Batch API vs Real-Time Calls: When Async Pays Off
Decide when the 50% batch API discount is worth a 24-hour window, match results by custom_id, recover expired and errored requests, and test it first.
pgvector HNSW Index: Tune Recall and Query Speed
Build a pgvector HNSW index, measure recall@10 against exact search, tune m, ef_construction and ef_search, and fix filtered queries with iterative scans.
Structured Outputs vs JSON Mode: Which One to Use
Pick JSON mode, schema Structured Outputs or strict tool use, see which schema keywords OpenAI and Claude reject, and keep the checks that still matter.
Long Context vs RAG: When to Skip Retrieval
Run one question set through a long-context prompt and a RAG pipeline, compare accuracy, cached cost and latency, then write your own decision rule.
Slopsquatting: Verify AI-Suggested Packages Before Install
Check every AI-suggested npm or PyPI package before install: existence, publish age, downloads, source repo and install scripts, plus a CI gate.
MCP vs Function Calling: When You Need an MCP Server
Decide between an in-process function and an MCP server by locating where execution, consent and authorization live.
PostgreSQL Row-Level Security for Multi-Tenant RAG
Build a PostgreSQL row-level security fixture for RAG: separate tenant roles, test unfiltered reads, and expose owner and BYPASSRLS traps.
Mutation Testing for AI-Generated Tests
Expose a covered boundary fault with a pinned StrykerJS experiment, then improve assertions and interpret the score.
Gitleaks Pre-Commit Hook: Block Secrets in AI Commits
Pin a Gitleaks pre-commit hook, scan staged changes, set a false-positive policy, catch bypassed hooks in CI and prove the block with a generated fake key.
Cosine Similarity Is Not an Answer Confidence Score
Compare false acceptance and rejection with labelled questions, choose a retrieval threshold and evaluate answer support separately.
RAG Document Deletion: Test Every Retrieval Path
Run a reproducible RAG deletion drill: inventory versioned chunks, clear cached context, contain a late ingestion write and keep a control document live.
RAG Reranking: When Better Ordering Improves Answers
Compare fixed candidate and context budgets, measure answer support, and reject reranking when latency or cost outweighs the gain.
RAG vs Fine-Tuning: Which One Your AI Feature Needs
Retrieval changes what the model knows; fine-tuning changes how it behaves. A decision order for 2026, when vendor fine-tuning is shrinking.
LLM-as-a-Judge: Detect Position Bias in Your Evals
Separate judging instability from answer-order sensitivity with fixed answer IDs, repeated AB/BA comparisons and manual review.
GPT-5.4-Cyber Shutdown: Check Your API Calls Today
Find exact model calls, test a replacement your account can access, and decide how to switch or pause each affected route.
OpenAI Webhook Signature Verification: Test the Receiver
Verify an OpenAI webhook against its raw body, reject a changed payload, and deduplicate delivery by webhook ID with an observable local test.
Embedding Model Migration: Reindex Without Losing Recall
Build a parallel vector index, compare recall on labelled queries, switch a small traffic slice and rehearse rollback.
LLM Load Testing with k6: Find Your App's Capacity
Measure your AI app against a controllable model mock, with constant arrival rates, p95 latency, error budgets and dropped iterations.
Sandbox an AI Coding Agent in a Dev Container: Three Escape Tests With an Answer Key
Run Claude Code in a dev container with no host secrets, a network allowlist and a non-root user, then prove it with three escape tests and an answer key.
GitHub Enterprise Adds Proof of Presence for High-Impact Actions: Plan Your Re-authentication Policy
Check whether GitHub proof of presence covers your enterprise, choose re-authentication or MFA, and plan for the two-hour window and announced merge checks.
GitHub Copilot App Adds Local Sandboxing: Verify Files, Network and Credentials
Run a local Copilot sandbox acceptance matrix for file access, network restrictions, credentials, and policy changes across active and new sessions.
Observe GitHub Copilot Agent Sessions with OpenTelemetry Without Leaking Prompts
Stage Copilot telemetry to a test collector, verify agent and tool spans, keep content capture locked off, and prove rollback.
GitHub Enterprise Credential Inventory: Turn the Export Into an Incident Triage Runbook
Normalize GitHub's read-only credential inventory, correlate supported audit evidence, and route scoped remediation with rollback ownership.
OpenAI Adds API Key Creation Controls: Block Human-Owned Keys Without Breaking Existing Credentials
Inventory OpenAI API keys, prove organization and project precedence, and decide how to migrate every existing credential.
npm Stage-Only Tokens Are Here: Move Token-Based Publishing to Staged Releases Before January 2027
Inventory every npm publish token, run one stage-and-approve test, and decide per package between OIDC, a stage-only token, or retirement.
GitHub Actions Execution Protections Are GA: Audit pull_request_target Before November 2
Inventory affected workflows, inspect evaluate-mode results, and prove whether to remove, replace, or narrowly allow each trigger.
GitHub Rewrote the Copilot Runtime in Rust: Copy the Migration Proof, Not the Line Count
Plan one bounded runtime-migration pilot with stable tests, explicit shims, staged exposure, and a measured stop/go decision.
Enforce GitHub Advanced Security Ownership Before Delegating Administration
Run a role-based before-and-after test to prove which GitHub administrators can override an enterprise security configuration.
Run a Harness Boundary Test Before Moving to OpenAI's Agents API
Run one portable fixture through your current harness and OpenAI's hosted path, then compare output, tools, context, latency, and cost evidence.
Copilot Code Review Now Resolves Its Own Comments: Check What Your Conversation-Resolution Rule Still Proves
Run a partial-fix check on Copilot auto-resolution and decide which finding classes still need a human-owned signal before merge.
VS Code Agent Usage Metrics Are Not Productivity Metrics: Build a Dashboard That Says What It Measures
Build a null-safe metric dictionary and separate dedicated VS Code Agents-window adoption signals from delivery and quality outcomes.
GitHub Actions cache-mode: Stop Low-Trust Workflows From Poisoning the Cache Your AI Pipeline Trusts
Map the effective GitHub Actions cache-mode per trigger and job, then prove a low-trust run cannot save and an over-requesting reusable workflow fails validation.
GitHub Copilot Agent Permissions: Test Enterprise Policy Before Auto-Approval
Prove one denied, one approval-required, and one allowed Copilot agent operation, then verify that local auto-approval cannot weaken the enterprise policy.
OpenAI Reports 3.1 Agent-Workdays per Researcher-Day: Read the Metric Before Copying the Workflow
Separate agent runtime, concurrency, completed tasks, human interventions, verified outputs, and bottlenecks before claiming coding-agent productivity.
Where should I start?
Your AI Eval Agent Found the Answer Key: Isolate Fixtures Before Trusting the Score
Separate task inputs from grader-only fixtures, create disposable agent workspaces, and test answer-key leakage with a synthetic marker and a positive control.
Run Cursor Cloud Agents in Vercel Sandbox: Verify the Isolation Boundary
Test claim ownership, retry deduplication, credential scope, concurrency limits, timeouts, cleanup, and recovery before running Cursor agents in production.
GitHub Actions Exposes Reusable Workflow Identity: Trace the Checks Behind an AI Pull Request
Compare caller and reusable workflow revisions in a disposable CI fixture, then record the implementation SHA alongside the completed check result.
npm Adds Multiple Trusted Publishers: Audit Every Route an AI Release Agent Can Use
Audit additive npm OIDC permissions across stable, prerelease and staging workflows, then test human approval boundaries with a separate package.
GPT-6 Astra Reaches the API: Build a Capability Gate Before Model Migration
Clone one representative request into a canary that tests Astra's API delta, output contract, tool behavior, latency, token cost, failure path, and rollback.
Copilot Content Exclusions Reach the App and CLI: Prove Secrets Stay Out of Agent Context
Use harmless canaries to verify repository and organization exclusions in both clients, then keep documented gaps outside the trust claim.
Copilot Can Approve Pull Requests: Prove the Review Is Independent Before It Counts
Run four controlled pull requests to prove path scope, dismissal after a new commit, and a separate merge gate before Copilot approval counts.
OpenAI mTLS and X.509 Workload Identity Are GA: Test the Two-Credential Boundary
Activate certificate trust safely, then prove bearer lifetime, mTLS admission, mapping, permissions, and root rotation fail and recover independently.
OpenAI's Hugging Face Incident: Test the Agent Containment Boundary
Verify brokered egress, artifact and credential isolation, cross-run separation, independent detection, and an emergency stop with a harmless two-run exercise.
