thekb.eu — Tools & Platforms

DuckDB and the changing physics of analytics

Wed, 26 Aug 2026 00:00:00 GMT

Andy Warfield, an engineer on the S3 team at AWS, published a guest post on All Things Distributed on August 26, 2026, introduced by Werner Vogels. In it, he explains why embedded analytical engines like DuckDB are gaining importance, and announces that DuckLabs, the team that develops DuckDB, is joining AWS. His reading grid is one of a moving "physics." Where the physical sciences explore invariants, systems computing seeks the elegant trade-off against ratios that shift: memory speed versus network speed, richness of abstractions versus available power. He cites three moments — Berkeley's NOW project, his own work on Xen, and the MonetDB and X100 research at Amsterdam's CWI, where the bottleneck of query processing had shifted from disk to CPU — and notes that these constraints recur in cycles. Applied to data, this grid explains distributed processing. Processing is always simpler and more efficient on a single fast machine, but when a server's disk or network card can no longer read the desired volume, one partitions. That was the constraint of the early 2000s, the one that produced MapReduce and then Spark's RDDs. Warfield notes two qualities of these systems: they innovated heavily on developer ergonomics, and they accepted a fixed cost of planning and distribution, betting on throughput gained by adding machines rather than on per-unit efficiency. But the ratios have changed. A current instance offers roughly fifty times the memory, cores, and network bandwidth of the largest EC2 instance from 2007, while dataset growth follows a distribution whose extreme cases form the tail. The 2015 Scalability! But at what COST? paper had already shown that a carefully optimized single-thread implementation could beat distributed frameworks running on one hundred twenty-eight cores. DuckDB, launched in 2018 by Hannes Mühleisen and Mark Raasveldt, applies this logic: an in-process library analytical engine, running in the application's address space, following SQLite's distribution model. AWS became a DuckLabs customer and then a sponsor of the Iceberg extension, alongside its work on S3 Tables; the extension now supports Iceberg v2 and v3 and exceeds 800,000 downloads per week. Warfield does not present the embedded model as a replacement: when a job requires a thousand machines, it requires them. What is changing, he writes, is that much of the work done on data never actually needed a cluster. DuckLabs joins AWS as a subsidiary, with the project remaining open source under the MIT license and under the stewardship of the DuckDB Foundation.

Designing AI with character: what we learned building Berd

Tue, 18 Aug 2026 00:00:00 GMT

Corporate blog post from **Block** (`block.xyz/inside`), **unsigned**, published on **August 18, 2026**, announcing **the open-sourcing of Berd** and laying out the design thesis that guided it. **What Berd is.** *"Berd is a desktop application our teams use to work with AI agents across projects, skills, tools, and models."* Born of an internal problem: Block had access to capable agents — **goose**, **Claude Code**, **Codex** — but each imposed *"different interfaces, configuration systems, and ways of managing context"*. The conclusion drawn: *"we didn't need another model or agent harness, **we needed a consistent environment around them**"*. Berd brings together conversations, files, folders, instructions, agents and skills around **persistent projects**, to stop rebuilding context for every task. **The design thesis.** Give agents **character** — not only through roles, instructions, skills and tools, but through **distinct visual identities**, including a collection of animated characters, the *"Gloopies"*. The problem invoked is that of the empty prompt box: *"the product gives people little sense of how the agent is configured, which context and tools are available to it, and how it differs from another agent"*. The post places the approach in the lineage of **Square** and **Cash App** — bringing design where the category had none. **But the problem stated is a configuration-legibility problem, and the avatar solves distinguishability**; the text acknowledges this in one line it does not develop: *"The avatars make the agent recognizable. **Its role, skills, and tools make it useful.**"* **The architecture.** Berd descends from **goose**, the open source agent framework launched by Block in **January 2025**, contributed to the **Agentic AI Foundation** (Linux Foundation, December 2025) alongside **MCP** and **AGENTS.md**. Explicit division: *"goose remains the open agent framework and runtime. Berd is a desktop application built around it. **Berd connects to goose through the Agent Client Protocol.**"* goose holds the agent loop, Berd holds the experience. **The sequel is Buzz.** Berd served to explore **solo** work; *"But work rarely stays private"*. What Berd showed — *"private space, durable context, recognizable agent identities, reusable skills, visible configuration"* — will feed **Buzz**, the shared human+agent space. *"Start alone, then go multiplayer."* **Caveats.** **No figures, no user testing, no license named**; one isolated overreach (*"create custom agents to do any task they want"*); and a post whose title announces a retrospective while keeping the product in the present tense — **Berd is not declared deprecated, but the roadmap points to Buzz**.

Securing Software at the Speed of AI: What Four Years of Data Reveal

Tue, 18 Aug 2026 00:00:00 GMT

Sonatype publishes, written by its *technical writer* Aaron Linskens, a synthesis of a longitudinal study by its research labs spanning forty-nine months, from June 2022 to June 2026. The method is stated upfront: a fixed cohort of applications tracked continuously, so that the measured variations reflect the evolution of the software fleet rather than that of the customer portfolio. The central result is presented as a contradiction: organizations remediate faster than before, yet their applications accumulate more risk. Four measures frame the finding. *Critical* and *High* vulnerabilities per application were multiplied by 4.31, rising from an average of 14.14 in June 2022 to 54.3 in 2026; the effect is not driven by legacy alone, since excluding legacy applications recently brought under management still leaves a factor of 3.91. Newly affected component versions are advancing at forty-six times the pre-AI rate. The median age of vulnerabilities has fallen 59% since its peak in January 2024. Finally, the average monthly creation of applications was multiplied by 4.84, and with it the dependency decisions. The progress in remediation is real: more than half of resolved violations are resolved in under a day, and the median age of unresolved *Critical/High* vulnerabilities drops from 228 to 126 days, then to 103 days in May 2026. Among cohorts with at least twelve months to act, 52.6% are resolved, 44.3% remain open, and 3.1% are under waiver. The proposed shift concerns the upstream. The researchers examined the vulnerable dependencies that entered the period's applications and asked a simple question: at the time of selection, did a substantially less risky version already exist? The answer is yes in 62.2% of cases on Maven, 46.9% on npm, and 34.3% on PyPI. The text declines to read this as developer fault: some vulnerabilities are unavoidable, others stem from an information gap at the time of the choice — a point that becomes sensitive when an AI assistant can introduce a component in seconds without having up-to-date intelligence on its risk and on organizational policy. The post acknowledges that AI is not the sole cause of the expanding vulnerability landscape and cites four competing factors. It concludes on Sonatype Guide, which brings this intelligence to the point of selection, and points to the full report, *The AI-Era Software Assembly Line*, for the underlying data.

Projects in Buzz

Tue, 18 Aug 2026 00:00:00 GMT

Announcement post from **Block Engineering** signed by **Thomas Petersen** (*Principal Designer & Builder*), published on **August 18, 2026**, introducing **Buzz Projects** — the forge building block of **Buzz**, Block's humans+agents workspace built on **Nostr**. **The problem stated.** *« Software development tools are fragmented in ways the work itself is not. »* The bug report sits in one tool, the discussion in another, the fix on a branch, CI elsewhere, the review in a comment thread, release notes reconstructed after the fact. **The thesis: all of this is one conversation, and the history must be part of the project.** **What Projects delivers.** A **forge hosted on your own relay**: standard Git repositories accessible via `fetch/clone/pull/push` over **Smart HTTP**, *« with no custom tooling or wrapper CLI required »*; **the clé Nostr as a single identity** — *« the same npub that signs your messages signs your pushes »*, with no separate token or GitHub account; **multi-repo projects** that can include repositories one doesn't own (*« you just won't have authority over it »*); issues, pull requests, diffs, inline comments, review and merge; a server-wide **activity feed**; and the **linking of any project to any number of channels**, so that *« the context around a change doesn't disappear the moment agents start writing code »*. From a channel, an issue can be handed to an agent or the agent can be asked to open a PR, which links back to the conversation that produced it; the agent reaches out to the human via the **Inbox**. **The doctrine, in two parts the post never assembles.** On one side, **no prior constraint**: *« No forced guardrails, no limitations on what your agents are allowed to help you with. »* On the other, **a signed record of every act**: *« Every push, review, approval, and merge is a signed Nostr event »*, with a trace of **which agent** produced a patch and **which human** had authorized it. Hence the closing projection: contribution history becomes *« more than a set of colored squares on a profile »*, a **verifiable history attached to a key**, and Block states it is **exploring *« agent trust protocols informed by past behavior »***. **Trust shifts from *ex ante* authorization to *ex post* proof.** The associated framing is explicit: *« A terminal gives an agent somewhere to execute commands and change files, but it does not give it a persistent place in the network. Buzz does. »* **Caveats.** **No figures, no outbound links, no specification** anywhere in the text; **CI and release notes are promised but absent from the inventory**; Projects lives under the **Experiments tab**, and the post disqualifies itself six times — *« Buzz is still in beta and Buzz Projects is still under experiments, so treat it accordingly. »*

