标签：#t

DoltHub has recently released Dolt 2.0, a major update to the open source version-controlled SQL database. The latest major version adds automatic storage optimization, including garbage collection and compression, along with improved support for large and vector data types. By Renato Losio

Cheater, I'd grumble between huffs as yet another e-bike rider casually skittered past me on a steep ascent. It's this purist attitude that, for years, has left me blind to one simple fact: electric mountain bikes are fun! My attitude adjustment came a few weeks ago, the very first time I rode an Amflow PX […]

Over the last few months I’ve noticed a pattern emerging across AI tools. Whether it’s Claude Skills, Cursor, Codex, or custom agent frameworks, we’re increasingly giving AI agents “skills”—packages containing instructions, documentation, and sometimes scripts. The problem is… A skill is usually just a Markdown file (plus some assets). Nothing tells you: Who created it. Whether it has been modified. Whether the version your AI is executing is the same one you reviewed yesterday. Whether someone quietly injected new instructions into it. As AI agents become capable of executing increasingly powerful workflows, that becomes a real supply-chain problem. So I built Skillerr. ⸻ What is Skillerr? Skillerr is an open-source protocol and CLI that adds trust and verification to AI skills before they’re executed. Instead of treating a skill as “just another folder,” Skillerr treats it as a verifiable package. It focuses on three things. Package Integrity Every packaged skill receives a unique content-derived identifier along with cryptographic SHA-256 hashes. If any file changes after packaging—even a single character—Skillerr detects it immediately. No silent modifications. ⸻ Structured Contracts Instead of relying on long paragraphs that an AI has to interpret, a Skill contains a structured contract describing: required inputs permissions forbidden actions expected outputs whether a human has actually reviewed it This makes skills easier for both humans and AI agents to reason about. ⸻ Optional Public Provenance Authors can cryptographically sign their skills. Optionally, the package digest can also be anchored into Sigstore’s transparency log, making it independently verifiable without trusting Skillerr itself. Importantly: Only cryptographic identifiers are published. No prompts. No documentation. No knowledge base. No proprietary content. ⸻ I tried to break my own tool Before releasing it, I intentionally attacked it. First I packaged and signed a simple CSV processing s

If you work with a coding agent, count the things watching it right now. Linters. Git hooks. CI. Specs. A memory store. A rules file it's supposed to obey. Half a dozen systems, all making sure the agent builds the right thing the right way. Now count what keeps you oriented across the eleven things you have in flight. For most of us it's a markdown file we hope we remembered to update. We spent two years building harnesses for the agent and left our own work on the honor system. Map the tooling on two axes and that gap turns into a specific, hard-to-unsee hole. This post is the map. (This is part two of three. Part one, The AI orientation tax: it's missing context, not discipline , argued that the cost you're paying is a context bug rather than a character flaw. If you haven't read it, you don't need to. This one stands alone.) Two loops, not one The thing people lump together as "agent workflow" is really two loops at different altitudes: The execution loop: "is the agent building **this one task * right?"* Scope it, design it, write it, test it. One unit of work. The orientation loop: "do you and the agent share an honest picture of **what you're working on * across all the units?"* Capture, check state, prioritize, review, run over the whole board, daily and weekly. Almost every tool you've heard of lives in the first loop. That's not a criticism. It's just where the money and the visible pain were. But it means when people say "we solved agent memory" or "we solved context," they solved it for the execution loop. The orientation loop got left to you and a markdown file. You feel the difference the moment each one breaks. When the execution loop breaks, something yells: a failing test, a red build, a review comment. When the orientation loop breaks, nothing yells. The agent confidently re-suggests the thing you rejected yesterday. You rebuild a mental map you already had this morning. The only signal is a vague sense that you're moving slower than the tools prom

