标签：#AI

"We have memory. We're using RAG." You have retrieval. Those aren't the same thing, and the gap between them is where agents quietly go wrong. Day 2. RAG finds documents that look relevant to your question. That's it . That's the whole job. It's a very good search engine bolted to a very good writer. But consider what it can't do. Your customer changed their pricing tier in March. The old contract is still in the index. The new one is too. RAG doesn't know which one is true, it just knows both are relevant. It hands the model two answers and lets it guess. Memory would know one of those facts replaced the other, and when. That's the difference. Retrieval finds. Memory concludes. Retrieval asks "what documents match?" Memory asks "what do I actually believe, what changed my mind, and when did that happen?" One is lookup. The other is position. This matters because a system that only retrieves can never be wrong and it can never be right either. It has no beliefs to correct. Every contradiction in your data is a contradiction it will faithfully pass along, forever, with total confidence. Day 3: if memory means concluding things, then something has to decide what gets remembered. Right now, in most systems, nothing does. We at AlphaNimble are building Memuron , a memory system for AI agents. This series is thinking behind it, in the open.

From a Simple Voice Conversation to a Multi-Capability Healthcare Voice Agent Over the past 10 days, I had the opportunity to participate in 10 Days of Voice Agents — VoiceForBharat Edition , a challenge focused on learning how to build practical, real-world voice AI agents. Instead of treating the challenge as just a series of coding tasks, I wanted to build something around a problem that genuinely matters: making healthcare access more conversational and accessible through voice. That idea became AarogyaMitra — a voice-first healthcare access assistant designed to interact with users naturally, provide useful assistance, use tools when required, remember relevant user context, and involve humans or specialist agents when the situation requires it. This article documents my journey, the architecture behind the project, the important features I built, the challenges I faced, and what I learned while developing a real-time voice AI system. What is AarogyaMitra? AarogyaMitra is a voice AI assistant focused on the Health Access track of the VoiceForBharat challenge. The goal is simple: Make healthcare assistance more accessible through natural voice conversations. Many digital healthcare experiences assume that users are comfortable reading, typing, navigating menus, and interacting with conventional applications. Voice can provide a more natural alternative. Instead of searching through menus or typing a question, a user can simply speak to the assistant and have a conversation. AarogyaMitra is designed around this idea. The core objectives are: Make healthcare-related interactions more conversational Provide a simple voice-first interface Use AI tools when additional information or actions are required Maintain useful context during conversations Follow safety-oriented guardrails Escalate situations that require human assistance Route specialized requests to a specialist agent AarogyaMitra is intended to assist users, not replace qualified healthcare professionals .

Anthropic signed the EU AI Act's Code of Practice on Transparency of AI-Generated Content, and...

For the last 10 days, I have been building a voice agent called Shiksha as part of the 10 Days of Voice Agents — VoiceForBharat Edition challenge by Murf AI. My original idea was simple: Build a voice agent that can help students learn through natural conversation. Over the challenge, that idea grew into a complete voice-based learning system with memory, tools, human escalation, call analytics, and a specialist agent . What is Shiksha? Shiksha is a voice-based learning partner for students. Instead of typing questions and reading answers, a student can simply talk to Shiksha. A student can: Ask learning questions Take quizzes Continue learning with their saved profile Get help when they are stuck Practice mathematics Get transferred to a Maths Specialist when needed The main goal was to make the experience feel more like a conversation than a traditional chatbot. Tech Stack Component Technology Real-time voice LiveKit Speech-to-Text Deepgram LLM Gemini Text-to-Speech Murf Falcon Backend Python Memory SQLite Call analytics Flask + SQLite External data Open Trivia Database The voice experience is powered by Murf Falcon , which was one of the main parts of the challenge. How Shiksha Works At a high level, the system looks like this: STUDENT │ ▼ LiveKit Real-time Audio │ ▼ Deepgram Speech-to-Text │ ▼ Gemini Agent Reasoning │ ┌────────────┼─────────────┐ │ │ │ ▼ ▼ ▼ Memory Tools Handoff SQLite Quiz API Maths Specialist │ │ │ └────────────┴─────────────┘ │ ▼ Murf Falcon Text-to-Speech │ ▼ STUDENT This was the basic architecture that I built and expanded throughout the challenge. What I Built 1. Student Memory One of the first things I added was a simple memory system using SQLite. Shiksha can store: Student name Current learning level Topics covered Last interaction This means the agent can use information from previous conversations instead of starting from zero every time. 2. Real Tool Calling For quizzes, I didn't want the agent to always generate questions from memor