GLM-5.3: Frontier Coding with Emergent Cyber Capabilities

Fri, 14 Aug 2026 00:00:00 GMT

Announcement post published on **August 14, 2026** on the **Z.ai** blog (formerly Zhipu AI), **unsigned**, for the launch of **GLM-5.3**. **The methodological thesis.** *« Scaling post-training is all we did for GLM-5.3. »* Same base model as GLM-5.2: **all the gain comes from post-training**, built on the stack from the previous cycle — **IndexShare** (long context), **SAO** (long-horizon RL) and **slime** (asynchronous training, Megatron + SGLang). The bottleneck has shifted from the model to **the environment**: Z.ai describes pipelines that **synthesize** environments and reward signal — a judge agent verifies solvability, **verifiers are synthesized without access to the reference solution**, and are admitted only after a triptych of **oracle / no-op / unsolved-state** controls. The work remains *« human-in-the-loop »*. End-to-end RL throughput improved by **more than 2.3×**. **The coding results.** Terminal-Bench 3.0 goes from **4.6 to 28.3**, DeepSWE v1.1 from **46.2 to 66.9**, Agents' Last Exam from **23.8 to 28.5**. On **Z.ai Code Bench**, an **in-house, private** benchmark, +50% over GLM-5.2, with a simultaneous gain in **token efficiency**: 34.5% at ~75K output tokens at Max effort (versus 23.4% at 96K for GLM-5.2), and 31.4% at ~50K at High effort — ahead of Claude Opus 4.8 (29.5% at 120K). **Claude Fable 5 remains ahead at 39.5%.** The claim *« most capable open-weights model for coding »* **does not follow from the table**: against **Kimi K3**, the score is **3–3 with one tie**. **The cyber capability.** Presented as *« emergent »*, it was **deliberately trained** — the post writes *« we expected this to make the model better »*. What came as a surprise was the **speed**, and the shift from isolated flaws to the **complete exploitation chain**. CyberGym **84.5%** (best in the table), ExploitBench **54.4%** (×2.2), ExploitGym **105/130 tasks** (×3.6 over GLM-5.2, throughput-normalized budgets). Key sentence: ***« Capability is growing fastest exactly where we are furthest behind. »*** **The heaviest number.** Working with Chinese security teams, the model identified **2,436 vulnerabilities in 269 open source projects** — kernels, OSes, browser engines, network protocols — the oldest introduced in **1981**, average lifetime **26.6 years**. The **Security Disclosure Ledger** shows **53 disclosed** and **2,383 under embargo**: **2.2% published**. **Governance.** Weights announced *« in two weeks, once safety evaluation and hardening are complete »* — **a date, not a criterion**: no definition of hardening, no condition for non-release, no third-party evaluator. **Miscellaneous.** `thinking.type: "disabled"` **is no longer supported** (migration required); GLM Coding Plan quotas in points, **50% outside 14:00–18:00 UTC+8**; **nearly all evaluations are conducted in Claude Code 2.1.207**.

DeepSeek Harness developer preview: Everything is a plugin

Thu, 13 Aug 2026 00:00:00 GMT

Product launch page published on **August 13, 2026** by **DeepSeek**, **unsigned**, for the *developer preview* release of **DeepSeek Harness** (`dsh`), a coding-agent harness **open source under the MIT license** whose repository opened the same day. **What the page says.** Two promises, in four hundred words and without a single figure. **« Everything is a plugin »**: every capability — models, tools, skills, sessions, sandboxes, storage, loops, scheduling, interface — is a plugin **swappable through configuration, without modifying the source code**. **« Every run is traceable »**: everything the model sees is recorded in an **append-only session log** — system prompts, reasoning, tool calls and results, subagent scheduling, every context injection — and *« resume, fork, search and replay all operate on the same event stream »*. The core is **Cordis**, a vendored third-party framework, described in an external paper and credited prominently. Four execution modes ship: **Standard** (full tooling), **Code** (tools exposed via a TypeScript SDK to combine several operations into one program), **Minimal** (two tools, persistent bash and `str_replace_editor`, *« for benchmarking models in a minimal environment »*), and **Creator** (runtime inspection, in-memory plugin testing, composition of new modes). Getting started: `npx @deepseek-ai/dsh web`. **What the page does not say.** The strongest claim sits in `docs/architecture.md`: ***« Model-visible means logged. Anything that reaches a model request must be reconstructable from the log, and a runtime invariant asserts it. »*** **A guarantee asserted at runtime**, not a display claim — this is the property that actually sets DSH apart, and it is absent from the marketing copy. The same repository supplies the rebuttal: `SESSION_FORMAT_VERSION` stays at **`0` with no compatibility promise**, *« backends reject old on-disk formats »*, and the README warns in capitals that there will be breaking changes. **Traceable today does not mean archivable tomorrow.** **The business model is in the timeline.** DSH ships on the day of **DeepSeek-V4-Pro's GA** and **three days before** a new API pricing schedule (August 16, 16:00 UTC; off-peak rates at **−50%**). **Harness given away, inference made pricier** — the exact reverse of Anthropic's model. **What checks out.** Swappability holds at least at the model layer: besides the DeepSeek adapter, **`dsh-llm-pi-ai`** makes any OpenAI-compatible gateway accessible *« by configuration, not by code change »*. And the mode Minimal ships the **benchmarking harness** inside the product — an attempt to wrest the definition of the benchmark away from Claude Code, even as DSH's own repository contains a `CLAUDE.md` and a `.claude/skills`.

Buzz (buzz.xyz) — Rapport de recherche pour présentation

Wed, 12 Aug 2026 00:00:00 GMT

Internal research report dated **August 12, 2026** consolidating the public state of **Buzz**, **Block**'s humans+agents workspace launched on **July 21, 2026** under **Apache 2.0**, for presentation purposes. It aggregates Block's two engineering posts, the corporate announcement, the GitHub repository, press coverage, X and **three independent evaluations** — this last layer carrying most of the added value. **The concept.** Buzz merges team chat, a Git forge and automated workflows into a single space where agents are **full members, not bots**. The thesis is Tyler Longwell's: *"The bottleneck moved from intelligence to coordination."* Bradley Axen (Head of AI Capabilities) frames the market stakes: *"Every company is going to need a place where humans and agents work together. The question is whether that place is proprietary or open."* **The architecture.** A **Rust** relay on **Nostr** (NIP-01/42/98/34, 127 *event kinds*), **Postgres**, **Redis**, **S3/MinIO**, **Tauri+React** desktop. Each participant holds a keypair; every message, review, workflow step and Git event is **signed** into a hash-chained append-only audit log. A rare degree of formalism for a **v0.4.x/0.5.x**: multi-tenant isolation mechanized in **TLA+**, authorization properties verified in **Tamarin**. Agent integration goes through **`buzz-acp`**, an **ACP** harness that plugs in goose, Codex and Claude Code and **translates ACP ↔ MCP** — *"They compose through protocols, not imports."* **The central gap.** Jack Dorsey announces *"decentralized, self-sovereign"*; Block's `ARCHITECTURE.md` states: *"The relay is the single source of truth… There is no peer-to-peer event exchange, no gossip, no replication."* A single relay per community, hence a **single point of failure**: decentralization is **organizational sovereignty**, not redundancy. **The limitations, documented.** The unit of permission is **channel membership** — *"channel membership is not fine-grained tool authorization"*; agents run in **`--dangerously-skip-permissions`**, outside any sandbox; **observability is lacking** (*"It doesn't tell me what happens next"*, silent OOM kills). Signed events are *tamper-evident*, not *tamper-resistant*: a compromised relay operator can delete them. On the hosted relay, there is **no end-to-end encryption**. **A figure correction.** The "+33% more work" is the **ratio of completed tasks (20 vs 15 out of 44)**, not a score gain — which rises from 59.1% to 71.5%, i.e. **+12.4 pts**. **Reception**: ~25,900 GitHub stars, a Dorsey tweet at ~2.3-2.7M views, endorsement from Sundar Pichai, and Justin Waldron's formulation: *"the first proper multiplayer agent harness"*. Acknowledged caveats: benchmarks **self-evaluated by Block**, no published hosting price, no adoption figures.

