Code415 Radar

Key ideas

hook

A function Claude Code calls when an event happens, which can watch the event, change it, or answer it itself.

settings hook vs mod

A settings hook is a shell command or HTTP call set in a settings file, while a mod's handlers are functions that run inside Claude Code's own process.

plugin marketplace

A named source of plugins; you install a mod as name@marketplace, the same way as any other plugin.

Steps

1. Read the Mods overview page in the Claude Code docs, focusing on the section on what a mod can do and the comparison table with hooks, skills and MCP.
2. Study the small register.js example that counts tool calls and shows the count next to the spinner; note how one variable is shared by two hooks.
3. Open the mods folder in the anthropics/claude-code repo and skim the diff mod to see a real pane with buttons.
4. Connect it to something familiar: it is like browser extensions or VS Code extensions, code that runs inside the host with your rights.
5. Self check: why can a mod approve a tool call that your own deny rule or PreToolUse settings hook would have stopped, and what does that mean for trust?

Steps

1. Run claude --version and update if it is older than 2.1.287.
2. In a scratch project, ask Claude for a mod that counts tool calls and shows the count beside the spinner, like the docs example.
3. Before loading it, run claude plugin validate on the mod's folder and read which events it hooks and which calls it makes.
4. Load it with /reload-plugins, run a task that reads a few files, and watch the counter change.
5. Run /plugin and confirm the dim line under the tabs names your mod as active.

Small angles to try

• Ask for a pane that charts tokens used per request and compare against the cost shown by your usage page.
• Write a mod that holds any Bash call containing rm and asks you first, then check how it interacts with your permission rules.
• Start with --safe-mode and confirm your mod no longer loads.

Key ideas

broadcast vs addressable control

Broadcast sends one command to every device, while addressable control sends a different command per seat or group, which is what makes crowd pictures possible.

920MHz band

A sub GHz radio band in Japan used for low power devices, with good reach through crowds and walls compared with 2.4GHz.

seat to pixel mapping

A table that turns seat numbers into coordinates, so a show file can treat the audience as a low resolution screen.

Steps

1. Read the ITmedia PC USER explainer on concert penlights and list the four control methods it describes.
2. For each method, write down what is sent, who receives it, and what can go wrong in a packed arena.
3. Connect it to something familiar: a seat mapped show is a framebuffer where each seat is one pixel and the venue sends frames.
4. Think about timing: if commands arrive 100 ms apart across the arena, how visible is the lag in a fast chase effect?
5. Self check: why does the Bluetooth method need fans to type in their seat number, and what happens to the picture if 10% of fans type it wrong?

Steps

1. Make a grid of seats, for example 40 rows by 80 seats, and treat each seat as one pixel.
2. Write a function that takes a short text, draws it into a tiny bitmap, and assigns each seat a color from that bitmap.
3. Simulate errors: give a random 10% of seats a wrong seat number or a dead battery and render the result.
4. Add per seat delay from 0 to 200 ms and animate a left to right color sweep to see how lag looks.
5. Save before and after images and compare how readable the text stays.

Small angles to try

• Compare a broadcast only mode where every seat shows the same color with seat mapped mode.
• Model infrared blind spots by blocking a cone of seats behind a pillar.
• Measure the minimum font height in rows that stays readable at 10% error.

Key ideas

full duplex

The system can listen and talk at the same time, so it can be interrupted and can interrupt, like a person on a call.

video Turing test

A test where people talk to a system over video and are asked afterwards whether they spoke to a human.

audio to video latency

The delay between someone finishing a sound and the generated face reacting; Tavus reports about 0.43 seconds.

Steps

1. Read the Griffin page on tavus.io and write down the sample size, what participants were told, and the comparison system.
2. Look for what is not reported: confidence intervals, who the participants were, and how long the calls ran.
3. Connect it to something familiar: video KYC and job interviews over video rely on the same signal Griffin is trained to fake.
4. Read the safety note explaining why the model is not released to customers.
5. Self check: with 26 of 54, what is a rough 95% interval for the true pass rate, and does it still clearly beat 50%?

Steps

1. Enter the two reported results: 26 of 54 for Griffin and 1 of 41 for the old system.
2. Compute a Wilson 95% interval for each pass rate.
3. Run a two proportion test or Fisher exact test between them.
4. Ask what sample size would be needed to tell 48% apart from 50% with reasonable power.
5. Write a three line summary of what the study shows and what it does not.

