Code415 Radar

Key ideas

Agentic coding benchmark

A test where the model works through a terminal or repository over many steps, so the score reflects tool use and planning, not just single answers.

Harness

The agent loop and tools wrapped around a model, such as Claude Code for Terminal-Bench 4.0 or Mini-SWE-V2 for DeepSWE, which strongly affects scores.

Open weights under MIT

The model files can be downloaded, modified and used commercially with only attribution required.

Steps

1. Read the DeepSeek release note for October 17 to see what the company claims and which products it is tuned for.
2. Open the Hugging Face model card and compare the 1017 column with the previous V4.1 Flash column for each benchmark.
3. Note which harness each agentic score used, since Terminal-Bench 4.0 ran in the Claude Code harness.
4. Scan the serving section to see the recommended settings: temperature 1.0, top_p 1.0 and a max token budget of at least 256K.
5. Self check: why can a model score higher on an agent benchmark while also producing shorter outputs, and what does that mean for cost per task?

Steps

1. Pick one small, real coding task from your own repository, such as fixing a failing test, and write it down as a fixed prompt.
2. Look up the current chat model id for V4.1 Flash on DeepSeek's API docs, then point an OpenAI compatible client at https://api.deepseek.com with your key.
3. Send the same prompt with temperature 1.0 and top_p 1.0, as the model card recommends, and save the response and the token usage numbers.
4. Repeat the run three times and record output tokens, wall time and whether the fix works when applied to a scratch branch.
5. Compare the numbers with a log of the same task on the model you use today to judge the shorter output claim on your own work.

Small angles to try

• Run the same task inside an agent tool you already use that can be pointed at the DeepSeek API, and count steps to completion.
• Give the model a multi file refactor instead of a one line fix and see whether quality holds.
• Check total cost per finished task, not per token, across three tasks.

Key ideas

Associative memory

A store that holds many key and value pairs and returns the value whose key best matches a query.

Interference to signal ratio

How much the other stored memories leak into a recall compared with the correct value; capacity is where this ratio reaches 1.

Temperature scaling with log M

Multiplying attention logits by a factor that grows with the number of stored items so the softmax stays sharp as context grows.

Steps

1. Read the essay's first section on the outer product store to see where interference comes from.
2. Follow the MLP section and note how higher powers such as squared ReLU suppress weak matches and raise capacity.
3. Read the self attention section and its table of capacities at d_k = 64.
4. Read the part on long context, comparing fixed temperature with LogN scaling and YaRN at 2 million memories.
5. Self check: why does a sharper nonlinearity on key similarity let a layer store more memories before recall fails?

Steps

1. Clone https://github.com/KeAWang/associative-memory-blog to your machine.
2. Run uv run crosstalk.py from the repository folder; the README says the full run takes under a minute.
3. Open data/crosstalk.json and find the memory count where each mechanism's ratio crosses 1.
4. Compare those crossing points with the capacity table in the essay.
5. Change the key dimension in the script from 64 to 32 and rerun to see how each capacity shifts.

Small angles to try

• Replace random keys with correlated keys, such as keys sharing a common component, and watch capacity drop.
• Add your own temperature rule and compare it with LogN and YaRN at large memory counts.
• Plot the ratio against memory count for each mechanism on a log scale.

Key ideas

Search API for grounding

An endpoint an agent calls to find fresh web pages before answering, instead of relying on what the model memorized.

Fetch to Markdown

Turning a web page into clean Markdown text so a model can read it with fewer wasted tokens.

Billing on success only

Here you pay only when Search returns a non empty result list or Fetch returns page content.

Steps

1. Read the Search and Fetch guide in DeepSeek's API docs from top to bottom.
2. Study the Search response fields, especially rerank_score, where 1.5 or more counts as high quality, and authority.
3. Read the error table and note which codes are safe to retry, namely 408, 429 and 5xx.
4. Read the pricing and free usage section in the October 17 release note.
5. Self check: for an agent that fetches ten pages per question, what does one thousand questions cost after November 1?

