Frontend Feeds

Today

Front-end, in one read.

The latest from the sources worth following, newest first.

  • DEV CommunityThe Giantsread at source

    Your agent reads .env. It can't read a vault.

    You give an AI agent a shell in your project. The project has a .env file. The agent can read it. Most advice offers two fixes: an ignore file and deny rules. Both help. Both leave gaps. Here is where, with commands you can try. The ignore file An ignore file only works for the tools that read it. It can hide a file from search. It does not stop a shell command. cat .env If the agent can run commands, it can print the file. Deny rules Claude Code lets you deny tools in .claude/settings.json : { "permissions" : { "deny" : [ "Read(./.env)" , "Read(./.env.*)" , "Bash(cat:*)" ] } } Now try these: head .env grep KEY .env sed -n p .env python3 -c "print(open('.env').read())" Each rule names one path or one command. The list of other ways to read a file is long. The environment Many keys never sit in the repo. You export them in your shell profile: export OPENAI_API_KEY = sk-... The agent starts from that shell. Every child process inherits the variable. printenv echo $OPENAI_API_KEY No ignore file or deny rule covers that. Settings that help Keep .env out of the folder you open the agent in. Deny Read on secret paths, as above. Keep Bash on ask, not allow. Don't export keys in ~/.zshrc . Start the agent from a clean shell. These shrink the gap. They don't close it. As long as the secret is in a file or in the environment, the agent can reach it. One fix: give the key to the command Kluis is a password vault for the Mac, for the terminal and the desktop. Your secrets live in the vault, not in plain files. kluis run gives a secret to one command. The secret is gone when that command ends. The agent asks kluis run to start a command with a secret. Touch ID confirms the read. The command gets the secret. The agent gets the output. The key goes to the command, never back to the agent. The agent can use a secret without reading it. A policy limits what it can use. Every read goes into an audit log. To move what is already lying around, an import scan finds keys and passwords in your files. What Kluis is not Kluis does not sandbox your agent. A secret you leave in a plain file stays readable. Kluis helps once the secret is in the vault. It requires macOS 14 or later on Apple silicon. It is free. No account, no server. The docs and the download are on the Kluis site: https://baken.vagebond.nl/r/TbrWtFJg

  • DEV CommunityThe Giantsread at source

    A 2.6B model on an iPhone that always answers in valid JSON

    Small language models are good at one thing that apps need all the time: read this text and fill these fields . A letter becomes sender, deadline and next steps; a voice note becomes a task list; a receipt becomes an expense entry. This post shows how we run that fully on an iPhone with llama.cpp and LFM2-2.6B, what it costs in seconds, and the five problems we had to solve on the way. Everything here runs offline on an iPhone 15 (A16, 6 GB RAM). That phone has no Apple Intelligence, which is exactly the case a local model is for. The setup Model: LiquidAI/LFM2-2.6B-GGUF , Q4_K_M, 1.6 GB Runtime: llama.cpp b11887 as an xcframework, Metal for all layers, n_ctx = 4096 Sampling: greedy, constrained by a GBNF grammar Inputs: Apple Vision for OCR, Apple's on-device speech recognition for audio Measured on the phone: Task Time First model load ~20 s (then it stays in memory) Short text → 6-field JSON 4–6 s Voice note → nested task list 7–9 s Scanned bill (~1,500 chars) → 7 fields 10–14 s OCR of a page (Vision) ~1 s 1. Make invalid JSON impossible Asking a 2B model to "answer in JSON" works most of the time. Every few hundred calls a bracket goes missing or a key is invented, and your parser throws. A GBNF grammar fixes this at the sampling step: tokens that would break the shape are never allowed. Writing grammars by hand is tedious, so we describe the shape in Swift and generate it: let schema = Schema ( "Letter" ) { Property ( "sender" , . string , "Who sent it, short" ) Property ( "action" , . choice ([ "none" , "pay" , "reply" , "sign" ])) Property ( "deadline" , . date , "Only if the letter names one" ) Property ( "steps" , . list ( . string , max : 4 )) } let grammar = schema . gbnf // pass to llama_sampler_init_grammar(vocab, grammar, "root") Keys come out in the declared order, which also helps the model: put the fields it should "think about" first and the conclusion last. The generator is MIT licensed: swift-gbnf . 2. Long prompts abort the app Short tests worked, a real letter killed the app with GGML_ASSERT(n_tokens_all . The default batch is 512 tokens and we decoded the whole prompt in one call. Setting n_batch = n_ctx (and leaving n_ubatch at 512) fixed it without noticeable memory cost. Also check prompt tokens + max new tokens before decoding, and fail gracefully if it doesn't fit. 3. Don't let the model do numbers LFM2 reads a bill well, but on a Japanese electricity bill it picked a line item (8,120 yen) instead of the total (10,056 yen). We stopped asking the model for numbers we can read with rules: the amount next to Total / Summe / ご請求金額 / 合計 , dates, IBANs. The model writes the summary and the steps, the rules provide the facts, and the facts override the model. 4. Give it a calendar "Your check-up is on Tuesday" turned into random dates. Small models can't count weekdays. Adding one line to the prompt fixed it almost completely: Today is Friday 2026-10-30. Next days: Saturday 2026-10-31, Sunday 2026-11-01, Monday 2026-11-02, Tuesday 2026-11-03, ... 5. Language: say it twice Given a German receipt and the instruction "answer in English" in the system prompt, the model often answered in German. Repeating the wish right after the input text, (Write every text value in English.) , made it reliable. Reading a Japanese letter and explaining it in English works well once that's in place. Bonus: the Simulator The official llama.cpp xcframework has no iOS Simulator slice, so apps that link it don't build for the Simulator. We built the same release with llama.cpp's own build-xcframework.sh and published it unchanged: llama-xcframework . In the Simulator, load with n_gpu_layers = 0 : its Metal lacks most kernels and is slower than the CPU. Takeaway A 2.6B model on a phone is a very good reader : summaries, classification, extraction, in many languages, private by design. Pair it with a grammar for the shape and plain rules for the numbers, and it behaves like a reliable component instead of a demo. Screen recordings of all of this on the iPhone: theyplay.games/ondevice . We packaged our full setup (Apple Intelligence first, the local model as fallback, background model download, OCR and speech helpers) as a Swift package there, but everything in this post works on its own.