Anthropic Adds Personal and Service-Account API Keys: Build the Offboarding Test
Map every Claude API key to an identity and workspace, migrate a production workload without a flag day, and prove offboarding removes only the intended access.
Persisted Reasoning Across API Turns: Test What the Model Actually Reuses
Verify the effective reasoning context, compare two-turn outcomes, replay complete stateless history, and stop incompatible model-family handoffs.
Version Tool Schemas Without Breaking In-Flight Agent Runs
Pin every durable run to an immutable tool contract, adapt old calls into one domain command, replay real checkpoints, and retire v1 only after its dependency count reaches zero.
A 200 Response Is Not a Complete Response: Test Truncated Structured Outputs
Check generation state before parsing, force max-output-token exhaustion in a contract test, and prove that partial model data cannot reach a side effect.
OpenAI GPT-5.6 on Amazon Bedrock: Choose the Inference Profile Before You Route
Choose the global or US cross-Region inference profile as a processing policy, authorize its complete route, and verify the actual destination Region in CloudTrail.
OpenAI Regional Processing Per Request: Route One Call to the EU
One Global-project API key can now select global, US, or EU processing per request. The base-URL change, eligibility gates, support matrix, and negative tests to add before rollout.
Computer Use Goes GA — and the Browser Toolset That Reads the Page Instead
The GA toolset rejects five parameters the beta tool accepted, and coordinates move into the screenshot you return. Plus when to address elements by reference instead of by pixel.
Anthropic Python SDK 1.0: The Migration That Removes temperature, top_p, and top_k
Version 1.0 raises the Python floor to 3.10 and swaps httpx for httpx2. Apply the five breaking changes in order, and check your mocks before you trust a green test run.
Private Claude Code Plugin Marketplaces: Short-Lived Auth with headersHelper
Claude Code 2.1.238 can mint HTTP headers for private URL marketplaces and plugin archives. Choose catalog or entry scope, preserve confirmation, and test every fetch path.
The Claude API Beta Headers That Just Went GA: What Removing Them Changes
Files, Skills, and Enterprise user management are GA on the Claude API. Two of the three beta headers are free to delete; the third quietly changes the shape of every GET /v1/files response.
Resume an Agent Run After a Crash: Checkpoints, Durable State, and Safe Replay
A dead run should restart at the step it reached, not at step one. The checkpoint record, the three replay classes, commit order around external effects, and the kill test that proves it works.
OpenAI's Assistants API Shuts Down August 26: The Migration Checklist
Assistants, threads, and runs map onto the Responses and Conversations APIs. Where the retention floor moves, why the recommended prompt-object step shuts down 96 days later, and what to export before the endpoint stops answering.
Claude Code's Subagent Forking Default: What Changes for Your Multi-Agent Setup
Claude Code 2.1.232 makes a subagent_type "fork" subagent inherit the full parent conversation and prompt cache by default. Where the cost assumption moved, where context can leak between subagents, and what to check in an existing config.
Prompt Cache Hit Rate: Why Your Cached Prompt Isn't Caching
The provider caches a prefix, and it fails without an error. Where the invalidator hides in prompt assembly, where breakpoints belong, and how to read the answer out of the usage fields.
Your Local Claude Code Sessions Are Now Retrievable by Your Organization
Three Compliance API endpoints, in beta for Claude Enterprise organizations, return transcripts of Cowork and Claude Code sessions run on users' own machines. What lands in the transcript, who can pull it, and what to change locally.
Imagen 4 Shuts Down August 17: Migrate the Model ID Without Breaking Image Output
Three Imagen 4 endpoints are scheduled to shut down. Replace the request and response contract, then prove bytes, MIME type, dimensions, failures, and visual acceptance before cutover.
Caching AI Responses Without Serving the Wrong Answer: Keys, TTLs, and Tenant Isolation
Put every input the answer depended on into the cache key, replace TTL with a version component for derived answers, and prove isolation with a probe that exits non-zero on a leak.
Agent Trace Observability: What to Log So a Failed AI Agent Run Is Debuggable
Emit one span per operation, propagate a single trace id, record the provider's request id, keep content capture opt-in, and prove it with a four-question drill.
Secure MCP Server Authorization: Prevent Confused-Deputy Tool Calls
Bind tokens to the intended MCP resource, keep upstream credentials separate, require per-client consent, and prove the boundary with hostile credential tests.
Idempotent Tool Calls for AI Agents: Prevent Duplicate Side Effects
Design idempotent AI-agent tool calls that stay safe under timeouts, retries, and duplicate delivery, with a persistent operation record and failure tests.
Zero Trust Architecture for Autonomous AI Agents
Allowing AI agents autonomous access to production data is a security risk without strict isolation. Learn how to design a zero trust architecture for your agentic workflows.
Setting Up Local AI Models for CI/CD Pipelines: Cost and Privacy Benefits
Relying on cloud APIs for AI support in CI/CD is expensive and leaks code. Learn how to run local models in your pipelines for testing and static analysis.
Modeling AI Infrastructure Costs: Tokens, Storage, and Observability
When developers budget for an AI feature, they usually count the tokens and stop there. Build a technical cost model that includes vector databases, tracing, and orchestration.
The AI Feature Flag Rollout Plan: Ship AI-Written Changes Behind a Toggle
Approval decides what an AI agent may change. A flag decides who actually sees it: percentage rollout, a fast kill path, and flag hygiene so flags never become permanent technical debt.
AI Agent Rollback Plans: Approval Gates That Keep Production Recoverable
A practical approval gate for production agents: define the action boundary, require reviewable evidence, bind the decision to a small scope, and plan recovery before execution.
Reliable AI API Calls: Timeouts, Retries, Rate Limits, and Fallbacks
Turn model calls into bounded production workflows with one deadline, classified failures, safe retries, concurrency limits, idempotent side effects, tested fallbacks, and end-to-end observability.
Adding Teams and Permissions to Your Vibe Coded App
Turn a personal vibe coded app into a shared workspace with explicit data boundaries. Model memberships and roles, enforce permissions where data is accessed, and test cross-team isolation.
The AI Queue & Background Job Migration Plan: Moving Heavy Work Safely
A 5-step plan for migrating synchronous HTTP workloads to asynchronous queues and background workers with AI — covering payload isolation, idempotency keys, DLQs, polling, and backpressure.
Adding Backups to Your Vibe Coded App
Rolling back a deploy restores your code, not your data. How to back up a vibe coded app's database and uploaded files, keep one copy off the platform, and test a restore before you need it.
The AI Performance Fix Plan: Measure Before You Let AI Optimize
A safer AI-assisted workflow for performance work: baseline on realistic data, locate the bottleneck with a profiler or explain plan, set a target and a price, change one thing, and re-measure identically.
Conversation Memory for AI Apps: State, Summarization, and Privacy
Build memory as governed application data: separate working context from durable facts, compact long threads, preserve provenance, isolate tenants, propagate deletion, and test both recall and forgetting.
AI Guardrails for Developers: Prompt Injection, Tool Safety, and Output Validation
Build AI features that remain safe when prompts, retrieved documents, and model outputs are untrusted. Put permissions, tool validation, approvals, and output checks in code.
Claude Opus 5 Keeps the Price and Changes the Bill
Opus 5 shipped July 24 at Opus 4.8's exact list price. Underneath it, thinking is on by default, the effort dial is the main cost control, and two prompt-cache rules moved in opposite directions.
Retrieval and RAG for Developers: Grounding AI Answers in Your Own Data
Most RAG failures are retrieval failures, not model failures. Diagnose where the pipeline breaks, chunk on document structure, choose an index, measure recall with a gold set, cite sources, and filter by permission.
Adding Form Validation and Error Messages to Your Vibe Coded App
Add client-side and server-side input validation to a vibe coded app, with accessible error messages, direct endpoint tests, and explicit rules.
Adding Email and Notifications to Your Vibe Coded App
Send password resets, receipts, and alerts the safe way. Use a hosted email API, keep your keys server-side, authenticate your domain, and never email the wrong person.
Adding File Uploads to Your Vibe Coded App
Add photo and file uploads without writing files to your own server. Use hosted storage, validate what you actually received, and keep private files private.
The AI File Storage Migration Plan: Move Uploads Without Breaking Links
A safer AI-assisted workflow for moving uploads: inventory the full storage contract, copy with evidence, preserve access rules, reconcile live changes, and retire the old path deliberately.
Adding User Accounts to Your Vibe Coded App
Add login to a vibe coded app without building your own password system. Use hosted auth, enforce per-user access, and test the full account flow before launch.
