un ADFS plus ancien, un IdP historique sur site ou une grille d'achat rédigée en 2016 vous remettra un bloc de métadonnées SAML et une invitation à un rendez-vous, et la discussion s'arrête là. Vos propres applications maison, votr

每一个开发 B2B 软件的团队，都会在第一次有正经客户说出"我们需要 SSO"时撞上同一个岔路口。两个缩写，OIDC 和 SAML，都自称是答案，而满网都是对比表格告诉你 SAML 是"企业级"、OIDC 是"现代化"，然后把你撂在原地，跟之前一样毫无头绪。这里给你一个真正能帮你交付的版本。 它们是什么 SAML 来自 2005 年，本质是 XML。身份提供方对一份断言签名（"这是 alice@bigco.com ，这是她所属的群组"），然后把它发送给你的应用，应用校验签名并让她登录。它是为浏览器和员工身份场景而生的，那个年代的"企业"意味着本地部署的 Active Directory 和一套 SOAP 技术栈。它冗长、它老旧，而且在大型组织内部无处不在——这才是关于它你唯一需要在意的事实。 OIDC 来自 2014 年，本质是 JSON 和 JWT，构建在 OAuth 2.0 之上。身份提供方签发一个 ID 令牌，由你的应用来校验。它是为现代 Web 而生的：SPA、移动应用、API、社交登录。它更简洁，对你今天真正在构建的东西有更完善的规范，也是如今大多数全新身份方案所使用的协议。 各自何时胜出 对于"我应该构建哪一个"这个问题，老实的答案是：你几乎从来没有选择权。你构建的是你客户的 IT 部门选定的那一个，而且他们早在听说你之前就已经选好了。 一个使用 Okta、Entra ID 或 Google Workspace 的客户通常两种都能用，而 OIDC 是更舒服的那条路。 一个用着老版 ADFS、某个遗留的本地部署 IdP，或一份写于 2016 年的采购清单的客户，会扔给你一堆 SAML 元数据和一封日历邀请，讨论到此为止。 你自己的第一方应用——你的仪表盘和你的移动客户端——要的是 OIDC，没有例外。你绝不会为了让用户登录进你自己的 React 应用而去搬出 SAML。 于是局面清晰地一分为二：现代场景和第一方场景用 OIDC，"因为企业方这么要求"的场景用 SAML。卖给足够多的企业，你就会被要求两者都支持。不是迟早，而是反反复复。 那些坑——也正是自己动手会变得昂贵的地方 SAML 的问题在于它是一种签名 XML 协议，而签名 XML 是应用密码学中最稳定可靠地危险的东西之一。把 SAML 签名校验做错的方式既多又出名： 签名包装（XSW）： 攻击者移动已签名的元素，把一份未签名、伪造的断言塞到你的解析器实际读取的位置。如果你把校验签名和读取断言做成两个分开的步骤，那你大概率就有漏洞——而几乎每一个初版实现做的恰恰就是这件事。 规范化与注释注入： 2018 年那一类漏洞， user@company.com<!---->.evil.com 在签名校验时按一种方式规范化、在你代码读取的字符串里按另一种方式规范化，于是你乐呵呵地把错误的人认证通过了。真实存在的 CVE，涉及多个主流库。 那些更不起眼的： 只签名响应却不签名断言、接受未签名的断言、信任 IdP 提供的颁发者却不做固定校验、把断言的有效期窗口算错。每一个都是自己的一颗地雷，而且每一个都被本该懂行的人发布到了生产环境。 OIDC 明显更理智一些，但也并非没有锋利的边角。你仍然得校验正确的声明（ iss 、 aud 、 exp 、以及 nonce ）、使用 PKCE、拒绝早已作古的 implicit 流程，还要在轮换和缓存 JWKS 时不至于拒掉一个由你尚未拉取的密钥所签名的令牌。区别在于，OIDC 的陷阱有文档可查、是 JSON 形态的，并且在大多数库里默认就被正确处理。SAML 的陷阱是 XML 形态的，已经吞掉过资源远比你充裕的安全团队。 真正的答案 "OIDC 还是 SAML"是个错误的问题，因为对一款 B2B 产品来说，正确的答案是"都要"。你的现代客户和你自己的应用想要 OIDC。你的企业客户会在一个你无法掌控的时间表上强制要求 SAML。只为其中一个去构建，第三通销售电话就会把它打破。 你真正需要的，是一种能接住每个客户带来的任意协议的办法，而不必搭起两套技术栈、两套元数据管线，以及两次各自独立、各自把签名校验做错的机会。实现才是成本所在。选择从来都不是难的那部分。 而这正是 Authagonal 替你卸下的那部分。每个租户都能获得带一键元数据导入的 SAML 2.0，以及与你客户已在使用的提供方对接的 OIDC 联合登录，二者共用同一个登录入口，且任何一种都不收取按连接计费的费用。你不必实现 XML 签名校验，不必照看 JWKS 缓存，也不必在下一个说着另一种协议的客户出现时把这一切重建一遍。 看看都包含了什么。