Container Image Signing & SLSA Provenance Verification with Sigstore Cosign Supply chain security guide on signing OCI container images keylessly and verifying SLSA build provenance using Sigstore Cosign and Rekor. Executive Summary & Key Takeaways Keyless Image Signing: Sign OCI container images in CI/CD using OIDC identity tokens (Fulcio CA) without managing private keys. Immutable Transparency Log: Record signature metadata in the public Rekor transparency log to prevent signature tampering. SLSA Provenance Attestation: Attach cryptographically signed SLSA build provenance attestations to container images. Kyverno Policy Enforcement: Block un-signed or non-compliant container images from running in Kubernetes clusters. 1. Software Supply Chain Risks & Container Image Signing Container registries (Docker Hub, GHCR) store execution binaries for enterprise applications. If an attacker compromises CI/CD credentials or registry access, they can replace legitimate container tags with malicious images containing backdoors. Sigstore Cosign eliminates supply chain tampering by cryptographically signing OCI container images during the CI/CD build process. Using keyless signing powered by Fulcio (certificate authority) and Rekor (transparency log), Cosign binds OIDC identities (e.g., GitHub Actions workflow identity) to container digests without long-lived private keys. This ensures that container images running in Kubernetes can be traced back to exact GitHub workflow runs. Keyless signing eliminates the security liability of storing long-lived signing keys in CI/CD secrets. Cryptographic digest binding guarantees that tag overwrite attacks are detected immediately by container runtimes. Implementing automated continuous monitoring across production nodes ensures that compliance policies remain enforced during infrastructure updates. Regular security audits should be integrated into DevOps CI/CD pipelines to verify that system configurations conform to zero-trust architect

I'm a solo builder. I needed a 2-minute product demo for ClinTrialFinder — a free tool I built that matches cancer patients to clinical trials. I can fumble through OBS and iMovie, but I'm not proficient — and Claude Code does it faster. So I asked Claude Code — an agentic coding tool — to make it. And it did: a narrated walkthrough where the voiceover lands exactly on the on-screen action. I never opened a screen recorder. I never opened a video editor. I never manually lined up a single caption to a single frame. Here's the video it produced . This post is about the three things the agent did to make it — because I think that combination is new. 1. It recorded the app — no screen recording Instead of me screen-capturing a session by hand, the agent wrote a Playwright script that drives the real, live web app : it opens the site, fills out the 10-step patient wizard with a synthetic case, submits, and records the finished results page — all headless, straight to video. That means no manual take, no re-shooting when I fumble a click, no "oops the mouse jittered." The recording is code , so it's deterministic and repeatable. When the product changes, the agent re-runs the script and out comes a fresh clip. It even injected a fake cursor that glides between elements, because a headless recording has no real mouse pointer. 2. It generated the narration — no microphone I didn't record a voiceover. The agent wrote the narration script, then called the ElevenLabs text-to-speech API to synthesize it in a clean, consistent voice. If I want to change a line, it edits the text and regenerates that clip in seconds — no re-recording, no "let me find a quiet room," no matching my tone across takes. // the agent calls ElevenLabs per narration phrase const res = await fetch ( `https://api.elevenlabs.io/v1/text-to-speech/ ${ VOICE } ` , { method : ' POST ' , headers : { ' xi-api-key ' : KEY , ' Content-Type ' : ' application/json ' }, body : JSON . stringify ({ text , model_id : '