Migrate an Existing Background-Job Queue Without Losing Work
A safer AI-assisted workflow for queue changes: map stored work, prove producer-worker compatibility, preserve idempotency, drain deliberately, and retire the old path with evidence.
Adding Payments to Your Vibe Coded App
Payments are the one feature where an AI mistake costs real money. How to use hosted checkout safely, what to check in AI-generated payment code, and why webhooks matter more than the success page.
Microsoft's CLI Agent Rollout: 24% More Merged PRs, With a Catch
A new field study of Microsoft's early-2026 rollout of Claude Code and GitHub Copilot CLI found roughly 24% more merged PRs among adopters, while showing why teams need better rollout metrics than raw output.
AI Observability: Logging, Tracing, and Monitoring AI Features in Production
Instrument AI features so you can explain what happened: structured logging without leaking secrets, OpenTelemetry tracing for agent pipelines, cost and drift metrics, and incident response dashboards.
The AI Authentication Migration Plan: Change Login Without Locking Users Out
A safer AI-assisted workflow for auth changes: map the trust boundary, prove session and credential compatibility, stage rollout, and retire the old path with evidence.
The AI API Contract Change Plan: Evolve Endpoints Without Breaking Clients
A safer AI-assisted workflow for API changes: map consumers, prove old/new compatibility, stage an additive rollout, and retire the old contract with evidence.
The AI Database Migration Plan: Change Schemas Without Guessing
A safer AI-assisted workflow for schema changes: map compatibility, stage expand-backfill-switch-contract, prove data invariants, and plan recovery.
The AI Dependency Upgrade Plan: Update Packages Without Guessing
A safer AI-assisted workflow for package upgrades: verify the version delta, map affected code, isolate the diff, define proof, and plan rollback.
GPT-5.6 Goes GA: The Locked Preview Opens Two Weeks Later
OpenAI made GPT-5.6 Sol, Terra, and Luna generally available on July 9, 2026, after a 13-day limited preview. GA pricing, ultra mode with four parallel agents, and programmatic tool calling in the Responses API.
The Intro-Pricing Trap: Budgeting AI Features on Promotional Prices
Promotional model pricing expires on a known date. Four guardrails: budget at list price, tag price-expiry dates, alert on unit cost, and pre-plan the downgrade.
AI Merge Readiness Checklist: 10 Questions Before You Approve
A practical pre-merge checklist for AI-assisted pull requests: 10 questions covering scope, tests, risk, rollout, and rollback before approval.
25 AI Code Review Comments That Actually Improve Diffs
25 copy-ready code review comments for AI-assisted diffs, grouped by correctness, security, tests, scope, and rollback — precise, not vague.
AI Regression Test Plan Template
A copy-paste template for scoping regression tests around an AI-assisted change: what could break, which suites to run, and what to check by hand.
The AI Verification Ladder: Confidence Levels Before Merge
A practical way to match AI change risk to the right depth of validation, using five confidence levels before merge.
Model Fallback Runbook Template: The First 30 Minutes
A minute-by-minute runbook for the first 30 minutes of an AI provider outage: who acts, what to check, and when to declare the incident stable.
AI PR Review Checklist Template for Engineering Teams
A copy-paste PR template that standardizes how your whole team reviews AI-assisted pull requests, so review quality doesn't depend on who's on call.
The AI Decision Log: Stop Re-Debating the Same Change
A practical way to keep AI coding work consistent across sessions: log key decisions, rationale, constraints, and checks so the next prompt starts from truth instead of guesswork.
AI Change Risk Matrix: Scope, Tests, Rollback Before Merge
A practical matrix for deciding how risky an AI-generated change is before merge, with scope, test depth, review evidence, and rollback requirements.
Run a Model Fallback Drill Before You Need One
A practical workflow for testing AI model fallback before an outage: trigger conditions, quality gates, rollback rules, and the one-page drill your team should run each month.
15 Acceptance Criteria Examples for AI Coding Tasks
Copy-ready acceptance criteria examples for AI coding tasks: UI, API, data, auth, tests, refactors, migrations, and rollback.
Writing the Context File: AGENTS.md and CLAUDE.md Done Right
What belongs in an AI agent's context file and what doesn't: commands, architecture, conventions, and boundaries — plus how to keep it short, true, and maintained like code.
The AI Acceptance Criteria Prompt: Define Done Before the Diff
A practical way to define acceptance criteria before AI writes code, so reviews are based on clear pass/fail outcomes instead of opinions.
GPT-5.6 Sol Launches in a Locked Preview: The Best Coding Model You Can't Use Yet
OpenAI previewed GPT-5.6 Sol on June 26, 2026 — a new state of the art on Terminal-Bench 2.1, with an ultra mode that runs subagents. But access is limited to a small set of partners after the U.S. government reviewed the launch.
Running AI Agents in Parallel
A practical method for running two or three coding agents at once without losing control: task isolation, branch hygiene, one reviewer, and when parallel actually slows you down.
Windsurf Is Now Devin Desktop: What Changes Before Cascade's July Cutoff
Cognition retired the Windsurf brand on June 2, 2026, relaunching it as Devin Desktop with an Agent Command Center and ACP support. Cascade, Windsurf's local agent, remains available through July 2026.
The AI Session Resume Packet
A practical way to make AI coding sessions resumable: capture goal, current state, decisions, changed files, open risks, validation, and the next prompt.
The AI Bug Report That Actually Helps
A practical structure for AI bug reports: observed behavior, expected behavior, reproduction path, relevant context, evidence, and fix boundaries.
Why Your AI Bill Got Expensive
Free tiers run out, credits disappear faster than expected, and some tools now meter usage by the token. Why AI costs spike for vibe coders, and how to keep control of what you spend.
Claude Fable 5's Free Window Ends While Access Is Still Suspended
Fable 5's no-extra-cost subscription window ended June 22. As of June 28, Anthropic's access statement still says Fable 5 and Mythos 5 were removed from all users while access is restored.
When Your AI Model Gets Pulled: Building for Model Availability Risk
A practical framework for AI model availability risk: why models get pulled, deprecated, or restricted, and how to build features that survive losing one.
The AI Plan Before Code: Stop Letting AI Start in the Middle
A practical workflow for asking AI to plan before it edits: define intent, constraints, risks, validation, and rollback before accepting code changes.
OpenCode Crosses 160,000 Stars: Inside the Model-Agnostic CLI Agent
The open-source terminal agent OpenCode crossed 160K+ GitHub stars and 7.5M monthly active developers, with support for 75+ model providers and a fast release cadence (v1.16.0 in early June, v1.17.x soon after) — what its provider-agnostic, BYOK approach means for your CLI workflow.
The AI Change Budget: How Much Should You Let AI Edit at Once?
A practical framework for deciding how large an AI-generated change can be before reviewability, tests, rollback, and production risk say to split it.
Why Small Diffs Win With AI
Broad rewrite prompts feel fast, but small diffs plus tight validation loops usually produce better AI-assisted code with less cleanup.
The AI Code Ownership Checklist: Before You Merge
A practical merge checklist for AI-generated code: behavior, tests, contracts, edge cases, security, and observability.
Claude Opus 4.8 Reaches 88.6% on SWE-bench Verified
Anthropic's latest Opus release reports an 88.6% SWE-bench Verified score, with stronger agentic coding behavior, dynamic workflows, and better uncertainty signaling.
The True Cost of Context: Why Context Dumping is an Anti-Pattern
Large context windows make it easy to include everything, but more context is not always better. Why targeted context curation improves quality, speed, and cost when coding with AI.
How to Hand Off a Vibe-Coded App to a Developer
You built a working app with AI. Now a developer needs to stabilize it, review it, or take it further. Learn what to prepare, what to document, and how to make the handoff useful instead of expensive chaos.
Codex in Production: Self-Improving Agents and Eval Loops
OpenAI's latest engineering case study shows a concrete production pattern: expert feedback becomes traces, traces become eval targets, and Codex helps ship bounded improvements with human review.
Multi-Agent Systems and Tool Use for Developers
Build reliable agent pipelines: tool use patterns, orchestrator–subagent coordination, parallel execution with concurrency limits, loop termination guards, tool input validation, and error recovery.
Streaming AI Responses: SSE, Real-Time UI, and Production Patterns
Stream AI responses end-to-end: Anthropic SDK streaming, passing SSE through a Node.js/Express backend, consuming streams in React, abort handling, WebSockets vs SSE, and streaming with tool use.
How to Read AI-Generated Code When You Don't Fully Understand It
Your app works, but what did AI actually build? Learn how to map the files, understand the user flow, spot risky code, and ask better follow-up questions before you deploy or expand your project.
