---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [A Tale of Two Flink Autoscalers](https://yomu.fyi/post/a-tale-of-two-flink-autoscalers.md)
- Company: [Netflix](https://yomu.fyi/company/netflix.md)
- Author: Netflix Technology Blog
- Published: Aug 21, 2026
- Type: Problem & solution

Netflix operates over 30,000 Apache Flink jobs across multiple AWS regions, ranging from managed pipelines to complex stateful DAGs. Its initial in-house autoscaler used external telemetry from Mantis and Atlas to scale TaskManagers as a single unit, cutting resource usage by 25–45% but failing on multi-operator stateful topologies. To address these limitations, Netflix adopted the Apache Flink Autoscaler library, which calculates True Processing Rate and per-vertex parallelism using internal metrics. The architecture uses Temporal workflows orchestrated within a Spring Boot application to evaluate jobs individually and prevent cross-job blast radiuses. Implementing the open-source autoscaler reduced annualized compute expenditures by 58% for client telemetry and logging, saving approximately $1.1 million.


### [SOP-Bench: A new benchmark for evaluating AI agents on real business procedures](https://yomu.fyi/post/sop-bench-a-new-benchmark-for-evaluating-ai-agents-on-real-business-pr.md)
- Company: amazon.science
- Author: Rohith Nama, Nandi Subhrangshu
- Published: Aug 21, 2026
- Type: Benchmark

AI agents often struggle to execute standard operating procedures because real-world business workflows contain implicit domain knowledge and procedural ambiguity that standard benchmarks overlook. To evaluate agent reliability, researchers introduced SOP-Bench, an open framework featuring more than 2,000 runnable tasks across 12 industrial domains paired with functioning tool interfaces and ground-truth answers. Domain experts authored the workflows, while an Anthropic Claude 3.5 Sonnet v2 model generated mock APIs, tool code, and edge-case datasets before expert verification. Experiments evaluating function-calling and reasoning agents across 11 frontier models revealed that newer models did not consistently outperform older versions, and providing 20 extraneous tools nearly halved task success. The benchmark, baseline agents, and evaluation code are released on GitHub and HuggingFace for reproducible testing.


### [What else runs on your Postgres server, and how do we stop it from taking the database down?](https://yomu.fyi/post/what-else-runs-on-your-postgres-server-and-how-do-we-stop-it-from-taki.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Aug 21, 2026
- Type: Problem & solution

The Postgres VM described here runs PgBouncer instances, a backup agent, metrics exporters, a local Prometheus, a log collector, and watchdog timers alongside the database. Those processes share machine-wide resources outside Postgres’s huge-page-backed shared\_buffers, so leaks, CPU saturation, or disk exhaustion can threaten database availability. ClickHouse Managed Postgres places supporting services in a cgroup v2 slice and combines Go runtime GOMEMLIMIT targets with systemd memory.high and memory.max enforcement. GOMEMLIMIT encourages earlier garbage collection, memory.high applies reclaim and throttling, and memory.max provides a hard ceiling whose OOM scope excludes Postgres because it uses a separate cgroup. CPU weights, bounded buffers, log and metric controls, disk thresholds, and exemptions for replication and monitoring sessions extend isolation across other failure modes; these controls are enabled by default.


### [Dispatches from O'Reilly: The right amount of spec for agentic development](https://yomu.fyi/post/dispatches-from-o-reilly-the-right-amount-of-spec-for-agentic-developm.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Markus Eisele
- Published: Aug 21, 2026
- Type: Explainer

As software agents make implementation faster and cheaper, engineering difficulty shifts away from typing code toward defining correctness and verifying behavior reliably. Omitting specifications forces human reviewers into expensive correction loops, while overspecification clutters model context windows with stale prose and competing instructions. To find the optimal middle ground, teams must validate specifications before coding, using one agent to draft minimal constraints and another to attack ambiguities, hidden dependencies, and missing failure modes. Multi-agent architectures demand formal interface contracts, schemas, and executable checks because interpretive drift compounds rapidly across unbounded agent handoffs. Core Extreme Programming and Agile practices such as continuous integration, small release batches, and rapid feedback loops remain essential error-detection mechanisms during agentic development.