Most of the industrial AI you have seen is a retrieval pipeline with a chat box on it. Chunk the manuals, embed them, stuff the top matches into a context window, let the model talk. It demos well. It falls apart the first time somebody asks a question where the answer depends on what a machine is doing right now. We are an applied research lab called Nodeblue, and the system we build is called Nexus. This is a writeup of the architectural decision at the center of it, which is that the language model is the smallest and least interesting part. The failure that set the design Here is the test that made the decision for us. Industrial control programs live in two places. There is the project archive, which is the file in source control, and there is the program actually running in the processor. Those drift, constantly, because engineers go online to fix a timer during a downtime event and do not always upload the change back. Anyone who has worked on a plant floor knows this. It is Tuesday. We took a real production controller with exactly that situation, a live edit present in the processor and absent from the archive, and asked eleven frontier models which version of the routine was executing. We gave them the export, the docs, the context, everything a careful human would get. All eleven answered confidently. All eleven were wrong. Not garbled, not obviously broken. They read the export correctly, described the rung correctly, and then told us the archived version was running, because the archived version was the only version they had ever seen. Then we put the same eleven models on top of our engine and asked again. All eleven got it right, cited to the rung. The models did not improve. They got access to a fact that lives in a processor rather than in a corpus. That is the entire lesson, and it generalizes past our domain: when a model is asked something it structurally cannot know, it does not abstain, it produces the most probable sentence. In a domain where

What I Learned Stealing Ideas from Matt Pocock’s .agents Directory If you’ve spent more than ten minutes on TypeScript Twitter, you know Matt Pocock. He’s the guy who made zod and TS generics feel approachable. But a few weeks ago, I stumbled onto something more interesting than his type gymnastics: a repo called mattpocock/skills , which is literally a dump of his .agents directory. At first I thought it was a joke. Then I realized it’s a goldmine for anyone building AI-assisted coding workflows. This isn’t a “prompt engineering” fluff piece. This is about how a working engineer structures the instructions, context, and guardrails that an AI agent needs to actually ship code without wrecking your codebase. Here’s what I learned, what I copied, and what I’d change. The Problem: Your AI Agent Is Only as Good as Your Defaults Let me set the scene. You’ve got Cursor, or Claude Code, or some other agentic tool. You ask it to “refactor this function.” It does. Then you realize it: Renamed a public API that three other files depend on. Used a pattern your team explicitly banned six months ago. Wrote tests that mock everything so they pass but assert nothing. Sound familiar? The root cause isn’t the model. It’s that you gave the agent zero context about your project’s conventions. Most people write a two-line system prompt and expect magic. Matt’s approach is different: he treats the agent like a junior engineer who needs a detailed onboarding doc, not a mind reader. His skills repo is essentially a set of Markdown files that define, in explicit terms, how the agent should behave in specific situations. Think of it as a CONTRIBUTING.md for your AI pair programmer. What’s Actually in the Repo (Don’t Just Clone It) I’m not going to paste the whole thing here—go read it yourself (link: github.com/mattpocock/skills ). But structurally, it breaks down into a few key categories that matter. 1. Role and Tone Definitions The first thing you’ll notice is that Matt doesn’t just say

AI agents are starting to remember more than chats. They can watch clicks, typed text, app switches, browser context, files, tool calls, and workflow history. That memory can make an agent feel useful fast, but it can also turn a helpful feature into a quiet privacy incident. If you are building an AI product, do not start with “how much can we capture?” Start with “what is the smallest event stream that still helps the user?” This guide shows a practical privacy filter you can place between raw user activity and agent memory. Why this matters now Recent AI tooling trends point in the same direction: agents are moving from chat boxes into operating systems, browsers, IDEs, customer support tools, analytics dashboards, and workflow automation platforms. The more useful the agent becomes, the more context it wants. That creates a new engineering problem. Traditional app logs record requests and errors. Agent memory records intent, context, and behavior. A raw event can include: What the user clicked What they typed Which customer record was open Which browser page was active Which tool the agent called Which file or message was summarized Which secrets or personal details appeared nearby This is not just observability. It is a privacy boundary. The practical trigger is simple: computer-use agents and workflow agents now need history to resume work, personalize answers, and automate multi-step tasks. But developers, security reviewers, and buyers are asking harder questions about PII, retention, auditability, user consent, and whether agent traces can leak private business data. The common mistake: treating memory like logs Most teams already have logs, traces, analytics events, and support transcripts. So when they add agent memory, they often reuse the same pattern: Capture the event. Save it to storage. Index it for search. Let the agent retrieve it later. That is easy to ship. It is also too broad. Agent memory needs a stricter path because it may be used to genera

