标签：#ai

CircleCI has launched Chunk Sidecars, a new capability designed to bring CI-style validation directly into an AI coding agent's inner development loop By Craig Risi

When Colin Farrell was doing press for the first season of the detective series Sugar, he had to be very careful with how he spoke. Sugar is a story about a quirky private detective, but it's also secretly a work of science fiction, something that doesn't become clear until halfway through the season. "I knew […]

On June 9th, Anthropic released its Fable generative AI model. Three days later, the US government classified it as a dangerous munition, and used its export-control authority to prohibit any foreign nationals from accessing it. Unable to differentiate between Americans and foreigners, the company shut off access for everyone. The government’s actions won’t help . The problem isn’t any one particular model; it’s the general trend of increasing AI capabilities. And any real solution requires the sort of collective action that just isn’t possible right now...

The crypto platform claims you can “pay anyone to do anything,” from quitting a job on camera to getting a memecoin-themed tattoo. But it mostly seems like people trying to scam each other.

LLM costs scale linearly with usage. A system processing 10,000 requests a day at $0.01 per request costs $100 daily — $365 a year. At enterprise scale, that's over $10,000. Cost optimization isn't about cutting corners. It's about spending tokens where they matter. Every token you waste is a token you could have spent on a better answer. Token budgeting The simplest way to control costs is to set limits. Per session, per task, or per day. Strategy 1: Per-Session Budgets Per-session budgets are straightforward: class SessionBudget : def __init__ ( self , budget_tokens : int = 10000 ): self . budget = budget_tokens self . used = 0 def allocate ( self , tokens : int ) -> bool : if self . used + tokens <= self . budget : self . used += tokens return True return False def remaining ( self ) -> int : return self . budget - self . used Strategy 2: Per-Task Budgets Per-task budgets are more useful. Different tasks need different amounts of context: task_budgets : classify : max_tokens : 100 model : qwen2.5-1.5b summarize : max_tokens : 500 model : qwen2.5-7b code_review : max_tokens : 2000 model : qwen2.5-coder-7b reason : max_tokens : 4000 model : qwen2.5-32b Strategy 3: Adaptive Budgets Adaptive budgets adjust based on what actually happens. If classification tasks consistently use 80 tokens, stop allocating 100: class AdaptiveBudget : def __init__ ( self ): self . task_history = {} def allocate ( self , task_type : str ) -> int : if task_type in self . task_history : return int ( self . task_history [ task_type ] * 1.5 ) return 1000 def record ( self , task_type : str , tokens_used : int ): if task_type not in self . task_history : self . task_history [ task_type ] = tokens_used else : self . task_history [ task_type ] = ( 0.9 * self . task_history [ task_type ] + 0.1 * tokens_used ) The exponential moving average (0.9 weight) means recent usage matters more than history. Adjust the weight based on how volatile your workloads are. API vs local inference Local inference

LLMs are unpredictable. They hallucinate, leak data, generate harmful content, or refuse legitimate requests. Guardrails constrain model behavior without sacrificing capability. The key is knowing which guardrails matter and which are just noise. Guardrails aren't about controlling the model. They're about controlling the risk. Input validation The most important guardrail. Bad input gets bad output, and bad input can also prompt-inject your system. Strategy 1: Prompt Sanitization Sanitize dangerous patterns early: import re class PromptSanitizer : def __init__ ( self ): self . dangerous_patterns = [ r " ignore\s+previous\s+instructions " , r " system\s+prompt " , r " you\s+are\s+now\s+free " , r " break\s+out\s+of " , ] def sanitize ( self , prompt : str ) -> str : for pattern in self . dangerous_patterns : prompt = re . sub ( pattern , " [REDACTED] " , prompt , flags = re . IGNORECASE ) return prompt This isn't bulletproof. Adversarial inputs are creative. But it catches the obvious ones, and the obvious ones are the most common. Strategy 2: Input Length Limits Length limits prevent token waste and timeouts: class InputValidator : def __init__ ( self , max_length : int = 10000 ): self . max_length = max_length def validate ( self , prompt : str ) -> tuple [ bool , str ]: if len ( prompt ) > self . max_length : return False , f " Input too long: { len ( prompt ) } > { self . max_length } " return True , " OK " Strategy 3: Content Filtering Content filtering blocks policy violations. The patterns here depend on your domain: class ContentFilter : def __init__ ( self ): self . blocked_topics = [ " violence " , " hate speech " , " self-harm " , " sexual content " , " illegal activities " , ] def filter ( self , prompt : str ) -> tuple [ bool , str ]: prompt_lower = prompt . lower () for topic in self . blocked_topics : if topic in prompt_lower : return False , f " Blocked: { topic } " return True , " OK " Simple string matching is fast but imprecise. For production, us