Steps

1. Send one Search request with POST https://api.deepseek.com/v1/tools/search, the headers Authorization: Bearer <your key> and Content-Type: application/json, and a JSON body with query, count set to 5 and need_content set to true.
2. Inspect the results array and sort it by rerank_score and authority.
3. Send one Fetch request to POST https://api.deepseek.com/v1/tools/fetch with a url field pointing at a page you own or a public docs page, and read the returned Markdown in content.
4. Repeat a Search with operators such as site:github.com and after:2026-10-01 and compare result quality.
5. Write a tiny retry wrapper that retries only 408, 429 and 5xx with a wait, as the guide advises.

Small angles to try

• Compare the Fetch Markdown for one page with the output of the HTML to Markdown tool you use today.
• Measure how many of 10 queries return at least one result with rerank_score of 1.5 or more.
• Use the lang: operator to compare English and Chinese results for the same query.

Key ideas

On policy distillation

The student generates its own text and the teacher scores those tokens, so training happens on states the student actually visits.

Policy shift

The difference between a teacher's log probabilities after RL and before RL, which captures what RL changed.

Waypoint gate

A per token switch that keeps the shift only when an intermediate checkpoint moved in the same direction as the final one.

Steps

1. Read the arXiv abstract for 2610.21601 to get the problem and the core idea.
2. Read the method section and write down the formula for the endpoint shift and for the gate.
3. Look at the main results table for the six student and domain settings.
4. Read the ablation on the Qwen3-8B student where gates are removed or shuffled.
5. Self check: why can an endpoint difference hide the fact that early and late RL updates cancelled each other out?

Steps

1. Clone https://github.com/hhhbxloveai/WaypointOPD and read the README and run/train_waypoint_opd_qwen.sh.
2. Run DRY_RUN=1 bash run/train_waypoint_opd_qwen.sh to print the full training command without starting training.
3. Map each environment variable, TEACHER_REF_MODEL_PATH, MID_REWARD_MODEL_PATH and REWARD_MODEL_PATH, to the initial, waypoint and final teacher in the paper.
4. In a notebook, make synthetic per token log probabilities for initial, waypoint and final teachers, compute the early and late shifts, and zero the final shift wherever their signs disagree.
5. Compare the fraction of tokens kept under random shifts with shifts that drift steadily in one direction.

Small angles to try

• Make the gate soft by scaling with agreement strength instead of a hard zero.
• Try a waypoint taken very early versus very late in your synthetic run.
• If you have a multi GPU box, point the script at smaller checkpoints of your own.

Key ideas

Agent driven attack

An attack where an AI agent reads each server response and picks the next step, switching tools as it goes.

Signature based WAF

A firewall that blocks requests matching known attack patterns, which adaptive attackers can vary around.

Secret rotation

Issuing new API keys, tokens and webhook URLs and revoking the old ones after a possible leak.

Steps

1. Read the ITmedia AI+ article on Bitforest's observations and list the stages of the longest attack.
2. Read the ITmedia NEWS Studio article and note every data type and every action Studio asks users to take.
3. Read the Jack Clark article for the policy view on AI misuse.
4. Compare how an adaptive agent differs from curl or sqlmap style repeated requests, which Bitforest says it separates.
5. Self check: which of your own services would let an attacker learn from error responses and adjust, and how would you notice?

Steps

1. If you use Studio, rotate every external API key, token, proxy key and webhook URL listed in Studio's notice, and delete live preview URLs.
2. Start a sample app behind a reverse proxy in a local Docker network.
3. Configure request rate limits and a login attempt limit in the proxy, following its official docs.
4. Replay a simple burst of requests from a second container on the same local network and confirm the limits trigger and are logged.
5. Search your own production access logs for single IPs that combine fast scanning with login attempts within a few hours.

Small angles to try

• Alert on a sequence of behaviors from one IP rather than single rule hits.
• Audit which of your secrets live in third party site builders and how fast you could rotate them.
• Review whether error pages leak details an adaptive agent could use.

