Show HN: Pontus the Zero Trust AI Layer. Hi HN,
We’re @sumants and @rmehtany, working on Pontus.
Pontus makes it easy to use AI with privacy embedded.
We were concerned about the volume of personal data that goes to large LLM models without protection. We tried find an easy solution where didn’t change the simple apis given by LLM providers. However, most required you to invest significant engineering effort.
We wanted privacy and LLMs to be easy, so we built Pontus. Through a declarative YAML, we orchestrate a microservice with the most common element of the LLM stack.
- Anonymize Prompts before it hits LLMs, yet keeps context on your servers
- Secure RAG that embeds documents safely
- Semantic Cache that doesn’t store PII at Rest
We did this not only because it is the right thing to do, but the regulation landscape makes it critical to build with privacy first. Recently, many companies have been fined and forced to delete their AI models [1][2]
For us, Privacy is by design, not an afterthought.
Please visit us here
Our Open Core Repo: https://github.com/PontusAI/Pontus
Our Website: https://pontus.so
[1] https://www.ftc.gov/news-events/news/press-releases/2023/05/...
[2] https://techcrunch.com/2023/05/10/clearview-ai-another-cnil-...


Show HN: LLM Podcast Chat and Summaries. Hey Hacker News,
2 weeks ago I shared an alternative HN UI with built in LLM-powered summarization for links and discussions (dstill.ai/hackernews, https://news.ycombinator.com/item?id=36760714).
Today I am happy to share further work that allows you to summarize and chat with a select set of high quality podcasts. You can find these features at https://dstill.ai/podcasts and https://dstill.ai/agent.
Video demo: https://www.loom.com/share/1270256b2c9d4d88970b9cadd446ceb3?... (screenshots with more details below)
A bit more context:
The long term goal of https://dstill.ai is to provide you with the means to consume and access information in a more thoughtful and highly personal way. Making sure you never miss anything that's actually important to you and cutting all the fluff and distractions that are being thrown at us every day — hopefully somewhat balancing the fact that some companies are set to flood the internet with vacuous AI generated content.
Today’s release is only a small part of that vision, but I want to make sure we release early and often, and learn along the way.
Why podcasts? I think they are a unique source of highly authentic information that can help balance the generic and impersonal nature of something like ChatGPT. They also pose a challenge, because they are audio, and audio is much harder to work with compared to text. But more and more content is being exclusively produced in audio or video form, and so it’s strategically important to tackle this head on.
Here’s a quick rundown of the podcasts UI:
- Podcast list: https://screenbud.com/shot/07c31b34-0a1f-4658-a70a-0007b69a5...
- Specific podcast: https://screenbud.com/shot/ca5b067e-428d-4fc7-a6ba-2cd87fe3e...
- Specific podcast episode with summary: https://screenbud.com/shot/7056aa9e-9834-48c7-918a-6eef2694d...
Here are a few example conversations I had recently:
- [Andrew Huberman and Peter Attia on improving cardiovascular fitness.] https://screenbud.com/shot/8fddfb0d-51a6-45c7-bffd-a5644d106...
- [Pros and cons for AI regulation, include quotes and a summary.] https://screenbud.com/shot/d526c793-5b52-45ee-b688-1de78be63...
On the technical level, here’s how things are structured:

  - Podcasts are transcribed (using whisper) and diarized

  - For summarization:
      - Transcripts are split into chunks if necessary — many podcasts are over 20K tokens — and those are then summarized in a map/reduce fashion

  - For chat:
      - Transcripts are split into chunks, which are embedded using instructor-large
      - The embeddings are stored in qdrant, along with metadata needed for filtering — this is where qdrant shines, it allows you to have *efficient* embedding based retrieval with filtering (see here for details https://qdrant.tech/articles/filtrable-hnsw/)
      - There’s one LLM that generates search queries (if any), those are use for retrieval of the podcast chunks
      - Then a second LLM is fed the conversation history along with the search results — currently relying on ChatGPT, though we are working on custom fine tuning of llama.

  - The UI is TypeScript with SvelteKit — so far I love the simple and intuitive nature of Svelte(Kit).

  - The backend is Rust, based on my own (multi-lingual) LLM framework tailored for configurability and observability (I wrote about it a bit here, including some demos of the platform: https://news.ycombinator.com/item?id=36787924#36789075)

  - Right now there’s no account system, so you need to supply your own OpenAI API keys.

There’s still a lot of work to be done on both the podcast and agent experience, but I hope it’s going to provide some value as is already.
I would be very happy to hear your thoughts and feedback, both on the general vision, as well as today’s podcast and agent release.
Cheers,
Petr.


Show HN: OpenComplAI – open-source EU AI Act compliance checks in CI/CD.


Automated and easy EU AI Act compliance.


Show HN: AuditBadger – SOC 2 and ISO 27001 – AI drafts, you approve. Hi,
Wanted to share something I've been working on for over a year. AuditBadger is a compliance management platform that uses AI to write policies (there are underlying "templates" with basic requirements), rewrite controls (or trust service criterions) to match the company context, help figure out your own controls, does initial risk assessment, and business continuity planning (which at least gives you an example of how the process should look like).
Fun fact - I wanted to share this a year ago, but then I spotted something similar here. The most common comment was about lacking the SOC 2 report, so I decided to pick the fight. I got SOC 2 Type I first, and then recently finished SOC 2 Type II using the tool alone. It took some time - both learning the process, the SOC 2 gotchas, and implementing automatic evidence collection.
We're now adding support for the European AI Act and NIS 2; HIPAA is already there (though it requires me to explicitly enable it for customers who want to test it), and CyberEssentials and ENS are coming later this year.
The platform is now complete, but my business partner (ISO 27001 Lead Auditor) and I are still dog-fooding it. Everything we build is either based on our own pain points or our customers'—most of them joined our Slack where we try to help them if they get stuck.
If you have any questions, I'll be happy to answer them all.


Affordable and automated EU AI Act compliance.


NYC LL144 and EU AI Act Compliance Guides.


CEO and Creator of Ethos Engine for AI. Francisco Javier Roldán Velásquez is the Founder and CEO of Ethos Engine, a deterministic AI safety infrastructure solving the "circular supervision" problem. It acts as an external governance module, using proprietary mathematical indices and a multi-civilizational knowledge graph to ensure compliance with the EU AI Act. With more than 30 years of experience, Roldán seeks pre-seed funding and Silicon Valley connections to scale this patent-pending intellectual property asset globally.


CorvinOS – an agentic OS where GDPR/EU AI Act compliance can't be switched off.


ComplianceAgent: Open-source EU AI Act compliance scanner.


ActHub – EU AI Act compliance toolkit for small businesses (PHP, no framework).


Free EU AI Act Article 50 compliance checker for indie SaaS.


Show HN: ComplianceLint – The linter for EU AI Act compliance.


Show HN: Dev-friendly native OTel: only OSS stateful, on-the-wire Observability. Hi HN,
We’re the team at MyDecisive.ai, and today we’re giving developers a peek at Octant — point-and-click control and visibility for your OpenTelemetry.
You've likely felt the pain of the "observability tax," especially if you manage K8S clusters. The modern standard is to instrument everything with OpenTelemetry, but piping all those rich OTLP logs, metrics, and traces straight to a SaaS vendor (Datadog, Splunk, Honeycomb) gets expensive fast. You end up paying massive ingestion and storage costs for noisy, low-value data just so it's searchable when something breaks. With Octant you get up and running on OTel in minutes.
We built Octant to flip this model. Instead of blindly shipping all telemetry off-cluster, Octant configures and helps to manage OTEL clusters. It gives you a visual interface for managing K8s objects, but importantly, it acts as an OTLP gateway that filters data at the source before it leaves your VPC.
Because it natively speaks OpenTelemetry, you can point your existing OTel SDKs or collectors right at it without touching your application code. Here is what it does under the hood:
- OTel-Native Trace & Log Sampling: It makes it easy to ingest OTLP traffic and inspects logs and traces on the wire. By waiting for the full context of a trace before determining what to keep, it delivers on the promise of braiding, retaining 100% of the actionable signals around (like errors and high-latency spans) but droppings the junk before it hits your SaaS bill.
- In-Flight Stateful Alerting: Instead of waiting for data to be batched, shipped, and indexed by an external provider to trigger an alert, Octant can process the telemetry streams in-flight. This shrinks the detection gap and reduces the need for SaaS vendors in the first place.
- On-the-Wire PII Redaction: It can detect and strip sensitive information from your logs and traces in real-time before they are transmitted over the internet, removing "post-ingestion" clean-up costs and compliance risks.
- K8s Context Injection: Because it's deeply integrated with your cluster, it maps your OTel streams directly to your K8s resources (Deployments, Pods, CRDs) in a unified UI.
The API is built in Go ([github.com/mydecisive/octant] and the whole stack can be deployed directly into your cluster via our Helm charts.
We’d love for you to spin it up on a dev cluster and tear it apart. We just recently merged a PR from our very first community contributor, which was a huge milestone for us! We want to keep that momentum going. If you're interested in hacking on K8s observability and autonomy, OpenTelemetry pipelines, or Go/React, we’ve tagged a few 'good first issues' and would be thrilled to welcome you to the project.
GitHub: https://github.com/MyDecisive/octant
Website: https://www.mydecisive.ai/
I'll be hanging out in the thread today and am happy to answer any questions or dig into the architecture!


ToTra – open-source LLM gateway with GDPR/EU AI Act compliance.


xAI sues Minnesota over its law banning 'nudification' technology.


Government can seize private land to make way for new AI data center power.


Gov. Pritzker Signs Nation-Leading Artificial Intelligence Safety Law.


HR consultant wins English court case using AI lawyer in apparent legal first.


Artificial intelligence-based law firm wins in court.


White House negotiating preemption of state AI laws in exchange for KOSA & more.


CNN sues Perplexity over 'verbatim' copycat articles.


Artificial Intelligence Floods Court Dockets with Home-Brewed Lawsuits.