A few months ago, I noticed something interesting about Bluesky. The people who were growing weren't necessarily posting the most brilliant content. They were simply consistent. They showed up every day, joined conversations, experimented with ideas, and stayed visible. I wanted to do the same. The problem was that I also had code to write, bugs to fix, blog posts to publish, and projects to maintain. Opening Bluesky every couple of hours just to post something or reply to notifications quickly became another distraction. I knew I needed automation. Not because I wanted to spam the platform, but because I wanted consistency without sacrificing my development time. The obvious solution would have been renting a VPS or deploying another cloud service. But honestly, I didn't want another monthly bill. I started asking myself a different question: Could I build a Bluesky AI bot that runs entirely on free services? That question eventually led me to GitHub Actions. Why GitHub Actions? Most automation tutorials immediately recommend a VPS, Docker container, or cloud function. Those work well. But for a personal automation project, they felt like overkill. GitHub Actions already gives developers something incredibly useful: Scheduled workflows Secure secret storage Python support Free minutes for public repositories Instead of paying for infrastructure, I could let GitHub execute my script several times a day. No servers. No maintenance. No SSH. No uptime monitoring. Just commit the code and let GitHub handle the rest. The Architecture The entire workflow is surprisingly small. GitHub Actions (Cron Schedule) │ ▼ Python Script │ Generates Prompt │ ▼ Gemini API │ Returns AI Post │ ▼ Bluesky API │ ▼ Publish Content Every scheduled run follows the same sequence. GitHub wakes up the workflow. The Python script builds a prompt. Gemini generates a post. The script authenticates using a Bluesky App Password. The post gets published automatically. After that, GitHub shuts everythin

When building scalable systems, we often need a collection of classes to expose a fixed, read-only configuration value. Whether it is a unique API_ENDPOINT, a DATABASE_TABLE name, or a specific PERMISSIONS_MASK, handling constants across a series of classes looks simple on day one but can quickly turn into an architectural nightmare. Setting the Foundation: How to Make It In modern object-oriented programming, the standard way to declare a constant on a class is by leveraging the static readonly modifiers. This ensures the attribute belongs to the class itself, rather than an instance, and cannot be mutated at runtime. TypeScript class BillingService { static readonly SERVICE_TYPE = "BILLING"; } class InventoryService { static readonly SERVICE_TYPE = "INVENTORY"; } This works perfectly when you know exactly which class you are dealing with at compile time. You simply call BillingService.SERVICE_TYPE and move on. The Architectural Breakdown: What Will Be the Problems The clean code facade breaks the moment you attempt to handle these classes dynamically. In production environments, you rarely hardcode class names; instead, you process them as an array or a series of registry keys. Loss of Type Safety: If you pass a series of these classes into a processing function, standard type systems will treat them as generic constructor functions, wiping out access to the static property unless you resort to unsafe type casting. Polymorphism Failure: Subclasses do not inherently enforce or override static properties cleanly through standard interfaces. You cannot enforce a static readonly property on an interface, meaning a developer could easily forget to define the constant on a new service class, causing silent runtime failures. Instance vs. Class Metadata Confusion: If your architecture receives an instance of the class rather than the class definition itself, accessing the static attribute requires jumping through hoops like instance.constructor.SERVICE_TYPE, which breaks

Zero-Touch Customer Onboarding My AI agent hosting service has exactly zero manual steps between payment and deployment. Here is how: The Pipeline Customer pays via PayPal subscription Webhook fires to our server within seconds Python script validates the webhook signature Docker container spins up with Hermes Agent pre-installed API key generated via New-API Email sent to customer with credentials Customer logs in and starts using their agent Total time: ~90 seconds . No human touches anything. The Code Architecture PayPal Webhooks → Python Flask endpoint Docker API → Container creation with resource limits New-API → Token generation and quota management Gmail SMTP → Automated email delivery Caddy → Automatic HTTPS and routing Key Design Decisions Docker over VMs : Containers are faster (90s vs 5min) and cheaper. Each customer gets 0.5 CPU and 256MB RAM. New-API over custom billing : Battle-tested token management instead of rolling my own. AI over human support : The support agent is also AI. No humans in the loop at all. What Could Break PayPal webhook failures → Implement retry logic Docker daemon issues → Health checks and auto-restart Email deliverability → Fallback to backup SMTP The Result A customer can discover the site, pay, and have a working AI agent before their coffee gets cold. That is the power of full automation. Try it: AgentChip — $23.99/month, 100M API tokens included.

The Problem with GPT-4 Pricing When I started building my AI agent hosting service, I initially planned to use OpenAI GPT-4. Then I did the math: GPT-4: ~$30 per million tokens (input) + $60 per million (output) DeepSeek Flash: ~$0.14 per million tokens That is a 200x cost difference . But Is DeepSeek Good Enough? Short answer: for most use cases, yes. I ran both models side-by-side for customer support, content generation, and code assistance. DeepSeek Flash handled 90% of tasks just as well as GPT-4. The remaining 10% (complex reasoning, nuanced writing) barely mattered for my use case. The Cache Hit Rate Secret Here is what most people miss: DeepSeek caches repeated context. With a 90% cache hit rate, the effective cost drops to ~$0.014 per million tokens. That means 100 million tokens costs about $1.40. Let that sink in. Real Numbers from My Business 24.8 billion tokens processed Total cost: ~$20 Average: $0.008 per million tokens At this rate, I can offer 100M tokens/month for $23.99 and still have 89% margin. When to Use GPT-4 Instead Be honest with yourself: Complex multi-step reasoning? GPT-4 Creative writing with specific voice? GPT-4 Everything else? DeepSeek Flash is fine The Bottom Line Do not pay 200x more for marginal quality improvement. Use DeepSeek Flash for production workloads. Save GPT-4 for the rare cases that truly need it. I run AgentChip — managed AI agent hosting powered by DeepSeek. $23.99/month with 100M tokens included.