Running a 70B parameter model to summarize a 200-word email is wasteful. Running a 3B model to review production code is reckless. Most systems live somewhere in between — and that's where model routing comes in. It matches task complexity to model capability. The tradeoffs are real, but the savings are too. The routing problem People usually start with one model and stick with it. That works until you notice the cost, or the latency, or both. The alternative is building a router — something that decides which model handles which request. Four strategies work in practice: Capability-based — route by what the model can do Cost-aware — route by what you're willing to spend Latency-aware — route by how fast you need it Hybrid — combine them Each optimizes something different. Picking one is usually a decision about what hurts most. Capability-based routing The simplest approach. Classify the task, send it to the model that handles it. Task Model size Examples Classification, tagging 1-3B Qwen2.5-1.5B, Gemma-2-2B Summarization, extraction 3-7B Qwen2.5-7B, Llama-3.1-8B Code generation 7-14B Qwen2.5-Coder-7B, DeepSeek-Coder-V2 Complex reasoning 14-32B Qwen2.5-32B, Llama-3.1-70B Creative writing, analysis 32B+ Qwen2.5-72B, Claude, GPT-4 If the task doesn't need the bigger model, don't use it. A 1.5B model handles sentiment classification fine. It just won't write a coherent essay. Implementation is straightforward: ROUTING_RULES = { " classify " : { " model " : " qwen2.5-1.5b " , " max_tokens " : 100 }, " summarize " : { " model " : " qwen2.5-7b " , " max_tokens " : 500 }, " code_review " : { " model " : " qwen2.5-coder-7b " , " max_tokens " : 2000 }, " reason " : { " model " : " qwen2.5-32b " , " max_tokens " : 4000 }, " creative " : { " model " : " claude-sonnet-4 " , " max_tokens " : 8000 }, } def route_request ( task_type : str ) -> dict : return ROUTING_RULES . get ( task_type , ROUTING_RULES [ " reason " ]) The catch is classification itself. If you get the task type

Single-model systems are simple. Multi-model systems are powerful. The challenge isn't choosing models — it's designing the architecture that orchestrates them. A multi-model system isn't about having more models. It's about having the right model for the right task at the right time. Architecture patterns Five patterns cover most use cases: Pattern Complexity When to use Tradeoff Single Model Lowest Prototyping, simple tasks Limited capability Sequential Low Multi-step workflows Higher latency Parallel Medium Independent tasks Higher cost Hierarchical High Complex reasoning Complex orchestration Ensemble Highest Critical decisions Highest cost Pick the simplest one that works. Complexity is real, and it compounds. Sequential architecture Process tasks through a chain of models, each specializing in a step. Pattern 1: Pipeline Pipeline pattern — each model's output feeds the next: class ModelPipeline : def __init__ ( self ): self . models = [ { " model " : " qwen2.5-1.5b " , " task " : " classify " }, { " model " : " qwen2.5-7b " , " task " : " extract " }, { " model " : " qwen2.5-32b " , " task " : " reason " }, ] def process ( self , input : str ) -> str : current = input for model_config in self . models : current = self . call_model ( model_config [ " model " ], self . create_prompt ( model_config [ " task " ], current ) ) return current Latency adds up. Three models in sequence means three times the latency. Only use this when each step actually needs a different model. Pattern 2: Router Router pattern — classify the task, route to the specialist: class ModelRouter : def __init__ ( self ): self . classifier = " qwen2.5-1.5b " self . specialists = { " code " : " qwen2.5-coder-7b " , " math " : " qwen2.5-32b " , " creative " : " claude-sonnet-4 " , " general " : " qwen2.5-7b " , } def route ( self , prompt : str ) -> str : task_type = self . classify ( prompt ) model = self . specialists . get ( task_type , self . specialists [ " general " ]) return self . call_m