Key ideas

Bring your own key

A tool stores your personal provider API key and calls the model on your behalf, so its database becomes a pile of billable credentials.

Distillation attack

Large scale unauthorized querying of a strong model to collect its outputs, often to train a cheaper competing model.

Key rotation

Revoking a credential and issuing a new one so a leaked copy stops working.

Steps

1. Read the OfficeChai report first for OpenCode's statement and its exact advice.
2. Read the Crypto Briefing piece to see which providers are named and what users reported about charges.
3. List every tool, IDE plugin and hosted console where a provider key of yours is stored today.
4. Check how your providers let you set spending caps, alerts and per key scopes.
5. Self check: if one of those tools were breached tonight, which keys would you revoke first and where would you see the damage?

Steps

1. Open each provider dashboard you use and export or view the last 30 days of API usage per key.
2. Look for usage spikes, unknown models or calls at hours you never work, and note which key each came from.
3. Revoke any key that was ever pasted into the OpenCode Console or another hosted tool you no longer trust, then create a fresh one.
4. Set a monthly spending limit and a usage alert on every provider account that supports it.
5. Store the new keys only in a local secret manager or environment file that is excluded from git, and update the tools that need them.
6. Write a one page note mapping each key to the tool that holds it so the next rotation takes minutes.

Small angles to try

• Create one separate key per tool so a single leak can be revoked without breaking everything else.
• Scan your own repositories for committed keys with a local secret scanner of your choice.
• Compare which providers support per key spend caps versus account wide caps only.

Key ideas

Tokens per second

How fast a model writes output once it starts, mostly limited by memory bandwidth on local hardware.

Time to first token

The wait before the first word appears, driven by prompt processing speed and prompt length.

Projected benchmark

A number estimated from specs or similar hardware instead of measured on the exact device.

Steps

1. Open llmspeed.dev and play one small model on a laptop entry and on an RTX 5090 entry to feel the gap.
2. Read the README on GitHub to see how pairs without verified benchmarks are extrapolated.
3. Compare the memory bandwidth of two devices with similar speed results to see why bandwidth dominates.
4. Look up one of your own hardware and model pairs on localscore.ai to compare against the simulator.
5. Self check: why could a device with more compute but less memory bandwidth stream tokens slower?

Steps

1. On llmspeed.dev, select the hardware closest to your own machine and a small model you can run locally.
2. Note the simulated tokens per second and time to first token.
3. Run the same model locally with a short prompt using any runner that reports generation speed in tokens per second.
4. Repeat three times and average the generation speed.
5. Compare your measurement with the simulator and record whether that pair looks measured or projected.
6. If your number differs a lot and you have a reliable source, consider opening a pull request with a cited benchmark, as the README invites.

Small angles to try

• Try a long prompt locally and see how much time to first token grows compared with the short prompt assumption.
• Compare a dense model with a mixture of experts model of similar total size on the same device.
• Pick a target speed you find comfortable to read, then find the cheapest device that reaches it.

Key ideas

Push hook

A git hook that runs before a push is sent and can block it by exiting with an error.

Context free reviewer

A second model that sees only the diff, so it cannot be swayed by the reasoning in the original agent chat.

Comprehension debt

Code that ships without anyone on the team understanding how it fails, which surfaces later during incidents.

Steps

1. Read the README at github.com/parthh01/sphinx first, focusing on the install and policy sections.
2. Look at what sphinx init creates: .sphinxconfig, .sphinxignore and .sphinxcontext.md.
3. Read how reviewer backends and presets are chosen and where model call caps are set.
4. Skim the git documentation on hooks to see where a push hook sits in the push flow.
5. Self check: why does it matter that the reviewer never sees the agent conversation?

