---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [How to Carry User Identity Across Federated Kubernetes and AI Platforms](https://yomu.fyi/post/how-to-carry-user-identity-across-federated-kubernetes-and-ai-platform.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Elizabeth Goodman
- Published: Sep 3, 2026
- Type: Explainer

Federated data and AI platforms let users move among portals, datasets, notebooks, and assistants across clusters, but single sign-on alone does not carry trusted identity across control-plane and data-plane boundaries. The post presents a central identity gateway that owns platform sessions through OIDC, a shared session store, stateless data-plane gateways, and an identity-validation API. Regional gateways validate sessions through /gateway/userinfo, enforce local policy, and inject standardized identity headers instead of forwarding raw tokens or independently managing refresh and logout. This separates session ownership from request enforcement, supports consistent logout, and lets assistants pass delegated user identity to backend tools without broad service credentials. At NVIDIA, the approach reduced repeated login events by 55% across internal developer platforms spanning Kubernetes clusters in AWS and OCI, while establishing a foundation for unified platform shells and AI assistants.


### [Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models](https://yomu.fyi/post/introducing-context-aware-vulnerability-discovery-and-remediation-with.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Ken Sanderson
- Published: Sep 3, 2026
- Type: Announcement

Cloudflare announces invitation-only early access to Vulnerability Discovery and Remediation, a Managed Defense service that investigates authorized codebases and helps prioritize and mitigate vulnerabilities. It combines source-code analysis with production route activity, traffic volume, security events, and active Web Application Firewall (WAF) protections to assess exposure. Reconnaissance maps request paths to code, hunter agents search relevant sections, and validation checks proposed patches and custom WAF rules before customer review. OpenAI Daybreak models, including GPT-5.6 Cyber, run reconnaissance, hunting, and validation through AI Gateway, while source code, logs, and request metadata are bounded by authorization, redaction, access policies, and external checks. Findings receive source-based risk ratings that network evidence can raise, with code patches and conservative WAF mitigations prepared for review; customers decide whether to test or deploy them.


### [Governance beyond security: knowledge, context & ontology on the lakehouse](https://yomu.fyi/post/governance-beyond-security-knowledge-context-ontology-on-the-lakehouse.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Srikanth Mandalapu, Travis Paulson, Bernie Kuan
- Published: Sep 3, 2026
- Type: Explainer

The post argues that healthcare AI governance must extend beyond security controls to include knowledge, context, and ontology: security governs access, while semantics determine what data means and whether models can trust it. DEP frames classification tags, model cards, data contracts, and lineage as machine-readable governance artifacts, with Unity Catalog serving as the metadata runtime for agents. Build agents can generate ETL, testing, de-identification, and deployment, while analytic agents answer questions over individual data products; human stewards approve proposals and own accountability. A shared lifecycle certifies the data product and AI track through gates using scores for governance, quality, semantics, and ownership, with certification expiring after relevant changes or failures. The approach applies data-layer ABAC to SQL and vector retrieval, logs agent prompts with lineage, and connects readiness metrics to model economics by enabling smaller models when cataloged data supplies sufficient context.


### [Building High-Quality and Trusted Data Products with Databricks](https://yomu.fyi/post/building-high-quality-and-trusted-data-products-with-databricks.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Amr Ali, Bernhard Walter, Fran Medina Castro, Glenn Wiebe, Karthik Subbarao, Lexy Kassan, Magnus Pierre, Pawarit Laosunthara
- Published: Sep 3, 2026
- Type: Explainer

Enterprise data products are presented as managed assets that deliver the right data at the right time, with appropriate quality, format, and usability for users and applications. Their value depends on clear ownership, business-aware data product owners, and five trustworthiness characteristics: quality and observability, semantic consistency, privacy, security, and discoverability. The proposed lifecycle runs from inception and design through creation, publication, operation and governance, consumption, and retirement, with data contracts, quality metrics, testing, versioning, access management, and lineage supporting those stages. For Databricks implementations, the guidance recommends Delta Live Tables expectations and constraints, staged development, testing and production environments, automated monitoring, and Unity Catalog for discovery, governance, lineage, auditing, and access controls.


