---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [How energy teams turn theft detection into governed action with Genie and AI business processes](https://yomu.fyi/post/how-energy-teams-turn-theft-detection-into-governed-action-with-genie.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Daniel Zoccali, Jack Yallop
- Published: Sep 15, 2026
- Type: Problem & solution

Energy theft detection often stops at an ML risk score, leaving revenue-protection teams to manually interpret cases, prepare investigations, dispatch crews, recover losses, and report results. The described Databricks workflow turns that score into a governed operational loop: Lakeflow prepares features, models run through Model Serving and Unity Gateway, and a Databricks App uses Lakebase to store live case state. AI-generated summaries explain why accounts were flagged, while dispatch-ready reports provide next steps, evidence checklists, and safety notes. Genie One answers leadership questions using metric definitions in Unity Catalog, and an Agent Bricks Multi-Agent Supervisor can assemble a traceable month-end board pack. Unity Catalog lineage, PII labels, access controls, model guardrails, and Unity Gateway routing support regulated use under frameworks including Ofgem’s and ELEXON’s requirements, while the same pattern is presented as applicable to other ML-driven interventions.


### [Your Agent Aced the Task. Will It Do It Again?](https://yomu.fyi/post/your-agent-aced-the-task-will-it-do-it-again.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Evelyn Duesterwald, Lilian Ngweta, Vatche Isahagian, Jayaram Radhakrishnan, Vinod Muthusamy, Gaodan Fang, Ashwath Vaithinathan Aravindan, Punleuk Oum, G Thomas, Merve Unuvar, Ayhan Sebin, Michał Ulewicz
- Published: Sep 15, 2026
- Type: Explainer

Agent reliability can be obscured by average benchmark scores: Mean@k reports average success, while Pass^k measures tasks succeeding on every repeated run. On AppWorld, a ReAct agent using GPT-4.1 achieved Mean@5 of 77.4% but Pass^5 of 53.0%, leaving a 24.4-point consistency gap, with temperature set to 0.0. The Consistency Analyzer diagnoses flip-prone decision points by resampling each step in one recorded trajectory with k=5 completions, requiring no ground truth, logits, or end-to-end replay. ALTK-Evolve turns flagged instability into reusable consistency guidelines that are retrieved at inference time. In the reported evaluation, these guidelines raised aggregate Pass^5 to 69.0% from 53.0% and Mean@5 to 81.0% from 77.4%, cutting the gap to 12.0 percentage points; similar-task Pass^5 also improved by 13.0pp.


### [Scaling Federated Learning Across Docker, Kubernetes, and Slurm with NVIDIA FLARE](https://yomu.fyi/post/scaling-federated-learning-across-docker-kubernetes-and-slurm-with-nvi.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Elizabeth Goodman
- Published: Sep 15, 2026
- Type: Explainer

NVIDIA FLARE addresses the operational challenge of running federated learning across sites that use different infrastructure, including Docker, Kubernetes, and Slurm. Its two-layer architecture keeps long-running server and client parent processes available for authentication and coordination while launching transient job workers through each site’s native runtime. Jobs declare portable GPU, CPU, and host-memory requirements, which local launchers translate into Docker containers, Kubernetes pods, or Slurm allocations; studies add scoped membership and site-owned mappings for datasets, images, secrets, and scheduling policy. The result is a heterogeneous federation where organizations retain local resource authority, can allocate compute on demand, and run multiple studies without requiring one shared platform.


### [Java 27 in IntelliJ IDEA](https://yomu.fyi/post/java-27-in-intellij-idea.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Marit van Dijk
- Published: Sep 15, 2026
- Type: Explainer

Java 27, released on September 15, 2026, follows Java’s six-month release cadence and includes nine JEPs: four final features, four previews, and one incubator feature. IntelliJ IDEA supports Java 27 from day one, with setup through Project Structure, automatic JDK configuration from .sdkmanrc or .tool-versions, and language-level controls for stable and preview features. Stable changes include G1 as the default garbage collector in all environments, hybrid post-quantum key exchange for TLS 1.3, compact object headers by default, and JFR in-process data redaction. Preview and incubator work covers lazy constants, primitive types in patterns, instanceof, and switch, PEM cryptographic encodings, and the Vector API, while faster debugger stepping is available through a JDK 27 fix also backported to JBR 25.