Small angles to try

• Repeat with the numbers from an older AI Turing test study you know and compare.
• Draft a simple liveness check for a video call that does not rely on how a face looks, and list how it could fail.

Key ideas

controlled natural language

A subset of a language with fixed rules and an approved word list, so each sentence can be read only one way.

ASD-STE100

The Simplified Technical English standard kept by ASD in Brussels, first written for aerospace maintenance texts; the current version is Issue 9 from January 2025.

readability metric

A number such as average sentence length or a grade level formula that estimates how hard text is to read.

Steps

1. Read the overview on asd-ste100.org to learn where STE came from and what kinds of rules it has.
2. Note the core ideas: short sentences, one word one meaning, active voice, one instruction per sentence.
3. Read a summary of Karpathy's post and list the other formats he suggests beyond prose.
4. Connect it to something familiar: STE is to writing what a linter is to code, a fixed set of rules that removes ambiguity.
5. Self check: why would a word list help a non native reader, and what kind of technical idea might it make harder to express?

Steps

1. Pick three hard paragraphs from docs you know, for example an RFC section or a library README.
2. Ask a model to explain each one normally, then again with an instruction to follow ASD-STE100.
3. Measure average sentence length and a readability grade for both versions.
4. Write five quiz questions per paragraph and ask a colleague or a second model to answer from each version.
5. Compare accuracy and note where STE dropped important detail.

Small angles to try

• Try it in Japanese output too and see whether the rules carry over.
• Compare a big model and a small local model on how well they follow STE rules.
• Count words outside a basic word list as a rough compliance score.

Key ideas

agent harness

The loop around a model that sends prompts, runs tools, feeds results back and decides when to stop.

deferred tool loading

Only short tool names go in the prompt at first, and full schemas load when the model asks, which saves context.

prompt cache warming

Sending a cheap request ahead of time so the provider caches the long shared prefix and later calls are faster and cheaper.

Steps

1. Read the Pi 1.0 post on earendil.com and list each new feature in one line.
2. Read the HN thread and collect two arguments for small harnesses and two against.
3. Connect it to something familiar: a harness is like a shell, and tools are like commands on PATH.
4. Compare Pi's feature list with the agent you use daily and mark what each one has.
5. Self check: what does a model lose and gain when tool schemas are loaded only on demand?

Steps

1. Install with curl -fsSL https://pi.dev/install.sh | sh on macOS or Linux, after reading the script first.
2. Start Pi in a throwaway git repo and give it a small task such as adding a unit test.
3. Start a new session, pick the router/auto model, and repeat the task.
4. Run /session to see cost and cache usage for each run.
5. Compare time, cost and diff quality with the coding agent you normally use on the same task.

Small angles to try

• Run the same task twice in a row and see how much cache warming saves on the second run.
• Add one MCP server and check how many tokens its tools add before and after deferred loading.
• Try it with a local model endpoint if your provider list allows it.

Key ideas

human baseline

Scores from real professionals on the same tasks, which tell you whether a benchmark number is high or low.

rubric grading

Each task is split into checkable criteria, and a score is the share of criteria met.

month end close

The accounting routine of reconciling accounts, booking adjustments and producing statements for the month.

Steps

1. Read the Mercor post and write down the number of tasks, the grading method and the time limits.
2. Find the line about models eighteen months ago falling short of the 37% human average.
3. Connect it to something familiar: it is like comparing a tool's test pass rate with a team's, on a fixed test suite.
4. List what the study does not cover, such as messy source documents, judgement calls and responsibility.
5. Self check: why can a model score 100% while the human average is 37%, and what would make the human score higher?

Steps

1. Make a tiny fake ledger with 20 transactions and two deliberate errors such as a duplicate and a wrong date.
2. Write a rubric with 6 to 8 checkable items for reconciling it.
3. Ask a model to do the reconciliation and grade its answer against the rubric yourself.
4. Do the same task yourself with a timer.
5. Compare score, time and the kind of mistakes each of you made.

Small angles to try

• Add an ambiguous item that needs a judgement call and see how the model handles it.
• Try a small local model and a frontier model on the same rubric.

Key ideas

attribution

Linking activity to a specific actor, which needs more than similar tactics, such as infrastructure or account evidence.

rate limiting

Capping how many requests a client can make in a time window, a basic defense against automated scanning.

parameter tampering

Changing values in a URL or form to see whether the server trusts them without checking.

