Every post, summarised

Sep 1, 2026

• AWS

  Hybrid cloud orchestration: Modernizing on-premises infrastructure management with AWS

  Managing distributed on-premises infrastructure across hundreds of sites creates inconsistency, manual lifecycle bottlenecks, fragmented visibility, and scalability problems, especially when hardware, operating system, Kubernetes, and application operations span thousands of servers. The proposed design centralizes orchestration in AWS while keeping execution on site, using hybrid connectivity, AWS Lambda, AWS Step Functions, Amazon EventBridge, DynamoDB, AWS Systems Manager, and supporting services. Redfish APIs provide vendor-agnostic bare-metal control for BIOS, firmware, power, and health operations, while EKS Anywhere deploys and operates management and workload clusters on local hardware; orders and inventory records track workflows and resource relationships. DynamoDB Streams also automate DNS, certificates, AWS access, and storage integrations, while centralized observability aggregates server, cluster, and application signals; the post presents architectural patterns and defers detailed implementation workflows and templates to later parts.

• Databricks

  The new Brickbuilder Partner Network tiers for ISVs and Data Providers are here

  The Databricks Partner Network has launched Bronze, Silver, Gold, and Platinum tiers for ISVs and data providers, with placement based on customer impact, technical excellence, strategic alignment, readiness and enablement, and joint go-to-market activity. Technical Excellence is evaluated through the Partner Well-Architected Framework (PWAF), which provides prescriptive, AI-ready guidance for secure, reliable integrations and serves as the standard for validated architecture. For customers, the tiers signal that a partner solution has met a high bar for architecture, security, compliance, and joint customer success, reducing vetting effort. For partners, each tier defines requirements and a roadmap tied to greater visibility, co-selling, and go-to-market support, while Databricks plans to refine the program and expand benefits over the coming months.

• Databricks

  How Discovery Bank delivers hyper-personalized banking at scale: behavioral AI, governed data, and real-time decisioning

  Discovery Bank’s hyper-personalized banking model addresses how to make interactions relevant to individual behavior while meeting financial-services demands for scale, speed, security, and governance. The bank combines demographic, transactional, digital-engagement, savings, borrowing, credit-risk, rewards, and lifestyle-related data on the Databricks Data and AI Platform, producing governed reusable features, indicators, scores, forecasts, and recommendations. Behavioral models and a reusable next-best-action decisioning layer support personalization, fraud detection, servicing, and banker assistance; TRUST alerts assess transactions against client-specific norms and can escalate from explanation to account locking. A four-layer architecture adds control services and specialized generative AI and agents to trusted data and analytical foundations, with governance remaining in the loop. Reported results include a 40% uplift in client engagement impact, 20x faster pipeline development and data processing, 5x faster data-product creation, more than 300 models built per day, and return on investment above 500%.

• Uber

  From Chaos to Control: Addressing Shard Distribution Challenges in M3DB with Subclusters

  M3DB’s sharded placement algorithm lets replicas spread across nodes subject primarily to isolation-group constraints, but large clusters experienced broad failure and maintenance impacts. The subclustered placement algorithm partitions nodes into fixed-size, self-contained groups, each owning a distinct shard slice while preserving replica separation across isolation groups. It requires equal instance weights, scaling in multiples of the subcluster size, a replica factor that cannot change through AddReplica, and instancesPerSubcluster divisible by RF. During scaling, a greedy donation strategy simulates removing each candidate shard, ranks the resulting per-node skew, and chooses the shard that leaves the donor most balanced, avoiding a second rebalancing move. The resulting model contains recovery within subclusters, enables parallel maintenance, and reduces arbitrary shard sharing from O(cluster) to O(subcluster), while the original algorithm remains suitable for smaller clusters or impractical scaling steps.

• AWS

  MCP went stateless: Is your AWS MCP server deployment well-architected?

  MCP 2026-07-28 removes the initialize handshake and Mcp-Session-Id, making the protocol core stateless and changing how remote servers scale on AWS. Requests carry protocol version and client context, while server/discover can expose versions, capabilities, and identity; continuity remains possible through server-minted identifiers passed in tool arguments and stored application state. It covers round-robin routing, header-based gateway signals, cache freshness fields, W3C Trace Context, idempotent tools, and Multi Round-Trip Requests for input-dependent calls. It recommends retaining sticky routing and session stores for 2025-era clients, then migrating after legacy traffic reaches zero and validating against the official conformance suite. The conclusion is that the revision aligns remote MCP deployments with AWS Well-Architected practices and permits removal of infrastructure required only by the old protocol.

