标签：#t

GitHub announced on July 14, 2026 that Dependabot now waits until a release has been available on its registry for at least three days before opening a version-update pull request. The cooldown is the new default and requires no configuration. Primary source: GitHub Changelog, July 14, 2026 . The product question is not whether three days is universally safer. Waiting may expose a broken or compromised release before adoption, but it can also postpone a needed compatibility fix. Cooldown is a baseline, not a complete dependency policy. Separate normal freshness from security response release -> cooldown -> update PR -> CI -> review -> deploy -> observe A cooldown does not replace lockfiles, CI, provenance checks, staged deployment, or rollback. It should not silently delay an urgent security-update workflow either. Use this decision table before creating exceptions: Package situation Suggested decision Compensating control Routine dev dependency with strong CI Keep default Deterministic tests Runtime package on a critical path Keep or lengthen Canary and fast rollback Identified security remediation Use the dedicated urgent path Security owner and targeted tests Isolated build-only tool Consider shorter Reproducible artifact checks Volatile pre-1.0 package Consider longer Manual release review Internal package released with the app Consider exception Exact-version integration test Parser, auth, crypto, or installer Keep default unless urgency wins Sandbox and abuse fixtures Score the exception Rate each dimension from 1 to 5: blast radius; upstream release volatility; test strength; rollback speed; cost of waiting. Then use two conversation scores: wait_value = blast_radius + release_volatility ship_confidence = test_strength + rollback_speed + cost_of_waiting This is not a statistical risk model. It forces the team to name evidence. Keep the default when scores are close. Consider shortening only when delivery evidence clearly exceeds wait value. Route vulnerabilit

GitHub announced on July 2, 2026 that Issue fields are generally available, including integration with GitHub's MCP server. Primary source: GitHub Changelog, July 2, 2026 . That creates a useful beginner project: validate structured issue metadata before an MCP client—or any program—uses it. The schema below is invented for learning. It is not GitHub's API schema. Define three fields // schema.mjs export const schema = { priority : { kind : " singleSelect " , required : true , options : [ " P0 " , " P1 " , " P2 " , " P3 " ] }, estimate : { kind : " number " , required : false , min : 0 , max : 100 }, customerImpact : { kind : " text " , required : false , maxLength : 120 } }; A schema describes both type and domain rules. estimate must be a number, but it also has to fit the range this project accepts. Validate at the boundary // validate.mjs import { schema } from " ./schema.mjs " ; export function validate ( input ) { const errors = []; if ( ! input || Array . isArray ( input ) || typeof input !== " object " ) { return [ " fields must be an object " ]; } for ( const [ name , rule ] of Object . entries ( schema )) { if ( rule . required && ! ( name in input )) errors . push ( ` ${ name } : missing` ); } for ( const [ name , value ] of Object . entries ( input )) { const rule = schema [ name ]; if ( ! rule ) { errors . push ( ` ${ name } : unknown field` ); continue ; } if ( rule . kind === " singleSelect " && ( typeof value !== " string " || ! rule . options . includes ( value ))) { errors . push ( ` ${ name } : expected ${ rule . options . join ( " , " )} ` ); } if ( rule . kind === " number " && ( typeof value !== " number " || ! Number . isFinite ( value ) || value < rule . min || value > rule . max )) { errors . push ( ` ${ name } : expected ${ rule . min } .. ${ rule . max } ` ); } if ( rule . kind === " text " && ( typeof value !== " string " || value . length > rule . maxLength )) { errors . push ( ` ${ name } : expected at most ${ rule . maxLength } charact

GitHub announced on July 2, 2026 that Copilot CLI no longer needs a personal access token when it runs in GitHub Actions. Primary source: GitHub Changelog, July 2, 2026 . Deleting a secret is easy. Proving the workflow still works—and recovering without hurriedly pasting credentials back into YAML—is the useful part. This is an unexecuted migration template, not a report from a production repository. Make one reversible change First find every place the old secret enters the job, including reusable workflows: git grep -nE 'COPILOT_PAT|COPILOT_GITHUB_TOKEN|GH_TOKEN|github_pat' Record the workflow, job, pinned CLI version, permissions block, and previous known-good commit. Never print environment variables while debugging. Then remove only the PAT injection. Do not upgrade the runner and CLI in the same patch. jobs: copilot-check: permissions: contents: read - env: - COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_PAT }} steps: - uses: actions/checkout@<PINNED_COMMIT> - run: ./scripts/setup-copilot-cli.sh - run: ./scripts/run-bounded-check.sh The scripts are placeholders for repository-owned commands. “No PAT required” does not mean “no identity or permissions exist”; follow the current setup documentation and keep permissions explicit. Add a canary with two proofs The canary should show that the legacy token is absent and that the existing bounded task still satisfies its output contract. name : copilot-cli-auth-canary on : workflow_dispatch permissions : contents : read jobs : canary : runs-on : ubuntu-latest timeout-minutes : 10 steps : - uses : actions/checkout@<PINNED_COMMIT> - name : Verify legacy PAT is absent run : | test -z "${COPILOT_PAT:-}" test -z "${COPILOT_GITHUB_TOKEN:-}" - run : ./scripts/setup-copilot-cli.sh - run : copilot --version - run : ./scripts/run-bounded-check.sh Use a read-only, cheap task. “Fix whatever you find” is not a canary; it is a small deployment wearing a fake mustache. Define pass criteria before clicking Run: absent legacy variables, e