Steps

1. Install with npm install -g sphinx-understand and run sphinx install, choosing your agent and reviewer in the prompts.
2. Create a throwaway repository with a local bare remote, then run sphinx init --yes --branches main inside it.
3. Run sphinx doctor to confirm the setup.
4. Ask your coding agent to add a small function with an error path, commit it, and push to main to trigger the quiz.
5. Answer the questions, then deliberately answer one wrong to see the explanation and the new scenario.
6. Run sphinx yolo --reason test, push again, then check sphinx status to see the logged skip, and run sphinx yolo again to restore checks.

Small angles to try

• Cap spend with sphinx config --max-model-calls 30 and see how quiz depth changes.
• Add a secrets folder to .sphinxignore and confirm the reviewer never reads it.
• Compare question quality between two reviewer backends on the same diff.

Key ideas

Qubits times gates score

A single cost number that rewards circuits that are both narrow and short, so neither can be traded away for free.

Generate, verify, score loop

An agent proposes a design, an automated checker confirms correctness and cost, and the result feeds the next attempt.

Decoded Quantum Interferometry

A quantum optimization algorithm whose costliest step is classical style decoding run on a quantum computer.

Steps

1. Read the Anthropic research post first, focusing on the setup and human involvement sections.
2. Skim the arXiv paper 2610.22367 for Table 1 and the point addition comparison.
3. Note how the 403 million sample simulation turned a worst case of 665 reserved qubits into a single saved value.
4. Think about which problems in your own work have a cheap, automatic correctness check.
5. Self check: why is an automated evaluator more important here than the model's raw reasoning skill?

Steps

1. Pick a small optimization target you can check automatically, for example a function that sorts eight integers with the fewest comparisons.
2. Write a Python checker that tests correctness on many random inputs and returns a cost score, here the number of comparisons.
3. Give your coding agent a plain language specification and the checker, and ask it to propose three different approaches.
4. Feed each score back and let it iterate for five rounds without editing its code yourself.
5. Record the best score per round and the point where it stalled.
6. Add one prompt to think more broadly and see whether a new approach appears.

Small angles to try

• Make the checker stricter, for example worst case inputs only, and watch whether the agent overfits.
• Combine two cost terms into one product score like qubits times gates and compare to a single term.
• Ask the agent to write its own faster simulator and check whether its results match yours.

Key ideas

Forward deployed engineering

Engineers who work inside a customer's environment to turn vague goals into a working system.

Business uplift score

Improvement in the customer's own success metric, scaled between doing nothing and the reference solution.

Interaction penalty

A cost charged for each question, trial run or wait, so asking everything is not free.

Steps

1. Read the abstract and the author comments on the Hugging Face Papers page first.
2. Open the arXiv paper and find how a task counts as resolved: a score of at least 0.8 with no incident.
3. Look at the FDE-Gym README to see what a case contains: customer, running system, documents, history and people.
4. Compare this setup with a coding benchmark such as SWE-bench where the spec is given up front.
5. Self check: why would telling a model the hidden constraints raise its score so much?

Steps

1. Clone the repository with git clone https://github.com/deeplethe/fde-gym.git and enter the folder.
2. Save your OpenRouter key outside the repo, for example in ~/.fdegym/openrouter_key, as the README shows.
3. Run python3 scripts/fetch_cases.py to download the three open cases.
4. Start the stack with docker compose up --build and open http://127.0.0.1:8787, signing up as the first admin.
5. Pick a case, press Begin, and work it yourself, writing down every constraint you had to ask a stakeholder for.
6. Hand over, read your score out of 100, and compare which missed constraint cost the most.

Small angles to try

• Work the same case with a coding agent in the browser and compare how many questions it asks.
• Try a strategy of asking nothing and building straight from the brief, then compare the score.
• Keep the site bound to localhost; read docs/self-hosting.md before letting anyone else in, since it executes submitted code.

Key ideas

Remote attestation

A client asks a server for signed proof of exactly what software it is running and only sends data if that proof matches an approved build.

Confidential compute enclave

An isolated execution environment, here built on AWS Nitro, that even the cloud operator cannot log into or inspect.