Steps

1. Read the BleepingComputer article and note dates, request counts and each side's statement.
2. Reread last week's agent probing story and list what is actually new here.
3. Read the OWASP pages on SQL injection and input validation to understand what defenders check.
4. Connect it to something familiar: this is the same noise a public web server gets from scanners, only driven by an agent.
5. Self check: what log fields would you need to tell an AI agent apart from an ordinary scanner?

Steps

1. Run a small web app of your own, for example a Flask app with one search form, in a local container.
2. Add request logging with client IP, user agent, path and status.
3. Write a local script that sends a burst of normal requests to it to produce realistic logs.
4. Add a simple rate limiter and confirm the burst gets 429 responses after the limit.
5. Write a short query over the logs that flags clients with many distinct paths in a minute.

Small angles to try

• Add a check that your search form uses parameterized queries and write a unit test that proves it.
• Compare how a reverse proxy rate limit and an app level limit behave.

Key ideas

decision model

A model that picks from allowed answers and returns a probability for each, instead of writing text.

calibration

Whether a model that says 80% is right about 80% of the time.

median latency

The middle response time, which hides slow outliers, so also look at the 95th percentile.

Steps

1. Read the Cloudflare changelog post on Clef and list the question types it supports.
2. Look at the example call that passes a state and typed questions to env.AI.run.
3. Connect it to something familiar: it is like a classifier with a fixed label set, but with the label set given in each request.
4. Read the Hugging Face model card for Cloudflare/clef-flash and check its license and intended use.
5. Self check: when would you trust a 0.62 probability enough to act on it without a human?

Steps

1. Pick a decision you make in code today, such as routing a support message to one of five queues.
2. Label 50 example messages yourself.
3. Send each to Clef Flash on Workers AI with the five queues as a choice question and record the top answer and its probability.
4. Compute accuracy and a simple calibration table by probability bucket.
5. Record latency for each call and report median and 95th percentile.

Small angles to try

• Compare with a general chat model asked to output one label.
• Try the 27B Clef on the hard cases only and measure the gain.
• Use your own logs as the dataset.

Key ideas

app coupon funnel

Using a discount only available in an app to get new customers to install it, so the chain can reach them later.

loyalty system merge

Combining two companies' member accounts and points, which needs matching users and converting balances.

co location

Putting two brands in one site to share rent and staff, chosen by data on traffic and overlap.

Steps

1. Read the Denfaminicogamer article on the acquisition and note the dates and store goals.
2. Read Sugakiya's store opening notice and list every perk that needs the app.
3. Connect it to something familiar: it is like a company migrating users from one auth system to another.
4. Sketch the data a chain would need to pick a site for a combined store.
5. Self check: what could go wrong if two loyalty apps merge user accounts by phone number only?

Steps

1. Make two small fake member tables, one per brand, with name, phone, email and points.
2. Add some overlap with slightly different spellings and old phone numbers.
3. Write a matching script that merges accounts by email, then phone, then fuzzy name.
4. Count true matches, false matches and missed matches against the overlap you planted.
5. Write a conversion rule for points and check total value before and after.

Small angles to try

• Add a rule that asks the user to confirm low confidence matches.
• Measure how many false matches appear if you match by phone only.

Key ideas

R&D tax credit

A US credit that lowers taxes for spending on qualified research, which can include equipment used in experiments.

uncertain tax position reserve

Money a company sets aside in its books in case tax authorities reject some of its claims.

capex

Capital spending on long lived assets such as buildings and chips, which AI companies now spend at record levels.

Steps

1. Read the TheNextWeb summary of the NYT report and list the yearly credit amounts.
2. Look up what the research credit is meant to cover on an official IRS page.
3. Connect it to something familiar: it is like labeling a production server as a test box to get a cheaper license.
4. Find Meta's statement and the reserve figure, and note who would decide if the claim stands.
5. Self check: what makes a data center an experiment rather than production, and who draws that line?

Steps

1. Put the three reported credit amounts into a sheet by year.
2. Compute the growth rate year over year.
3. Add the reported reserve and its two year growth.
4. Chart credit and reserve together and describe the trend in two sentences.
5. List which numbers come from the company and which from reporters.

Small angles to try

• Add public capex figures from Meta's filings to see the credit as a share of spending.
• Compare with another big tech company's reported credit if you can find it.

Key ideas

line level review

Comments tied to specific changed lines, like a human reviewer leaves on a pull request.

false positive rate

The share of review comments that point at problems that are not real.

custom endpoint

A setting that lets the tool call any server that speaks a compatible API, including a local model.

