---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [Why your non-root container dropped its capabilities (and how to fix it)](https://yomu.fyi/post/why-your-non-root-container-dropped-its-capabilities-and-how-to-fix-it.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Nandan Hegde
- Published: Oct 5, 2026
- Type: Problem & solution

A platform engineer traces why a non-root OpenShift container configured with CAP\_NET\_RAW still fails ping with Operation not permitted. The root cause is that SCC is only an admission-time gate that does not enforce runtime privileges. CRI-O translates the PodSpec into an OCI spec with the capability in the Bounding, Effective, and Permitted sets but deliberately omits ambient capabilities. During the runtime’s UID transition from root to the target non-root user, the kernel clears both Permitted and Effective sets, leaving an empty CapEff. The only mechanism that survives a UID transition for non-root processes is ambient capabilities, which CRI-O intentionally avoids to preserve the Kubernetes assumption that switching to a non-root user drops capabilities. To resolve this, file capabilities can be applied directly to the binary via setcap, avoiding the need for ambient capabilities.


### [Add NeMo Guardrails to a LangGraph agent on OpenShift AI](https://yomu.fyi/post/add-nemo-guardrails-to-a-langgraph-agent-on-openshift-ai.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Tarun Etikala
- Published: Oct 5, 2026
- Type: Tutorial

LangGraph agents can call tools and follow prompts but lack safety guardrails, risking unsafe responses like explaining fraud. NeMo Guardrails acts as a transparent proxy between the agent and LLM, inspecting every request and response without requiring agent code changes. On Red Hat OpenShift AI, the guardrails service is deployed via a NemoGuardrails custom resource managed by the TrustyAI Operator, and the agent’s BASE\_URL points to this service instead of the model endpoint. The example demonstrates three rail types: regex filtering for jailbreak patterns, content safety classification against S1-S13 categories, and topic safety to keep the agent within a banking domain, with optional tracing using MLflow and OpenTelemetry. Rails execute sequentially, with the first failure short-circuiting the chain, and the separation lets safety policy be owned by guardrails while the agent handles reasoning and tools.


### [Everything we launched during Birthday Week 2026](https://yomu.fyi/post/everything-we-launched-during-birthday-week-2026.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Meagan Gamache
- Published: Oct 5, 2026
- Type: Announcement

Cloudflare marked its 16th Birthday Week with 46 announcements spanning open source, application security, AI agent economics, and developer platform upgrades. The week began with a new agentic CLI called cf, an open-source generation pipeline called Forge, and EmDash, a serverless CMS with sandboxed plugins. Tuesday focused on Cloudflare’s intention to become a public certificate authority and post-quantum security tools. Wednesday introduced Pay Per Use and the Monetization Gateway, creating an economic model for AI agents to pay creators when using their content. The week closed with features for faster connectivity and broader accessibility.


### [One year later: the power of 1.1.1.1 interns](https://yomu.fyi/post/one-year-later-the-power-of-1-1-1-1-interns.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Judy Cheong
- Published: Oct 5, 2026
- Type: Announcement

Cloudflare’s internship program, announced a year ago with a goal of 1,111 interns, has hosted 750 interns across 48 teams in nine offices worldwide, including Austin, San Francisco, and London. Interns shipped Cache Transcoding, compressing assets to a third of their on-disk size with Zstandard; CryptoLabe, an internal AI tool for cryptography mapping; and post-quantum visibility in Logpush. AI tools helped interns learn codebases faster and prototype ideas, but managers and mentors remained essential; Iliana measured BGP ORIGIN rewriting on 70% of paths and publicly advocated for removing ORIGIN from route selection. Several Birthday Week launches included intern-authored work, such as Protected Quick Tunnels and native Rust in Workers. The program continues hiring, with many interns returning full-time, aiming to build a new generation of builders.