Claude Opus 4.8: 1M Context, Adaptive Thinking, Dreaming Agents
What actually changed in Claude Opus 4.8 for developers. 1M token context is now default. Adaptive thinking cuts wasted reasoning tokens. Dreaming gives agents persistent memory between sessions.
Local and Private AI Models for Developers
When code genuinely can't leave your machine: Ollama, LM Studio, Jan, and which models are worth running. Covers NDA and air-gapped use cases, VS Code integration via Continue, and private cloud as a middle option.
AI Cost Modeling: Tokens, Model Selection, and Budget Control
Token costs are predictable if you model them before you ship. Covers Haiku vs Sonnet vs Opus selection, prompt caching, max_tokens control, pre-ship cost estimation, usage logging, and spending alerts.
Sanitizing Code and Data Before Sending to AI
What to scrub before using cloud AI: credentials, PII, business logic, customer data, and logs. Includes automated scanning with TruffleHog and Gitleaks, a sed log-scrubbing script, and guidance on when to switch to a local model.
Case Study: Refactoring Legacy Authentication with AI
A concrete example of using AI to modernize an undocumented legacy authentication controller. From the initial messy state to a clean, tested, and validated result.
The Multi-Agent Coding Stack: Cursor, Claude Code, Codex
The era of one AI coding tool is over. Many senior developers now run 2–3 tools in parallel. Cursor 3.2 ships /multitask for parallel subagents. Zed 1.0 adds the Agent Client Protocol.
Google I/O 2026: The Developer Edition
Everything from Google I/O that actually matters for developers: Gemini 3.5 Flash, Antigravity 2.0 subagents, the Managed Agents API, WebMCP, and Android CLI 1.0 — stripped of the keynote hype.
AI Code Review: From Diff to Production Confidence
Use AI to review your own code before opening a PR, catch regression risks, spot security issues, generate test ideas, and write better review comments. A structured workflow for every stage of review.
How to Fix a Broken Vibe Coded App
Your app almost works but something is wrong and AI keeps making it worse. A concrete guide to diagnosing and fixing bugs, broken state, auth issues, and deploy problems.
Why AI Code Feels Fast But Fragile
AI-generated code can make the first hour feel magical, then become brittle when edge cases, tests, integration, and maintenance arrive. Here's how to keep the speed without losing the structure.
AI Evals in Production
Keep AI quality stable in real systems. Build eval datasets, run prompt regression in CI, add release quality gates, and monitor drift after deploy.
Which Vibe Coding Tool Should You Use?
Claude, Bolt, Lovable, Replit, or v0 — they all let you build with AI, but they're designed for different things. A practical breakdown of each tool, what it's best for, and how to choose the right one for your project.
Should This Feature Use AI?
A practical decision framework for when AI belongs in a product feature, when ordinary code is better, and how to keep probabilistic systems away from decisions that need deterministic control.
Building AI-Powered Products with Claude API
For developers building products on top of Claude. System prompt design, context management, prompt caching, cost optimization, streaming, and tool use — with real working code for every pattern.
Debugging with AI
The investigation workflow for debugging with AI — reading error messages, interpreting stack traces, bisecting problems, and knowing when to give AI more context vs. start fresh. Plus a copy-paste prompt library for every bug category.
Prompt Engineering for Python
Concrete AI prompts for Python development. Pydantic-first prompting, FastAPI endpoints, SQLAlchemy async patterns, pytest, and Django — with a copy-paste prompt library for every common scenario.
Growing Your Vibe Coded App
Your app is live and people are using it. How do you add features without breaking things, store real user data, respond to feedback, and handle it when something breaks on live?
AI-Assisted CI/CD
Use AI to write GitHub Actions workflows, generate production Dockerfiles, automate code review in CI, and build deployment pipelines — with real working examples for every stage.
Working with AI in a Team
You're a developer on a team that uses AI. This guide covers how to participate — contributing to shared context files, self-reviewing before PRs, using the team prompt library, and onboarding into an AI-augmented codebase.
When Vibe Coding Isn't Enough
An honest guide to recognizing when your project has outgrown AI-only building — and how to find and talk to a developer when you don't know code.
AI for Technical Leads & Architects
You lead a team that uses AI. This guide covers the decisions above the keyboard — defining the shared context file, setting the PR review process, building the organizational prompt library, and using AI for architecture decisions.
Deploying Your Vibe Coded App
Your app works in the preview. Now put it on the internet. Step-by-step deployment for HTML files, Bolt, Replit, Lovable, and v0 — plus custom domains, data storage, and what surprises people after going live.
AI-Assisted Database Design
Design schemas, write safe migrations, optimize slow queries, and evolve a live database — with AI as your design partner. From first ERD to production, with real prompts at every step.
Testing with AI
Write better tests faster. Unit tests, integration tests, TDD workflows, mocking patterns, and edge case generation — with real prompts for every scenario and framework.
AI Prompt Library
50+ ready-to-use prompts for debugging, code review, testing, refactoring, documentation, security auditing, and more. Searchable, filterable, copy-paste ready.
How This Site Was Built: A Developer and AI, Start to Finish
The full story of building aiprogrammingmanual.com — one developer and Claude, over 6 weeks. What worked, what went wrong, and what I'd do differently.
A Day of Vibe Coding: Building a Real App
Follow along as we build a movie watchlist app in one afternoon. Every prompt, every revision, every bug — from first idea at 1 PM to working app at 4 PM.
How AI APIs Work (And Why You're Already Using Them)
Every time you use Claude or ChatGPT, an API is doing the work behind the scenes. What's actually happening, how tokens and pricing work, and why this one concept explains the entire AI tool landscape.
Where Vibe Coding Is Actually Going
Vibe coding is moving toward agent supervision and multi-tool workflows, but product judgment, review, security, and maintenance still decide what survives.
7 Vibe Coding Mistakes That Waste Your Time
The traps that turn a fun afternoon into hours of frustration. Real scenarios, practical fixes — from describing too much at once to going in circles instead of starting fresh.
How to Start Building With AI
A step-by-step learning path from your first AI conversation to building real apps. No programming experience needed — just curiosity and something you want to build.
How AI Models Are Trained: What's Actually Happening
The training process behind Claude, ChatGPT, and other AI tools — explained in plain language. Why AI hallucinates, why it writes outdated code, and why context improves results so dramatically.
Vibe Coding: The Practical Guide
How to build real software by describing what you want to AI. Tools, techniques, common traps, and how to tell when something is actually working vs just looking like it works.
How AI Programming Is Different From Traditional Development
Deterministic code vs probabilistic systems, writing rules vs providing data, and why debugging AI feels completely different. What changes when you move from traditional software to AI-assisted development.
Build a REST API from Spec to Deployment
Design, build, test, and deploy a complete bookmark manager API. From OpenAPI spec through Express, TypeScript, integration tests, Docker, and production deployment.
Prompt Engineering for TypeScript/React
Concrete prompts for TypeScript and React development. Type-first prompting, component patterns, state management, API routes, and a copy-paste prompt library.
AI-Assisted Dev with VS Code & Cursor
Practical setup and workflow guide for AI-assisted editors. Configuration, keyboard shortcuts, project rules files, and the editing habits that actually make you faster.
Migrating a Legacy Codebase with AI
A five-phase approach to understanding, testing, and modernizing legacy code with AI. From comprehension through validation — one module at a time, never breaking what works.
CLI-First AI Development
AI-assisted development from the terminal. Claude Code, Aider, shell patterns, tmux workflows, and automation scripts for developers who live in the command line.
The Senior Developer's Guide to Not Fighting AI
You've spent years building real expertise. AI feels like it cheapens all of that. This guide addresses eight specific resistances honestly — and shows a pragmatic path forward.
When AI Gets It Wrong: A Field Guide
An honest catalog of nine ways AI-generated code fails — with real examples, real fixes, and a practical checklist for catching every category of error before it ships.
Build a Full-Stack App with AI in a Weekend
Put the methodology into practice in this illustrated tutorial. Follow the process of building Taskflow — a complete task management app — in one weekend, AI-first. Features example prompts, architectural decisions, and AI responses.
AI Developer Tools: A Practical Guide
The complete landscape of AI development tools — chat interfaces, editor integrations, CLI tools, and APIs. What to use, when to use it, and how to set up your stack.
The Complete Guide to AI-Assisted Development
A 20-chapter path from first prompts to planning, review, testing, security, and maintainable AI-assisted workflows.
pgvector HNSW Index: Tune Recall and Query Speed
Build a pgvector HNSW index, measure recall@10 against exact search, tune m, ef_construction and ef_search, and fix filtered queries with iterative scans.