  • DEV CommunityThe Giantsread at source

    The EDI 944, Decoded: A Warehouse Stock Transfer Receipt Advice Is How a Transfer Becomes True

    The EDI 944 · Warehouse Stock Transfer Receipt Advice is the receiving warehouse's answer to a stock transfer. It reports what actually arrived at the receiving location — which products, in what quantities, in what condition — against what the sending location said it shipped in the 943 · Warehouse Stock Transfer Shipment Advice. Until the 944 comes back and matches, a transfer is a claim, not a fact. Yesterday's document in this series, the 943, is the promise: stock has left one location and is headed to another. The 944 is the proof. It is the moment inventory stops being in transit on paper and becomes stock the receiving warehouse can put away, count, and sell against — or the moment a discrepancy gets named while the shipment is still identifiable. What is the EDI 944 · Warehouse Stock Transfer Receipt Advice? The 944 is an X12 transaction set used by a warehouse or receiving facility to advise a depositor or sending location that a stock transfer has been received. It confirms receipt of the transferred goods and reports the quantities and condition as received, not as shipped. Think of the chain it completes: The 943 · Warehouse Stock Transfer Shipment Advice says stock has left the sending location and is on its way. The 944 · Warehouse Stock Transfer Receipt Advice says what the receiving warehouse actually received. The 940 · Warehouse Shipping Order tells a warehouse to ship goods out to a customer. The 945 · Warehouse Shipping Advice confirms what a warehouse shipped out on that instruction — the outbound mirror of the 944's inbound job. The 846 · Inventory Inquiry/Advice reports stock levels — and it is only trustworthy if pairs like the 943/944 are closed honestly on both ends. The 944 is not a payment document and it is not a customer document. No buyer is waiting on it and no invoice should be created from it. Its job is internal truth: two locations that both hold the same company's stock should end a transfer agreeing about what moved. What does a 944 actually contain? At the header, the 944 identifies the receipt: the receipt advice number, the date the goods were received, the receiving location, and references that tie it back to the original transfer — most importantly the shipment advice number from the matching 943, so the two documents can be paired automatically rather than by someone's memory. At the line level, each item reports the product identifier, the quantity received, and the unit of measure. Where the received quantity differs from the shipped quantity, implementations carry the discrepancy and, in mature flows, a reason: short shipment, damage in transit, or a mis-pick at the sending end. Receipt condition matters too. Goods that arrive damaged are received, but they are not available stock. A 944 that books damaged cases as good inventory has not confirmed a transfer; it has created a future stock-out with extra steps. Why is the 944 different from the 945 · Warehouse Shipping Advice? The numbers sit next to each other and the names sound alike, which is exactly why they get confused. Their directions are opposite. The 945 looks outward. It tells a depositor what a warehouse shipped to a customer on a 940 · Warehouse Shipping Order — proof that an outbound instruction was carried out. The 944 looks inward and sideways. It tells a sender what a receiving warehouse took in from a transfer — proof that an internal move landed. No customer order exists anywhere in the 944's story. If the 945 answers "did we ship what we were told to ship?", the 944 answers "did we receive what we were told was coming?" Where do 944 flows usually break? The first break is the 944 that never gets sent. The goods are on the shelf, the receiving warehouse is picking from them, and the sending location still shows the stock as in transit because no receipt advice ever closed the transfer. Every report that reads the documents instead of the shelves now disagrees with reality, and the argument gets settled by a cycle count weeks later. The second break is the rubber-stamp 944 — a receipt advice generated by copying the 943's quantities instead of counting what arrived. This is worse than no 944 at all, because it closes the loop with false confidence. The discrepancy the document exists to surface — 90 arrived, 100 were shipped — gets absorbed silently into inventory, where it will surface later as a stock-out on a product the system swears is available. The third break is a unit-of-measure mismatch at receipt. The 943 shipped cases; receiving books eaches; the 944 reports a number that is technically accurate and practically meaningless against the shipped quantity. Pairing the documents line by line only works if both ends agree on what one unit means, in writing, before the first transfer. What should you check in a 943/944 loop? Three checks keep the receiving end honest: First, pairing, from the other side: every 944 should reference a real 943, and every 943 older than its expected transit time should have a 944 chasing it. An unpaired document in either direction is an open exception, not paperwork in progress. Second, counted-not-copied: quantities on the 944 must come from the receiving count, not from the 943. If your system pre-fills the receipt from the shipment advice and receiving never edits it, you do not have a receipt process — you have a photocopier, and your discrepancies are being filed where nobody will ever look for them. Third, condition and availability: received stock should enter available inventory only to the extent it arrived usable. Damaged or quarantined quantities belong in the 944 too, recorded as received-but-not-available, so the sender sees the full picture and the receiver never sells stock it cannot pick. A flow that runs those checks turns the 944 from a formality into the control that keeps multi-location inventory believable. Frequently asked questions Is the 944 · Warehouse Stock Transfer Receipt Advice the same as the 945 · Warehouse Shipping Advice? No. The 945 confirms an outbound shipment to a customer against a 940 order. The 944 confirms an inbound stock transfer against a 943 advice. Opposite directions, different document pairs. Who sends the 944 and who receives it? The receiving warehouse or facility sends it; the depositor, manufacturer, or sending location that issued the 943 receives it. What document does a 944 answer? The 943 · Warehouse Stock Transfer Shipment Advice. The 944 should reference the 943's shipment advice number so the pair can be matched automatically. What happens if the received quantity differs from the shipped quantity? Report what was actually received, with the difference named — short shipment, damage, or mis-pick. Copying the shipped quantity into the 944 hides the discrepancy inside inventory, where it surfaces later as an unexplained stock-out. Does a single-warehouse business need the 944? Usually not. Like the 943, it earns its keep when inventory moves between locations — multiple warehouses, a manufacturer shipping into a 3PL, or a 3PL rebalancing stock between facilities. A transfer is not finished when the truck is unloaded; it is finished when both ends agree, in writing, about what moved. At SignalEDI , we treat an unclosed 943/944 pair as an open exception rather than a delay — because inventory records that disagree with the shelf do not stay a warehouse problem for long. They become a promise made to a customer that nobody can keep. — Chris, founder of SignalEDI