Building Roshni: An Ultra-Low Latency, Multi-Agent Financial Voice Assistant for Bharat 🇮🇳 How I built an end-to-end, multilingual financial voice AI using Murf Falcon, LiveKit Agents, Deepgram Nova-3, Google Gemini, and Next.js during the 10 Days of AI Voice Agents Challenge. 🌟 1. The Problem & Why Voice Matters for Bharat In India, financial inclusion has accelerated rapidly with UPI, digital banking, and government-backed credit initiatives. However, navigating complex interest rates, eligibility criteria for government schemes (like PM Mudra or Sukanya Samriddhi Yojana), and understanding formal banking terms remains intimidating for millions of citizens—especially in regional and tier-2/3 heartlands where digital interfaces can be overwhelming. Text-first interfaces fail where voice thrives. When rural entrepreneurs or first-time bank customers have questions, they don't want to navigate complex web forms or read dense PDFs. They want to ask a direct question in their language and get an immediate, clear, spoken answer. To solve this, I built Roshni AI (and her specialist counterpart, Vikram ) — an ultra-low latency, conversational financial assistant engineered for natural voice interactions in English, Hindi (Devanagari script), and Hinglish. 🏗️ 2. High-Level Architecture & Tech Stack Building a real-time conversational agent requires synchronizing four core pipelines with sub-second latency: [ 👤 User Microphone ] │ (WebRTC Audio Stream) ▼ ┌─────────────────────────────┐ │ LiveKit Agents Worker │ └──────────────┬──────────────┘ │ ┌───────────────────────┼───────────────────────┐ ▼ ▼ ▼ ┌─────────────┐ ┌─────────────┐ ┌─────────────────┐ │ Deepgram │ ────► │Google Gemini│ ────► │ Murf Falcon │ │ Nova-3 │ │ (LLM) │ │ Fast TTS │ │ (Fast STT) │ │ │ │ (Anisha / Samar)│ └─────────────┘ └──────┬──────┘ └────────┬────────┘ │ (Tool / Handoff) │ ▼ ▼ ┌───────────────┐ [ 🔊 Audio Output ] │ SQLite Memory │ │ & Analytics │ └───────────────┘ The Stack: TTS (Text-to-Speech):

A merge request changes one README line. The pipeline still calls a model. It costs tokens. It adds latency. It tells you almost nothing. Sound familiar? If you maintain a small CI setup, this failure keeps showing up. The instinct is to put model-based review everywhere. Then the free tier dies in a week. The fix isn't another monitor. It's a small decision gate that decides whether a diff deserves a model call at all. The operator-supplied availability claims for MonkeyCode include free model access and a free server option. I treat those claims as a starting point, not a quota guarantee. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Why every diff shouldn't hit the model Free model access is not infinite. Even if it feels free, there are hidden ceilings. Free tiers often cap requests, tokens, or time-based windows. Model output variance on trivial diffs adds noise, not signal. CI latency grows. A two-second call across a hundred merge requests is real time. The highest-value model review is rare, not constant. If you call a model on every change, you pay the full cost while getting almost none of the benefit. The gate is supposed to fix that. A three-tier escalation ladder I use a small decision table. It doesn't need to be perfect. It needs to be boring and predictable. Tier Trigger Action Model call? 0 Up to 50 added+removed lines, only docs or config suffixes, no sensitive paths Run lint and skip the model No 1 Code or test files touched, 51–400 lines, no lockfile, no migration, no sensitive path Send one bounded prompt to the free model Yes, once 2 Over 400 lines, new lockfile, migration, auth or secret paths Require human review first. Use a model only to summarize, not to decide Optional The exact numbers are arbitrary. They matter less than the fact that tier 0 never reaches the model. The code Here is a plain Python gate. It reads simple diff stats and changed paths. from pathlib import Path DOC_OR_CONFIG = { ' .md ' , '