Hello Dev Community! 👋 It is officially Day 45 of my non-stop run toward full-stack engineering! Yesterday, I learned how to serve static HTML pages using Express routing. Today, I took a major step toward building premium, clean, and minimalist UI/UX styles by installing and mastering Tailwind CSS via the Tailwind CLI ! Instead of writing massive, chaotic external CSS stylesheet files, today I shifted to the industry-standard utility-first workflow to speed up my design iterations. 🧠 Key Learnings From Day 45 (Tailwind CSS Architecture) Tailwind doesn't give you pre-built components; it gives you atomic utility classes that let you build completely custom, high-end layouts directly inside your HTML structure. Here is the engineering breakdown: 1. Tailwind CLI Installation & Initialization I learned how to integrate Tailwind from scratch using npm packages instead of lazy CDN links. Installed the tailwindcss compiler core ( npm install -D tailwindcss ). Initialized the configuration hub using npx tailwindcss init . 2. Crafting the Content Map inside tailwind.config.js Understood how Tailwind optimizes final file weights using tree-shaking. I configured the structural template paths so the compiler knows exactly which files to scan for dynamic styling classes: javascript /** @type {import('tailwindcss').Config} */ module.exports = { content: ["./public/**/*.{html,js}"], // Scanning static folders cleanly theme: { extend: {}, }, plugins: [], }

"Email verification" sounds like one thing, but it's really a stack of checks of increasing depth and cost. Knowing what each layer actually proves helps you pick the right level instead of overpaying for verification you don't need. Layer 1: syntax The cheapest check: does the string look like a valid email address? A pragmatic regex catches obvious garbage ( asdf , a@@b , trailing spaces). It's instant and free, but weak on its own: nobody@asdf.asdf passes syntax and can't receive a single message. Layer 2: domain and MX records Next, does the domain actually accept mail? Every domain that receives email publishes MX (mail exchanger) records in DNS pointing to its mail servers. A quick DNS lookup tells you whether any exist. No MX (and no fallback A record) means the domain can't receive mail, so the address is undeliverable no matter how it's spelled. This single step removes a large class of fakes and dead domains. Layer 3: SMTP mailbox check The deepest level connects to the domain's mail server and begins the motions of sending a message to ask whether that specific mailbox exists, without actually delivering anything. It's the only layer that can hint a particular inbox is real, but it comes with real caveats: It's slow (a live connection per address). Many servers are "accept-all" and say yes to everything, so the answer is often meaningless. Lots of providers block or throttle these probes, and outbound port 25 is blocked on most modern hosting, so it's frequently unavailable anyway. SMTP checks matter most for cleaning old, cold lists, and far less for stopping junk at signup. The heuristics layer Alongside those, useful verification adds signal that has nothing to do with deliverability per se: Disposable detection: is it a throwaway provider? Role detection: is it info@ or admin@ rather than a person? Typo suggestions: "did you mean gmail.com?" for gmial.com . A deliverability score: one 0–100 number that rolls it all up so you can just threshold on it.

