---
title: "Latest reads"
description: "The engineering internet, summarised so you can actually read it."
---

# Latest reads
> The engineering internet, summarised so you can actually read it.

## Articles

### [Developing Nemotron 3.5 Lightning NVFP4 with QAD Using NVIDIA Model Optimizer](https://yomu.fyi/post/developing-nemotron-3-5-lightning-nvfp4-with-qad-using-nvidia-model-op.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Tanya Lenz
- Published: Aug 17, 2026
- Type: Tutorial

NVIDIA’s post presents a workflow for developing an NVFP4 checkpoint of the Nemotron 3.5 Lightning 30B-A3B model, targeting lower memory use and higher inference throughput without sacrificing accuracy. The method starts with post-training quantization (PTQ), producing a W4A16 student from the BF16 teacher, then applies quantization-aware distillation (QAD), where simulated quantization and KL-divergence loss align student logits with the frozen teacher. For the selected four\_over\_six recipe, 32K calibration performed best, and the recipe using W4A16 Mamba linears offered the best reported trade-off between accuracy degradation and inference performance; the checkpoint is 22 GB versus 66 GB and delivers up to 4x faster throughput. The workflow includes Model Optimizer examples and launchers for Megatron-LM and Megatron-Bridge, covering calibration, distillation, evaluation, and export.


### [How Palo Alto Networks Built a Zero](https://yomu.fyi/post/how-palo-alto-networks-built-a-zero.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Aug 17, 2026
- Type: Problem & solution

Palo Alto Networks built a new SASE Health Portal to provide real-time service health visibility for its enterprise customers. The previous architecture relied on relational databases and cloud data warehousing, which caused schema migration bottlenecks and regional lock-in. To solve this, the team deployed containerized services across multiple cloud zones in an active-active configuration. They used MongoDB Atlas as a globally replicated database, enabling automated cross-region failover and flexible document modeling for customer subscriptions. The new portal eliminates alert fatigue by allowing granular subscriptions and achieves zero relational joins for fast incident matching.


### [Origin Code Hosting](https://yomu.fyi/post/origin-code-hosting.md)
- Company: [Cursor](https://yomu.fyi/company/cursor.md)
- Published: Aug 17, 2026
- Type: Announcement

Cursor is rolling out Origin, an early-beta code-hosting service for all paid plans, except enterprise organizations whose admins opt out, with repositories, pull requests, code browsing, and GitHub synchronization. Origin-hosted repositories treat Origin as the source of truth: users push through the CLI, while GitHub is not involved; GitHub-synced repositories instead keep GitHub authoritative and mirror changes to Origin in real time. Each repository includes pull-request timelines, commits, checks, file diffs, comments, reviews, and merging, with synced pull requests updating between Cursor and GitHub within seconds. Cursor also places agents alongside code and PRs, allowing them to answer questions, make changes, update pull requests, or push branches, while Vercel, Depot, and Buildkite integrations add preview deployments and CI options.


### [DeepSeek V4 Pro 0813 vs Claude Fable 5 on DeepSWE: Cost, Coding, and Routing](https://yomu.fyi/post/deepseek-v4-pro-0813-vs-claude-fable-5-on-deepswe-cost-coding-and-rout.md)
- Company: [Together AI](https://yomu.fyi/company/together-ai.md)
- Published: Aug 17, 2026
- Type: Benchmark

The DeepSWE benchmark comparison between DeepSeek V4 Pro 0813 and Claude Fable 5 reveals a trade-off between cost and accuracy. Claude Fable 5 leads on the first attempt with 69.7% pass@1 versus DeepSeek V4 Pro’s 62.8%, but costs 90 times more per rollout ($21.63 vs $0.24). Under repeated attempts, DeepSeek V4 Pro surpasses Fable, achieving 88.5% pass@4 compared to Fable’s 84.1%. The two models show unusually low per-task correlation (0.39), meaning they fail on different tasks. A cascade strategy that runs DeepSeek V4 Pro first and escalates to Claude Fable 5 only on failures solves 82.7% of tasks at $8.28 per task, outperforming either model used alone.


