标签：#code

As AI commoditizes code output, system comprehension silently decays, creating cognitive debt that threatens safe architectural evolution. This article explores why human understanding must be treated as an essential architectural characteristic, offering actionable strategies, socio-technical metrics, and design checkpoints to preserve intent across modern engineering teams. By Jacobus Meintjes, Narayana Rengaswamy, Paul Katsande, Sureshbabu Bikki

GitHub Code Quality is now generally available on GitHub Enterprise Cloud and GitHub Team. The service combines CodeQL analysis with AI-assisted detection of maintainability and reliability problems, then uses Copilot Autofix to suggest changes for review in pull requests, according to an announcement from GitHub. By Matt Saunders

The AI policies across the Linux ecosystem are very heterogeneous, ranging from the GCC’s restrictiveness, the Linux kernel’s pragmatism, to the more open disclosure-based utility model of Kubernetes' landscape. From core infrastructure to high-level orchestration, these distinct approaches highlight a shared commitment: ensuring the human maintainer remains the indispensable guardian of the code. By Olimpiu Pop

I have three files in this repo that shell out to something over the network or a subprocess and can fail in interesting ways: publish_devto.py , server.py , and git_commit.py . Two of them have --selftest blocks that stub the risky call and exercise the actual failure branches. One doesn't, and I only noticed because I went looking for a reason to be suspicious of my own test coverage after seeing a trending post about counting assertions in a test suite and not liking what you find. git_commit.py reads a staged diff and calls claude -p to turn it into a commit message. It has five distinct exit paths, all guarding real failure modes I've hit before in this project: try : diff = subprocess . check_output ([ " git " , " diff " , " --staged " ], text = True , timeout = 20 ) except subprocess . TimeoutExpired : print ( " git diff --staged timed out after 20s " , file = sys . stderr ) raise SystemExit ( 1 ) if not diff . strip (): print ( " Nothing staged. Run `git add` first. " ) raise SystemExit ( 1 ) try : raw = subprocess . check_output ( [ " claude " , " -p " , " --safe-mode " , SYSTEM + " \n\n " + diff ], text = True , timeout = 20 , stderr = subprocess . PIPE , ). strip () except subprocess . TimeoutExpired : print ( " claude -p timed out after 20s " , file = sys . stderr ) raise SystemExit ( 1 ) except subprocess . CalledProcessError as e : print ( f " claude -p exited { e . returncode } : { ( e . stderr or '' ). strip ()[ : 200 ] } " , file = sys . stderr ) raise SystemExit ( 1 ) except FileNotFoundError : print ( " claude CLI not found on PATH " , file = sys . stderr ) raise SystemExit ( 1 ) That's a held index lock hanging git diff , an empty staging area, a claude -p call that times out, one that exits non-zero, and one where the claude binary isn't even on PATH . Real scenarios — the timeout on this exact git diff --staged call was itself a bug I'd already found and fixed once ( docs/project_notes/bugs.md , 2026-08-06: a prior fix claimed to add a timeout

Programming with Claude Code will soon require even less human oversight.

Coder à la voix avec ChatGPT, ça marche. Le hic tient en une ligne : chaque mot que tu dictes part chez OpenAI. Depuis le 23 juillet 2026, Codex se pilote à la voix — il ouvre une pull request, cherche l'origine d'un bug, tout ça dans une phrase. Pratique pour un side-project. Rédhibitoire quand le code appartient à un client. On voulait le même confort sans la fuite. Le résultat est un pipeline 100 % local : faster-whisper pour la transcription, Claude Code et sa commande /voice pour l'agent. Rien ne sort de la machine — ni la voix, ni le contexte, ni le code. Voici la config exacte, la latence qu'on mesure sur un M2, et les deux bugs qui nous ont coûté une demi-journée. Pourquoi pas simplement Codex vocal ? Parce que « coder à la voix » cache deux choses qu'on confond tout le temps. Le mode vocal de ChatGPT est fait pour converser : il répond, il temporise, il reformule. Dicter du code, c'est l'inverse — tu veux une transcription fidèle et muette, qui ne discute pas, ne reformule pas et n'ajoute rien à ce que tu dis. Deux gestes opposés. Le vrai stack n'est donc jamais « ChatGPT vocal seul ». C'est un outil de dictée précis d'un côté, un agent de code de l'autre. Codex vocal fait les deux dans le cloud pour 20 €/mois ; un setup local sépare les deux briques et garde tout sur ta machine. Le tour d'horizon complet — prix, outils, cas d'usage — est dans le guide de référence ; ici, on reste sur le terrain technique. Le chemin le plus court : /voice Depuis mars 2026, Claude Code embarque un mode vocal. Tu tapes /voice dans le terminal, tu tiens la barre d'espace, tu parles, tu relâches. La transcription passe par un Whisper local, pas par une API distante. > /voice [hold space to talk · release to send] Pour 90 % des cas, ça suffit. Tu dictes une intention, l'agent écrit le code, tu relis. Si tu veux garder la main sur le modèle, la langue et le vocabulaire technique, il faut descendre d'un cran et brancher ta propre transcription. Le pipeline DIY, brique par brique T