• Cloudflare

  How we could save petabytes of cache storage with Zstandard and Pingora

  Cloudflare prototyped Cache Transcoding, a Pingora-based architecture that stores eligible cache responses as Zstandard (zstd) rather than their original representation. On a fill, the proxy compresses qualifying uncompressed text at zstd level 3, records the compressed representation and original content length, keeps it compressed on disk and between Tiered Cache layers, and decodes it on the client-facing path. Eligibility requires a 200 OK response, compressible text, no existing Content-Encoding, known Content-Length of at least 4 KiB, and excludes several request and binary-content cases. In initial tests, eligible assets shrank to roughly one-third of their original on-disk size, with a 2.834x ratio, while encoding cost 4.31 ns per byte and decoding 1.56 ns; the modeled CPU increase stayed within budget, though broader testing remains necessary.

• Jetbrains

  The Grails Plugin Has a New Home: Apache Grails

  The Grails plugin for IntelliJ IDEA, providing framework-aware coding assistance, GSP tooling, and GORM integration, has moved to the Apache Grails project. The Apache Software Foundation now owns its source code, while the Apache Grails Project Management Committee oversees development, releases, and compatibility rather than IntelliJ IDEA release cycles. The Grails team builds, signs, and publishes updates to JetBrains Marketplace under the Apache Grails vendor listing; build 262.0.0 supports IntelliJ IDEA 2026.2. Existing users do not need to migrate, and the plugin ID remains unchanged for now, but beginning with 2026.2 it is no longer bundled by default with IntelliJ IDEA Ultimate. Users who cannot find it in the IDE can install it from Marketplace, where JetBrains will continue featuring the plugin.

• Sentry

  Application Metrics caught my broken size estimator

  Cliparr’s video size estimator was intended to predict output size from target bitrate multiplied by clip duration, but real-world results could vary because its VBR encoder changes bitrate with content. Rather than manually testing a matrix of formats, codecs, and quality settings, the author extracted the browser-based export engine into Cliparr Convert, a standalone static converter, and instrumented it with anonymous Sentry Application Metrics. Completed conversions record actual and estimated bytes, their ratio and delta, plus attributes such as output format, quality, and estimator basis; counters also track conversion completion and the progressive web app installation funnel. The resulting dashboard exposed an estimate that was off by 83% and supports grouping real usage by conversion conditions, while sending only numeric metrics and not media, filenames, or URLs.

• Jetbrains

  Ensuring Code Compliance in Public Sector Software Projects

  Public sector software must satisfy data protection, security, accessibility, procurement, supply-chain, and infrastructure requirements while protecting sensitive citizen data. Compliance failures can expose organizations to breaches, penalties, legal costs, contract disputes, and reputational damage. The brief organizes common risks around secure development, contractual and procurement obligations, audit evidence, long-term supportability, and IT governance, noting examples such as hardcoded credentials, weak cryptography, vulnerable dependencies, license conflicts, unsupported libraries, and unchecked quality issues. It recommends embedding automated SAST, secret detection, cryptography and dependency scans, license checks, quality gates, technical debt metrics, freshness tracking, testing, and time-stamped reports into IDE and CI/CD workflows, plus self-hosted or air-gapped deployment where policy requires it. These controls are presented as ways to catch problems before production, create audit trails, support handovers, and maintain compliance over long software lifecycles.

• Red Hat

  Orchestrate production RAG with OpenShift AI

  This guide shows how to move a streaming retrieval-augmented generation (RAG) workflow from a monolithic Ray Data script to modular AI pipelines on OpenShift AI. It addresses failure recovery and run traceability by separating parsing and chunking, ingestion, model download, and deployment into five reusable components. Parsed and chunked JSONL is stored in S3-compatible storage so KFP can rerun ingestion without repeating document processing, and each run records parameters, timestamps, logs, and status. The data chain uses Docling’s HybridChunker and Ray map_batches with ActorPoolStrategy, while the model chain downloads a Hugging Face model and deploys it through vLLM and KServe in parallel. For embedding ingestion, the workflow supports local CPU processing with granite-embedding-125m-english or a dedicated GPU vLLM service for larger collections and offers notebooks for deployment and query validation.