### [What is Data Transformation?](https://yomu.fyi/post/what-is-data-transformation.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Databricks Staff
- Published: Sep 3, 2026
- Type: Explainer

Data transformation turns raw data extracted from source systems into usable, trusted datasets for operational needs, analytics and decision-making. The process addresses inconsistencies, missing values and duplicates through techniques such as cleansing, de-duplication, integration, aggregation, validation and format revision, often mapping data to a target schema during ETL. Performance considerations include compaction, partitioning, file-size tuning, data skipping and pruning, and caching to reduce storage, scanning, processing time and latency. The article also compares on-premises, cloud, open-source, proprietary, no-code, low-code and codable ETL tools, then describes Spark Declarative Pipelines and Lakeflow Jobs on Databricks for quality checks, pipeline development, monitoring and orchestration. A Navy Federal Credit Union proof of concept illustrates a rapid deployment, with a proof of concept completed in a week and a dashboard released days after production deployment.


### [How Agentforce Achieves 100% Deterministic Rendering for AI Agent UX](https://yomu.fyi/post/how-agentforce-achieves-100-deterministic-rendering-for-ai-agent-ux.md)
- Company: [Salesforce](https://yomu.fyi/company/salesforce.md)
- Author: Scott Nyberg
- Published: Sep 3, 2026
- Type: Explainer

Agentforce faced a production problem: LLM-driven rendering could recognize a required form or regulated disclosure yet choose a different output because its reasoning was stochastic. The Agentforce Connections layer addresses this by separating probabilistic reasoning and orchestration from deterministic presentation: builders associate an action with a connection-specific response format through the render: directive, and the platform applies that format instead of asking the LLM to select a component. Multi-action, long-running, and supervised flows required the system to identify the configured action and render only after approval and execution. The same abstraction supports Lightning Web Components, third-party interfaces, and headless structured JSON outputs. Per-action, per-session event logs record the action, format, connection, and conversation point, providing auditable evidence that required rendering occurred.


### [Speeding up LLM inference with P-EAGLE in vLLM Speculators](https://yomu.fyi/post/speeding-up-llm-inference-with-p-eagle-in-vllm-speculators.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Helen Zhao, Megan Flynn, Dipika Sikka
- Published: Sep 3, 2026
- Type: Explainer

P-EAGLE (Parallel EAGLE), implemented in Speculators v0.6.0, extends EAGLE-3 with parallel drafting so a draft model predicts multiple future tokens in one forward pass rather than sequentially. Speculative decoding pairs this small draft model with a verifier model, which checks the proposed sequence in parallel and accepts only its correct prefix while preserving the verifier’s output distribution. The post adds Conditional Drop-token (COD) sampling, learnable mask embeddings and hidden states, and a custom flex-attention mask to support multi-depth prediction within the EAGLE-3 framework. The post presents an end-to-end workflow covering data preparation, vLLM hidden-state extraction, training and deployment, including a Qwen3-8B example that takes about 50 minutes on four H100s. A published Qwen3-a8B draft model reports an average length of 3.044 across the listed datasets.


### [Evaluating LLM guardrail configs locally with EvalHub](https://yomu.fyi/post/evaluating-llm-guardrail-configs-locally-with-evalhub.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Rob Geada
- Published: Sep 3, 2026
- Type: Benchmark

This installment evaluates local NeMo Guardrails configurations against large-scale risk datasets using EvalHub, following earlier manual testing. EvalHub provides a unified interface for AI evaluation, with provider integrations, reusable benchmarks, Hugging Face dataset inputs, and both local and Kubernetes deployment options. The benchmark configuration maps dataset prompt and label columns to block and pass labels, while balanced safe and risky examples prevent an always-block guardrail from appearing perfect. On the prompt-injection benchmark, the nuanced regex configuration achieved 51.1% accuracy with 13.7 ms median latency; DeBERTa reached 88.93% accuracy with 45.2 ms median latency. The conclusion favors layered guardrails: targeted regex checks can provide speed, with DeBERTa handling other cases, and EvalHub supplies reproducible measurements of the latency–efficacy trade-off.