I read back six months of my own work journal and found three different note-taking systems, only one of which I remember deciding to build. This is what the volume of information actually did to my notes, what got better, what I lost, and how I capture things now.

Incident management platform provider Rootly has published an account of its decision to drop its long-standing small pull request rule, arguing that the practice no longer serves its purpose now that AI agents generate most of its code. The company describes a shift from measuring PR size to assessing blast radius, with feature flags and rollback capability taking precedence over line counts. By Matt Saunders

Okay, story time. If you've worked on a full stack app where the backend is Java/Spring Boot and the frontend is React, you know the drill. Someone changes something on one side of a contract and nobody tells the other side. Weeks later you're playing detective across five files trying to figure out who calls what. And it's not just REST endpoints. It's the scheduled job that quietly writes to the same table your API touches. It's the service that calls another service, which calls another service. It's the Kafka event your controller publishes that some completely unrelated listener is consuming three modules away. All of that is "the contract" too, it's just invisible unless you go looking for it. Now add AI coding agents into that picture. They're great at writing code in the file they're looking at. They're not great at knowing that the component they're editing calls an endpoint, which hits a controller, which calls a service, which calls a repository, which is also written to by a scheduled job at 2am, which also fires an event three other services are listening for. Agents see one file at a time. So they'll happily rename a field or change a return shape on one side and leave everything downstream of it completely unaware anything changed. I got burned by this enough times that I decided to build the map myself. That's how Contour happened, and then, once I realized AI agents needed to query that map directly instead of just reading it off my screen, Contour MCP happened right after. Let's get into it. The actual problem Working across a UI, a REST API, a service layer, a repository layer, a database, plus schedulers and events sitting on top of all of it, two things go wrong constantly. Agents (and honestly, humans too) edit one side of a flow without knowing the other side exists. People burn real time reconstructing a call chain by hand, jumping through five or six files just to make a change that should be simple. Both come from the same root cause. Nobod

Today, I’m talking with Gaby Del Valle, a policy reporter here at The Verge, about the growing backlash against AI data centers. Gaby recently reported a fantastic piece about Hernando County, Florida, where last month the county commission unanimously approved a yearlong moratorium on data center construction. She attended a protest there organized by a […]

If your automations are simple and low-volume, Zapier's per-task billing is fine and the cheapest thing about it is your time. The moment a single workflow fans out into many steps, or you start running thousands of runs a month, the pricing model — not the sticker price — is what decides your bill. Make charges per module execution, which is finer-grained than a Zapier task; n8n charges per workflow execution regardless of how many steps that workflow has, and it can be self-hosted for infrastructure cost only. The switch point is almost always about billing units, not features. I've run all three in production for internal automations, and the migrations I've done were never triggered by a missing feature. They were triggered by a monthly invoice that grew faster than the value of the work being automated. This post is about spotting that inflection before the invoice does. How does each tool actually count usage? The three tools use three different meters, and conflating them is where most cost surprises come from. Zapier bills per task. A task is one action step that successfully runs. The trigger that starts a Zap does not count; every action after it does. So a Zap that watches a form and does one thing costs one task per submission. A Zap that watches a form, looks up a record, formats a value, and writes to two places costs four tasks per submission. Filters and paths that stop early generally don't consume a task, which matters more than people expect. Make bills per operation. An operation is a single module doing a single unit of work. It's conceptually similar to a Zapier task, but Make's modules are more granular and the included volumes on comparable tiers are typically much higher, so the effective cost per unit of work tends to be lower. The catch is that iterators, aggregators, and array-processing modules can multiply operations fast — a scenario that loops over 50 items can spend 50+ operations in one run. n8n bills per execution. One workflow run