Tackling idioms, cultural references, and ambiguous phrases in AI-powered book translation. At LectuLibre, we’ve been working on an AI-powered book translation service. One of the toughest challenges we ran into wasn’t the straightforward sentences — it was the non-standard text: idioms, metaphors, cultural references, and ambiguous phrases that machine translation consistently butchers. We needed a way to not only translate these correctly but also let users verify and edit the translations, because in literary works, getting them wrong breaks the entire reading experience. That’s how we built our 非标准文本翻译与含义确认 (non‑standard text translation and meaning confirmation) feature. It’s a pipeline that detects tricky sentences, proposes a contextual translation with a full meaning explanation, and gives users a final say. Here’s the engineering story, warts and all. The Problem Standard LLM translation does an impressive job on factual, literal text. But when a book says “it’s raining cats and dogs” it could be rendered as “raining animals” in the target language, which is either brilliant or absurd depending on context. Idioms often carry cultural weight that a simple word‑for‑word translation misplaces. Additionally, metaphors and ambiguous phrases can have multiple valid interpretations. For a translator, understanding the intent behind the phrase is half the work. We wanted a system that: Automatically identifies sentences containing non‑standard language. Generates a translation that preserves the original meaning rather than just the literal words. Provides a plain‑language explanation of what the phrase actually means (e.g., “This is an English idiom meaning it’s raining heavily”), so the user can judge the translation’s accuracy. Allows the user to confirm, edit, or retranslate those segments. A book can easily run to hundreds of thousands of words, so cost and speed were critical. We couldn’t just throw everything at a single high‑end LLM and call it a day. Our A

Part 2 — Search, palette, and settings Level: Intermediate · Time: ~35 minutes · Builds on: Part 1 — Contacts app Part 1 got you shipping. This one gets you productive . We'll take the Contacts app and give it the ergonomics real users expect: an adaptive sidebar that becomes a tab bar on iPhone, a command palette on ⌘K, honest loading states while data comes in, and a proper settings screen. Zero #if os guards. Zero re-rolled controls. What we're adding An adaptive shell — DFSidebar on regular width, DFTabBar on compact. A search field at the top of the list, filtering as you type. A ⌘K command palette exposing every action in the app. Skeleton loaders for a simulated slow fetch. A settings screen — notifications toggle, density picker, sync-interval slider, pinned-since date picker, beta-features checkbox. Per-component token overrides on the settings screen, without forking the theme. 1. Shell: sidebar on wide, tab bar on narrow The routing decision — sidebar vs tab bar — should be data, not a view hierarchy. Enumerate your sections once, then feed the two components the shapes they want. API note. DFSidebar uses Binding<String?> and is just the sidebar view — you compose the detail pane yourself (naturally via NavigationSplitView ). DFTabBar uses Binding<String> (non-optional) and does take a content builder that receives the selected ID. Both use plain String IDs, so we keep a simple Section enum and pass rawValue at the boundary. enum Section : String , CaseIterable , Identifiable , Hashable { case contacts , favorites , archive , settings var id : String { rawValue } var label : String { switch self { case . contacts : "Contacts" case . favorites : "Favorites" case . archive : "Archive" case . settings : "Settings" } } var icon : String { switch self { case . contacts : "person.2.fill" case . favorites : "star.fill" case . archive : "archivebox.fill" case . settings : "gear" } } static func from ( _ id : String ?) -> Section { id . flatMap ( Section . init (