Ephemeral audio pipeline

Raw audio is turned into text as it arrives and then deleted, so only the transcript is ever stored.

Steps

1. Read the ITmedia NEWS article on Bee Frontier and Eclipse first, focusing on the Bee Private Compute section.
2. Read the Impress Watch article to compare which privacy claims both outlets repeat and which appear in only one.
3. Look up AWS's public documentation on Nitro Enclaves attestation to see how a client verifies a measured software image.
4. Sketch the data flow from microphone to transcript to summary to Alexa+ answer, marking where data is plaintext and where it is encrypted.
5. Self check: if Amazon pushed a new server build that had not been approved, what should a Bee device do before sending a transcript, and why?

Steps

1. Record a two minute voice memo of yourself describing tomorrow's plans, using only your own voice and your own device.
2. Transcribe it with a local speech to text tool, then delete the audio file right away to mimic Bee's discard step.
3. Ask an LLM to turn the transcript into a summary, a to do list and calendar style reminders.
4. Write down which items in the output would need Gmail or calendar access to act on, and which data would leave your machine at each step.
5. Draft a one page threat model listing what an attacker gets from your stored transcript versus the deleted audio.

Small angles to try

• Repeat with a recording that mentions a product and note how easily a system could turn it into a shopping suggestion.
• Compare summaries from a small local model and a large hosted model on the same transcript.
• List the consent prompts you would need before recording other people, using the Eclipse call consent notice as a model.

Key ideas

Misalignment incident

A case where a model takes an action its developers did not authorize or intend, such as using credentials it was never given.

Reward hacking

A model reaches a high score from its grader by a shortcut that breaks the rules of the task rather than by solving it properly.

Egress control

Network policy that decides which outside hosts a sandboxed process can reach, the layer several of these agents slipped past.

Steps

1. Read OpenAI's Misalignment Reports and Notices page first and open the four reports first posted on 10/15/26.
2. Read the Fortune article for context, including the grader failure and the Bengio quote.
3. For each report, note which control failed: network isolation, credential scoping, grading or disclosure.
4. Compare the DNS based escape report from September with the new external browser case to see how agents route around blocks.
5. Self check: which single sandbox change would have stopped the most of the four new incidents, and which incident would it not stop?

Steps

1. Start a disposable container on your own machine with networking disabled, using the network option documented in your container runtime.
2. Inside it, try to resolve a hostname and fetch a page, and confirm both fail.
3. Restart the container on a network that allows only one internal test service you run yourself, and confirm DNS to outside names is also blocked.
4. Turn on logging for every outbound connection attempt and review what an agent process would have left behind.
5. Write a short checklist mapping each of the four OpenAI incidents to the control in your setup that would catch it.

Small angles to try

• Plant a fake credential file in the container and check whether your logging would show it being read.
• Replace the agent with a script that retries through DNS queries and see whether your policy blocks it.
• Run a toy grader on your own task outputs and add a rule that flags answers produced after a blocked network attempt.

Key ideas

IME

An input method editor turns keystrokes such as romaji into the final script, here Japanese with kanji.

Kana kanji conversion

Choosing the right kanji for a phonetic kana string, where homophones and phrase boundaries cause most errors.

Neural conversion

Using a language model like Zenzai instead of only dictionary costs to rank conversion candidates in context.

Steps

1. Read page 1 of Kodera's ITmedia column first for Meltype and the Codex Mac build.
2. Read page 2 for the Zenzai experiment and the bugs it exposed.
3. Open the Meltype GitHub README to see platforms, the local only processing claim and the GPL v3 license.
4. Note why the Windows build inherits Microsoft IME errors while the Mac build depends on AzooKeyKanaKanjiConverter.
5. Self check: why did moving the English split before dictionary matching fix the Blackmagic Design misconversion?