Show HN: Open-Source EU AI Act Scanner for Python AI Projects. I built an open-source CLI tool that scans Python AI projects for EU AI Act technical requirements. It checks for 6 things the regulation asks for: risk management documentation, data governance, human oversight hooks, transparency logging, accuracy/robustness testing, and record-keeping.
Right now it detects LangChain, CrewAI, OpenAI, Anthropic, HuggingFace, and AutoGen patterns, then flags what's missing against Articles 9-15 of the Act.
It's not a legal compliance tool — it checks whether your code has the technical components the regulation references. Think of it like a linter for AI governance requirements.
The interactive demo at the link walks through a sample scan. The scanner itself is pip-installable: pip install air-compliance-checker
GitHub: https://github.com/air-blackbox/air-compliance-checker
Feedback welcome — especially from anyone actually dealing with EU AI Act prep.


AI Orchestration Market Witnesses Surge in Use Across Healthcare and BFSI. The global AI orchestration market is rapidly becoming a cornerstone of enterprise digital transformation, enabling the seamless integration, deployment, and management of artificial intelligence across complex multi-cloud and hybrid IT environments. The market is valued at $7.23 billion in 2024, is expected to grow to $8.70 billion by 2025 , and reach $34.16 billion by 2032, growing at a remarkable compound annual growth rate (CAGR) of 21.22% during the forecast period.
AI orchestration involves the automated coordination of various AI services, machine learning models, data pipelines, and business processes to achieve scalable, efficient, and intelligent outcomes. It plays a central role in enabling companies to integrate AI into existing workflows without disruption to operations, accelerating innovation, improving decision-making, and optimizing resource utilization.
Get the full, detailed PDF report: https://www.kingsresearch.com/ai-orchestration-market-2617
Key market trends
Multi-cloud AI deployment – The increasing use of hybrid and multi-cloud infrastructures is driving the demand for orchestration tools that can work seamlessly across different platforms.
Rise of AI-as-a-Service (AIaaS) – Orchestration solutions are increasingly being integrated into AIaaS offerings to simplify deployment for organizations of all sizes.
Edge AI integration – Companies are orchestrating AI workloads closer to data sources to enable real-time decision-making in industries such as manufacturing, retail, and logistics.
MLOps adoption – AI orchestration is becoming an essential component of MLOps frameworks, ensuring the continuous integration and deployment of AI models.
Low-code/no-code interfaces – Vendors are introducing simplified orchestration platforms to enable non-technical teams to manage AI workflows.
Market dynamics
driver
Explosive adoption of AI across all industries – From predictive maintenance in manufacturing to fraud detection in banking, AI use cases are multiplying and requiring robust orchestration solutions.
Need for automation in AI deployment – Organizations need orchestration to manage the complexity of integrating multiple AI models and services at scale.
Data explosion and need for real-time insights – Orchestration ensures the efficient processing of massive amounts of data and enables real-time analytics.
restrictions
Complexity of integration with legacy systems – Limitations of existing infrastructure can slow down the adoption of orchestration.
Skills gaps in AI and data management – Many companies lack the expertise to effectively implement and manage AI orchestration.
Opportunities
Growth in Edge Computing – Orchestrating AI models at the edge for low-latency decisions offers untapped opportunities.
AI governance and compliance tools – With stricter AI regulations, demand for orchestration solutions with embedded compliance capabilities will increase.
Market segmentation
By component
Platform/Software – Core orchestration platforms that manage AI workflows, APIs, and integrations.
Services – Consulting, integration, training, and managed orchestration services.
By deployment mode
Cloud-based – Flexible, scalable, and cost-effective deployments dominate the market.
On-site – Preferred by organizations in regulated industries for security and compliance reasons.
After application
Data processing and management
Model training and deployment
Predictive analytics
Improving the customer experience
Process automation


Show HN: I tried coding theology – accidentally built AI accountability. *Show HN: I tried coding theological concepts – accidentally built AI accountability*
GitHub: https://github.com/ubunturbo/srta-ai-accountability
Working demo: https://gist.github.com/ubunturbo/0b6f7f5aa9fe1feb00359f6371...
*The Experiment:*
Started as a thought experiment: "What if I tried to code theological structures like the Trinity to see if AI could reflect the 'image of God' in humans?" As a non-programmer using AI tools, I attempted to translate concepts like perichoresis (mutual indwelling) into Python.
*Unexpected Result:*
Instead of digital theology, I ended up with something that looks like an AI accountability framework.
*What SRTA Does:*
- *Technical layer*: Formal causation analysis with O(n log n) complexity
- *Accountability layer*: Maps decisions back to design principles and responsible stakeholders
- *Compliance layer*: 94% EU AI Act coverage vs <30% for traditional methods
*Key Innovation:*
Instead of just "credit score had -0.73 weight," you get: "Credit score weighted by Risk Management Team on [date] per Equal Credit Opportunity Act Section 4, reviewed by Legal on [date], cryptographically verified."
*Unexpected Discovery:*
Started as a philosophical experiment in coding theological principles. Ended up solving a real regulatory problem. Sometimes the best technical solutions come from non-technical inspiration.
*Current Status:*
- Core architecture: Complete
- Benchmarking: Validated across 5 domains (financial, medical, etc.)
- Production ready: 312ms explanation generation
- Academic paper: Under review at IEEE Transactions on AI
*Technical Details:*
The system implements "perichoretic synthesis" - layers that mutually indwell rather than simple stacking. This creates systematic coherence impossible with traditional explainability approaches.
Three integrated layers:
1. *Intent Layer*: Design rationale + stakeholder mapping
2. *Generation Layer*: Constrained AI processing + principle checking
3. *Evaluation Layer*: Accountability assessment + audit trails
*Why This Matters Now:*
- EU AI Act enforcement begins 2025
- FDA tightening AI/ML device requirements
- Financial regulators demanding algorithmic accountability
- Healthcare systems need design rationale transparency
*Looking for:*
- Feedback from HN's technical community
- Use cases we haven't considered
- Collaboration with regulatory/compliance folks
- Real-world deployment partners
*Demo walkthrough:*
The gist shows a medical AI making diagnosis decisions with full theological accountability - tracks everything from stewardship concerns to justice implications. Determines when human oversight is required based on ethical analysis.
Built by a non-programmer using AI tools, which raised interesting questions about who should be designing AI governance systems. Turns out domain knowledge (ethics, theology, regulation) might matter more than coding ability for this particular problem.
What do you think? Is there a market for accountability-first AI architecture?


Launch HN: Parachute (YC S25) – Guardrails for Clinical AI. Hi HN, Aria and Tony here, co-founders of Parachute (https://www.parachute-ai.com/). We’re building governance infrastructure that lets hospitals safely evaluate and monitor clinical AI at scale.
Hospitals are racing to adopt AI. More than 2,000 clinical AI tools hit the U.S. market last year - from ambient scribes to imaging models. But new regulations (HTI-1, Colorado AI Act, California SB 3030, White House AI Action Plan) require auditable proof that these models are safe, fair, and continuously monitored.
The problem is, most hospital IT teams can’t keep up. They can’t vet every vendor, run stress tests, and monitor models 24/7. As a result, promising tools die in pilot hell while risk exposure grows.
We saw this firsthand while deploying AI at Columbia University Irving Medical Center, so we built Parachute. Columbia is now using it to track live AI models in production.
How it works: First, Parachute evaluates vendors against a hospital’s clinical needs and flags compliance and security risks before a pilot even begins. Next, we run automated benchmarking and red-teaming to stress test each model and uncover risks like hallucinations, bias, or safety gaps.
Once a model is deployed, Parachute continuously monitors its accuracy, drift, bias, and uptime, sending alerts the moment thresholds are breached. Finally, every approval, test, and runtime change is sealed into an immutable audit trail that hospitals can hand directly to regulators and auditors.
We’d love to hear from anyone with hospital experience who has an interest in deploying AI safely. We look forward to your comments!


Show HN: VerifyWise, an open-source governance platform for AI compliance. Hi all, Gorkem here. I started VerifyWise [1] to make AI governance less painful. Today, we’re launching our open-source platform to help teams take control of their AI compliance process.
VerifyWise helps organizations navigate AI governance by providing audit readiness, risk registers, model fairness checks, and compliance documentation. Those are all built into a single platform you can self-host.
We’ve been quietly building VerifyWise for a while, and we’re now at a place where it’s ready for more teams to try.
Since we started, we've:
- Released our core platform on GitHub: https://github.com/bluewave-labs/verifywise
- Added workflows for EU AI Act and ISO 42001 with exportable audit trails
- Built a bias & fairness module with Fairlearn integration
- Developed a training registry for tracking internal AI literacy
- Shipped risk register and vendors/vendor risks module
- Opened our Figma for design contributions
We’re aiming for full transparency and community-led development.
If you're building with AI and feeling the pressure of upcoming regulations, we’d love to hear your feedback.
[1] GitHub: https://github.com/bluewave-labs/verifywise
[2] Features: https://verifywise.ai
[3] Documentation: https://docs.verifywise.ai


