标签：#t

Over the past few months, I've been exploring how AI agents can fit into a modern CI/CD pipeline—not to replace engineers, but to eliminate repetitive work that slows teams down. Here's what worked well: ✅ Automatically categorized incoming pull requests ✅ Flagged potential security and dependency issues ✅ Suggested fixes for linting and test failures ✅ Generated review summaries for faster code reviews ✅ Reduced context switching for reviewers The biggest lesson? AI is most valuable before the human review begins. The Problem Every engineering team eventually runs into the same issue. Developers submit pull requests faster than reviewers can process them. A typical PR often goes through several repetitive steps: CI builds Unit tests Linting Dependency checks Security scanning Style comments Reviewer assignment Documentation validation None of these tasks require deep architectural thinking, yet they consume valuable engineering time. I started wondering: What if an AI agent handled the first round of triage automatically? The Workflow Instead of waiting for a human reviewer, the pipeline lets an AI agent inspect every pull request immediately after CI starts. Developer │ ▼ Pull Request Created │ ▼ CI Pipeline Starts │ ▼ AI Agent ├── Analyze changed files ├── Review commit summary ├── Detect risky changes ├── Check coding standards ├── Explain failing tests ├── Suggest fixes └── Generate PR summary │ ▼ Human Review By the time a reviewer opens the PR, much of the routine analysis is already complete. Example GitHub Actions Workflow A simplified workflow might look like this: name: AI Pull Request Review on: pull_request: types: [opened, synchronize] jobs: ai-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run Tests run: npm test - name: Run Linter run: npm run lint - name: AI PR Analysis run: ./scripts/ai-review.sh The AI step can analyze: Test failures Lint violations Changed files Security findings Dependency updates before publishing a r

The fast fix If your GitLab CI job fails with Cannot connect to the Docker daemon at unix:///var/run/docker.sock , your docker client is looking for a local socket that does not exist inside the job container, because DOCKER_HOST is not set. Point the client at the docker:dind service over TCP and the error goes away: build : image : docker:28.3 services : - name : docker:28.3-dind alias : docker variables : DOCKER_HOST : tcp://docker:2376 DOCKER_TLS_CERTDIR : " /certs" DOCKER_CERT_PATH : " /certs/client" DOCKER_TLS_VERIFY : " 1" script : - docker info - docker build -t my-app . That is the whole fix for the common case. The rest of this page explains why the socket variant of the error is different from the tcp://docker:2375 variant, and covers the two other setups (socket-mounted runners and the Kubernetes executor) where the same message shows up for a different reason. Why you get the unix socket variant specifically This error is not the same as Cannot connect to the Docker daemon at tcp://docker:2375 . The address in the message tells you exactly what the client tried: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? When DOCKER_HOST is empty, the Docker CLI falls back to its compiled-in default, the local unix socket at /var/run/docker.sock . Inside a GitLab CI job that uses the docker executor, that socket file simply is not there. The daemon runs in a separate docker:dind service container, not in your job container, so there is nothing listening on the local socket. The client connects, finds no socket, and prints the message above. The tcp://docker:2375 form is the opposite problem: DOCKER_HOST is set correctly but the dind service is not reachable (missing service, no privileged mode, or a TLS mismatch). If you are seeing that address instead, read the companion write-up on the tcp://docker:2375 form of this error , which walks the service and privileged-mode causes in detail. This page is about the case w

Teams treat "externalize the rules" as two different decisions depending on the stack. In Node, it's "which npm package handles conditionals." In Java, it's "do we adopt Drools." Both framings are wrong in the same way — they turn an architecture decision into a product decision before anyone's actually designed the seam. The seam is the same regardless of language: rules become data instead of control flow, the boundary between your service and the rule layer is typed on both sides, and a contract test catches the moment a rule change would silently break what your code expects back. Get that seam right and it barely matters whether you're calling it from Express or Spring Boot. Get it wrong and you've just moved your if statements into a config file and called it progress. The seam: rules as data, not control flow The actual pattern is small. Instead of branching logic living inline in a handler or a service method, you define a typed input, a typed output, and a rule set that maps one to the other — evaluated somewhere the calling code doesn't need to know the internals of. That's it. That's the whole architectural move. Everything else — which engine, which language, how it's hosted — is an implementation detail on top of that seam. Most of the friction teams run into with a low-code layer in Node.js or a Java service isn't the rule engine choice. It's skipping the typed boundary and finding out three months later that a rule change silently returns a shape the calling code wasn't built to handle. Node.js: keeping the boundary typed Here's the seam in a TypeScript service. The route handler never sees a conditional — it sees a typed input going in and a typed decision coming out: interface PricingInput { userTier : " free " | " pro " | " enterprise " ; cartTotal : number ; couponCode ?: string ; } interface PricingDecision { discountPercent : number ; reason : string ; } async function evaluatePricingRule ( input : PricingInput ): Promise < PricingDecision > { c

