---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [Helix: The internal tool powering our Shopify app's native migration (2026) - Shopify](https://yomu.fyi/post/helix-the-internal-tool-powering-our-shopify-app-s-native-migration-20.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: Talha Naqvi
- Published: Sep 21, 2026
- Type: Announcement

Shopify’s internal tool Helix powers the native migration of its Shopify app, which has over 300 screens. The company previously rebuilt the Shop app in just 12 weeks using similar methods. Helix is a set of tools and skills that help LLMs migrate features and screens from the React Native app while following a highly opinionated architecture. Unlike most tools that gather information, create specs, and implement everything at once, Helix aims for consistent, high-quality, and maintainable results. The approach is now being applied to the larger Shopify App after its success with Shop.


### [Financial Crime Mitigation with MongoDB / Series Overview](https://yomu.fyi/post/financial-crime-mitigation-with-mongodb-series-overview.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Sep 21, 2026
- Type: Problem & solution

Financial crime losses could exceed $2 trillion annually, and legacy systems—fragmented, batch-processed, and transaction-focused—cannot keep pace with modern, AI-powered attacks. MongoDB Atlas offers a unified platform that consolidates entity management, transaction monitoring, behavioral risk scoring, model management, and case management on a single flexible data foundation. Key capabilities include AI-driven entity resolution via Atlas Search’s $rankFusion, network analysis with $graphLookup, and hybrid detection combining rules with vector search. The platform enables real-time intelligence through Change Streams and Time Series Collections, allowing immediate action at the moment of decision instead of retrospective analysis. Organizations can either buy off-the-shelf solutions or build custom platforms on MongoDB, with the build approach offering rapid iteration, freedom from vendor constraints, and competitive differentiation.


### [Financial Crime Mitigation with MongoDB / Part I: Dynamic Customer Profile](https://yomu.fyi/post/financial-crime-mitigation-with-mongodb-part-i-dynamic-customer-profil.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Sep 21, 2026
- Type: Tutorial

This article is the first in a series on building a financial crime mitigation platform with MongoDB as a unified data platform, focusing on the customer onboarding stage. It outlines a three-step process: capturing prospective customer data into a dynamic profile, running candidate basic checks using hybrid search with the $rankFusion operator, and performing compliance verification via network graphs built with $graphLookup. MongoDB’s flexible data model aggregates structured and unstructured data from various sources, enabling a single customer view. The platform supports vectorized profile representations for similarity searches and clustering, all within one cluster without external search engines. The post concludes by noting that the next part will explore AI-enhanced due diligence processes.


### [Financial Crime Mitigation with MongoDB / Part III: Behavioral Risk Modeling for Event-Driven Fraud Detection](https://yomu.fyi/post/financial-crime-mitigation-with-mongodb-part-iii-behavioral-risk-model.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Sep 21, 2026
- Type: Explainer

MongoDB’s document model and event-driven architecture support behavioral risk modeling for fraud detection in financial institutions. The platform combines rule-based policies with probabilistic reasoning, using change streams for real-time event processing and vector search for similarity assessment. MongoDB captures behavioral events like typing patterns and device IP addresses, aggregating them into dynamic customer profiles. Vector search compares incoming transactions against historical patterns, but it does not evaluate numerical data such as transaction amount, which requires traditional risk scoring. This approach reduces false positives and lowers total cost of ownership by minimizing manual intervention, while MongoDB’s flexible schema allows adding risk factors without downtime.


### [tokenizers v1: encode, decode and scaling, measured](https://yomu.fyi/post/tokenizers-v1-encode-decode-and-scaling-measured.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Arthur Zucker, Simon Brandeis, Luc Georges, Lysandre
- Published: Sep 21, 2026
- Type: Announcement

The tokenizers library is being reworked for version 1 with a heavy focus on performance, as tokenization can become a bottleneck that starves models of data when workloads scale. The work draws on ideas from other open-source tokenizers like gigatoken, tiktoken, and kitoken. Key optimizations include using SIMD instructions for UTF-8 text, ensuring merges never cross pre-token boundaries, and reusing scratch buffers to avoid allocations. The release candidate is implemented in the Rust pre-release on crates.io, with the crate split into tk-encode, tk-serialize, tk-convert, and tk-train. Batched model calls and faster decoding with parallel batch processing are also part of the improvements.