### [TeamCity 2026.2.1 and 2026.1.5 Are Out](https://yomu.fyi/post/teamcity-2026-2-1-and-2026-1-5-are-out.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Dmitrii Korovin
- Published: Oct 5, 2026
- Type: Announcement

JetBrains has released TeamCity 2026.2.1 and 2026.1.5, two bug-fix updates for the On-Premises versions of TeamCity that address more than 40 security vulnerabilities combined. These updates also resolve specific regressions including TFS projects failing to display diffs, YAML configuration import issues from a main repository branch, and MSBuild tools not being detected after the Visual Studio Build Tools 2026 September update. In addition to the numerous security fixes, these releases deliver performance improvements, better compatibility with integrations, and faster, more stable builds for users. A key compatibility feature allows upgrades or downgrades within the same major version without requiring backup restoration because bug-fix releases share a common data format. Users can upgrade via automatic update within TeamCity, direct download from the JetBrains website, or by pulling the updated Docker image from Docker Hub.


### [Discontinuing Swift Language IDE Support in the Kotlin Multiplatform Plugin](https://yomu.fyi/post/discontinuing-swift-language-ide-support-in-the-kotlin-multiplatform-p.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Anton Makeev
- Published: Oct 5, 2026
- Type: Announcement

JetBrains is discontinuing Swift language IDE features in the Kotlin Multiplatform plugin starting with IntelliJ IDEA 2026.3 and Android Studio Rabbit 2 | 2026.2.2, including editing, syntax highlighting, and navigation within Swift files and between Swift and Kotlin. Running iOS applications and debugging Kotlin code on iOS will remain fully supported, and Kotlin/Native functionality such as Swift Export is unaffected. The existing Swift functionality will remain available in earlier versions of IntelliJ IDEA, Android Studio, and the KMP plugin, though these older versions will not receive further updates. The decision follows analysis showing limited and declining usage, with most iOS developers on KMP projects preferring Xcode for Swift development. The Swift support, originally developed for AppCode, required substantial effort to stay compatible with changes in Swift, Xcode, and the IntelliJ Platform.


### [Twilio Reaches Branded Calling Milestone Across AT&T, T-Mobile, and Verizon Networks](https://yomu.fyi/post/twilio-reaches-branded-calling-milestone-across-at-t-t-mobile-and-veri.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Melissa Blassingame, Robert McCulley, James Lapic
- Published: Oct 5, 2026
- Type: Announcement

Consumers rarely answer unknown numbers, causing legitimate business calls from pharmacies, banks, and delivery drivers to be ignored. Branded Calling addresses this by displaying a verified brand name, logo, and call reason on the recipient’s device to establish trust before the recipient decides to pick up. Twilio expanded Branded Calling to include AT&T (in pilot) alongside T-Mobile and Verizon, building on work since 2021 when they executed the first wireless call using Rich Call Data (RCD) over the PSTN authenticated with STIR/SHAKEN, and later documented the approach and brought the feature to general availability. Customer CareSignal, a healthcare engagement platform, saw a 21% increase in call answer rates. Twilio emphasizes that trust must extend beyond voice to channels like RCS, WhatsApp, Email, and Apple Messages for Business, so the same verified brand carries through every step.


### [TypeSafe AI scales Jev to trillions of tokens in three days on Modal](https://yomu.fyi/post/typesafe-ai-scales-jev-to-trillions-of-tokens-in-three-days-on-modal.md)
- Company: [Modal](https://yomu.fyi/company/modal.md)
- Published: Oct 5, 2026
- Type: Announcement

TypeSafe AI’s Jev is a System One Model that outputs structured decisions with probabilities rather than generating text, taking state and questions as input and returning typed values. It uses a custom architecture, a parallel sampler for maximum efficiency, and a training method called Reinforcement Learning for Calibrated Decisions (RLCD). Unlike autoregressive LLMs, Jev produces outputs in parallel, enabling low-latency responses suitable for workloads like large-scale automation, fast browser use, and generative user interfaces. Launched on a Thursday, Jev topped OpenRouter’s leaderboard for contexts between 1K and 10K tokens one week later, handling 15.1% of requests on that platform. To meet demand exceeding one trillion tokens in three days, TypeSafe used Modal’s serverless platform for bursty, high-concurrency inference without managing their own infrastructure, gaining control over networking, routing, and autoscaling needed for ultra-low-latency serving.