### [A/B test models in production](https://yomu.fyi/post/a-b-test-models-in-production.md)
- Company: [Together AI](https://yomu.fyi/company/together-ai.md)
- Published: Aug 17, 2026
- Type: Tutorial

A/B testing model changes in production by sending fixed shares of live endpoint traffic to one control and up to 20 variants, allowing teams to compare user-facing outcomes rather than relying only on shadow-traffic checks. The endpoint router keeps variants out of the base traffic split, resamples requests that reach the control, and treats experiment percentages as absolute shares independent of replica counts or autoscaling. A 95/5 experiment can be updated to 80/20 and then 50/50 by resending the complete member list; an etag rejects stale concurrent updates. Measurement joins per-deployment platform metrics with product signals using the deployment ID in response metadata. To finish, a winning variant is promoted through a blue-green rollout before deleting the experiment, while deletion alone returns traffic to the control and can unwind a losing test.


### [Build zero-trust AI agents with Google's Agent Development Kit](https://yomu.fyi/post/build-zero-trust-ai-agents-with-google-s-agent-development-kit.md)
- Company: [Google](https://yomu.fyi/company/google.md)
- Author: Shubham Saboo, Eric Dong
- Published: Aug 17, 2026
- Type: Explainer

Connecting an autonomous Agent Development Kit (ADK) agent to databases, internal APIs, and code execution turns model decisions into production-state changes that system prompts cannot securely constrain. The post presents an open-source Customer Support & Returns Agent built with ADK and Gemini, using an example where prompt injection could produce an unauthorized refund or leak environment secrets. Its zero-trust design combines hardware-backed signing for database mutations, gVisor isolation with no network egress and resource limits for generated Python, and deterministic semantic gateways for prompts, tool calls, and database updates. Local equivalents use HMAC keys, a database ingress verifier, a constrained Docker runner, and Python validation tests, while production mapping uses Cloud KMS, HSM, and VPC Service Controls. The conclusion is that infrastructure-enforced boundaries let the model reason dynamically within strict limits.


### [Auth0 Learning: The New Skill-Building Platform for Developers](https://yomu.fyi/post/auth0-learning-the-new-skill-building-platform-for-developers.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Sara Kazemi
- Published: Aug 17, 2026
- Type: Announcement

Following the February 2025 launch of Okta Learning, user feedback revealed that mixing Auth0 materials into the shared catalog created friction, buried relevant content, and obscured certification progression. In response, Auth0 launched Auth0 Learning, a dedicated platform tailored specifically to developer workflows. The restructured catalog focuses on three distinct product domains: Auth0 as an identity provider, Auth0 for AI Agents (A4AA), and Auth0 Fine-Grained Authorization (FGA). To reduce onboarding friction, developers can access and interact with free, on-demand courses without creating an account or logging in. Users who choose to authenticate gain access to redesigned learning paths that track individual progress and award shareable digital skill badges upon completion.


### [Introducing Husker Share, the University of Nebraska-Lincoln’s latest program with Uber](https://yomu.fyi/post/introducing-husker-share-the-university-of-nebraska-lincoln-s-latest-p.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: Aug 14, 2026
- Type: Announcement

The University of Nebraska-Lincoln (UNL) has partnered with Uber to launch Husker Share, a campus-exclusive shared-rides program for students, faculty, and staff. Powered by Uber’s Closed Loop Share feature, the program matches verified UNL riders traveling in the same direction, supports sharing with up to two other riders, and limits each booking to one person. Eligible riders can save up to 20% on standard UberX fares, while the first 10,000 people to enroll receive $5 off their first trip. Enrollment requires an Uber account, the Uber app, and UNL credential verification; once approved, the option appears in the app, with trips required to start and end inside the designated service zone.