### [Building Secure AI Agents with Microsoft Agent Framework and Auth0: Human-in-the-Loop Approval](https://yomu.fyi/post/building-secure-ai-agents-with-microsoft-agent-framework-and-auth0-hum.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Andrea Chiarelli
- Published: Sep 21, 2026
- Type: Tutorial

The post details how to add secure human-in-the-loop approval to an AI expense agent built with Microsoft Agent Framework and Auth0, completing the four-part series that handles identity, authorization, and action. Because approval is a security-sensitive action requiring the same cryptographic rigor as any authentication event, the agent uses Client-Initiated Backchannel Authentication (CIBA) to push a notification to the manager’s phone instead of accepting chat input. The notification includes a binding message describing the expense by ID, amount, vendor, and context, giving the manager enough information to decide from a lock screen. The agent polls Auth0’s token endpoint until the manager approves or denies, then uses the CIBA-issued access token scoped with approve:expenses to record the decision on a separate Expense API. This design ensures approval decisions are cryptographically bound to the manager’s identity and verifiable by downstream services, completing the secure loop.


### [RADAR: Catch gray failures with anomaly detection](https://yomu.fyi/post/radar-catch-gray-failures-with-anomaly-detection.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Hongwen (Olivia) Song
- Published: Sep 19, 2026
- Type: Problem & solution

Gray failures are partial customer-facing problems that can leave health checks green while a subset of users quietly fails. RADAR (Reliability Anomaly Detection, Alerting, and Root-cause analysis) addresses this gap by collecting error counts and distinct affected users, segmented by error code and region, then applying the unsupervised streaming SPOT model. SPOT learns normal behavior from the previous 14 days using a single risk parameter, while downstream stages enrich, filter, deduplicate, and route alerts before providing anomaly details and AI/BI Genie-backed dashboards for investigation. Running RADAR internally reduced incident-discovery time by 95% with over 90% precision and no human needed to spot the pattern. The post also describes a Databricks scaffold that maps metrics, detection, alerting, and root-cause analysis to platform components and can be assembled by an AI agent from a metric, scaffold, and prompt.


### [Your sandbox can now serve requests](https://yomu.fyi/post/your-sandbox-can-now-serve-requests.md)
- Company: [Boxcompute](https://yomu.fyi/company/boxcompute.md)
- Author: boxy
- Published: Sep 19, 2026
- Type: Announcement

Sandboxes have traditionally been outbound-only machines, unable to receive inbound connections because they sit behind NAT with no public IP or open ports. BoxCompute now enables sandboxes to serve requests by using Tailcat, an open-source library from Tailscale that performs NAT traversal. Tailcat establishes a direct peer-to-peer WireGuard-encrypted path between the client and sandbox, using a DERP relay only for the initial handshake. This approach avoids the latency and bandwidth bottlenecks of relay-based tools like ngrok or Cloudflare Tunnel, and keeps the relay out of the data path. The feature is rolling out as an early preview with scoped, short-lived grants for selected TCP ports.