• Jetbrains

  Authenticating TeamCity Builds to External Services With OIDC

  Static CI/CD credentials can leak through logs or artifacts, expose uncertainty over who copies them, and require rotation, so the article presents OIDC as an alternative for authenticating TeamCity builds. It explains the workload flow: an identity provider issues a signed JWT whose claims include validity, audience, and issuer, while the consuming service retrieves metadata and JWKS, verifies the signature, and checks those claims. The TeamCity OIDC JWT plugin makes the server an identity provider, supports RSA- or ECDSA-based signing, key rotation, configurable public issuer hosting, and extensions for HSMs or key-management services. After installation from JetBrains Marketplace, build configurations can issue tokens at startup or on demand, with default or fixed five-minute lifetimes, for direct presentation or token exchange with AWS, Google Cloud, and other OIDC services.

• Red Hat

  Developing LLM guardrail configs locally with NeMo Guardrails

  The article presents a local workflow for developing and testing NeMo Guardrails configurations in a Jupyter notebook, avoiding repeated Kubernetes deployments and requiring no LLM, GPU, or cloud resources. It defines rails, configurations, and servers, then starts with a case-insensitive regex rail that blocks the exact phrase “ignore all previous instructions”; the test catches a direct attack but allows an accented “Ignóre” variant. A broader regex configuration is followed by a DeBERTa-based prompt-injection classifier and a manually assembled set of 13 prompts, producing 12 correct decisions out of 13, with one subtle attack allowed. The article recommends iterating locally, potentially layering targeted regexes before classifiers for fail-fast, defense-in-depth filtering, while noting that 13 prompts cannot meaningfully measure performance and pointing to standardized EvalHub evaluations as a next step.

• Red Hat

  Red Hat OpenShift autoscaling using MachineSet autoscaler with KEDA

  The demonstration compares OpenShift MachineSet Autoscaler with KEDA against the previously used Cluster Autoscaler, using metrics to scale a MachineSet before pods remain pending. After installing Red Hat’s Custom Metrics Autoscaler operator (KEDA 2.19), granting permissions for MachineSet scaling and Thanos/Prometheus access, it creates a ScaledObject with a Prometheus trigger targeting demo-p4p95-worker-eastus3. Because a MachineSet has no pods, the HPA path cannot use metricType: Value, so AverageValue is paired with a PromQL query that multiplies CPU request utilization by the current node count. With nine one-CPU test pods, the MachineSet scaled from one to two to three nodes as the metric crossed 75%, and all pods reached Running; two additional Standard_D4s_v3 VMs were provisioned in zone 3.

• MongoDB

  Europe Data Residency for Atlas Embedding and Reranking

  MongoDB announced the public preview of data residency in Europe and the United States for the Embedding and Reranking API Service (ERAS) on Atlas. This introduces a Geography, a named group of cloud regions, as a processing boundary for inference, distinct from the region-level cluster provisioning. Requests to a Designated Service are processed and logged only within the chosen Geography, with a 10% price premium for scoped processing. The Europe Geography initially covers EEA regions, and the US Geography covers US regions, with plans to expand. This approach supports data sovereignty goals for European organizations while maintaining a global endpoint for workloads without residency requirements.

• MongoDB

  The Shared View That Makes Insurance AI Fast and Safe

  Agentic AI transforms insurance claims processing, underwriting, and customer service by autonomously executing tasks, reducing a routine claims review from eight hours to eight minutes. However, adding AI agents to fragmented data silos of policy details, claims history, and buried email threads multiplies problems because agents work with incomplete views that degrade. Pairing AI with a unified data architecture that creates a single shared context layer is key; MongoDB Atlas powers this by storing all data in a flexible document model. This shared view delivers accelerated resolution through single-motion retrievals, seamless human oversight by basing decisions on the same record, and built-in compliance through an automatic action trail. Insurers who build on this foundation can safely scale AI agents across claims, underwriting, and customer service while maintaining the oversight regulators and customers expect.