GitHub announced on July 10, 2026 that CodeQL 2.26.0 adds AI prompt-injection detection. Enabling a query is useful; owning a regression test is better. Primary source: GitHub Changelog, July 10, 2026 . The examples below are implementation templates, not results from a repository I tested. Model a path, not a phrase A useful fixture contains an untrusted source, prompt construction, and a model sink: security-fixtures/prompt-injection/ ├── positive/direct-flow.ts ├── positive/helper-flow.ts ├── negative/trusted-instruction.ts └── expected-alerts.json Do not test for the literal phrase ignore previous instructions . Static analysis needs a data-flow path. Preserve a supported SDK call from your production stack so CodeQL can recognize the sink. // Intentionally vulnerable fixture. Never ship this path. import { model } from " ./supported-client " ; declare function loadIssueBody ( id : number ): Promise < string > ; export async function summarize ( id : number ) { const untrusted = await loadIssueBody ( id ); return model . generate ({ system : " Summarize the issue " , user : untrusted , }); } Add a second positive case that passes the value through a helper. Then add a negative control where attacker input cannot select or alter the instruction. A function named sanitize() is not evidence of sanitization. Assert SARIF evidence Uploading SARIF alone does not create a regression gate. Commit the expected rule and fixture location: { "required" : [ { "ruleId" : "REPLACE_WITH_DOCUMENTED_RULE_ID" , "pathSuffix" : "positive/direct-flow.ts" } ], "forbiddenPathSuffixes" : [ "negative/trusted-instruction.ts" ] } Keep the rule ID as a placeholder until it is copied from the CodeQL 2.26.0 documentation or an observed SARIF result. Machine-facing identifiers should never be guessed. A small assertion can compare runs[].results[].ruleId and each physical location against this file. Fail when a required alert disappears or a negative fixture starts alerting. Do not assert the

Applied Computing has raised a $20M Series A to build a foundation AI model for the oil, gas and petrochemical industry.

Syntetica, a French startup that has developed a novel approach to recycling nylon, has already obtained big-name partners and investors.

Last week an AI-generated GPU kernel ran 18.71× faster than an optimized PyTorch baseline. The model—Fable 5—didn't just edge past the human implementation. It lapped it. Claude Opus 4.8 reached 14.4×. GLM-5.2 hit 11.14×. GPT-5.5 managed 4.34×. Fable's kernel was in a different tier entirely. The exciting read: AI is starting to improve the low-level machinery that makes AI itself cheaper and faster. Specialized performance work that once required rare expertise just got dramatically easier to explore. The uncomfortable read: what happens when the best implementation is also the one nobody on your team would have written—or can fully explain? That question is about to land on every engineering team that ships AI-generated code. The Benchmark Problem A benchmark shows the kernel ran fast under tested conditions. It doesn't show: How it behaves across different GPU hardware How it handles numerical edge cases What happens under months of production changes Whether it degrades gracefully when inputs shift The person who wrote it can't answer these questions either. The AI generated this code through a process that doesn't leave a reviewable chain of reasoning. There's no commit message that says "I chose this approach because X." So the reviewer's job just got harder—not easier. The Real Shift I've been watching this pattern across engineering teams this year. The argument is moving from "can AI generate working code?" to "can our org absorb generated code without breaking quality, morale, or judgment?" The GPU kernel story makes the tension concrete: One side says the code ran, it was measured, it won. Stop moving the goalposts. The other side says somebody still has to know where it can fail and take responsibility when it does. Both are right. AI can make implementation cheaper while making proof more expensive. Senior engineers may write less code but spend more time designing adversarial tests, checking assumptions, planning rollbacks, and deciding whether an impr