### [Introducing Scheduled Upgrades in ClickHouse Managed Postgres](https://yomu.fyi/post/introducing-scheduled-upgrades-in-clickhouse-managed-postgres.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Sep 3, 2026
- Type: Announcement

ClickHouse Managed Postgres now supports scheduled maintenance windows, addressing the problem of routine platform upgrades landing at the same time for every customer, potentially during heavy workloads. Users can choose a two-hour UTC window, while Enterprise organizations can also specify the days of the week when maintenance is least disruptive. The setting covers ClickHouse-initiated Postgres minor-version upgrades, Managed Postgres feature updates, and patches to operating-system and system components, but not user-triggered changes or urgent storage scaling above 90% disk usage. Read replicas follow the schedule of their primary, and the feature is available without opt-in to Scale and Enterprise organizations; Basic users can see the setting and required plan.


### [Portal by Spotify cut my Claude Code token usage by 90%](https://yomu.fyi/post/portal-by-spotify-cut-my-claude-code-token-usage-by-90.md)
- Company: [Spotify](https://yomu.fyi/company/spotify.md)
- Author: Spotify Engineering
- Published: Sep 3, 2026
- Type: Problem & solution

Claude Code often spends frontier-model tokens on file I/O and predictable code generation rather than reasoning, motivating a routing setup built with Portal by Spotify’s AiKA Modes. The implementation defines two public modes—bulk-reader for multi-file analysis and code-writer for pattern-based generation—both shown with Gemini 2.5 Flash, while a Claude Code plugin named shunt enforces delegation through hooks, scripts, and skills. PreToolUse hooks block large Read and shell-based file reads above a configurable threshold, while scripts send files or references to ephemeral worker invocations without exposing the full file corpus or generated code to Claude’s context. In a Java monorepo benchmark, mean bulk-read savings were around 90%, although code-write savings were harder to measure. The approach does not suit editing or reasoning tasks: worker summaries lacked reliable line numbers, missed a subtle thread-safety bug, and added 10–30 seconds of latency, so targeted reads and Claude’s reasoning remain necessary.


### [Spotify’s Backstage Portal cut my Claude Code token usage by 90%](https://yomu.fyi/post/spotify-s-backstage-portal-cut-my-claude-code-token-usage-by-90.md)
- Company: [Spotify](https://yomu.fyi/company/spotify.md)
- Author: Spotify Engineering
- Published: Sep 3, 2026
- Type: Tutorial

Claude Code often spends frontier-model tokens on file I/O rather than reasoning, prompting a routing approach that sends predictable work to cheaper models. The post implements this with two public AiKA Modes in Spotify’s Backstage Portal: bulk-reader summarizes large file sets, and code-writer generates patterned files from a specification and reference file, using Gemini 2.5 Flash in the examples. A Claude Code plugin called shunt enforces delegation through PreToolUse hooks, scripts, and skills; reads above a configurable threshold, defaulting to 350 lines, are blocked and redirected. In tests on a Java monorepo, bulk-read saved around 90% of Claude’s tokens, while generated code can go directly to disk. The design does not cover editing or reasoning, and 10–30-second delegation latency makes small tasks counterproductive.


### [ZGateway: Learnings from Putting a Proxy in Front of ZippyDB](https://yomu.fyi/post/zgateway-learnings-from-putting-a-proxy-in-front-of-zippydb.md)
- Company: [Meta](https://yomu.fyi/company/meta.md)
- Author: By Rittik Banik, Yunhao Cao
- Published: Sep 3, 2026
- Type: Explainer

ZGateway is a stateless proxy tier introduced to unify traffic from ZippyDB’s large, diverse client fleet and address the reliability limits of direct access. By terminating TLS, authorizing requests, applying admission control and shaping, and routing through regional tiers, it replaces a many-to-many connection mesh with bounded client-to-gateway and gateway-to-server hops. Its embedded thick C++ client batches and coalesces shard requests, while a shared pipeline supports pure-proxy and read-through-cache tiers; per-use-case metrics, traces, and quota usage provide operational visibility. The gateway handles more than 1 billion operations per second, carries about 40% of ZippyDB traffic, and adds about 6% computational overhead to an average use case, with traffic projected to exceed 60%; production work also consolidated transaction state handling across 100% of transaction traffic without a reliability regression.


