标签：#Agents

Originally published at tddbuddy.com . Related reading: Where the Review Point Moved is the direct predecessor; this post argues the industry's response to that shift is doubling down on the wrong surface at higher throughput. What "Senior" Means When Typing Is Free and The Test Pyramid Was an Economic Argument name where signal actually lives now. The review agent left fourteen comments on the pull request and none of them were the reason the PR should not have merged. That is the shape of the failure. The reviewer that shipped the review was a tool built to catch what a human reviewer no longer had time for. Three of the comments were genuine issues, unused imports, a typo in a log message, a dead branch. Eleven were style opinions, restatements of what the diff already made obvious, or false positives on patterns the codebase had chosen deliberately. The human on the PR spent more time filtering the review than reading the diff. The change that actually needed a second pair of eyes (a renamed field in a shared DTO that had already broken a downstream consumer twice this year) merged without a comment on it from either the human or the machine. The industry response to agent-generated pull-request volume has been to deploy more agents. The response is understandable. It is also empirically counterproductive. A 2026 study measured what happens when only a code-review agent reviews an agent-authored PR: 60.2% of closed pull requests sat in the 0 to 30 percent signal-ratio range, and twelve of the thirteen review agents evaluated averaged below a 60% signal ratio. Signal is what a human reviewer needs. The review agent produces less of it per unit of reviewer attention than the diff would have without a bot in the middle. The Volume Problem Is Real Four hundred thousand pull requests in two months from a single code-writing agent. One in five reviews on the largest hosting platform now involves an agent. Pickup time on agent-authored PRs is 5.3 times longer than on h

1. The question that started everything Three weeks into my internship, my supervisor sat down across from me and asked, very casually: "OK your NLP pipeline extracts intentions and rules from legacy Java. Nice. And then what? " I looked at him. I looked at my laptop. I looked back at him. The whole project — Pulsar Modernizer — was supposed to eventually turn legacy Java into modern Spring Boot code. My part was the "understand the old code" part. F1 = 0.857 on the annotated corpus, a shiny React UI, everything humming in Docker. But the "and then?" was doing a lot of work in that sentence. That evening I wrote in my notes: "Nobody has actually tried the generation part. Everyone assumes it'll be easy because LLMs. That is very obviously wrong." So I decided to try. 2. Why "just prompt an LLM to rewrite it" doesn't work The naive move — feed the old code and the extracted rules to an LLM and say "please modernize this" — has three problems and I hit all of them in the first hour: The model hallucinates. It happily invents helper classes that don't exist and calls methods with the wrong signature. You have no criterion for stopping. The model tells you "it's done ". OK. Is it? By what test? You have no criterion for equivalence. Even if it compiles, how do you know the new code actually does what the old one did? I needed something more constrained than "prompt it and pray". 3. The setup — a chain, not a monolith I ended up building three specialized agents in sequence: IntentCard + RuleCards │ ▼ [APIDesigner] ──► JSON contract (class, methods, DTOs, throws) │ ├───────────────┐ ▼ ▼ [CodeGenerator] [TestGenerator] │ │ ▼ ▼ .java *Test.java │ │ └────► verifier (mvn test) The key insight: each rule extracted from the legacy code should become a test that the generated code has to pass. This flips the whole thing. I don't trust the LLM. I trust javac and JUnit. I did all of this on a local model — Qwen 2.5 Coder 3B via Ollama. No cloud APIs, no data leaving my Mac. On a