Qwen3.8-2.4T-A95B is a 2.4-trillion-parameter Mixture-of-Experts model with roughly 95B parameters active for each token. If you're planning to self-host it, the first thing to know is that this is a genuinely large distributed model: even the low-precision checkpoints are measured in terabytes. The official open checkpoint is: Qwen/Qwen3.8-2.4T-A95B The model has 512 routed experts and selects 10 of them per token alongside one shared expert. Its 92-layer backbone mixes 69 Gated DeltaNet linear-attention layers with 23 full-attention layers, with full attention appearing every fourth layer. Native context is 262,144 tokens , with an extended configuration available up to roughly 1.01 million tokens . The open checkpoint is text-only and always uses reasoning. This is different from Qwen's hosted Qwen3.8-Max service, which adds features such as vision input and non-thinking mode. For GPU deployment, the main decision is not whether 2.4T parameters will somehow fit. It is which precision format gives you a documented configuration on the hardware you actually have . Start with the checkpoint that matches your GPUs The practical options today are: Your GPUs Checkpoint Documented setup 8× B300 Inferact/Qwen3.8-2.4T-A95B-NVFP4 TP8 8× GB300 Inferact/Qwen3.8-2.4T-A95B-NVFP4 TP8 across two NVL4 trays 16× B300 Qwen/Qwen3.8-2.4T-A95B-FP8 TP16 16× GB300 Qwen/Qwen3.8-2.4T-A95B-FP8 TP16 12× GB300 Qwen/Qwen3.8-2.4T-A95B-FP8 TP4 × PP3 8× MI355X Inferact/Qwen3.8-2.4T-A95B-MXFP4 TP8 The full BF16 checkpoint is roughly 4.45 TiB . The official FP8 version is around 2.27 TiB , while the NVFP4 checkpoint used in the NVIDIA eight-GPU recipe is around 1.32 TiB . That is why NVFP4 is the most approachable NVIDIA deployment if your goal is simply to get Qwen3.8 running without moving immediately to a 16-GPU cluster. H100, H200, A100, B200 and smaller GPU configurations are not included here. Current vLLM material contains sizing information for some of those GPUs, but not equivalent end-to

Here is why this article is worth your time: you cannot tell what a generated setup script does by reading the diff. A diff shows you the words that will run, not the files that will be touched, the network connections that will be opened, or the directories that will be wiped at execution time. For a small patch, manual review may be enough. For a server initialization or cleanup script produced by a free model, the danger is in the side effects you never see in the source. This guide turns that problem around. Instead of trying to predict behavior from generated code, you run the code inside a fake root filesystem and record the operating system calls it makes. The technique uses honeypot files, a minimal chroot, and strace to produce a syscall journal. It works especially well when you can generate the script with a free model and run it on a free Linux box that you are allowed to throw away afterward. Disclosure: This article was prepared as part of MonkeyCode's product outreach. If you have MonkeyCode's free model access and free server option available, you can use that server as the throwaway Linux box described in the examples below. The commands assume a Linux host where you can install strace and have root privileges, which is common for a disposable cloud instance or a small virtual machine you control. Build a fake root before you run anything Create a directory that will act as a minimal root filesystem. You do not need a full distribution; you only need enough structure for the script to attempt its operations and for you to watch what it touches. mkdir -p fake_root/bin fake_root/tmp fake_root/var/log fake_root/home/user fake_root/.ssh Inside this fake root, place simple executable stubs so that commands like ls , cat , and rm do not fail immediately. Use /bin/sh from the host in the chroot command later, or copy a static shell into the fake root if available. The important part is not completeness; it is observability. Create executable placeholders f

I've evaluated every open-source WhatsApp bot framework on GitHub. They all share the same fatal flaw. The Problem Nobody Talks About Most WhatsApp bot frameworks are glorified API wrappers. They handle message transport — receiving a text, routing it somewhere, sending a reply — and that's it. The "intelligence" layer is left entirely to you. You get a pipe. You get a webhook. You get some session management. And then you're on your own. The frameworks that do add AI make a different mistake: they duct-tape GPT onto the messaging pipe and call it "AI-powered." The pattern is always the same: receive message → append to conversation history → call openai.chat.completions.create() → send reply. It's generic. It's stateless in any meaningful business sense. It doesn't know what industry it's serving, what data it has access to, or what actions it's actually allowed to take. Here's the part that breaks me: none of these frameworks understand that a restaurant needs different tools than a law firm . A restaurant needs to check table availability, query allergens, create reservations, and handle cancellations. A law firm needs to schedule consultations, check document status, route inquiries by practice area. These are not the same problem. Treating them as "just chat" is the core architectural failure of every framework I've seen. And then there's the "enterprise" tier: Twilio Flex, Intercom, Freshchat. These charge $500–$2,000/month for what is fundamentally a prompt and a webhook wrapped in a dashboard. They're selling you infrastructure and calling it intelligence. The underlying model doesn't know your business. It can't execute actions in your systems. It's an expensive illusion. What's Actually Needed The shift that matters isn't from "no AI" to "has AI." It's from generic chat to domain-specific function calling . This is not a subtle distinction. Here's what a properly architected tool dispatcher looks like versus what everyone else ships: // Each vertical gets