### [NVIDIA PAIR Virtual Inference Router Expands Available Compute on Your Local Network](https://yomu.fyi/post/nvidia-pair-virtual-inference-router-expands-available-compute-on-your.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Tanya Lenz
- Published: Sep 3, 2026
- Type: Explainer

NVIDIA Personal AI Router (PAIR) addresses the GPU bottleneck created when multi-agent workflows and concurrent local sessions generate many independent inference requests. It acts as a virtual inference router rather than an inference engine, proxying compatible Ollama and LM Studio interfaces, discovering and securely pairing local systems, and scheduling each request onto one eligible node based on readiness, engine state, model availability, workload, and GPU utilization. The agent keeps one familiar connection, while PAIR streams responses back and exposes placement through Jobs and metrics views; it does not merge GPUs, pool VRAM, or split a single request across machines. In an unofficial Hermes five-subagent demonstration, a three-device cluster averaged 8 minutes 48 seconds versus 18 minutes on one RTX Spark laptop, with results explicitly dependent on configuration and workload.


### [Elevating security, control, and accessibility: Stack Internal 2026.6](https://yomu.fyi/post/elevating-security-control-and-accessibility-stack-internal-2026-6.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Carrie Koos
- Published: Sep 3, 2026
- Type: Announcement

Stack Internal 2026.6 is a release focused on administrative security, API control, developer portal integration, knowledge-health automation, and accessibility for enterprise AI workflows. Its new Admin Security page supports X-API-Key headers for API v2.3 requests, inactivity windows, per-application daily limits up to 10,000 requests per day, and service-credential rotation with non-displayable secrets. The release adds scheduled expiration for Announcement articles, generally available community broadcasts, expanded custom award limits, tag preference and synonym APIs, richer user data, and a Backstage plugin update supporting the New Frontend System alongside the legacy architecture. Accessibility work improves screen-reader announcements, keyboard and reflow navigation, focus management, high-zoom layouts, contrast, and semantic markup, while additional fixes address tags, suggested edits, and Slack rendering.


### [NeoMME: an efficient Multimodal-native and Multilingual Encoder](https://yomu.fyi/post/neomme-an-efficient-multimodal-native-and-multilingual-encoder.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Tony Wu, Aurélien Lac
- Published: Sep 3, 2026
- Type: Explainer

NeoMME is a family of 260M and 800M multilingual multimodal encoders designed to represent text and images without a separate pretrained vision tower or causal language model. A single bidirectional Transformer processes text tokens and raw 32×32 image patches, while pretraining from scratch uses a masked discrete-diffusion text-denoising objective with high masking to encourage image-grounded reconstruction. The retrieval variant adds jointly trained dense mean-pooled and 128-dimensional late-interaction heads, returning both in one forward pass for page-image retrieval. On ViDoRe v3, the 260M model reaches 0.523 and both sizes lie on the model-size Pareto frontier; at 2048×2048, it encodes about 51 pages per second on an NVIDIA L40S, roughly twice ColModernVBERT's throughput. Hierarchical token pooling and asymmetric quantization reduce late-interaction storage from roughly 1.5 MB to 6 kB per page, a 255× reduction, while retaining more than 95% of baseline nDCG@10.


### [Learning to Code in the Age of AI: Advice From a Top Udemy Instructor](https://yomu.fyi/post/learning-to-code-in-the-age-of-ai-advice-from-a-top-udemy-instructor.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Regina Muradova
- Published: Sep 3, 2026
- Type: Explainer

An interview with Python educator Ardit Sulce examines how beginners should learn programming as AI changes development and teaching. Sulce says AI now handles many small questions, while teachers provide curated learning paths, judgment, and context; he also argues that students should preserve productive struggle while outsourcing setup friction. He recommends evaluating understanding through code explanation, review, and debugging rather than treating working code as proof, and identifies reading unfamiliar code, debugging, and system understanding as important junior skills. His proposed three-stage path moves from writing syntax by hand in a professional IDE, to using AI as a tutor, and finally to using it as a co-worker while reviewing increasingly complex projects.