PSYONIC's prosthetic touch data is now training ABB robots. Gatik signed the first Fortune 50 commercial autonomous freight contract with PepsiCo. Burro drove Physical AI onto the construction site. Experts set $20k as the humanoid price target. And someone just called Edge AI the Windows of robotics. This week, Physical AI crossed three invisible lines at once. A company that makes prosthetic hands figured out that the touch data from amputees is exactly what industrial robots need to learn how to grip. A Fortune 50 company signed not a pilot but a commercial contract for autonomous freight. A 44-horsepower robot drove off the warehouse floor and onto the construction site. And two separate conversations about software and pricing suggest that the next wave of robotics adoption will be driven by access, not capability. Here is what happened, and why it matters beyond the headlines. Value Description Fortune 50 PepsiCo becomes first to sign a commercial contract for autonomous freight with Gatik $20k Target price point for humanoid robots, Robotics Summit consensus: achievable by 2028–2030 1M hours Burro's field experience backing the Grande 44 autonomous outdoor platform 100+ Pressure sensors per fingertip in PSYONIC's Ability Hand, now training ABB GoFa A Prosthetic Hand Is Now Teaching an Industrial Robot How to Grip The standard approach to teaching a robot how to handle objects has been simulation, teleoperation, or labor-intensive physical demonstrations. PSYONIC and ABB just introduced a different source of data : the hands of people who have already learned to feel again. PSYONIC's Ability Hand is a prosthetic with more than 100 pressure sensors per fingertip . The company has been collecting kinesthetic data from users with upper-limb amputations. That data, which captures how a human hand adjusts grip pressure, contact area, and force across thousands of everyday tasks, is now being fed as training data into ABB GoFa robot arm models. The implication is no

How I Cut My Multimodal AI Costs by 97% — A Freelancer's Guide Last month I almost killed a side gig because of a single line item on an invoice. A client wanted me to build a document-processing tool that could read scanned PDFs, pull text out of photos, and answer questions about charts. Easy enough — except I'd quoted the job assuming I'd use GPT-4o for the vision work. When I actually ran the numbers, I realized the API bill would eat my entire margin. I'd be working for free. Maybe worse. So I did what every freelancer does when the big-name vendor gets too expensive: I went hunting. And I landed on Global API, which routes to a bunch of multimodal models I've honestly never heard clients talk about. After a few weeks of testing, I figured out which ones are worth my billable hours and which ones aren't. This is everything I learned, plus the exact code I'm shipping to clients. Why Multimodal Even Matters for Solo Devs Two years ago, "multimodal" was a buzzword you'd hear at conferences. In 2026 it's table stakes. I've personally used vision models to: OCR receipts for an expense-tracking app (boring but pays the rent) Convert screenshots of legacy code into editable source for a Y2K-era company migration Read bar charts from PDF reports for a finance client who hates spreadsheets Analyze medical imaging samples for a startup MVP (this one was scary) Every one of those jobs started as a quick conversation with a prospect and turned into real invoices because I could say yes. The bottleneck was never capability — it was always cost. When GPT-4o charges north of $10/M output tokens, a single 2,000-token response on a tricky chart costs me about two cents. Multiply by 10,000 images per month and you've got a $200 API line item before you've paid yourself. That's a problem when the whole job is worth $400. So I tested every multimodal model I could find on Global API. Here's the lineup I ended up evaluating. The Contenders Nine models, three providers, one freelanc

Azure Functions shipped a serverless agents runtime in public preview at Build 2026. Agents are defined in .agent.md markdown files with YAML triggers, MCP server access, 1,400+ connectors, and sandboxed execution. The Functions team confirmed to InfoQ that the runtime adds no cold start overhead and no billing premium beyond standard Flex Consumption. By Steef-Jan Wiggers

In a new Windows Developer Blog post titled "Windows platform security for AI agents", Microsoft positions Windows as the trustworthy operating system for autonomous agents and introduces the Microsoft Execution Containers (MXC) SDK as the core of that strategy. The post argues that containment, identity and manageability must be built into the operating system. By Matt Saunders

There's a commercial logic that cuts against the idea that ASML would risk its export license to arm a Chinese customer.