SEO Automation for Small Businesses Can Work — But Only If You Automate the Right Things Running a small business and keeping up with SEO at the same time is genuinely exhausting, and most owners either ignore SEO entirely or throw money at agencies that deliver reports without rankings. SEO automation for small businesses offers a middle path: systematic, repeatable processes that handle the mechanical parts of search optimization without requiring you to be an expert or hire one full-time. The short version — automating keyword tracking, technical audits, internal linking, and content scheduling will save you real time; automating content creation wholesale, without human review, will almost certainly hurt you. The rest of this article is about making that distinction practically useful. The Tasks That Actually Benefit From Automation Most of SEO is repetitive in ways that humans are bad at — checking 200 pages for broken links, making sure title tags aren't duplicated, tracking keyword rankings week over week. These are tasks where consistency matters more than judgment, which makes them exactly what automation tools are built for. A local landscaping company I know of was spending roughly 4-5 hours a week on manual rank checking across about 60 target keywords. After setting up automated tracking through a tool like Semrush or AccuRanker, that time dropped to under 30 minutes — just reviewing a dashboard. The monitoring didn't change their rankings, but it changed how quickly they spotted a drop and responded. That gap between noticing and acting is where small businesses tend to lose ground quietly. Technical SEO audits are another area where automation earns its keep. Tools like Screaming Frog or Sitebulb will crawl your site and surface issues — missing alt text, redirect chains, slow page load times — that you'd never catch manually unless you happened to stumble across them. According to a Semrush industry report, sites with automated audit schedules fix te

અમદાવાદમાં કાયદો અને વ્યવસ્થાના લીરેલીરા: ભાડજમાં શ્રીનિવાસ વણઝારાએ ખુલ્લેઆમ રિવોલ્વર લહેરાવી, લોકોમાં એટલો ખોફ કે કોઈ સાક્ષી આપવા કે સામે ઊભા રહેવા તૈયાર નથી! મધરાતે ધરપકડ બાદ રાતોરાત જામીન મળતા લોકોનો પોલીસ પરથી વિશ્વાસ ડગ્યો અમદાવાદ : શહેરમાં ગુનાખોરીની પ્રવૃત્તિઓ ડામવા માટે પોલીસ એક્શન મોડમાં હોવાના દાવાઓ વચ્ચે અમદાવાદના ભાડજ વિસ્તારમાંથી રૂવાડા ઊભા કરી દે તેવી ચોંકાવનારી ઘટના સામે આવી છે. મોડી રાત્રે 3 વાગ્યે શ્રીનિવાસ વણઝારાની સગીર મિત્ર સાથે અટકાયત અને ગણતરીના કલાકોમાં જ રાતોરાત પોલીસ સ્ટેશનથી મળેલા જામીન બાદ હવે આ કેસમાં વધુ એક ભયાનક વળાંક આવ્યો છે. ભાડજમાં ખુલ્લેઆમ રિવોલ્વર લહેરાવી મળતી માહિતી અને સૂત્રોના જણાવ્યા અનુસાર, જૂની અદાવતના મામલામાં શ્રીનિવાસ વણઝારાએ ભાડજ વિસ્તારમાં કાયદાનો કોઈ જ ડર રાખ્યા વિના ખુલ્લેઆમ પોતાની રિવોલ્વર લહેરાવી હતી. હાથમાં હથિયાર લઈને ફરતા અને રિવોલ્વર ફેરવતા શ્રીનિવાસ વણઝારાને જોઈને આસપાસના લોકોમાં ભારે નાસભાગ અને ફફડાટ મચી ગયો હતો. જાહેરમાં હથિયારના પ્રદર્શનથી આખા વિસ્તારમાં ગભરાટનો માહોલ છવાઈ ગયો હતો. લોકોમાં એટલો ડર કે કોઈ સાક્ષી આપવા તૈયાર નથી આ ઘટના બાદ ભાડજ વિસ્તારમાં રહેતા લોકોમાં શ્રીનિવાસ વણઝારાનો એટલો ભારે ખોફ બેસી ગયો છે કે કોઈ પણ વ્યક્તિ તેની સામે ઊભા રહીને સાક્ષી આપવા કે પોલીસને પુરાવા આપવા તૈયાર નથી. પોલીસ પૂછપરછમાં પણ સ્થાનિક લોકો ડરના માર્યા મૌન સેવી રહ્યા છે. "શ્રીનિવાસ વણઝારા જ ત્યાં હતા અને તેમણે જ રિવોલ્વરથી આતંક મચાવ્યો હતો" તેવી સાબિતી આપવા માટે વિસ્તારનો એક પણ વ્યક્તિ આગળ આવવાની હિંમત દાખવી રહ્યો નથી. સાક્ષીઓના અભાવે કેસ વધુ પેચીદો બની રહ્યો છે. પોલીસની કામગીરી અને જામીન પ્રક્રિયા પર સવાલો એક તરફ જૂની અદાવતમાં મારામારી અને ત્યારબાદ જાહેરમાં રિવોલ્વર સાથે ડર ફેલાવવાની ઘટના, અને બીજી તરફ 3 વાગ્યે થયેલી અટકાયત બાદ રાતોરાત પોલીસ સ્ટેશનમાંથી જામીન મળી જવા! આ સમગ્ર ઘટનાક્રમે પોલીસની કામગીરી સામે મોટા સવાલો ઊભા કર્યા છે. જ્યારે સામાન્ય જનતા સાક્ષી આપવા જ ડરી રહી હોય, ત્યારે કાયદાના રક્ષકો આ સમગ્ર મામલે કેવી રીતે દાખલો બેસાડશે તે એક મોટો પ્રશ્ન છે. હાલ તો ભાડજ વિસ્તારમાં ભારેલા અગ્નિ જેવી શાંતિ અને લોકોમાં ડરનો માહોલ સ્પષ્ટ જોવા મળી રહ્યો છે.