### [Kotlin Toolchain 0.12: Multiplatform Library Publishing, Wasm Apps, and More](https://yomu.fyi/post/kotlin-toolchain-0-12-multiplatform-library-publishing-wasm-apps-and-m.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Joffrey Bion
- Published: Sep 3, 2026
- Type: Announcement

Kotlin Toolchain 0.12.0 extends its multiplatform build and publishing capabilities with multiplatform library publication, preview support for Wasm applications, command-line Compose Hot Reload, and broader IDE and terminal improvements. Libraries use the existing publishing configuration and produce a common API, per-platform artifacts, sources, module metadata, plus commonized and platform-specific cinterop bindings; Compose Multiplatform resources are not yet included. wasm-js/app modules can be built into ready-to-use web applications, run with kotlin run, customized through resources, and supplied transitive npm dependencies from Kotlin Multiplatform libraries. The release also reduces default Maven Central files, supports Compose Hot Reload through an MCP server, and recommends project-root-relative // dependencies while retaining the older syntax. It raises minimum compilation requirements to JDK 17 and Kotlin 2.2.20, updates bundled versions including Kotlin 2.4.10 and JDK 25, and recommends IntelliJ IDEA 2026.2.1 or newer for the latest features.


### [The economics of agent scale: tokens, ROI, and building platforms for AI-first teams (Part 2)](https://yomu.fyi/post/the-economics-of-agent-scale-tokens-roi-and-building-platforms-for-ai.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Eira May
- Published: Sep 3, 2026
- Type: Explainer

The conversation examines the economics and platform implications of operating dozens or hundreds of AI agents rather than a small number of human-driven workflows. Andi Gutmans argues that many current models are already sufficient for automation, shifting the optimization problem to the complete system: model, harness, context, personalization, and evaluation. The goal is the least sophisticated model and smallest viable context that produce a reliable outcome at the lowest cost, with better trajectories reducing reasoning loops and token processing; Google’s stated approach is to hill climb models and data together. The discussion also addresses cost governance, search and observability for agents as a distinct persona, human-in-the-loop handling, and the continuing importance of computer-science fundamentals, agentic fluency, and business judgment.


### [Evaluate AI agents with IBM CLEAR & EvalHub on OpenShift AI](https://yomu.fyi/post/evaluate-ai-agents-with-ibm-clear-evalhub-on-openshift-ai.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Hema Veeradhi, Surya Pathak
- Published: Sep 3, 2026
- Type: Tutorial

Reliable AI agents can fail in production through incorrect tool use, off-topic reasoning, or plausible but incorrect answers that unit tests, static benchmarks, and logs may not expose. This tutorial builds an eval-driven trace-evaluation pipeline on Red Hat OpenShift AI 3.4 or later, using MLflow to store structured agent traces and evaluation artifacts, IBM CLEAR to score reasoning quality, relevance, and tool usage with an LLM judge, and EvalHub to orchestrate OpenShift jobs. It uploads eight prerecorded multistep research-agent traces, each containing at least 30 spans, then verifies them in MLflow before deploying EvalHub, registering the ibm-clear provider, and configuring judge-model credentials. Standard mode evaluates steps holistically, while SPARC mode gives tool calls separate scoring rows; the resulting workflow produces critiques and ranked failure patterns with frequency, severity, and step or agent attribution.


### [Extend Layer 2 networks into Red Hat OpenShift Virtualization with BGP and EVPN](https://yomu.fyi/post/extend-layer-2-networks-into-red-hat-openshift-virtualization-with-bgp.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Miguel Duarte de Mora Barroso, Valentino Uberti
- Published: Sep 3, 2026
- Type: Tutorial

The article describes how to extend Layer 2 networks from a legacy data-center fabric into Red Hat OpenShift Virtualization using BGP and EVPN. It uses a three-node OpenShift lab with secondary NICs on a provider network, static IPv4 addressing, a VTEP CR for 172.19.0.0/24, FRRouting peering, and a Layer 2 primary CUDN with VNI 100. The configuration preserves imported VMs’ IP and MAC identities while maintaining isolation for tenant networks that may have overlapping address spaces. In the example, an external FRR router learns the VM MAC through EVPN and reaches 22.100.0.3; after the VM moves from node 3 to node 1, the MAC remains unchanged and the advertised VTEP changes from 172.19.0.102 to 172.19.0.100. The stated result is phased migration with Layer 2 adjacency to legacy application tiers and end-to-end tenant segmentation.


[Newer posts](https://yomu.fyi/posts/page/56.md) · [Older posts](https://yomu.fyi/posts/page/58.md)