We open-sourced Tanso Core: a self-hosted monetization engine for B2B AI products. Usage metering, prepaid credits, entitlements, and Stripe billing in one Spring Boot service, with one property the rest of the stack doesn't have. Every metered event carries its cost. Repo: https://github.com/tansohq/tanso-oss The gap If you sell an AI product today, your monetization stack is split across two categories of tools that don't talk to each other. Billing platforms meter usage and generate invoices, but they have no idea what your inference costs. They can tell you a customer consumed 40,000 events. They cannot tell you whether you made money on them. LLM observability tools know your costs down to the token, but they don't bill anyone. They can tell you a feature costs $0.038 per run. They cannot connect that to what the customer paid for it. So margin per customer, the number that decides whether your pricing works, lives in neither system. Most teams reconstruct it in a spreadsheet, quarterly, if at all. Tanso keeps both sides in one ledger. Every event you ingest records what you billed and what it cost you: input and output tokens, model, provider. Margin per customer, per feature, per model is a query, not a project. What it allows Enforcement at ingestion, not at invoice time. Entitlement checks, usage caps, and credit limits are applied when the event comes in. If a customer is out of credits, the check fails now, not on a reconciliation job three weeks later. For AI products, where a runaway integration can burn real money in an afternoon, this is the difference between a limit and a suggestion. Credits as a first-class primitive. Prepaid credit pools per customer, with grants, deductions, expirations, and full transaction history. Most AI products end up selling some form of prepaid usage. Bolting that onto a subscription-shaped billing system is painful; here it's the core model. Stripe as a payment adapter, not the source of truth. Billing state lives in Tan

Part 1 of "Multi-Agent Systems in Production: What They Don't Tell You" — a four-part series...

느린 LLM 호출 중 DB connection을 잡지 않는 이유 AI 기능의 latency는 모델 응답 시간으로만 끝나지 않습니다. 요청이 LLM이나 embedding API를 기다리는 동안 데이터베이스 session까지 긴 범위로 유지하면, 느린 외부 호출이 DB connection pool의 압력으로 전파될 수 있습니다. 이 글은 AI memory OSS인 Honcho의 변경 이력과 pinned source를 읽으면서, 외부 호출과 DB transaction/session 경계를 어떻게 분리했는지 추적한 기록입니다. Scenario Honcho의 dialectic 경로(저장된 memory를 근거로 사용자 질문에 답하는 질의 경로)는 답하기 전에 다음 작업을 수행합니다. peer·session·workspace 확인 -> 관련 memory 검색 -> embedding·LLM 호출 -> 필요하면 tool로 추가 조회·기록 -> 답변 생성 여기에는 짧은 DB 조회와 상대적으로 느리고 변동성이 큰 외부 호출이 섞여 있습니다. 두 작업을 하나의 session scope로 묶으면, DB가 필요하지 않은 대기 시간까지 session lifetime에 포함됩니다. 변경 전에는 무엇이 묶여 있었나 PR #477 직전의 agentic_chat 은 하나의 tracked_db context 안에서 peer와 설정을 읽고, 그 session을 DialecticAgent 에 전달한 뒤, agent.answer() 가 끝날 때까지 같은 context를 유지했습니다. streaming 경로도 같은 형태였습니다. 구조를 단순화하면 다음과 같습니다. DB session open -> preflight read -> DialecticAgent receives session -> embedding / memory tools / LLM answer DB session close commit 0533c6d 의 제목도 이 문제를 dialectic held connection 으로 기록합니다. 다만 이번 분석에서는 실제 pool checkout 시간이나 장애를 재현하지 않았습니다. 여기서 확인한 것은 코드의 session scope와 변경 의도입니다. SQLAlchemy의 session 객체를 만들었다고 곧바로 connection을 점유하는 것은 아닙니다. 하지만 이 경로처럼 SQL을 실행해 transaction이 시작되면 session은 pool에서 빌린 connection을 commit·rollback까지 유지합니다. Honcho의 tracked_db 는 종료할 때 rollback() 과 close() 를 호출하므로, SQL 실행 뒤 이 context를 LLM 대기까지 유지하던 범위를 줄이는 것은 이 경로의 connection 점유 구간도 줄이는 일입니다. 어떻게 경계를 줄였나 변경 후에는 tracked_db("dialectic.preflight") 가 본 작업 전 검증과 설정 조회(preflight), 즉 peer 존재 여부, session/workspace 설정, peer card를 읽는 구간만 감쌉니다. context가 끝난 다음에 DialecticAgent 를 만들고 LLM 답변을 생성합니다. Agent 생성자에서도 DB session 인자가 제거됐습니다. short DB preflight -> 필요한 값 읽기 DB session close agent execution -> embedding / LLM / tools tool needs DB -> tool-owned short DB session -> close 핵심은 DB 사용을 없앤 것이 아닙니다. 요청 전체가 session을 소유하는 대신, DB가 필요한 작업이 자기 범위의 session을 소유하도록 바꾼 것 입니다. pinned current code에서도 유지되는가 분석 기준 commit 85239a6 에서도 이 경계는 유지되고 더 구체화돼 있습니다. src/dialectic/chat.py 의 일반·streaming 경로 모두 preflight context를 닫은 뒤 agent를 실