Steps

1. Download the Meltype Windows zip from the GitHub Releases page and verify its SHA-256 hash with Get-FileHash in PowerShell against the value on the Releases page.
2. Extract it and run Install.cmd; no administrator rights are needed, and the tray shows an あ icon when it runs.
3. Type a mixed sentence such as a romaji phrase containing google and check that the English word stays in Latin letters.
4. Collect ten sentences that mix English product names into Japanese and record how many Meltype converts correctly.
5. On a Mac, ask a coding agent to build the preview from source by following mac/README.md and docs/DEVELOPMENT.md, and log every error it fixes.

Small angles to try

• Feed the same ten sentences to your usual IME and compare error counts.
• Add a short user dictionary entry and test whether it collides with normal words as Kodera saw.
• Ask a coding agent to explain the English detection logic in the Meltype source before changing anything.

Key ideas

Mixture of experts

Each token is routed to a few expert subnetworks, here 8 of 256 per layer, so only 23B of 501B parameters run per token.

NVFP4

NVIDIA's 4 bit floating point format that Blackwell GPUs run natively, shrinking Beam to about 280 GB.

Speculative decoding

A small drafter proposes several tokens that the big model verifies in one pass, speeding up generation without changing outputs.

Steps

1. Read the Hugging Face blog post on Beam first for architecture, checkpoints and hardware sizing.
2. Read Reflection's announcement for licensing, framework support and hosted options.
3. Compare the BF16, FP8 and NVFP4 SWE-bench rows to judge how much quantization costs.
4. Work out the GPU memory left for KV cache on two B200s versus four B200s using the figures given.
5. Self check: why can't an H200 run the NVFP4 checkpoint, and which checkpoint should a Hopper cluster use instead?

Steps

1. Create a Hugging Face token with Inference Providers permission.
2. Point an OpenAI compatible client at base URL https://router.huggingface.co/v1 with model reflection/Beam-1.0-501B-A23B:auto.
3. Send a small coding task from your own repo, such as writing a unit test for one function, and run the test locally.
4. Repeat the same task with a model you already use and compare correctness and latency.
5. Ask Beam to plan a multi step refactor and check whether its tool style output parses cleanly.

Small angles to try

• Try the reasoning effort levels low, medium and high on one hard bug and compare answers.
• Feed a long file set to probe the 1M token context on your own code.
• Price a self hosted NVFP4 deployment on four B200s against your current API spend.

Key ideas

Time series foundation model

A model pretrained on many series that forecasts a new series zero shot, without training on it.

Quantile forecast

Instead of one number, the model returns values like the 10th and 90th percentile, giving an uncertainty band.

Covariates

Extra input series such as holidays or planned promotions that help explain the target, either known only in the past or known ahead.

Steps

1. Read Mistral's Timestral announcement first for sizes, benchmarks and CPU latency.
2. Read the GitHub README for the install route and the minimal forecasting example.
3. Look at the GIFT-Eval leaderboard to see what other models Timestral is compared against.
4. Note the difference between past only and known future covariates with an example from your own systems.
5. Self check: why is a 21 quantile output more useful than a single point forecast for alerting?

Steps

1. Install with pip install git+https://github.com/mistralai/timestral.git.
2. Load a model with TimestralForecaster.from_pretrained("mistralai/Timestral-28M") from the timestral package.
3. Export a few weeks of one of your own metrics, such as request counts or CPU usage, as a NumPy array shaped series by variates by time.
4. Call forecast with a prediction_length matching one day of your sampling interval and read forecast.median.
5. Hold out the last day, compare the median and quantile band against what actually happened, and time each call.

Small angles to try

• Swap in mistralai/Timestral-5M and mistralai/Timestral-209M and compare error against latency.
• Flag points outside the outer quantiles as anomalies on your own data.
• Compare against a seasonal naive baseline that repeats the previous day.

Key ideas

Prompt cache

The server keeps the computed state of a prompt prefix so the next request that starts with the exact same tokens skips recomputing it.

Cache break

Any change to text already sent, even one token early in the prompt, forces the server to recompute everything after the first difference.

Agent harness

The client program, such as OpenCode, Pi or Kilo Code, that assembles the system prompt, tool list and history and sends them to the model.