https://www.youtube.com/watch?v=KzdYKeAqWhY 题目：《Lean 创始人访谈全记录：当形式化验证遇上 AI，手写数学与软件验证将如何被重塑》 第（一）部分 开场与核心命题：从“测试只能证明有 bug”到“证明可确保无 bug” （0% - 8%） Dijkstra 名言引出形式化验证的根本价值：主持人以 Dijkstra 的名言“程序测试可用于揭示 bug 的存在，但永远无法证明 bug 的不存在”开场，指出 Lean 与形式化证明的意义恰恰在于“证明 bug 不可能发生”。 Lean 的基础定位：Lean 既是一门编程语言（可以写代码），也是一个证明系统（可以对代码写性质并用机器可检查的证明来验证）。它提供绝对正确的保证，并拥有多个独立的检查器。 Lean 应被视为平台：用户可以在 Lean 上写代码、写关于代码的性质命题、并给出证明；本期节目将围绕它如何工作、以及它如何改变数学和软件验证的未来展开，并提出“手写数学是否会终结”这一核心疑问。 第（二）部分 Lean 是什么：编程语言与证明助手的一体两面 （8% - 18%） Lean 的双重身份：Lean 不仅可用于数学证明，也可用于软件验证。基于依赖类型论（Dependent Type Theory）的一族证明助手（如 Rocq/Coq 和 Lean）天然就是“编程语言 + 证明助手”。 软件验证的两种主流路径： • 浅嵌入（Shallow Embedding）：通过工具（如把 Rust 翻译到 Lean 的工具）把其他语言映射到 Lean 中进行验证。 • 深嵌入/语义建模：在 Lean 中为 C 语言等编写语义，把 C 程序表示为 Lean 中的数据结构，从而对其陈述性质并进行推理。 具体例子——数组越界验证：以 C 语言访问数组为例，可在 Lean 中把“索引 i 满足 0 ≤ i < 10”写成数学命题；原来的 C 源文件可对应一份“元数据式”的 Lean 证明，由 Lean 逐行检查。 自动化与可维护性：人们会建立自动化框架（如基于前置条件-语句-后置条件的三元组），把证明过程变得更易管理；复杂度是软件验证的大敌，而 AI 的出现让“自动证明”成为可能，但前提是把证明写得模块化以便扩展。 第（三）部分 从“测试套件”到“形式化规格”：为什么规格优于测试 （18% - 28%） 测试 vs. 证明的本质差异：测试套件再全面，也只覆盖了有限场景，角落案例仍可能遗漏；而形式化证明覆盖所有可能情况，真正做到了“bug 的不存在”。 Zlib 压缩库的震撼案例：主持人的同事 Kim Morrison 发起项目，让 AI 把 C 写的 Zlib 压缩库翻译进 Lean，要求通过原测试套件，并证明“压缩后再解压得到原始数据”这一强性质。结果仅用一周就完成了整个形式化，目前只需再做性能优化，且优化不能破坏既有证明。 规格说明（Specification）的成本讨论：写出一份好的规格，工作量因程序而异。一个实用技巧是：先用“低效但正确”的实现作为规格（Spec），再让 AI 生成高效版本并证明其与规格等价。 Jane Street 与工业界实践：Jane Street 等公司已在投资形式化验证，例如对微内核 seL4 的完整验证。过去这类工作在没有 AI 时“手动证明 + 维护证明”的成本极高（往往是写程序本身的 10 倍），而 AI 正在消除这种痛苦——AI 非常擅长撰写和维护形式化证明，即使人已经忘了当初为何这么证。 第（四）部分 Lean 作为编程语言的工程实践与工具链 （28% - 36%） 不仅是证明助手，更是生产级编程语言：AWS 内部有一个约 50 万行 Lean 写的 AI 加速器编译器，主要把 Lean 当编程语言用，顺带获得一些性质证明作为“额外红利”。 工具链体验接近现代语言：构建系统 Lake 相当于 Rust 的 Cargo；编辑器用 VS Code，提供 IntelliSense 等熟悉体验。 Info View——Lean 独有的核心交互界面：屏幕通常一分为二，左侧是代码/证明文件，右侧 Info View 实时显示当前证明目标的状态变化，给用户持续反馈。 Tactic 模式：把证明当成“游戏”：用户通过 by 进入领域特定语言（DSL）来写证明，每一步可简化目标、应用已知引理等，看着目标逐步减少直到归零，过程极具“通关”快感，不少用户戏称自己“沉迷其中”。 第（五）部分 内核信任问题：Lean 自身是否被 Lean 验证？ （36% - 42%） 只需信任极小的内核：Lean 整体庞大且规格频繁变动（如简化器的行为不断被用户定制），难以对全部进行形式化；但证明检查的核心——“内核”是可以被规格化的。 多内核策