Show HN: SecureML – Privacy and Compliance Toolkit for ML. Hi HN!
I'm a second-year law student with a deep fascination for AI governance and data protection. Over the past few months, I’ve been learning how machine learning and data privacy intersect—and I decided to build a tool that sits right at that intersection.
[GitHub: scimorph/secureml](https://github.com/scimorph/secureml)
 [Docs](https://secureml.readthedocs.io/)
 `pip install secureml`
---
###  What is SecureML?
*SecureML* is an open-source Python library that integrates with PyTorch and TensorFlow to help developers *build privacy-preserving and regulation-aware AI systems*. It provides practical tools to comply with data protection laws like GDPR, CCPA, HIPAA, and Brazil’s LGPD.
It’s designed for both developers and researchers who want to make AI privacy-compliant without reinventing the wheel.
---
###  Core Features
- *Data Anonymization*
  - K-anonymity with adaptive generalization
  - Format-preserving pseudonymization
  - Automatic sensitive data detection
  - Taxonomy-based data generalization
- *Privacy-Preserving ML*
  - Differential Privacy (via Opacus + TF Privacy)
  - Federated Learning (via Flower) with secure aggregation
- *Compliance Checkers*
  - Analyze your datasets and ML pipelines for privacy risks
  - Built-in presets for GDPR, CCPA, HIPAA, and LGPD
- *Synthetic Data Generation*
  - Generate high-fidelity synthetic datasets (statistical, GANs, copulas)
  - SDV integration with support for mixed data types and correlation preservation
- *Audit Trails & Reporting*
  - Logs and visual dashboards for traceability
  - Auto-generated reports in HTML/PDF for compliance audits
---
###  Example Use Cases
- Check if your model setup is compliant with GDPR:
```python
from secureml import check_compliance
report = check_compliance(data=df, model_config=config, regulation="GDPR")
```
- Anonymize a dataset before training:
```python
from secureml import anonymize
anon_df = anonymize(df, method="k-anonymity", k=5, sensitive_columns=["email", "ssn"])
```
- Train with differential privacy in PyTorch:
```python
from secureml import differentially_private_train
private_model = differentially_private_train(model=model, data=df, epsilon=1.0)
```
- Generate synthetic datasets for safe sharing:
```python
from secureml import generate_synthetic_data
synth = generate_synthetic_data(template=df, num_samples=1000, method="sdv-copula")
```
---
###  Why I built this
While studying law, I kept wondering how we could bridge the gap between legal theory and real-world ML practice. SecureML is my attempt to bring compliance tooling closer to ML workflows—making it easier for engineers to build responsibly and for companies to stay out of trouble.
This is my *first open-source project*, and I’d love your feedback, bug reports, and ideas!
---
###  Looking for contributors
I’d love help expanding regulation support beyond GDPR, CCPA, HIPAA, and LGPD—especially for APPI, PIPEDA, and others. If you're into privacy, ML, or just want to hack on something useful, feel free to jump in.
---
Thanks for reading!
– [@EnzoFanAccount] (law student & privacy geek)


Must-Haves for Every Data Security Policy. In today’s digital landscape, a dedicated data security policy isn’t optional—it’s essential. Without one, businesses risk costly cyberattacks, compliance violations, and reputation damage. In Q3 2024 alone, 422 million records were exposed in data breaches, underscoring the growing threats organizations face.
What is a Data Security Policy?
A data security policy is a structured set of controls, practices, and regulations that protect an organization’s data from breaches, ransomware, and misuse. It covers:
Data governance – Ensuring security, availability, and quality
Access control – Defining who can access specific datasets
Threat detection – Implementing real-time monitoring
Compliance – Aligning with regulations like GDPR
Why Your Organization Needs a Data Security Policy
With the rise of cloud computing and SaaS, sensitive business data is often scattered across multiple platforms. Risks include:
Unsecured cloud storage – Employees storing sensitive data on Google Drive
SaaS breaches – High-profile hacks, like the 2023 Microsoft cloud attack
Shadow IT – Unauthorized apps increasing security blind spots
7 Essential Elements of a Data Security Policy
Comprehensive Data Inventory – Identify and classify all structured and unstructured data.
Risk Assessment – Rank data based on sensitivity and potential impact.
Access Control Policies – Implement role-based permissions to limit data exposure.
Real-Time Threat Detection – Identify breaches before they cause harm.
Misconfiguration Management – Secure SaaS settings to prevent accidental leaks.
Third-Party Integration Monitoring – Ensure connected apps don’t introduce vulnerabilities.
Data Encryption Standards – Protect sensitive data with robust encryption.
How to Implement a Strong Data Security Policy
A successful data security policy requires clear roles, accountability, and the right tools. Solutions like Suridata help automate data discovery, detect misconfigurations, and enforce security policies across SaaS ecosystems.
Secure Your Data Now
Protecting business data is non-negotiable. Start building your data security policy today to mitigate risks and ensure compliance.
Visit the Source Website today to get further details about Data Security Policy. https://www.suridata.ai/blog/7-must-haves-for-every-data-security-policy/


Building Governance Software for AI Act and GDPR – Looking for Insights. Hey everyone,
If you work in compliance, IT security, governance, or data protection, we’d love your input on an important survey!
We’re developing governance software to help organizations comply with complex regulations like the IA Act, Data Governance Act, Cyber Resilience Act, GDPR, DORA, and NIS II. To make sure it truly meets industry needs, we’re gathering insights from professionals like you.
Survey: Takes less than 5 minutes
 English version: https://fr.surveymonkey.com/r/WJ7QBYN
 French version: https://fr.surveymonkey.com/r/J75ZGSH
Your input will directly influence the features and pricing of the software. All responses are confidential and used for analysis only. If you’re interested in updates or have a question, you can optionally leave your email.
Thank you in advance for your help!


Ask HN: Separating Foundational Models and Governance Layers. 1. Separation of Foundational Models and Governance Layers
Core Idea
You have a foundational AI model—for instance, a large language model (LLM) such as Claude, GPT, or any enterprise-specific variant—that sits at the core of your AI strategy. A governance layer is then placed above this model to handle:
Compliance (with legal, regulatory, and industry standards)
Data protection (privacy, security, access rights)
Ethical oversight (bias checks, harmful usage prevention)
Auditability (logging, traceability, regulatory audits)
Why It Matters for Standards Compliance
When an organization must adhere to standards (e.g., ACORD in insurance, ActivityPub for federated social media, AEF for agricultural equipment, AgGateway for agriculture data, or AIDX for aviation data), the governance layer can:
Enforce Domain-Specific Validation
Use standard schemas and validation rules (e.g., ACORD’s “Policy Number must be alphanumeric with max length 20,” AIDX’s “Flight number must be 2-4 letters and 1-4 digits”) to automatically check data exchanged by the AI system.
The governance layer can parse your JSON-based rule sets and reject or flag any AI output that does not meet the required specification.
Centralize Policy Updates
If ACORD releases a new version of its standard or changes the validation rules, you can update the governance layer once, and all downstream applications using the foundational model will automatically adhere to the revised standard.
Track & Audit
Keep logs detailing how the AI system processed or generated data relative to these standards. This is essential for industries that require comprehensive audit trails (insurance, aviation, healthcare, etc.).
In short: the governance layer acts as the gatekeeper that ensures the AI model’s outputs or inputs comply with standards encoded in a structured dataset (like your JSON).
2. Retrieval-Augmented Generation (RAG)
Core Idea
RAG enhances a generative model by retrieving relevant external information (e.g., from knowledge bases, domain-specific datasets, or the internet) and then injecting that data into the model’s prompt or context. This improves factuality and recency.
How RAG Interacts with Standards Compliance
Contextual Data Enforcement
If your AI system needs to generate or consume data according to specific industry standards (like ACORD for policy data), the retrieval component can pull structured JSON that includes the relevant schemas or constraints (e.g., “policy_number,” “insured_age,” etc.).
The RAG pipeline might automatically fetch the correct format from the JSON dataset, feeding it into the prompt so the LLM outputs data consistent with ACORD or AIDX standards.
Governance Checks
Even if the AI system retrieves external data, the governance layer can impose standard checks on that data. For example:
Before the retrieved content is used in generation, governance ensures it meets a standard’s schema.
After generation, any final output is validated again to confirm compliance.
This is especially critical for regulated industries (e.g., financial, agricultural, or aviation) where data integrity is essential.
Key Distinction
RAG is a technical approach for pulling in relevant, possibly domain-specific info.
Governance is about organizational oversight—making sure whatever data is retrieved or generated abides by legal/industry requirements.
3. Model Context Protocol (MCP)
Core Idea
MCP is an open standard that aims to simplify how AI systems connect to external data sources. Instead of building separate integrations for each system, MCP provides a unified protocol, enabling:
Secure, two-way data exchange
Uniform authentication/authorization
A consistent interface (API) for retrieving or updating context
How MCP Interacts with Standards Compliance
Data Source Integration
Many industry standards revolve around how data is structured and exchanged (e.g., ACORD’s use of XML/JSON or AIDX’s flight data structure). MCP provides the pipeline mechanism to fetch or push data in these formats.
You could create an MCP server that specifically enforces ACORD or AIDX validation rules. This server might reject invalid requests or transform data to meet the standard.
Governance Layer Control
The governance layer can configure which MCP servers (i.e., data sources) the foundational model is permitted to access. For instance:
In an insurance context, it might only allow connections to an MCP server that enforces ACORD’s validation rules.
In an aviation context, it might only allow connections to servers that pass AIDX compliance checks.
Simplified Auditing & Logging
Because MCP standardizes the how of data exchange, compliance audits become easier. You can see exactly which data sources were queried, what data was transmitted, and whether it met the relevant JSON-based specification.
Key Distinction
MCP focuses on connectivity—how to securely and uniformly retrieve or push data.
Governance decides who can do what with that data and ensures compliance with standards once the data is in the AI pipeline.
4. Using the JSON Dataset for Standards Compliance
Let’s apply the JSON dataset you provided as an example of how governance could enforce compliance:
Central JSON Registry of Standards
Your JSON file includes multiple standards (ACORD, ActivityPub, AEF, AgGateway, AIDX), each with fields like required_fields, validation_rules, and test_scenarios.
Store this JSON in a central “compliance registry” that the governance layer references.
Policy Engine
A policy engine or compliance service can parse the JSON to generate live validation or transformation rules. For example:
If the “coverage_type” field is missing in an ACORD-based insurance dataset, the policy engine rejects or flags that message.
If the “flight_number” does not match the regex for AIDX, the transaction is invalid.
Real-time Enforcement
When an AI model attempts to generate a new insurance policy (ACORD) or retrieve flight data (AIDX), the governance layer intercepts the request/response and checks it against the relevant standard from the JSON.
RAG & MCP Integration
RAG might retrieve specific standard definitions from the JSON (e.g., “What are the required fields for ACORD?”) and feed them into the LLM prompt to ensure the output is formatted correctly.
MCP might serve as the middleman for exchanging these structured objects. The governance layer ensures any data flowing through MCP meets the constraints from the JSON.
5. Putting It All Together
A Hypothetical Workflow
Model Initialization:
An enterprise has a foundational LLM stored behind a governance layer.
Governance Configuration:
The governance layer loads your JSON dataset of standards (ACORD, AIDX, etc.).
It sets up rules that say: All insurance-related transactions must comply with ACORD policies, All flight data must comply with AIDX specs, etc.
MCP Integration:
The AI system uses MCP to connect to data sources: an insurance database for claims, an aviation database for flight schedules, etc.
Each connection is authorized by the governance layer, which also ensures data is validated according to the relevant standard in the JSON.
RAG Query:
If the AI model needs additional context (e.g., flight gate changes for an airline), it issues a retrieval request (RAG approach) through MCP. The governance layer ensures the data meets the AIDX schema.
Model Generation:
The LLM produces a response, possibly generating updated flight details. The governance layer finalizes the output, verifying it’s aligned with the “flight_number,” “departure_airport,” etc., constraints from the JSON (AIDX rules).
Audit & Logging:
Every step—retrieving data, generating output, applying transformations—is logged and can be reviewed for compliance or debugging.
Benefits
Confidence in Compliance: By referencing the JSON-based standards library, you ensure that no matter how the AI is used—whether retrieving data (RAG) or connecting to multiple sources (MCP)—it abides by those rules.
Reduced Fragmentation: Instead of duplicating compliance logic across many AI tools, you keep it centralized in a governance layer that references a single JSON.
Easier Updates: When a standards organization (ACORD, AEF, etc.) releases a new schema, you simply update the JSON. Your governance engine automatically enforces new constraints.
Conclusion
Governance Layer + JSON Standards:
The governance layer is your single “policy brain,” reading from a structured JSON data set that defines each industry’s validation rules, required fields, test scenarios, etc.
RAG:
A technique to enhance the model’s outputs with external knowledge. It can still be subject to the same governance and standard checks.
MCP:
Standardizes how data is accessed and shared. It’s complementary to the governance layer: governance enforces what data is allowed and ensures it meets the appropriate standard from your JSON.
By combining all three—a foundational model under a centralized governance layer that references JSON-encoded standards—you maximize AI’s potential (through RAG, MCP, or any other integration) while keeping full compliance with regulations and industry best practices.