Slopsquatting: Verify AI-Suggested Packages Before Install
Check every AI-suggested npm or PyPI package before install: existence, publish age, downloads, source repo and install scripts, plus a CI gate.
PostgreSQL Row-Level Security for Multi-Tenant RAG
Build a PostgreSQL row-level security fixture for RAG: separate tenant roles, test unfiltered reads, and expose owner and BYPASSRLS traps.
Gitleaks Pre-Commit Hook: Block Secrets in AI Commits
Pin a Gitleaks pre-commit hook, scan staged changes, set a false-positive policy, catch bypassed hooks in CI and prove the block with a generated fake key.
RAG Document Deletion: Test Every Retrieval Path
Run a reproducible RAG deletion drill: inventory versioned chunks, clear cached context, contain a late ingestion write and keep a control document live.
OpenAI Webhook Signature Verification: Test the Receiver
Verify an OpenAI webhook against its raw body, reject a changed payload, and deduplicate delivery by webhook ID with an observable local test.
Embedding Model Migration: Reindex Without Losing Recall
Build a parallel vector index, compare recall on labelled queries, switch a small traffic slice and rehearse rollback.
LLM Load Testing with k6: Find Your App's Capacity
Measure your AI app against a controllable model mock, with constant arrival rates, p95 latency, error budgets and dropped iterations.
Sandbox an AI Coding Agent in a Dev Container: Three Escape Tests With an Answer Key
Run Claude Code in a dev container with no host secrets, a network allowlist and a non-root user, then prove it with three escape tests and an answer key.
Reliable AI API Calls: Timeouts, Retries, Rate Limits, and Fallbacks
Turn model calls into bounded production workflows with one deadline, classified failures, safe retries, concurrency limits, idempotent side effects, tested fallbacks, and end-to-end observability.
Conversation Memory for AI Apps: State, Summarization, and Privacy
Build memory as governed application data: separate working context from durable facts, compact long threads, preserve provenance, isolate tenants, propagate deletion, and test both recall and forgetting.
AI Guardrails for Developers: Prompt Injection, Tool Safety, and Output Validation
Build AI features that remain safe when prompts, retrieved documents, and model outputs are untrusted. Put permissions, tool validation, approvals, and output checks in code.
Retrieval and RAG for Developers: Grounding AI Answers in Your Own Data
Most RAG failures are retrieval failures, not model failures. Diagnose where the pipeline breaks, chunk on document structure, choose an index, measure recall with a gold set, cite sources, and filter by permission.
AI Observability: Logging, Tracing, and Monitoring AI Features in Production
Instrument AI features so you can explain what happened: structured logging without leaking secrets, OpenTelemetry tracing for agent pipelines, cost and drift metrics, and incident response dashboards.
Multi-Agent Systems and Tool Use for Developers
Build reliable agent pipelines: tool use patterns, orchestrator–subagent coordination, parallel execution with concurrency limits, loop termination guards, tool input validation, and error recovery.
Streaming AI Responses: SSE, Real-Time UI, and Production Patterns
Stream AI responses end-to-end: Anthropic SDK streaming, passing SSE through a Node.js/Express backend, consuming streams in React, abort handling, WebSockets vs SSE, and streaming with tool use.
Local and Private AI Models for Developers
When code genuinely can't leave your machine: Ollama, LM Studio, Jan, and which models are worth running. Covers NDA and air-gapped use cases, VS Code integration via Continue, and private cloud as a middle option.
AI Cost Modeling: Tokens, Model Selection, and Budget Control
Token costs are predictable if you model them before you ship. Covers Haiku vs Sonnet vs Opus selection, prompt caching, max_tokens control, pre-ship cost estimation, usage logging, and spending alerts.
Sanitizing Code and Data Before Sending to AI
What to scrub before using cloud AI: credentials, PII, business logic, customer data, and logs. Includes automated scanning with TruffleHog and Gitleaks, a sed log-scrubbing script, and guidance on when to switch to a local model.
AI Code Review: From Diff to Production Confidence
Use AI to review your own code before opening a PR, catch regression risks, spot security issues, generate test ideas, and write better review comments. A structured workflow for every stage of review.
AI Evals in Production
Keep AI quality stable in real systems. Build eval datasets, run prompt regression in CI, add release quality gates, and monitor drift after deploy.
Building AI-Powered Products with Claude API
For developers building products on top of Claude. System prompt design, context management, prompt caching, cost optimization, streaming, and tool use — with real working code for every pattern.
Debugging with AI
The investigation workflow for debugging with AI — reading error messages, interpreting stack traces, bisecting problems, and knowing when to give AI more context vs. start fresh. Plus a copy-paste prompt library for every bug category.
Prompt Engineering for Python
Concrete AI prompts for Python development. Pydantic-first prompting, FastAPI endpoints, SQLAlchemy async patterns, pytest, and Django — with a copy-paste prompt library for every common scenario.
AI-Assisted CI/CD
Use AI to write GitHub Actions workflows, generate production Dockerfiles, automate code review in CI, and build deployment pipelines — with real working examples for every stage.
Working with AI in a Team
You're a developer on a team that uses AI. This guide covers how to participate — contributing to shared context files, self-reviewing before PRs, using the team prompt library, and onboarding into an AI-augmented codebase.
AI for Technical Leads & Architects
You lead a team that uses AI. This guide covers the decisions above the keyboard — defining the shared context file, setting the PR review process, building the organizational prompt library, and using AI for architecture decisions.
AI-Assisted Database Design
Design schemas, write safe migrations, optimize slow queries, and evolve a live database — with AI as your design partner. From first ERD to production, with real prompts at every step.
Testing with AI
Write better tests faster. Unit tests, integration tests, TDD workflows, mocking patterns, and edge case generation — with real prompts for every scenario and framework.
AI Prompt Library
50+ ready-to-use prompts for debugging, code review, testing, refactoring, documentation, security auditing, and more. Searchable, filterable, copy-paste ready.
Build a REST API from Spec to Deployment
Design, build, test, and deploy a complete bookmark manager API. From OpenAPI spec through Express, TypeScript, integration tests, Docker, and production deployment.
Prompt Engineering for TypeScript/React
Concrete prompts for TypeScript and React development. Type-first prompting, component patterns, state management, API routes, and a copy-paste prompt library.
AI-Assisted Dev with VS Code & Cursor
Practical setup and workflow guide for AI-assisted editors. Configuration, keyboard shortcuts, project rules files, and the editing habits that actually make you faster.
Migrating a Legacy Codebase with AI
A five-phase approach to understanding, testing, and modernizing legacy code with AI. From comprehension through validation — one module at a time, never breaking what works.
CLI-First AI Development
AI-assisted development from the terminal. Claude Code, Aider, shell patterns, tmux workflows, and automation scripts for developers who live in the command line.
The Senior Developer's Guide to Not Fighting AI
You've spent years building real expertise. AI feels like it cheapens all of that. This guide addresses eight specific resistances honestly — and shows a pragmatic path forward.
When AI Gets It Wrong: A Field Guide
An honest catalog of nine ways AI-generated code fails — with real examples, real fixes, and a practical checklist for catching every category of error before it ships.
Build a Full-Stack App with AI in a Weekend
Put the methodology into practice in this illustrated tutorial. Follow the process of building Taskflow — a complete task management app — in one weekend, AI-first. Features example prompts, architectural decisions, and AI responses.
AI Developer Tools: A Practical Guide
The complete landscape of AI development tools — chat interfaces, editor integrations, CLI tools, and APIs. What to use, when to use it, and how to set up your stack.
The Complete Guide to AI-Assisted Development
A 20-chapter path from first prompts to planning, review, testing, security, and maintainable AI-assisted workflows.
Start with the practical guide and learning path, choose a tool for your constraints, then build, inspect, test, deploy, and grow in that order. Add accounts, permissions, files, email, payments, and backups only when the project needs them.
Vibe Coding: The Practical Guide
How to build real software by describing what you want to AI. Tools, techniques, common traps, and honest guidance on what vibe coding can and can't do.
How to Start Building With AI
A step-by-step learning path for beginners who want to build real things with AI tools. No programming experience required — just curiosity and a clear idea.
Which Vibe Coding Tool Should You Use?
Claude, Bolt, Lovable, Replit, or v0? A practical comparison of five vibe coding tools, their tradeoffs, and the project constraints to check before choosing.
A Day of Vibe Coding: Building a Real App
Follow along as we build a working movie watchlist app in one afternoon using only AI. Every prompt, every revision, every mistake — nothing skipped.