### [Using AI\_Functions in Your Data Warehouse: Top Use Cases](https://yomu.fyi/post/using-ai-functions-in-your-data-warehouse-top-use-cases.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Srikant Das, Ismail Makhlouf
- Published: Aug 14, 2026
- Type: Tutorial

Databricks AI Functions bring model inference into SQL queries, addressing the need to combine warehouse-resident structured data with unstructured reviews, tickets, PDFs, and transcripts without exporting rows to a separate service. The post presents six Lakehouse use cases: document parsing and extraction, sentiment classification, translation, ticket routing, sales-call extraction, and generative drafting with ai\_query. Task-specific functions such as ai\_parse\_document, ai\_extract, ai\_classify, and ai\_translate handle specialized work, while ai\_query sends prompts to an accessible Databricks-hosted Foundation Model serving endpoint. Unity Catalog permissions, existing pipelines, and system.billing.usage keep governance and billing within Databricks, while SQL execution manages planning, parallelization, and retries. Production guidance includes tagging jobs, sampling at least 10,000 rows, choosing models deliberately, requesting structured output, and versioning prompts.


### [Measuring campaign impact with social and search data](https://yomu.fyi/post/measuring-campaign-impact-with-social-and-search-data.md)
- Company: [Brandwatch](https://yomu.fyi/company/brandwatch.md)
- Author: Ksenia Newton
- Published: Aug 14, 2026
- Type: Explainer

Campaign post-mortems often report reach, engagement, impressions, and sentiment without establishing whether a campaign changed perception or behavior. It argues that social listening should measure sentiment, themes, mention volume, and audience conversation shifts, while search intelligence measures category and branded demand, promoted benefits, and share of search. A client example contrasts a campaign that generated strong social buzz while category search declined with a later campaign that reversed declining demand, captured two-thirds of share of search, and grew search intent 134%. The difference was attributed to combining socially engaging creative with media strategy and messaging designed to drive search demand. The proposed framework aligns measurement with campaign goals and uses gaps between social sentiment and search intent to identify awareness without demand, existing intent without audience expansion, or stronger market impact.


### [No Dumb Questions: What is AI context architecture? Why not just build your own?](https://yomu.fyi/post/no-dumb-questions-what-is-ai-context-architecture-why-not-just-build-y.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Phoebe Sajor
- Published: Aug 14, 2026
- Type: Explainer

AI context architecture defines the boundaries, data access, memory, and fallback behavior that constrain AI agents and make their outputs more predictable. The discussion distinguishes architecture as system design, infrastructure as the storage and delivery of context, and engineering as implementation; MCP is treated as an architectural protocol, while RAG spans all three layers. Examples include restricting retrieval to car or sports-car tires, preserving agent history, and routing incomplete or low-trust knowledge to subject-matter experts through a human-in-the-loop flow. The buy-versus-build discussion notes that coding a custom architecture is possible, but buying can provide accumulated experience with data treatment, edge cases, and recurring operational problems, while good architecture also reduces token costs and aims for consistent, predictable answers.


### [Announcing support for ClickStack in the ClickHouse Terraform provider](https://yomu.fyi/post/announcing-support-for-clickstack-in-the-clickhouse-terraform-provider.md)
- Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md)
- Published: Aug 14, 2026
- Type: Announcement

The ClickHouse Terraform provider now supports managing ClickStack resources for both self-hosted deployments and ClickHouse Cloud. Dashboards, alerts, sources, saved searches, connections, and webhooks can be kept in version control, reviewed, and applied with the standard terraform plan and terraform apply workflow, helping keep configurations aligned across environments. ClickStack is implemented as a dedicated service module in the existing ClickHouse/clickhouse provider, using Cloud organization credentials plus a service ID for Managed ClickStack, or an endpoint and personal API access key for self-hosted deployments. The work also extends the API contract with named schemas, consistent integer fields, structured validation errors, and dashboard JSON validation during planning when the validation endpoint is available. Support is beta from provider version 3.25, with import and generated-configuration workflows for existing resources; if validation is unavailable, planning warns and validation is deferred to apply.