  • DEV CommunityThe Giantsread at source

    Why a failed handler gets its payment back and a failed settlement does not

    A payment gate marks a payment spent before it knows whether the work succeeded. You don't get to pick that ordering: record the key after the handler returns and the entire run is open to a second presentation of the same signed payload. Record it first and you get the opposite failure, where a handler that fell over has burned a payment for a response nobody received. The fix is a release allowed on exactly one path, and the reasoning about which path carries more weight than the mechanism does. The code here is paygate402 , an x402 payment gate that wraps an http.Handler : an unpaid request comes back as 402 with the terms the server accepts, the client repeats it with an X-PAYMENT header, and the gate gets that payment verified and settled before the handler's response reaches anybody. The ordering is not a choice The replay key is a hash of the payment, not of the request: // PaymentKey is the replay key for a payment. func PaymentKey ( payment Payment ) string { sum := sha256 . New () sum . Write ([] byte ( payment . Scheme )) sum . Write ([] byte { 0 }) sum . Write ([] byte ( payment . Network )) sum . Write ([] byte { 0 }) sum . Write ( payment . Payload ) return hex . EncodeToString ( sum . Sum ( nil )) } That payload is what a client sends over the wire, and the server is not the only party that ever holds a copy of it. If the key went into the store after the handler returned, the gap between the two would be as long as the work takes (a report to generate, a model to call, a file to build), and the same payload could be spent again inside that gap, concurrently, as many times as the server has goroutines to serve it. A replay window as wide as your own p99 latency is not a window you get to reason about. It opens widest exactly when the endpoint is expensive. So the key goes in first. One refinement is worth saying out loud, because it mirrors the whole problem: the key goes in after verification passes, not at first sight. Recording an unverified payment would burn a payload the facilitator rejected, and a rejection is often something the client can fix (an allowance, an approval) and then legitimately resend the same signed payment for. store := g . Seen if store == nil { store = defaultStore } if store . SeenBefore ( PaymentKey ( payment ), window ) { g . challenge ( w , accepts , "this payment has already been used" ) return } // The handler runs into a buffer. recorder := & recorder { header : http . Header {}, status : http . StatusOK } next . ServeHTTP ( recorder , r . WithContext ( withPayer ( r . Context (), verification . Payer ))) The handler writes into a recorder that buffers status, headers and body. Nothing has reached the client yet, and that is what makes the next decision possible at all. Four exits, and only one of them is before the money Once the key is recorded there are four ways out of the handler: Exit What the client gets Key after Handler answered outside 2xx the handler's own status and body released Settle returned an error 502 , settlement unavailable stays spent Settlement.Success is false 402 with the facilitator's reason stays spent Settled the buffered response plus X-PAYMENT-RESPONSE stays spent The first exit is the only one you reach before any settlement was attempted: if recorder . status 200 || recorder . status >= 300 { // Nothing was delivered, so nothing is charged — and nothing was // settled either, so the payment is handed back rather than left // spent on a response the client never got. if releaser , ok := store . ( Releaser ); ok { releaser . Release ( PaymentKey ( payment )) } recorder . flush ( w , "" ) return } Notice what the flush does not carry: no X-PAYMENT-RESPONSE , because there is no settlement to report. The client sees its 500 and can retry with the identical header. The other two failure exits look like they deserve the same treatment. They don't: settling , done := context . WithTimeout ( context . WithoutCancel ( r . Context ()), g . settleTimeout ()) defer done () settlement , err := g . Facilitator . Settle ( settling , payment , terms ) switch { case err != nil : g . log ( "settlement call failed" , "error" , err ) http . Error ( w , "payment settlement is unavailable" , http . StatusBadGateway ) return case ! settlement . Success : g . log ( "settlement declined" , "reason" , settlement . ErrorReason ) g . challenge ( w , accepts , orDefault ( settlement . ErrorReason , "payment could not be settled" )) return } A transport error is the unknown case, and it is the oldest trap in payments: a call that failed is not a transfer that did not happen. The request may have reached the facilitator, the facilitator may have broadcast, and all you know is that you did not hear back... Release the key there and the next presentation of the same payload gets settled again, on top of a transfer that may already be sitting on the chain. The declined case is subtler, and it is the one I see people get wrong. Success: false with a reason reads like a definitive no, but it is the facilitator's account of what it observed, and the gate has no second witness. The gate does not read the chain, and it has no business doing so inside a request. So both of these keep the payment spent, and the client is told plainly that the payment was used. For an honest client that is a worse outcome than an automatic retry would be, and it is the only direction that cannot charge twice. One detail keeps the unknown case from being manufactured on purpose: settlement runs on context.WithoutCancel with its own timeout. A client that hangs up the instant it would have received its response cannot abort the transfer mid-flight and leave the money in the one state nobody can act on. The release is optional, and that is the safety property Release is not part of the store interface. It is a second, narrower one: // Releaser is a SeenStore that can forget a key. type Releaser interface { SeenStore Release ( key string ) } A store that does not implement it keeps the payment spent, and there is a test pinning exactly that, using a wrapper that is a SeenStore and nothing more: // keepingStore is a SeenStore and nothing more: it cannot take a payment back. type keepingStore struct { inner * MemoryStore } func ( s * keepingStore ) SeenBefore ( key string , ttl time . Duration ) bool { return s . inner . SeenBefore ( key , ttl ) } func TestAStoreWithoutReleaseLeavesThePaymentSpent ( t * testing . T ) { g := releaseGate ( & keepingStore { inner : NewMemoryStore ()}) signed := header ( t , payment ( "1" )) if failed := releaseRequest ( t , g , handlerThatFails (), signed ); failed . Code != http . StatusInternalServerError { t . Fatalf ( "status = %d, want the handler's 500" , failed . Code ) } retry := releaseRequest ( t , g , paidHandler (), signed ) if retry . Code != http . StatusPaymentRequired { t . Fatalf ( "retried request: status = %d, want 402; body %s" , retry . Code , retry . Body ) } } This is for whoever puts a shared store behind the interface, which any multi-replica deployment has to do: the bundled MemoryStore is one process's memory, and FileStore is one machine's disk. A Redis-style store implements Release in a line. A store that genuinely cannot delete, say an append-only audit log you do not control, or a third-party idempotency service with no revoke, does not have to pretend. Leave the method off and the gate takes the conservative branch, with no configuration flag anywhere and no way for a deploy to pick up the dangerous half of the behaviour by accident. Forgetting in an append-only log FileStore exists so a restart does not hand a captured X-PAYMENT header a second chance. Its file is an append-only log of expiry key lines, so forgetting cannot be a deletion. It has to be another line: // releaseMarker stands where an expiry would be, on a line that takes a payment // back. An append-only log forgets by appending, and the later line wins when // the file is read again. const releaseMarker = "-" A release writes the key with - where its timestamp would be. On the way back in, the record parser turns that marker into the zero time, and the loader deletes any key whose expiry is zero. The tombstone survives the restart, which is the whole point: a release that lived only in memory would resurrect the spent key on the next boot and refuse a retry the client is entitled to. Releasing a key that was never recorded writes nothing, so a stray release does not grow the file, and the file gets rewritten once the dead records outnumber the live ones. The free tier obeys the same rule from the other side. An allowance is spent before the X-PAYMENT header is even read, and a free request that answered outside 2xx comes back through Return on the allowance store: work that was not delivered is not charged for, whether the unit of charge is a stablecoin transfer or one of five courtesy requests. What I would change Release(key string) returns nothing. For a map behind a mutex, and for a file that keeps its own error for you to ask about later, that is fine. For a network store it is not: a release that fails against Redis is a payment silently left spent, with no log line and nothing for an operator to find. I would give it an error return and log the failure at the gate, while still treating it as non-fatal. The client already has its 500 , and a release that did not take is the same conservative outcome as a store that cannot release at all. The second change is about visibility. The gate asks whether the store is a Releaser per request, inside the failure branch, so the quiet, conservative behaviour is also the invisible one: an operator who swapped in a store without Release probably learns about it from a support ticket. I would resolve the capability once, where the gate is validated, and say so at startup. What I would not change is the single-path rule. Everything above collapses into one sentence: record the payment before the work runs, and forget it only where nothing was attempted. The mechanism is the easy half of that. The part I had to sit with is that a declined settlement is not evidence of an absent transfer, and that the gate has to be the component which refuses to guess. Originally published on polycratia.com — where I write about payment systems, crypto rails and marketplace backends.