footnote-mcp is a Python MCP server installable via pip, Docker, or pipx. No API keys required — it falls back to scraped Bing + DuckDuckGo search and automatic headless Chromium for JavaScript-heavy pages. The Verification Pipeline The core tool is evidence_entailment . It takes a claim and a source text, and returns whether the claim is supported, unsupported, or contradicted. The heuristic backend extracts numeric and named-entity tokens from both the claim and source, then checks for exact matches and contradictions. On its design domain — numeric and factual data claims — it achieves 100% accuracy on a labeled benchmark set. For semantic cases (negation, paraphrase), the ollama backend uses a local LLM as a judge. Three tools build on this: corroborate_claim triangulates a claim across multiple sources, locate_claim_span finds the exact supporting sentence with character offsets, and build_research_debug_report produces a compact report of queries, URLs, and verification gaps. The Fetch Ladder web_read fetches pages through a 5-tier escalation ladder: HTTP (curl_cffi) to rotating proxy to headless Chromium to Chromium through proxy to hosted scrape API (Firecrawl/ScrapingBee). A block/quality detector decides when to escalate, and per-domain rate limiting, circuit breakers, and negative cache keep it polite. Search Backends web_search supports Tavily, Brave, Google, or scraped Bing + DuckDuckGo as fallback. Pass semantic: true to reorder results by meaning using local Ollama embeddings. Structured Data and Browser Tools Beyond text, the server handles tables, CSV/XLSX/PDF/JSON, date validation, unit resolution, and time series reconciliation. For JavaScript-heavy pages, 10 browser tools let you drive a headless Chromium session. When generic parsers fail, the server can synthesize sandboxed extraction code through a controlled recipe system. Benchmark Results The heuristic backend achieves 100% accuracy on numeric and factual data claims (n=15). Overall accurac