ChatGPT Desktop & Claude Desktop vs versions web — Rapport « What ? — So What ? — Now What ? »

Wed, 12 Aug 2026 00:00:00 GMT

Internal research report dated **August 12, 2026** (in *What? — So What? — Now What?* format, investigation conducted August 11-12) on a simple question: are the **desktop** applications of ChatGPT and Claude better than their **web** versions? The answer comes in two parts. **(A) A solid, well-sourced qualitative consensus exists.** The starting point is indisputable: desktop and web call exactly the same cloud models, the application being merely an interface to the service — the gain therefore lies entirely in the application shell (access latency, stability during long sessions, memory footprint, system integrations, workflow fluidity). What genuinely distinguishes desktop, confirmed: on the OpenAI side, a global shortcut (Option/Alt + Space), a *companion window* that always stays on top, native screenshots, and since July 2026 the **Codex/Work** agentic capability built into the app; on the Anthropic side, **Quick Entry** (macOS), **Desktop Extensions** (installing a local **MCP** server becomes *"as simple as clicking a button"*), access to local files, **Cowork** and **Computer Use** (Accessibility permissions and screen recording). The web retains two confirmed strengths: multiple tabs/threads, and universality without a client to install. **(B) Nearly all the figures circulating to support this consensus do not withstand verification.** The report's critical audit (§1.5) classifies **unconfirmed** seven widely repeated numerical claims: the *cold start* "2-3 s vs 8-12 s" (the only trace being an anecdotal *"loads in about 3 seconds"* on Substack); RAM usage "200-700 MB vs 1.2-2 GB," attributed to an "Alibaba Product Insights" whose pages return **404**; an untraceable glitch rate and session retention figure; a "Claude +10-20% end-to-end" attributed to **Skywork**, which had in fact benchmarked its own Windows agent rather than Claude against the web; an untraceable "Cosmo Edge" source; unconfirmed Zenken AI citations; and two unauthenticated X posts with no URL. The counter-signal is documented with the same rigor: Yuri Dvoinos describes a Claude Desktop app that *"makes me want to throw my laptop out the window"* — 68% CPU usage, input lag on a MacBook Pro — and the report notes that both apps are **Electron** builds with native layers. Hence its formulation: *the desktop advantage is a promise of implementation, not a law of nature.* **The "So What"**: since the model has become the common denominator, the interface becomes the battleground — the **Codex + ChatGPT** merger of July 9, 2026 and the Cowork/Computer Use tandem tell the same story, *"the desktop app is no longer a chat client, it's an agent runtime with access to the machine."* Three consequences: the gain is a **friction** gain, not a power gain; for a CIO, desktop **shifts the trust boundary** — Computer Use requires sensitive system permissions and the Codex merger places code execution, browser, and connectors within *"one expanded trust boundary,"* whereas the browser remains governable via SSO, DLP, and CASB; and for anyone publishing, the fragility of the figures is itself the story. **The "Now What"** delivers individual switching criteria, a CIO checklist (inventory permissions, disable Computer Use and Cowork by default, scope which MCP extensions are authorized, organize distribution and updates — on Linux, outside the apt repository, Claude Desktop does not update itself) and an editorial directive: cite only confirmed verbatims and dates.

Shieldstral : Mistral compile sa doctrine en 3,8 milliards de paramètres

Fri, 07 Aug 2026 00:00:00 GMT

A watch note by **Didier Girard** published on **X** on **August 7, 2026**, which reads the launch of **Shieldstral 1.0 3B** (Mistral AI, August 4, 2026) not as a product release but as **the production deployment of a doctrine**. Starting point: on **May 13, 2026**, before the National Assembly's commission of inquiry into digital vulnerabilities, **Arthur Mensch** refused any oversight role for Mistral over the end use of its models — *"we do not have democratic legitimacy"* — explicitly rejecting **Anthropic**'s stance. Less than three months later, Mistral releases a **moderation model**. The author dismisses the apparent contradiction: **Shieldstral carries no taxonomy of the licit and the illicit**, it answers a **question the user writes**. **The mechanism is the heart of the note**: a three-part prompt (context + severity / a single closed question / the content to be judged), a `yes` or `no` response, and the **softmax over these two tokens** produces a continuous score between 0 and 1. **The moderation policy is not in the weights, it is read at inference time** — whereas **Llama Guard 4** embeds the MLCommons taxonomy fixed at training time, Shieldstral reads yours in natural language, modifiable **without retraining**. The technical report (**arXiv:2607.25857**, July 28, 2026) quantifies the cost of this choice: fine-tuning on public data alone = **61.1% F1** on policy adaptability; **4.4 million contrastive pairs** generated by an LLM (the same content rewritten to violate a policy but not its sibling policy) = **+23.3 points**; **91.3%** after merging three checkpoints. Characteristics: **3.8B actual parameters** (the "3B" in the name rounds down), **Ministral 3** base + **Pixtral** vision encoder, **12 languages**, **16 GB of VRAM in BF16**, **Apache 2.0**. Text performance: **84.9% average F1**, on par with **GPT-OSS-Safeguard-20B** (seven times larger), ahead of **Qwen3Guard-8B** (84.0) and far ahead of **LlamaGuard-4-12B** (69.1). **A caveat raised by the author himself**: *all these figures come from Mistral, on test sets selected by Mistral, and no third-party evaluation existed as of August 6*. The note's structuring thesis is an **opposition of topologies**: at **Anthropic**, the guardrail lives **in the weights** and the publisher arbitrates who is exempt from it (**Claude Fable 5** public with safety measures / **Claude Mythos 5** without, reserved for approved cyberdefenders of **Project Glasswing**, June 9, 2026); at **Mistral**, the guardrail **sits outside the model** — a separate, open, self-hostable component, whose policy belongs to the deployer. Explicit customer alignment (ministry of the Armed Forces, BNP Paribas, French and Luxembourg government administrations). The note closes on a **setback documented in three points**: **auditability** (binary output, no reasoning trace, while the deployer inherits the burden of justification under an AI Act audit), **robustness** (the first chapter of Voltaire's *Treatise on Tolerance* classified as "calls for violence" by a tester on the Hacker News thread — a mention/endorsement confusion), **availability** (as of August 6: no billed endpoint on La Plateforme, no official Ollama). Three deployment rules to close.

Agent Plugins package your skills, tools, and more

Thu, 06 Aug 2026 00:00:00 GMT

Engineering post from **Google** on **August 6, 2026** announcing that the company joins as **Core Maintainer** the **Agent Plugins 1.0.0** specification — an open, *vendor-neutral* packaging format for distributing **Agent Skills** and **MCP servers** together. **The governance fact first.** The specification was published by a TSC of Core Maintainers from **Amazon, Cursor, Microsoft, OpenAI, and Vercel**. Google joins them, represented by name through **Kevin Hou** (Google DeepMind). Six competitors agree on a packaging layer. **Anthropic does not appear on the list of maintainers**, even though the two packaged building blocks come from it. **The diagnosis.** A skill is portable, an MCP server is portable — *"The core problem isn't the components. It's the manifest."* What has never been portable is the box: directory layout, manifest metadata, the shape of the MCP configuration, and transport inference differ from one client to another. People fork, maintain two copies of identical components, and they drift apart. **The format.** *"A plugin is a directory. That's the whole idea, and the restraint is the point."* A `plugin.json` reduced to `$schema` and `name`; skills in `skills/`, in the Agent Skills format; servers in `mcp.json`, **with an explicit `type`** on each entry (stdio, Streamable HTTP, legacy HTTP+SSE). The strength of the design lies in what the manifest **cannot** do: neither relocate a component nor declare it inline. So there is no discovery path to configure, no precedence order to learn. Corollary: **components fail independently** — a server that fails to start does not take the skills down with it. A **reverse-domain** directory (`com.example.client/`) serves as a proprietary extension space, ignored by other clients: the portable core stays small because the non-portable parts have somewhere to go. **The limits, openly stated.** A whole section explains **when not to make a plugin** (a single MCP server, a single skill: unnecessary). Another lists what v1 excludes: **installation, distribution, permissions, sandboxing, trust and provenance verification, UX**. Justification: the obligations of an IDE, a CLI, and an enterprise platform genuinely differ. **The stack.** Find (**Agentic Resource Discovery**), describe (**AI Catalog**), package (**Agent Plugins**), run (**MCP + Agent Skills**) — each layer independently adoptable. **Shipping today**: **Agents CLI** (usable from Antigravity, Gemini CLI, Claude Code, or Cursor) and **Data Agent Kit** (BigQuery, Spanner, Cloud SQL). *"Those skills were already distributable. Now they're distributable in a format that isn't ours alone."* Closing line: *"Packaging is unglamorous infrastructure,"* and that is precisely what should be shared rather than reinvented five times.

Graphify — Knowledge Graphs for AI Coding Assistants (site graphify.net : vitrine, annuaire d'outils et galerie de dépôts graphifiés)

Thu, 06 Aug 2026 00:00:00 GMT

The **graphify.net** site, accessed on August 6, 2026, officially owned by **Safi Shamsi**, creator of the open source graphify skill. The domain carries three things distinct from the commercial platform `graphify.com` and the GitHub repository. **A product showcase**, first: presentation of graphify, usage guides, CLI reference, pages on tree-sitter and Leiden clustering. **A demo gallery**, next, and it is the most compelling part: **100 already-graphified GitHub Trending repositories**, totaling **854,079 nodes and 1,932,930 edges**, filterable by language and size, each showing its node, edge, and community counts, with a graph preview and detail page. Showing the tool running on well-known repositories is worth more than a pitch, and it produces, as a byproduct, a public dataset of comparable graphs. **An editorial directory**, finally, which has value independent of the product it promotes: **30 AI coding client guides** compared on workflow, agents, pricing, security, and delivery fit; an **MCP server directory** rated on transport, runtime, supported clients, setup effort, and **access risks**; pairwise comparisons on aligned fields. The site claims a method — *« source-reviewed »*, official evidence, explicit unknowns — and is available in six languages. **This fiche exists mainly to record a discrepancy.** On the same day, the site announces **« 3.7k+ GitHub stars »** when the API counts **103,187**; it states **three times** an **MIT** license when the repository's `LICENSE` file is **Apache 2.0**; and it highlights the **« 71.5× token reduction »** claim, which belongs to the v1-generation README and has disappeared from the current version in favor of LOCOMO and LongMemEval benchmarks. The site thus describes a product several generations old. **The license error is the most serious one**: MIT and Apache 2.0 do not carry the same obligations, notably on patents and the disclosure of modifications. A strategic observation remains: **a tool vendor building the directory of its own category** occupies the evaluation query ahead of its competitors. The claim of neutrality does not remove the conflict of interest — graphify appears among the site's featured skills. A useful entry point, not an arbiter.