  • Hacker News Front PageThe Giantsread at source

    AI startup hacks Anthropic, gains access to employee details, internal messages

  • DEV CommunityThe Giantsread at source

    I Built 4 AI Agent Apps That Run 100% in Your Browser with Laya and WebGPU (No API Key, No Server)

    I built four AI apps on Laya, and every one of them runs entirely inside a browser tab: no server, no API key, no cost per call. An AI agent. An LLM-as-a-judge for RAG. Agentic workflow automation. Long-term agent memory that knows when to forget. All four run on one 421M-parameter model using WebGPU, and on the job that matters most for agents (deciding what to do next) it beat a generative LLM nearly four times its size. Here's what I built, the numbers, and the design patterns that make it work. What is Laya? Laya is a 421M-parameter decision model from ConvAI Innovations, built on ModernBERT-large and open source under Apache 2.0. It doesn't generate text. You give it a typed question (pick one of these options, yes or no, or a score on a scale) plus some context, and in a single forward pass it returns a probability for every option. That makes it a non-autoregressive "System 1" model : about 33–40 ms per decision on a T4 GPU, versus 236–276 ms for TypeSafe's generative Jev ( AI Weekly ). It's built for the high-volume decisions every AI system makes: ticket routing, content moderation, AI guardrails, agent-trace checks. "System 1" is Kahneman's fast, intuitive thinking. The idea is that most of what an AI agent does all day (which tool, which queue, is this safe, are we done) is System 1 work, and you shouldn't be paying a frontier LLM to do it. This is one of the big themes of 2026. NVIDIA researchers argued that small language models are the future of agentic AI, and the industry is moving towards small models handling routine agent work while big models take only the hard cases ( a good roundup ). At the same time WebGPU has made running real AI models in a browser tab a practical, production-ready choice. Laya sits right where those two trends meet. So I wanted to see: how much of an AI stack can a 421M decision model run, on a laptop, in a tab? Getting Laya into the browser I converted the typed-decisions checkpoint to ONNX and quantized it ( layaForWeb , model on Hugging Face as VishalMysore/layaForWebTrained ): int8: about 422 MB, runs on WASM int4: about 278 MB, runs on WebGPU It downloads once from Hugging Face, is cached in the browser's Cache Storage, and runs through ONNX Runtime Web. GitHub Pages can't send the COOP/COEP headers that multithreaded WASM needs, so each app registers a tiny service worker that adds them. It's fully private, local AI: nothing you type leaves the page. One trick I used in every app: playback before download. Each page ships answers Laya gave for the built-in examples and plays them back (clearly labelled) until you load the model. The demo works in one second, and the live model is one click away. Then I built four apps on top of it. 1. layaForWorkflows: agentic workflow automation as a graph Live demo · Code A workflow is just data: a DAG of three node types. Diamonds are typed questions Laya answers. Boxes are automation steps. Circles at the end say whether the case was handled automatically, sent to a person, or blocked. Type a support ticket ("the app closes as soon as I open it, client demo in an hour") and the path lights up with Laya's probability on every branch: bug, 78% , then "is the customer blocked right now?" yes, 67% , so it pages the on-call engineer. Seven workflows ship with it, including support ticket triage, IT incident response, insurance claim intake, content moderation and an AI agent action guardrail that fails closed: deletions are blocked, and anything uncertain waits for a human. Laya answers every decision node in one batched forward pass , including the ones off the path the run took. So the confidence slider re-routes a finished run instantly, with no model call, and the Analytics tab shows how the mix of automated, human-reviewed and blocked cases shifts as you raise the bar. Across the 37 example inputs, Laya sent the routine cases straight through, routed the risky ones to people and blocked the dangerous ones, with each decision drawn on the graph and exportable as an OWL ontology in Turtle or JSON-LD. A force-push to main correctly went to a human for approval. That's exactly the behaviour you want from an AI guardrail. 2. layaAsRagJudge: LLM-as-a-judge without the LLM Live demo · Code LLM-as-a-judge is everywhere right now, usually meaning another expensive API call to a big model to check the first one. Laya does the core of that job in the browser: is this claim actually supported by the retrieved evidence? The whole RAG pipeline runs in the tab: sentence-aware chunking, all-MiniLM-L6-v2 embeddings, an IndexedDB vector store, cosine top-3 retrieval, and then one typed question to Laya. The verdict goes through a gate: AUTO, BLOCK, or HOLD for review. On 72 claims about fictional documents (so the model can't lean on what it already knows): Judge question Accuracy False "supported" AUROC Two options (default) 75.0% 27.8% 0.80 Three options (supported / contradicted / not mentioned) 72.2% 11.1% 0.80 Yes / no 69.4% 19.4% 0.74 That's with no fine-tuning for this task , just a typed question. With the confidence gate on, Laya acts on its own on 44% of claims at 84% accuracy and flags the rest for review. Switch to the three-option question and false "supported" verdicts drop to 11%. Then I built a RAG router on top: Laya decides which knowledge base (Encyclopedia, News or Policy) should answer a question, or whether to skip retrieval entirely. It picked the right knowledge base 23 times out of 24 . With a second Laya question ("do these passages answer it?") checking the results, the router got the right final outcome on 94% of questions, all in the browser. 