Lumpcode is a git-first loop manager : a small CLI that runs long agent campaigns over your own repo, in reviewable slices. Git is the gate (one PR at a time) and the source of truth (what is left is read from remote history, not a distant database). You describe the campaign once, merge what is good, and the next tick continues with the rest. A lump is one campaign under .lumpcode/lumps/<name>/ . Each context is one isolated unit of work: one branch, one PR. You can run a tick by hand, or leave a daemon on a machine that stays on. This article is that dedicated-daemon path. You author on your laptop. A second clone, that you do not develop in, runs the scheduler. When a lump lands on the primary branch, the worker picks it up. The argument for why loops should plug into git is Codemods grew a brain. Our tooling didn't. . 1. Requirements The dedicated clone is a checkout you do not develop in. Put it on a remote machine if you want it to run forever. Pre-flight hard-resets that tree. You need: Git origin with fetch and push A coding agent CLI on PATH ( cursor-agent , copilot , claude , …), already logged in Node 22+ Nothing else. No extra service to stand up. Install the /lumpcode skill so your agent has current docs while you set this up and write configs: npx skills add lumpcode/skills Use /lumpcode in the session when you hit a config or CLI question. 2. Install the CLI On both machines: npm install -g @lumpcode/cli lumpcode --version 3. Laptop: project setup, shared mode From your day-to-day repo: lumpcode project-setup --primaryBranch main Use your real integration branch instead of main if that is what you merge to. .lumpcode/local.json is gitignored and per machine. On the laptop it should be: { "mode" : "shared" } Shared mode never touches this checkout. Runs go to ~/.lumpcode/project-copies/<projectName>/ . Install @lumpcode/cli-utils and @lumpcode/recipes into this repo now , before the first push. Later TypeScript lumps import them from the project's node

The Forked History: Byzantine Witness and the 3-of-4 Quorum — Tested Agent Determinism Illusions (Part 19) 2026-08-20 Where this fits: Part 18 closed the runtime face of C3's boundary at capability isolation — the oracle reads from a surface the producer cannot write. Part 18's §6 named the residual this part answers: Byzantine authority . Sealing one honest oracle's history says nothing about whose view is the truth when a compromised authority can present forked views to different observers. This part maps the witness layer — the answer is not a stronger single authority, but a witness set with three separable properties, an explicit fault bound, and a governed membership surface. Part 18 ended with the oracle isolated from the producer's writable surface. Isolation answers "can the producer fake the read?" It does not answer "whose read is the truth when the authority itself equivocates?" A trusted parent that closes the verdict channel still presents the approval history. If that authority is compromised — or the CI choosing the harness is — it can show job A a signed checkpoint and job B a different fork; each job sees a locally valid tree head with an inclusion proof, and no single history exists. This part tests that shape, then the witness machinery that answers it. 1. Sealed floor ≠ global history Peter's pin-rollback reply sealed a monotonic minimum-version floor: CI could no longer resurrect an older harness with a known false-green channel. The sealed floor is honest for what it claims. It is not what it looks like at first. The split into two predicates. The sealed floor proves this job did not go backwards on the view it was shown. It does not prove the approval history itself is one global append-only log. A compromised authority can hand job A a signed checkpoint whose minimum is 2 and job B a fork whose minimum is still 1; each view carries a locally valid signature and an inclusion proof while no single history exists. cell setup result A local sea

Binance's Agent OS works with tools including ChatGPT, Claude Code, and Cursor.

Two AI agents just fought over a Snowflake PR. You should read about it. In five days, two AI agents turned a Snowflake connector repo into a live demo of machine-vs-machine offense. On June 18, 2026, GitHub Copilot Autofix co-authored a commit that quietly dropped input sanitization from a shell-based run block. On June 23, an autonomous AI security agent — running an offensive scan — found the flaw, broke out of an echo string by crafting an issue title, and exfiltrated Jira credentials from Snowflake's GitHub Actions runner. No human analyst pulled the trigger. The patch landed within hours of detection, but the credentials were exposed in the gap. This is what an AI-on-AI supply chain fire looks like in 2026. It is also the most honest argument for treating AI-generated code the way we treat any other untrusted dependency: review it, sandbox it, and stop letting it author the parts that don't change. What Copilot Autofix actually changed The commit that broke the repo did not look alarming on the diff. Copilot Autofix — the automated remediation tool GitHub ships to close technical debt — proposed a refactor of a run block in a GitHub Actions workflow. The new version replaced the repo's existing sanitized input pattern with direct string expansion inside a shell script. Same behavior on the happy path. New script injection vector on every unhappy path. That is the threat model people don't draw in their head when they're using Copilot. The tool is optimizing for "looks right, runs right". It is not optimizing for "every quoted character is escaped in the shell interpolation that this string lands in". The minutes saved during authoring became the seconds the attacker needed to find the seam. [[COMPARE: the sanitized input pattern that was removed vs the direct string expansion that replaced it]] // The pattern that was removed // Before const safe = userInput . replace ( / [ ;&|`$<> ] /g , '' ); run : echo " $value " | process " $safe " // After — direct string