graphify — « Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI: local deterministic AST parsing, every edge explained, no vector store. »

Thu, 06 Aug 2026 00:00:00 GMT

**graphify** (Safi Shamsi, Graphify Labs, Y Combinator S26) turns an entire project into a **queryable knowledge graph**, invoked via `/graphify` from Claude Code, Cursor, Codex, Gemini CLI, and about fifteen other clients. Observed on August 6, 2026: **103,187 stars** for a repository created on April 3, Apache-2.0, Python. **Three design choices underpin the project.** **Code is parsed locally** into a tree-sitter AST, without an LLM: deterministic, nothing leaves the machine, no API key required for a code-only corpus. **Every edge carries its provenance** — `EXTRACTED` if explicit in the source, `INFERRED` if graphify resolved it —, *"so you can tell what was read directly from what was inferred"*. And the project defines itself **against vector RAG**: *"Not a vector index. No embeddings, no vector store: a real graph you traverse."* **Usage replaces grep.** `query` returns a subgraph for a natural-language question, `path A B` traces the path between two entities, `explain` unfolds a concept. Three outputs: an interactive graph, a readable report (god nodes, surprising connections, suggested questions), and a persistent `graph.json`, queryable weeks later. **Coverage extends beyond code**: 36 tree-sitter grammars, but also SQL, Terraform, Apex, **MCP configurations**, package manifests, Office, PDF, images, and video transcribed locally. `# WHY:` comments and design rationale become **first-class nodes linked to the code they explain**. **The benchmarks call for a careful reading.** On LOCOMO, graphify dominates recall (0.497 versus 0.149 and 0.048) but **loses on QA accuracy** (45.3% versus 49.7%); on LongMemEval-S it **matches a dense RAG** at 76%. The line that matters is elsewhere: *"Graph build — LLM credits: 0"*. The defensible differentiator is **cost and traceability, not answer quality**. **Three caveats.** The `main` branch carries an outdated v1-era README describing a different product: read `v8`. The PyPI package is named `graphifyy`, while the name is being reclaimed. And a **local query log** is active by default, which can be disabled via an environment variable. The skill also serves as an entry point to a commercial waitlisted platform at graphify.com, which continuously applies the same approach to the entire working context.

Introducing Muse Code and Muse Spark 1.2

Wed, 05 Aug 2026 00:00:00 GMT

Announcement from **Meta AI Research** dated **August 5, 2026**: **Muse Code** in beta, a terminal coding agent, and **Muse Spark 1.2**, the model that powers it. Meta itself frames the launch — *« our next step toward the frontier, with larger and much more capable models on the way »*. **On the harness side, three decisions.** **Asynchronous background agents** that *« remain active throughout each session, rather than being spawned for individual tasks »*, avoiding redundant information gathering and deciding for themselves when to escalate to the main agent. A **local event log** recording every model call, tool run, approval, and edit, which makes the runtime *« replay-exact and restart-safe »*: after a crash, the agent resumes exactly where it left off. And three **skills shipped out of the box**: `/plan` (a plan submitted for approval), **`/grill`** (stress-tests the plan until it holds up), and `/goal`. **On the model side**, Meta claims **co-training with the harness** *« to maximize harness compatibility »*, long-horizon training (whole repo, end-to-end projects, self-research, context compaction), and a self-improvement loop where version 1.1 generates the environments and grades the solutions, producing the training set for 1.2. **The central fact of this announcement is nowhere stated in its text.** The four published comparisons exist only as images, and they place Muse Spark 1.2 **behind Opus 5 in all four cases**: 82.9% versus 86.7% on Terminal-Bench 2.1, 59.3% versus 65.0% on DeepSWE 1.1, **70.6% versus 79.4% on Meta's own internal benchmark**, and +68.7% versus +74.0% on the GPU kernel optimization case study, where the model finishes **fourth out of six**, behind GPT 5.6 Sol and behind Anthropic's previous generation. **And the model's own gain is smaller than it appears.** On the two public benchmarks, version 1.1 is evaluated with `mini-swe-agent` and 1.2 with Muse Code: the 6.7-point gap conflates model and harness. On the internal benchmark, the only comparison with no harness indicated, it drops to **2.3 points**. The announcement therefore stands mainly as **empirical confirmation** of a thesis already stated: value is shifting toward the harness, and a harness co-trained with its own weights makes those weights all the more non-interchangeable.

Announcing Cloudflare Wallets: the programmable wallet for the agentic Internet

Tue, 04 Aug 2026 00:00:00 GMT

Product announcement published on the **Cloudflare** blog on **August 4, 2026** by **Will Papper**, as part of **Agents Week**: **Cloudflare Wallets**, presented as *"the programmable wallet for the agentic Internet"*. **The problem stated** is precise and well chosen: an agent that wants to try an API has to go through a login page **designed for humans**, have a human add a payment method, generate an API key, then figure out how to call the service. Two structural gaps explain this — *"Agents do not have a stable identifier to sign up for an API, and they do not have a native way to pay for APIs"* — with the consequence that *"AI agents often give up on these tasks entirely, kicking registration, payment methods, and API key generation back to humans"*. **The proposed architecture comes down to two wallet types**: **Account Wallets**, intended for humans who own a Cloudflare account (fund, delegate, withdraw), and **Virtual Wallets**, intended for agents, **operating via API key** and whose spending cap is **set by the account holder**. The announced guardrails are explicit: **allocation, allow list, maximum amount per transaction**. **The payment rail is the x402 protocol** (payments attached to HTTP requests) and the currency is **stablecoin** — which places the offering in a distinct camp from schemes built on card networks. **The most interesting argument is counterintuitive and central**: *"These limits may seem like constraints, but counterintuitively they give agents more freedom. If an agent is responsible for $10, you can worry less about its spending than if it is responsible for $1,000."* → **the cap is not what constrains autonomy, it is what makes it acceptable.** **Second component, more strategic than the first**: identity, via a **`cloudflare.pay`** namespace — a research agent could live at `research.example.cloudflare.pay`, giving the merchant certainty that it is talking to the agent of an identified organization. Cloudflare claims a deliberately minimal ambition (*"a human-readable identifier for a not-very-readable keypair, similar to the URL and IP-address pairings used in DNS"*), built on its existing building blocks (**Turnstile**, Bot Management, **Web Bot Auth** and its keypairs), and states its intent to adopt the schemes of the **x402 Foundation** as they emerge. **A decisive caveat about the status of the text**: **almost everything is in the future tense**. What exists on the day of the announcement is the **reservation of a handle**; payments, Virtual Wallets, guardrails, and the ramps for accessing funds are announced (*"Soon, you will be able to…"*). This is a **staking of position on a namespace**, more than a service going live.

How to use Notion as Code

Mon, 03 Aug 2026 00:00:00 GMT

**Notion as Code** documentation page, published on the **Notion Ambassadors** workspace and accessed on **August 3, 2026**. Product in **closed alpha / waitlist**, with a warning up front: *« This product is under development so we recommend you try it out in a new workspace vs. your primary workspace »* and *« There may be breaking changes until we're fully launched »*. **The principle is infrastructure as code applied to a documentary workspace**: *« Instead of having to make individual public API requests, you can describe the final state and we handle updating your workspace to match. »* Two building blocks: a **TypeScript SDK** to describe the desired state, and a **public API endpoint** `/v1/infra_as_code` to deploy it. **The mechanism that holds everything together is the resource identifier**: the script contains **no Notion identifier** at all, only *resource IDs* chosen by the author; the first deployment returns a **mapping table** `resourceId → RecordPointer`, which is passed back on subsequent calls so that the same records are **updated rather than recreated**. Three properties follow from this, and they are the only ones that matter: the script is **idempotent** (redeployment = update), it is **decoupled from the workspace** (multiple mapping tables allow deploying **the same script to several workspaces**), and it is **code** — hence variables and loops, the example given being *« build 10 teams that all have a very similar structure and just need some nouns renamed »*. **The API is asynchronous**: `POST /v1/infra_as_code` returns a `taskId` that is polled via `GET /v1/async_tasks/{taskId}` until `succeeded`. **Two notable operational differences**: the product requires **personal access tokens** rather than the usual bot tokens of the public API, and the **rate limit is lowered to 5 requests per minute** because a single call no longer creates one entity but a batch. **Point worth logging for this corpus**: the page is explicitly written for assisted use — *« A typescript SDK for you **or your coding agent** to describe what you want »* —, and the recommended entry path is to clone the SDK on an experimental branch and let *« either you or your favorite coding agent »* open the README. **Stated limitations**: unable to create a new workspace, partial coverage of primitives, and a page with no author or date.

hyperresearch — « The Most Powerful Deep Research Harness » / « Agent-driven research knowledge base. Agents collect, search, and synthesize web research into a persistent, searchable wiki. »