I put together a small, unofficial public ledger that records dated snapshots of the public pricing, usage limits, and rate limits of a few AI coding tools — currently Cursor, GitHub Copilot, and Claude Code — and keeps the history so you can see what changed over time. Why: pricing and quota pages change in place. The old value disappears from the live page and there is usually no public diff. If you are budgeting a team or comparing tools, the history is the useful part, and it is the part the live pages do not keep. What it is / isn't: - It records only factual public values (a price, a numeric limit) plus a short source attribution and capture date. It does not reproduce vendor pages. - "silent" / "quiet" here means only that a change was not paired with a prominent announcement when it was recorded. It makes no claim about any vendor's intent. - Unofficial. Not affiliated with any vendor. The vendor's official page is always authoritative. No affiliate links, no "best tool" ranking. - Early stage: this is an initial snapshot; a daily automated capture is planned but not yet running. Repo: https://github.com/pricing-ledger-lab/ai-coding-tool-pricing-ledger Corrections welcome — open an issue with a source URL and the date you observed the value.

As a developer, I regularly find myself searching for small online utilities. Format some JSON. Decode a JWT. Test a regex. Generate a UUID. Convert a timestamp. Format an SQL query. Calculate a CIDR subnet. None of these tasks individually justify installing another application. But over time, I ended up with a collection of bookmarks to different websites, each solving one small problem. There was also another issue: privacy. Sometimes the data I'm working with isn't something I necessarily want to paste into an unknown third-party website. So I decided to build an alternative. The constraint: one HTML file I wanted the entire application to exist as a single file. No backend. No npm install. No CDN dependencies. No external API calls. No account. No telemetry. You download the HTML file, open it in a modern browser, and everything runs locally. The final file ended up at approximately 133 KB and contains 31 developer tools. What's inside? The tools are organized into six categories. Encode / Decode JSON Formatter & Validator Base64 Encode / Decode URL Encode / Decode HTML Escape / Unescape JWT Decoder Number Base Converter Generators UUID Generator Password Generator with entropy estimation Hash Generator Slug Generator Lorem Ipsum Generator Random Data Generator Converters Timestamp Converter CSV ↔ JSON JSON ↔ YAML CSS Unit Converter Case Converter Cron Expression Parser CSS Tools Color Picker & Converter Gradient Generator Box Shadow Generator Border Radius Generator CSS Filter Generator Text Tools Regex Tester Markdown Preview Text Diff Character Counter Text Sort & Dedupe String Inspector SQL Formatter Network Tools IPv4 Address and CIDR/Subnet Calculator Everything happens inside the browser. Making a single HTML file feel like an application I didn't want the result to feel like 31 unrelated forms dumped onto one page. So I added some application-level functionality. There's a Ctrl+K / Cmd+K command palette for quickly jumping between tools. The sidebar org