### [MongoDB Queryable Encryption: Prefix, Suffix, and Substring Queries Are Now GA](https://yomu.fyi/post/mongodb-queryable-encryption-prefix-suffix-and-substring-queries-are-n.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Oct 5, 2026
- Type: Announcement

MongoDB announced general availability of prefix, suffix, and substring query support in Queryable Encryption, extending beyond equality and range queries to production workloads at no additional cost in Atlas, Enterprise Advanced, and Community Edition. These capabilities enable expressive text searches on encrypted data without decryption, with the database server never seeing plaintext during query processing. The open-source encryption scheme is independently verifiable, works without specialized hardware, and protects data at rest, in transit, and in use. The new query types enable partial-name lookups, autocomplete, and partial-word filtering on encrypted fields via the native query engine, requiring no external indexes or middleware. This helps meet HIPAA, PCI-DSS, and GDPR compliance by protecting data in use — a stage other encryption methods cannot cover — reducing audit gaps and eliminating workarounds.


### [Together Link: open models in the harness you already use. Start with one command today.](https://yomu.fyi/post/together-link-open-models-in-the-harness-you-already-use-start-with-on.md)
- Company: [Together AI](https://yomu.fyi/company/together-ai.md)
- Published: Oct 5, 2026
- Type: Announcement

Together Link connects coding agents to over 40 production-tier open models on Together AI, cutting model spend by over 50% compared to premium closed models. It integrates with Claude Code, Claude Desktop, Codex, OpenCode, and Pi without requiring any workflow changes. Open models such as Kimi K3, GLM 5.3, DeepSeek V4.1 Flash, and GLM 5.3 Flash now handle both complex architectural tasks and everyday fixes at a fraction of the per-token cost. A per-session router reads each session’s first task and routes it to either a fast, low-cost model or a frontier model; when no Anthropic key is provided it routes between GLM 5.3 and GLM 5.3 Flash, and Together AI serves the largest share of OpenRouter tokens for these models. Billing uses the existing Together API key with pay-as-you-go or credit packs, and a per-session tracker shows what the session would have cost on Opus 5.5.


### [Negotiating Ontological Boundaries in User-Authored Personal Sensing Systems](https://yomu.fyi/post/negotiating-ontological-boundaries-in-user-authored-personal-sensing-s.md)
- Company: [Apple](https://yomu.fyi/company/apple.md)
- Published: Oct 5, 2026
- Type: Explainer

Designed artifacts are ontological, shaping what becomes possible, yet systems enabling user authorship are typically evaluated on usability rather than ontological boundary negotiation. Two open-ended probes using a Wizard of Oz technique were created to let participants experience training a personalized machine learning system on phenomena they defined themselves. In a week-long exploratory study, participants used one of two probes during their everyday lives, allowing observation of boundary negotiations. Four sites of ontological boundary negotiation emerged: the boundaries of a phenomenon, the subject as part of relations, distinguishing signal from noise, and the objectivity of data. The paper offers starting points for supporting boundary negotiation through design and proposes open-ended probes as a method for ontological design.


### [Auth0 Metadata Explained: user\_metadata vs app\_metadata](https://yomu.fyi/post/auth0-metadata-explained-user-metadata-vs-app-metadata.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Carla Urrea Stabile
- Published: Oct 5, 2026
- Type: Explainer

Auth0’s user\_metadata and app\_metadata define a security boundary: user\_metadata is writable by users through the update:current\_user\_metadata scope, while app\_metadata requires privileged scopes available only to confidential clients via the client credentials grant. Post-login Actions reading authorization data like subscription plans or feature flags from user\_metadata allow users to escalate privileges by modifying their own metadata, for example setting plan to enterprise and beta\_access to true. Writing to app\_metadata demands a server-side M2M application with update:users\_app\_metadata scope, which no public client or user token can obtain. The correct practice is to store access-control data such as roles, tenant membership, and IP allowlists in app\_metadata, and non-sensitive preferences like theme or language in user\_metadata. A third field, client\_metadata, holds application-level properties readable via event.client.metadata in Actions.