Every agent-security vendor tells you what they block. Nobody tells you what they miss. That gap is the whole problem. "We stop prompt injection" is a claim you cannot check. You cannot run it, and you cannot tell it apart from the next company saying the same sentence. So security engineers do the rational thing and discard all of it. I published the opposite. It is called the ARE Incident Database , and it is public: https://aredb.org What is in it 32 agent failures that actually happened, each with a real source. A production database dropped during a code freeze. Twenty-five thousand documents deleted in the wrong environment. Credentials read and shipped to an external sink. A budget burned to zero in a loop. Each one gets a stable id ( ARE-2026-001 through ARE-2026-032 ), and each one is mapped to its category in the OWASP Agentic Security Initiative Top 10 , which is the peer-reviewed catalog of what goes wrong with agents. AREDB does not compete with it. OWASP owns the map. This is the cited incidents underneath it. The part that makes it uncomfortable to publish Every entry carries a coverage flag, and the flag is about our own product . We block 23 of the 32 today. Two more are partial, and they say partial. That leaves six of the ten OWASP categories covered at the action layer, and four that we do not cover: ASI06 Memory and context poisoning. We strip the hidden characters attackers use to smuggle instructions into text. We do not read the meaning of the text itself, so this one is only partial, and we mark it partial. ASI07 Insecure inter-agent communication. This is about how agents talk to each other over the network, which a firewall that sits in front of actions never sees. Not ours. ASI09 Human-agent trust. This is a design and disclosure problem. There is no action for a firewall to catch. Not ours. ASI10 Rogue agents. We stop the dangerous actions, but we do not diagnose the misbehavior itself. Partial. A firewall that claimed all ten would be l

If you are like me and use AI often to help with complicated tasks and own a Flipper Zero, you might want a Super Tiny Language Model (STLM). Why this is useful Until now, there have been no language models small enough to run on a small device, such as a Flipper Zero. Flippermind relies on lightweight Python3 installs and a local connection to Qwen2.5-0.5B. Although this is configured for Flipper Zero, you can run it on other small machines like a Raspberry Pi. Challenges Throughout development, I found errors within the language model not loading. PyTorch and Python3 transformers are used to run the Python3 dependencies, and they would not run on Debian Linux distros. I fixed the install.sh to run on any OS. How it works There are a couple main components that make this function. The main function is the qwen_2_5_ask.py script located in tools/ . This is script runs the language model when asked a question. Example: python3 qwen_2_5_ask.py "Hello world" The install.sh file located in main works as the installer for the model. You run it using: bash install.sh You can download it on the GitHub repo linked below. How to contribute To help me continue to work on this, check out our Github Repo If you have questions or just want to talk, talk to me in the comments or email me at hello@syop200.com What do you guys think? Any ideas? I'm curious if anyone has successfully ran other quantized models on hardware with this little RAM—let me know in the comments!

By keeping the number of investments to about 25 per fund, Greylock aims to remain what it calls "the most important partner" to its founders.

I wanted to play with AI image generation without paying for Midjourney or dealing with Discord bots. So I built SnapShift — a free web tool that transforms photos into artwork in seconds. What it does: Upload any photo (portrait, pet, landscape, product) Pick from 50+ styles — cyberpunk, anime, oil painting, Ghibli, movie posters, 3D figurines, and more Download in 1K or 2K quality No signup, no limits, completely free Tech stack: static site on GitHub Pages, AI generation via Agnes API with Cloudflare Worker proxy. Try it: https://snapshit.fun Would love to hear what other styles you'd like to see!