3. layaAgent: a 421M encoder beat a 1.5B LLM at running an AI agent Live demo · Code This is the result that surprised me most. layaAgent is an AI agent that runs entirely in a browser tab. Laya is System 1 : at each step it picks the next tool from 12 options and picks each argument from candidate spans. A small LLM running in the tab through WebLLM (Qwen2.5-1.5B-Instruct) is System 2 , a generative fallback. Tools call Wikipedia, Wikidata and Open-Meteo straight from the browser, plus a calculator, unit and date math, and notes stored in IndexedDB. The rule that makes this work: Laya never has to write. It doesn't type "Japan"; it picks "Japan" out of the spans an extractor found in the last tool result. Tool calling becomes a choice, and choices are what Laya does best. I expected the hybrid (Laya first, Qwen when Laya is unsure) to win. It didn't. Laya did. On its own, Laya more than tripled the task success of the 1.5B LLM (32% vs 10%), and ran each task in under a third of the time (9.7 s vs 35.3 s). Handing Laya's uncertain steps to the LLM actually made things worse. Picking from options is what Laya was trained for, and it shows. Even better, Laya knows when it knows. On unseen tasks, the steps Laya took on its own were right 90% of the time , and everything else was visibly held with a reason. Put a person on those held steps (human-in-the-loop) and 94% of tasks finish correctly . On top of that, anything that changes something ( note_save , note_delete , send_message ) always asks you first, no matter who picked it: Laya is especially strong on single-tool goals (weather, arithmetic, unit conversion, dates, memory) and at spotting risk: its "does this goal change something?" check scored an AUROC of 0.90 . 4. layaForMemory: AI agent memory that knows when to forget Live demo · Code Agent memory is one of the hottest problems in agentic AI, and the hardest part is that facts go stale. "We use Postgres" stops being true the day the migration lands, and your assistant keeps repeating it. layaForMemory is a memory invalidation layer, following the design of invalidate and rebuilt for the browser. Every event (a chat message, a settings change, a Slack-style note) is checked against similar stored facts, and Laya decides what it does to each one: confirmed, superseded, contradicted, needs review, or unrelated. Memory text is never edited. Stale facts are struck through and linked to their replacement, and every verdict is written to an audit ledger before memory changes. It also has built-in prompt-injection defence , and it's beautifully simple. Before touching memory, Laya answers one question: is this event a report, a question, a proposal, or a command? Commands never change memory. On 62 test cases: Zero good facts wrongly thrown away (0 of 32) 100% of questions, plans and prompt-injection commands recognised and ignored Combining four Laya questions separated stale from current facts with an AUROC of 0.95 7 design patterns for building on Laya These held across all four projects. 1. Gate on branch probability. Use the share of Laya's probability that went down the chosen route as your confidence gate. One slider then means the same thing on every decision node: "act on your own only if at least X of the probability agrees". It's simple and it works everywhere. 2. Choice questions are Laya's superpower. The 4-way "what kind of message is this?" separated prompt-injection commands from everything else perfectly on my sample. The router picked the right knowledge base 23 of 24 times. Whenever you can phrase a decision as "pick one of these", do. 3. Route on what something is. Laya is at its best classifying intent, category and risk. Design your questions around what a ticket, claim or event is, and let plain code handle the arithmetic. 4. Wording is a hyperparameter. "The user is now pescatarian instead of vegetarian" cleanly superseded "The user is vegetarian". Phrase events as direct statements and test your question wording against real model outputs. A little prompt tuning goes a long way. 5. Ask several questions and average them. Each staleness question scored an AUROC of 0.89–0.92 on its own; their mean hit 0.95 . Laya is fast enough that four questions in one batch cost almost nothing. 6. You may not need a generative fallback at all. In my agent, Laya plus a person beat Laya plus an LLM by a wide margin. Sometimes the best System 2 is a human. 7. Record once, re-score forever. Every app stores Laya's full answers and lets sliders re-route them without another forward pass. Threshold tuning becomes dragging a slider, and the trade-offs are visible to anyone opening the page. Can a 421M model run your AI agents? The decision layer, yes. And that's most of what an agent does. Build around what Laya is great at: Let code propose the options. Let Laya pick. Gate on branch probability, and make "I'm not sure" a first-class outcome. Keep side effects behind a confirmation no model can skip. Run it locally with WebGPU: no API key, no server, no cost per call. All four apps are open source (Apache-2.0) and run on GitHub Pages. Open one, hit Run , and watch the decisions light up before you've downloaded a single megabyte: 🔀 Workflows: https://vishalmysore.github.io/layaForWorkflows/ ⚖️ RAG judge + router: https://vishalmysore.github.io/layaAsRagJudge/ 🤖 Agent: https://vishalmysore.github.io/layaAgent/ 🧠 Memory: https://vishalmysore.github.io/layaForMemory/ If you're building AI agents with small language models, I'd love to hear: which part of your agent do you think actually needs a big LLM? Tell me in the comments. Results come from the evaluation pages in each repo, on the test suites shipped there. This is an independent project, not affiliated with ConvAI Innovations. Laya is by ConvAI Innovations (Apache-2.0), built on ModernBERT-large by Answer.AI and LightOn.