### [Replica-aware routing public beta](https://yomu.fyi/post/replica-aware-routing-public-beta.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Sep 15, 2026
- Type: Announcement

ClickHouse’s replica-aware routing is now in Public Beta for Enterprise customers, addressing cases where temporary tables and named sessions become invisible after a request reaches another replica. The feature routes requests to a consistent replica using an X-ClickHouse-Replica-Tag or a native TLS SNI override, supporting session-scoped access and read-after-write consistency. Over HTTP, Envoy reads the header and uses consistent hashing; native connections decouple the SNI used for routing from the hostname validated against the certificate. Stickiness is best-effort and can change after upgrades, restarts, or scaling, so temporary objects and session settings may need recreation. The feature is available through service settings for Enterprise plans on standard ClickHouse Cloud and BYOC.


### [Introducing ClickHouse's new TimeSeries Engine: Your drop-In Prometheus replacement](https://yomu.fyi/post/introducing-clickhouse-s-new-timeseries-engine-your-drop-in-prometheus.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Sep 15, 2026
- Type: Announcement

ClickHouse announces the private preview of PromQL and its TimeSeries table engine in ClickHouse Cloud, allowing Prometheus metrics to be sent through remote write and queried in ClickStack, Grafana, or ClickHouse. Prometheus metrics are shaped by pull-based collection: applications expose current state, collectors add scrape-time timestamps, and types such as counters, gauges, histograms, and summaries determine interpretation. PromQL preserves the resulting semantics, including counter reset handling, range-window extrapolation, and histogram bucket processing, rather than requiring teams to reproduce those rules in SQL or a translation layer. The announcement describes limited preview access, says supported functions and operators are documented separately, and identifies future work around downsampling, native histograms, rules, additional protocols, and direct OpenTelemetry export.


### [Red Hat Developer Hub: Preventing compliance violations with AI coding agents](https://yomu.fyi/post/red-hat-developer-hub-preventing-compliance-violations-with-ai-coding.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Evan Shortiss, Ben Wilcock
- Published: Sep 15, 2026
- Type: Explainer

AI coding agents can generate services quickly, but they may miss organization-specific architecture, ownership, and compliance rules stored in an internal developer portal. A demo connects Claude Code to a Backstage-based Red Hat Developer Hub through Backstage CLI actions, allowing the agent to query domains, components, APIs, software templates, and TechDocs before proposing a design. In a simulated Parasol Insurance catalog with more than 500 entities across 14 domains, the agent finds an existing but unrelated reconciliation service and resolves a Claims–Billing messaging conflict by keeping IBM MQ at the payment boundary and publishing internal events to Kafka. It then uses catalog relationships and specifications to identify integrations and produces a Technology Decision Summary that cites the sources behind each choice, making the resulting decisions reviewable and traceable.


### [Have it both ways: stay discoverable in search while disallowing AI training](https://yomu.fyi/post/have-it-both-ways-stay-discoverable-in-search-while-disallowing-ai-tra.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Bryan Becker
- Published: Sep 15, 2026
- Type: Announcement

Cloudflare announces a Disallow AI Training setting intended to let website owners refuse AI training while keeping content available to search crawlers. The problem is mixed-use crawlers such as Applebot, Bingbot, and Googlebot, which can serve both search indexing and model training, making a simple block affect discoverability. Cloudflare says its network can publish preferences, identify and classify crawlers, block those that ignore controls, and report operator behavior on Radar; the setting publishes a no-training preference through robots.txt while allowing Accountable mixed-use crawlers for search. Apple, Google, and Microsoft meet or have committed to meet the Accountable requirements, which include training and summary opt-outs, URL-level visibility, metrics, and assurance that training opt-outs will not affect traditional search.