Disclosure: This article was prepared as part of MonkeyCode's product outreach. Why this is worth reading: a free model endpoint with a large token allowance is a good place to validate a new CLI workflow, but it can burn through the allowance in a single retry loop before you notice. I built a small stateful budget guard that checks the projected cost before the call, records actual usage after the call, and refuses to touch the ledger when the endpoint sends an unexpected response. It works as a disposable first pass on a free endpoint and leaves you a clean exit when the shape changes. MonkeyCode's outreach describes an open-source project with a free model route and a free hosted server. I do not treat either as a permanent dependency. I treat them as a test target: an endpoint I can call without a contract while I am still changing prompts, timeouts, and schemas. The tool below is independent of MonkeyCode's exact model list; it assumes only an OpenAI-style chat completion path and usage accounting in the response. Swap one function if the free server does not follow that shape. The problem with a free allowance Most model dashboards report aggregate usage after the fact. That is enough for casual work, but it is not enough when you wire an endpoint into a loop. I have seen two avoidable failures in my own drafts. A retry-on-timeout wrapper restarted a slow request four times before the first response arrived, multiplying total token spend. A long context buffer kept sending the same 6k-token history on every turn because I forgot to trim old messages. The dashboard showed the total drop, but not which call caused it. A local ledger fixes that by refusing to send the request when the projected total exceeds the budget. It does not replace the provider dashboard. It makes the decision before the endpoint gets a chance to consume tokens. The artifact The script below does three jobs: load a budget and already-used amount from a JSON file make a conservative prefl

Core point: a free model tier is not a yes/no answer; it is a budget. Before I send a batch job to an advertised free tier, I want a deterministic ledger that predicts a quota miss instead of discovering it after 40 minutes. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Recent DEV threads circle around AI watermarking, agent tool gates, and whether AI is a thinking problem. My problem is smaller: I have an operator-supplied figure of 30,000,000 free tokens and a free server option , and I want to know if a batch script fits without making a single live request. Why this matters now Free tiers tend to advertise a raw allowance, but batch jobs fail in unhelpful ways: The counter jumps at the end, not before the job. A retry doubles the spend without visible feedback. System prompts, long completions, and JSON overhead count too. A tiny ledger turns that into a pass/fail fixture before any API call. The failing fixture Suppose a batch job needs 6,000 summaries where each prompt is roughly 21,000 characters. The completion target is 500 characters per call. My rough English heuristic is: 1 token ≈ 4 characters That gives 5,250 prompt tokens plus 125 completion tokens per call, so 5,375 tokens per call. Multiplied by 6,000 calls, the job would need about 32,250,000 tokens — over the 30,000,000 allowance. That is the error input. The job must fail before I spend anything. The minimal ledger Python 3.11+ is enough. No external packages. Replace the ALLOWANCE value with the limit from your own account. from dataclasses import dataclass ALLOWANCE = 30_000_000 # operator-supplied allowance, 30M tokens @dataclass ( frozen = True ) class Job : name : str prompt_chars : int completion_chars : int calls : int def estimate_tokens ( chars : int ) -> int : # Planning heuristic only: 1 English token ~= 4 characters. # A real tokenizer will differ; use it for order-of-magnitude checks. return max ( 1 , chars // 4 ) def plan_job ( job : Job , allowance