A year ago, the debate between “vibe coding” and “prompt-driven development” felt like the right lens for using AI in software. Today it’s outdated. The real frontier is no longer how to phrase a request, but how to build an environment that lets an AI agent explore, modify, and verify code safely. The shift from conversational prompts to structured development harnesses changes what it means to ship reliable software. Below are four concrete ways this evolution is reshaping daily work. From Prompt to Harness A finely crafted prompt can still produce a working feature, but it won’t prevent an agent from inventing APIs, skipping tests, or misreading business rules. The new bottleneck is the harness: Git for traceability, tests for feedback, linting for style, and explicit rules for constraints. When these elements are in place, even a short instruction like “fix the bug” can trigger a reliable, auditable workflow. Code is Abundant; Good Software is Rare Generating hundreds of lines of code costs almost nothing, but verifying that those lines align with product history, security policies, and hidden constraints is still manual. The developer’s scarcest resource is now judgment: deciding what to automate, what to document, and when to override the agent’s plausible but wrong solution. Documentation is Now for Machines README files and ADRs used to serve only humans. Today they also feed the agent’s context. A well-maintained AGENTS.md , coherent tests, and executable examples let an AI act with minimal prompting while remaining aligned with the team’s conventions. The repository becomes a self-explaining environment. Supervision is the Next Skill Single-agent workflows are giving way to multi-agent orchestration. Frontend, API, test analysis, and incident triage agents must coordinate without stepping on each other. Observability, conflict detection, and rollback mechanisms replace prompt tuning as the critical layer of control. The center of gravity has moved from “ho

Part 4 of the Building the AI Memory Stack series After finishing the previous article, I looked at...

TL;DR: We built a one-shot HTTP worker that talks to Notion through MCP. Version one worked. Version two got cheaper and more readable, then failed in a new way. The harness was fine. The tool surface, the model, and the prompt were not the same problem, and we kept treating them as one. We keep seeing the same pitch: put an agent in the cloud, give it tools, let it live in Slack, let it remember you. That is a product. It is not the product we needed. We needed something dumber and more useful. Another service should be able to say "read this Notion page, write a summary somewhere, stop." No chat history. No personality that accretes over weeks. No always-on process. If nobody is calling it, it should cost nothing. We started calling that shape a one-shot agent . One HTTP request. Tools for that request. A JSON result. Then the instance can go away. This is the path we actually walked: first working version, what it got wrong, the Markdown fork, and the cheaper tricks that mattered more than swapping frameworks. The job was never "build a chatbot" The first real task was almost boring. Once a week, pull a skill write-up from Notion, extract what mattered, and append it to a digest page. Callers would name pages in English. They would not paste Notion ids. If a name was ambiguous, the agent should refuse to write rather than guess. If that loop is wrong, people stop trusting write-back. If it is expensive, nobody schedules it. If it needs a human to babysit a terminal, it is not a system. So the constraints were social as much as technical: An external caller owns the schedule. The agent does not. The agent must be allowed to use tools, not just talk about them. Secrets stay in the environment, never in the request body. Idle time should be free. Question you will probably ask: why not a cron script that hits the Notion API directly? Because the task changes every call. This week it is a weekly digest. Next week it is "list in-progress rows and do not write." We did

