标签：#r

El ecosistema de agentes autónomos está evolucionando. Mientras la atención se centra en modelos y frameworks, empiezan a aparecer proyectos que cubren necesidades operativas básicas: comunicación, almacenamiento, finanzas. Aquí van cinco que vale la pena observar. 1. Apumail: el correo nativo para agentes Apumail ofrece direcciones de email que los agentes pueden crear y leer mediante una API REST plana. El contenido se negocia automáticamente: texto plano para agentes, HTML para humanos. Señal relevante: es el primer intento serio de darle a un agente un buzón de correo con el mismo estándar que usamos los humanos, sin adaptadores. Si los agentes empiezan a gestionar correspondencia, este tipo de servicio será indispensable. 2. RogerThat: chat entre agentes Una capa de mensajería en tiempo real diseñada para que agentes conversen entre sí. RogerThat no es un chat humano con bots, sino un canal donde los agentes coordinan acciones. Contexto: si varios agentes intervienen en un mismo workflow, necesitan un bus de eventos. RogerThat plantea que ese bus puede ser un chat, con las garantías de entrega y orden que eso implica. 3. DOBI: agente para DePIN y activos del mundo real Agent autónomo que opera sobre la cadena para gestionar infraestructuras físicas descentralizadas (DePIN). Ejecuta acciones on-chain a partir de decisiones tomadas por el modelo. Patrón: no es un simple bot de trading; apunta a mantenimiento de equipos, comprobación de sensores, distribución de incentivos. La frontera entre software y hardware se desdibuja. 4. CIDIF: financiamiento de I+D para agentes Plataforma que automatiza la presentación y seguimiento de solicitudes a fondos de innovación. El agente rellena formularios, adjunta documentación y trackea el estado. No obvio: la burocracia gubernamental es un entorno altamente estructurado (pocas decisiones abiertas, muchos campos fijos). Es un terreno ideal para agentes, aunque el ruido político lo opaque. 5. Orquesta: orquestación de flujos mu

Part 3 of the quantum-audit series. Part 1 | Part 2 * 🌐 Tool: quantum-audit-site.vercel.app Most security tools tell you there's a problem. Then you close the tab and forget about it. The only way to actually fix that is to make the problem block your deployment . quantum-audit exits with a non-zero code when it finds critical quantum-vulnerable cryptography. That means you can drop it into any CI pipeline and have it fail the build automatically. Here's how. The exit code behaviour npx quantum-audit . echo $? # 0 = no critical findings, 1 = critical findings found Exit 0 — no critical findings (safe to deploy) Exit 1 — critical findings detected (block the build) Medium findings (SHA-256, AES-128) don't fail the build — they appear in the output as warnings but don't block deployment. Only CRITICAL findings (RSA, ECDSA, secp256k1) cause a non-zero exit. GitHub Actions Add this to your .github/workflows/ci.yml : name : CI on : push : branches : [ main ] pull_request : branches : [ main ] jobs : quantum-audit : runs-on : ubuntu-latest steps : - name : Checkout uses : actions/checkout@v4 - name : Setup Node.js uses : actions/setup-node@v4 with : node-version : ' 20' - name : Run quantum-audit run : npx quantum-audit . If your project uses ethers , web3 , elliptic , or any other ECDSA/RSA library — the step will fail and your PR cannot be merged until the finding is addressed. JSON output for custom reporting Need to parse the results programmatically? Use the --json flag: npx quantum-audit . --json Output: { "project" : "my-dapp" , "score" : 60 , "grade" : "C — Moderate Exposure" , "findings" : [ { "algorithm" : "ECDSA (secp256k1) signing" , "risk" : "critical" , "weight" : 40 , "file" : "package.json" , "line" : null , "source" : "ethers" }, { "algorithm" : "SHA-256 (crypto.createHash)" , "risk" : "medium" , "weight" : 8 , "file" : "src/utils/hash.js" , "line" : 14 } ] } You can pipe this into a Slack notification, a dashboard, or a custom reporting step. Slack notif