• Twilio

  How to disclose AI to customers without killing the conversation

  Customer service teams may avoid disclosing AI because they fear customers will leave, but the post argues that unclear or delayed disclosure creates more frustration than honesty. It recommends a short first-turn greeting that says “AI,” explains what the agent can do, and offers an immediate route to a human, with renewed disclosure when a conversation moves to SMS or voice. Web chat, SMS, and voice examples show how to pair disclosure with an exit, while voice should disclose before the caller explains the issue and leave a pause. The post identifies burying the disclosure, using ambiguous labels, apologizing, over-explaining, and omitting escalation as failure modes. It proposes checking Twilio Conversation Intelligence transcripts alongside containment and escalation rates to assess wording changes, citing research on customer expectations and bypass behavior.

• Twilio

  When AI takes the wheel: The rise of invisible identity intelligence in 2026

  Point-in-time authentication treats an initial password, MFA, or passkey check as sufficient trust for the rest of a session, leaving post-login account takeovers, session hijacking, and risky API actions insufficiently evaluated. The proposed model replaces this front-door assumption with continuous context evaluation using passive telemetry such as network, telecommunications, device, behavioral, and transaction signals, then intervenes when risk scores or policy thresholds rise. For AI agents, delegated authority sets temporal, monetary, and API limits through short-lived credentials, while Know Your Agent lineage links execution to the authorizing human and deploying enterprise. High-impact actions can trigger human checkpoints through SMS, push, or voice channels, while immutable logs, transparent scoring, tenant isolation, and session lineage support auditability and compliance. The resulting architecture aims to keep low-risk autonomous work unobtrusive while making sensitive operations controllable and provable.

• Twilio

  Complete guide to sending email to Google: Rules, signals & setup

  Sending email to Google requires understanding differences between consumer Gmail and Google Workspace, plus the authentication and reputation signals used by Google’s filtering systems. The guide says SPF and DKIM are required for all senders, while DMARC is required for senders exceeding 5,000 messages per day to Google inboxes; it also gives a bounce example for missing alignment. It recommends keeping user-reported spam below 0.1%, never reaching 0.3%, and providing one-click unsubscribe handling. Google Postmaster Tools reports compliance, spam rate, authentication success, and delivery errors, while the Feedback-ID header enables aggregate complaint analysis by campaign or sender ID. Workspace administrators can apply additional filters, so successful delivery to Gmail does not guarantee placement in a corporate Workspace inbox.

• Hugging Face

  Introducing @huggingface/kernels: 200+ WebGPU Kernels for Local AI

  Hugging Face’s WebAI team is releasing @huggingface/kernels, a JavaScript loader for optimized WebGPU kernels hosted on the Hub, alongside an initial collection of 207 Apache-2.0 kernels. Each kernel repository packages a versioned contract, metadata, correctness cases, benchmark cases, and parameterized WGSL shader templates, while the loader derives outputs and selects variants for a request and device. Fleet adds browser-based correctness and performance testing, with consent-based private evidence used to identify failures, compare variants, and guide optimization. In comparisons against ORT WebGPU on an Apple M4, matching cases showed a 2.57x geometric-mean speedup and a 1.90x median speedup, though the measurements cover individual GPU operations and exclude setup costs. The project is also intended as a shared foundation for browser inference and future integration with higher-level tooling.

• Auth0

  How to Make Your AI Agent Enterprise-Ready: Enabling Enterprise-Managed Authorization for Client Apps in Auth0

  Auth0 is launching Early Access for Client App, or Requesting App, capabilities that support Cross App Access (XAA) for AI assistants, developer tools, and autonomous agents. In the Enterprise-Managed Authorization (EMA) model, an employee’s corporate SSO login can authorize access to external APIs or Model Context Protocol (MCP) servers through the IETF Identity Assertion Authorization Grant (ID-JAG) draft specification. Auth0’s Token Vault brokers the multi-hop exchange: it stores an upstream enterprise refresh token, retrieves a short-lived ID-JAG, exchanges it with the downstream Resource App, and returns a standard access token to the backend. Setup uses dashboard toggles and connection settings, followed by a standard /oauth/token federated exchange, while the API requires no XAA-specific changes. The release also describes audit logging, enterprise IdP policy control, OIN distribution, and caching downstream tokens because ID-JAG exchanges are rate-limited to 50% of the tier’s standard Auth API limit.