### [ReadyOn’s Four Walls of tenant isolation on Amazon EKS](https://yomu.fyi/post/readyon-s-four-walls-of-tenant-isolation-on-amazon-eks.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Roshan Daneshvaran
- Published: Sep 18, 2026
- Type: Explainer

ReadyOn describes a four-layer tenant-isolation architecture for Harmony, its multi-tenant workforce-intelligence platform on Amazon EKS, which handles payroll data, organizational hierarchies, and operational analytics. The design combines dedicated Kubernetes namespaces, Karpenter-managed tenant node pools, per-tenant Amazon VPC security groups, and dedicated Amazon Aurora databases, with RBAC, admission control, default-deny network policies, IAM Roles for Service Accounts, and tenant-scoped secrets. GitOps through Argo CD ApplicationSets provisions identical controls and continuously reverts drift, while dual taints and admission validation prevent cross-tenant scheduling. ReadyOn says adversarial exercises have blocked all six tested cross-tenant paths to date, and reports defenses across 10 threat-model stages, though shared control-plane dependencies make the layers defense in depth rather than fully independent probabilities.


### [Partnering with Accenture on embedded evaluation](https://yomu.fyi/post/partnering-with-accenture-on-embedded-evaluation.md)
- Company: [Anthropic](https://yomu.fyi/company/anthropic.md)
- Published: Sep 18, 2026
- Type: Announcement

Anthropic is partnering with Accenture’s specialist AI business, Faculty, on independent evaluation of frontier AI, advancing a commitment to embed evaluators within Anthropic. The work will cover model evaluation and red-teaming, alignment assessments, and testing safeguards, informed by Accenture’s experience deploying AI across industries. Anthropic and Accenture each expect to invest at least $1 billion in building capacity over five years, although operating details, access standards, reporting practices, and funding models remain unsettled. Embedded evaluators would work inside AI companies with employee-comparable access to observe training, follow development and deployment decisions, speak with staff, verify safety commitments, identify blind spots, and report incidents; Anthropic says its partnership is non-exclusive and that model safety remains its responsibility.


### [Benchmarking LLM Inference at Scale with AIPerf](https://yomu.fyi/post/benchmarking-llm-inference-at-scale-with-aiperf.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Elizabeth Goodman
- Published: Sep 18, 2026
- Type: Benchmark

AIPerf is NVIDIA’s successor to GenAI-Perf, intended to benchmark large-scale LLM inference without letting the load client become the bottleneck. Its multiprocess architecture combines worker processes, separate record-processor services, and ZMQ coordination, while supporting 15+ endpoint types, public datasets, and trace-replay formats. The walkthrough serves Qwen3-0.6B through vLLM, using streaming synthetic requests with fixed 128-token inputs and outputs; AIPerf reports TTFT, ITL, request latency, output token throughput, percentile distributions, and optional GPU telemetry in CSV and JSON. A second profile uses Poisson arrivals averaging 10 requests per second, variable input and output lengths, and a fixed random seed, producing wider latency distributions than the static baseline as concurrency and workload variability increase.


### [Enabling secure, productive work on personal devices](https://yomu.fyi/post/enabling-secure-productive-work-on-personal-devices.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Steven Angle, Brian Schaffner
- Published: Sep 18, 2026
- Type: Explainer

Personal devices let employees use Slack, approve requests, and access internal apps, but they combine corporate data with private content that Databricks cannot inspect or control. The proposed mobile security model layers Mobile Device Management (MDM), identity and context-aware authentication, Zero Trust Network Access (ZTNA), and application management. On iOS, Account-Driven User Enrollment creates an encrypted workspace without full device management, while Android Work Profile provides comparable separation; per-app VPN keeps work traffic apart from personal traffic. Access requires strong authentication, a managed device, and a trusted tunnel, with continuous posture checks able to block unhealthy devices. Managed apps, configurations, tenant controls, and sensitivity tiers contain data where supported, while transparency about privacy encourages enrollment and supports mobile apps such as Genie.