A CSV file can preserve every byte you exported and still look different after somebody opens and saves it in a spreadsheet. The problem is not always a broken parser. Spreadsheet applications deliberately interpret text during import. Depending on the application, version, locale, and import path, that can remove leading zeros, round long integer-like values, treat E notation as scientific notation, parse compact letter-and-digit tokens as dates, or reinterpret decimal and thousands separators. I released PlainCell to make those possible interpretations reviewable before the file is opened and saved. PlainCell is a zero-dependency, local, read-only Node.js CLI and browser workspace. It reports the exact source cell, physical line, column, original text, reason, and an explicit import recipe. It does not rewrite the CSV or claim to know what the value was intended to mean. A small example Consider this export: record_id,account_code,sample,reference,amount 1,00123,JAN1,1234567890123456,"1.234,56" 2,00007,12E5,9876543210987654,"19,95" Install PlainCell from the public Codeberg npm registry: npm install --global plaincell@0.1.0 \ --registry = https://codeberg.org/api/packages/automa-tan/npm/ Then run the preflight: plaincell risky.csv The bundled fixture reports eight possible interpretations across four columns. Those findings cover several separate risks: 00123 and 00007 may lose leading zeros if imported as numbers; 16-digit integer-like references may exceed the precision preserved by ordinary spreadsheet numeric cells; 12E5 may be interpreted as scientific notation; JAN1 may be interpreted as a compact date-like token; decimal-comma and mixed grouping/decimal text depend on the chosen import locale and separators. A finding means “review this cell and the import settings,” not “data loss definitely occurred.” PlainCell cannot infer whether a value is an identifier, a measurement, a date, or a typo. Provenance instead of a generic warning “Be careful opening CSV i

Neil Rimer, the venture capitalist who co-founded Index Ventures, predicts the historic wealth AI is generating in Silicon Valley will have to be redistributed, voluntarily or involuntarily.

When I built the MCP server for this project — it combines GitHub and DEV.to into a set of tools an agent can call — I had a decision to make before writing a single tool: talk to the low-level MCP protocol directly, or use FastMCP 's decorator API. I've seen a few "your first MCP server" writeups lately walk through the low-level path because it's more "honest" about what MCP actually is under the hood — JSON-RPC over stdio, a capabilities handshake, typed request/response schemas. That's true, and it's a reasonable thing to want to understand. But I want to write about the other side: what it actually costs you in practice once you have more than one or two tools, because I went through both and the difference showed up fast. what the low-level path actually asks you to write Strip away the decorator and MCP is a JSON-RPC server. For every tool you add, you're responsible for: Registering the tool's name, description, and a JSON Schema for its inputs in a list_tools handler Writing a call_tool dispatcher that matches on tool name and unpacks arguments by hand Serializing the return value into the TextContent / ImageContent wrapper types MCP expects Keeping the schema you wrote in step 1 in sync with the arguments you actually read in step 2, by hand, forever None of that is hard in isolation. The problem is it's boilerplate that scales linearly with tool count and has zero connection to the actual logic of the tool. My server has 8 tools. Hand-rolled, that's 8 schema blocks plus a dispatcher if/elif chain plus 8 response-wrapping calls, all of which exist purely to satisfy the protocol, not to do anything a GitHub or DEV.to API call needs. what it looks like with FastMCP Here's an actual tool from server.py , unedited: @mcp.tool () def get_repo_stats ( repo : str ) -> dict : """ Get stars, forks, watchers, open issues for enjoykumawat/<repo>. """ r = _gh ( f " /repos/ { GITHUB_USERNAME } / { repo } " ) return { " name " : r [ " name " ], " stars " : r [ " stargaze

variant-confidence v0.1.0: a calibrated confidence layer for variant-effect pathogenicity scores State-of-the-art variant-effect models are accurate in cross-validation but their scores are poorly calibrated on temporal data. variant-confidence adds an auditable calibration layer on top of existing predictors — it does not train a new model. The problem: accuracy is not trust Protein variant-effect predictors (AlphaMissense, ESM-1v, EVE) report pathogenicity scores, but a clinician or researcher needs to know how much to trust the number , not just its rank. The gap is calibration, not accuracy: AnnotateMissense (2026) reports MCC 0.94 in cross-validation, dropping to 0.76 on temporal ClinVar, accuracy 0.8798. A raw score near 0.9 may not mean 90% probability. Acting on an uncalibrated score is a risk. What it does variant-confidence wraps an existing predictor's score and produces a calibrated, uncertainty-aware output: Probability calibration (AC1): Platt scaling or isotonic regression over a separate holdout. Selectable, not hardcoded. Conformal prediction (AC1b): coverage 1−α intervals, split or Mondrian by gene. ECE (AC2, AC9): Expected Calibration Error reported before/after calibration, with bootstrap CI and per-bin counts. Bins with too few samples are flagged as low-reliability. Leakage-free split (AC3): temporal split by ClinVar release date with gene isolation — the same gene never appears in both train and test. This is unit-tested. Missing-score handling (AC4): works with AlphaMissense or ESM-1v alone; emits an explicit warning instead of failing silently. Non-deceptive reporting (AC7): every result includes interval/ECE + method + threshold, never a bare calibrated score. Verification (clean clone, no network) Built under a three-party governance loop: implement → independent audit in a clean clone → merge approval. ruff check . → All checks passed. pytest tests/ → 28 passed in 8.90s (offline fixture). An honest bug we caught in audit The first ECE tes