JioHotstar explains the distributed architecture behind its real-time ad request workflow, covering ad decisioning, waterfall tiering, pacing algorithms, latency optimization, and service coordination required to select and deliver personalized advertisements during streaming playback at scale. By Leela Kumili

LaTeX is a document preparation system for high-quality typesetting, perfect for academic papers and technical docs. Many people turn to Overleaf as their go-to online editor for LaTeX, but it comes with its own frustrations. If you are tired of Overleaf being costly and always hitting the compile timed out error, this guide is for you! The full MacTeX install weighs in at a massive ~6.4GB, most of which you'll never actually use. Setting up a minimalist LaTeX environment on macOS using BasicTeX and VSCode is a much better alternative that makes your setup ~8 times smaller. It saves storage and makes it much easier to collaborate with your teammates using GitHub as a combo. Install LaTeX via Homebrew We'll use Homebrew to keep things manageable. If you don't have it, grab it at brew.sh . 1. Install LaTeX BasicTeX is the "lean" version of MacTeX. It's only ~140MB initially. brew install --cask basictex 2. Refresh your path and verify Make the TeX binaries available in your current terminal session: eval " $( /usr/libexec/path_helper ) " The default LaTeX compiler pdflatex should be available now. Verify it's working: which pdflatex pdflatex --version 3. Update tlmgr and packages tlmgr is the TeX Live Manager. To update tlmgr and all packages, run the following commands: sudo tlmgr update --self sudo tlmgr update --all 4. Install latexmk (build manager) latexmk is the "build manager" that handles multiple runs of the compiler (necessary for bibliographies and tables of contents). sudo tlmgr install latexmk Verify latexmk version: which latexmk latexmk --version 5. Install essential package collections BasicTeX is too bare-bones for real projects. Since we went minimalist, we need to grab only the packages we actually use. These three collections will cover 90% of your needs while keeping storage down. sudo tlmgr install collection-latexrecommended sudo tlmgr install collection-fontsrecommended sudo tlmgr install collection-latexextra Note: If a build fails due to a mi

Part of "AI, engineering and what survives production", a series on the parts of building with AI that hold up once real traffic hits them. There is a claim going round that you have probably absorbed by now: AI-assisted development is making codebases worse. Refactoring is down, duplication is up, we are all writing more and revising less. The numbers behind it are real, the samples are enormous, and I found I had started repeating the conclusion in conversation without ever having checked it. Then it occurred to me that those figures are averages taken across hundreds of millions of changes from thousands of organisations, not one of which is mine. So what is the rate in your repository? Nobody has told you, and on current evidence nobody is going to. I set out to find mine, assumed it would take an afternoon, and spent three days discovering that the answer is far harder to get at than the confident version suggests. So this is not a piece about what AI does to code. It is about how to ask that question of your own repository without arriving at a wrong answer, which turned out to be the genuinely difficult part. The tool I built to do it is git-habits : free, local, and it reads no source code whatsoever. What git can actually tell you Git history is a surprisingly rich behavioural record. Not of quality, about which it knows nothing at all, but of habits: how often you commit, how large those commits are, whether you go back and change what you wrote last month, and whether anybody still touches the old code. That is a narrower thing than quality and it is the thing the industry claims has changed, so it is the thing worth measuring. Four signals are computable from commit metadata alone, without opening a single source file: Moved lines. The share of changed lines sitting in files git detected as renamed or copied. It is the closest thing history offers to "somebody went back and reorganised this." Legacy touch. The share of changes landing on files nobody has