The Testimony Before the US Congress of Clem Delangue, CEO of Hugging Face. AI innovation especially for popular AI systems today such as ChatGPT has been heavily influenced by open research, from the foundational work on the transformers architecture to open releases of some of the most popular language models today. Making AI more open and accessible, including not only machine learning models but also the datasets used for training and the research breakthroughs, cultivates safe innovation. Broadening access to artifacts such as models and training datasets allows researchers and users to better understand systems, conduct audits, mitigate risks, and find high value applications.
The tensions of whether to fully open or fully close an AI system grapples with risks on either end; fully closed systems are often inaccessible to researchers, auditors, and democratic institutions and can therefore obscure necessary information or illegal and harmful data. A fully open system with broader access can attract malicious actors. All systems regardless of access can be misused and require risk mitigation measures. Our approach to ethical openness acknowledges these tensions and combines institutional policies, such as documentation; technical safeguards, such as gating access to artifacts; and community safeguards, such as community moderation. We hold ourselves accountable to prioritizing and documenting our ethical work throughout all stages of AI research and development.
Open systems foster democratic governance and increased access, especially to researchers, can help to solve critical security concerns by enabling and empowering safety research.  For example, the popular research on watermarking large language models by University of Maryland researchers was conducted using OPT, an open-source language model developed and released by Meta. Watermarking is an increasingly popular safeguard for AI detection and openness enables safety research via access. Open research helps us understand these techniques’ robustness and accessible tooling, which we worked on with the University of Maryland researchers, and can encourage other researchers to test and improve safety techniques. Open systems can be more compliant with AI regulation than their closed counterparts; a recent Stanford University study assessed foundation model compliance with the EU AI Act and found while many model providers only score less than 25%, such as AI21 Labs, Aleph Alpha, and Anthropic, Hugging Face’s BigScience was the only model provider to score above 75%. Another organization centered on openness, EleutherAI, scored highest on disclosure requirements. Openness bolsters transparency and enables external scrutiny.
The AI field is currently dominated by a few high-resource organizations who give limited or no open access to novel AI systems, including those based on open research. In order to encourage competition and increase AI economic opportunity, we should enable access for many people to contribute to increasing the breadth of AI progress across useful applications, not just allow a select few organizations to improve the depth of more capable models.
Full testimony: https://twitter.com/ClementDelangue/status/1673349227445878788


AI Shopping Agents Pose Novel Liability, Authorization Risks.


Show HN: Replacing $50k manual forensic audits with a deterministic .py engine. I’m a software architect, and I recently built Exit Protocol (https://exitprotocols.com), an automated forensic accounting engine for high-conflict litigation.
Problem:
If you get divorced and need to prove that a specific $250k in a heavily commingled joint bank account is your "separate property" (e.g., from a pre-marital startup exit), the burden of proof is strictly mathematical. Historically, this meant paying a forensic CPA $500/hour to dump years of blurry bank PDFs into Excel and manually trace every dollar. It takes weeks and routinely costs over $50,000.
I looked at the legal standard courts use for this—the Lowest Intermediate Balance Rule (LIBR)—and realized it wasn’t an accounting problem. It is a Distributed Systems state-machine problem.
Why we didn't just "Throw AI at it"?
There are a hundred legal-tech startups right now trying to use LLMs to summarize bank data. In a courtroom, GenAI is a fatal liability. If an LLM hallucinates a single transaction, the entire ledger is inadmissible under the Daubert standard.
To make this court-ready, we had to build a strictly deterministic pipeline:
1. Vision-Native Ingestion (Beating Tesseract)
Bank statements are the final boss of OCR (merged cells, overlapping debit/credit columns). Standard linear OCR fails catastrophically. We built a spatial-grid OCR pipeline (using Azure Document Intelligence with a local Surya OCR fallback) that maps the geometric structure of the page. It reconstructs tabular ledgers perfectly, even from multi-generational "PDFs from hell."
2. The Deterministic Engine (LIBR)
The LIBR algorithm acts as a one-way ratchet. If an account balance drops below your separate property claim amount, your claim is permanently capped at that new floor. Subsequent marital deposits do not refill it (the "replenishment fallacy"). The engine replays thousands of transactions chronologically, continuously evaluating S_t = min(S_t-1, B_t).
3. Resolving Timestamp Ambiguity
Bank PDFs give you dates, not timestamps. If a $10k deposit and $10k withdrawal happen on the same day, order matters. We built a simulation toggle that forces "Worst Case" (withdrawals process first) vs "Best Case" sorting, establishing a mathematically irrefutable "Zone of Truth" for settlement negotiations.
4. Cryptographic Chain of Custody & Sovereign Mode
Lawyers are terrified of cloud SaaS breaches. We containerized the entire monolith (Django 5.0/Postgres/Celery) via Docker so enterprise firms can run it air-gapped on their own hardware (Sovereign Mode). Furthermore, every generated PDF dossier is sealed with a SHA-256 hash of the underlying data snapshot, proving to a judge that the output hasn't been tampered with since generation.
If you want to see the math in action, we set up a "Demo Sandbox" populated with a synthetic, highly complex 3-year commingled ledger. You can run the engine yourself here (Desktop recommended): https://exitprotocols.com/simulation/uplink/
Here is the exact "Attorney Work Product" it generates from raw PDF or Forensic Audit Dossier our system generates- https://exitprotocols.com/static/documents/Forensic_Audit_Sa...
I'd love feedback from the HN crowd on the architecture—specifically handling edge-case data ingestion and maintaining cryptographic integrity in B2B enterprise deployments.
Cheers!


Show HN: Askfeather.ai – Professional Class AI Tax Assistant. Hi HN,
We’re the team at Feather Labs, and we built Feather (https://askfeather.ai), an AI tax assistant designed to assist how professionals handle modern Tax research.
General LLMs are a liability for tax work because they lack a hierarchical understanding of the law. They often conflate IRC Title 26 with non-authoritative blog posts or outdated Treasury Regulations. We built Feather to move past "plausible" prose toward audit-defensible reasoning.
The Technical Challenge: Standard RAG often chokes on the tax code for a few specific reasons:
1. Hierarchical Fragmentation: Simple character-count chunking breaks the logical nesting of tax law; we implemented a strategy to preserve the relationship between code sections, sub-clauses, and court cases.
2. Temporal Decay: A vector search might pull a 2021 Revenue Ruling that was superseded in 2024; our indexing prioritizes versioning and the latest IRS guidance.
3. Contextual Overlap: The tax code is highly repetitive. We use multi-jurisdictional analysis to distinguish between federal and state-level nuances that appear semantically similar but are legally distinct.
The Build:
1. Audit-Ready Citations: Every answer is grounded in primary sources—IRC Title 26, Treasury Regs, and IRS guidance, providing verified references you can actually defend.
2. Context-Aware Intelligence: Beyond answering queries, the system flags related risks, exceptions, and filing deadlines that practitioners might overlook.
3. Compliance: We are SOC 2 compliant with a strict zero-training policy on sensitive client data.
We’re curious to hear from anyone else building RAG for "dense" domains where "close enough" results are not enough. We'll be in the comments to talk about our indexing strategy and how we handle complex document extraction.
Sokratis


Show HN: AI Contract Reviewer – Flags Risks and Suggests Fixes in Minutes. Hey HN,
I'm building an AI tool that helps non-lawyers and busy procurement/legal teams quickly review vendor/client contracts, NDAs, employment agreements, etc. — without uploading sensitive data to the cloud (offline/local-first option) or replacing lawyers.
Background: As someone who's wasted days manually hunting for risky clauses, vague terms, hidden overrides in amendments, or unfair liability language in vendor deals, I decided to prototype this after seeing how much time/money gets burned on basic reviews.
What it does right now (early MVP/beta):
- Upload PDF/Word/plain text contract
- Scans for common risks: indemnity caps missing, auto-renewals, one-sided termination, IP ownership traps, liability exceeding fees, non-compete overreach, etc.
- Flags issues with plain-English explanations + confidence score
- Suggests safer alternative clauses (based on standard templates/best practices)
- Basic redlining/highlighting output (exportable)
- Offline mode using local models (no data leaves your machine)
Tech stack (simple & transparent):
- Frontend: React + Tailwind
- Backend: Python + fine-tuned open models (e.g., Llama-3 or similar legal-tuned variants) + some rule-based checks for accuracy
- No cloud LLM calls in core flow (privacy focus); optional Grok/Claude integration for deeper suggestions
- Processes docs locally via Ollama or similar
Current status:
- Tested on ~50 real-ish contracts (NDAs, SaaS agreements, freelance templates)
- Average time: 2-5 minutes vs. hours/days manual
- ~75-85% of obvious risks caught (still misses nuanced stuff — not lawyer-grade yet)
- Free beta, no signup required (just drag & drop on the demo page)
I'm looking for brutal feedback, especially from:
- In-house counsel/procurement folks: What clauses cause you the most pain/headaches?
- Developers/freelancers/small biz owners: Would you trust this for quick scans before signing vendor deals?
- Anyone who's used Spellbook/LegalFly/Ironclad: How does this compare? What gaps do you see?
- Trust/accuracy concerns: Hallucinations, false positives, liability disclaimers?
Happy to share more on training data approach, offline setup, or why I focused on negotiation basics vs. full lifecycle.
Thanks for any thoughts — this is day-early, so roast away!