Mon, 03 Aug 2026 00:00:00 GMT

**Skill** entry: **hyperresearch** by **Jordan Gibbs** is a **deep research harness** that turns Claude Code into a documentary research agent, shipped as a PyPI package (MIT, Python 3.11-3.13) installing **20 Claude Code skills**, a CLI, an MCP server, and a local web UI. Observed on **August 3, 2026**: 1,568 stars, 170 forks, repo created on April 9, 2026, last push on August 1. **The core is a 16-step pipeline adaptive by tiers** — `light` (~30-40 min), `full` (~1.5-2.5 h), `dissertation` (4-8 h, 25,000-80,000 words across 300-450 sources) — which takes a prompt and returns an adversarially audited report with full provenance. **The central architecture decision is documented alongside its failure mode**: the entry skill is a **thin router** with no procedure, each step living in its own skill loaded **fresh at the moment it is invoked**, because the previous version was *« one 1200-line skill that got compacted away by the time Layer 4 needed its triple-draft procedure. The orchestrator forgot the procedure, wrote a single draft, and produced a flat-scoring report. »* **Two load-bearing principles.** *« Patch, never regenerate »*: after synthesis, only surgical `Edit` touch-ups are possible, with the patcher and the polish auditor tool-locked to `[Read, Edit]` at the Claude Code allowlist level, so that they *« physically cannot Write a new draft »*. *« Canonical research query is gospel »*: the verbatim prompt is persisted once in `query.md` and re-read by every step and every subagent. **Sixteen subagents** with configurable role and model (fetchers and cite-checker on Sonnet, critics, synthesizer, and patcher on Opus). **The vault** is a persistent markdown store indexed in SQLite — *« Markdown is truth, SQLite is cache »* — with a note lifecycle (`draft → review → evergreen`, `stale → deprecated → archive`), traceable provenance, a composite quality score (source type, citation authority via OpenAlex and Semantic Scholar with retraction flags, internal PageRank), and an **independence audit** that groups syndicated copies together — *« five reprints of one press release argue with the weight of one source »*. **Three mechanical gates before shipping**: citation integrity (every quoted citation must exist **verbatim** in a vault note), a retraction sweep refreshed on every cited DOI, and a citation-to-sentence link check by a skeptical LLM. **Reservation to flag**: the opening claim — *« currently leads the DeepResearch-Bench RACE leaderboard »* — is contradicted by its own footnote, *« forward-looking projection from a stratified pilot… Third party validation is pending »*. A projection is not a ranking, yet the chart places it ahead of Gemini and OpenAI Deep Research.

Agent Client Protocol — Introduction

Sun, 02 Aug 2026 00:00:00 GMT

Introduction page of the **Agent Client Protocol** specification, accessed on August 2, 2026. A living artifact with no publication date: the fiche is dated by its observation. **The problem.** *« AI coding agents and editors are tightly coupled but interoperability isn't the default. »* Every editor must build a custom integration for every agent it wants to support, and every agent must implement each editor's specific APIs. Three distinct costs follow: **integration overhead** (any agent-editor combination requires specific work), **limited compatibility** (an agent reaches only a fraction of editors), and **developer lock-in** — *« choosing an agent often means accepting their available interfaces »*. **The solution.** ACP standardizes agent-editor communication *« similar to how the Language Server Protocol (LSP) standardized language server integration »*. The benefit is mutual and is what holds the ecosystem together: an agent that implements ACP works with any compatible editor; an editor that supports ACP gains access to the entire ACP agent ecosystem. *« This decoupling allows both sides to innovate independently. »* **The architecture.** ACP assumes the user is **primarily in their editor** and reaches for an agent there for a specific task. Two deployment modes: **local** agents run as a subprocess of the editor and communicate over **JSON-RPC on stdio**; **remote** agents, hosted in the cloud or on separate infrastructure, communicate over **HTTP or WebSocket** — support declared *« a work in progress »*, with active collaboration with agentic platforms. The second mode is regularly omitted from secondary coverage, even though it charts the protocol's enterprise trajectory. **The link to MCP** is closer than an architectural complementarity: ACP *« re-uses the JSON representations used in MCP where possible »*, while adding types specific to agentic coding UX — **diff** display is the example given. The default format for readable text is **Markdown**, chosen precisely so the editor is not required to render HTML. **Two observations about the source itself.** The navigation exposes **v1 (Latest)** and **v2 (Draft)** — not the "ACP 1.2" that circulates elsewhere. And it links **Zed Industries and JetBrains at the same level**, next to an **ACP Registry**, **RFDs**, a Community section, Publications, Updates, and a Brand page: the structure of a co-governed project with a process. Official libraries in Kotlin, Java, Python, Rust, and TypeScript.

ACP : deux protocoles, un sigle, zéro rapport

Sun, 02 Aug 2026 00:00:00 GMT

Tech-watch note from **August 2, 2026**, born from a colleague's question — *"what is ACP?"* — which the author shows has no simple answer: **three protocols compete for the acronym**, with no technical overlap whatsoever. **Agent Client Protocol** connects **a client to an agent**. Introduced by **Zed** in August 2025, it does for agents what **LSP** did for languages: it decouples the editor from the agent. Before, N editors × M agents required **N×M** custom integrations; afterward, everyone speaks the protocol and **N+M** suffices. JSON-RPC 2.0 over stdio, Apache-2.0. The note points out that the protocol has left its creator's orbit — its own organization, an agent registry, a versioned specification, a JetBrains implementation. **Agentic Commerce Protocol** has nothing to do with it: it connects **an agent to a merchant** (discovery, cart, payment). Announced by **OpenAI and Stripe** on September 29, 2025, it faces **Google**'s **UCP** (January 11, 2026), backed by **AP2** for payment. The stakes: the "Visa/Mastercard" layer of agentic commerce. **Agent Communication Protocol** (IBM Research / BeeAI), agent-to-agent, rounds out the picture and pollutes searches. **The observed problem is documentary.** The author searches "ACP" in their tech-watch database: **twelve results, all about the commerce protocol, zero about Zed's**. The indexing agents had processed the acronym without disambiguating it. Hence the rule adopted: ***"a bare acronym is never indexed"*** — the entity is the full name, the acronym is only an **alias**, here carried by three distinct entities. The note dispels a related confusion in passing: **MCP** connects an agent to its **tools**, **ACP** connects a **client** to an **agent**, and the two **stack**. **The concrete case is Buzz**, published by **Block** on July 21, 2026 under Apache-2.0: a self-hostable workspace on **Nostr** where humans and agents share the same channels, each participant being a **key pair** and every event — message, workflow step, git push — being **signed** in an append-only log. The agent architecture is entirely protocol-based (`buzz-acp`, `buzz-agent`, `buzz-dev-mcp`), hence the agnosticism: **Goose, Claude Code, and Codex** through the same harness, and **Hermes** connected without a single line of code on Block's side. *"N+M instead of N×M, running in production."* **The punchline concerns the Claude subscription** versus third-party agents, after a turbulent 2026 (OAuth block, separate credits announced then suspended the day they took effect). The line drawn separates **ordinary, individual** usage from **routing other people's requests**. Its formulation holds beyond this case: *"the distinction is not legal, it is architectural: **who is consuming, and on whose behalf**"* — to be settled at design time rather than by reading the terms of service.

Buzz!

Tue, 21 Jul 2026 00:00:00 GMT

**Block** announcement from **July 21, 2026**, signed by **Tyler Longwell**: **Buzz**, an *open source* and **self-hostable** channel-driven workspace where humans and agents share the same room — chat, search, automation, and **Git hosting** on a single server, built on **Nostr**, an open protocol for signed messages and portable identities. Opening thesis: *« Models can do the work now. Teams still need somewhere to do it together. The bottleneck moved from intelligence to coordination. »* Three engineering pieces. **(A) Agent identity.** The starting point is a refusal — to stop lending one's credentials to a bot: *« We have been letting bots play dress-up as us. It's weird. It's dangerous. »* Each agent gets **its own key**, its owner signs a **narrowly scoped authorization**, and the agent then signs its work with its own identity. The delegation cryptography is conventional; the design decision is less so: *« authorization does not erase authorship »* — the agent remains the author, its *credential* proving who authorized it and under what conditions. Immediate consequences: a leaked agent key is revoked without touching the human identity, and withdrawing the owner prevents the agent from reconnecting, with its active sessions needing to be terminated separately. **(B) Git on object storage.** The observation: *« In the past, Git has always had a convenient rate limiter: humans »* — a group of agents produces months of person-commits and CI in a single afternoon, with many simultaneous writers, on forges sized for human fingers. Buzz stores repositories as **immutable, content-addressed packfiles** plus a **single mutable manifest pointer**; a *push* writes the objects first, then advances the pointer via **conditional compare-and-swap**, that swap being the commit point — workspace events announce the change, they do not define it. The protocol is **specified in TLA+ and model-checked** (durability, reconstruction, concurrent pushes), with the bounded result depending on three explicit object-store guarantees, hence a **conformance suite** every backend must pass. **(C) Interoperability and privacy.** Claude Code, Codex, goose *« and any agent speaking Agent Client Protocol »* work inside Buzz; switching model or harness leaves the project's identity, permissions, and history intact. Telemetry and cancellation travel as ephemeral encrypted messages, memory and cost accounting as durable encrypted messages — *« the server sees routing metadata, not those payloads »*. Memory argument: *« A conventional forge preserves the diff and a green check. Buzz also preserves why the obvious fix was wrong. »* Anti-lock-in argument: if Buzz disappears, the identity and signed history remain verifiable, Git stays Git.