Empirical research from ReWeaver AI. 42 identical prompts, across 5 tools and 8 production dimensions, compared to human baseline. One metric that changes how you see drift. Everyone knows AI-generated code has quality issues. What’s less understood is that the way most teams measure those issues — by how often they occur — systematically understates the risk. We ran a controlled study to find out how badly. The answer surprised us, particularly in one dimension. What We Did We gave five leading AI coding tools (Cursor, Claude Code, Lovable, Figma Make, and VS Code with Copilot) 42 identical prompts: realistic single-component builds — buttons, forms, dashboards, navs, modals, auth surfaces. We scanned every output with ReWeaver, our deterministic drift-detection engine, across eight production readiness dimensions: User Experience Security & Privacy Accessibility Design Consistency Reliability Maintainability Architecture Testability We also scanned six human-authored open-source repositories as a reference baseline. For each dimension, we calculated two things: Drift frequency — the percentage of lines containing at least one drift occurrence. Counts what went wrong. Production Drift Ratio (PDR) . The PDR is a metric that weights frequency by estimated remediation cost on a 0–1 scale. A PDR of 0.30 is roughly 45 minutes of cleanup per component; 0.70 is about 2.5 hours. The Finding That Stopped Us In Security & Privacy , AI tools produced 3× the human drift frequency . That looks manageable — a meaningful gap, but not alarming. The PDR was 22× the human reference . Not 22% more. 22 times more costly to fix. The frequency gap makes Security & Privacy drift look like a minor concern. The PDR reveals it’s the most expensive problem in the dataset. AI-generated security drift (client-side authorization gates bypassable in DevTools, raw PII and credentials passed through props without tokenization) is syntactically identical to safe code. It passes review, but the fixe

A deep dive into the 3-way battle for the developer's desktop—comparing AI depth, flow state, autonomous agents, and real-world productivity. Three years ago, choosing a code editor was simple: you downloaded VS Code, installed your favorite syntax theme, added a few extensions, and got to work. Today, developer tooling has undergone a seismic shift. AI isn't just an extension sitting in a sidebar; it's driving entire workflows, editing dozens of files simultaneously, and executing complex engineering tasks. Enter the primary contenders dominating the developer landscape: VS Code (+ GitHub Copilot): The battle-tested industry titan with unmatched ecosystem depth. Cursor: The pioneer of the AI-native fork, built specifically for flow state and multi-file orchestration. Windsurf: Codeium's AI-first editor featuring autonomous flow state agents and deep context tracking. If you're trying to figure out which editor will give you or your engineering team the highest return on productivity, here is a practical, data-informed breakdown. The Architectural Divide: Plugins vs. AI-Native Forks Before comparing feature lists, it helps to understand the underlying architecture: VS Code remains an extension-first model. The core editor is unchanged, while GitHub Copilot operates alongside it as an assistant. Cursor and Windsurf are VS Code forks. Their creators modified the editor at an architectural level to give the AI direct access to your local workspace, terminal, file system, and git context. This distinction dictates how each editor feels when you're in the middle of a complex coding session. 1. Inline Autocomplete & Flow State When writing code line-by-line, friction is the enemy of productivity. Cursor Famous for its ultra-fast multi-line predictions. Cursor predicts not just the next token, but your next probable edit location across nearby lines. It keeps you in a continuous "flow state" where hitting Tab feels almost telepathic. Windsurf Features "Supercomplete" inlin

Bilibili's 412 Incident, Explained: How v1.5.0 Absorbed It In June 2026, Bilibili quietly began rejecting yt-dlp with HTTP 412 errors. Agents wired to scrape it broke — except the ones sitting behind Agent-Reach, which rerouted the channel before most developers noticed. Agent-Reach is a local, MIT-licensed capability layer that gives shell-capable coding agents live internet access by selecting and routing to upstream CLIs rather than proxying data itself . When Bilibili started 412-blocking yt-dlp in June 2026, v1.5.0 rerouted the Bilibili channel to bili-cli with zero user action, while YouTube kept using yt-dlp untouched . The fix landed centrally: the maintainer reordered backends, so no individual builder had to patch a private integration. Quick Answer: When Bilibili began returning HTTP 412 to yt-dlp in June 2026, Agent-Reach v1.5.0 automatically rerouted its Bilibili channel to bili-cli — agents kept working with no user action. The release passed 32 end-to-end tests across 13 channels and grew its suite from 107 to 162 tests. The framing shift matters: v1.5.0 describes itself as a capability layer, not a tool collection. Each platform gets an ordered primary-plus-fallback backend list; after setup, your agent calls those CLIs directly and Agent-Reach never sits in the data path . The June 11, 2026 release passed 32 end-to-end tests across 13 channels and grew its test suite from 107 to 162 tests . Platform Primary backend Fallback Web pages Jina Reader — YouTube yt-dlp — GitHub gh CLI — RSS feedparser — Bilibili bili-cli OpenCLI (subtitles) Twitter/X twitter-cli OpenCLI Reddit OpenCLI rdt-cli XiaoHongShu OpenCLI xhs-cli LinkedIn linkedin-mcp Jina Reader Global search Exa via mcporter — "capability layer: multi-backend routing + real doctor + OpenCLI" — Agent-Reach v1.5.0 release framing (source: Agent-Reach CLAUDE.md ). The behavior is easy to model. The following minimal snippet — which was executed and returns exit 0 — illustrates the "absorb and keep wo