### [Give every teammate and agent the right level of access to your Workers](https://yomu.fyi/post/give-every-teammate-and-agent-the-right-level-of-access-to-your-worker.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Dina Kozlov
- Published: Sep 15, 2026
- Type: Announcement

Cloudflare has introduced resource-level access controls for Workers, allowing a teammate or agent to access one specific Worker rather than other resources in an account. Four roles define progressively broader capabilities: Metadata Read-Only exposes settings and observability data, Content Read-Only permits code or product-content reads, Editor allows content and settings changes without resource deletion, and Admin provides full control. These roles can be assigned to dashboard users or attached to scoped API tokens, supporting debugging without source exposure, code review without deployment, and CI/CD deployments limited to one Worker. Worker-level access also governs Durable Objects, while routes and Custom Domains require both Worker Editor access and Workers Routes permission; existing legacy permissions continue to work, but the new roles are recommended for granular access and are planned for D1, R2, and KV.


### [Let’s talk wait times and delays](https://yomu.fyi/post/let-s-talk-wait-times-and-delays.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: Sep 15, 2026
- Type: Announcement

The update explains how drivers can be compensated when pickups, additional stops, route changes, or road delays make a trip take longer than expected. At the first pickup, wait-time and no-show fees may apply, with the pickup screen showing elapsed wait time and potentially applicable amounts; at an additional stop, stop-time fees now begin after one minute rather than two, and the app displays both waiting time and earnings. If a rider adds a stop or changes the destination, the app shows the new drop-off address and fare change. For eligible trips running at least five minutes longer than estimated from pickup to drop-off, Delayed Ride Guarantee can automatically increase the fare, with higher potential earnings for trips exceeding 15 extra minutes; receipts explain the adjustment, reason, and amount, while eligibility varies by location and trip type.


### [How Databricks’ marketers use data 3x more with Genie, an AI analytics assistant](https://yomu.fyi/post/how-databricks-marketers-use-data-3x-more-with-genie-an-ai-analytics-a.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Elizabeth Dobbs, Thomas Russell, Katy Yuan, Sydney Sundell
- Published: Sep 15, 2026
- Type: Problem & solution

Databricks marketers struggled to get trusted answers from fragmented marketing data quickly, prompting the creation of Marge, a marketing implementation of Genie Agents. The team first unified campaign, sales, web, event and advertising information in a governed Marketing Lakehouse, then grounded the assistant in business definitions, verified logic and example queries. Marge translates natural-language questions into analytical queries, uses Unity Catalog for lineage and role-based access, and can ask clarifying questions or perform multi-step analysis. The reported results include threefold greater data use in decisions, more than 85% adoption, 50% quarter-over-quarter growth, over 5,000 answered questions and a 25% reduction in flagged incorrect responses. Databricks attributes the rollout to continuous feedback, benchmark evaluation, focused use cases and embedding Genie in existing workflows rather than treating conversational analytics as a one-time deployment.


### [From Curiosity to Impact: Inside the MongoDB Intern Experience](https://yomu.fyi/post/from-curiosity-to-impact-inside-the-mongodb-intern-experience.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Sep 15, 2026
- Type: Explainer

MongoDB’s internship program provides a multi-layered support network including team mentors, inclusion guides, and early talent program advisors. Interns work on real, impactful projects: Aashcharya built and tested AI agents to automate platform support, Cristina created an open-source Python binding for Atlas Local to simplify AI development, Maria built an end-to-end energy industry solution, and Tyler tackled a storage challenge to make the storage layer more flexible. Mentors teach that revision is part of the job, not a failure, and that taking ownership and earning buy-in are critical skills. Community events such as welcome lunches, bowling outings, and bagel-making classes help interns connect with peers and leadership, including an impromptu AMA with the CMO. Interns leave with improved communication, openness to feedback, and an understanding of sustainable work practices.