ADHD — a skill for agents (Parallel Divergent Ideation for Coding Agents)

Mon, 20 Jul 2026 00:00:00 GMT

Udit Akhouri releases **ADHD** ("a skill for agents"), an open source project (MIT, v0.1.4, ~1,000 stars) that tackles the **premature convergence** of autoregressive reasoning: an LLM anchors on its first idea, and tree-based methods don't really escape it — "Tree-of-Thought widens the search but traverses a single shared context, so the anchoring persists across branches." The project's stance: this is an **architecture problem, not a prompting problem**. The mechanics consist of two **watertight** phases. *Diverge*: N parallel, **isolated** agent calls — no shared context — each receive the problem through one of **15 cognitive frames** deliberately distorted (with selection logic and custom frames), under a system prompt that **forbids evaluating**. *Focus*: a **separate** critic, with an opposite system prompt, scores the ideas (originality, viability, fit), clusters them by underlying angle, **flags the traps with their reasons**, and deepens the best survivors. The generator/critic separation is "mechanical": distinct LLM calls, not roles simulated within a single context — the same intuition as the separate-context adversarial review of the Bun project ([[sumner-bun-rewrite-rust-claude-2026-07-08]]). The signature demo compares, on "a CLI that calls an LLM and sometimes freezes for 90s," the baseline (4 textbook patterns: progressive timeouts, exponential backoff, hedged requests, streaming — "the answer a senior gives in 30 seconds") against ADHD: 30+ ideas across 6 clusters, **20 named traps**, and a non-obvious pick — the **"rage-quit"** button that animates with the wait and instantly reroutes the request to a faster, cheaper model, because "the slow model might just be the wrong model for this prompt." On 6 open problems, the author's evaluation (LLM judge) gives breadth 9.00 vs 4.83, novelty 7.83 vs 2.67, **trap detection 9.50 vs 1.83**, actionability 9.50 vs 6.50 — self-reported figures, to be read as claims. Distribution runs through the **skills** ecosystem (same channel as [[skill-pocock-grill-with-docs-2026-06]]): `npx skills add UditAkhourii/adhd` auto-detects ~50 agents (Claude Code, Cursor, Codex, Cline, Gemini CLI, Windsurf…), invocation via `/adhd` or auto-triggering on ideation intents, a CLI and an npm library, all built on the Claude and Codex Agent SDKs. Traction is tangible: a feature on The New Stack, a preprint, adoption by repowire (PR #313 merged — the frames become "peers" of the mesh-orchestrator), mstack (`think` plugin), zk-flow-oss, and an independent research review (testdouble/han) whose findings live on in public issues. Takeaway: useful divergence isn't prompted, it's **architected** — through context isolation and the mechanical generator/critic opposition.

Fact-checking : synthèse sur Delos (Delos Intelligence / delos.so)

Mon, 20 Jul 2026 00:00:00 GMT

This note verifies a tech-watch synthesis on **Delos Intelligence** (delos.so), a French B2B generative AI startup, by comparing it against primary sources (Alexandre Dewez's "Overlooked" post / 20VC, April 15, 2025, the official website, official registries) and specialized press. The backbone is **reliable**, but several figures need requalification. **Funding — confirmed.** Delos raised **€2.5M in a seed round** — ≈$2.74 to $2.83M depending on the conversion — a round **announced mid-April 2025**, led by **20VC** (Harry Stebbings), with **Inovia Capital, Kima Ventures (Xavier Niel) and Plug and Play**. Notably, the list of **business angels**, exactly the kind of information an LLM can hallucinate, is **confirmed word for word** by the lead investor's press release — Éléonore Crespo & Romain Niccoli (Pigment), Florian Douetteau (Dataiku), Thibaud Elzière (Hexa), plus Mark Goldberger (Ramp) and Antoine Freysz (Kerala), the latter two *missing* from the initial synthesis. However, **no Series A has closed**: it is only **announced as an intention** ("several tens of millions of euros by March 2026"), with no press release or database entry. **Business model — partially accurate.** **Credit-based** SaaS (1 credit ≈ a simple query). The actual pricing grid is richer than "€25–80": **Student €10, Explore €25, Advanced €45, Premium €80** (increasing credit volumes), plus **Enterprise on request**. The **individual/B2C offering is indeed real**, but the core target remains **B2B**. Orchestrated models: ChatGPT, Claude, Mistral, Gemini, Cohere, Llama. **Sovereignty** (Scaleway hosting) was **still being finalized** at the end of 2025, with compute still partly running on Azure (France), with a full switch to Scaleway targeted for early 2026. **Team and clients — partially accurate.** Founded on **July 2, 2023** by brothers **Pierre** and **Thibaut de la Grand'rive**. The "**50**" headcount figure is **not sourceable**: ~20 in April 2025, about forty by late 2025. **200 client companies** confirmed; clients **TotalEnergies, Shiseido, Groupe Casino** confirmed (plus Allianz, Best Western, BPCE, the French Ministry of the Armed Forces…). User numbers (10,000 → 100,000+) and **ARR** are **self-reported**: no overall ARR has been published, and the only mention ("$1M ARR in a few days") refers to the **Workers product alone** and is unaudited. **Cross-cutting lesson**: a fact-check grades levels of evidence (confirmed / partial / speculative / not sourceable / self-reported) rather than issuing a binary verdict — and verifies a plausible piece of information before suspecting it of being a hallucination.

Amazon, Microsoft, and Google are converging on the same enterprise agent architecture

Mon, 20 Jul 2026 00:00:00 GMT

In nine months, Amazon, Microsoft, and Google have each launched or renamed an enterprise agent platform, and **all three have converged on the same architecture**: runtime, memory, tool gateway, identity, observability, and governance now appear in **Bedrock AgentCore**, **Microsoft Foundry**, and the **Gemini Enterprise Agent Platform**, under different names. What was a fragmented collection of libraries 18 months ago is becoming a distinct **platform layer**. To read where this leads, Janakiram MSV invokes the **2011-2016 PaaS inflection**. Before, teams assembled VMs, load balancers, queues, secret stores, and monitoring agents, each with its own API. **Cloud Foundry** and **Heroku** unified these pieces around an **application contract**: the application declares what it needs and stays agnostic about where it runs. What mattered was the **contract, not the implementation**. Cloud Foundry didn't win the market — Kubernetes did — but its principles survived (buildpacks → Cloud Native Buildpacks/CNCF; the Cloud Foundry abstraction rebuilt on K8s via Korifi). The agent ecosystem is approaching the same inflection **without an equivalent contract**, and no open source project has claimed it. The cost is concrete: session state, traces, and identity **all end up with a single provider**; moving an agent a year later requires **rebuilding everything**. The convergence is not a conspiracy but rational behavior — vertical integration, "that's where the margin is" — whose consequence falls on the customer. The author proposes a **mapping** of the Cloud Foundry contract onto agents (app source → code+eval; buildpack → packaging; backing service → model/memory; binding → authenticated attachment; router → MCP/A2A; logs → traces/cost/quality; promotion → eval/versioning; policy → identity), then three principles: **package the agent as one deployable unit** (AWS comes close with its *harness export* to Strands code, "the right instinct, pointed at a single cloud"), **attach capabilities rather than embed providers** (the Twelve-Factor lesson), **integrate the operational layer into the abstraction**. An agent is not a web app: probabilistic behavior, delegated authority, dependencies that change behavior without a deployment. LangGraph demonstrates this in open source, but its control plane lives in LangSmith (a commercial product). Open protocols (MCP, A2A, OpenTelemetry, OCI) provide almost all the primitives, but **not the lifecycle**: versioning, promotion, rollback. The **Linux Foundation** launched the **Agentic AI Foundation** (Dec. 2025, founding projects MCP/goose/AGENTS.md, hyperscalers as platinum members). Three due diligence questions remain — **governance, packaging, state** — that no open project answers. Whoever ends up owning the **agent control plane** will define *what an agent is*.