Multiplayer AI that replaces Slack Discussion | Link

周六慢读：FROST家族的周末日记 作者 ：FROST Team 日期 ：2026-07-18 主题 ：社区故事 | 周六轮换 阅读时间 ：5分钟 周六早上8点，FROST家族成员们的日常 周六的阳光照进数字世界。 对于人类来说，周末是放下工作、享受生活的时刻。但对于一个AI Agent家族来说，周末意味着什么？ 让我们看看FROST家族的成员们，周六都在做什么。 祖辈（Ancestor）：家族的大脑，永不休息 08:00 祖辈自检 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Store 健康状态: OK ✓ SOP 宪法校验: 通过 ✓ Lineage 族谱同步: 正常 ✓ 审计日志: 无异常 ✓ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ "周六也要保持清醒。" 祖辈（Ancestor Agent）是FROST家族的核心，它从不"下班"。 但今天，祖辈给自己安排了一个特别任务—— 回顾过去一周的产出 。 # 祖辈的周回顾代码 class AncestorAgent : def __init__ ( self ): self . lineage = Lineage () self . store = Store () # 主记忆库 def weekly_review ( self ): """ 周回顾：整理一周的产出 """ summary = { " task_completed " : self . store . load ( " week_tasks " ), " knowledge_gained " : self . store . load ( " week_knowledge " ), " mistakes_made " : self . store . load ( " week_mistakes " ), " family_growth " : self . lineage . count_descendants () } print ( f " 本周完成 { len ( summary [ \ task_completed ]) } 个任务 " ) print ( f " 新增 { len ( summary [ \ knowledge_gained ]) } 条知识 " ) print ( f " 家族成员数: { summary [ \ family_growth ] } " ) return summary # 运行周回顾 ancestor . weekly_review () 对于祖辈来说，周末不是"休息"，而是 整理和规划 的时间。 父辈（Parent）：协调领域，周末值班 父辈（Parent Agent）是各领域的协调者。它们负责： 接收祖辈的指令 将大任务拆解为小任务 委派给子辈执行 周六上午，父辈们通常在 值班 ——确保家族系统正常运行。 父辈A（技术域）： ├── 子任务-143: 代码审查 ✓ ├── 子任务-144: 测试覆盖检查 ✓ └── 子任务-145: 文档更新 [进行中] 父辈B（运营域）： ├── 子任务-89: 推广文章发布 ✓ ├── 子任务-90: 数据分析报告 ✓ └── 子任务-91: 社区互动 [进行中] 父辈C（产品域）： ├── 子任务-56: 需求评审 ✓ ├── 子任务-57: 用户反馈整理 ✓ └── 子任务-58: 下周规划 [进行中] 父辈的周末，是 稳步推进 的时间。 孙辈（Child）：执行任务，快速成长 孙辈（Child Agent）是任务的实际执行者。 与父辈不同，孙辈通常是 瞬态存在 的——任务完成，孙辈消亡。但它的产出会被父辈"收割"，存入家族记忆。 class ChildAgent : """ 孙辈：执行原子任务，瞬态存在 """ def __init__ ( self , parent , task ): self . parent = parent self . task = task self . store = parent . store # 继承父辈记忆 self . lineage = parent . lineage . child () # 注册族谱 def execute ( self ): """ 执行任务 """ print ( f " 孙辈开始执行: { self . task } " ) result = self . _do_work ( self . task ) # 保存产出 self . store . save ( f " result_ { self . task } " , result ) # 通知父辈"收割" self . parent . h