A background worker sits quietly for weeks, chewing through a job queue without incident, and then one Tuesday afternoon it disappears mid-batch, taking forty in-flight jobs down with it. No stack trace pointing at the offending line, no alert until a customer notices their export never finished. Nine times out of ten, the culprit is one of the most under-discussed failure modes in server-side JavaScript: unhandled promise rejections. They are easy to introduce, easy to miss in code review, and in modern Node.js they no longer just print a warning — they can end your process outright. This post walks through what unhandled promise rejections actually are at the engine level, why they are far more dangerous in long-running Node.js services than in typical web requests, how Node's default behavior around them has shifted over the years, and the concrete patterns you can use to stop them from quietly killing your jobs. What an Unhandled Promise Rejection Actually Is At the JavaScript engine level, a promise is a state machine with three possible states: pending, fulfilled, or rejected. When an async operation fails — a network call times out, a database query throws, a JSON parse blows up — the promise representing that operation transitions to the rejected state and carries a reason, usually an Error object. That's all a rejection is: a value flowing down the promise's error channel instead of its success channel. The engine only considers a rejection "handled" if, by the time it does its bookkeeping (which happens on a microtask checkpoint, not synchronously), there is a .catch() handler, a second argument to .then() , or a surrounding try/catch around an await somewhere in that promise's chain. If none of those exist anywhere in the chain, the rejection is classified as unhandled. This is the precise, narrow definition of unhandled promise rejections: a promise that reaches the rejected state with zero handlers attached anywhere along its chain of consumers. It's wo

I cranked Apple’s iOS 27 beta to maximum transparency on my iPhone and enjoyed every warped second.

RAMageddon has claimed yet another victim, with Framework now announcing a "major and unfortunate" pricing update for its upcoming premium laptop - which also impacts folks who preordered it. Memory configurations for the Laptop 13 Pro have been adjusted after Framework says it received cost updates from its memory supplier that "are more than double […]

If you are an enterprise architect working on Microsoft Entra and AI agents, your first overdue job is not another policy wizard, another dashboard, or another governance steering committee. It is schema design. Specifically, it is deciding how you classify non-human identities with custom security attributes in Microsoft Entra . Not eventually. Up front. I keep seeing the same pattern across customers of every size: teams move quickly on agent experimentation, they onboard identities, they test controls, and then they realize they have no consistent attribute language for policy scope. At that point, every policy becomes a naming convention problem in disguise. That is backwards. The control plane starts with classification Custom security attributes are not decorative metadata. They are tenant-scoped key-value classifications you can assign to users, enterprise applications (service principals), and agent identities that are modeled as a service principal subtype, with dedicated role and permission boundaries for who can define and assign them ( overview , Graph model , agent identity service principal model ). That alone should change how architects think about them. This is not "nice to have taxonomy." This is policy input. Microsoft Entra Conditional Access for agents supports attribute-driven targeting with custom security attributes, and policy evaluation happens during token issuance and refresh, not just at policy authoring time ( Conditional Access for agents ). In other words: if your classification is sloppy, your runtime decisions are sloppy. Why agents raise the stakes You can say "an agent identity is still a service principal" and be technically correct. Microsoft Entra Agent ID is built on service principal infrastructure ( agent identities, service principals, and applications ). You can also miss the point. Agent identity introduces a blueprint-centered model where one blueprint can represent many agents, where blueprint-level policy decisions can