Introduction: The Question Beneath All Questions I think a lot of people are searching for the same thing but using different words. Some people call it: success happiness freedom purpose wealth enlightenment achievement legacy But underneath all of it is a deeper question: "What is worth dedicating my life to?" That question is harder than finding a job. It is harder than making money. It is harder than becoming successful. Because even if I get everything I think I want, I still have to answer: "Why did I want it?" Chapter 1: The Strange Reality of Modern Life We live in one of the wealthiest civilizations in human history. We have: technology beyond anything past generations could imagine medicine that would look like magic centuries ago instant communication across the planet access to unlimited information Yet so many people feel like they are barely surviving. Why? Because humans were built for survival. Our brains evolved to constantly ask: What could go wrong? How do I stay safe? How do I belong? Am I enough? Am I falling behind? The threats changed, but the machinery stayed the same. Ancient humans worried about predators. Modern humans worry about: money careers status loneliness comparison identity the future The battlefield moved from the physical world into the mind. Chapter 2: Money Is Not Evil — Money Is Power There is a tendency to pretend money does not matter. That is false. Money changes what is possible. Money can buy: freedom of time experiences travel education tools comfort opportunities the ability to help others A person with resources has access to a larger range of possible lives. Wanting money does not automatically mean being greedy. Sometimes wanting money is really wanting: freedom adventure security creativity proof that you overcame something The question is not: "Do I want money?" The better question is: "What will I use money for?" Money is a tool. A hammer can build a house or destroy something. The tool is not the meaning. The pu

Não é novidade para ninguém que estamos passando por uma transformação na área de desenvolvimento de software, em que a IA está assumindo diversas atividades. E isso me faz pensar: o que vamos medir, ou o que teremos como parâmetro para qualidade de software daqui pra frente? É sobre isso que vou falar neste texto. Antes das métricas: entenda o momento do seu time Antes de entrarmos nas métricas em si, precisamos entender o momento em que o nosso time está. É muito fácil eu simplesmente jogar métricas aqui e você aplicá-las ao seu time de maneira automática — mas será que elas fazem sentido para o seu contexto? Uma coisa que eu falo bastante aos meus alunos da mentoria que dou na He4rt Developers é: pra que eu quero isso? Softwares representam necessidades do mundo real, logo, medir o sucesso e a qualidade deles vai depender muito das necessidades que eles buscam suprir. Partindo agora para as métricas, eu gosto de dividi-las em dois grupos: Métricas para stakeholders Métricas para o time Qualidade de software não se resume a número de bugs — ela se aplica tanto em como o software é recebido pelo cliente final, quanto em como ele é desenvolvido. Métricas para stakeholders Uma coisa que eu aprendi neste tempo na empresa em que tenho atuado, principalmente com a transformação digital, é que mostrar número de bugs abertos ou resolvidos não mostra para o público o que realmente importa: como está a qualidade do produto. E, para me ajudar nisso, eu sempre tento me colocar no lugar de um cliente que não tem conhecimento profundo sobre o ciclo de desenvolvimento de software. A primeira coisa que eu gostaria de ver quando um QA, ou o time, vier me mostrar os resultados de uma sprint ou de um quarter é: quantos problemas eu tenho em produção — mas não só isso, quanto tempo tenho levado para resolvê-los. Mean Time to Resolve/Repair (MTTR) Essa é a famosa métrica que vai mostrar o tempo que leva desde que o problema é identificado até ele ser resolvido em produção. Dependendo

The companion to the seven things to check before a WordPress major upgrade is the question that comes right after: when do you actually apply it? A new WordPress major drops today. Do you ship it to production tonight? Tomorrow? In a week? Hold for the next scheduled monthly maintenance? This call tends to live in tribal knowledge, but a few clear axes combined together give you a calibration framework you can apply every time without re-deciding from scratch. Here are five axes worth using. Premise — majors are not security patches The first thing to anchor: a major upgrade is not a security patch . WordPress ships security fixes via minor releases ( 6.4.1 → 6.4.2 , 6.5.0 → 6.5.1 — the second-digit bumps ). Those are same-day apply by default . Major releases ( 6.4 → 6.5 , eventually some 6.x → 7.0 ) carry new features and API changes; they aren't released to be applied immediately for security reasons. Without this distinction, the felt urgency of " we have to apply this for security " pushes you to rush majors that should wait. Minors immediately, majors by judgment — that separation is the first rule worth writing down. Axis 1 — wait for x.0.1 For essentially every major release, x.0.1 (the first patch release) lands within 1–3 weeks and absorbs the critical bugs that surfaced after launch. Past examples have included things like "the admin goes white under specific settings," "a particular theme breaks the block editor," "DB migration stalls in specific environments." Nobody hit these on launch day; they emerged as the world started using it for days or weeks. Just waiting for x.0.1 instead of x.0 sidesteps most of those launch-window bugs. For the first few weeks after a major lands, the world's WordPress installations are effectively running the beta test . Being downstream of the people who hit the mines is the rational position for a maintenance practice. Axis 2 — wait until major plugin vendors update "Tested up to" The thing that breaks most after a majo