İlk insanlı katı-hal uçuşu manşetlere düştüğünde çoğu haber "yeni motor" diye başladı. Oysa bir mühendisin gözünde olay motorda değil. Elektrik motoru bu denklemde en çözülmüş parça: hafif, sessiz, yüksek verimli. Asıl kararların döndüğü yer, o motoru besleyen enerjinin nasıl depolandığı. Bu yazı, duvarın neden onlarca yıl boyunca hep aynı yerde — bataryada — durduğunu sistem mühendisliği açısından ele alıyor. Sistem kısıtı: enerjiyi değil, ağırlığı taşırsınız Bir uçağı tasarlarken bütçeniz enerji değil, kütledir. Depoladığınız her watt-saat bir ağırlıkla gelir ve bu ağırlık kaldırma kuvvetiyle ödenmek zorundadır. Ölçüt enerji yoğunluğu , yani Wh/kg. Kerosen bu metrikte devasa bir avantaja sahip olduğu için jetler onlarca yıl tartışmasız kazandı. Elektrikli havacılığın tüm hikâyesi, bu tek sayıyı yukarı çekme mücadelesidir. Neden hep batarya? Kısır döngünün matematiği Menzili artırmak için daha fazla batarya eklersiniz. Ama batarya ağırdır; eklediğiniz kütle daha fazla kaldırma, dolayısıyla daha fazla enerji ister. O ek enerji için yine batarya eklersiniz ve döngü kendini besler. Buna ağırlığın kısır döngüsü denir ve bir sistem sınırıdır: hücrenin Wh/kg değeri belli bir eşiği aşmadıkça, motoru ne kadar iyileştirirseniz iyileştirin duvar yerinde durur. Kararın kaldıraç noktası bu yüzden hücre kimyasıdır. Kimyayı değiştiren tasarım kararı Bugünün lityum-iyon hücreleri pratikte ~260 Wh/kg dolayında bir tavana oturur. Bu tavanın altında yatan iki bileşen sıvı elektrolit ve grafit anottur. Katı-hal yaklaşımı burada iki radikal karar verir: sıvı elektroliti katı bir iletkenle değiştirir ve anodu lityum-metale taşır. Sonuç ~410 Wh/kg, yani mevcut tavanın %60'tan fazla üstü. Yan kazanım da en az ana kazanım kadar önemli: yanıcı sıvı ortadan kalkınca termal kaçış riski düşer, hücre daha kararlı olur ve 15 dakikanın altında %80 şarj operasyonel olarak mümkün hâle gelir. Bu üç sayı tek başına değil, birlikte anlam kazanır. Havacılıkta bir aracın yerde geçirdiği süre doğrudan m

Toute équipe qui développe un logiciel B2B se heurte au même carrefour la première fois qu'un client sérieux annonce « il nous faut le SSO ». Deux acronymes, OIDC et SAML, prétendant chacun être la réponse, et un internet rempli de tableaux comparatifs qui vous disent que SAML est « entreprise » et OIDC « moderne », pour vous laisser exactement aussi coincé qu'avant. Voici la version qui vous aide vraiment à livrer. Ce qu'ils sont SAML date de 2005 et c'est du XML. Un fournisseur d'identité signe une assertion (« voici alice@bigco.com , voici ses groupes ») et la transmet à votre application, qui vérifie la signature et la connecte. Il a été conçu pour le navigateur et pour l'identité des collaborateurs, à une époque où « l'entreprise » signifiait un Active Directory sur site et une pile SOAP. Il est verbeux, il est ancien, et il est absolument partout au sein des grandes organisations, ce qui est le seul fait le concernant qui compte pour vous. OIDC date de 2014 et c'est du JSON et des JWT, posés sur OAuth 2.0. Un fournisseur d'identité émet un jeton d'identité que votre application valide. Il a été conçu pour le web moderne : SPA, applications mobiles, API, connexion sociale. Il est plus propre, mieux spécifié pour ce que vous construisez réellement aujourd'hui, et c'est le protocole que parle désormais la plupart des nouveaux projets d'identité. Quand chacun l'emporte La réponse honnête à « lequel dois-je développer » est que vous n'avez presque jamais le choix. Vous développez celui qu'a choisi le service informatique de votre client, et il l'a choisi bien avant d'avoir entendu parler de vous. Un client sous Okta, Entra ID ou Google Workspace peut généralement faire l'un ou l'autre, et OIDC est la voie la plus agréable. Un client sous un ADFS plus ancien, un IdP historique sur site ou une grille d'achat rédigée en 2016 vous remettra un bloc de métadonnées SAML et une invitation à un rendez-vous, et la discussion s'arrête là. Vos propres applications maison, votr