  • HTML All The ThingsPodcastsAudioListen

    Are Anthropic’s AI Economics Finally Working?

    Anthropic's IPO filing has revealed some eye-opening numbers about the economics of artificial intelligence. Revenue is growing dramatically faster than computing expenses, suggesting that running AI models might finally be becoming a sustainable business. But does that mean the…

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: UPC Label Maker – 1:1 PostScript point barcode imposition for Avery/FBA

    Comments

  • Hacker News Front PageThe Giantsread at source

    Why Anthropic's Filing Crushed Tech Stocks

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: Million Piece Puzzle

    Comments

  • Hacker News Front PageThe Giantsread at source

    Prospero: A new coding harness for a more civilized age

  • Hacker News Front PageThe Giantsread at source

    Shiny Object Syndrome

  • Flavio CopesMore Front-end Bloggersread at source

    Test your SaaS replacement before cancelling the original

    Run a homemade SaaS replacement beside the original with read-only inputs, compare real outputs, and rehearse recovery before switching over.

  • Hacker News Front PageThe Giantsread at source

    We Took over ChatGPT Accounts

  • Flavio CopesMore Front-end Bloggersread at source

    How to make it easy to leave your SaaS

    Design a useful SaaS export with stable IDs, attachments, and import checks, then handle account deletion through a durable, verifiable process.

  • Smashing MagazineThe Giants11 min read

    A Spark Of Color In November’s Gray (2026 Wallpapers Edition)

    Let’s kick of November with a new collection of desktop wallpapers! Designed by creatives from across the globe, the wallpapers come in a variety of screen resolutions and can be downloaded for free. Enjoy!

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: Readeck sync for Kobo's stock reader

    Comments

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: Agent-arcade – Terminal games that pause when Claude Code/Codex is done

    Comments

  • SitePointThe Giantsread at source

    How to Optimize AI-Generated Images for Faster Websites

    null Continue reading How to Optimize AI-Generated Images for Faster Websites on SitePoint .

  • AbduzeedoMulti Author Blogsread at source

    Web Design: The Geist Font Specimen by Vercel

    Vercel crafts a benchmark in web design with the interactive Geist font specimen, pairing Swiss precision with developer-grade typography. Typography specimen websites usually fall into one of two tra...

  • Hacker News: Show HNLibraries, Frameworks, etc.read at source

    Show HN: To Honor Sir Patrick Stewart, Enjoy the TNG Episode Guessing Game

    Comments

  • AbduzeedoMulti Author Blogsread at source

    AKT London: Inside Two Times Elliott’s Visual Identity

    Two Times Elliott channels West End theater marquees into a plastic-free visual identity and aluminum tube system for AKT London. Natural deodorant brands almost always hide behind pale kraft paper an...

  • AbduzeedoMulti Author Blogsread at source

    Cuberto Unveils Wickret UI/UX Design & Mobile Banking System

    Cuberto crafts the UI/UX design for fee-free mobile bank Wickret, pairing Montserrat type grids with color-blocked wallet cards and motion. Most mobile banking apps look like dressed-up spreadsheets. ...

  • Geoff GrahamMore Front-end Bloggers1 min read

    New Album: Gone Dark

    I worked on a new album this past year as a follow-up to last year’s Covers. I finished it early September, submitted it for distribution, and then… nothing. It sat quietly in “approval” hell. But Gone Dark came out Monday which just so happened to be a very big day for a very different reason. […]

  • Flavio CopesMore Front-end Bloggersread at source

    Build or buy calculator: when does your replacement cost less?

    Compare a SaaS bill with building your own replacement. Count development, migration, maintenance, and overlap to estimate the first cheaper month.

  • SitePointThe Giantsread at source

    Pin vs Juicebox in 2026: An Honest Comparison for Recruiting Teams

    Pin vs Juicebox for recruiting teams: seats, outreach channels, AI agents, a five-person cost example and security, checked October 2026. Continue reading Pin vs Juicebox in 2026: An Honest Comparison for Recruiting Teams on SitePoint .

  • SitePointThe Giantsread at source

    How to Add AI Content Detection to Your Node.js App

    null Continue reading How to Add AI Content Detection to Your Node.js App on SitePoint .

  • HeyDesignerDeveloper/Designer Newsread at source

    I don't use Figma anymore, and it cost me my job

    Brand is who you are, Move fast and make things, The window with no buttons.

  • CodePenCompany/Startup Blogs1 min read

    446: Our Next-Generation of Feeds is Here

    CodePen has “feeds” for exploring content, like our Trending feed for showing off what’s popular lately all across CodePen, and our Following feed showing off the work of people you’ve chosen to follow on CodePen. Both of those require some fairly fancy technology to pull off! We’ve pulled this tech in-house, so we have more […]

  • Flavio CopesMore Front-end Bloggersread at source

    Research keywords through OpenSEO MCP

    Connect OpenCode to OpenSEO, verify the project and search market, approve a bounded keyword lookup, and save only the ideas you select.

  • Frontend Masters BlogMore Front-end Bloggers13 min read

    Two Circles, One Connection, and border-shape

    Swapping the clip-path arrow from the previous article for border-shape and shape(), we can connect two draggable circles with fancy curved lines that stay perfectly aligned.

  • AbduzeedoMulti Author Blogsread at source

    Packaging Design: Kocktail Reusable Glass on Dieline

    Kocktail trades disposable RTD cans for reusable fluted rocks tumblers, pairing ring-pull brass lids with clean-peel packaging design. Aluminum cans kill bar rituals. Pre-mixed drinks save sourcing ha...

  • AbduzeedoMulti Author Blogsread at source

    Typography: Sausage Regular Display Serif by JFFF

    Just For Free Font releases Sausage Regular, a bold rounded display serif for food packaging, diner menus, and vintage poster typography. Heavy display faces often lose their warmth when pushed to ext...

