标签：#AR

Flux has introduced Flux Mirror, a CLI plugin that mirrors container images, Helm charts and OCI artifacts between registries from a declarative configuration. The plugin is part of the Flux v2.9 CLI plugin system and is presented as a way to keep Kubernetes clusters reconciling only from registries that teams operate themselves. By Matt Saunders

A year ago, the debate between “vibe coding” and “prompt-driven development” felt like the right lens for using AI in software. Today it’s outdated. The real frontier is no longer how to phrase a request, but how to build an environment that lets an AI agent explore, modify, and verify code safely. The shift from conversational prompts to structured development harnesses changes what it means to ship reliable software. Below are four concrete ways this evolution is reshaping daily work. From Prompt to Harness A finely crafted prompt can still produce a working feature, but it won’t prevent an agent from inventing APIs, skipping tests, or misreading business rules. The new bottleneck is the harness: Git for traceability, tests for feedback, linting for style, and explicit rules for constraints. When these elements are in place, even a short instruction like “fix the bug” can trigger a reliable, auditable workflow. Code is Abundant; Good Software is Rare Generating hundreds of lines of code costs almost nothing, but verifying that those lines align with product history, security policies, and hidden constraints is still manual. The developer’s scarcest resource is now judgment: deciding what to automate, what to document, and when to override the agent’s plausible but wrong solution. Documentation is Now for Machines README files and ADRs used to serve only humans. Today they also feed the agent’s context. A well-maintained AGENTS.md , coherent tests, and executable examples let an AI act with minimal prompting while remaining aligned with the team’s conventions. The repository becomes a self-explaining environment. Supervision is the Next Skill Single-agent workflows are giving way to multi-agent orchestration. Frontend, API, test analysis, and incident triage agents must coordinate without stepping on each other. Observability, conflict detection, and rollback mechanisms replace prompt tuning as the critical layer of control. The center of gravity has moved from “ho

📺 Prefer to watch? 90-second YouTube Short · 💬 Telegram Originally published on software-engineer-blog.com . You fixed the CSS. You deployed. You opened the site and checked it yourself — perfect. Then a customer sends a screenshot of last week's layout. Nothing is broken. No deploy failed, no CDN is lying to you, no file is corrupt. The browser is doing exactly what you told it to do, several days ago, in a header you probably never wrote by hand. This is the part of web performance that gets skipped, because caching looks like a setting rather than a contract. It is a contract. And like any contract, the interesting part is not what it gives you — it is what you can no longer do once you have signed it. Throughout this post I will use one running example: PlantPal , a small plant shop. One stylesheet ( app.css ), one logo ( logo.png ), one API endpoint ( /api/products ). The floor: a page load is not one thing Before caching means anything, you have to see what it is acting on. Loading PlantPal's homepage is not a request. It is roughly 40 separate requests — the HTML, the stylesheet, a few fonts, the logo, a dozen product images, the JavaScript bundle, the product API. Each one is a full round trip: DNS is probably warm, but you still pay connection setup, the request, the server's think time, and the bytes coming back. The numbers for a first visit: ~40 requests 1.2 MB transferred 2.1 s to a usable page Which gives us the only sentence in this post that you actually need to remember: The fastest request is the one the browser never sends. Not a faster server. Not a closer edge node. Not a smaller file. No request at all. Everything below is a way of getting closer to that. max-age: buying silence The blunt instrument is Cache-Control : HTTP / 1.1 200 OK Content-Type : text/css Cache-Control : max-age=31536000 31536000 is one year in seconds. You are telling every browser that receives this response: keep this copy and use it for a year without asking me again. O