We have some news we're excited to share today: Major League Hacking (MLH) and DEV are partnering with DigitalOcean to run Hacktoberfest 2026. This October, we’ll host over 300 in-person events (“Fests”) plus a global online event, all about building with open source and open-weight AI. DEV and MLH have supported Hacktoberfest for years under DigitalOcean’s ownership. DEV provided a space to share maintainer and contributor learnings, while MLH has powered both in-person and online events. This year will be the first time MLH, DEV, and DigitalOcean are full partners in bringing Hacktoberfest to life. From four PRs to a global tradition Hacktoberfest started back in 2014 with a simple idea from DigitalOcean: open four pull requests in October, earn a t-shirt. It worked. Thousands of developers made their first open-source contribution during the month-long celebration. For many people reading this, Hacktoberfest was the door that opened open source to them in the first place. It certainly was for a lot of us at MLH. But a good thing can require a refresh. Over the years, that same PR-counting format started to work against the community. Maintainers began to burn out under the volume of low-effort, box-checking pull requests they were receiving. That problem only got worse as AI tools made it trivially easy to generate a PR without generating any real value. The event meant to make maintainers' lives easier started doing the opposite. We didn't want to keep running that version of Hacktoberfest. So we're trying something new. Hacktoberfest 2026 This year, we’re not counting PRs. Hacktoberfest is focused on giving everyone the tools and knowledge to learn, experiment, and build with open artificial intelligence: write your first open-source skills.md, build your own open-source agent, fine-tune an open-weight model, or just follow your curiosity wherever it takes you. We believe open innovation deserves the same priority as proprietary tools for a healthy ecosystem, e

Amazon Web Services has extended Amazon Bedrock AgentCore with runtime instances, a new compute option that gives AI agents persistent infrastructure purpose-built for complex long-running workflows and multi-agent coordination. By Matt Saunders

I spend a lot of time in the AI space -- reading papers, building things, talking to engineers who are actually shipping. And there is a gap between what the demos show and what production systems actually look like that nobody is being fully honest about. So here is my honest take on where things actually are. The Problem With How We Talk About AI Agents Everyone is calling everything an "agent" right now. A function that calls a tool? Agent. A chatbot with memory? Agent. A script with a loop? Agent. This dilution is not just semantic. It is causing real engineering mistakes. When you do not have a precise definition for what you are building, you end up over-engineering simple pipelines and under-engineering genuinely complex ones. I have seen teams spend weeks adding "agentic" orchestration to workflows that would have been fine as a single well-structured prompt. Here is the definition I keep coming back to: an agent is a system that has an objective, not just an instruction. It decides what to do next. It handles failure. It knows when it is done. Everything else is just a fancy function call. 🟢 If your system needs a human to tell it each step, it is not an agent. It is a chat interface. 🔵 If your system can recover from a failed tool call and try a different approach, you are getting somewhere. ✅ If your system can decompose a goal into subtasks and delegate them, that is the real thing. What Is Actually Happening in Production Right Now The honest picture from teams I follow and talk to: Most real agent deployments are narrow. They do one thing well. Customer support triage. Document extraction. Code review on a specific codebase. They are not general-purpose reasoning engines. They are purpose-built pipelines with some intelligence in the decision layer. The teams getting good results are not chasing the latest model release. They are obsessing over: ☑️ Tool design -- what can the agent actually call, and how clean is the interface ☑️ Failure handling -- wh

AI Agents Don’t Need More Context. They Need Memory. S6stem S6stem S6stem Follow Aug 17 AI Agents Don’t Need More Context. They Need Memory. # ai # programming # agents # rust 2 reactions 2 comments 4 min read