Steps

1. Read the README of alibaba/open-code-review and list what it checks and how it is configured.
2. Look at an example review output and judge how specific the comments are.
3. Connect it to something familiar: it is a linter that reads intent, not only syntax.
4. Compare it with the review features of the coding agent you already use.
5. Self check: how would you measure whether it saves reviewer time rather than adding noise?

Steps

1. Install with npm install -g @alibaba-group/open-code-review.
2. Set the provider and model with ocr config provider and ocr config model.
3. Take an old pull request from your own repo where you know the real bugs, and check out its diff.
4. Run the tool on the diff and save the comments.
5. Label each comment as real issue, style nit or wrong, and count them.

Small angles to try

• Run it with two different models and compare the useful comment rate.
• Plant three known bugs in a branch and see how many it finds.

Key ideas

fiber

A lightweight task managed by a library rather than the OS, so you can run tens of thousands cheaply.

tree shaking

Removing unused code at build time, which is why bundle size depends on how a library is structured.

lockstep releases

All packages in an ecosystem share one version number, so mixed versions do not break each other.

Steps

1. Read the Effect 4.0 release post and copy the three benchmark numbers with their units.
2. Read the Effect docs intro to see what problem it solves: typed errors, dependency injection and concurrency.
3. Connect it to something familiar: a fiber is like a goroutine or an async task with structured cancellation.
4. Skim the migration guide and list the three biggest breaking changes.
5. Self check: why can a library get 6x faster without your code changing, and what might you pay for it?

Steps

1. Make two folders, one with Effect 3 and one with Effect 4, each with the same small program that runs many concurrent tasks.
2. Bundle both with the same bundler and compare output sizes.
3. Time both with 10,000 and 50,000 tasks and record tasks per second.
4. Measure peak memory for each run.
5. Compare your numbers with the release post and note differences.

Small angles to try

• Ask a coding agent to migrate a small Effect 3 project with the official guide and count the fixes you had to make.
• Compare with plain Promise.all for the same workload.

Key ideas

end to end test

A test that drives the real app like a user, from UI to backend.

record and replay

Saving the concrete actions an agent took so later runs repeat them without calling the model.

flaky test

A test that sometimes passes and sometimes fails with no code change.

Steps

1. Read the README of tester-army/e2e and note how agent steps and normal steps are mixed.
2. Find how replay decides the app has changed and the agent must run again.
3. Connect it to something familiar: it is like snapshot tests, but the snapshot is a list of UI actions.
4. Compare it with Playwright tests you know and list what the agent adds.
5. Self check: if a button label changes, what should happen in replay, and what if the flow changes?

Steps

1. Run npx e2e init in a test folder for your app.
2. Write one normal test with a locator and an assertion for a login or form page.
3. Write the same flow as an agent step described in plain language.
4. Run both three times and record time, cost and pass rate.
5. Change a button label in your app and run again to see whether replay recovers.

Small angles to try

• Try the agent step with a small local model and a frontier model.
• Add a deliberate slow network delay and check which style is flakier.

Key ideas

Monte Carlo simulation

Running a random process many times to estimate a probability that is hard to compute by hand.

series win probability

The chance of winning a best of N series given the chance of winning one game.

advantage win

A win counted before the series starts, which changes how many games each side needs.

Steps

1. Read the NPB Climax Series page and write down both formats and the two trigger conditions.
2. Work out by hand how many wins each team needs in each format.
3. Connect it to something familiar: it is like a retry budget, the favorite can lose more games and still pass.
4. Learn the binomial way to compute series odds, then compare it with simulation.
5. Self check: if the top team wins 55% of single games, does the 2 win rule matter more or less than when it wins 45%?

Steps

1. Write a function that plays one series given a single game win probability, a head start and a target number of wins.
2. Run it 100,000 times for the 1 win format and for the 2 win format.
3. Repeat for single game probabilities from 0.40 to 0.65.
4. Plot both curves on one chart.
5. Check one point against an exact binomial calculation.

Small angles to try

• Add ties, which happen in NPB, and see how they change the odds.
• Use this season's real records to estimate single game probabilities.
• Compare with an MLB best of 5 Division Series with no head start.

Key ideas

off balance sheet financing

Funding held in separate entities or leases so it does not show up as company debt.

share of GDP

Spending divided by the size of the whole economy, the fair way to compare booms across eras.

labor share

The part of national income paid to workers rather than to capital owners.