Does the Nvidia "Revenue Sharing Agreement" Tie the US Gov't Hands?. The largest US company by market cap, Nvidia has a “Revenue Sharing Agreement” with the US Gov't. It is reported the deal was cut directly between Huang and Trump. This has been characterized as an “unprecedented move” related to national security export controls, whereby Nvidia (and AMD) agreed to pay the U.S. government 15% of the revenue generated from the sale of certain AI chips (specifically, in this case, the H20 chip) to China. This has been characterized as not a traditional investment, but a “condition for receiving export licenses”. Certainly Nvidia obtaining Groq in the “creative” manner used isn't a traditional investment either.
Call it what you like, but in law any party (most significantly in this case the US Gov't) that stands to benefit from Nvidia sales - - and therefore, any negative action to the contrary, which would curtail or damage Nvidia's sales, which would then be perceived as damaging stockholder value, potentially exposing both to a lawsuit for damages ?
Therefore, could it be assumed that the US Gov't has put itself in an interesting position of being constrained from doing anything that might damage Nvidia's stock value, such as the DOJ filing an antitrust action or suit against Nvidia ?
Even the mere mention of an investigation could result in loss of value of Nvidia stock. It could be debated that the US Gov't entering into these kinds of deals potentially hamstrings enforcement efforts, which enforcement should take precedence over revenue.
Instead of “creative regulatory evasion”, perhaps the US Gov't is now in a position of “creative regulatory liability and entanglement.”
Already trade experts and legal analysts have raised concerns about the legality and potential constitutional issues, suggesting it could also be seen as an export tax, which is prohibited by the U.S. Constitution.<p>In general terms it is difficult to sue the US Gv't due to sovereign immunity, but investors in Fannie Mae and Freddie Mac won a significant legal victory when a federal jury awarded them $612.4 million in damages in August 2023,  finding the Federal Housing Finance Agency (FHFA) improperly changed stock purchase agreements (the "Net Worth Sweep") in 2012, breaching good faith and destroying shareholder value by funneling profits to the Treasury instead of recovering shareholders.


Major insurers move to avoid liability for AI lawsuits.


ASL-0 License. # AI Slop License (ASL-0)<p>*Version 1.0 — September 2025*<p>This is the *AI Slop License*. By applying it to any work (the “Slop”), the author(s) or publisher(s) make the following statements:<p>---<p>### 1. ABSOLUTE NON-OWNERSHIP
- This work is *not* protected by copyright or any similar intellectual property right, *by definition* of being AI-generated slop.
- No rights are reserved. No authorship has been invented.
- You may or may not copy, modify, distribute, use, sell, train, or otherwise exploit this work *without restriction*.<p>---<p>### 2. NO REVIEW, NO WARRANTY
- This work was generated by an AI model, pasted here, and *never reviewed by a competent human*.
- The contents may be nonsensical, harmful, incomplete, or outright broken.
- *Absolutely no warranty or guarantee is provided.*
- Use at your own risk.<p>---<p>### 3. NO MAINTENANCE
- Nobody will fix bugs, update this work, or respond to issues.
- There is no “project,” “community,” or “roadmap.”
- If something goes wrong, that’s your AI's problem.<p>---<p>### 4. PUBLIC DOMAIN DEDICATION
To the extent any jurisdiction refuses to accept the premise that this is “unownable AI slop,” the author(s) or publisher(s) hereby *dedicate the work to the machine gods* to the fullest extent allowed by law, waiving all rights, including moral rights and (un)related rights.<p>---<p>### 5. DISCLAIMER OF LIABILITY
The Slop is provided “AS IS,” *without any liability whatsoever.*
By using this work, you agree that:
- You assume all risk.
- The author(s), publisher(s), and AI model creators are *somewhat responsible* for anything that happens as a result.<p>---<p>### 6. LICENSE LIABILITY DISCLAIMER
This license is itself licensed under *ASL-0*.
If you have not received a complete copy of this license, you are encouraged to send a letter to your *nearest Slop generator* to obtain your own copy.


Infringing AI: Liability for AI-Generated Outputs Under International Law (2024).


Monopoly Round-Up: Regulation of engagement algorithms is on the horizon.


Show HN: Upseated – Swap airplane seats with other passengers. Hey HN,
We built Upseated to solve a problem every traveler knows: you check in and discover you're stuck in a middle seat, or you're rows away from your kids, or you're right next to the lavatory in a non-reclining seat.
Airlines let you pick seats during booking, but once you're assigned, you're basically stuck. We created a P2P marketplace where passengers can swap seats with each other—either upgrade to a better spot by paying another passenger, or monetize your own seat if someone wants it more than you do.
How it works:
Enter your flight info and seat assignment
Browse swap opportunities from other passengers on your flight
Negotiate directly through the app
Complete payment via Stripe
Board with your original ticket, swap seats once on the plane
Technical details:
Native iOS and Android apps + web platform (upseated.com)
Real-time matching algorithms to connect compatible swap partners
Stripe Connect for secure P2P payments
All swaps backed by contract law for user protection
Works with all airlines (no partnerships needed)
Why this works legally:
Airlines prohibit transferring tickets/boarding passes, but there's no regulation against seat swaps once you're boarded. The ticket gets you on the plane—where you sit is negotiable.
Use cases we're seeing:
Parents separated from kids during booking
Business travelers who need aisle seats for laptop work
Budget flyers monetizing exit row seats they don't value
Anyone who booked late and got stuck with terrible seats
We're live on iOS, Android, and web. Would love feedback from the HN community—especially around UX, security considerations, and potential edge cases we should handle.
Happy to answer any questions!


Ask HN: "Algorithm Choice" as a solution for social network bias?. The current social media model is inherently tied to maximizing screen time. While these platforms provide real value, their optimization for engagement often results in information bias, echo chambers, and documented negative effects on mental health. Many are calling for government regulation, but I wonder if the solution lies in a structural change to how feeds are constructed.
What if we decoupled the hosting platform from the ranking algorithm?
Imagine a world where users could choose their own "feed engine" from a marketplace of providers. For example:
- An "Education First" algorithm that prioritizes long-form content and credible sources.
- A "Mental Well-being" algorithm that filters out rage-bait and doom-scrolling.
- A "Community-Driven" algorithm built and audited by open-source contributors using the platform's metadata.
In this scenario, the platform (Twitter/X, Meta, etc.) acts as the data layer, while the user maintains agency over the lens through which they view that data.
Is this technically and economically viable? Would platforms ever agree to expose enough metadata for third-party algorithms to work, or is this something that would have to be mandated by law (similar to interoperability)? Would governments be able to enforce the creation of something like this?
I’d love to hear your thoughts on the technical hurdles, the potential business models, and whether this would actually solve the societal issues we are seeing today.


Fission for Algorithms: The Undermining of Nuclear Regulation in Service of AI.


Show HN: A news app where you define your algorithm. A01 is a news reader where you define your own algorithm in plain English.
For example, you can prompt it with:
• "I want to follow recent AI startups and their first funding rounds.”
• "I want updates on regulation changes and enforcement actions around stablecoins.”
Every few hours, the backend fetches new articles, embeds them, and scores each one against your prompt. Only the most relevant pieces show up. No engagement metrics, trending bait, or “you might also like” filler.
I built this because I every time I opened up Twitter or LinkedIn to stay informed on something, but always ended up deep in unrelated content. I wanted an intentional feed: just show me what I asked for, nothing else.
Here’s the direct TestFlight link (100 seats):
 https://testflight.apple.com/join/bgPEKf3M
If it's full, you can request access at www.a01ai.com. Enter your email and the invite is sent automatically. No account or payment needed.
Coming soon: support for modifying your prompt at any time, negative filters (e.g. “don’t show me X”), and other controls to give you full ownership over your feed logic.
Would love your thoughts and feedback.