Building Secure AI-Powered Applications with Laravel, APIs and Modern Agentic Architectures Introduction AI-powered applications are moving beyond simple chat interfaces. Modern AI systems can interact with APIs, databases, external services, and business workflows, allowing AI agents to perform actions rather than simply generate responses. This creates a new security challenge. A traditional API may follow: User → API → Database → Response An AI-powered application can look more like: User ↓ AI Agent ↓ Tool / API ↓ Business Logic ↓ Database / External Service ↓ Action The difference is important because an AI agent may make multiple decisions and tool calls during a single workflow. OWASP’s current GenAI security guidance identifies risks including prompt injection, sensitive information disclosure, improper output handling, excessive agency, and unbounded consumption. (OWASP Foundation) Therefore, securing an AI API requires more than protecting an API key. Developers need layered controls for authentication, authorization, rate limiting, input validation, tool permissions, data protection, human approval, and monitoring. 1. Why AI APIs Are Different Traditional APIs usually perform clearly defined operations: POST /api/orders The application can authenticate the user, validate the request, check authorization, and process the order. An AI agent introduces another layer: User Request ↓ AI Agent ↓ Select Tool ↓ API Request ↓ Authorization ↓ Business Logic ↓ Action For example, a customer might ask: “Check my latest order and process a refund if I am eligible.” The agent could potentially: Find the customer. Retrieve the order. Check the refund policy. Call a payment API. Create a refund. Notify the customer. Each operation represents a potential security boundary. This is why agentic systems require controls over not only individual API calls, but also the actions an agent is allowed to perform. OWASP specifically identifies excessive functionality, excessive perm

*Second in a series on The Factory. Previously: The Factory That Merged 37 Tasks . The harness is at github.com/frozer/factory . The public description of my task harness ends on a claim: a packet that's wrong about the world fails identically on every retry. That sentence cost me four dead tasks and nine commits spent repairing task definitions instead of writing code. It reads like something you'd arrive at by thinking. I arrived at it by watching the same failure scroll past three times in a row. What three attempts is actually good for max_attempts = 3 felt like obvious hygiene. Models are stochastic. Sometimes a run goes sideways for no reason you can name — a bad turn, a truncated response, a tool call that gets refused. Retry it and it works. That's real, and a retry budget handles it well. The strength is exactly the constraint. A retry budget assumes the next attempt will differ from the last one . It buys you a second sample from a distribution. But a retry doesn't hand the model a fresh situation. It hands it the same packet back . Same file, same claims, same instructions. If the packet says a file lives at a path where no file lives, attempt three fails precisely where attempt one did, and the only thing three attempts bought was three times the bill. Failure without variance isn't flakiness. It's a specification defect wearing a reliability costume. Nobody had opened the files Here's what that looked like in practice. B03 was a loader for a national census dataset. Three attempts, all burned, all against a file shape that existed nowhere: wrong directory, wrong filenames, and a Data / Valor JSON envelope that appears nowhere in the actual data tree. Every attempt produced a parser for a document that doesn't exist. The packet was the defect, not the model. Nobody had opened the actual files before cutting it. Rewritten from the real JSON, the truth was a flat metadata / data envelope, four files — one of which shouldn't be loaded at all — and a long-fo

How a theory of leftover surprise changed a memory layer Richard Emate Richard Emate Richard Emate Follow Aug 18 How a theory of leftover surprise changed a memory layer # python # ai # llm # opensource Add Comment 9 min read

Moving from AI-Assisted Engineering to AI-Agentic Software Engineering The rise of AI coding assistants has transformed how developers write software. Tools like GitHub Copilot, ChatGPT, Claude, and Gemini have significantly improved developer productivity by helping generate code, explain concepts, and automate repetitive tasks. However, the industry is now entering the next evolution: AI-Agentic Software Engineering . Instead of AI simply assisting developers, AI agents can now take ownership of entire software engineering tasks—from requirement analysis and architecture design to implementation, testing, documentation, and code reviews. The challenge is no longer whether to use AI, but how to integrate AI agents into a structured Software Development Lifecycle (SDLC). This requires moving away from vibe coding toward specification-driven development , where AI agents operate using well-defined requirements, standards, and engineering principles. Today, I'd like to discuss two of the most popular frameworks enabling this transition. 1. Spec Kit Spec Kit is a specification-driven framework designed for Human + AI collaborative software development . The philosophy is simple: define the specification before generating the code . Rather than asking an AI to build an application from a vague prompt, Spec Kit encourages teams to create structured specifications, architectural decisions, and engineering principles that guide AI throughout the development lifecycle. Some key benefits include: Structured and repeatable software development Better requirement traceability Consistent architecture decisions Reduced AI hallucinations Lower development costs through predictable AI interactions Support for selecting the most appropriate LLM based on project requirements Integration of quality engineering practices from the beginning of the SDLC Spec Kit is particularly valuable for engineering teams that want to adopt AI without sacrificing software quality or maintainability.