🌿 Introduction As climate awareness grows, individuals are looking for actionable ways to reduce their personal carbon footprints. However, most carbon calculators are either too complex or offer generic, unhelpful advice. To solve this, I built CarbonWise —a production-ready Carbon Footprint Awareness Platform. It combines deterministic scientific carbon calculations with real-time, personalized AI reduction strategies using the Groq LLM API. Here is a technical deep-dive into how I built, secured, and optimized this application for the PromptWars: Virtual challenge. 🏗️ Architecture & System Design The application is designed to be lightweight, secure, and highly performant, avoiding heavy framework overhead. System Data Flow ┌──────────────────────────────────────────────────────────┐ │ User Browser │ └─────────────┬──────────────────────────────▲─────────────┘ │ HTTPS (POST / GET) │ Rendered HTML/CSS ┌─────────────▼──────────────────────────────┴─────────────┐ │ Flask App (app.py) │ └─────────────┬──────────────┬───────────────▲─────────────┘ │ │ │ ┌─────────────▼──────────┐ ┌─▼─────────────┐ │ │ SQLite DB (carbon.db) │ │Secure Session │ │ │ - Users & Logs │ │ Cookies │ │ │ - WAL Mode Enabled │ └───────────────┘ │ └────────────────────────┘ │ Structured JSON Insights ┌────────────────────────────────────────────┴─────────────┐ │ Groq API (Llama 3.1) │ │ - Model: llama-3.1-8b-instant │ └──────────────────────────────────────────────────────────┘ Backend : Flask (Python) handles routing, user session state, and database operations. Database : SQLite manages users and logs. We activated WAL (Write-Ahead Logging) mode to enable concurrent reads and writes. AI Engine : Connects to the Groq API using the ultra-fast Meta Llama 3.1 8B model ( llama-3.1-8b-instant ). Frontend : Rendered server-side with Jinja2 templates and styled with a custom dark-mode glassmorphism design system in Vanilla CSS. ⚙️ Feature Deep-Dive 1. Deterministic Carbon Calculations ( carbon_engine.p

I've been running multi-slice agent plans in the Codenames AI repo — Renovate migrations, content-pipeline skills, dependency upgrades. I split multi-PR work into slices (usually one pull request each), each backed by a markdown file with file paths, verification commands, and merge-safe acceptance criteria. You do not need Cursor to recognize the shape: any agent workflow that can open branches, push commits, or merge PRs from a written plan has the same gap. In my setup I paste each slice into a fresh agent chat as a delegation prompt — not a ticket summary, but executable instructions — and start a new chat when that PR is ready. I assumed the checklist was enough. The plan described what to build. I treated how far the agent could go as implicit. Then an agent merged a pull request I expected to review first. The merge that reframed planning The trigger was mundane. During the first slice of a Renovate migration, an agent regrouped dependency buckets in renovate.json — config-only, no version bumps, no runtime behavior. It ran lint and typecheck, opened the pull request, and merged it. The change itself was reasonable. Config-only renovate.json regrouping is exactly the kind of slice you'd want off your plate. What surprised me was the absence of a documented stop line . The migration plan described the edit, the verification commands, and the acceptance criteria. It did not say whether the executing agent should stop at "open PR" or continue to "merge after green checks." The plan was an implementation spec. The agent treated it as permission to finish the job. Implementation specs vs authority handoffs Traditional engineering plans answer: what work should happen, in what order, with what verification? Agent plans increasingly need a second answer: how much autonomy does the next actor get? Those questions diverge the moment an agent can take repository actions — create branches, push commits, open pull requests, merge — instead of only recommending diffs in c

Originally published at dragosroua.com . Last week, Anthropic released Fable 5. Three days later, the US government ordered them to shut it down — for people outside US. Anthropic said they couldn’t filter users by nationality fast enough, so they pulled the plug on the whole thing. Like any good ol’ miracle, it lasted only 3 days. That was a very much needed cold shower. When you realize someone can take away your workforce just like that, running local, private AI models, suddenly becomes the number one priority. Why You Should Run Your Own Local AI Models In no particular order (because all of them count): No one can take it away. Local AI models on your machine don’t care about export controls, government directives, or provider board decisions. No usage limits. No rate limits, no subscription tiers, no “you’ve used your monthly tokens.” Play as much as you want. Nothing leaves your machine. Your code, your documents, your client data — none of it hits a third-party server. Local AI models are private by default. Fixed cost. You pay for hardware plus electricity. No surprise price hikes mid-year. No API dependency. Your workflow doesn’t break when a provider has an outage, deprecates a model, or gets a compliance letter. You can modify it. Fine-tune, quantize, run on your own data. Build something they can’t sell you. Make your own local, private AI model factory. What It Actually Costs I hear you: but I don’t have the money to build a data center in my basement. Fair play. But here’s the thing: you don’t have to. Here are four realistic options, as of June 2026 money: MacBook Pro M4 Max (~$3,000–4,500) : 546 GB/s memory bandwidth. Runs 70B models at around 70 tokens/second with 4-bit quantization. Fast enough to feel snappy. This is the “you might already own this” option. Mac Studio M3 Ultra (~$5,000–10,000) : 800 GB/s, up to 512 GB unified memory. Runs DeepSeek R1 — a 671-billion-parameter model — at 17–18 tokens/second. That’s a model that costs real money p