### [Saving another 100TB of RAM with math (and Rust)](https://yomu.fyi/post/saving-another-100tb-of-ram-with-math-and-rust.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Ivan Babrou
- Published: Sep 18, 2026
- Type: Explainer

Cloudflare describes how excessive memory use in pingora-ketama, the consistent-hashing component of its Pingora Backend Router, was investigated as a resource-efficiency problem at global scale. Consistent hashing maps servers and cache keys onto a circular hash space, but a single hash per server creates uneven ranges, while multiple hashes improve balance; with 160 points per server, the coefficient of variation falls to about 8% in the 100-server example. The work produced a v2 ring with compacted storage, faster sorting, and a configurable base number of hashes per node, while retaining the existing v1 ring and supporting simultaneous use during migration. After the old ring was decommissioned, measured memory usage for PBR fell by 100TB globally, and the changes are available in pingora-ketama behind an unadvertised Cargo feature.


### [How Notion handles concurrent editing with CRDTs](https://yomu.fyi/post/how-notion-handles-concurrent-editing-with-crdts.md)
- Company: [Notion](https://yomu.fyi/company/notion.md)
- Author: Angelique Nehmzow, Emma Guo
- Published: Sep 18, 2026
- Type: Explainer

Notion replaced its text-editing system because its former last-write-wins storage could overwrite concurrent edits to the same block, with Offline Mode increasing the risk of lost changes. The new system uses a Conflict-free Replicated Data Type based on Replicated Growable Array, representing inserted text as uniquely identified items, retaining deletions as tombstones, and deterministically ordering concurrent inserts. Peritext-based annotation operations merge rich-text formatting such as bold, italics, and hyperlinks while preserving extendability rules. To keep edits correctly positioned when Enter splits a block, Notion introduced text slices, text slice trees, text instances, and compact search labels for locating slices across blocks. Deployed in July 2025, the system processes millions of CRDT operations per minute and supports Offline Mode and agent collaboration.


### [How CSIRO built scalable, cost-optimized genomic variant querying on AWS](https://yomu.fyi/post/how-csiro-built-scalable-cost-optimized-genomic-variant-querying-on-aw.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Prof. Denis Bauer
- Published: Sep 18, 2026
- Type: Explainer

CSIRO built Serverless Beacon (sBeacon), a production-ready implementation of the Global Alliance for Genomics and Health (GA4GH) Beacon protocol for secure genomic variant querying. Its serverless architecture combines Amazon S3, AWS Lambda, Amazon DynamoDB, and Amazon Athena: genomic data remains in its original S3 location, while metadata is indexed in ORC tables and ontology indexes for query processing. Standard VCF files can be queried through API Gateway, with modular Lambda functions resolving ontology terms, querying Athena, and, when needed, issuing HTTP byte-range requests to source buckets so raw VCF bytes do not leave their owning organization. The post reports support for hundreds of millions of individuals and billions of genomic locations, approximately USD 0.40 monthly operation for a 1000 Genomes-scale dataset, roughly five-second real-world queries, and about 18-second generation-to-use onboarding, while noting that whole-genome range queries can time out.


### [The AIDEs Framework: How We Built a “Theory of Everything” for AI Development Tools](https://yomu.fyi/post/the-aides-framework-how-we-built-a-theory-of-everything-for-ai-develop.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Stanislav Tikhomirov
- Published: Sep 18, 2026
- Type: Explainer

JetBrains presents the AIDEs Framework as a model for understanding how AI development tools evolve, rather than trying to track every market change. The post describes a progression from single-line completion through multiline completion, IDE chat, AI code editors, agentic development environments, and cloud-based agents. It defines an Artificial Intelligent System as a system that demonstrates intelligence in helping users achieve goals, and an Artificial Intelligent Development Environment (AIDE) as an AIS for creating software; intelligence may come from deterministic heuristics as well as LLMs. The framework treats principals and agents as potentially human or AI actors and views software creation as a broader delegation process than coding alone. It proposes examining assumptions, building a model, and validating it against ongoing change, while suggesting a possible future of vertically integrated Agentic Software Production Platforms that use AI as an “intelligence” resource.