Steps

1. Read the Brookings page for Financing the AI Buildout and note the total and the per year share.
2. Find the comparison with past infrastructure booms in the paper.
3. Read the a16z State of Markets II post and look for the chip, power, networking and building split.
4. Connect it to something familiar: it is like a startup's burn rate, where the question is when revenue catches up.
5. Self check: how much yearly revenue would AI need to make $10.3T of investment pay back over ten years?

Steps

1. Enter the $10.3T total and spread it evenly over the eight years.
2. Apply the a16z split to see yearly spend on chips, power, networking and buildings.
3. Assume a chip life of four to six years and compute yearly depreciation.
4. Compute the revenue needed each year to cover depreciation at a few margin levels.
5. Write two sentences on which assumption changes the result most.

Small angles to try

• Compare with a cloud provider's reported AI revenue if you can find a public figure.
• Change the chip life to three years and see the effect.

Key ideas

forced perspective

Making near and far objects look the same size and line up by placing them at the right distances from the camera.

pinhole camera model

The simple math where an object's size on screen is its real size divided by its distance from the lens.

face tracking AR

Software that finds a face in each frame and attaches a virtual object to it.

Steps

1. Read the NewEngen October trends post and pick the Pumpkin Head Illusion.
2. Look up the pinhole camera formula for projected size.
3. Connect it to something familiar: it is the same math as why the moon looks as big as a coin at arm's length.
4. Think about what breaks the illusion: the friend moving, a wide angle lens, or depth of field.
5. Self check: if the friend's head is 3 m away and the pumpkin is twice as wide, how far from the lens should the pumpkin be?

Steps

1. Compute the pumpkin distance with the pinhole formula for your own measurements.
2. Film the trick with a phone and check how close your formula was.
3. With OpenCV, run a face detector on the video and see whether it still finds the hidden face.
4. Write a small script that overlays a pumpkin image on detected faces as an AR version.
5. Compare how both versions handle head movement.

Small angles to try

• Try a wide lens and a zoom lens and note how alignment changes.
• Measure how many frames per second your AR overlay runs at on a laptop.

Key ideas

diffusion language model

A model that starts from noise or masked tokens and refines the whole sequence over several steps, instead of writing left to right.

variational bound

A training objective that gives a lower bound on likelihood, used when the exact likelihood is hard to compute.

perplexity

A measure of how surprised a language model is by test text; lower is better.

Steps

1. Read the abstract on the Hugging Face paper page for HC-DLM.
2. Look at the figure that shows the discrete and continuous tracks and how they interact.
3. Connect it to something familiar: image diffusion denoises pixels, and this denoises tokens with a helper signal alongside.
4. Read the Sudoku result and think about why global constraints are hard for left to right models.
5. Self check: what does the continuous path give the model that masked tokens alone do not?

Steps

1. Clone the code from github.com/rhfeiyang/HC-DLM and read the README.
2. Find where the continuous latent and the token sequence are combined in the model code.
3. If you have a GPU, run the smallest Sudoku setting the README describes.
4. Compare solved rate with the discrete only baseline if the repo provides one.
5. Write down how many denoising steps were used and how speed changes with steps.

Small angles to try

• Change the number of denoising steps and plot accuracy against time.
• Generate your own Sudoku set with a known difficulty spread.

Key ideas

zero day

A flaw attackers use before the vendor has a fix out.

session hijacking

Taking over a logged in user's session, often by stealing or forging a session token.

privilege escalation

Going from a limited account to admin or root on the same system.

Steps

1. Read the BleepingComputer article and note the product, versions and the two CVE numbers.
2. Read Zammad's own security advisory or release notes for version 7.
3. Connect it to something familiar: helpdesk tools hold customer data and admin links, much like an email server.
4. List the steps in the chain in plain words: session, code execution, root.
5. Self check: which single control would have cut the chain earliest, and why?

Steps

1. Check whether any Zammad or other helpdesk instance you run is reachable from the internet.
2. Note its version and compare with the fixed version in the advisory.
3. In a local container, set up a helpdesk app and review session settings such as cookie flags and timeouts.
4. Read the diff between versions if it is public and note which input checks changed.
5. Write a short patch checklist for internet facing tools you maintain.

Small angles to try

• Add an uptime and version check script that warns you when a tool falls behind its latest release.
• Put the app behind an access proxy in the container and compare exposure.