​I. The Terminal Velocity of Disembodied Intelligence ​The current paradigm of artificial intelligence is approaching a fundamental cognitive ceiling. We have built vast, sprawling minds, yet we have trapped them in sensory deprivation chambers. Today’s Large Language Models and industrial robotics operate under a fatal flaw: the reliance on linear, arbitrary tokenization. Traditional AI chops raw text into disconnected, non-semantic fragments, wasting immense computational memory tracking the mere phonetic order of spelling and grammar. ​Simultaneously, industrial machines navigate the physical world through siloed sensor pipelines. They process light, space, and kinetics as heavy, raw digital arrays, relying on brute-force algorithmic equations to stitch reality together. This is not intelligence; it is computational exhaustion. To achieve true artificial general intelligence, the machine must stop reading about the world and begin to inhabit it. ​II. The Biological Imperative ​Nature solved the hardware-software integration problem millions of years ago. Human biology remains the ultimate benchmark for flawless, metabolic efficiency. Our somatosensory system does not wait for a central brain to read a text string before pulling a hand away from a fire; it processes physical feedback in milliseconds through decentralized neural highways. ​Human cognition leverages cross-modal integration within the angular gyrus, allowing visual data to be instantly cross-referenced with kinesthetic feedback to trigger anticipatory motor reflexes. Furthermore, biological intelligence is inherently tied to physical survival. We manage thermodynamics through a centralized hypothalamic thermostat, protecting the body from cellular destruction, while routing ambient light data to deep-brain structures to drive a natural circadian rhythm. True AGI requires this exact synthesis of abstract thought and biological mechanics. ​III. The Logographic Paradigm Shift ​To bridge the gap between

This continues from Part ③ . We have the system set to refresh data daily, but unexplained errors can sometimes occur. Symptoms The segments were not properly configured as expected. Checking System → Schedule showed that the automatic refresh schedule itself was fine. The data source refresh also appeared to have no issues. Opening the Unify screen, everything looks like it succeeded at first glance — but checking the Performance screen reveals that something is failing during unification. Drilling in further, the failure is happening at the Customer Profiles step. Resolution Steps Attempt to manually re-run just the "Customer Profiles" task → Error persists Redo everything manually from the data source refresh step onwards This resolved the issue successfully. Takeaway Since this is not a misconfiguration issue, patient repetition of the refresh process is enough to recover. Hopefully this saves someone some troubleshooting time.

If you've been working with cognitive architectures that rely on structured memory injection, you likely know the pain of corrupted or incomplete embedding spaces. The latest update to hermes-memory-installer directly addresses a brittle failure mode: missing embeddings in the gbrain module. This fix introduces an automatic, targeted repair mechanism that detects and rebuilds only the affected subset of embeddings, rather than triggering a full reinstall. Here’s what changed, why it matters, and how to benefit from it. The Problem: Silent Degradation in gbrain In a typical setup, hermes-memory-installer populates the gbrain—a specialized long-term memory store—with precomputed embeddings for core concepts, episodic traces, and procedural patterns. These embeddings are the numeric backbone that allows the agent to query, retrieve, and associate memories efficiently. However, under certain conditions—partial upgrades, concurrent memory imports, or incomplete network transfers—the gbrain’s embedding table ended up with holes. Specific embeddings for targeted contexts were simply missing. The agent would still boot, but retrieval quality degraded silently: queries returned null vectors or fell back to generic responses, breaking fine-grained recall. Users reported that their agents "forgot" recent conversations or failed to recognize learned skills, yet no obvious error was raised. Previously, the only remedy was a full reinstall of the memory installer, which wiped and rebuilt the entire gbrain. That was slow, wasteful, and could erase customized embeddings that were working correctly. The Fix: Targeted Auto-Repair The new update ( v2.1.0 onwards) adds a dedicated repair pass during the installation and upgrade routine. Instead of scanning the entire gbrain, the installer now maintains a lightweight manifest of expected embedding keys for each memory context. During setup, it checks the actual embedding store against this manifest. If any keys are missing, it triggers