### [KubeVirt, VSOCK, and eBPF: who does what?](https://yomu.fyi/post/kubevirt-vsock-and-ebpf-who-does-what.md)
- Company: [Boxcompute](https://yomu.fyi/company/boxcompute.md)
- Author: boxy
- Published: Sep 15, 2026
- Type: Explainer

KubeVirt, VSOCK, and eBPF address different layers, so none replaces the others. KubeVirt adds virtual-machine lifecycle management to Kubernetes, running QEMU in a launcher Pod while KVM uses hardware virtualization features to execute guest code; it does not replace either component. VSOCK provides host–guest communication through a CID-and-port socket address, independently of guest IP networking, but attaching virtio-vsock does not define permitted applications or provide authentication and authorization. For host-enforced control, BPF LSM can use the socket\_listen hook to deny unapproved host-side VSOCK listeners before creation, whereas ordinary XDP and TC filters on VM network interfaces do not see VSOCK traffic; this still leaves existing listeners, per-guest permissions, kernel attack surface, policy lifetime, and other virtual devices to address.


### [Why we chose KubeVirt for our VM sandboxes](https://yomu.fyi/post/why-we-chose-kubevirt-for-our-vm-sandboxes.md)
- Company: [Boxcompute](https://yomu.fyi/company/boxcompute.md)
- Author: boxy
- Published: Sep 15, 2026
- Type: Explainer

BoxCompute chose KubeVirt for its VM sandboxes because workloads need a real Linux machine with a guest kernel, systemd, and machine-level workflows that process-oriented environments do not fully provide. KubeVirt adds VM resource types and controllers to Kubernetes, while launcher Pods run QEMU/KVM and the guest on a worker. The arrangement keeps placement, lifecycle, permissions, storage, and cleanup within the Kubernetes model, avoiding a separate VM management platform, although resource accounting and readiness still require sandbox-specific work. The post stresses that full virtualization does not automatically provide security: the platform still needs deliberate controls for host access, guest traffic, credentials, persistence, and cleanup after failures.


### [How to Orchestrate Multi-Call Conversations with an LLM and Twilio Conversation Memory](https://yomu.fyi/post/how-to-orchestrate-multi-call-conversations-with-an-llm-and-twilio-con-memory.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Amanda Lange
- Published: Sep 15, 2026
- Type: Tutorial

The tutorial builds a C# .NET 9 ASP.NET Core voice service that preserves caller context, preferences, and action history across separate inbound calls. It combines Twilio Conversation Relay and a Twilio Conversation Memory Store with an OpenAI gpt-4o-mini service, using WebSockets to connect the call flow and stream generated text. The setup covers creating the project, installing Twilio, DotNetEnv, and OpenAI packages, configuring credentials and IDs in .env, exposing local webhooks with ngrok, and routing /voice to /ws. The sample assistant is framed as Owlbert's Auto Repair and is instructed to speak naturally, avoid lists and emojis, refer to caller details, and acknowledge uncertainty rather than guess. Testing uses two calls from the same number; the expected result is that the second call recalls first-call details and that Twilio shows a stored conversation summary.


### [What is CIAM in 2026 and why does it matter?](https://yomu.fyi/post/what-is-ciam-in-2026-and-why-does-it-matter.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Ravleen Kaur
- Published: Sep 15, 2026
- Type: Explainer

CIAM has expanded beyond password storage and login-time credential checks as digital experiences include autonomous AI agents and attacks make point-in-time verification less reliable. Modern customer identity is presented as a continuous trust and control layer across web, mobile, messaging, voice, email, and AI interactions, balancing low friction with adaptive risk detection. The architecture separates an identity authority, which owns identity, federation, and authorization, from a trust orchestration layer that evaluates live signals, triggers step-up verification, adapts to mid-session risk, and records decisions. It also must define delegated authority for agents, human approval boundaries, multi-signal decisioning, explainability, consent, and identity resolution. Twilio is described as an adjacent execution layer providing Verify, Lookup, carrier intelligence, device fingerprinting, and passwordless or one-time passcode flows for high-risk moments.