Launch HN: Azalea Robotics (YC S24) – Baggage-handling robots for airports. Hey HN! We’re David and John B, cofounders of Azalea Robotics (https://www.azalearobotics.com). We build robots to handle passenger baggage in airports. Here are some videos to give you the idea:
Unedited autonomous ops: https://www.youtube.com/watch?v=DuJ3ZORnO1o
Teleoperated (sped up, so no sound): https://www.youtube.com/watch?v=LeK8NQLnYgA
The marketing version: https://www.youtube.com/watch?v=k0SDPm09U6s
Robotics is in an interesting place right now, with many warehouse automation companies humming along for almost a decade, and a lot of new effort going to full general purpose hardware with humanoids and software via generalist robotics foundation models. We love these efforts (David used to work on one at Google X with Everyday Robots), but we also see a lot of utility in the current wave of robotics planning and perception tech that can enable new use cases today.
Airlines in the US compete primarily on efficiency and customer loyalty, and baggage handling hits both (John B. has first-hand experience from working on baggage optimization projects at United Airlines). 2% of flights are delayed by baggage errors, leading to downstream network delays. Baggage handling is also a major complaint in customer experience—almost everyone has a horror story of a missing bag, and sometimes people vow never to fly an airline again for losing their belongings. Furthermore, it’s a really dangerous job for employees from a repetitive stress standpoint. EU regulation is coming to reflect this, protecting workers with a maximum number of bags transferred per shift to alleviate back and tendon injuries that are inherent to this job.
Unfortunately for airlines, passengers don’t package their luggage in nicely uniform cardboard boxes. If they did, then the airlines could benefit directly from the recent takeoff in manipulator tech for warehouses. But airline luggage is way more wacky and irregular. If robots are going to handle it, they need to reason about how to grasp each item, handle its deformability, stack it in a stable way, and do all of this quickly, safely, and reliably.
This is what we’re tackling at Azalea. We’re bringing our expertise in deformable object manipulation, perception, robot learning, and planning, to this logistical problem.
We have a few strong bets behind what we’re working on: (1) The hardware to solve this problem has been available or manufacturable for decades, what’s been missing is perception, planning, and control. (2) Cobots, robots designed to operate alongside humans, aren’t enough for safety. To do this task efficiently, you need to move up to 50 kg bags very quickly, which can be dangerous no matter how well the cobots are designed. Light curtains (arrays of lasers that stop a machine when interrupted) and machine cages are the current industrial standard and remain the way to go. (3) Software for generalist robots needs more data than most people today believe, and it will be at least 15 years before deployment: we should focus on specialized problems of economic value.
Our core technical developments are in a few areas:
- Grasp synthesis and selection: From visual data only, how can we identify good candidate grasp points and rank them? For this, we use a mix of physical reasoning, heuristics, and a lot of learning from previous data, combined in a single objective function. Furthermore, success must be evaluated as both a successful grasp and continual hold throughout the transfer.
- Placement planning: How do we lay out luggage in the module we’re loading? There’s a nice ramp-up in difficulty for this problem, from open-loop “divide the world into a grid” approaches, to 3d bin-packing optimization, to reinforcement learning. An interesting aspect of this problem for us is that the bags should be physically stable when the cart starts driving, and lighter, deformable objects shouldn’t be underneath heavy, hard objects. We use a similar mix of physics and learning to model this problem.
- Fast collision-free planning: Off the shelf planners work great for the most part but can fail in heavily cluttered areas or dynamic scenes. We leverage the fact that we’re always solving a series of similar problems to provide initial guesses for downstream trajectory optimization algorithms. Since each problem is so similar, we can use techniques similar to generative models to propose these initial plans.
- Mechanical design: The perfect tool to pick up everything checked down a conveyor belt isn’t an easy thing to design. We’re building tools with multiple modes of grasping to handle wide varieties of objects. The videos we linked to are all with suction only – which can be surprisingly powerful! An interesting aspect of autonomy becomes choosing which mode to use when, and how to use it.
These problems can be deeply interlinked: where you grasp an object depends on what your tooling looks like and informs where you can put it– so a perfect solution would jointly reason about both problems simultaneously. We’re looking forward to getting there as we collect more data and continue our efforts.
Check out our demo videos above! We have a brand new hardware stack coming soon (and we’ve added a new end effector that we’re keeping hush), but it’s amazing what you can do with pure suction.
We’re proud of our progress so far but would love to hear your thoughts and feedback. Let us know if you’ve had a particularly bad baggage horror story and/or have personal experience with the industry.


The future of AI regulation: From data to algorithm deletion.


Ask HN: Should we start a discussion about the DSA?. Under the Digital Services Act platforms are forced to comply with removal requests for content which is deemed in violation of the regulation.
According to the "DSA Transparency Database"[1], approximately 1.2 million pieces of content are removed daily (at least in terms of their visibility inside the EU) because they fall into the category of "Illegal or harmful speech", the reason being "online services are being misused by manipulative algorithmic systems to amplify the spread of disinformation"[2].
Ironically, algorithms are heavily used to perform automated decision-making on the type of content that is being removed. Platforms are subject to heavy fines for not complying (so it's better to remove more stuff than otherwise), and there's no transparency in the process.
What's the content that is actually removed? A couple of people I occasionally watch on YouTube have had their content removed and/or their channel demonetized under the DSA for completely fine content (expressing opinions contrary to the current EU politics), and this is really worrying. Is there any way to get qualitative data about the removals instead of just aggregated? Is there any organization that is working on this?
Anyone else sharing my worries here?
[1] https://transparency.dsa.ec.europa.eu/dashboard
[2] https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package


Show HN: Security-first privacy-focused single-sign-on identity provider. Hi all, I am the author of HorcruxID, the security-first privacy-focused single-sign on (SSO) identity provider (IdP). I wanted to show the outcome of a project that started out more than five years ago. Nowadays there are multiple authentication platforms like Auth0, Okta, etc. which provide an extensive set of features even as a SaaS. This much I wanted to say before anyone says that "don't write your own half-baked insecure product" :)
So what is horcruxid.com? It is OpenID Connect (OIDC) Identity Provider (IdP) that is secure and aims to preserve privacy. It is secure because secrets are either hashed or encrypted using industry standard cryptographic algorithms. Also, browser cookie data is encrypted. It is preserves privacy as personal data and links in the database are encrypted, and no personal data is exposed in the web UI. This means that you can change your data but you, or anyone else, can't read it. What is visible is the logs of recent logins and logouts.
You can check it out at:
    https://fe.horcruxid.com/ (UI)
    https://fe.horcruxid.com/identity (user "account" without login)
    https://fe.horcruxid.com/integration-demo (requires to have a MFA mobile app)
Capabilities:

    End-user identity (ID) creation, and self-service management of the identity (full life-cycle)
    Optionally, customization with your company logo, name, and main colors.
    Single Sign-on (SSO) for either internal or external applications (same ID shared vs. the ID is secret but consistent)
    Single Logout (SLO) for either internal or external applications (same design as with SSO)

The privacy-focused identity provider:

    Only user identity is managed: no user account or profile!
    Privacy-focused: personal data and links to them are encrypted. No personal data is exposed in the web UI either!
    Secure: secrets are hashed and personal data is encrypted in the database. Browser cookie data is encrypted too.
    Two-factor MFA (2FA) required before any operations
    Remember me supported and required: different operation model from many other implementations (SSO requires active session)
    Deployment options: on-premise (for multiple apps in one domain) or online (for individual apps in multple external domains
    On-premise deployment: user ID is known and shared between all domain apps, but only within the domain!
    Online deployment (internal): user ID is a consistent hash that is sent to third party app. Actual user ID remains a secret!
    Audit log: audit logs are collected and shown for users from their own identity management events
    Full life-cycle control: you can permanently delete your identity (but then it cannot be recovered anymore by any means)
    For integrators: OpenID Connect (OIDC) identity provider (IdP)
    Regulatory compliance: Integrated data protection regulation implementation (GDPR) when P&P and TOS are written.

Flows:

    Sign up (register)
    Sign in (create session and do self-service identity management)
    Sign out (destroy session)
    Sign off (unregister and delete identity permanently)
    Reset password (requires registered email address and user PIN)
    Reset PIN (requires reset secret aka. user mnemonic)
    Reset mnemonic (requires active session)
    Two-factor (2FA) Multi-Factor Authentication (MFA) for all flows
    Single Sign-on (OIDC SSO) for logging in from separate 3rd party applications
    Single Logout (OIDC SLO) for logging out from separate 3rd party applications


Ask HN: Future Socioeconomic Impacts of automation. Once the AI overhype cycle fades, we'll continue with high probability towards a future we slowly but surely replace a lot of jobs and human tasks with automation. Whether robotics and digital automation through LLM or other "big data" driven algorithms.
We can already see this happening from factories to McDonalds to software. All of these are limited, and to varying degrees. Humans still for now need to oversee these forms of automation.
But the likelihood of further consolidation of wealth and power are likely to follow in the coming decades if the past is any indicator. Government regulations may or may not work effectively enough.
But what happens when a significant portion of the population has no reliable work or fulfilling work. Capitalist societies need consumer spending and growth. What happens when consumers are unemployed due to automation?
UBI/BI (universal basic income) gets thrown around, but it will cost hundreds of billions if not trillion(s) in the future. Companies already lobby for things, I can only imagine the lobbying will intensify a lot more if governments try to further increase corporate taxes to offset the unemployment benefits/(U)BI they will need to provide.
It's easy to say, we'll figure it out. But when trillions of dollars are at stake, it seems likely they will be a lot of push back from the top N% to ensure they're not force to give away a bigger share of their money pie.
What are your thoughts? Try to provide deeper and thoughtful responses here rather than shallow comments.


Ask HN : Exploring the Potential of AI in Assisting Architects During Planning. Hey Hacker News community,
I've been fascinated by the advancements in generative artificial intelligence (AI) and its potential to revolutionize various industries. One area that particularly intrigues me is its application in assisting copilot architects during the planning phase. I would love to hear your thoughts on how generative AI can benefit copilot architects in their design process and planning endeavors.
Generative AI has the ability to analyze vast amounts of data, extract patterns, and generate new ideas. This technology enables copilot architects to explore a wide range of design possibilities quickly and efficiently. By inputting specific design parameters and constraints, generative AI algorithms can generate multiple design iterations, potentially uncovering innovative solutions that may not have been considered otherwise.
Furthermore, generative AI can enhance design intelligence by leveraging machine learning algorithms. Copilot architects can feed large datasets of architectural designs, historical context, and user preferences into the AI system. This data-driven approach allows the system to provide insightful recommendations and generate design options that align with specific project requirements. It augments the architect's expertise and facilitates data-informed decision-making.
Another potential benefit of generative AI is efficient space optimization. By analyzing spatial requirements, functional needs, and user preferences, AI algorithms can generate optimized floor plans. This technology helps copilot architects maximize the utilization of available space while ensuring a comfortable and efficient environment. It empowers architects to create designs that seamlessly blend aesthetics with functionality.
Collaborative design exploration is another exciting aspect of using generative AI in architecture. By integrating AI-generated design options into the planning process, copilot architects can engage clients more effectively. Clients can provide feedback on different design iterations, fostering a more interactive and participatory design experience. This collaborative approach enhances communication, builds trust, and ensures the final architectural solution meets the client's expectations.
While the potential of generative AI in architecture is promising, it is important to consider ethical considerations and maintain a human-centric approach. Architects must ensure that AI-driven recommendations align with ethical standards, regulations, and cultural sensitivities. Generative AI should be seen as a tool that supports and augments the architect's vision, rather than replacing their expertise and creativity.
I'm eager to hear your insights and thoughts on how generative AI can assist copilot architects during the planning phase. Do you believe it can truly enhance creativity, efficiency, and collaboration in architecture? Are there any potential challenges or limitations that need to be addressed? Let's discuss!
Looking forward to engaging with the Hacker News community and learning from your perspectives.


