标签：#r

느린 LLM 호출 중 DB connection을 잡지 않는 이유 AI 기능의 latency는 모델 응답 시간으로만 끝나지 않습니다. 요청이 LLM이나 embedding API를 기다리는 동안 데이터베이스 session까지 긴 범위로 유지하면, 느린 외부 호출이 DB connection pool의 압력으로 전파될 수 있습니다. 이 글은 AI memory OSS인 Honcho의 변경 이력과 pinned source를 읽으면서, 외부 호출과 DB transaction/session 경계를 어떻게 분리했는지 추적한 기록입니다. Scenario Honcho의 dialectic 경로(저장된 memory를 근거로 사용자 질문에 답하는 질의 경로)는 답하기 전에 다음 작업을 수행합니다. peer·session·workspace 확인 -> 관련 memory 검색 -> embedding·LLM 호출 -> 필요하면 tool로 추가 조회·기록 -> 답변 생성 여기에는 짧은 DB 조회와 상대적으로 느리고 변동성이 큰 외부 호출이 섞여 있습니다. 두 작업을 하나의 session scope로 묶으면, DB가 필요하지 않은 대기 시간까지 session lifetime에 포함됩니다. 변경 전에는 무엇이 묶여 있었나 PR #477 직전의 agentic_chat 은 하나의 tracked_db context 안에서 peer와 설정을 읽고, 그 session을 DialecticAgent 에 전달한 뒤, agent.answer() 가 끝날 때까지 같은 context를 유지했습니다. streaming 경로도 같은 형태였습니다. 구조를 단순화하면 다음과 같습니다. DB session open -> preflight read -> DialecticAgent receives session -> embedding / memory tools / LLM answer DB session close commit 0533c6d 의 제목도 이 문제를 dialectic held connection 으로 기록합니다. 다만 이번 분석에서는 실제 pool checkout 시간이나 장애를 재현하지 않았습니다. 여기서 확인한 것은 코드의 session scope와 변경 의도입니다. SQLAlchemy의 session 객체를 만들었다고 곧바로 connection을 점유하는 것은 아닙니다. 하지만 이 경로처럼 SQL을 실행해 transaction이 시작되면 session은 pool에서 빌린 connection을 commit·rollback까지 유지합니다. Honcho의 tracked_db 는 종료할 때 rollback() 과 close() 를 호출하므로, SQL 실행 뒤 이 context를 LLM 대기까지 유지하던 범위를 줄이는 것은 이 경로의 connection 점유 구간도 줄이는 일입니다. 어떻게 경계를 줄였나 변경 후에는 tracked_db("dialectic.preflight") 가 본 작업 전 검증과 설정 조회(preflight), 즉 peer 존재 여부, session/workspace 설정, peer card를 읽는 구간만 감쌉니다. context가 끝난 다음에 DialecticAgent 를 만들고 LLM 답변을 생성합니다. Agent 생성자에서도 DB session 인자가 제거됐습니다. short DB preflight -> 필요한 값 읽기 DB session close agent execution -> embedding / LLM / tools tool needs DB -> tool-owned short DB session -> close 핵심은 DB 사용을 없앤 것이 아닙니다. 요청 전체가 session을 소유하는 대신, DB가 필요한 작업이 자기 범위의 session을 소유하도록 바꾼 것 입니다. pinned current code에서도 유지되는가 분석 기준 commit 85239a6 에서도 이 경계는 유지되고 더 구체화돼 있습니다. src/dialectic/chat.py 의 일반·streaming 경로 모두 preflight context를 닫은 뒤 agent를 실

Every agent-security vendor tells you what they block. Nobody tells you what they miss. That gap is the whole problem. "We stop prompt injection" is a claim you cannot check. You cannot run it, and you cannot tell it apart from the next company saying the same sentence. So security engineers do the rational thing and discard all of it. I published the opposite. It is called the ARE Incident Database , and it is public: https://aredb.org What is in it 32 agent failures that actually happened, each with a real source. A production database dropped during a code freeze. Twenty-five thousand documents deleted in the wrong environment. Credentials read and shipped to an external sink. A budget burned to zero in a loop. Each one gets a stable id ( ARE-2026-001 through ARE-2026-032 ), and each one is mapped to its category in the OWASP Agentic Security Initiative Top 10 , which is the peer-reviewed catalog of what goes wrong with agents. AREDB does not compete with it. OWASP owns the map. This is the cited incidents underneath it. The part that makes it uncomfortable to publish Every entry carries a coverage flag, and the flag is about our own product . We block 23 of the 32 today. Two more are partial, and they say partial. That leaves six of the ten OWASP categories covered at the action layer, and four that we do not cover: ASI06 Memory and context poisoning. We strip the hidden characters attackers use to smuggle instructions into text. We do not read the meaning of the text itself, so this one is only partial, and we mark it partial. ASI07 Insecure inter-agent communication. This is about how agents talk to each other over the network, which a firewall that sits in front of actions never sees. Not ours. ASI09 Human-agent trust. This is a design and disclosure problem. There is no action for a firewall to catch. Not ours. ASI10 Rogue agents. We stop the dangerous actions, but we do not diagnose the misbehavior itself. Partial. A firewall that claimed all ten would be l

submitted by /u/davidalayachew [link] [留言]