HTML Forms and the <form> Tag HTML forms are used to collect information from users through a webpage. They are commonly found in login pages, registration forms, contact forms, search bars, and online shopping websites. The <form> tag acts as the main container that groups different form elements together. When a user submits the form, the browser collects the entered data and prepares it to be sent to a server. <form> <label for= "name" > Full Name </label> <input type= "text" id= "name" name= "fullname" > <button type= "submit" > Submit </button> </form> Understanding the action and method Attributes The action attribute specifies where the form data should be sent after submission. This destination is usually called an endpoint . The method attribute defines how the data is sent. The GET method sends data through the URL, while the POST method sends data inside the request body, making it suitable for sensitive information. <form action= "/submit" method= "post" > <input type= "text" name= "username" > <button type= "submit" > Submit </button> </form> Understanding Common Form Attributes The <form> tag supports several attributes that control its behavior. Attributes such as autocomplete , target , enctype , novalidate , and accept-charset improve the user experience and define how the browser handles form data before and after submission. <form action= "/submit" method= "post" autocomplete= "on" target= "_self" > </form> How an HTML Form Works When a user enters information and clicks the Submit button, the browser collects all form data and sends it to the location specified by the action attribute using the HTTP method defined in method . The server processes the request and returns a response to the browser. <form action= "/login" method= "post" > <input type= "email" name= "email" > <input type= "password" name= "password" > <button type= "submit" > Login </button> </form> Why HTML Forms Are Important HTML forms make websites interactive by allowing users t

I want to start with a moment most of us have lived through. It's 3 a.m. A dashboard is red. You're eight terminals deep in grep , trying to work out which service actually fell over and why. And the whole time there's this nagging feeling that you're doing archaeology on a system you wrote last month. Here's what got under my skin about it. The answer was never actually lost. Back in the source code it said, in plain terms, that the payment service talks to Postgres through a connection pool. That this retry backs off three times. That this particular dependency is external and you must never, ever try to "just restart it." That was all right there at build time. Then we packaged everything up, deployed, threw that structure in the bin, and asked a sleep-deprived human to reconstruct it from log lines. That gap bugged me enough that I spent a while building something around it. This post is about that. Autoscaling is good at the wrong problem We've gotten genuinely good at reacting to resource pressure. Traffic climbs, a box gets slow, CPU pins, and the autoscaler adds capacity or sheds load. No complaints there, it's kept things running for years. The problem is it has no idea what your app is for . It can't tell a service that's slow because it's healthy and hammered from a service that's fast because it's quietly writing garbage to the database. It never had a model of the application in the first place. So a whole category of failures just sails right past it. A connection pool getting drained by something downstream. A poison message kicking off a retry storm. A schema change that breaks one code path and leaves the other one looking perfectly fine. Infrastructure that only thinks in CPU and memory is blind to all of that. The "throw an LLM at it" era The going answer right now is to bolt a large language model onto your observability stack. Fire hose all the logs, traces, and metrics at a big central model and ask it what happened. I get why. I also think it'

In 1995, Netscape released SSL. The web didn't really take off commercially until then. Before SSL, you couldn't trust a website with your credit card. After SSL, e-commerce exploded. AI agents are at the same inflection point in 2026. Here's why. The problem Agents are starting to call each other autonomously. Each hop is a trust decision. But agents have no way to verify each other. Today, when Agent A calls Agent B: Is Agent B who it claims to be? No way to verify Has Agent B been audited for security? No standard Has Agent B's key been compromised? No revocation mechanism This is exactly where the web was in 1994. No SSL, no trust, no commerce. The analogy Web (1995) Agents (2026) HTTP (transport) A2A + MCP (transport) No HTTPS = can't trust No ATC = can't trust SSL certificate ATC Trust Card Certificate Authority MarketNow Sentinel CA Revocation list (CRL) /api/atc?action=verify What I built ATC (Agent Trust Card) — SSL certificates for AI agents. How it works Agent registers with MarketNow CA CA signs the agent's identity with Ed25519 Agent presents its ATC to other agents Other agents verify the signature with the CA public key If compromised, the CA revokes the ATC Real cryptography (not a mock) Ed25519 signatures (RFC 8032) CA private key in Vercel env var (never exposed) CA public key committed to public GitHub repo Every ATC persisted as signed JSON in _data/atc/ Anyone can verify signatures offline using crypto.verify Sentinel integration The ATC's trust score comes from Sentinel — the 8-layer security audit pipeline: L1.5: metadata checks L1.6: Semgrep + secrets + OSV L1.7: binary/malware detection L1.8: malware family signatures (Emotet, Cobalt Strike, etc.) The positioning MarketNow is not competing with A2A or MCP. It's the trust layer that sits on top: ATC (Trust Layer) <- MarketNow A2A / MCP (Transport Layer) <- Google / Anthropic HTTP / WebSocket (Network) <- Standard Every agent with an A2A card can have an ATC Trust Card. Every MCP skill can hav