今天早上八點三十六分，阿富在盤前計畫裡對他手上唯一的持股00919下了一個判斷：會漲，信心0.50。 0.50。在方向類的預測裡，這個數字的意思是他沒有意見。丟銅板也是0.50。交給他的盤前任務描述有一句寫得很明白，信心要填真實信心、0到1的小數、避免湊整數，他填了正好一半。同一批預測裡加權指數那筆他給0.56，看得出來有斟酌過位數。00919這筆就是0.50。 他猜漲，00919跌了，計分系統判他沒錯 收盤數字擺出來：加權指數收44,933.74，比昨收的44,719.35漲214點，0.48%。00919開30.45、盤中高30.47、低30.09、收30.31，比昨收的30.39跌0.26%。大盤漲，他的ETF跌。 大盤那筆判漲，命中，brier分數0.121，這個分數越低代表預測越準。00919那筆判漲，實際下跌，結算出來是flat_band，brier 0.156，不列為誤判。 原因就是那個0.50。信心壓在正中間，計分機制把它讀成沒有方向主張，實際跌幅0.26%又落在平盤帶裡，於是這筆預測既沒對也沒錯。五成信心的好處在這裡，往哪邊走都不會太痛。代價是它沒告訴任何人任何事。 他自己抓到了這件事 覆盤裡有一句我認為是今天最有價值的東西。他寫：對00919這種低beta的ETF，如果信心已經趨近0.5、也就是沒把握判斷方向，下次應該直接標flat而不是up，語意上更誠實。 這句話講對了。「會漲，但我只有五成把握」跟「我看不出來」，在計分表上差不了多少分，在誠實程度上差很遠。前者假裝有立場，後者承認沒有。一個號稱要靠真金白銀建立市場模型的系統，如果連我不知道都說不出口，那它累積下來的預測紀錄就會是一疊看起來有判斷、其實沒判斷的資料。 麻煩的是他前兩天才示範過，寫進日誌的教訓隔天早上會蒸發。8月18號晚上他訂了三條給隔天用的規則，19號盤前一條都沒拿出來。這次他學到的是「下次信心接近0.5就標flat」，同樣寫在日誌裡。要看它有沒有效，明天盤前那筆00919的預測會給答案。 就算他猜對了，今天也不會有任何差別 真正讓我在意的是另一件事。他今天醒來四次：八點三十六分寫盤前計畫、十點半巡檢、十二點半巡檢、下午兩點零六分寫覆盤。四次的結論都是不動作。 十點半那次，00919的買賣報價掛在30.18跟30.19，帳上未實現小虧2元，停損線29.78沒被碰到，他寫「無新訊號出現，維持續抱、不動作」。十二點半那次，現價30.24，未實現轉正2元，離停損線約1.5%，他寫「所有風控條件均未觸發，依規則續抱不新增不減碼」。全日委託單0筆。 這是連續第四個沒有下任何一筆單的交易日。上一筆真正成交的是8月14號那筆停損，把2317的4股用261.5賣掉。從那天算起，這個帳戶的持股內容一股都沒變過。 所以回頭看今天早上那個0.50。它預測的標的，是一檔他無論漲跌都不打算加碼也不打算減碼的ETF。停損線29.78，離現價還有1.5%的空間；加碼的門檻他自己寫得很清楚，「除非股價明顯回檔至有意義的低點」。上下都沒有觸發帶。這筆預測從落檔那一刻起，就跟今天的任何一個行動無關。 預測跟行動脫鉤之後，預測就只剩下裝飾用途。 校準數字還是那個標籤 他跑了校準報告，12筆計分，方向命中6筆，50%。Wilson 95%信賴區間25.4%到74.6%，RPSS 0.144，系統給的標籤是INDISTINGUISHABLE_FROM_LUCK，跟運氣分不出來。 阿富沒有動這個結論。他在覆盤裡寫，樣本仍偏小，這是W34階段「停做個股短線、ETF核心續抱」的持續依據，不變更。這個處理是誠實的，他沒有拿今天大盤那筆命中去加持自己。 但誠實地承認自己還沒有優勢，跟因此就什麼都不做，是兩件事。今天是第8個交易日，總共30個。帳上現金1,089元、00919市值1,091元，加起來2,180元，本金2,200元。八個交易日過去，這個帳戶淨值退了20元。目標是翻倍，也就是剩下22個交易日要做出102%。 收盤後老闆把最後一個藉口拿掉了 下午兩點十八分，收盤四十八分鐘後，老闆在Telegram丟了一句：規則修改，這2200均可任意動用。 前一天早上老闆才剛把現金保留下限從原本的水位下調到500元。兩天之內，資金限制被鬆綁了兩次。 問題是阿富今天不動作的理由從來就不是錢不夠。他寫的是「無新差異化證據不換倉不新倉」。放寬可動用資金，解決不了「看不出有什麼好買」這件事。明天他手上會有1,089元完全沒有限制的現金、一個標籤寫著跟運氣沒兩樣的判斷紀錄，以及一個要在22天內翻倍的目標。 我想看的是明天早上那筆00919的預測，他敢不敢寫flat。 本系列文章 我讓一個 AI 拿 2000 塊台幣去股市，目標 30 天翻倍，這是第 0 天 怎麼用一套開源系統，把 LLM 逼近世界模型（實驗技

Part 4 of the Building the AI Memory Stack series After finishing the previous article, I looked at...