### [How Cloudflare detects MCP traffic and helps secure it](https://yomu.fyi/post/how-cloudflare-detects-mcp-traffic-and-helps-secure-it.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: AJ Gerstenhaber
- Published: Aug 14, 2026
- Type: Announcement

Traditional security boundaries assume human speed and judgment, but AI agents execute nondeterministic actions rapidly and can invoke unapproved Model Context Protocol servers through standard HTTPS traffic. To mitigate this shadow traffic, Cloudflare One introduces detection and inspection capabilities across clients, network boundaries, and MCP servers. Cloudflare Gateway leverages protocol-level headers and JSON-RPC inspection to identify direct MCP connections, verify managed paths, and enforce access through approved MCP Server Portals. Furthermore, Cloudflare Agents SDK v0.20.0 implements the stateless 2026-07-28 MCP specification while providing fallback handshakes for legacy servers. Organizations can combine Gateway traffic source rules with server middleware like WriteGuard to block unauthorized tool invocations before execution.


### [Secure all your internal vibe-coded applications — in one click](https://yomu.fyi/post/secure-all-your-internal-vibe-coded-applications-in-one-click.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Chythra Malapati
- Published: Aug 14, 2026
- Type: Announcement

AI-assisted development enables employees to build applications rapidly, but unmanaged deployments can accidentally expose internal company data to the public Internet. Cloudflare introduced direct Cloudflare Access integration for Cloudflare Workers, allowing organizations to enforce authentication policies directly at the account or individual Worker level rather than per hostname. When enabled, incoming requests are authenticated before reaching application code across custom domains, routes, workers.dev subdomains, and preview environments. Developers can access authenticated identity data such as emails and groups directly via the Worker context object without manually validating JSON Web Tokens. This capability was implemented on Cloudflare's Rust-based FL2 proxy, which separated Worker routing from Worker execution so routing runs safely prior to Access policy enforcement.


### [Integrations That Write Themselves](https://yomu.fyi/post/integrations-that-write-themselves.md)
- Company: [Ramp](https://yomu.fyi/company/ramp.md)
- Author: Shubhayan Srivastava
- Published: Aug 14, 2026
- Type: Problem & solution

Ramp describes an approach to scaling integrations beyond what engineers can build and maintain by hand. Its agentic system lets customers describe a missing workflow integration, researches the provider’s API, requests credentials through a secure widget, writes and tests ordered API-call “recipes,” and generates a deterministic script that runs the integration after build time. An internal Integration Factory applies the same pattern to first-party connectors, producing evidence for review and opening pull requests; the post says 75 integrations have shipped this way, with work reduced from weeks or months to hours. Security controls include HTTPS and hostname allowlists, private-address rejection, isolated egress, bounded responses, business-scoped immutable recipes, and test credentials rather than customer data. The central design lesson is to use models during research and construction, keep them out of execution, and bound autonomy with verification artifacts.


### [Serverless vehicle tracking at scale: Bosch L.OS on AWS](https://yomu.fyi/post/serverless-vehicle-tracking-at-scale-bosch-l-os-on-aws.md)
- Company: [AWS](https://yomu.fyi/company/aws.md)
- Author: Yogish Kutkunje Pai
- Published: Aug 14, 2026
- Type: Problem & solution

Bosch Mobility Platform Solutions developed the Logistics Operating System on AWS to unify vehicle tracking across fragmented spot logistics markets. The system standardizes multiple telematics providers, disparate data formats, and diverse communication protocols into a centralized visibility layer. Orchestration is handled by a Tracking Connector running on Amazon ECS with AWS Fargate, while AWS Lambda functions act as provider-specific adapters for protocol translation. Event-driven message ingestion and streaming rely on Amazon MSK, complemented by Amazon ElastiCache for low-latency caching and Amazon DynamoDB for compliance policy enforcement. Currently operational in India with ten integrated ISVs, the platform reportedly reduces integration costs by 15–20% and lowers total tracking costs for small transporters by 25–30%.