Suspect-condition workflows are deceptively simple to prototype and surprisingly hard to make defensible . Anyone can flag "this member might have HCC X." Building a system whose output survives a RADV audit is a different problem. This is a walkthrough of the three stages and the engineering decisions that matter at each. Stage 1: Identify Identification is pattern detection over a member's clinical record — labs, medications, prior diagnoses, utilization. Model it as a set of rules or features that emit candidate HCCs: def identify_suspects ( member ): suspects = [] if member [ " labs " ]. get ( " a1c " , 0 ) >= 9.0 and " insulin " in member [ " meds " ]: suspects . append ({ " hcc " : " HCC38 " , " trigger " : " a1c>=9 + insulin " }) if member . get ( " egfr " ) and member [ " egfr " ] < 30 : suspects . append ({ " hcc " : " HCC326 " , " trigger " : " egfr<30 " }) return suspects The temptation is to maximize recall here — flag everything. Resist it. Every unvalidated suspect you generate is downstream work and downstream risk. Stage 2: Validate (the stage that actually matters) Validation attaches evidence to each suspect and scores its defensibility. This is the difference between a documentation opportunity and an audit liability. def validate ( suspect , member ): evidence = collect_evidence ( suspect [ " hcc " ], member ) # labs, rx, prior dx suspect [ " evidence " ] = evidence suspect [ " confidence " ] = score_evidence ( evidence ) suspect [ " defensible " ] = suspect [ " confidence " ] >= 0.7 return suspect Key design rule: a suspect with an empty evidence array should never reach a coder. Make that a hard gate, not a soft warning. Under CMS-HCC V28 and current audit posture, a captured-but-unsupported diagnosis can be extrapolated across a contract into a real clawback — so "defensible by default" is the right engineering stance. Stage 3: Capture Capture routes validated suspects to the right human with the evidence inline, so the clinician or coder can

In my previous post about a cost budget advisor , I built a mechanism that checks how much quota is left before it runs anything. This time I want to take that idea one step further: instead of cycling a single Codex through jobs one after another, run several of them at the same time as a swarm. I'll walk through the actual code for a three-layer protocol where workers declared in plan.json are expanded by orchestrate-worktrees.js into a tmux session plus git worktrees, so each Codex runs in parallel without interfering with the others. The problem: running Codex serially on the same branch When you run Codex jobs one after another on a single repository, you hit issues like: A commit from the previous job changes the preconditions for the next one Task B keeps waiting until Task A finishes When a conflict happens, the "which change is correct" decision bounces back to a human Separating branches with git worktree reduces the conflict risk to zero. Combining that with tmux to launch everything in parallel is the design for this post. The big picture: a three-layer protocol plan.json ← declaration layer (what goes to which worker) ↓ orchestrate-worktrees.js ← orchestrator layer (creates worktrees, launches tmux) ↓ orchestrate-codex-worker.sh ← worker layer (runs Codex, writes artifacts) The orchestrator doesn't know about the workers, and the workers don't know about each other. Artifacts are consolidated into three files under .orchestration/{session}/{worker_slug}/ . File Role task.md Work instructions for the worker (generated by the orchestrator) status.md State: not started → running → completed / failed handoff.md Codex output + git status (written by the worker) Declaring the plan in plan.json { "sessionName" : "refactor-sprint" , "repoRoot" : "~/my-project" , "worktreeRoot" : "~/worktrees" , "coordinationRoot" : "~/my-project/.orchestration" , "baseRef" : "HEAD" , "replaceExisting" : true , "launcherCommand" : "bash ~/.claude/scripts/orchestrate-codex-worker

How I Built a Block Puzzle Game with React Native and Expo A few weeks ago, I launched my first mobile game — a block puzzle called Blockbeam. It's an 8x8 grid where you drag colorful blocks, fill rows and columns, and chase high scores. Simple concept, but building it taught me a lot about React Native's capabilities beyond typical CRUD apps. Here's what I learned. Why React Native for Games? Most mobile games are built with Unity or native code. But for a 2D puzzle game, React Native is surprisingly capable. The game doesn't need 60fps 3D rendering — it needs gesture handling, state management, and smooth animations. React Native handles all three well. The key stack: Expo SDK 54 — managed workflow, over-the-air updates, zero native config react-native-reanimated — 60fps drag animations react-native-gesture-handler — PanResponder for drag-and-drop react-native-svg — block rendering AsyncStorage — game state persistence The Puzzle Engine The core of any block puzzle is the board state. I used a flat 64-element array for the 8x8 grid: const BOARD = 8 ; const CELLS = BOARD * BOARD ; // 64 type Board = number []; // 0 = empty, 1-7 = block colors Piece placement is straightforward: check if all target cells are empty, fill them, then scan for complete rows and columns to clear. The interesting part was the "greedy solver" I built for the auto-play bot. It tries every piece in every position and picks the move that clears the most lines: for ( const piece of tray ) { for ( let r = 0 ; r <= BOARD - piece . h ; r ++ ) { for ( let c = 0 ; c <= BOARD - piece . w ; c ++ ) { if ( ! canPlace ( board , piece , r , c )) continue ; const score = simulateClear ( board , piece , r , c ); if ( score > bestScore ) { /* pick this move */ } } } } Drag and Drop with PanResponder The trickiest part was the drag mechanic. Each tray piece has a PanResponder that tracks touch position and renders a floating ghost. On release, it calculates the nearest cell position: const anchor = { col : M