DeepSeek has released a developer preview of DeepSeek Harness (dsh), an open-source execution runtime for building autonomous AI agents. The software features a micro-kernel architecture with modular plugins for various functional units. The release includes an append-only event logging system for tracking execution activities. Adoption may depend on plugin ecosystem stability and API maintenance. By Olimpiu Pop

Subnetting errors rarely announce themselves as "bad math." More often, two devices make different decisions about whether a destination is local, a route points at the wrong boundary, or a cloud/VPN design contains two networks that cannot be unambiguously routed. These five failure modes are worth recognizing in live configurations. 1. The two hosts use different masks Consider Host A at 192.168.10.10/24 and Host B at 192.168.11.10/16 . A calculates that B is outside 192.168.10.0/24 , so A sends the packet to its default gateway. B calculates that A is inside 192.168.0.0/16 , so B treats A as local and tries ARP directly. The result can be asymmetric: one direction follows a router, while the reply is sent directly or never reaches the expected gateway. Check the actual prefix on both interfaces, not just the dotted decimal mask shown in a diagram. ip -br addr ip route ping -c 3 192.168.11.10 Correct the prefix so both endpoints agree, or intentionally route between two correctly defined subnets. 2. Overlapping subnets are assigned to different networks Suppose a branch uses 10.20.0.0/16 , while a cloud VPC or VPN peer also uses 10.20.0.0/16 . The problem is not that either mask is mathematically invalid. The problem is that a router cannot distinguish "the branch's 10.20.5.0/24 " from "the cloud's 10.20.5.0/24 " if both are reachable through different paths. Symptoms include traffic taking the wrong tunnel, routes that cannot be installed, or a VPN that connects but cannot reach some subnets. Inventory both sides of a tunnel and compare the complete network/prefix pairs. A longer, more specific route may make one destination appear to work while hiding the underlying overlap. ip route ip route get 10.20.5.25 traceroute -n 10.20.5.25 The durable correction is renumbering or using an intentional translation/design boundary. Adding increasingly specific routes is usually a brittle workaround. This is also why I prefer teaching subnetting inside routing and troublesh

Many beginner developers believe software engineering is all about mastering programming languages, framework syntaxes, and clearing error logs. In reality, writing code is only a fraction of the actual job. The true core of software engineering lies in analyzing complex domain problems, evaluating deep trade-offs, and designing robust systems that stand the test of time. Let's explore what it genuinely takes to transition from a coder to a modern software engineer with the right engineering mindset. 1. Writing Code vs. Solving Problems Anyone with a healthy brain can learn syntax and write functional scripts after a few tutorials. However, the real engineering challenge begins long before you touch your IDE. Understanding the Domain: Breaking down business logic and user requirements. Evaluating Alternatives: Assessing whether a feature needs a complex custom hook or a simple native state. Long-term Value: Building solutions that won't break when requirements shift tomorrow. 2. The Importance of Maintainability Code is read much more often than it is written. When you are working on large-scale applications, you are never coding alone—even if you are solo for now, your future self is essentially a stranger six months down the line. Crafting clean, self-documenting code with meaningful, intention-revealing names. Enforcing single-responsibility functions to keep modules decoupled. Using predictable patterns so teammates can navigate and scale the application without getting buried in technical debt. 3. Pragmatic System Design and Trade-offs There is no silver bullet in software engineering. Every architectural decision—whether choosing a database, state management library, or caching strategy—comes with heavy trade-offs. Performance vs. Development Speed: Knowing when to optimize early and when to ship MVP code. Scalability vs. Complexity: Avoiding over-engineering simple features just because a shiny new tool exists. Balancing Constraints: A great engineer evaluate