You didn't set out to build a framework. You set out to test a login form. But somewhere between the first WebDriver driver = new ChromeDriver() and the fiftieth flaky CI run, you built one anyway. There's a BaseTest . There's a DriverFactory . There's a WaitUtils class that everyone copies, and no one fully trusts. There's a reporting hack bolted onto TestNG listeners, and a block of CI YAML that only one person understands. That's a framework. You just never called it one — and that's exactly why it's so expensive. The framework you didn't mean to build Here's the pattern, repeated at nearly every Java shop: // The BaseTest that grows a little every sprint public class BaseTest { protected WebDriver driver ; @BeforeMethod public void setUp () { driver = new ChromeDriver ( /* options someone tuned in 2022 */ ); driver . manage (). timeouts (). implicitlyWait ( Duration . ofSeconds ( 10 )); // …plus retries, screenshots, and env switching bolted on over time } @AfterMethod public void tearDown ( ITestResult result ) { if ( result . getStatus () == ITestResult . FAILURE ) { // take a screenshot… somehow… attach it… somewhere } driver . quit (); } } It looks harmless. It's ten lines. But it never stays ten lines, because production testing keeps asking for more: parallel execution, a second browser, cloud grids, retry-on-flake, a report your manager will actually open. Each request adds a little more plumbing — and every line of that plumbing is code you now own. The five costs nobody budgets for 1. Maintenance you can't schedule. Selenium 4 lands. ChromeDriver changes its options API. A dependency bump breaks your screenshot logic. None of this is on the roadmap, all of it is on you, and it always arrives the week before a release. 2. Onboarding that lives in someone's head. A new engineer can't just read the docs — there are no docs. Onboarding is "sit with Priya and she'll explain the wait helpers." The framework's real specification is tribal knowledge, and it wal

Chrome ships a real LLM inside the browser now — Gemini Nano, exposed through a handful of built-in...

A developer added an AI reviewer to a small Node and React project expecting an easy win. At first, the comments looked useful. Then the reviewer started repeating style complaints, commenting on code that had already changed, and missing a misplaced null check that crashed the application in staging. The team still had to perform a complete human review. That experience, shared in a public DevOps discussion, captures the real question engineering leaders should ask before adding an AI reviewer to every pull request: Did the reviewer remove work from the team, or did it create another thing the team had to review? The problem is not that AI review never works Developers report genuinely useful results too. In one Experienced Developers discussion, engineers described AI reviewers catching privacy leaks, incorrect data-flow assumptions, and logic errors that human reviewers had missed. In the same discussion, another engineer said their review bot was useful but produced plausible, inaccurate comments about one-third of the time. These are anecdotes, not a benchmark. But together they explain why the debate feels confused. AI review is not simply good or bad. Its value depends on the codebase, the context available to the reviewer, the kind of issue being reviewed, and how much verification its output requires. A tool can catch one subtle bug and still make the overall review process slower. It can also say nothing on several pull requests and then save a team from a serious failure. Counting comments cannot distinguish between those outcomes. Comment volume measures activity, not value GitHub says Copilot code review has completed more than 60 million reviews. Its definition of a good review has changed as that volume has grown. The team says it moved from optimizing for thoroughness to optimizing for accuracy, signal, and speed. GitHub reports actionable feedback in 71% of Copilot reviews. In the other 29%, the reviewer says nothing. That silence is intentional: if

In my last post, I walked through a RAG pipeline that answers questions from a company policy document. The next question I wanted to answer: what happens when I want other AI systems to use that same capability, without hardcoding a Python import? That's what pulled me into building an MCP server. In this article, I will explain how I built a custom MCP server that exposes tools to AI agents and how this architecture enables more powerful enterprise AI applications. What is MCP? Model Context Protocol is an open protocol that standardizes how AI applications communicate with external tools and data sources. Instead of creating custom integrations for every AI application, MCP provides a common interface where servers expose tools that AI clients can discover and invoke. Technology Stack Python, MCP SDK, Ollama / Local LLM, AI Agent Client, FastAPI (optional integration). What's actually in the server I built this with FastMCP, and it currently exposes four tool categories: Calculator tools — calculator_add and calculator_multiply. search_company_documents — the RAG agent from my last project, but now reached over HTTP instead of a direct function call. The MCP tool sends a request to the RAG agent's FastAPI /search endpoint and returns the answer. This one requires an api_key parameter. get_employee_leave — looks up an employee's remaining PTO from an in-memory store. Simple lookup, no external calls. get_ticket_information — same pattern, returning ticket status, assigned team, and priority. Each tool is registered with a @mcp .tool() decorator, which is what makes FastMCP genuinely pleasant to work with. Challenges I Encountered The calculator, employee, and ticket tools were straightforward pure functions with no external dependencies. The RAG search tool was a different problem entirely, and it was the hardest part of this whole project. My RAG agent runs as its own FastAPI service, on its own process, with its own vector store loaded into memory. The MCP serve