7 Vibe Coding Mistakes That Waste Your Time
The most common mistakes people make when building with AI — and how to avoid each one. Real scenarios, practical fixes, no jargon.
How to Read AI-Generated Code When You Don't Fully Understand It
Your app works, but what did AI actually build? Learn how to map the files, understand the user flow, spot risky code, and ask better follow-up questions before you deploy or expand your project.
How to Fix a Broken Vibe Coded App
Your vibe coded app almost works but something's wrong. A practical guide to fixing bugs, broken state, auth issues, and deploy problems with AI's help.
Deploying Your Vibe Coded App
Your app works in the preview. Now put it on the internet. A practical, step-by-step guide to deploying vibe coded apps — whether you built in Claude, Bolt, Replit, or Lovable.
Growing Your Vibe Coded App
Your vibe coded app is live. Now what? How to add features, handle real users, store data, respond to feedback, and keep things working without breaking everything.
Adding Form Validation and Error Messages to Your Vibe Coded App
Add client-side and server-side input validation to a vibe coded app, with accessible error messages, direct endpoint tests, and explicit rules.
Adding User Accounts to Your Vibe Coded App
Add login to a vibe coded app without building your own password system. Use hosted auth, enforce per-user access, and test the full account flow before launch.
Adding Teams and Permissions to Your Vibe Coded App
Turn a personal vibe coded app into a shared workspace with explicit data boundaries. Model memberships and roles, enforce permissions where data is accessed, and test cross-team isolation.
Adding File Uploads to Your Vibe Coded App
Add photo and file uploads to a vibe coded app without writing files to your own server. Use hosted storage, validate what you actually received, and keep private files private.
Adding Email and Notifications to Your Vibe Coded App
Send transactional email from a vibe coded app the safe way: use a hosted email API, keep your keys server-side, reach the inbox, and never email the wrong person.
Adding Payments to Your Vibe Coded App
Add hosted checkout with clear trust boundaries, verified and idempotent webhooks, test-mode checks, and a review before real money moves.
Adding Backups to Your Vibe Coded App
Rolling back a deploy restores your code, not your data. How to back up a vibe coded app's database and uploaded files, keep one copy off the platform, and test a restore before you need it.
Why Your AI Bill Got Expensive
Free trials run out, credits disappear faster than expected, and some AI tools now meter usage by the token. Why AI costs spike for vibe coders, and how to keep control of what you spend.
How to Hand Off a Vibe-Coded App to a Developer
You built a working app with AI. Now a developer needs to stabilize it, review it, or take it further. Learn what to prepare, what to document, and how to make the handoff useful instead of expensive chaos.
When Vibe Coding Isn't Enough
An honest guide to recognizing when your project has outgrown AI-only building — and how to find and talk to a developer when you don't know code.
Batch API vs Real-Time Calls: When Async Pays Off
Decide when the 50% batch API discount is worth a 24-hour window, match results by custom_id, recover expired and errored requests, and test it first.
Structured Outputs vs JSON Mode: Which One to Use
Pick JSON mode, schema Structured Outputs or strict tool use, see which schema keywords OpenAI and Claude reject, and keep the checks that still matter.
Long Context vs RAG: When to Skip Retrieval
Run one question set through a long-context prompt and a RAG pipeline, compare accuracy, cached cost and latency, then write your own decision rule.
MCP vs Function Calling: When You Need an MCP Server
Decide between an in-process function and an MCP server by locating where execution, consent and authorization live.
Mutation Testing for AI-Generated Tests
Expose a covered boundary fault with a pinned StrykerJS experiment, then improve assertions and interpret the score.
Cosine Similarity Is Not an Answer Confidence Score
Compare false acceptance and rejection with labelled questions, choose a retrieval threshold and evaluate answer support separately.
RAG Reranking: When Better Ordering Improves Answers
Compare fixed candidate and context budgets, measure answer support, and reject reranking when latency or cost outweighs the gain.
RAG vs Fine-Tuning: Which One Your AI Feature Needs
Retrieval changes what the model knows; fine-tuning changes how it behaves. A decision order for 2026, when vendor fine-tuning is shrinking.
LLM-as-a-Judge: Detect Position Bias in Your Evals
Separate judging instability from answer-order sensitivity with fixed answer IDs, repeated AB/BA comparisons and manual review.
Your AI Eval Agent Found the Answer Key: Isolate Fixtures Before Trusting the Score
Separate task inputs from grader-only fixtures, create disposable agent workspaces, and test answer-key leakage with a synthetic marker and a positive control.
Shorter reads on specific topics — ideas, perspectives, and practical takes on AI-assisted development.
Persisted Reasoning Across API Turns: Test What the Model Actually Reuses
Verify the effective reasoning context, compare two-turn outcomes, replay complete stateless history, and stop incompatible model-family handoffs.
Version Tool Schemas Without Breaking In-Flight Agent Runs
Pin every durable run to an immutable tool contract, adapt old calls into one domain command, replay real checkpoints, and retire v1 only after its dependency count reaches zero.
A 200 Response Is Not a Complete Response: Test Truncated Structured Outputs
Check generation state before parsing, force max-output-token exhaustion in a contract test, and prove that partial model data cannot reach a side effect.
Resume an Agent Run After a Crash: Checkpoints, Durable State, and Safe Replay
A dead run should restart at the step it reached, not at step one. The checkpoint record, the three replay classes, commit order around external effects, and the kill test that proves it works.
Prompt Cache Hit Rate: Why Your Cached Prompt Isn't Caching
The provider caches a prefix, and it fails without an error. Where the invalidator hides in prompt assembly, where breakpoints belong, and how to read the answer out of the usage fields.
Caching AI Responses Without Serving the Wrong Answer: Keys, TTLs, and Tenant Isolation
Put every input the answer depended on into the cache key, replace TTL with a version component for derived answers, and prove isolation with a probe that exits non-zero on a leak.
Agent Trace Observability: What to Log So a Failed AI Agent Run Is Debuggable
Emit one span per operation, propagate a single trace id, record the provider's request id, keep content capture opt-in, and prove it with a four-question drill.
Secure MCP Server Authorization: Prevent Confused-Deputy Tool Calls
Bind tokens to the intended MCP resource, keep upstream credentials separate, require per-client consent, and prove the boundary with hostile credential tests.
Idempotent Tool Calls for AI Agents: Prevent Duplicate Side Effects
Design idempotent AI-agent tool calls that stay safe under timeouts, retries, and duplicate delivery, with a persistent operation record and failure tests.
Zero Trust Architecture for Autonomous AI Agents
Allowing AI agents autonomous access to production data is a security risk without strict isolation. Learn how to design a zero trust architecture for your agentic workflows.
Setting Up Local AI Models for CI/CD Pipelines: Cost and Privacy Benefits
Relying on cloud APIs for AI support in CI/CD is expensive and leaks code. Learn how to run local models in your pipelines for testing and static analysis.
Modeling AI Infrastructure Costs: Tokens, Storage, and Observability
When developers budget for an AI feature, they usually count the tokens and stop there. Build a technical cost model that includes vector databases, tracing, and orchestration.
The AI Feature Flag Rollout Plan: Ship AI-Written Changes Behind a Toggle
Approval decides what an AI agent may change. A flag decides who actually sees it: percentage rollout, a fast kill path, and flag hygiene so flags never become permanent technical debt.
AI Agent Rollback Plans: Approval Gates That Keep Production Recoverable
A practical approval gate for production agents: define the action boundary, require reviewable evidence, bind the decision to a small scope, and plan recovery before execution.
The AI Queue & Background Job Migration Plan: Moving Heavy Work Safely
A 5-step plan for migrating synchronous HTTP workloads to asynchronous queues and background workers with AI — covering payload isolation, idempotency keys, DLQs, polling, and backpressure.
The AI Performance Fix Plan: Measure Before You Let AI Optimize
A safer AI-assisted workflow for performance work: baseline on realistic data, locate the bottleneck with a profiler or explain plan, set a target and a price, change one thing, and re-measure identically.
The AI File Storage Migration Plan: Move Uploads Without Breaking Links
A safer AI-assisted workflow for moving uploads: inventory the full storage contract, copy with evidence, preserve access rules, reconcile live changes, and retire the old path deliberately.
Migrate an Existing Background-Job Queue Without Losing Work
A safer AI-assisted workflow for queue changes: map stored work, prove producer-worker compatibility, preserve idempotency, drain deliberately, and retire the old path with evidence.
The AI Authentication Migration Plan: Change Login Without Locking Users Out
A safer AI-assisted workflow for auth changes: map the trust boundary, prove session and credential compatibility, stage rollout, and retire the old path with evidence.