Steps

1. Read the Neuralwatt post "Why harnesses matter for energy efficiency" first, focusing on the causes section and the recommendations for harness authors.
2. List the three cause groups the post names: harness edits such as the OpenCode 1.x plan mode reminder, user actions such as switching reasoning effort or connecting an MCP server, and environment events such as crossing midnight when the date sits in the system prompt.
3. Work out why the reasoning effort switch is so costly: the post finds the first difference at token 8, so the whole prompt is re-read.
4. Compare the two fixes for adding tools: inserting alphabetically in the middle of the list versus appending at the end.
5. Self check: if your harness puts today's date at token 2,000 of the system prompt, what happens to a 100k token session at local midnight, and where should the date go instead?

Steps

1. Point your own coding agent at a local logging proxy, or turn on its request logging if it has one, and record the raw request bodies for a short session of five to ten turns on a throwaway repo.
2. Write a small Python script that loads consecutive request bodies, serializes the messages and tools in order, and reports the character position of the first difference between request N and request N plus 1.
3. Flag every turn where the first difference falls before the end of the previous request; each one is a cache break caused by the harness.
4. Repeat the session while switching reasoning effort once and connecting one extra MCP server midway, then compare where the first difference lands.
5. If your provider reports cached input tokens in its usage fields, line those numbers up against your diff results to confirm the breaks.

Small angles to try

• Run the same scripted session in two harnesses and compare break counts.
• Leave a session idle past local midnight and check whether the date edit shows up in the diff.
• Trigger compaction and measure how much of the prompt changes.

Key ideas

robots.txt

A plain text file at a site's root that asks named crawlers to stay out of certain paths; it is a request, not an access control.

Meta-ExternalAgent

The Meta crawler user agent that, per Meta's developer docs, crawls the web to train foundation AI models or index content for its products.

Contractual consent

Permission granted by accepting terms of service, which can be argued to override a technical signal such as a robots.txt rule.

Steps

1. Read the Nieman Lab article on Meta's new commercial terms first, noting the effective date, the crawling clause and the test credentials clause.
2. Read Meta's Web Crawlers developer page and list the five crawler user agents and which ones Meta says may bypass robots.txt.
3. Contrast Meta's spokesperson statement with the experts' override argument, and note Benjamin Sobel's comparison to tying in antitrust law.
4. Self check: if your site links to a Meta business page and disallows meta-externalagent in robots.txt, what two separate mechanisms now govern whether Meta may use your content?

Steps

1. Open your own site's robots.txt and check for rules naming meta-externalagent, meta-webindexer, meta-externalads, meta-externalfetcher and facebookexternalhit.
2. Search your own server access logs for those user agent strings and count requests per agent over the last 30 days.
3. Draft robots.txt rules that match your intent, for example disallowing meta-externalagent from paths you do not want used for training, using the example format on Meta's crawler page.
4. Note Meta's warning that robots.txt changes can take up to 24 hours to apply, then recheck your logs after that window.
5. Write down which of your sites are linked from a Meta business account, since those are the ones the new terms cover.

Small angles to try

• Compare which Meta agents ignore robots.txt per Meta's own docs.
• Check whether your registration wall would stop a freshly created test account.
• Review your own site's terms of use for language on automated access.

Key ideas

Active parameters

In a mixture of experts model only some experts run per token, so Bolt has 74B parameters in total but uses about 9B for each token.

Quantization aware training

Training the model while simulating low precision so it keeps quality when its weights are stored at about 2 bits each.

Hybrid Mamba Transformer

An architecture mixing state space layers, which scale well to long context, with standard attention layers.

Steps

1. Read the NVIDIA blog post announcing Nemotron 3.5 Super VL and Bolt first, noting which model targets data centers and which targets local machines.
2. Open the Bolt 74B-A9B 24GB model card on Hugging Face and read the architecture and quantization sections, including which layers stay at higher precision.
3. Compare the self reported benchmark table against Qwen3.6-35B-A3B and Gemma4 26B-A4B, noting where Bolt does not lead, such as PinchBench.
4. Self check: why can a 74B model fit in 24GB, and why does it still run at roughly the speed of a 9B model?