### [Improved failure reports on Red Hat OpenShift with the event-driven diagnostic operator](https://yomu.fyi/post/improved-failure-reports-on-red-hat-openshift-with-the-event-driven-di.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Periyamaruthu Mohanraj
- Published: Aug 21, 2026
- Type: Problem & solution

During major infrastructure incidents, critical system logs and diagnostic evidence are frequently overwritten, lost, or erased by emergency recovery efforts before engineers can investigate. To solve this visibility gap in multi-cluster environments, an open-source event-driven diagnostic operator was developed as an automatic first information report collector. Deployed on a central hub cluster, the operator monitors Kubernetes warning events rather than relying on heavy polling. When an event matches a predefined regular expression pattern, the operator identifies the target spoke cluster, copies its kubeconfig secret, and spins up an independent must-gather job. Diagnostic data is written to off-site or shared storage with a configurable retention window, preserving forensic context without human intervention.


### [NVIDIA AVO Reaches 100% on ARC-AGI-3, Demonstrating a Frontier-Level General-Purpose Architecture for Long-Horizon Autonomous Agents](https://yomu.fyi/post/nvidia-avo-reaches-100-on-arc-agi-3-demonstrating-a-frontier-level-gen.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Tanya Lenz
- Published: Aug 21, 2026
- Type: Explainer

NVIDIA’s Agentic Variation Operators (AVO) is a general-purpose agent architecture designed to make frontier language models reliable on extended, multistep tasks. It combines tool use and execution with persistent memory, an iterative inspect-plan-implement-evaluate loop, and a supervisor that can redirect work when progress stalls. In a seven-day GPU-kernel optimization study, AVO explored more than 500 directions, produced 40 committed versions, and outperformed cuDNN by up to 3.5% and FlashAttention-4 by up to 10.5% across evaluated configurations. On the ARC-AGI-3 public set, the same architecture achieved a 100.00 RHAE score across 25 environments, completing all 183 levels in 6,624 actions; the post cautions that comparisons with other systems are not controlled ablations.


### [Where Security Fits in an AI Agent Stack](https://yomu.fyi/post/where-security-fits-in-an-ai-agent-stack.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Michelle Horton
- Published: Aug 21, 2026
- Type: Explainer

The post explains where security controls should sit in an emerging AI agent stack as agents gain capability and operate over longer horizons. It distinguishes behavioral controls in models and harnesses, which guide proposed actions, from authoritative infrastructure controls that bind identity, enforce policy, contain failures, and record activity. The stack is presented as layers for models, harnesses, meta-harnesses, secure runtimes such as NVIDIA OpenShell, and inference infrastructure, with the runtime boundary established before launch so tools, plugins, MCP processes, and delegated runtimes operate under policy. It recommends least privilege, isolation, explicit authorization, auditability, short-lived and task-scoped access, independent checks, and safer failure states, while describing four security profiles from isolated to adversarial workloads. The conclusion is that every high-impact external effect must pass through enforcement layers the agent cannot bypass.


### [Running AI agents in GitHub Actions with Docker Sandboxes](https://yomu.fyi/post/running-ai-agents-in-github-actions-with-docker-sandboxes.md)
- Company: [Docker](https://yomu.fyi/company/docker.md)
- Author: Jennifer Kohl
- Published: Aug 21, 2026
- Type: Tutorial

GitHub Agentic Workflows added support for Docker Sandboxes as an agent runtime, allowing CI coding agents to operate within microVM isolation. Useful AI agents require broad capabilities like executing arbitrary shell commands and launching containers, which elevates risk on shared CI runners. With the docker-sbx runtime, agents receive root privileges and a private Docker daemon inside a dedicated microVM while external repository access and network traffic remain restricted. In a demonstration, an agent ran on an Ubuntu runner, executed Java 21 integration tests with PostgreSQL via Testcontainers, identified an email case-sensitivity defect, applied a code fix, and opened a draft pull request. The complete workflow executed in eleven minutes and sixteen seconds while confining modifications strictly to source files.