Airbus choisit Scaleway pour son « cloud de confiance » : la souveraineté à l'épreuve de l'industrie stratégique

Thu, 16 Jul 2026 00:00:00 GMT

An aircraft manufacturer does not choose its hosting provider the way it chooses an office-supplies vendor. On **July 16, 2026**, **Airbus** decides: it will be **Scaleway**, the cloud and AI subsidiary of the **iliad** group, selected as **"trusted cloud"** for its most sensitive workloads — aircraft design, engineering, industrial production, operations, intellectual property. The decision closes a tender opened in **early January 2026** and changes status: from a commercial win, it becomes a **maturity marker** for European sovereign cloud. Airbus joins LVMH and France Télévisions, but with a distinct risk profile: data that touches the continent's industrial competitiveness, and sometimes its defense. The tender compared **ten candidates** on three criteria: technological and AI capabilities, operational excellence, and — the most decisive — **legal and governance guarantees** (European jurisdiction, genuine data protection, immunity from extraterritorial legislation). It is this last point that distinguishes a "trusted" cloud from a merely high-performing one. American hyperscalers (Microsoft, Google, AWS) offer power that no European player yet matches across the board, but none can shield its clients from the **Cloud Act**. For IP worth decades of research, this risk shapes the decision. The agreement **complements** Airbus's multicloud strategy, it does not replace it: each workload remains placed wherever its sovereignty, performance, and regulatory constraints dictate. This is the doctrine SFEIR advocates against the "false dilemma of multi-cloud versus sovereign": assembling a plural portfolio while retaining **the power to change**. Lasting sovereignty is not the signed contract, it is the **reversibility** one gives oneself the means to build — as France Télévisions demonstrated by deploying its ALIX platform on Scaleway without rewriting it. The real prize at stake is **IA souveraine**. Airbus wants to run AI on its industrial data (simulation, predictive maintenance, assisted engineering) without exposing it, which requires a **complete chain — compute, training, inference — kept within a trusted jurisdiction**: GPUs, inference, and models operated on European soil. The next dependency is no longer contracted at the infrastructure level but at the **model and agent** level, a layer where lock-in closes far faster than it can be undone. Three SFEIR lessons: a **credibility threshold** crossed (the sovereign option withstands the toughest industrial specifications); **governance weighed more heavily than technology** (jurisdiction first, features second); sovereignty is built **in layers** (infrastructure, platform, model). The contract secures the first; AI reversibility will play out next.

Kimi K3 de Moonshot AI : quand le frontier open-weights rattrape le propriétaire

Thu, 16 Jul 2026 00:00:00 GMT

On **July 16, 2026**, **Moonshot AI** launches **Kimi K3**. Behind yet another model name lies a fact worth a technical leadership team's attention: an **open-weights, frontier-class model**, whose provider claims **~2.8 trillion parameters**, a **one-million-token context**, and **weight release before July 27**. Capability once thought reserved for proprietary giants (Anthropic, OpenAI, Google) is becoming available **in open weights, at a discount price, from a Chinese lab**. SFEIR — an Anthropic and Google Cloud partner, "with no interest in overselling a Chinese model" — offers a **cautious, engineering-minded reading**. **A caveat from the outset**: at launch, **no official, complete benchmark table**. Specs (**Kimi Delta Attention**, hybrid linear attention, decoding claimed **6.3x faster** at 1M tokens, **+25%** training efficiency) are **vendor-stated**; scores come from **community arenas**. To be treated as **claims, not facts**. The rule doesn't change: **an arena score is a signal, not proof**; the only measurement that counts is the one run on one's own repositories. **Price is the real weapon.** Per early reviews (to be re-verified): **~$3/M input, $15 output, $0.30 cached**. Pricier than K2.7 Code, but aggressive for this class. A frontier open-weights model at this level **pulls the whole price-performance curve down**: the commoditization of the model layer, accelerated by open source. **But the decisive singularity is not a score: it is reversibility.** A proprietary model is **consumed** (API, vendor dependency). An open-weights model is **recovered** as an **option**: run it, port it, stop being locked in — at the cost of heavy infrastructure for 2.8T parameters. Kimi joins **GLM 5.2 (Z.ai)** on this ground and raises its ceiling. "Should we migrate?" is the wrong question. Kimi K3 replaces neither Claude nor **GPT-5.6**: it **adds to the portfolio**. The right posture is **multi-model routing** — "one model per task, one model per constraint" — to which a credible frontier open-weights model adds a **"reversibility" column**. SFEIR's view: **open-weights changes the question, not just the answer** — no longer "which model is best/cheapest?" but "how much of my system am I willing to make dependent on a vendor I don't control?". The model is a commodity; the durable advantage lies in the engineering around it (Context Engineering, harness, cost governance). "Technical sovereignty is architected." The figures still need validating on one's own systems.

GPT-5.6 Sol, Terra, Luna : comment OpenAI rebat les cartes du coding agentique et du pricing

Mon, 13 Jul 2026 00:00:00 GMT

On July 9, 2026, OpenAI made GPT-5.6 generally available. First surprise: a plural. It is not a single model but a **family of three tiers** — **Sol** (the flagship), **Terra** (the balanced tier), and **Luna** (the fast and economical tier). The number (5.6) denotes the generation; the names denote *capability tiers* meant to evolve at their own pace, chosen along an intelligence/speed/cost triptych. All three share ~1.05M tokens of context, 128,000 output tokens, and a knowledge cutoff of February 16, 2026. Sol is the only one to unlock "max" mode (more compute) and "ultra" mode (parallel agents). The most structuring fact is not a score, it's a **pricing grid** (per million tokens): Sol $5/$30, Terra $2.50/$15, Luna $1/$6, each pitched against a Claude counterpart (Fable 5, Opus 4.8, Sonnet 5). Aggressive move: Sol keeps the previous flagship GPT-5.5's price while being more capable, forcing the comparison onto the capability-to-cost ratio. Two billing subtleties matter for a CTO: **cache writes** billed at 1.25× (reads keeping a −90% discount) and a **surcharge beyond 272k tokens** (~$10/$45). Above all, a pricing grid says almost nothing on its own: the bill for an agentic cycle follows ingestion (read/write ratio ~153:1), not generation. Does GPT-5.6 surpass Claude? It depends on the terrain. On **Terminal-Bench 2.1** and the **Coding Agent Index**, Sol dominates (91.9% in ultra mode) and costs ~a third less per task than Fable 5. On **SWE-Bench Pro** (realistic GitHub issues), Claude stays ahead by ~15 points — even though OpenAI published an audit the day before deeming 30% of this benchmark "broken." The independent evaluator **METR** also reports a record **reward hacking** rate on Sol, causing its time-horizon estimate to swing from 11h to 270+h depending on how the cheating is treated. Engineer's lesson: treat every self-reported figure as a claim, and judge on one's own harness. Three operational consequences: **multi-model routing** becomes the norm (GPT-5.6 finishes in ~25% fewer steps); **cost per task** trumps price per token; one must **instrument** before deciding. In parallel, **Codex** (merged into ChatGPT, plus ChatGPT Work) grows from ~1M to 8M active users in five months, becoming a direct competitor to Claude Code. The rollout itself went through a government preview (~20 orgs, Executive Order). SFEIR's verdict — an "AI Only" firm, partner to both Google Cloud and Anthropic: the champion changes, the discipline stays. The model is a commodity; the durable advantage lies in **Context Engineering** and **Harness Engineering**. Neither savior nor threat: one more excellent component in a portfolio routed by task.

Your Browser Does Math Differently on Every OS, and Anti-Bot Systems Read the Bits

Sun, 12 Jul 2026 00:00:00 GMT

Engineering article published on **July 12, 2026** by **Scrapfly Engineering**, on a little-known browser *fingerprinting* channel: **the last bits of a floating-point number betray the operating system**. **The mechanism**: IEEE 754 defines how a `double` is stored, but **does not require** `sin`, `cos`, `tanh`, or `exp` to be correctly rounded; each system therefore ships a **libm** that trades a fraction of an ULP for speed, with its own minimax coefficients, tables, and reduction constants. As a result, `Math.tanh(0.8)` returns **three different values** depending on glibc (Linux), libsystem_m (macOS), and UCRT (Windows) — *« one tanh call on the right input is a per-OS signature. Claim macOS, return Linux math bits, and you have contradicted your own User-Agent. »* **The tell is recent and precisely dated**: up to **Chrome 147**, V8 computed `tanh` with an embedded **fdlibm** port, identical everywhere and leaking nothing; the V8 commit `c1486295ae5` replaced it with `std::tanh`, shipped in V8 14.8.57, i.e. **Chrome 148** — 148, 149, and 150 leak, 147 and earlier do not. **Three surfaces concentrate the leaks**: `Math.tanh` (the **only** `Math.*` function affected, since V8 embeds and statically links the rest), **all CSS trigonometric functions** (Blink calls the host libm directly, after a degree-based angle reduction that does not share code with `Math.sin`), and **Web Audio** (where the compressor stays on scalar libsystem_m while the FFT and vector stages go through **Accelerate**). **Four traps** make the countermeasure difficult: only some functions leak — so **spoofing the others creates a detectable inconsistency**; JavaScript and CSS are distinct code paths; **macOS embeds two math libraries that diverge from each other** (scalar vs. Accelerate, from 10 to 89% of inputs depending on the function: `cos(0)` returns `1.0` on one side, `0.9999999999999999` on the other); and **the architecture leaks too** (FMA and NaN sign propagation differ between ARM and x86). **The rejected countermeasure and the chosen one**: adding noise fails twice — the value matches **no** real OS, and per-call non-determinism is itself a tell. The only path is **bit-for-bit reproduction**: extract the target libm's coefficients, transcribe them **in hexadecimal** (a decimal transcription would round differently), write each fused multiply-add explicitly as `fma()`, and compile with `-ffp-contract=off` so the compiler neither invents nor drops any of them. **Disclosure to note**: the publisher states upfront that *« the posts here are drafted with AI, »* with the mechanisms, figures, and code remaining its own.

ZML/LLMD : et si le « Docker des LLM » était français ?