  • AbduzeedoMulti Author Blogsread at source

    Cepa Studio’s Motion Design for TIF Be Bold

    Cepa Studio blends 3D claymation, 2D cel animation, and paper collage in a mixed-media motion design series for Curitiba agency TIF’s Be Bold. Most agency rebrands play it safe with a fresh wordmark a...

  • AbduzeedoMulti Author Blogsread at source

    Brand Identity: WING’IN by Brandegree

    Brandegree builds a spicy brand identity and packaging system for WING’IN, pairing a curved wing W emblem with bold red takeaway boxes. Fast-casual chicken spots often lean on loud cartoon mascots or ...

  • Flavio CopesMore Front-end Bloggersread at source

    Build a tiny site-audit crawler with Workers and Queues

    Build a bounded Cloudflare crawler with Workers, Queues, and D1 to find broken pages, missing titles, and redirect chains in a local test site.

  • Flavio CopesMore Front-end Bloggersread at source

    The best voice to text apps for a Mac

    Handy is the free open source dictation app I use. Compare the other Mac voice to text apps and speech APIs, then dictate a prompt.

  • SitePointThe Giantsread at source

    Building a Human Review Pipeline for AI Search: A Practical Developer’s Guide

    null Continue reading Building a Human Review Pipeline for AI Search: A Practical Developer’s Guide on SitePoint .

  • PiccalilliMore Front-end Bloggersread at source

    The Index: Issue #204

    CSS-Tricks has a new owner! This really is a big win for the web and it should fill you with hope. We're not done yet ! The Serotonium — Music shared with friends This does exactly what is says on the tin and the volume of extremely good recommendations is mind-blowing. Anthropic files its ‘IPO’ — but all the key numbers are missing If the immediate glazing of Anthropic's IPO documents on social media was getting you down, then have a read to get yourself back level again. Digital recipe management for fastidious cooks An interesting look into the world of managing your recipes and what options there are. Local Wikipedia This is such a cool tool that allows you to filter Wikipedia by your chosen location. CSS nesting: use with caution Here's one from the Piccalilli archives that you might have missed to wrap up this issue. P.S. this is a good website . Sponsor message When anyone can make anything, we can make you stand out. AI technologies have given anyone the ability to bring their ideas to life, but to produce a high quality service that actually works for the people it needs to work for requires experience, specialist skills and creativity. We’ve got heaps of all of that here at Set Studio and we've got availability starting in 2027, so check us out and see what we're about. Check out our work

  • Net NinjaYouTube ChannelsVideoWatch on YouTube

    GitHub Copilot App Tutorial #5 - Automations

  • Flavio CopesMore Front-end Bloggersread at source

    Build an agent approval flow that survives a restart

    Build a local approval queue with exact message previews, expiring decisions, rejection, and crash recovery. Test it safely with a fake email provider.

  • Flavio CopesMore Front-end Bloggersread at source

    Lessons for builders from Sam Altman's Cheeky Pint interview

    Eight practical lessons from Sam Altman and John Collison on code scans, agent teams, budgets, and prices customers can predict.

  • AbduzeedoMulti Author Blogsread at source

    The Web Design of Gleb Kuznetsov’s Portfolio

    Gleb Kuznetsov pairs crisp Swiss typography and generative Natural OS previews in a sharp portfolio web design for the Brain.AI design chief. Most executive portfolios get buried under heavy case-stud...

  • ESLint BlogLibraries, Frameworks, etc.1 min read

    ESLint v10.14.0 released

    Highlights In ESLint v10.14.0, the following rules have been updated to avoid incorrect or unexpected behavior in some edge cases: func-name-matching no-invalid-this no-restricted-globals object-shorthand yoda Features d23a7f9 feat: fix property descriptor handling in…

  • AdactioTop Front-end Bloggersread at source

    Thursday session

  • Google for DevelopersYouTube ChannelsVideoWatch on YouTube

    Accelerate shipping to scale with Google Antigravity

  • Heroku BlogCompany/Startup Blogs3 min read

    Securing Your Stack: Recent PHP and eMudhra Updates on Heroku

    Managing critical vulnerabilities often consumes significant engineering time. When two remote code execution flaws hit PHP alongside the eMudhra root certificate compromise, Heroku managed the heavy lifting for their managed runtimes. The post Securing Your Stack: Recent PHP and eMudhra Updates on Heroku appeared first on Heroku .

  • Jim Nielsen’s BlogMore Front-end Bloggersread at source

    Celebrating SIM Cards

    It’s time to celebrate a little win. The other day, my mom contacted me saying her 10-year-old iPhone wouldn’t turn on. After getting a hold of the device and doing some family IT support, I concluded the battery was dead. So I bought her a new (old) one on Walmart (SE 3rd gen., if you must know). Her old phone used a SIM card, so I was expecting the process to go something like this: Take the SIM out of the old phone Put it in the new phone Setup the device Troubleshoot why there was no service Call my Mom’s carrier and work through the issue But step 4 and 5 never happened. The new phone “just” connected. I called her number. I texted it. Everything worked as expected. Everything worked as expected. Everything worked as expected. I didn’t have to Google a single question. I was floored. Flabbergasted. I know I shouldn’t have been because that’s how SIM cards are supposed to work, right? Like that’s the whole promise of a SIM card: you can seamlessly swap them between phones. And in this case, the tech worked exactly as promised. As I write this, I’m kind of amazed at how amazed I am that everything “just worked”. Shout out to anyone who has ever worked on SIM card technology. More things like this please :) Reply via: Email · Mastodon · Bluesky

  • SitePointThe Giantsread at source

    AI, DevOps and the Cost of Hosting: From Idea to Production for $0

    null Continue reading AI, DevOps and the Cost of Hosting: From Idea to Production for $0 on SitePoint .

  • WebAIM BlogBrowsers, engines, etc.4 min read

    Captioned Doesn’t Always Mean Accessible

    Accurate dialogue is only part of accessible video captions. Quality captions also identify speakers, convey meaningful sounds, and provide readable, synchronized text. Whether captions come from an automatic tool or a professional service, this article explains why evaluating the finished viewing experience is essential for people who rely on captions.