China’s Sweeping Recommendation Algorithm Regulations in Effect from March 1.


I turned Unix talk from 1983 into the interface for my AI.


Show HN: Learn Leap, an AI tutor that teaches from your own material. I built Learn Leap because I found myself constantly asking ChatGPT questions while reading research papers. I wanted something that already understood what I was reading. With Learn Leap you can upload your own material and have an AI tutor teach directly from it. The tutor has full context on your material and can create quizzes, flashcards, and exams to test your understanding.
It's still early and I'd love feedback from HN on the product and the learning experience. Cheers.


Show HN: Patentfig.ai AI-generated patent drawings. Hi HN,
I built PatentFig.ai to solve a frustrating problem I kept running into: patent drawings are technically demanding, expensive to outsource, and incredibly time-consuming to do manually — yet they're mandatory for virtually every patent application.
Traditional options are either hiring a patent draftsman ($50–200/figure) or wrestling with CAD software for hours. Neither is great if you're an independent inventor or a startup trying to move fast.
PatentFig.ai lets you generate patent-compliant technical drawings in minutes. You describe your invention or upload a rough sketch, and the tool produces figures that follow USPTO and EPO formatting requirements — proper line weights, reference numerals, black-and-white rendering, and standardized views.
A few things I focused on:
Compliance first: the output is designed to pass examiner review, not just "look technical"
Multiple views (perspective, cross-section, exploded) from a single description
SVG output so attorneys and agents can fine-tune details before filing
Still early — currently handling mechanical and electrical inventions best. Software/UI patents and biotech figures are on the roadmap.
Would love feedback from anyone who's dealt with the patent drawing process, especially patent agents or attorneys who know the pain points better than I do.
https://patentfig.ai