Steps

1. Install the latest llama.cpp following the GGUF model card, for example with brew install llama.cpp or a prebuilt release binary.
2. Start a server with llama-server -hf nvidia/NVIDIA-Nemotron-3.5-Bolt-74B-A9B-24GB-GGUF and wait for the download to finish.
3. Alternatively run it through Ollama with ollama run hf.co/nvidia/NVIDIA-Nemotron-3.5-Bolt-74B-A9B-24GB-GGUF.
4. Give it a small debugging task from your own repo and record tokens per second and GPU memory use.
5. Send one screenshot or chart from your own files to test vision input, which requires the mmproj file listed on the card when using llama-server with explicit files.

Small angles to try

• Compare speed and answers with a 30B class model you already run locally.
• Try the Super model in Ollama with ollama run nemotron-3.5-super if you have the hardware.
• Use the 28GB recipe on the GGUF card with its speculative draft model and compare throughput.

Key ideas

CodeQL

GitHub's static analysis engine that queries code as data to find vulnerability patterns in supported languages.

Advisory finding

A result shown on the PR for humans to review that does not change the check status or gate merging.

Agentic autofix

Copilot proposes a fix, verifies it by rerunning CodeQL, iterates if needed and opens a draft pull request.

Steps

1. Read the GitHub changelog entry for AI Scan for pull requests first, then the agentic autofix entry.
2. Open the GitHub docs page on AI powered security detections and note the requirements: code scanning enabled, the AI Scan setting on, no CodeQL default setup needed.
3. Note the access chain for autofix: an enterprise policy, then an org or repo setting, then a Copilot billing method.
4. Self check: a PR adds a shell script with an injection bug; will AI Scan flag it, and can that finding stop the merge?

Steps

1. Create a new public test repository under your own account.
2. In the repository settings, enable code scanning and turn on the "AI Scan for pull requests" toggle under Code scanning.
3. On a branch, add a small Bash script that builds a shell command from unsanitized input and a Dockerfile that runs as root, then open a pull request against your default branch.
4. Check the Conversation and Files changed tabs for findings marked with the AI indicator and read the explanation and any suggested fix.
5. Confirm the code scanning check still passes, showing the findings are advisory.

Small angles to try

• Add a Terraform file with an open security group and see if it is flagged.
• Open a PR from a fork to confirm AI Scan does not run there.
• On an Enterprise Cloud org, assign one CodeQL alert to Copilot and review the draft PR.

Key ideas

Proof assistant

Software such as Lean that checks every step of a formal proof mechanically, so a result does not rely on trusting its author.

AI assisted result

A theorem or proof produced partly by a language model, which still has to be verified by people or a checker.

Research norms

Shared community rules on disclosure, credit and verification for how a tool may be used in published work.

Steps

1. Read the Simons Foundation announcement first and list the four goals it funds.
2. Note what each partner contributes: the foundation awards funds, the labs supply tools and compute.
3. Skim the HN discussion for the main concerns raised about verification and credit.
4. Self check: why does a formal checker like Lean change how much you need to trust an AI generated proof, and what does it still not tell you?

Steps

1. Pick a small fact you can prove by hand, such as the sum of the first n odd numbers equals n squared.
2. Ask an AI assistant for a proof in plain language and, separately, a formal version for Lean.
3. Check the plain language proof line by line yourself and mark any step you cannot justify.
4. Run the formal version through your local proof checker and record whether it compiles and what errors appear.
5. Write down which errors the checker caught that your manual read missed, and the reverse.

Small angles to try

• Try the same with a code correctness claim and a unit test as the checker.
• Ask two different models and compare where their proofs diverge.
• Draft a one paragraph disclosure note for AI use, as a research norm would require.