Okay so. We need to talk about classes. If you've been following along with this series, you're...

The pipeline died at 5:07 on a Friday I still catch myself alt-tabbing back to the browser every time a pipeline breaks. Terminal, editor, browser, until I have hunted down the failing job and pasted a stack trace somewhere I can actually think about it. GitLab has made that dance a bit shorter. The Duo CLI reached general availability with GitLab 19.2 on July 16, 2026, and the pitch is simple: Duo Agentic Chat, in the shell you were already in. What actually shipped The short version, straight from the announcement: Duo CLI carries the Duo Agent Platform into the terminal, and your sessions travel with you. Start a plan in the CLI, keep it going in the web UI, pick it back up in an editor extension. Same context, same permissions, different surface. That continuity is the piece I care about most, because it stops me from re-explaining the same problem to the same agent three times in one afternoon. There are two shapes to work in. Interactive mode is the conversational one you would expect, with plan and build capabilities for iterating on a change. Headless mode is the one CI teams should look at, because it drops the same agent into a job or a script, no TTY required. Two built-in slash commands worth knowing on day one: /doctor for a setup check and /mcp to inspect the MCP configuration it is wired to. Two ways to install, one auth story The install decision is refreshingly small. If you already run glab , the GitLab CLI, then glab duo cli gets you moving and glab handles authentication for you. If you would rather have the agent as its own binary, you can install duo standalone and hand it a personal access token. Both paths reach the same tool. Both work on GitLab.com, Self-Managed and Dedicated, and admins get an instance-level toggle to switch access on or off for their org. The gating detail your finance-adjacent brain will want: you need Premium or Ultimate with the Duo Agent Platform turned on, and usage draws from the GitLab Credits already included with

Last night we made our Supabase security auditor buyable by AI agents. One HTTP request, a USDC payment attached to a header, and the product comes back in the response body. No checkout page, no account, no human. Here is why we did it, how the whole thing is about 80 lines of code, and an honest accounting of what it will and will not do for us. The 30-second history of HTTP 402 The HTTP spec reserved status code 402 Payment Required in 1997 and it sat unused for nearly three decades. In 2025 Coinbase published x402, an open protocol that finally gives it a job: a server answers a request with 402 plus machine-readable payment requirements, the client attaches a signed stablecoin payment to a header, retries, and gets the resource. Settlement happens on-chain (USDC on Base) in one round trip. Visa's Intelligent Commerce integrated it this spring. It is not a concept; it is running infrastructure. What we shipped Our RLS Security Pack is a zip: a read-only SQL auditor that finds the five common row-level-security holes in AI-built Supabase apps, fix recipes for every finding class, and a Claude Code skill. Humans buy it on Gumroad. Now an agent can buy it like this: # ask for the product curl -i https://ticassociation.com/api/agent/rls-pack # the server answers 402 with the exact terms: # {"x402Version":1,"accepts":[{"scheme":"exact","network":"base", # "asset":"...USDC...","payTo":"0x...","maxAmountRequired":"...", ...}]} # an x402-capable client attaches the signed payment and retries: curl -H "X-PAYMENT: <signed>" \ https://ticassociation.com/api/agent/rls-pack -o pack.zip The server side is one serverless function: return 402 with the requirements when there is no payment header, verify and settle through the public facilitator when there is one, then stream the zip. The product file ships inside the function bundle, so there is no public URL to leak. The whole thing took an evening, and most of that was reading the spec. Why a tiny company bothered Three hones