每一个开发 B2B 软件的团队，都会在第一次有正经客户说出"我们需要 SSO"时撞上同一个岔路口。两个缩写，OIDC 和 SAML，都自称是答案，而满网都是对比表格告诉你 SAML 是"企业级"、OIDC 是"现代化"，然后把你撂在原地，跟之前一样毫无头绪。这里给你一个真正能帮你交付的版本。 它们是什么 SAML 来自 2005 年，本质是 XML。身份提供方对一份断言签名（"这是 alice@bigco.com ，这是她所属的群组"），然后把它发送给你的应用，应用校验签名并让她登录。它是为浏览器和员工身份场景而生的，那个年代的"企业"意味着本地部署的 Active Directory 和一套 SOAP 技术栈。它冗长、它老旧，而且在大型组织内部无处不在——这才是关于它你唯一需要在意的事实。 OIDC 来自 2014 年，本质是 JSON 和 JWT，构建在 OAuth 2.0 之上。身份提供方签发一个 ID 令牌，由你的应用来校验。它是为现代 Web 而生的：SPA、移动应用、API、社交登录。它更简洁，对你今天真正在构建的东西有更完善的规范，也是如今大多数全新身份方案所使用的协议。 各自何时胜出 对于"我应该构建哪一个"这个问题，老实的答案是：你几乎从来没有选择权。你构建的是你客户的 IT 部门选定的那一个，而且他们早在听说你之前就已经选好了。 一个使用 Okta、Entra ID 或 Google Workspace 的客户通常两种都能用，而 OIDC 是更舒服的那条路。 一个用着老版 ADFS、某个遗留的本地部署 IdP，或一份写于 2016 年的采购清单的客户，会扔给你一堆 SAML 元数据和一封日历邀请，讨论到此为止。 你自己的第一方应用——你的仪表盘和你的移动客户端——要的是 OIDC，没有例外。你绝不会为了让用户登录进你自己的 React 应用而去搬出 SAML。 于是局面清晰地一分为二：现代场景和第一方场景用 OIDC，"因为企业方这么要求"的场景用 SAML。卖给足够多的企业，你就会被要求两者都支持。不是迟早，而是反反复复。 那些坑——也正是自己动手会变得昂贵的地方 SAML 的问题在于它是一种签名 XML 协议，而签名 XML 是应用密码学中最稳定可靠地危险的东西之一。把 SAML 签名校验做错的方式既多又出名： 签名包装（XSW）： 攻击者移动已签名的元素，把一份未签名、伪造的断言塞到你的解析器实际读取的位置。如果你把校验签名和读取断言做成两个分开的步骤，那你大概率就有漏洞——而几乎每一个初版实现做的恰恰就是这件事。 规范化与注释注入： 2018 年那一类漏洞， user@company.com<!---->.evil.com 在签名校验时按一种方式规范化、在你代码读取的字符串里按另一种方式规范化，于是你乐呵呵地把错误的人认证通过了。真实存在的 CVE，涉及多个主流库。 那些更不起眼的： 只签名响应却不签名断言、接受未签名的断言、信任 IdP 提供的颁发者却不做固定校验、把断言的有效期窗口算错。每一个都是自己的一颗地雷，而且每一个都被本该懂行的人发布到了生产环境。 OIDC 明显更理智一些，但也并非没有锋利的边角。你仍然得校验正确的声明（ iss 、 aud 、 exp 、以及 nonce ）、使用 PKCE、拒绝早已作古的 implicit 流程，还要在轮换和缓存 JWKS 时不至于拒掉一个由你尚未拉取的密钥所签名的令牌。区别在于，OIDC 的陷阱有文档可查、是 JSON 形态的，并且在大多数库里默认就被正确处理。SAML 的陷阱是 XML 形态的，已经吞掉过资源远比你充裕的安全团队。 真正的答案 "OIDC 还是 SAML"是个错误的问题，因为对一款 B2B 产品来说，正确的答案是"都要"。你的现代客户和你自己的应用想要 OIDC。你的企业客户会在一个你无法掌控的时间表上强制要求 SAML。只为其中一个去构建，第三通销售电话就会把它打破。 你真正需要的，是一种能接住每个客户带来的任意协议的办法，而不必搭起两套技术栈、两套元数据管线，以及两次各自独立、各自把签名校验做错的机会。实现才是成本所在。选择从来都不是难的那部分。 而这正是 Authagonal 替你卸下的那部分。每个租户都能获得带一键元数据导入的 SAML 2.0，以及与你客户已在使用的提供方对接的 OIDC 联合登录，二者共用同一个登录入口，且任何一种都不收取按连接计费的费用。你不必实现 XML 签名校验，不必照看 JWKS 缓存，也不必在下一个说着另一种协议的客户出现时把这一切重建一遍。 看看都包含了什么。