When the enemy occupies favorable terrain, don't attack head-on. Use a decoy to lure the tiger down the mountain. Then take the mountain. — The 36 Stratagems, Lure the Tiger Down the Mountain Previously on this series: #2: Derek Shaw Walked Into Another AI Promise. The Pipeline Had a Better Plan. — Derek lost the Finova contract at QualiGuard. In the parking lot, Lena turned back before getting in her car: "Next time you put together a proposal — make sure your boss knows what you're doing out there." That line followed him. At MediSys he nearly made the same mistake. Fixed the ETL pipeline instead of the model, beat OmniDx with their own white paper. But VP Morgan still saw through him: he still hadn't told his boss. #8: Alex Watched an AI Dashboard Take Over. He Kept the Keys Under the Table. — MedTech signed a seven-figure AI operations monitoring system. Alex was assigned as training lead. Under everyone's noses, he built a second monitoring panel labeled "training environment." Three weeks later the vendor dashboard went down. Alex's hidden panel was the only one still running. The first time Alex and Derek really talked, and it wasn't in a working group. At the FHIR standards committee quarterly meeting, they sat in the same row, three seats apart, and voted against the same proposal. They knew each other's names. That was it. Two months later, Derek was fixing a partition config in the staging environment. MediSys had just signed a major hospital; the AI diagnostic validation platform was in integration testing. He found an unrotated log directory in /etc/logrotate.d/ with a prefix that didn't match MediSys's naming convention. He traced it upstream. One server. Labeled "temporary data exchange node." MedTech's supply chain order stream and MediSys's diagnostic validation records were sitting in the same directory. Write permissions hadn't been restricted. The hospital's integration spec had a line saying "both parties are recommended to complete data alignme

By keeping the number of investments to about 25 per fund, Greylock aims to remain what it calls "the most important partner" to its founders.

I wanted to play with AI image generation without paying for Midjourney or dealing with Discord bots. So I built SnapShift — a free web tool that transforms photos into artwork in seconds. What it does: Upload any photo (portrait, pet, landscape, product) Pick from 50+ styles — cyberpunk, anime, oil painting, Ghibli, movie posters, 3D figurines, and more Download in 1K or 2K quality No signup, no limits, completely free Tech stack: static site on GitHub Pages, AI generation via Agnes API with Cloudflare Worker proxy. Try it: https://snapshit.fun Would love to hear what other styles you'd like to see!

Introduction: The Question Beneath All Questions I think a lot of people are searching for the same thing but using different words. Some people call it: success happiness freedom purpose wealth enlightenment achievement legacy But underneath all of it is a deeper question: "What is worth dedicating my life to?" That question is harder than finding a job. It is harder than making money. It is harder than becoming successful. Because even if I get everything I think I want, I still have to answer: "Why did I want it?" Chapter 1: The Strange Reality of Modern Life We live in one of the wealthiest civilizations in human history. We have: technology beyond anything past generations could imagine medicine that would look like magic centuries ago instant communication across the planet access to unlimited information Yet so many people feel like they are barely surviving. Why? Because humans were built for survival. Our brains evolved to constantly ask: What could go wrong? How do I stay safe? How do I belong? Am I enough? Am I falling behind? The threats changed, but the machinery stayed the same. Ancient humans worried about predators. Modern humans worry about: money careers status loneliness comparison identity the future The battlefield moved from the physical world into the mind. Chapter 2: Money Is Not Evil — Money Is Power There is a tendency to pretend money does not matter. That is false. Money changes what is possible. Money can buy: freedom of time experiences travel education tools comfort opportunities the ability to help others A person with resources has access to a larger range of possible lives. Wanting money does not automatically mean being greedy. Sometimes wanting money is really wanting: freedom adventure security creativity proof that you overcame something The question is not: "Do I want money?" The better question is: "What will I use money for?" Money is a tool. A hammer can build a house or destroy something. The tool is not the meaning. The pu