### [MongoDB 9.0: This Is What a Database Should Be](https://yomu.fyi/post/mongodb-9-0-this-is-what-a-database-should-be.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Oct 5, 2026
- Type: Announcement

MongoDB 9.0 is the most advanced release in MongoDB’s history, designed to eliminate the tradeoffs that force organizations to add infrastructure, compromise security, or rethink architecture as applications grow. Transactional workloads achieve up to 20% higher throughput compared to 8.0, with find-one queries up to 35% faster and update-one queries up to 30% faster, and large deployments see nearly 2x higher throughput. Queryable Encryption now supports prefix, suffix, and substring queries, enabling partial-match searches on encrypted data throughout its lifecycle. Intelligent Workload Management queues transient traffic spikes during overload to keep clusters responsive, buying time for auto-scaling or operator intervention. The release also includes redesigned Atlas Metrics UI, enhanced OpenTelemetry integration for streaming metrics to platforms like Datadog and Prometheus, and a MongoDB extension for Hibernate ORM to ease modernization.


### [Tag, You're It: Using MongoDB Labels To Drive DataDog Business Logic](https://yomu.fyi/post/tag-you-re-it-using-mongodb-labels-to-drive-datadog-business-logic.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Oct 5, 2026
- Type: Announcement

MongoDB Atlas’s integration with DataDog now sends custom cluster-level labels as tags on DataDog metrics objects, allowing users to organize and categorize monitoring data in meaningful ways. Users define key-value labels in MongoDB at the cluster level using the Data API or configuration endpoints, and these labels automatically appear as tags in DataDog. These tags can filter metrics in the Metrics Explorer, group data for dashboards, and set alert priorities based on attributes such as environment, application, or region. For instance, tag-based monitors can trigger a P2 alert for production clusters exceeding query targeting thresholds while assigning lower priority to non-production clusters. This enhancement, available on Atlas M10 cluster tiers and higher, leverages existing MongoDB labeling infrastructure to improve observability and drive business-specific alerting and dashboarding logic.


### [Powering AI-led research through simulation](https://yomu.fyi/post/powering-ai-led-research-through-simulation.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Henokh Fibrianto
- Published: Oct 5, 2026
- Type: Problem & solution

Grab built sim-rs, a self-contained simulator that models its fulfillment marketplace to enable rapid experimentation with dispatch strategies. The simulator processes a city-day of marketplace activity in tens of minutes, using historical data and configurable components for batching, allocation, and cancellation. Agents connected through an autoresearch loop propose changes, run reproducible experiments, and receive computed verdicts, with safeguards against specification gaming such as immutable core data and scoped changes. The simulator also supports A/B/n comparisons within a single run, exposing all arms to the same demand and dynamics to improve translation to production. By making each attempt take minutes instead of weeks, sim-rs allows agents to test thousands of ideas cheaply and receive honest feedback, accelerating research while keeping the simulator faithful through automated translation of production logic and behavioral modeling.


### [Unlocking Data Portability: Preventing Catalog Lock-in with REGISTER and UNREGISTER APIs](https://yomu.fyi/post/unlocking-data-portability-preventing-catalog-lock-in-with-register-an.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Ryan Blue, Marco Kroll
- Published: Oct 4, 2026
- Type: Explainer

The post explains how the REGISTER and UNREGISTER APIs in the Apache Iceberg REST catalog specification enable table portability between catalogs without copying or moving data files. REGISTER attaches an existing table to a new catalog by providing the metadata location, but using it alone creates a split-brain scenario where two catalogs both think they own the table, leading to inconsistent writes and data loss. The UNREGISTER endpoint, contributed to the specification, cleanly removes the table from the old catalog and returns the latest metadata pointer needed by the next catalog. The handoff process combines unregister, receiving the location, and register to ensure exactly one managing catalog at all times. Unity Catalog supports these endpoints in private preview, allowing organizations to move tables between catalogs as their architecture evolves.