### [10 Best Websites to Book a Rental Car in 2026](https://yomu.fyi/post/10-best-websites-to-book-a-rental-car-in-2026.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: Aug 21, 2026
- Type: Explainer

The guide compares 10 websites and apps for booking rental cars in 2026, grouping them into aggregators, direct rental companies, peer-to-peer marketplaces, and hybrid platforms. It matches services to needs such as price comparison, member discounts, unusual vehicles, loyalty rewards, bundling, coupon savings, and international coverage. The entries describe concrete differences: Kayak searches hundreds of providers, Costco Travel uses negotiated member rates, Turo lists vehicles from private owners, and Uber Rent combines traditional agencies with Turo listings in one search. Other examples include Priceline’s Express Deals, Expedia’s trip bundling, AutoSlash’s coupon and price-tracking tools, and direct programs from Enterprise and Hertz. It advises comparing total cost, cancellation terms, mileage limits, fuel policy, protection options, deposits, pickup and drop-off locations, and additional-driver fees because advertised daily rates do not capture every booking condition.


### [How AgentFlo built AI sales agents with Amazon Bedrock AgentCore – Part 2](https://yomu.fyi/post/how-agentflo-built-ai-sales-agents-with-amazon-bedrock-agentcore-part-2.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Muhammad Musab Iqbal
- Published: Aug 21, 2026
- Type: Problem & solution

AgentFlo designed an architecture using Amazon Bedrock AgentCore and AWS serverless infrastructure to address traffic spikes and build trust in autonomous commerce agents. Security operates across three stages: AWS Fargate filters prompt injections and opt-outs, AgentCore Gateway enforces deterministic Cedar authorization policies during tool execution, and post-turn privacy filters screen outputs. Session isolation is maintained across merchants through AgentCore runtime microVMs, while AgentCore Observability and Amazon CloudWatch provide end-to-end tracing. Data reliability and long conversation journeys rely on Amazon DynamoDB context storage, Amazon Bedrock Knowledge Bases, and Amazon S3 Vector embeddings. Early deployment data showed a 12 percent net revenue uplift.


### [August 2026 newsletter](https://yomu.fyi/post/august-2026-newsletter.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Aug 21, 2026
- Type: Announcement

The August 2026 newsletter rounds up ClickHouse product releases, research, managed services, observability, community work, and upcoming events. It introduces Andy Pavlo’s arrival to establish ClickHouse Labs, describes the 26.7 release’s join optimizations, token-position text indexes, and EXPLAIN ANALYZE, and reports a 40× phrase-search improvement on a Hacker News dataset. It also covers an interactive ClickBench playground for more than 100 database systems, running isolated workloads in Firecracker microVMs on AWS EC2, plus guidance on combining Postgres for mutable data with ClickHouse for immutable analytical workloads. Additional items address Managed Postgres notifications and backups, TTL-related disk growth, vector-search trade-offs, and hdx-evals, which found a purpose-built ClickStack MCP server scored 7–20 percentage points higher than direct SQL access in five reproducible scenarios.


### [Spring Boot Configuration Management Best Practices](https://yomu.fyi/post/spring-boot-configuration-management-best-practices.md)
- Company: [Jetbrains](https://yomu.fyi/company/jetbrains.md)
- Author: Siva Katamreddy
- Published: Aug 21, 2026
- Type: Explainer

Spring Boot externalizes application configuration across files, environment variables, system properties, and command-line arguments to allow a single artifact to run across multiple environments. A resilient setup classifies values into application defaults, deployment configurations, and externalized secrets stored in dedicated vaults. Binding properties to type-safe Java records via @ConfigurationProperties ensures immutability, supports relaxed property mapping, and eliminates the discovery issues common to scattered @Value annotations. Enforcing validation with @Validated and Jakarta Bean Validation constraints triggers fail-fast startup behavior when required settings are absent or malformed. Property precedence determines the effective runtime values, which must be adapted appropriately whether deploying a monolith, containerized workloads in Kubernetes, or a microservices cluster.