Não é novidade para ninguém que estamos passando por uma transformação na área de desenvolvimento de software, em que a IA está assumindo diversas atividades. E isso me faz pensar: o que vamos medir, ou o que teremos como parâmetro para qualidade de software daqui pra frente? É sobre isso que vou falar neste texto. Antes das métricas: entenda o momento do seu time Antes de entrarmos nas métricas em si, precisamos entender o momento em que o nosso time está. É muito fácil eu simplesmente jogar métricas aqui e você aplicá-las ao seu time de maneira automática — mas será que elas fazem sentido para o seu contexto? Uma coisa que eu falo bastante aos meus alunos da mentoria que dou na He4rt Developers é: pra que eu quero isso? Softwares representam necessidades do mundo real, logo, medir o sucesso e a qualidade deles vai depender muito das necessidades que eles buscam suprir. Partindo agora para as métricas, eu gosto de dividi-las em dois grupos: Métricas para stakeholders Métricas para o time Qualidade de software não se resume a número de bugs — ela se aplica tanto em como o software é recebido pelo cliente final, quanto em como ele é desenvolvido. Métricas para stakeholders Uma coisa que eu aprendi neste tempo na empresa em que tenho atuado, principalmente com a transformação digital, é que mostrar número de bugs abertos ou resolvidos não mostra para o público o que realmente importa: como está a qualidade do produto. E, para me ajudar nisso, eu sempre tento me colocar no lugar de um cliente que não tem conhecimento profundo sobre o ciclo de desenvolvimento de software. A primeira coisa que eu gostaria de ver quando um QA, ou o time, vier me mostrar os resultados de uma sprint ou de um quarter é: quantos problemas eu tenho em produção — mas não só isso, quanto tempo tenho levado para resolvê-los. Mean Time to Resolve/Repair (MTTR) Essa é a famosa métrica que vai mostrar o tempo que leva desde que o problema é identificado até ele ser resolvido em produção. Dependendo

The companion to the seven things to check before a WordPress major upgrade is the question that comes right after: when do you actually apply it? A new WordPress major drops today. Do you ship it to production tonight? Tomorrow? In a week? Hold for the next scheduled monthly maintenance? This call tends to live in tribal knowledge, but a few clear axes combined together give you a calibration framework you can apply every time without re-deciding from scratch. Here are five axes worth using. Premise — majors are not security patches The first thing to anchor: a major upgrade is not a security patch . WordPress ships security fixes via minor releases ( 6.4.1 → 6.4.2 , 6.5.0 → 6.5.1 — the second-digit bumps ). Those are same-day apply by default . Major releases ( 6.4 → 6.5 , eventually some 6.x → 7.0 ) carry new features and API changes; they aren't released to be applied immediately for security reasons. Without this distinction, the felt urgency of " we have to apply this for security " pushes you to rush majors that should wait. Minors immediately, majors by judgment — that separation is the first rule worth writing down. Axis 1 — wait for x.0.1 For essentially every major release, x.0.1 (the first patch release) lands within 1–3 weeks and absorbs the critical bugs that surfaced after launch. Past examples have included things like "the admin goes white under specific settings," "a particular theme breaks the block editor," "DB migration stalls in specific environments." Nobody hit these on launch day; they emerged as the world started using it for days or weeks. Just waiting for x.0.1 instead of x.0 sidesteps most of those launch-window bugs. For the first few weeks after a major lands, the world's WordPress installations are effectively running the beta test . Being downstream of the people who hit the mines is the rational position for a maintenance practice. Axis 2 — wait until major plugin vendors update "Tested up to" The thing that breaks most after a majo

​I. The Terminal Velocity of Disembodied Intelligence ​The current paradigm of artificial intelligence is approaching a fundamental cognitive ceiling. We have built vast, sprawling minds, yet we have trapped them in sensory deprivation chambers. Today’s Large Language Models and industrial robotics operate under a fatal flaw: the reliance on linear, arbitrary tokenization. Traditional AI chops raw text into disconnected, non-semantic fragments, wasting immense computational memory tracking the mere phonetic order of spelling and grammar. ​Simultaneously, industrial machines navigate the physical world through siloed sensor pipelines. They process light, space, and kinetics as heavy, raw digital arrays, relying on brute-force algorithmic equations to stitch reality together. This is not intelligence; it is computational exhaustion. To achieve true artificial general intelligence, the machine must stop reading about the world and begin to inhabit it. ​II. The Biological Imperative ​Nature solved the hardware-software integration problem millions of years ago. Human biology remains the ultimate benchmark for flawless, metabolic efficiency. Our somatosensory system does not wait for a central brain to read a text string before pulling a hand away from a fire; it processes physical feedback in milliseconds through decentralized neural highways. ​Human cognition leverages cross-modal integration within the angular gyrus, allowing visual data to be instantly cross-referenced with kinesthetic feedback to trigger anticipatory motor reflexes. Furthermore, biological intelligence is inherently tied to physical survival. We manage thermodynamics through a centralized hypothalamic thermostat, protecting the body from cellular destruction, while routing ambient light data to deep-brain structures to drive a natural circadian rhythm. True AGI requires this exact synthesis of abstract thought and biological mechanics. ​III. The Logographic Paradigm Shift ​To bridge the gap between