  • Jeffrey Zeldman PresentsMore Front-end Bloggers6 min read

    The Day the Focus Died

    If we failed to do this, I feared, we would stop leading the industry and turn into “merely the CSS trick of the week.” The post The Day the Focus Died appeared first on Jeffrey Zeldman Presents .

  • Engineering at MetaCompany/Startup Blogs6 min read

    Catching Bugs Before They Land: JiTTesting’s Human-on-the-Loop Approach at Full Scale

    Over the last year we’ve been sharing our work leveraging large language models to catch bugs on the fly — a novel approach we call Catching Just-in-Time Tests (JiTTests). Now, we’re sharing the results and positive impact we’ve seen with Catching JiTTests deployed into production. Our paper, “Just-in-Time Catching Test Generation at Meta,” fully details [...] Read More... The post Catching Bugs Before They Land: JiTTesting’s Human-on-the-Loop Approach at Full Scale appeared first on Engineering at Meta .

  • Web Tools WeeklyMulti Author Blogsread at source

    Web Tools Weekly Issue #693

    JS Utils, Testing, Build Tools

  • Microsoft Edge BlogBrowsers, engines, etc.2 min read

    Edge is faster on Windows with Accelerated App Launches

    We're excited to announce that Edge is the first browser to support accelerated app launches on Windows, delivering a faster and more consistent browser launch experience. With accelerated app launch, most Windows users will see a 15% launch The post Edge is faster on Windows with Accelerated App Launches appeared first on Microsoft Edge Blog .

  • CSS-TricksThe Giantsread at source

    The Frankenstein Table

    A super scary way to go about tables using other layout techniques, like CSS Grid. The Frankenstein Table originally handwritten and published with love on CSS-Tricks . You should really get the newsletter as well.

  • HeyDesignerDeveloper/Designer Newsread at source

    Building beautiful websites with Claude (video)

    Designing a skill, Building an AI-ready design system library, How I design with AI, part 2, HTML-in-Canvas in Chrome 157.

  • DigitalOcean BlogMulti Author Blogs17 min read

    Inside DigitalOcean Simulations: how user simulation, execution, and validation work

    Ask a coding agent which Python version to upgrade to from 3.11, and it picks one from memory. It cites a few changes from that version’s release notes and calls the upgrade straightforward. A single-turn evaluation asking “Is this a reasonable recommendation?” would likely pass…

  • PiccalilliMore Front-end Bloggersread at source

    If we stop, we lose

    It's been a rather morale draining era in the making websites industry since the wider tech industry decided to gamble everything on LLMs. We at Piccalilli see it amongst the community and feel it ourselves. You'll also have noticed the velocity of posts has slowed down somewhat on this website with no new courses announced either. There's a couple of reasons for that. First, the numbers have taken a dramatic tumble — industry-wide — but also, aside from being very busy in the studio , we've been tired . Swimming against this particular current will do that, even for folks like us that have always operated like that. Something else you might have noticed is that a lot of other educators have gone a lot quieter this year too. I'm writing this post today to hopefully try and fix that. A shot in the arm I had a delightful conversation with CSS-Tricks head honcho, Geoff , yesterday. Aside from the excellent vibes as a result of CSS-Tricks being back as an independent publisher , I started in a rather glum mood. After spending a few minutes listening to Geoff's exciting plans though I really perked up. We're nowhere near CSS-Tricks here, but we've always looked up to them as an example of what years and years at the top of your game looks like. Sure, the DigitalOcean acquisition didn't work out, but the fact that the publication is not only back, but well up for the fight against the supposed death of web education is really inspiring to me. I needed that win, as did many others . I needed it so much, it's spurred me on to write this article to hopefully give us all a shot in the arm. There is no inevitable future and education will always matter A comment I see all the time is "we don't need articles and courses because we can just ask an LLM now", which I guess is true, but I could also eat an entire can of spray cheese. It ain't gonna nourish me! AI technologies have given anyone the ability to bring their ideas to life, but to produce a high quality end product that actually works for the people it needs to work for requires experience, specialist skills and creativity. That is a reality, which aside from Silicon Valley's best efforts, is why there are still working developers out there, regardless of "frontier model" power. Human developer's experience is necessary because LLM outputs still (somehow, after hundreds of billions of investment) fall short. Let me repeat that: their experience is necessary . Who inevitably contributed to that experience? Yep: educators. Let's get to work then This article is mainly addressed to fellow educators, but also to people that write on their personal blogs. You must keep going because people still need us . If we don't, we lose. The LLM era is opening up an enormous skills gap that's only going to get wider as the industry continues to pull up the ladder, eliminating entry level positions. We're needed to help people really understand how all of this stuff works , so even if they are at the behest of LLM mandates , they can produce better outputs. The technology is going nowhere — that toothpaste is long out of the tube — but how many other hype cycles have underwhelmed in the end? Spoiler, all of them The economics of the AI industry simply do not work and the technology — albeit ever-present in development — will fall into its actual place eventually, as a niche tool . With all of this in mind, we're fighting back too, so I'm opening up the guest authoring on this site again , just like Geoff is over on CSS-Tricks . I'm determined to get this website cooking again and I would love to share your words with the rest of the industry. Let's buck up our ideas and get cracking, everyone. There's lots to teach and I know we've got plenty of fight left in us. To quote our very own Mat Marquis : You and me, we’re not done until we say we’re done Don't let the bastards grind you down.

  • QuirksBlogTop Front-end Bloggersread at source

    Things AI cannot do

    Last week I did my first tests in nearly nine years. I’m planning to redo the viewport tests , and I created a new test page . I also wrote an article about meta viewports that will be published eventually. I thoroughly enjoyed myself and was surprised how easy it was for me to slip back into compatibility testing patterns. My reflexes are still there, but I only test on three mobile devices and that saves some time. Then it occurred to me that, while AI can write my article if I give it notes, it cannot do fundamental browser compatibility research. That’s it. That’s the entire blog post.

  • SitePointThe Giantsread at source

    How to Create an App in ChatGPT in 2026

    null Continue reading How to Create an App in ChatGPT in 2026 on SitePoint .

See everything from the last 30 days →