Every morning, an online store receives the previous day’s orders from a marketplace partner. The file comes in JSON format. The company needs to add those orders to its main MongoDB orders collection. The sales manager also needs a CSV report that can be opened in Excel. That sounds like a small task. Import the file, copy the documents, export the report. But in practice, a few things can break the process. A date can be imported as a string. A field can have the wrong name. One batch may use total , while the main collection uses totalAmount . A temporary collection can keep old records and trigger duplicate key errors. A CSV export can create null values because the mapping points to fields that do not exist. And then there is customer data. The manager may need the sales numbers, but they probably do not need real customer names or internal customer IDs. This article walks through a real daily workflow: Import marketplace JSON ↓ Store the batch in a temporary MongoDB collection ↓ Copy the orders into the main orders collection ↓ Mask customer fields during export ↓ Create a CSV report The goal is not just to move data from JSON to CSV. The goal is to make the process repeatable, easier to check, and safer to share. The workflow The workflow has three jobs: Import Yesterday Orders ↓ Add Orders to Main ↓ Export Daily Sales Report The important part is the parent relationship between the jobs. Add Orders to Main depends on Import Yesterday Orders , so it only runs after the JSON file is imported successfully. Export Daily Sales Report depends on Add Orders to Main , so the CSV is created only after the main orders collection has been updated. This prevents the report from being generated when data is missing or incomplete. The incoming JSON file The partner sends a file with yesterday’s completed orders. A single order looks like this: { "orderId" : "ORD-2026-07-201" , "customerId" : "CUST-1003" , "customerName" : "Sofia Rossi" , "orderDate" : "2026-07-21T08:20:00

This week's releases cluster around a theme: reducing the overhead that compounds in production agentic systems. Gemini 3.6 Flash ships with measurable token reduction and a price cut, Vercel's AI Gateway gets service tier routing for latency-cost tradeoffs, and Python cold starts quietly drop by half with zero code changes required. Nothing experimental here—most of this is worth touching immediately if you're already in these ecosystems. Gemini 3.6 Flash cuts output tokens by 17% Google's 3.6 Flash reduces output token usage by 17% versus 3.5 Flash while lowering cost to $1.50/1M input and $7.50/1M output. The improvement is most pronounced on coding and web tasks, which happen to be the workload profile of most production agents. The companion model, 3.5 Flash-Lite, trades some quality for throughput—350 output tokens/sec—at $0.30/$2.50 per million tokens. Token efficiency isn't a vanity metric in agentic systems. Multi-step workflows compound output costs: every intermediate reasoning step, tool call response, and context accumulation multiplies what you pay. A 17% reduction per model call can translate to significantly more than 17% savings across a full agent loop, depending on how many hops your workflow runs. The throughput number on Flash-Lite matters too—if you're running high-volume document classification or search reranking, 350 tokens/sec opens architectures that weren't cost-viable before. The API swap is a single parameter change. No migration friction, no new authentication surface. Ship it now if Gemini is already in your stack and you're paying attention to inference costs. Replace 3.5 Flash with 3.6 Flash for general agentic tasks; move high-throughput, lower-stakes subtasks to Flash-Lite. Gemini 3.6 Flash and 3.5 Flash-Lite on AI Gateway Both new Gemini models are immediately available through Vercel's AI Gateway, callable via the unified AI SDK with the same cost tracking, failover, and routing you'd use for any other provider. Model selection

Most bibliography failures show up the night before arXiv or the journal deadline: placeholder DOIs, year pasted into volume= , inverted page ranges, invented case reporters. The fix is a paper repo that fails closed from day one . One command pip install https://github.com/SybilGambleyyu/citesure/releases/download/v0.5.68/citesure-0.5.68-py3-none-any.whl citesure init my-paper cd my-paper citesure gate . --preset ci citesure gate . --preset arxiv citesure init writes refs.bib , pre-commit hooks ( gate --preset ci + soft-lint), .github/workflows/citesure.yml , and a short CITESURE.md for coauthors. Empty bibliographies skip hard-ID floors until entries appear. What the gate checks Soft-lint — placeholder number/issue, inverted pages, year-like volume/month/edition, unsafe keys, all-caps titles, missing venues, duplicate DOIs/titles Health — hard-ID coverage floors Promote dry-run — DOIs still buried in url= Live verify — Crossref, doi.org, arXiv, PubMed, Europe PMC, DataCite, OpenAlex, CourtListener Domain packs Fifty-five live-clean packs (demography, sociology, political science, anthropology, ML, law, ecology, …): citesure packs --gate-all citesure packs --run anthropology-classics Evidence: 256/256 integrity · 209/209 claim pairs · 55 packs. Source: github.com/SybilGambleyyu/citesure · Demo: citesure.sybilgambleyyu.workers.dev