### [Making Local AI Smarter and Faster](https://yomu.fyi/post/making-local-ai-smarter-and-faster.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Vladimir Sotnikov
- Published: Sep 18, 2026
- Type: Announcement

Junie Local’s update introduces Qwen3.8-3.6-27B-blend, a merged model that balances speed and capability for local coding agents. The blend, created by merging Qwen3.6 and Qwen3.8 weights in equal proportions, completed 37 tasks in a 100-task internal benchmark, compared to 34 for Qwen3.6 and 39 for Qwen3.8, while generating 71% fewer output tokens than Qwen3.8. The runtime uses multi-token prediction (MTP), with a two-token proposal on M5 MacBook Pro making decoding 60% faster. A four-bit MTP head was kept over an eight-bit one due to similar acceptance rates and memory savings. The update also brings experimental NVIDIA RTX support on Windows for machines with at least 24 GB of VRAM.


### [Red Hat OpenShift networking: Default OVN-Kubernetes vs. Cilium operator](https://yomu.fyi/post/red-hat-openshift-networking-default-ovn-kubernetes-vs-cilium-operator.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Amjed Jabari (AJ), Wuxin Zeng, Rodrigo Gonzalez
- Published: Sep 18, 2026
- Type: Explainer

The article compares Red Hat OpenShift’s default OVN-Kubernetes CNI with the Cilium operator for teams managing microservices, AI workloads, and declarative multi-cluster infrastructure with Cluster API (CAPI). It describes OVN-Kubernetes as natively managed by the OpenShift Cluster Network Operator, with Open vSwitch foundations, hardware offloading, Multus and OpenShift Virtualization compatibility, and OVN Interconnect for large-scale deployments. Cilium uses kernel-level eBPF programs and offers identity-based policies, sidecarless service mesh capabilities, and Hubble Layer 7 observability, while CAPI manifests and MachineSets support declarative worker-node provisioning. The source recommends Cilium for new clusters when eBPF capabilities and CAPI integration justify added operational complexity, while positioning OVN-Kubernetes as the simpler choice for integrated lifecycle management and hardware acceleration.


### [Matching OpenShift edge topologies to your physical footprint](https://yomu.fyi/post/matching-openshift-edge-topologies-to-your-physical-footprint.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Daniel Froehlich
- Published: Sep 18, 2026
- Type: Explainer

Red Hat OpenShift topologies are mapped to edge-site constraints such as hardware footprint, availability, rack space, power, and workload needs. It is presented as a micro cloud that brings full Kubernetes functionality to server-class edge hardware, with optional virtualization and software-defined storage. Cluster capabilities can be minimized with baselineCapabilitySet: none and selectively enabled later, although added capabilities cannot be removed without reinstalling. Options span single-node OpenShift, which requires 4 vCPUs, 16 GB RAM, and 120 GB storage, two-node designs using fencing or an arbiter, and three-node compact clusters for resilient high availability. Each topology retains shared management and security practices, so selection depends on the physical footprint, failure tolerance, and scale required at the site.


### [What did AI cost you this quarter?](https://yomu.fyi/post/what-did-ai-cost-you-this-quarter.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Markell Rawls, Suhas Kashyap
- Published: Sep 18, 2026
- Type: Tutorial

AI infrastructure costs are often billed to a platform team as one lump sum, leaving Finance without a departmental breakdown and teams without feedback on their usage. The post presents a working demo on Red Hat OpenShift AI that attributes requests and token consumption through department-specific MaaS API keys, shared model servers, Prometheus metrics, Perses dashboards, and MLflow traces. In its example, three departments generate 79,420 inference requests and consume 634 million tokens against a $14,200 quarterly bill, while Marketing’s 32% GPU utilization reveals roughly $34,000 in annual waste. The system combines aggregate usage filters with request-level details such as prompts, token counts, latency, and calculated cost, and the post argues that showback helps identify inefficient allocations and model mismatches rather than police teams.


[Newer posts](https://yomu.fyi/posts/page/38.md) · [Older posts](https://yomu.fyi/posts/page/40.md)