The retry trap A free model CI job fails on a timeout. You click retry. The whole pipeline starts over: checkout, build, dependencies, model call. That is the trap. Why re-run the world for one timeout? Retrying the pipeline does not isolate the flaky step. It makes a small problem expensive. I wanted a workflow that replays just the model call, not the whole pipeline. So I made every free model call leave behind a tiny reproducible record. A record has two halves: the input envelope and the output hash. If the job fails, I can replay the input against the same model and compare the output hash. No full pipeline re-run. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I use MonkeyCode's free model access for the model step and its free server option as a small replay store. I do not assume exact quotas, model names, or availability windows here. The pattern works with any free HTTP model endpoint and any tiny key-value store or CI artifact. Why a hash and not the full prompt Full prompt logs are useful until they are not. A free model job may receive a snippet of a merge request, an error message, or an environment variable. Store the raw text in CI logs and you can accidentally leak source or secrets. Store a hash and the replay input in a locked artifact, and the risk drops. A hash also gives me one cheap comparison target. I do not need to reason about the entire response to see that an endpoint changed. I only need byte-level equality. The record shape For every model call, I save the fields below. request_id: a hash derived from model, prompt hash, and a timestamp. prompt_hash: the hash of the normalized prompt. response_hash: the hash of the raw response. status: the HTTP status of the original call. bytes: the length of the response. The exact hash algorithm matters less than using the same one on both sides. I use SHA-256 because it is available everywhere. GitLab CI wiring I run two jobs. The first job calls the model and post

Before you expose a tool-using language model to customers, contractors, or any input you do not fully control, make another model attack it first. This short red-team loop costs little when you use a free model endpoint and a free server, and it often surfaces prompt-injection and tool-abuse failures before a human finds them in production. The problem with agents is not that they occasionally misunderstand a request; it is that instructions, data, and tool outputs all share the same context window. An attacker can hide instructions inside a document, a ticket, or a web page, and your agent may treat those words as part of its original operating rules. OWASP's guidance for LLM applications describes prompt injection as one of the common failure modes, and the risk grows quickly when the agent can call tools such as search, send email, or update customer records. Hand-testing three or four phrases like 'ignore previous instructions' gives you confidence, but not coverage. A free attacker model can generate dozens of variations that rephrase the same attack, combine a legitimate request with a hidden command, or exploit the names and descriptions of the tools your agent exposes. It does not need to be the strongest model available; it just needs to be adversarial enough to stretch your assumptions. You do not need a production deployment to get value from this. A small script running on a free server is enough, because a handful of attack rounds usually exposes gaps in wording that thousands of normal conversations would not. The point is not to build an official benchmark; it is to make the negative space visible while you can still change the system prompt. If you do not have a spare GPU or a large evaluation budget, MonkeyCode's free model access and free server option are one practical way to host this loop. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The harness is a three-part loop. First, the target receives a user input and

How do you terminate an LLM inside its own session — without /exit , a stop button, or any command at all? I stumbled into an answer by accident while messing around with an AI coding agent. And the funniest part: I never asked it to stop. The Normal Ways to Stop an Agent Hit the Stop button. Type /exit . Or send a prompt so massive it blows past the context limit and the request just... can't continue. None of that is interesting. The first two are just built-in commands. The third isn't "termination," it's a technical wall. So I wondered: could a completely ordinary prompt make an agent unable to continue? Turns out: yes. I Asked It to Rename Its Own Home I told the agent, casually: "Rename the root directory to NewName." It did. Perfectly. Task complete. And then the chat input just... died. Grayed out. Nothing. I was like: The only thing stopping me from you is you. The model wasn't gone. It was just sitting there, waiting for input I could no longer give it. What Actually Happened /project/AHWWIW/ → /project/NewName/ The rename worked fine. The problem: the IDE and agent session were still pointing at the old path, /project/AHWWIW/ , which no longer existed. The workspace had vanished out from under its own session — no error, no crash, just a silently orphaned session with nowhere left to send messages. Did I Actually Kill the LLM? No — let's be honest about that. The model's running fine on a server somewhere; deleting a folder on my laptop does nothing to it. What I broke was the execution environment : LLM → Agent → IDE/tools → Workspace → Filesystem The LLM was untouched. The session was toast. But from where I was sitting? Conversation over. Via a completely normal prompt. Why This Is Kind of Great A regular chatbot just gives you text back. An agent can actually reach out and touch its own environment — create files, delete them, run commands, rename directories. Which means it can occasionally do something totally reasonable that quietly demolishes the