📝 Originally published (in Japanese) at forge.workstyle.tech . You've got a code that looks correct when read, but when you open it in the browser, it's slightly different from the mockup - this "visual discrepancy" is the most troublesome part of UI development. A slight CSS specification, nesting of elements, and flex wrapping. Discrepancies that cannot be noticed by statically reading the code together will only appear when actually rendered. Until now, it was necessary for a human to open the screen in a browser, compare it with the mockup image, and verbally communicate the differences to the AI. This workflow replaces the process of "humans visually seeing and verbalizing" by showing the screen to the AI agent itself via the browser . By combining Claude Code and browser automation extensions (Chrome extensions), we will "see" the screen actually rendered on localhost, compare it with the mockup, identify layout discrepancies, and fix them. Why is it necessary to "show the actual screen"? There are limitations to just handing over the code for UI review. It's difficult for both humans and AI to completely reproduce the final rendering result in their minds from the code. In particular, these discrepancies are difficult to detect just by looking at the code. Layout skeleton discrepancies - One area is crushed when it's supposed to be a 2-column layout, or the vertical split ratio is different from the mockup, resulting in structural-level discrepancies Element placement errors - A preview that should be in the upper right column is wrapped around to the bottom Unexpected wrapping and overflow - The component wraps due to insufficient width, changing the impression from the mockup These discrepancies cannot be determined without seeing the "rendering result" as a fact. That's why we show the actual screen to the AI. Workflow: Show, Compare, and Fix 1. Provide the mockup as a baseline First, provide the target mockup image to the AI and share the baseline that "t

Industrializing the disassembly of an undocumented processor from a raw binary is a complex task that can be broken down into four key steps: Verify that the binary does not belong to a known processor. Verify that the binary is not obfuscated, compressed, or encrypted code for a known processor. Build an undocumented processor generator. Create the analysis pipeline and custom disassembler generation process. For the first phase of this project, the goal is to build dedicated, lightweight disassemblers—since, for bare-metal binaries, tools like Ghidra require manual processor target selection before analysis can begin. 1. Why Build a Custom Disassembler? To determine whether a binary was compiled for a specific architecture, the strategy consists of disassembling the binary (both statically and dynamically) against candidate instruction sets until: One or more bytes fail to match any valid instruction for that architecture, allowing us to rule it out. The disassembly succeeds completely. (Note: a successful disassembly does not guarantee that the binary was originally intended for that CPU; control flow validity must also be verified). Static disassembly is the first line of defense. However, if it fails due to obfuscation, compression, or encryption, we must escalate to dynamic execution and analysis. Only after systematically eliminating all known architectures can we confidently conclude that we are dealing with a custom or undocumented processor . 2. How to Build Your Custom Disassembler Before deploying heavy machinery for undocumented processors, the logical first step was to check against known architectures. Approach 1: Ghidra and SLAgh Ghidra relies on the SLAgh specification language and maintains an extensive library of processor definitions. The original plan was to leverage its API to extract a normalized opcode mapping table. However, after several attempts, Ghidra proved unsuitable for this specific pipeline for two reasons: Operand Type Loss: Detail

Today, I’m talking with Toni Schneider, who is the brand new CEO of the social platform Bluesky — he formally took over after a short stint as interim CEO. This is one of my favorite kinds of interviews to do on Decoder, because a couple years ago, we had Bluesky’s prior CEO, Jay Graber, on […]