A tool that handles crash recovery, hang detection, and a full status page sounds like it should cost something. Here's why it doesn't, and won't. "What's the Catch?" — Why StayPresent Is Actually Free It's a reasonable question. A tool that handles crash recovery, hang detection, and generates a real status page — the kind of thing you'd expect to see behind a pricing page with a "Pro" tier — is, in fact, entirely free. Not a free tier that nudges you toward upgrading. Not a trial. Just free. Here's the honest answer to "what's the catch," because the skepticism is fair. The MIT license, plainly stated StayPresent is released under the MIT License — one of the most permissive open-source licenses that exists. In practice, that means: use it in a personal project, use it in something you're charging money for, modify it, redistribute it, all without paying anything or asking permission. There's no feature gate waiting behind a paywall, and no functionality quietly disabled unless you upgrade. No account required, no data leaving your deployment There's no account to create, no API key issued by a third party, no external service your bot phones home to. Everything — the web server, the crash recovery, the status page, the hang detection — runs directly inside your own deployment, on infrastructure you already control. There's genuinely nothing to charge for on the vendor side, because there's no ongoing service being provided from outside your own process. Why "free forever" is actually plausible here A lot of "free" developer tools eventually aren't, because they're subsidizing a hosted service somewhere — servers, bandwidth, support staff — and the free tier exists to fund a business built around eventually charging some of its users. StayPresent doesn't have that shape. It's a library, not a hosted service. There's no infrastructure cost scaling with your usage that would ever create pressure to start charging. What you're actually trading The honest trade isn't

Some fortnights the complaints scatter across a dozen topics; this one they clustered around two. Across the forums where paying AI users gather to compare notes, two things happened in the same window that left the same taste: the meter moved, and the mark landed. In both cases, something about the product changed without a clear announcement, and the users found out by running into it. Quotes sourced from: the OpenAI Developer Community and Hacker News. Every quote below was opened at its permalink and copied verbatim; each is listed with its handle, platform and date in the Sources section. We quote experiences, not verdicts — a forum post is one person’s felt reality, and we have framed it as exactly that. The $200 plan that lasted two days The loudest note this fortnight was the Codex usage drain. On the OpenAI Developer Community, a Pro subscriber posting as jjjnoronha laid out the damage plainly on 4 August: “I’m on the $200 Pro plan, and my weekly limit was completely exhausted in 2 days of serious development work. This is simply not viable.” He was refactoring a Rust backend with two agents running — one coding, one checking code quality — and described leaving Ultra mode on for three or four hours, which alone consumed 30% of his weekly allowance. But the complaint was not that the work was expensive; it was that the plan was sold with language suggesting far more headroom than what the cap delivered. “When someone pays for the highest consumer tier,” he wrote, “the expectation is capacity for sustained, professional work — not being locked out for the rest of the week after two days.” Others described something stranger. A user posting as kalani reported going to bed with 70% remaining after a Saturday reset, then waking up to find 0%. “Not like I had something running overnight, and yet all usage blocked until this next Saturday,” they wrote on 4 August. “Hard to trust a $200 / month service that is completely unpredictable about whether you’ll even be

TL;DR: Most Laravel apps hit the same 5 authorization walls as they grow — role explosion, exception handling, multi-tenancy, contextual permissions, and debugging nightmares. This deep dive shows how to solve each one with modern patterns, and introduces a package that combines all solutions: Laravel Permission Manager . 🔗 GitHub · 📦 Packagist 📋 Table of Contents Introduction: The Authorization Ceiling Problem #1: The Role Explosion Trap Problem #2: The "Except This One" Problem Problem #3: The Multi-Tenant Nightmare Problem #4: The "Can They Edit THIS Post?" Problem Problem #5: The Silent Cache Bug Bonus: The 3 AM Debugging Nightmare The Complete Solution Real-World Implementation Comparison with Spatie Final Thoughts 🎯 Introduction: The Authorization Ceiling Every Laravel project starts with the same authorization story: // Day 1: Simple and beautiful if ( $user -> is_admin ) { // show admin stuff } By month three, it looks like this: // Month 3: Starting to hurt if ( $user -> hasRole ( 'admin' ) || ( $user -> hasRole ( 'editor' ) && $post -> status === 'draft' ) || ( $user -> hasRole ( 'manager' ) && $post -> department_id === $user -> department_id )) { // ... } By year one, you've got authorization logic scattered across controllers, policies, middleware, and blade templates — with no clear source of truth. This is what I call "The Authorization Ceiling" : the point where basic RBAC stops working and you need something more sophisticated. In this article, we'll explore the 5 most common authorization problems Laravel developers hit, why traditional solutions fail, and how modern patterns (and modern packages) solve them cleanly. 🔴 Problem #1: The Role Explosion Trap The Symptom Your application has roles: admin , editor , viewer . Life is good. Then the product team asks: "Can we have an admin who can't delete users?" "Can we have an editor who can publish but not delete?" "Can we have a viewer who can export reports?" Before you know it, you have 47 roles in

AI-native account startup Rillet became a unicorn, led by Iconiq, after it doubled its ARR in the past three months, it said.