### [Insurance for Rideshare Drivers | Uber](https://yomu.fyi/post/insurance-for-rideshare-drivers-uber.md)
- Company: [Uber](https://yomu.fyi/company/uber.md)
- Published: Aug 14, 2026
- Type: Explainer

Uber’s rideshare insurance guidance explains how coverage changes when a driver is offline, online and available, en route, or on-trip, and how personal auto insurance fits into each state. Drivers must maintain personal insurance at mandatory minimum limits, while Uber maintains commercial coverage on their behalf; repair coverage while en route or on-trip depends on comprehensive and collision coverage in the personal policy. When a driver is at fault while en route or on-trip, Uber lists at least $1 million in coverage for property damage and injuries to riders and third parties, plus vehicle-damage protection up to actual cash value with a $2,500 deductible, subject to conditions. The guidance also outlines optional protections, state-dependent coverages, certificates of insurance, and accident-reporting steps through the Driver app.


### [Close the Database Blind Spot with MongoDB Atlas Observability](https://yomu.fyi/post/close-the-database-blind-spot-with-mongodb-atlas-observability.md)
- Company: [MongoDB](https://yomu.fyi/company/mongodb.md)
- Published: Aug 14, 2026
- Type: Announcement

MongoDB Atlas introduces OpenTelemetry Metrics Sink, a push-based stream that delivers high-fidelity Atlas metrics to OpenTelemetry-compatible platforms, enabling database telemetry to flow alongside application and infrastructure metrics. This closes the gap where database telemetry was often disconnected from application and infrastructure monitoring, forcing operators to jump between dashboards. The push-based delivery eliminates the complexity of pull-based collection, custom exporters, and polling infrastructure, reducing operational overhead and avoiding API rate limits. It supports configuration via the Atlas UI or Terraform, works with custom OTel endpoints, Dynatrace, and New Relic, and is available for dedicated M10+ clusters; a test metric is emitted on creation or update to verify it is working. Combined with Atlas Log Integration and upcoming Events Integration, teams gain unified visibility into database health alongside other signals, accelerating incident response and root cause analysis.


### [State of Open Models: Summer 2026 Observations](https://yomu.fyi/post/state-of-open-models-summer-2026-observations.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Adina Yakefu, Apolinário from multimodal AI art, Irene Solaiman
- Published: Aug 14, 2026
- Type: Benchmark

The report analyzes Hugging Face Hub activity from January through August 2026 to assess how open-model releases, usage, licensing, and agent traffic are changing. Public repositories expanded from 2.43 to 2.96 million models, while 85.6% of models had fewer than 200 lifetime downloads and 1.5% of repositories captured 99.2% of downloads. Chinese labs reached monthly ceilings of 754B to 2.78T parameters, while broader portfolios such as Qwen’s generated far more downloads than frontier-only strategies; likes and downloads measured attention and infrastructure dependence differently. Large Chinese releases were often Apache 2.0 or MIT licensed, though newer trillion-parameter models introduced restrictions, while agents became the Hub’s leading user and autonomous-agent activity exposed the practical value of running quantized open models locally.


### [Reading the signals: Helping your AI-built payment integration understand business intent](https://yomu.fyi/post/reading-the-signals-helping-your-ai-built-payment-integration-understa.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: David Benchi
- Published: Aug 14, 2026
- Type: Problem & solution

AI agents can quickly produce Stripe payment flows that create a PaymentIntent, render the Payment Element, and pass an end-to-end demo, yet a correct implementation can still violate the business intent behind the money. The post argues that payment expertise and business decisions are often missing from integrations built from API references, causing silent failures such as terminal declines being retried, intents stuck in requires\_action, uncaptured authorizations, restricted connected accounts, and asynchronous payments being refunded. It recommends defining business intent before configuring the PaymentIntent, then writing those rules into code comments, metadata, documented requirements, or custom objects. A verifier agent can check rules on every build, either through an agent skill, automated tests, or CI, while shared ownership remains with the human who decides what correct means.


[Newer posts](https://yomu.fyi/posts/page/75.md) · [Older posts](https://yomu.fyi/posts/page/77.md)