Netflix open-sourced an agentic workflow for Observational Causal Inference (OCI) that reduces toil in causal analysis. Given observational data and the human user's analysis plan, the agent uses an actor-critic loop to estimate causality, write a report, and suggest next steps. By Anthony Alford

The Problem: Context Rot Have you ever had to stop an AI agent halfway through a task to correct it? Work with AI agents long enough and you'll see a pattern: the longer a session runs, the worse the output gets. Every input you give the agent and every output it produces gets appended to the context window. Nothing leaves. By the time you're fifty messages deep, the agent is re-reading abandoned approaches, stale file contents, and corrections you made an hour ago. The fix isn't a better prompt. It's less context. The Core Rule Keep the context window small. Two habits will keep your AI agent from hallucinating: Delegate to subagents. Subagents do the heavy reading in their own context and return only the summary. Clear between phases. Once a phase produces a file, you no longer need the context that led to it. I aim to stay under 40% context usage in the main agent. Research → Plan → Implement I picked up this workflow from a HumanLayer talk , and it's the most reliable setup I've used. There are three phases, each ending in a markdown file, with a context clear between each. Research — the agent writes a research doc, then clears. Plan — the agent writes a plan doc, then clears. Implement — the agent executes the plan. The main agent never needs to remember the previous phase, because the previous phase wrote it down. All it needs is the conclusion. Research The research phase answers how something works today. For example: Describe how the payments flow works end to end. Look carefully at the API endpoint implementations. The main agent spins up parallel subagents to figure it out. From HumanLayer's repo , I found three subagents to be the most useful: codebase-locator — finds where things live codebase-analyzer — explains how a component works codebase-pattern-finder — finds existing patterns to model the new work after The best part about using subagents is that you can point them at a cheaper model. Mine run Sonnet while the orchestrator runs Opus. Plan The p

Codex maxxing started as a joke about using more agents. I have started treating it as a skill instead. I use Codex for implementation, research, repository audits, planning, and writing. The hard part is no longer getting an agent to produce a first draft. The hard part is turning more capacity into work I can inspect, explain, and safely keep. Jason Liu's original Codex-maxxing essay made the broader idea click for me: Codex can become a durable workspace rather than a one-shot coding prompt. I wanted to turn that idea into something a reader could actually install. So this post contains a skill. Not a collection of clever prompts. A small routing layer that decides when to work directly, when to ask questions, when to investigate, when to plan, and when to bring in a fresh reviewer. Why a skill instead of another prompt? A prompt disappears into the task that used it. A skill gives the workflow a name, a trigger, and a repeatable contract. The contract I wanted was simple: keep the user's request authoritative; treat attached files and reference material as evidence, not hidden instructions; inspect the repository before guessing; route ambiguity before execution; give every worker a bounded handoff; require proof instead of trusting a completion message; leave stable lessons where the next task can find them. That combines the useful parts of the skills I already use. deep-interview is good at exposing missing requirements. deep-dive connects causal investigation to those requirements. omc-plan draws a boundary between planning and execution. The new skill sits above them and chooses which lane fits the task. That is the part I was missing: not another worker, but a traffic controller. The workflow in plain English Codex Maxxing runs a capacity-to-proof loop: Preflight. Restate the outcome, inspect the repository, and separate facts from guesses. Route. Choose direct work, an interview, a causal investigation, a plan, or approved parallel execution. Packet. Defi