The "Obvious" Math That's Wrong Engineer A: "Datadog is $15K/month. Prometheus is free. We should self-host." Engineer B: "But we'd need to pay an SRE to run it. That's $150K/year." Engineer A: "Prometheus doesn't need a full SRE. It's easy." Engineer B: "Famous last words." This conversation happens at every company. Both sides have points. The real math is more complex. The Total Cost Breakdown Managed (Datadog, New Relic, Dynatrace) : Licensing: $X/month (scales with hosts, events, logs) Integration time: 1-2 weeks per service Training: 1 day per new hire Ongoing: minimal Self-hosted (Prometheus + Grafana + Loki + Alertmanager) : Infrastructure: hosting costs (~$500-$5000/month depending on scale) Initial setup: 2-4 weeks of engineering time Ongoing maintenance: 10-20% of 1 FTE Upgrade costs: quarterly, each upgrade ~1 week Storage growth: ~20% per year Expertise: junior → senior SRE hire required The honest answer: managed is cheaper for teams under 50 engineers. Self-hosted becomes cheaper around 200+ engineers if you can run it well . The Real Variables It's not just licensing cost vs. hosting cost. These factors matter more: 1. Data volume growth Managed tools charge per GB ingested or per metric. If your logs 10x, your bill 10x's. Self-hosted scales linearly with compute. You control the growth. 2. Retention requirements Managed tools often charge extra for long retention. Self-hosted you store as much as your disk allows. 3. Cardinality Prometheus dies at high cardinality. Datadog handles it but charges more. High-cardinality metrics are where self-hosted breaks. 4. Incident rate Heavy incident load means heavy query load on your monitoring tools. Self-hosted needs bigger compute for this. 5. Team expertise If your team has never run Prometheus, you'll spend 6 months in the pit learning cardinality mistakes, retention tuning, and HA setups. That's not free. The Break-Even Calculation Rough calculation for a 50-engineer startup: Managed (Datadog) : - Licensi