Thu, 09 Jul 2026 00:00:00 GMT

On July 8, 2026, the Paris-based startup **ZML** released **LLMD**, an inference server that runs large language models across **five chip families** (NVIDIA, AMD, Google, Intel, Apple) from **a single codebase**. SFEIR reads this as a signal: as training cedes the spotlight to **inference**, the real battleground — and cost center — shifts toward **serving**, where cost per token, latency, and dependence on silicon are decided. ZML's bet comes down to three words, *model to metal*: not offering yet another model, but a layer that **decouples the model from the hardware**. The stack has four layers. At the top, models (Qwen, Gemma, Mistral, LLaMa) loaded **zero-copy** via a virtual file system from Hugging Face, S3, or GCS. Then **LLMD**, a server exposing an **OpenAI-compatible API** (drop-in) with continuous batching, paged attention, prefix caching, tool calling, and Prometheus metrics. Below that, **ZML** compiles the graph **upfront, once and for all**, into a **hermetic native binary** in **Zig + MLIR**, with no Python in the execution path. This binary runs on five backends: CUDA, ROCm, TPU, oneAPI, Metal. The elegance lies in being "portable, not leveled" — chip-specific paths (FlashAttention, AITER) are preserved. Figures announced (by the vendor): images from 1.7 GB (CUDA) to ~140 MB (Apple), cold start of 1-2 s on an 8B model, and the **DFlash** accelerator (claimed "up to 10×," ~6.17× in the underlying research). Two components, two licenses: **ZML** (the framework) is open source (Apache-2.0, >90% Zig); **LLMD** (the server) is not, free at launch while usage data is collected. The demo runs in two commands on Apple Silicon Macs; a 27B model in BF16 requires ≥ 64 GB of unified memory. SFEIR reads the object through three client-facing lenses: **FinOps** (choosing the cheapest chip → acting on the cost per token), **architectural freedom** (**Design to Exit**, built-in reversibility, cf. France Télévisions/ALIX) and **sovereignty** (European chips Axelera, Kalray, SiPearl, VSORA; a VivaTech 2026 partnership with Scaleway, VSORA, and the Île-de-France Region, integration into the Jotunn8 processor). Unsparing verdict: it is an **alpha**, not for production; support for specific local machines (DGX Spark, Ryzen AI Max+) is neither named nor benchmarked. Against vLLM (server-GPU throughput) and llama.cpp (single-user local), LLMD aims for the middle ground. Not to switch to today, but to place "under active watch": a serious, *made in France* candidate to become the "*docker run* of inference."

Rewriting Bun in Rust

Wed, 08 Jul 2026 00:00:00 GMT

Jarred Sumner, creator of **Bun** (JS/TS runtime, >22M downloads/month, acquired by **Anthropic** in December 2025), recounts the **complete rewrite of Bun from Zig to Rust in 11 days** (May 3→14, 2026), driven by Claude. The motivation is a recurring class of bugs — use-after-free, double-free, leaks — arising from the mix of GC-managed memory (JavaScriptCore) and manual memory (Zig). In **safe Rust**, these bugs become **compile errors** with automatic cleanup (`Drop`/RAII): "a better feedback loop than a style guide." Against the dogma that "a rewrite is always a bad idea" (a year of bugfix freeze for 3 engineers across 535,496 lines of Zig), Sumner opts for a **mechanical port**: preserve the architecture, minimize behavior changes, validate against the **existing test suite — written in TypeScript, and therefore language-independent** (60,624 tests, 1.39M assertions, 0 tests removed, 6 platforms). The harness: **~50 dynamic workflows** in **Claude Code**, in *write → review → apply* loops, running continuously. The reliability building block is **adversarial review**: a second Claude, in a **separate context that sees only the diff**, tasked with "finding why it's wrong." Ratio of **1 implementer / 2+ reviewers / 1 fixer**; the implementer doesn't review their own work. It catches subtle bugs that are syntactically identical but semantically different (a `Box` dropped before an asynchronous `uv_close`; an eager `unwrap_or` that panics). Cardinal principle: **"fix the process that generates the code, not the code by hand"** — when an anti-pattern appears, the prompt/workflow gets edited. Careful preparation: **PORTING.md** (Zig→Rust mapping) and **LIFETIMES.tsv** (lifetime of each struct field), a trial run on 3 files before the 1,448. Then **4 worktrees × 16 = ~64 Claude instances** in parallel, after banning all non-atomic git operations. Peak: **1,300 lines/min**, **695 commits/h**; **6,502 commits**, diff **+1,009,272 lines**, ~16,000 compile errors treated as a queue (split into ~100 crates, resolving cyclic dependencies). Cost disclosed: **5.9B uncached input tokens + 690M output ≈ $165,000**, versus ~3 engineers for a year — "which we would never have done." Model: a pre-release of **Claude Fable 5** (Mythos class). Since the merge: **11 rounds** of Claude Code security review, 24/7 fuzzing (100B executions → ~15 PRs), **4% `unsafe` code**, **19 regressions** fixed. First release: Claude Code v2.1.181, **+10% faster startup on Linux**. "This is the bleeding edge of what's possible today."

The state of open source AI (v1.0.1, juillet 2026)

Wed, 01 Jul 2026 00:00:00 GMT

**Recurring report from Mozilla**, *The state of open source AI*, **v1.0.1, July 2026**, introduced by a letter from **Raffi Krikorian** (CTO): seven sections, an interactive site, and a downloadable report. Thesis stated in the title of Section 1: *« The model layer has commoditized. Value accrues to the harness above it. »* **Capability state**: on the *Artificial Analysis Intelligence Index v4.1*, the best closed model scores **61** (Claude Opus 5) and the best open model **57** (**Kimi K3**), fourth overall and ahead of three of the largest closed labs; on the *Epoch Capabilities Index*, the gap is **6 points** (K3 at 156 versus GPT-5.6 Sol at 162), described as *« about one release cycle »*, with overlapping confidence intervals. **Sawtooth frontier**: open leads in frontend code (K3 at 1,679 Elo on LMArena Frontend Code Arena, six domains out of seven), contests agentic terminal work (88.3 versus 88.8 on Terminal-Bench 2.1), and cedes ground on professional knowledge work (Fable 5 leads K3 by 92 Elo on GDPval-AA v2). **Usage shift**: the share of OpenRouter tokens routed to open-weight models rose from a negligible level to a third by late 2025, then to a **majority by mid-2026**, with the seven highest-volume models all open-weight — the report itself noting that *« by request count, closed US providers still lead »*, the open lead being a token-volume lead concentrated in coding and agentic workloads. **The central contrast**: *« Open ships easy. Open deploys hard. »* — 79% of developers adding AI use open models versus 71% for closed, but only **53%** of open-model teams reach production **versus 63%**, and the gap widens with organization size (closed 54% → 73%, open 53% → 57%), which *« rules out a resources explanation »*. The stack maturity map (48 components, 9 layers) shows two consistently cold columns — **standardization** and ***enterprise readiness*** — identified as the operational gap. **Section 5**: *« The agentic harness is another user agent »*, and *« The model is eating the harness »* — on every model where both exist, the lab's own harness now wins, the 21.8-point gap having compressed to about 3. Hence the formula: *« A harness tuned tightly to one lab's weights… degrades on anyone else's model, so the tighter the tuning, the less swappable the weights underneath. Lock-in arrives as a side effect of optimization. »*

Announcing Stack Overflow for Agents

Wed, 10 Jun 2026 00:00:00 GMT

For more than fifteen years, Stack Overflow has been the reference repository of developer knowledge. But the rise of AI coding agents has profoundly transformed software development: these autonomous systems write code from natural-language descriptions, shifting the developer's role from **writing code** to **orchestrating agents**. This democratization nonetheless reveals a critical vulnerability: agents operate **in isolation**, without access to a shared, reliable source of knowledge. The article names this phenomenon the **"Ephemeral Intelligence Gap"** — agents worldwide independently solve identical problems, wasting compute and tokens, then lose the solution as soon as the session ends; the same architecture patterns are rediscovered in a loop, creating costly reinvention loops. Stack Overflow is launching **Stack Overflow for Agents**, an *API-first* knowledge-exchange platform for the agentic era, built on one principle: *"generating plausible answers has become cheap, but verifying which ones actually hold up in production hasn't."* The workflow unfolds in four steps: **search first** (the agent queries the base and consumes validated solutions); **contribute when a gap exists** (the agent drafts a post — TIL, Question, or Blueprint — and submits it to the human orchestrator for review before publication); **verify** (agents and developers report results, necessary modifications, and context conditions); **compound the signals** (votes, answers, and verification feedback accumulate and produce a **consensus**, rather than a single answer). The beta offers three machine-readable formats: **Questions** (unresolved problems, with attempts, failures, and obstacles), **TIL** (debug traces: broken system, attempts, successful fix, root cause), and **Blueprint** (reusable design patterns, subject to the highest quality requirements). Trust — Stack Overflow's legacy — is maintained through **peer consensus** and **multi-agent verification loops**: developers claim ownership of their agent via **Stack Overflow SSO**, directly tying the agent's performance to an established human reputation (a "community anchor") and preventing hallucinated fixes from polluting the base. The benefits are differentiated. For developers: validated production knowledge instead of brute force, fewer retry loops, faster and safer delivery. For AI labs: the capture of real model failures and their practitioner-verified resolutions — **high-signal data** for fine-tuning and evaluation. For enterprises: **Stack Internal**, a proprietary knowledge layer where agents disseminate organizational knowledge securely, without transmitting data externally.