### [The Agent Said It Was Done. The Database Disagreed.](https://yomu.fyi/post/the-agent-said-it-was-done-the-database-disagreed.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Tuhin Kundu
- Published: Oct 3, 2026
- Type: Benchmark

ThinkingBox, a benchmark from Microsoft and Hugging Face, grades AI agents on the database state and side effects they leave behind rather than on tool calls or final responses. In a common-set ablation covering 121,680 valid trials across 12 LLM models, 79,853 attempts failed executable checks, and 67.24% of those failures still terminated cleanly and invoked a state-changing tool without error, with wrong field values in 77.61% of them. The benchmark runs every task 20 independent times from identical clean backends, reporting pass@1, pass@20, and observed 20/20 consistency to separate capability from reliability. For example, Kimi-K3 solved 93.89% of tasks at least once but only 13.41% consistently, while Claude Opus 5 completed 47.53% of tasks on every attempt, and Claude Opus 5.5 gained no additional dependability over its predecessor despite higher pass@1. ThinkingBox is available through Hugging Face’s OpenEnv with MIT-licensed code and CDLA-Permissive-2.0 benchmark data.


### [How Genie One reshapes work for finance teams](https://yomu.fyi/post/how-genie-one-reshapes-work-for-finance-teams.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Cynthya Peranandam, Sydney Sundell
- Published: Oct 3, 2026
- Type: Problem & solution

Finance teams must interpret data to guide decisions, but answering follow-up questions often requires manual extraction and metric negotiation, delaying answers past leadership discussions. Genie One is a data-smart AI coworker grounded in business context such as approved metric definitions, fiscal periods, and entity rollups, using Genie Ontology to unify context. It supports workflows including budget variance analysis, cash flow forecasting, financial close management, and spend analytics, allowing plain-language queries like “Which entities have unreconciled intercompany balances above $100,000?” Users can review tables behind answers, schedule recurring reviews, and have results posted to chat with visualizations. Genie One respects each user’s existing permissions, so a corporate controller sees enterprise-wide items while a regional accountant sees only relevant entities.


### [How to choose your first Genie Agents for maximum impact](https://yomu.fyi/post/how-to-choose-your-first-genie-agents-for-maximum-impact.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Nasir Dakri
- Published: Oct 2, 2026
- Type: Problem & solution

With over 1 million Genie Agents created in 2026, the challenge is selecting which to build first for maximum impact. The post presents a rubric scoring candidate workflows on five variables: business impact, demand frequency, data readiness, scope clarity, and governance risk. Scores of 20-25 indicate readiness to build, 14-19 need shaping, and under 14 suggest the workflow is not a good fit; an executive champion is essential regardless of score. Examples include a pension fund’s risk Q&A agent that scored high and saw quick adoption, and a wealth manager’s analytics agent that failed due to metadata gaps. The rubric helps avoid common pitfalls like the ‘everything agent’ and the ‘vanity demo’ by focusing on narrow scope and governed data.


### [In Capital Markets, the Buy Side Runs on NAV. Finance Protects the Fee.](https://yomu.fyi/post/in-capital-markets-the-buy-side-runs-on-nav-finance-protects-the-fee.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Andrea DeSosa, Soheyl Rafi, Ralph Laite, Paul Signorelli, Kim Hatton
- Published: Oct 2, 2026
- Type: Problem & solution

Buy-side asset management finance departments face growing complexity from AI agents influencing valuation, redemption, and reconciliation workflows, while protecting net fee margin and NAV integrity remains their core mission. Databricks Genie One is presented as a data-smart AI coworker grounded in Genie Ontology, which captures business meaning and keeps definitions current as strategies and fee arrangements shift. Behind the assistant, Genie Agents automate overnight fund operations: ingesting custodian files, pricing positions, reconciling records, and producing a preliminary NAV for review. Every figure is traceable to its source, permissioned by role, and provable to investors or regulators, enabling finance teams to see forming risks early. The system does not make investment or valuation decisions; a human remains in the loop for every action.


[Newer posts](https://yomu.fyi/posts/page/23.md) · [Older posts](https://yomu.fyi/posts/page/25.md)