### [Red Hat Ansible development workspaces for governed automation content creation](https://yomu.fyi/post/red-hat-ansible-development-workspaces-for-governed-automation-content.md)
- Company: [Red Hat](https://yomu.fyi/company/red-hat.md)
- Author: Leonardo Gallego
- Published: Aug 21, 2026
- Type: Problem & solution

Ansible development workspaces in Red Hat Ansible Automation Platform leverage Red Hat OpenShift Dev Spaces to solve environment drift and lengthy developer onboarding. Instead of configuring local environments, developers access cloud-hosted VS Code instances via a web browser using declarative devfile.yaml configurations. The platform enforces immutability with a read-only /var directory at runtime, preventing arbitrary package installations that cause configuration drift. To address differing domain requirements across teams without creating bloated monolithic images, the solution implements a four-tiered image strategy based on OpenShift BuildConfigs and ImageStreams. When base container images receive security patches, the dependent image layers automatically rebuild throughout the entire chain.


### [Add Cross App Access to Your OIDC Requesting Application](https://yomu.fyi/post/add-cross-app-access-to-your-oidc-requesting-application.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Sohail Pathan
- Published: Aug 21, 2026
- Type: Tutorial

OpenID Connect federated applications connecting to third-party services can implement Cross App Access using the Identity Assertion Authorization Grant specification. When a user authenticates via the standard authorization code flow, the requesting application retains the issued refresh token. The application exchanges this refresh token at Okta's token endpoint via RFC 8693 token exchange to receive a short-lived Identity Assertion Authorization Grant JSON Web Token. Next, the application presents this assertion to the third-party resource authorization server using the RFC 7523 JWT bearer grant to obtain a final access token. Developers can configure an AI Agent and application integrations in Okta to validate the entire end-to-end request flow against test endpoints on xaa.dev.


### [GLM-5.3 vs. GPT-5.6 Sol on DeepSWE: Cost, Coding, and Routing](https://yomu.fyi/post/glm-5-3-vs-gpt-5-6-sol-on-deepswe-cost-coding-and-routing.md)
- Company: [Together AI](https://yomu.fyi/company/together-ai.md)
- Published: Aug 21, 2026
- Type: Benchmark

GLM-5.3 and GPT-5.6 Sol were evaluated on 113 DeepSWE tasks with 904 rollouts, comparing accuracy, cost, and failure patterns. Sol edges ahead at pass@1 (72.7% vs 69.0%), but GLM-5.3 leads at pass@4 (87.6% vs 85.8%) at $3.99 per rollout, half Sol’s $8.37 cost and yielding 17 solves per $100 versus Sol’s 9. Their low per-task correlation of 0.43 makes a cascade effective: GLM-5.3 first, then Sol on test failure, achieving 85.9% solved at $6.61 per task. Sol runs faster (19 minutes, 61 steps vs 35 minutes, 124 steps) and achieves higher reliability (61 tasks solved all four tries vs 48), but it breaks passing tests in 20% of failures versus GLM-5.3’s 11%.


### [GLM-5.3 vs. Claude Fable 5 on DeepSWE: Cost, Coding, and Routing](https://yomu.fyi/post/glm-5-3-vs-claude-fable-5-on-deepswe-cost-coding-and-routing.md)
- Company: [Together AI](https://yomu.fyi/company/together-ai.md)
- Published: Aug 21, 2026
- Type: Benchmark

GLM-5.3 and Claude Fable 5 were compared on the DeepSWE benchmark across 113 tasks with four trials each, totaling 904 rollouts. On first-attempt accuracy, Fable 5 scored 69.7% and GLM-5.3 scored 69.0%, a statistical tie inside error bars. GLM-5.3 led on pass@2 (81.1% vs. 77.1%) and pass@4 (87.6% vs. 84.1%), and cost $3.99 per rollout versus Fable’s $21.63, a 5.4x price gap. Per $100, GLM-5.3 solved 17 tasks while Fable solved 3. Both models regress test suites in only 11% of failures, and GLM-5.3 averages 35 minutes per rollout with 80k output tokens versus Fable’s 34 minutes and 114k tokens. The models are near-substitutes with 0.65 per-task correlation; GLM-5.3 won five of eight domains including JavaScript and concurrency, while Fable excelled only in Rust and serialization, making GLM-5.3 the practical default.