The AI API Contract Change Plan: Evolve Endpoints Without Breaking Clients
A safer AI-assisted workflow for API changes: map consumers, prove old/new compatibility, stage an additive rollout, and retire the old contract with evidence.
The AI Database Migration Plan: Change Schemas Without Guessing
A safer AI-assisted workflow for schema changes: map compatibility, stage expand-backfill-switch-contract, prove data invariants, and plan recovery.
The AI Dependency Upgrade Plan: Update Packages Without Guessing
A safer AI-assisted workflow for package upgrades: verify the version delta, map affected code, isolate the diff, define proof, and plan rollback.
The Intro-Pricing Trap: Budgeting AI Features on Promotional Prices
Promotional model pricing expires on a known date. Four guardrails: budget at list price, tag price-expiry dates, alert on unit cost, and pre-plan the downgrade.
AI Merge Readiness Checklist: 10 Questions Before You Approve
A practical pre-merge checklist for AI-assisted pull requests: 10 questions covering scope, tests, risk, rollout, and rollback before approval.
25 AI Code Review Comments That Actually Improve Diffs
25 copy-ready code review comments for AI-assisted diffs, grouped by correctness, security, tests, scope, and rollback — precise, not vague.
AI Regression Test Plan Template
A copy-paste template for scoping regression tests around an AI-assisted change: what could break, which suites to run, and what to check by hand.
The AI Verification Ladder: Confidence Levels Before Merge
A practical way to match AI change risk to the right depth of validation, using five confidence levels before merge.
Model Fallback Runbook Template: The First 30 Minutes
A minute-by-minute runbook for the first 30 minutes of an AI provider outage: who acts, what to check, and when to declare the incident stable.
AI PR Review Checklist Template for Engineering Teams
A copy-paste PR template that standardizes how your whole team reviews AI-assisted pull requests, so review quality doesn't depend on who's on call.
The AI Decision Log: Stop Re-Debating the Same Change
A practical way to keep AI coding work consistent across sessions: log key decisions, rationale, constraints, and checks so the next prompt starts from truth instead of guesswork.
AI Change Risk Matrix: Scope, Tests, Rollback Before Merge
A practical matrix for deciding how risky an AI-generated change is before merge, with scope, test depth, review evidence, and rollback requirements.
Run a Model Fallback Drill Before You Need One
A practical workflow for testing AI model fallback before an outage: trigger conditions, quality gates, rollback rules, and the one-page drill your team should run each month.
15 Acceptance Criteria Examples for AI Coding Tasks
Copy-ready acceptance criteria examples for AI coding tasks: UI, API, data, auth, tests, refactors, migrations, and rollback.
Writing the Context File: AGENTS.md and CLAUDE.md Done Right
What belongs in an AI agent's context file and what doesn't: commands, architecture, conventions, and boundaries — plus how to keep it short, true, and maintained like code.
The AI Acceptance Criteria Prompt: Define Done Before the Diff
A practical way to define acceptance criteria before AI writes code, so reviews are based on clear pass/fail outcomes instead of opinions.
Running AI Agents in Parallel
A practical method for running two or three coding agents at once without losing control: task isolation, branch hygiene, one reviewer, and when parallel actually slows you down.
The AI Session Resume Packet
A practical way to make AI coding sessions resumable: capture goal, current state, decisions, changed files, open risks, validation, and the next prompt.
The AI Bug Report That Actually Helps
A practical structure for AI bug reports: observed behavior, expected behavior, reproduction path, relevant context, evidence, and fix boundaries.
When Your AI Model Gets Pulled: Building for Model Availability Risk
A practical framework for AI model availability risk: why models get pulled, deprecated, or restricted, and how to build features that survive losing one.
The AI Plan Before Code: Stop Letting AI Start in the Middle
A practical workflow for asking AI to plan before it edits: define intent, constraints, risks, validation, and rollback before accepting code changes.
The AI Change Budget: How Much Should You Let AI Edit at Once?
A practical framework for deciding how large an AI-generated change can be before reviewability, tests, rollback, and production risk say to split it.
Why Small Diffs Win With AI
Broad rewrite prompts feel fast, but small diffs plus tight validation loops usually produce better AI-assisted code with less cleanup.
The AI Code Ownership Checklist: Before You Merge
A practical merge checklist for AI-generated code: behavior, tests, contracts, edge cases, security, and observability.
The True Cost of Context: Why Context Dumping is an Anti-Pattern
Large context windows make it easy to include everything, but more context is not always better. Why targeted context curation improves quality, speed, and cost when coding with AI.
Case Study: Refactoring Legacy Authentication with AI
A concrete example of using AI to modernize an undocumented legacy authentication controller. From the initial messy state to a clean, tested, and validated result.
Why AI Code Feels Fast But Fragile
AI-generated code can make the first hour feel magical, then become brittle when edge cases, tests, integration, and maintenance arrive. Here's how to keep the speed without losing the structure.
Should This Feature Use AI?
A practical decision framework for when AI belongs in a product feature, when ordinary code is better, and how to keep probabilistic systems away from decisions that need deterministic control.
How This Site Was Built: A Developer and AI, Start to Finish
The full story of building aiprogrammingmanual.com — one developer and Claude, over 6 weeks. What worked, what went wrong, and what I'd do differently.
How AI APIs Work (And Why You're Already Using Them)
Every time you use Claude or ChatGPT, an API is doing the work behind the scenes. What's actually happening, how tokens and pricing work, and why this one concept explains the entire AI tool landscape.
Where Vibe Coding Is Actually Going
Vibe coding is moving toward agent supervision and multi-tool workflows, but product judgment, review, security, and maintenance still decide what survives.
How AI Models Are Trained: What's Actually Happening
The training process behind Claude, ChatGPT, and other AI tools — explained in plain language. Why AI hallucinates, why it writes outdated code, and why context improves results so dramatically.
How AI Programming Is Different From Traditional Development
Deterministic code vs probabilistic systems, writing rules vs providing data, and why debugging AI feels completely different. What changes when you move from traditional software to AI-assisted development.
GPT-5.4-Cyber Shutdown: Check Your API Calls Today
Find exact model calls, test a replacement your account can access, and decide how to switch or pause each affected route.
GitHub Enterprise Adds Proof of Presence for High-Impact Actions: Plan Your Re-authentication Policy
Check whether GitHub proof of presence covers your enterprise, choose re-authentication or MFA, and plan for the two-hour window and announced merge checks.
GitHub Copilot App Adds Local Sandboxing: Verify Files, Network and Credentials
Run a local Copilot sandbox acceptance matrix for file access, network restrictions, credentials, and policy changes across active and new sessions.
Observe GitHub Copilot Agent Sessions with OpenTelemetry Without Leaking Prompts
Stage Copilot telemetry to a test collector, verify agent and tool spans, keep content capture locked off, and prove rollback.
GitHub Enterprise Credential Inventory: Turn the Export Into an Incident Triage Runbook
Normalize GitHub's read-only credential inventory, correlate supported audit evidence, and route scoped remediation with rollback ownership.
OpenAI Adds API Key Creation Controls: Block Human-Owned Keys Without Breaking Existing Credentials
Inventory OpenAI API keys, prove organization and project precedence, and decide how to migrate every existing credential.
npm Stage-Only Tokens Are Here: Move Token-Based Publishing to Staged Releases Before January 2027
Inventory every npm publish token, run one stage-and-approve test, and decide per package between OIDC, a stage-only token, or retirement.
GitHub Actions Execution Protections Are GA: Audit pull_request_target Before November 2
Inventory affected workflows, inspect evaluate-mode results, and prove whether to remove, replace, or narrowly allow each trigger.
GitHub Rewrote the Copilot Runtime in Rust: Copy the Migration Proof, Not the Line Count
Plan one bounded runtime-migration pilot with stable tests, explicit shims, staged exposure, and a measured stop/go decision.
Enforce GitHub Advanced Security Ownership Before Delegating Administration
Run a role-based before-and-after test to prove which GitHub administrators can override an enterprise security configuration.
Run a Harness Boundary Test Before Moving to OpenAI's Agents API
Run one portable fixture through your current harness and OpenAI's hosted path, then compare output, tools, context, latency, and cost evidence.
Copilot Code Review Now Resolves Its Own Comments: Check What Your Conversation-Resolution Rule Still Proves
Run a partial-fix check on Copilot auto-resolution and decide which finding classes still need a human-owned signal before merge.