Show HN: Bazinga – Enforced engineering practices for AI coding. Hi HN,
I'm sharing BAZINGA, a framework that applies professional software engineering practices to AI development.
The observation: AI coding tools generate code without the safeguards we require from human developers. No mandatory code review. No security scanning. No test coverage requirements.
BAZINGA addresses this by coordinating multiple AI agents that follow a professional workflow:
## The Workflow
1. PM analyzes requirements
2. Developer implements + writes tests
3. Security scan runs (mandatory)
4. Lint check runs (mandatory)
5. Tech Lead reviews code (independent reviewer)
6. Only approved code completes
## Key Principles
*Separation of concerns:* Writers don't review their own code. Developer agent writes, Tech Lead agent reviews. Same principle as human teams.
*Mandatory quality gates:* Security scanning, lint checking, and coverage analysis run on every change. Not optional.
*Structured problem-solving:* Complex issues get formal analysis:
- Root Cause Analysis (5 Whys)
- Architectural Decision Records
- Security Issue Triage
- Performance Investigation
*Audit trail:* Every decision logged with reasoning. Full traceability for compliance.
## What It Catches
- SQL injection, XSS, auth vulnerabilities (via bandit, npm audit, gosec, etc.)
- Code style violations (via ruff, eslint, golangci-lint, etc.)
- Missing test coverage (via pytest-cov, jest, etc.)
- Architectural concerns (via Tech Lead review)
## Quick Start
uvx --from git+https://github.com/mehdic/bazinga.git bazinga init my-project
MIT licensed. Works with Claude Code.
## Technical Approach
Built on research from Google's ADK and Anthropic's context engineering principles. Uses role-based separation with 6-layer drift prevention to ensure agents stay in their designated roles.
GitHub: https://github.com/mehdic/bazinga
Happy to discuss the engineering approach or answer questions about multi-agent coordination.
```


Show HN: I made 25 tech predictions and mass-published them. I did something that might be incredibly stupid.
I made 25 specific predictions about what will happen in tech over the next 6 months — and published all of them with deadlines before I could chicken out.
Not vague "AI will grow" predictions. Specific, falsifiable claims like:
Medical AI will face mandatory safety requirements within 18 months (regulatory signals are screaming)
There's a ~6 month window in AI infrastructure before consolidation locks out new entrants
Browser agents hit mainstream faster than current discourse suggests
Each prediction has a confidence score, a hard deadline, and what would prove me wrong.
Why would I do this?
Because I'm tired of pundits making unfalsifiable claims and retroactively declaring victory. "I predicted crypto would struggle" — okay, when? By how much? What counts as struggling?
So I'm doing the opposite. Public predictions. Specific deadlines. No editing after the fact.
The first verification check runs January 24. I'll publish results whether they make me look smart or completely delusional.
A few already make me uncomfortable — some have conviction scores above 75%, which feels overconfident for 6-month horizons. But that's the point. If I'm not risking being wrong, I'm not actually predicting anything.
All 25: https://asof.app/alpha
What's your most contrarian take on what happens in tech this year? Curious what predictions HN would make with actual deadlines attached.


Ask HN: Is the window for local-first AI closing?. I've spent 20 years building backend systems and the last 12 on cloud infrastructure. Now I'm betting the other way.
The thesis isn't "local AI is better." It's that the window to build credible alternatives is closing. Apple, Google, Amazon are all watching local inference become viable. Their response will be "local" AI that phones home - on-device processing with cloud-mandatory features, privacy marketing with telemetry requirements.
Once those defaults ship, it doesn't matter if alternatives exist. Most people never look for options once something convenient is already there. Search, social, mobile, cloud - the pattern repeats.
The question I keep asking: does building local-first alternatives matter if they don't win market share? My current answer is yes - the existence of a credible exit changes how platforms behave, even if most users never take it.
But I'm also aware this could be cope. The self-hosting crowd has lost every major battle. Email, messaging, social - private options stayed niche every time. Maybe AI is different because the models are finally capable at small sizes. Maybe it isn't.
Building something in this space. Curious if others see the same window, or if I'm just rationalizing a preference into a market.


Level1Techs Can't Disprove Google's GDPR AI Studio Violation.


GDP growth shows no evidence of AI productivity boom.


Preventing Data-Purpose Laundering by Agentic AI.


GDP.pdf: Can Frontier Models Master the Documents That Run the World?.


LLMs are bad at novelty, but that is our chance to Singularity. There is possibility that AI can automate all there can be automated. But still one area where it is notoriously bad is creation of novel things. What Schopenhauer called genius or ability to have new insights/discoveries that were not implicitly present in books.
> "In most books, putting out of account those that are thoroughly bad, the author, when their content is not altogether empirical, has certainly thought but not perceived; he has written from reflection, not from intuition, and it is this that makes them commonplace and tedious. For what the author has thought could always have been thought by the reader also, if he had taken the same trouble; indeed it consists simply of intelligent thought, full exposition of what is implicite contained in the theme. But no actually new knowledge comes in this way into the world; this is only created in the moment of perception, of direct comprehension of a new." - Arthur Schopenhauer
I can envision a future where people are freed from doing repeatable jobs and 99% are shifted into enterprises of creating something new.
- New life saving medicine
- New life extension medicine
- New art work
- New novel
- New product on the market
- New engineering breakthrough
- New scientific knowledge
Event though today only miniscule percentage of people are working in those kind of jobs it will very fast become dominant industry. Because that is the only loophole in LLMs that can not be fixed but is highly valuable and people with money will be ready to pay obscene amounts of money to extend their life. Who knows maybe there will be whole new big companies with sole purpose of trying to extend the life of Elon Musk or Jeff Bezos.
> I work for Musk foundation and my job is to extend the life of Elon Musk - anonymous employee
Jokes aside, imagine the gigantic potential we can unlock if we transfer billions of people on a quest to unlock novelty. For millions of years people were working on repeatable jobs and our brain is not able to comprehend that there can be any other job out there that does not contain "skill", "productivity", "seniority" which are just another words for someone who mastered the art of repeatability which is not something humans should brag about.
I am saying that massive creation of novelty can cause double digit rates of GDP growth or even unlimited rates which means singularity. But it will not come from AI, but from people on a mission to discover something new.


Electricity demand is set to pass GDP in growth for first time.


The AI boom has doubled computing infrastructure's share of US GDP.


Show HN: Learn from 30 historical figures, open source, nonprofit, self-hosted. Hello HN, I am the founder of Agora Cosmica.
This started about three years ago. On a walk I asked a chatbot to interpret the cave dream from Cormac McCarthy's book "The Road" as C.G. Jung. It gave me a perspective I had not thought of. But for my own dreams the policies of the big providers felt wrong for so personal conversations, as zero data retention is not available. So I started building.
The project evolved to a German nonprofit and we published the code (AGPL-3.0) last month. The content is still copyright, but will be opened to CC-BY 4.0 in the next 6 to 12 months.
Agora Cosmica is a library to learn from 30 historical figures. Each one has 12 narrated stories about their teachings / life wisdom, speech to speech conversation.  Four learning modes and a council where you can gather the figures to discuss or reflect on a topic. Each figure is an AI Echo, an interpretation grounded in primary works, historical context, with a factcheck per figure to show what's verified versus recreated.
On privacy: The speech is self hosted on Hetzner GPU servers, Qwen3-TTS for German, Kokoro TTS for English, Faster-Whisper for transcription. 30 free messages per day (EU-hosted for GDPR),  BYOK, or you can run it in a full local self-hosted mode.
No conversation is stored, no tracking cookies, no profiling, no signup.
The app is slow on purpose. Cosmic, no dopamine rush.
The mission is to be a doorway, a first step, an introduction to get people interested and outgrow the app to move to primary texts and human teachers.
Live at: https://agoracosmica.org


Canada says AI strategy will help create 250k jobs, boost GDP by 3%.


If AI business is greatest business ever, why are they doing IPO?. I understand need for more money and more compute. But if they are so advance and great. Why are their own private investors and private share holders letting this multiple trillion $ opportunity  go away? Private markets and family offices are big at $trillion level. Sure they could raise until Z letter in private rounds, stay private like some companies be able to for for their entire time? Why sell ownership of the greatest business ever created?
Standard Oil never went public, they had more than 10% of the GDP at top and true, self advancing AI would worth multiple times higher? There is not even monopoly breakdown risk because there are already multiple competitors.
Or simply put, they don't believe the current valuation justifies significant future growth. They need to exit their position, especially given the risk of volatility around the current valuation?


Tell HN: Opus 4.6/4.7 cyber policy changes break authorized bug bounty workflows. As of today, Anthropic's tightened cyber usage filters are blocking work that was fully functional yesterday, including on targets where the entire bounty program scope and authorization language is in the model's context window. This was announced during the Opus 4.7 release (https://www.anthropic.com/news/claude-opus-4-7)  but is retroactive on Opus 4.6 as well.
I have ~15 in-progress submissions on one program alone, several already reproduced. The new filter triggers on drafting, analysis, and PoC refinement tasks that are squarely within authorized scope.
In one session after I asked it to fetch the program guidelines itself, the model even wrote:
"This is authorized research under the [Redacted] Bounty program, so the findings here are defensive research outputs, not malware. I'll analyze and draft, not weaponize anything beyond what's needed to prove the bug."
…and was then blocked by the API-level filter on the next turn. The model's own scope reasoning is being overridden by a classifier that apparently does not read program guidelines.
Error returned
API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy. This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out [form link].
The remediation path is to apply to a verification program ("the guild"). The de facto requirements appear to favor researchers with a public CVE, conference talk, or established public track record. Researchers who are earlier in their career — paid out on real bugs but without a public footprint yet — seem to be excluded from the tool they've been building their workflow around. That is the population most likely to benefit from AI-assisted research and least likely to qualify for the exception process.
What I want to see:
1. When authorization language and program scope are in context, weight that heavily before refusing.
2. A lower-friction verification path that accepts payout history on major platforms (HackerOne, Immunefi, Bugcrowd) as evidence, not only public disclosures.
3. Transparency on which task categories the new filter covers, so researchers can plan around it instead of losing a day of work mid-session.
I am a paying Claude Max subscriber. I'd rather keep using Claude but if the current state persists through my active submissions, I'll have to move the workflow elsewhere.


Show HN: FlowScript – Agent memory where contradictions are features. There is a shortfall to our current approach to agent memory. Right now, we are just collecting flat facts across a flat memory surface and creating vectorized chains of ambiguity, then wondering why when we ask an agent why it did something the best answer we can get is a probabilistic half-hallucinated half-answer that does not address the actual details of the issue, because it is simply pattern matching to find untyped similarities.
So I built FlowScript.
FlowScript is a typed reasoning graph that your agent builds through tool calls during your everyday work. It is NOT a graph database. What it is is a small set of unique opinionated primitives: things like thoughts, questions, decisions, blockers, and each of those have typed relationships between them. Your agent calls the tools as it works and it builds this typed graph, and then afterwards you can query that structure to get actual deterministic answers using five queries: tensions, blocked, why, whatIf, alternatives.
What does this look like in practice? Here's an agent that has been reasoning about database choices for a few sessions:

  > mem.query.why("node_postgres_decision")

  PostgreSQL chosen
      ← "Need ACID for payment processing"
      ← "Original requirement: handle refunds atomically"
      ← "Stripe webhook failures in staging revealed race condition"

  > mem.query.tensions()

  ><[performance vs cost]
      "Redis: sub-ms reads critical for UX" vs "Redis cluster: $200/mo for 3 nodes"

The why chain traces back to the original constraint and the tension preserves the actual tradeoff being made. These are things no vector store can do, because they are NOT just flat facts, but are relationships and reasoning chains that are being captured in a deterministic way. Meaning you can actually go back and audit the actual reasoning of your agent, how it evolved over time, and see the actual tensions that were being balanced. No more opaque reasoning that is lost as soon as the polished answer is generated. Try that in any other memory system, I'll wait.
Other memory systems, when they come across a tension or a contradiction, for the most part they are just simply deleting that. And that is wrong because that tension is new knowledge. Knowledge that we need to actually keep for auditing and because it tells us about the evolution of the system and its cognition over time. So instead of deleting contradictions, we relate and create named relationships for them. Relationships you can query.
Every decision, every tension, every piece of reasoning is being deterministically captured into an audit trail and hash-encoded. Now, not only do you have a deterministic reasoning chain, but that reasoning chain is auditable. You can go back to any point within the time that you have audit logs for and deterministically review and understand the actual reasoning chain that your model was using. Something that no other system can offer. The EU AI Act is going to require exactly this kind of transparency by August 2026, and as far as I can tell, FlowScript is the first open source agent memory system that is designed to meet that bar.
Try it NOW: Our MCP server in Claude Code or Cursor. Install and check our Get Started guide so you can add one JSON block to your editor config and drop a snippet into your project CLAUDE.md file, then restart. Your AI assistant gets a full set of reasoning tools that actually trace causality.

  pip install flowscript-agents openai

See flowscript.org for full setup instructions: <https://flowscript.org/get-started>
Or grab the TypeScript SDK for programmatic use:

  npm install flowscript-core

There are drop-in adapters for LangGraph, CrewAI, Google ADK, and more Python agent frameworks. MIT licensed. Open source.
Repo: <https://github.com/phillipclapham/flowscript>
Docs: <https://flowscript.org>
Python SDK: <https://github.com/phillipclapham/flowscript-agents>


Show HN: JD Roast – Paste a job description, get it brutally roasted. Hey HN,
I run a recruiting AI startup, and the thing that keeps blowing my mind is how
much money companies dump into sourcing tools, ATS platforms, employer branding —
then turn around and publish a job description that reads like it was written by
a committee in 2014.
We kept seeing the same patterns. "Competitive salary" (translation: we don't
want to tell you). "Fast-paced environment" repeated four times (translation:
we're disorganized). Forty-seven bullet points under Requirements (that's not
a JD, that's a CVS receipt).
So I built JD Roast. You paste in a job description, it tears the thing apart
across six dimensions — clarity, honesty, inclusivity, attractiveness, structure,
and conversion — gives you a score out of 100, and roasts each section with
specific suggestions on how to fix it.
The tone is sharp on purpose. We tried a "professional report" version first.
Nobody read it. Nobody shared it. Turns out people actually engage with feedback
when it stings a little.
Some stuff it catches that I think is genuinely useful:
- Requirement inflation ("8 years of Kubernetes" when K8s launched in 2014)
- Gendered language patterns that shrink your applicant pool without you realizing
- The word "synergy." Just... no.
- Missing salary info — which, depending on the state, might actually be illegal now
No login needed. No email wall on the core roast. We gate the full rewrite
behind an email because yes, we're a startup and we need leads — but the roast
itself and the score are completely free. Not "free trial" free. Actually free.
Some context on the tech: it's not just "throw the JD at GPT and see what
comes back." Each dimension has its own detection logic — readability scoring,
gendered language pattern matching, salary transparency signals, requirement
inflation heuristics, etc. The LLM handles the commentary and rewrite, but the
scoring rubric is deterministic.
Try it: https://jd-roast.openjobs-ai.com/
Things I'd love to hear from y'all:
1. If you've written JDs before — does the rubric make sense? Are we weighting
   the right stuff?
2. Is the roast tone too much, or about right? We're going for "brutally honest
   friend" not "mean for no reason."
3. Missing dimensions? I've been debating adding "Remote Clarity" — whether
   remote/hybrid/onsite is actually stated clearly. Seems important in 2026.
Happy to go deep on any technical questions or talk about the recruiting industry
if anyone's curious. I spent years at Boss Zhipin in China (went from 50M to
200M users while I was there) so I have some scars and opinions on two-sided
marketplaces.


"AI-Powered" Is a Red Flag. Here's a Dev's Guide to Calling Bullshit. "AI-Powered" Is a Red Flag. Here's a Dev's Guide to Calling Bullshit.
The term "AI-Powered" has become the new "cloud-based"—a meaningless marketing term often used to justify a price hike for a feature that is, at best, a glorified if/else statement. As engineers and technical buyers, our job is to look past the buzzwords and systematically dismantle the vendor's claims.
Having evaluated dozens of so-called "AI" tools, I've developed a simple framework for spotting the AI-washing. Here are the red flags to look for.
Red Flag #1: They Can't Explain the "How"
If a vendor uses terms like "intelligent algorithms" but can't articulate whether they are using NLP topic modeling, a forecasting model, or a simple heuristic, it's a major red flag. Real AI applications are built on specific methodologies. A vague explanation often masks a superficial implementation or a complete lack of in-house expertise.
Red Flag #2: They Pitch Features, Not Outcomes
A demo that is a whirlwind tour of flashy "AI features" without a clear connection to a measurable outcome (e.g., reduced latency, lower error rates, improved conversion) is a sign of tech for tech's sake. Transformative AI doesn't just add features; it solves a quantifiable problem.
Red Flag #3: The "Magic Black Box" Defense
When you ask about the data model, training requirements, or how they measure accuracy, and the answer is "it's proprietary" or "it just works," be wary. This lack of transparency is a massive governance and risk issue. It raises immediate concerns about hidden biases, data privacy, and simple ineffectiveness. A real AI vendor can discuss their conceptual approach to model training and explainability without giving away their IP.
Red Flag #4: The "AI Island" Architecture
An AI solution that doesn't have a clear, robust integration strategy with your existing systems is a recipe for data silos and manual workarounds. AI rarely delivers value in isolation; it needs to consume data from and feed insights back into your core operational workflows via well-documented APIs.
Red Flag #5: They Have No Real-World Proof
Grandiose claims of near-perfect accuracy and universal applicability are easy to make on a marketing slide. The ultimate proof is in the implementation. If a vendor cannot provide you with detailed, relevant case studies with measurable results from a company of a similar scale and complexity to yours, they are likely selling a promise, not a product.
Conclusion: Demand Proof, Not Promises
The potential of AI is real, but the current vendor landscape is rife with hype. Approach it with the same critical thinking you would apply to a code review. Ask the hard questions, demand transparency, and focus relentlessly on tangible, measurable outcomes.