### [Top user authentication trends for 2026](https://yomu.fyi/post/top-user-authentication-trends-for-2026.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Sebastian Del Aguila Fiocco, Ravleen Kaur
- Published: Aug 21, 2026
- Type: Explainer

The article outlines authentication trends expected to shape identity verification, fraud prevention, payments, and access in 2026, against a backdrop of deepfakes, synthetic identities, regulatory change, and increasingly online services. It describes identity orchestration that combines document checks, biometrics, device intelligence, and behavioral signals, while fraud systems assess behavior and may allow, challenge, delay, or block access. For AI agents, Know Your Agent links a bot to its enterprise and official communication channel, with document verification and Twilio Lookup presented as a combined onboarding approach. The recommended strategies add continuous anomaly monitoring, risk-based MFA, human-in-the-loop approvals, multichannel authorization, passkeys, digital IDs, and layered controls, while concluding that businesses and regulators should remain agile and use services such as Twilio Verify, Lookup API, and Verify Fraud Guard.


### [The fraud-friction paradox: Why stronger security should feel invisible](https://yomu.fyi/post/the-fraud-friction-paradox-why-stronger-security-should-feel-invisible.md)
- Company: [Twilio](https://yomu.fyi/company/twilio.md)
- Author: Anurag Dodeja, Reed Mcginley-Stempel, Catie Kolander
- Published: Aug 21, 2026
- Type: Explainer

The post argues that the long-standing trade-off between security and seamless user experience is a false choice, especially as autonomous AI agents act across systems. High-friction measures such as passwords, CAPTCHAs, and one-time login checks can create insecure credential reuse and fail to govern over-permissioned agents or risks that emerge during a session. It proposes invisible, continuous risk evaluation using device, network, phone, email, communication, and behavioral signals, with event-triggered verification when an agent requests a consequential action. The approach also separates human authentication from agent identity and Know Your Agent (KYA), which define delegated authority, contextual rules, and time-bounded permissions while linking an agent to its deploying entity. Twilio is presented as a unified trust layer combining customer data, security intelligence, AI governance, and communication channels; the conclusion is that adaptive controls can protect users while making security largely invisible.


### [How Hugging Face Inference Endpoints, Jobs, and Buckets Power Search on Papers with Code](https://yomu.fyi/post/how-hugging-face-inference-endpoints-jobs-and-buckets-power-search-on.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Niels Rogge
- Published: Aug 21, 2026
- Type: Explainer

Papers with Code needs a search engine that supports exact titles and arXiv identifiers, semantic requests, navigational queries, typos, and fast responses when model services are cold or unavailable. The system uses hybrid retrieval: PostgreSQL full-text search provides a lexical baseline, pgvector stores dense embeddings, and reciprocal rank fusion combines them. Full-corpus embeddings for more than 110,000 papers run in burstable GPU Jobs from repeatable-read database snapshots, with checksummed JSONL inputs and resumable Parquet outputs stored in Buckets. An Inference Endpoint serves low-latency query embeddings and bounded hourly updates for changed papers, while lexical retrieval remains a fallback. The embedding contract pins the model revision, dimension, prompts, normalization, and source hash; production uses Qwen/Qwen3-Embedding-0.6B with 256-dimensional L2-normalized vectors, and stored vectors also support related-paper retrieval without a request-time model call.


### [Measuring benchmark optimization in speech recognition](https://yomu.fyi/post/measuring-benchmark-optimization-in-speech-recognition.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Theo Lebryk, Eric Bezzam, Alice, David Ayllon, Jakub Piotr Cłapa, Jens Madsen, Panagiotis Tzirakis
- Published: Aug 21, 2026
- Type: Benchmark

Public voice AI benchmark scores can overstate speech-recognition ability when models learn benchmark-specific patterns rather than improve underlying transcription. Traditional evaluations may miss reliability, naturalness, contextual appropriateness, and other real-world conditions, motivating held-out sets in Real World VoiceEQ, the Open-ASR Leaderboard, and the Far-field ASR Leaderboard. The study introduces three tests and evaluates 11 widely used open-source ASR models, finding that several reproduce VoxPopuli and LibriSpeech reference transcripts when audio contradicts them, words are silenced, or two written forms sound identical. Models also sometimes use acoustic cues to identify dataset membership and select its expected transcription policy, while fresh post-cutoff data and other interventions often restore more audio-faithful output; the findings support fully held-out evaluation and broader metrics than a single public WER score.


[Newer posts](https://yomu.fyi/posts/page/70.md) · [Older posts](https://yomu.fyi/posts/page/72.md)