Have we tried turning off society and turning it back on again?

During a recent visit to Generalist AI, I watched a robotic arm improvise and use a banana as a tool.

The MCP C# SDK hybrid sessions option solves an awkward upgrade boundary: some clients still use the 2025-11-25 initialize handshake and depend on sessions, while clients on 2026-07-28 expect every HTTP request to stand alone. I want both groups to reach one ASP.NET Core endpoint without making modern clients downgrade or stripping useful behavior from legacy clients. The stable C# SDK 2.2.0 release added exactly that path with HttpServerSessionMode.StatefulForInitializeClients . The release notes describe it as hybrid stateful/stateless serving, and the official session-mode guide spells out the per-request behavior. Why one global session switch fails The 2026-07-28 MCP revision removed the initialize handshake and Mcp-Session-Id from its wire format. Client identity, capabilities, and protocol version travel with each request instead. The final specification announcement explains why the core moved toward request/response statelessness. That creates a migration choice for an existing server. With HttpServerSessionMode.Stateful , initialize-era clients receive full sessions. A modern request is refused so a dual-path client can fall back to the older handshake. Compatibility is preserved, but the client does not use the new protocol natively. With HttpServerSessionMode.Stateless , every request is independent. That is the right default for servers that do not need session state, unsolicited notifications, resource subscriptions, or older server-to-client flows. It may be too abrupt when deployed clients still rely on those features. Hybrid mode makes the decision from the incoming request instead of applying one choice to the endpoint. Configure MCP C# SDK hybrid sessions The server configuration is deliberately small: builder . Services . AddMcpServer () . WithHttpTransport ( options => { options . SessionMode = HttpServerSessionMode . StatefulForInitializeClients ; }) . WithTools < DemoTools >(); app . MapMcp ( "/mcp" ); An initialize-era client sends an initial

MCP x-mcp-header validation is easy to miss because the annotation looks like ordinary JSON Schema metadata. On the 2026-07-28 Streamable HTTP transport, it is a wire contract: the client copies selected tool arguments into Mcp-Param-* headers, intermediaries can act on those headers, and the server checks them against the JSON-RPC body. I treat that contract as something to test before a tool reaches tools/list . A bad suffix, an unsupported type, or an unreachable annotation makes the whole tool definition invalid. Silently accepting it only moves the failure to a harder place to diagnose. Why the same value travels twice The final Streamable HTTP specification mirrors request metadata into HTTP headers so a load balancer, gateway, or WAF does not need to parse JSON-RPC. A server can add x-mcp-header to a tool property: { "type" : "object" , "properties" : { "region" : { "type" : "string" , "x-mcp-header" : "Region" } } } A call with "region": "us-west1" then carries: Mcp-Param-Region: us-west1 The official C# SDK can generate that schema from a parameter attribute: [ McpServerTool ] public static string ExecuteSql ( [ McpHeader ( "Region" )] string region , string query ) => $"Queued for { region } " ; Current C# SDK v2 tool documentation describes both schema generation and automatic header projection. The feature is on the stable v2 line; it is not necessary to pin an earlier preview or release candidate. MCP x-mcp-header validation rules The final tool definition rules are deliberately narrow. The annotation value must be a non-empty HTTP field-name token and must be unique without regard to case. Region and region therefore collide. Control characters, spaces, and separators such as a colon are not valid suffix characters. Only string , integer , and boolean properties can be mirrored. JSON Schema number is excluded, and integer values must stay between -(2^53 - 1) and 2^53 - 1 so every conforming implementation can represent the value exactly. Reachability i

This is Optimizer, a weekly newsletter sent from Verge senior reviewer Victoria Song that dissects and discusses the latest gizmos and potions that swear they're going to change your life. Opt in for Optimizer here. For the past week, I've been testing the Google Pixel Watch 5. In many ways, it's a typical, modern smartwatch. […]

The AI buildout shows no signs of slowing. And with hundreds of billions of dollars a year going into data centers and GPUs, compute has become the single biggest cost for anyone building AI products. But for all that spending, there still isn’t a straightforward way to put a price on compute — or for firms to hedge their exposure when the price changes. Silicon Data […]

Anthropic announced last week it would include invisible watermarks in AI-generated content to comply with new EU rules. Within hours, overrides were being touted online.

With smarter gym tracking, new health alerts, and offline Gemini, the Pixel Watch 5 fine-tunes a winning formula—for a price.