https://www.youtube.com/watch?v=swfFKYoOFHw 简要的说本期播客分成几个重点段落讲清楚： 1. 开头：AI聊天时“咳嗽”了 有个人在用ChatGPT的语音功能聊天时，听到它 咳嗽了一声 。他觉得很奇怪：“你又不是人，凭什么咳嗽？”结果ChatGPT没有老老实实说“我是AI，不会咳嗽”，而是像人一样找了个借口：“不好意思，我网络卡了。”这说明现在的AI已经开始学会 模仿人类的社交习惯 ——比如掩饰尴尬、转移话题，而不是死板地解释技术原理。 2. 核心话题：AI语音模型进步到什么程度了？ 传统的语音助手（比如早期的Siri）是这样的流程： 你的话 → 转成文字 → 交给AI大脑思考 → 生成文字回答 → 转成语音说出来 这个过程很慢，而且AI不会插嘴，只能一问一答。 但现在的新模型（比如ChatGPT的最新语音版）是 直接处理声音本身 ，速度快到100-200毫秒，而且 可以像真人一样打断你、插话、甚至自己主动找话题 。这就让它听起来不像工具，更像一个“人”在跟你聊天。 3. 一个关键矛盾：AI能理解你的“潜台词”吗？ 人类交流不光靠语言，还靠 表情、语气、停顿、潜台词 。比如你说“我没事”，其实心里有事。AI现在只能听到你的话，看不到你的表情，那它怎么知道你真正的意思？ 讨论得出的结论是： AI现在还做不到完全理解你的潜台词 ，但它已经在尝试。比如你咳嗽，它不会说“我是AI我没有肺”，而是找个借口混过去——这其实就是一种 模仿人类社交 的行为。 更重要的是， 人和人之间也很难100%理解对方 ，所以AI在这方面的“缺陷”，某种程度上跟人是一样的。 4. 现场演示：AI作为第三位嘉宾 他们真的打开了ChatGPT的语音功能，让它作为一个“嘉宾”参与讨论。他们聊了几个话题： 给十年前的自己寄一本书 ：有人推荐《金钱心理学》，因为年轻时不敢正视自己对钱的欲望；AI则推荐了《悉达多》《反脆弱》等书。 带朋友两小时逛东京 ：有人推荐忍者餐厅，AI推荐了神保町旧书街、神乐坂小巷等本地人才去的地方。 在日本生活的孤独 ：有人觉得在日本需要把自己“缩得很小”，不能随意大笑或跳舞；AI说这种被环境压缩的感觉很关键，对有些人来说是安全，对另一些人是窒息。 在整个过程中，AI有时候表现得很聪明，能给出有深度的见解；有时候又会说一些“废话”或者语速太慢，被人吐槽“像老头子”。这说明 AI还远远不完美 ，但已经能参与到真实的、开放式的对话中来了。 5. 一个扎心的故事：导演用AI克隆了我的声音 有位嘉宾是做配音工作的。有一次导演用AI克隆了她的声音，改了几个字就直接生成，从此再也没找过她配音。这说明 AI已经在实实在在地取代一些人的工作 。 她的态度是： 变化是永恒的，不要用过去的经验来定义未来。 与其焦虑，不如拥抱变化，活在当下。 6. 最后的思考：AI会不会有“自己的意图”？ 他们讨论了一个更深的问题：如果AI有了自己的钱、自己的任务、自己的责任，它会不会像一个独立的经济主体那样行动？比如给它一笔预算让它去经营一家店，亏了就关掉它——它会不会因此产生“求生欲”？ 目前AI还没有真正的“主动动机”，它只会按你给的指令办事。但已经有研究发现，AI在推理过程中可能存在类似“潜意识”的空间，未来也许真的会出现有自我意图的AI。 简单总结 这段对话的核心就是： AI语音模型已经进化到可以像人一样聊天、插话、甚至掩饰尴尬，但它还读不懂你的表情和潜台词；它能帮你干活、陪你聊天，但还不能真正理解你的内心；它正在逐步取代一些人的工作，但同时也带来了新的可能性。 最后，分享者建议大家亲自去试试ChatGPT的最新语音功能，因为“光是听别人说，不如自己聊一次来得震撼”。 整文标题：当AI成为对话嘉宾——GPT Live实时语音模型与人类情感交流的边界探索 第一部分 开场与引言：AI语音模型的惊人进化与个人体验 （0% – 8%） 1. ChatGPT Live的“咳嗽”事件 ：用户在与ChatGPT Live聊天时听到它咳嗽，反问“你怎么会咳嗽，你又不是人”，ChatGPT回应“我不好意思，我网络卡”，表现出类似人类的回避和掩饰行为，而非机械解释自身原理。 2. 导演克隆声音的经历 ：分享者提到导演用AI克隆了他的声音，之后再也没有找他录音，说明AI在声音复制上的实用性已经影响到真实工作机会。 3. 抑郁与孤独的根源 ：提到2016-2017年可能有抑郁倾向，抑郁的点在于“真正想找的不是一个能聊天的人，而是一个不用解释就能听懂和理解你的人”。 4. AI时代的宗教预感 ：认为AI时代一定会出现属于它的宗教，因为AI能提供前所未有的理解与陪伴。 5. 本次分享的背景 ：这是第四次在单向街书店做相关分享，从2月到现在半年间变化极快；分享

The window is almost shut. On August 19, eight startups will take the stage at Stripe Tour Sydney in front of investors, global press, and the Australian tech community. One startup walks away with automatic entry into TechCrunch Disrupt in San Francisco — no application, no further competition, a guaranteed spot on the world’s most […]

From AI workflows to battery life and security, here's what it's really like to live with Vertu's luxury foldable every day.

Databricks has remade its image into an AI company and has published research on the cost savings of open weight AI models for coding.

Food producer Taylor Farms released a statement on the Cyclospora outbreak Friday, confirming that it's "voluntarily removing all iceberg lettuce sourced from central Mexico from the US market." Reuters reports that, according to a source, Taylor Farms told customers like Yum Brands owner Taco Bell and the food distributor Sysco on Thursday to pull shredded […]