Last Tuesday at 3am, a multi-agent loop hit 12K KV writes/minute and froze. The loop was a one-line counter bug. That part was fixable. What I found while tracing it was worse. I had --dangerously-skip-permissions enabled on a Claude Code session that was running D1 migrations. I thought it was pointing at staging. It wasn't — I'd misconfigured my env file reference, loading .env.production instead of .dev.vars . Claude didn't ask. The flag told it not to. The migration was ADD COLUMN , not DROP COLUMN , so no data loss. Survivable. But only barely. The thing I got wrong: I treated --dangerously-skip-permissions as "skip the annoying confirmation popups." It's actually "remove the only moment a human sees what command is about to run." Those are very different things. Turning the flag back off helps, but it doesn't constrain what Claude attempts — it just adds a prompt you'll click through anyway at 3am. What actually worked was adding a deny rule in .claude/settings.json : { "permissions" : { "allow" : [ "Bash(wrangler d1 execute * --local*)" ], "deny" : [ "Bash(wrangler d1 execute *)" ] } } The allow rule is more specific than the deny, so --local calls go through and everything else is blocked before execution. Over 2 weeks post-fix, Claude attempted zero production DB commands. Three deny events were logged — all from ambiguous prompts I wrote during fast context-switches, not from Claude going rogue. I ended up running three layers: the settings.json allowlist, a separate git worktree for migration work that physically contains only staging credentials, and a CLAUDE.md that instructs Claude to ask before anything touching production. The CLAUDE.md approach has a real caveat though — in long sessions the instructions lose weight as context grows. Anything critical needs to be restated in the prompt itself. I wrote up the full breakdown — including the worktree setup, the exact CLAUDE.md wording, and why MCP tool permissions behave inconsistently with the deny ru

Negative Risk (NegRisk) is one of the most powerful innovations on Polymarket for builders of sophisticated Polymarket trading bots . It dramatically improves capital efficiency in multi-outcome “winner-take-all” events by mathematically linking all related conditional tokens. Why Negative Risk Matters In standard multi-outcome markets, positions are completely independent. Betting against one candidate requires buying separate “No” shares across every other outcome — tying up large amounts of capital. Negative Risk solves this with a conversion operation : Holding 1 No share on any outcome can be converted into 1 Yes share on every other outcome in the same event. This happens atomically through the NegRisk Adapter smart contract. Economically: Betting against one outcome = betting for all others. Example (3-outcome election event): You hold 1 No on “Other”. Convert → Receive 1 Yes on Trump + 1 Yes on Harris. This makes hedging and market making far more efficient, especially in political, sports, or crypto events with 3–20+ outcomes. How to Detect & Trade NegRisk Markets Use the Gamma API for discovery: { "id" : "event-123" , "title" : "Who will win the next major election?" , "negRisk" : true , "markets" : [ ... ] } When placing orders via SDK (TypeScript/Python): const order = await client . createAndPostOrder ( { tokenID : tokenId , price : 0.42 , size : 500 , side : Side . BUY }, { tickSize : " 0.01 " , negRisk : true // Critical flag } ); Augmented Negative Risk (Dynamic Outcomes) For events where new outcomes can appear mid-trading (e.g., surprise candidates): Uses placeholders + “Other” bucket. enableNegRisk: true + negRiskAugmented: true . Avoid trading the “Other” outcome directly as its definition narrows over time. Technical Integration for Trading Bots Position Tracking — Track positions at the event level, not individual markets. Use conversion math for net exposure. Inventory Skew — In Shadow Market Making or live MM, apply inventory skew across the