VS Code Agent Usage Metrics Are Not Productivity Metrics: Build a Dashboard That Says What It Measures
Build a null-safe metric dictionary and separate dedicated VS Code Agents-window adoption signals from delivery and quality outcomes.
GitHub Actions cache-mode: Stop Low-Trust Workflows From Poisoning the Cache Your AI Pipeline Trusts
Map the effective GitHub Actions cache-mode per trigger and job, then prove a low-trust run cannot save and an over-requesting reusable workflow fails validation.
GitHub Copilot Agent Permissions: Test Enterprise Policy Before Auto-Approval
Prove one denied, one approval-required, and one allowed Copilot agent operation, then verify that local auto-approval cannot weaken the enterprise policy.
What changed in the AI stack — filtered for developers and vibe coders. No hype, no consumer app coverage. Model releases, API changes, and what they mean for how you build.
OpenAI Reports 3.1 Agent-Workdays per Researcher-Day: Read the Metric Before Copying the Workflow
Separate agent runtime, concurrency, completed tasks, human interventions, verified outputs, and bottlenecks before claiming coding-agent productivity.
Run Cursor Cloud Agents in Vercel Sandbox: Verify the Isolation Boundary
Test claim ownership, retry deduplication, credential scope, concurrency limits, timeouts, cleanup, and recovery before running Cursor agents in production.
GitHub Actions Exposes Reusable Workflow Identity: Trace the Checks Behind an AI Pull Request
Compare caller and reusable workflow revisions in a disposable CI fixture, then record the implementation SHA alongside the completed check result.
npm Adds Multiple Trusted Publishers: Audit Every Route an AI Release Agent Can Use
Audit additive npm OIDC permissions across stable, prerelease and staging workflows, then test human approval boundaries with a separate package.
GPT-6 Astra Reaches the API: Build a Capability Gate Before Model Migration
Clone one representative request into a canary that tests Astra's API delta, output contract, tool behavior, latency, token cost, failure path, and rollback.
Copilot Content Exclusions Reach the App and CLI: Prove Secrets Stay Out of Agent Context
Use harmless canaries to verify repository and organization exclusions in both clients, then keep documented gaps outside the trust claim.
Copilot Can Approve Pull Requests: Prove the Review Is Independent Before It Counts
Run four controlled pull requests to prove path scope, dismissal after a new commit, and a separate merge gate before Copilot approval counts.
OpenAI mTLS and X.509 Workload Identity Are GA: Test the Two-Credential Boundary
Activate certificate trust safely, then prove bearer lifetime, mTLS admission, mapping, permissions, and root rotation fail and recover independently.
OpenAI's Hugging Face Incident: Test the Agent Containment Boundary
Verify brokered egress, artifact and credential isolation, cross-run separation, independent detection, and an emergency stop with a harmless two-run exercise.
Anthropic Adds Personal and Service-Account API Keys: Build the Offboarding Test
Map every Claude API key to an identity and workspace, migrate a production workload without a flag day, and prove offboarding removes only the intended access.
OpenAI GPT-5.6 on Amazon Bedrock: Choose the Inference Profile Before You Route
Choose the global or US cross-Region inference profile as a processing policy, authorize its complete route, and verify the actual destination Region in CloudTrail.
OpenAI Regional Processing Per Request: Route One Call to the EU
One Global-project API key can now select global, US, or EU processing per request. The base-URL change, eligibility gates, support matrix, and negative tests to add before rollout.
Computer Use Goes GA — and the Browser Toolset That Reads the Page Instead
The GA toolset rejects five parameters the beta tool accepted, and coordinates move into the screenshot you return. Plus when to address elements by reference instead of by pixel.
Anthropic Python SDK 1.0: The Migration That Removes temperature, top_p, and top_k
Version 1.0 raises the Python floor to 3.10 and swaps httpx for httpx2. Apply the five breaking changes in order, and check your mocks before you trust a green test run.
Private Claude Code Plugin Marketplaces: Short-Lived Auth with headersHelper
Claude Code 2.1.238 can mint HTTP headers for private URL marketplaces and plugin archives. Choose catalog or entry scope, preserve confirmation, and test every fetch path.
The Claude API Beta Headers That Just Went GA: What Removing Them Changes
Files, Skills, and Enterprise user management are GA on the Claude API. Two of the three beta headers are free to delete; the third quietly changes the shape of every GET /v1/files response.
OpenAI's Assistants API Shuts Down August 26: The Migration Checklist
Assistants, threads, and runs map onto the Responses and Conversations APIs. Where the retention floor moves, why the recommended prompt-object step shuts down 96 days later, and what to export before the endpoint stops answering.
Claude Code's Subagent Forking Default: What Changes for Your Multi-Agent Setup
Claude Code 2.1.232 makes a subagent_type "fork" subagent inherit the full parent conversation and prompt cache by default. Where the cost assumption moved, where context can leak between subagents, and what to check in an existing config.
Your Local Claude Code Sessions Are Now Retrievable by Your Organization
Three Compliance API endpoints, in beta for Claude Enterprise organizations, return transcripts of Cowork and Claude Code sessions run on users' own machines. What lands in the transcript, who can pull it, and what to change locally.
Imagen 4 Shuts Down August 17: Migrate the Model ID Without Breaking Image Output
Three Imagen 4 endpoints are scheduled to shut down. Replace the request and response contract, then prove bytes, MIME type, dimensions, failures, and visual acceptance before cutover.
Claude Opus 5 Keeps the Price and Changes the Bill
Opus 5 shipped July 24 at Opus 4.8's exact list price. Underneath it, thinking is on by default, the effort dial is the main cost control, and two prompt-cache rules moved in opposite directions.
Microsoft's CLI Agent Rollout: 24% More Merged PRs, With a Catch
A new field study of Microsoft's early-2026 rollout of Claude Code and GitHub Copilot CLI found roughly 24% more merged PRs among adopters, while showing why teams need better rollout metrics than raw output.
GPT-5.6 Goes GA: The Locked Preview Opens Two Weeks Later
OpenAI made GPT-5.6 Sol, Terra, and Luna generally available on July 9, 2026, after a 13-day limited preview. GA pricing, ultra mode with four parallel agents, and programmatic tool calling in the Responses API.
GPT-5.6 Sol Launches in a Locked Preview: The Best Coding Model You Can't Use Yet
OpenAI previewed GPT-5.6 Sol on June 26, 2026 — a new state of the art on Terminal-Bench 2.1, with an ultra mode that runs subagents. But access is limited to a small set of partners after the U.S. government reviewed the launch.
Windsurf Is Now Devin Desktop: What Changes Before Cascade's July Cutoff
Cognition retired the Windsurf brand on June 2, 2026, relaunching it as Devin Desktop with an Agent Command Center and ACP support. Cascade, Windsurf's local agent, remains available through July 2026.
Claude Fable 5's Free Window Ends While Access Is Still Suspended
Fable 5's no-extra-cost subscription window ended June 22. As of June 28, Anthropic's access statement still says Fable 5 and Mythos 5 were removed from all users while access is restored.
OpenCode Crosses 160,000 Stars: Inside the Model-Agnostic CLI Agent
The open-source terminal agent OpenCode crossed 160K+ GitHub stars and 7.5M monthly active developers, with support for 75+ model providers and a fast release cadence (v1.16.0 in early June, v1.17.x soon after) — what its provider-agnostic, BYOK approach means for your CLI workflow.
Claude Opus 4.8 Reaches 88.6% on SWE-bench Verified
Anthropic's latest Opus release reports an 88.6% SWE-bench Verified score, with stronger agentic coding behavior, dynamic workflows, and better uncertainty signaling.
Codex in Production: Self-Improving Agents and Eval Loops
OpenAI's latest engineering case study shows a concrete production pattern: expert feedback becomes traces, traces become eval targets, and Codex helps ship bounded improvements with human review.
Claude Opus 4.8: 1M Context, Adaptive Thinking, Dreaming Agents
What actually changed in Claude Opus 4.8 for developers. 1M token context is now default. Adaptive thinking cuts wasted reasoning tokens. Dreaming gives agents persistent memory between sessions.
The Multi-Agent Coding Stack: Cursor, Claude Code, Codex
The era of one AI coding tool is over. Many senior developers now run 2–3 tools in parallel. Cursor 3.2 ships /multitask for parallel subagents. Zed 1.0 adds the Agent Client Protocol.
Google I/O 2026: The Developer Edition
Everything from Google I/O that actually matters for developers: Gemini 3.5 Flash, Antigravity 2.0 subagents, the Managed Agents API, WebMCP, and Android CLI 1.0 — stripped of the keynote hype.
All News →
Browse the full news archive.