Ethereal Bytecode for the Network: Unlocking XDP's Magic! Hey there, fellow tech enthusiasts! Ever felt like the traditional networking stack in your Linux kernel was a bit… sluggish? Like it was taking the scenic route when you needed it to be a supersonic jet? Well, let me introduce you to a superhero that swoops in and turbocharges your network packet processing: eBPF, specifically in the context of XDP (eXpress Data Path). Forget the days of wrestling with complex kernel modules or praying for better hardware offload. eBPF and XDP offer a revolutionary, in-kernel, safe, and incredibly efficient way to program packet processing at the very edge of your network interface. Think of it as giving your network card a tiny, super-smart brain, capable of making lightning-fast decisions before the packet even bothers the main kernel stack. Pretty cool, right? So, buckle up as we dive deep into the wonderful world of XDP and eBPF, demystifying its power and showing you why it's becoming the darling of modern networking. 1. The "What's the Big Deal?" Section: Introduction to XDP & eBPF Imagine a bustling highway (your network). Traditional networking is like having every car stop at a toll booth, get inspected, and then directed by a central traffic controller. This works, but it can get congested. XDP, on the other hand, is like having intelligent on-ramps where some cars can be instantly identified, rerouted, or even rejected before they even hit the main highway. eBPF (extended Berkeley Packet Filter) is the technology that makes this possible. It's a powerful, sandboxed virtual machine that runs within the Linux kernel. Unlike traditional kernel modules, which can potentially crash your entire system if written incorrectly, eBPF programs are rigorously verified by the kernel for safety and correctness before they are allowed to execute. This means you get the power of kernel-level access without the existential dread of a kernel panic. XDP (eXpress Data Path) leverages

With “blessings” from the original Jibo founders, iKairos is a wearable or desk-mounted “AI journal” that turns your family moments into AI images and video.

On July 3, as a heat wave swept the region, New York State’s grid imported 52 gigawatt-hours of electricity from Canada—enough to meet about 9% of its total electricity demand that day. Some of that power shuttled in on a 339-mile power line stretching from Quebec to Queens called the Champlain Hudson Power Express (CHPE).…

Hear from six pediatricians in measles hot spot Utah, as the US faces infection levels not seen in over three decades and prepares to lose its status as a country that eliminated the dangerous disease.

The bottleneck in a mature SOC is rarely analyst triage; rather, it is the detection-engineering team's ability to keep the rule base aligned with a threat landscape that evolves faster than rules can be written. Learn how multi-agent system for production security operations has reduced mean times to detect and to respond by 40% and compressed the human work required by 12x. By Willem Berroubache

Increase your brand's AI visibility on autopilot Discussion | Link

Permission-first real-time senses for AI companions Discussion | Link

A human-in-loop support agent that tracks customer signals Discussion | Link

A private data-usage meter for your Mac menu bar Discussion | Link

As a backend developer, I have build hundreds of endpoints, so the typical endpoint flow is deeply ingrained in how I think about web applications. But when I started building AI-powered endpoints, I noticed an interesting shift. At first, AI endpoints looked like simple proxy endpoints with some configuration for connecting to a model: API receives request ↓ send prompt to model ↓ receive response ↓ return it to the client And it worked well until I found out that passing a prompt directly from the client was not a good idea. The endpoint could be misused for a completely different purpose, allowing someone else to consume my AI usage credits. Then I realized that the input also needed limits. Sending a large context for a specific task costs more and may produce unexpected results. So when I started looking closer, especially when I needed reliable structured output and predictable application behavior, I quickly realized that it was not that simple. Validation was no longer only guarding execution, it had also become a post-processing step. AI models are probabilistic. Even with the same input, they may return different outputs, omit required information, misunderstand instructions or return something that is technically valid but logically wrong. And because every token has a price, I cannot simply retry the request and hope for a better result. That was when I started questioning whether AI endpoints should be designed in the same way as conventional Web API endpoints. Table of Contents Conventional Web API Endpoint Flow AI-powered Web API Endpoint Flow What This Difference Changes Unpredictable Latency Retry Logic Idempotency and Side Effects Testing AI Endpoints The Output Contract Observability and Cost Summary Conventional Web API Endpoint Flow A conventional Web API endpoint usually follows a similar flow: validate request ↓ execute business logic ↓ return representation The first phase is request validation. We validate the incoming data against property