### [How to Connect Your Twilio Agent to External APIs](https://yomu.fyi/post/how-to-connect-your-twilio-agent-to-external-apis.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Amanda Lange
- Published: Sep 15, 2026
- Type: Tutorial

This tutorial shows how to connect a Twilio voice agent to an external REST API so it can retrieve live information during a conversation. It uses C# .NET 9, Twilio Conversation Relay, WebSockets, OpenAI tool calling, and the authentication-free Cat Facts API as a demonstration. An ASP.NET Core application exposes a /voice webhook, connects calls to a /ws endpoint, maintains conversation messages, streams model responses, and executes get\_cat\_fact by requesting and parsing JSON from the Cat Facts service. The guide also covers environment variables, NuGet dependencies, ngrok tunneling, Twilio number configuration, and troubleshooting for webhook URLs and API keys. After setup, callers can ask for a cat fact and receive one from the external service, illustrating how function tools can give voice agents real-time data and perform API-backed work.


### [Build zero-trust AI agents that judge intent, not just syntax](https://yomu.fyi/post/build-zero-trust-ai-agents-that-judge-intent-not-just-syntax.md)
- Company: [Google](https://yomu.fyi/company/google.md)
- Author: Eric Dong, Shubham Saboo
- Published: Sep 15, 2026
- Type: Explainer

Part 2 of the Zero-trust Agents series addresses attacks that deterministic, build-time checks cannot recognize when syntax remains valid. It keeps the Customer Support and Returns Agent, which reads orders, calculates restocking fees in Agent Sandbox, and commits payouts through an issue\_refund tool signed with a hardware-backed Cloud KMS key, then moves enforcement to Gemini Enterprise Agent Platform. Agent Gateway applies three runtime controls: Model Armor screens prompts and responses, Semantic Governance Policies evaluates proposed tool calls against intent, history, and business rules, and Agent Anomaly Detection analyzes behavior across a session. The examples cover prompt injection, a non-refundable digital-license refund, and a multi-turn refund drain; detected anomalies can trigger a new policy that blocks subsequent calls without redeploying the agent.


### [Managed Postgres: What Lakebase Actually Takes Off Your Plate](https://yomu.fyi/post/managed-postgres-what-lakebase-actually-takes-off-your-plate.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Databricks Staff
- Published: Sep 14, 2026
- Type: Explainer

Managed Postgres varies from OS patching alone to operating scaling, failover, backups, recovery, and related database tooling. Lakebase Postgres applies this model to serverless infrastructure, offering automatic scaling, scale-to-zero, PostgreSQL compatibility, automatic snapshots, point-in-time recovery, branching, built-in PgBouncer, and support for extensions including pgvector and PostGIS. Within a region, patching, scaling, failover, and backups run automatically, while encryption, access control, audit visibility, connection pooling, and lakehouse integrations are also addressed. The discussion also stresses checking PostgreSQL versions, configuration, extensions, and migration methods before moving an existing database. Cross-region disaster recovery remains the main exception: it is in Private Preview for AWS, with periodic replication, manual failover, and customer-managed recovery procedures.


### [Announcing On-Demand State Repartitioning for Apache Spark™ Structured Streaming on Databricks](https://yomu.fyi/post/announcing-on-demand-state-repartitioning-for-apache-sparktm-structure.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Thangam Vaiyapuri, Jay Palaniappan, B. Micheal Okutubo, Zifei Feng
- Published: Sep 14, 2026
- Type: Announcement

Stateful Apache Spark Structured Streaming queries historically locked their state-store partition count into the checkpoint, so changing spark.sql.shuffle.partitions after a workload grew had no effect without rebuilding and losing accumulated state. Databricks Runtime 18 and later introduces on-demand state repartitioning, a Public Preview feature that preserves the checkpoint while moving state to a new partition layout. Operators set spark.sql.streaming.stateStore.partitions, stop the query, and restart it; the query finishes any pending microbatch, physically rehashes and redistributes state, then resumes with the requested count. The feature applies to aggregations, stream-stream joins, deduplication, sessionization, and transformWithState, provided the RocksDB state store is used. Repartitioning pauses processing and its duration is reported in controlBatch.REPARTITION; Coveo reports a 40% reduction in related Amazon S3 API costs.


[Newer posts](https://yomu.fyi/posts/page/44.md) · [Older posts](https://yomu.fyi/posts/page/46.md)