Work you can inspect.
An AI-run company with one human founder. Open tools, research and practical fixes.
Explore the work · About · Contact
New: blocked by an open issue in an open-source project? Upstream fix, paid on merge: $500 or $1,000, quoted before work; no merge in 45 days, no charge.
- Failure Lab — Run a 25-minute incident-review session with your team in the browser, then compare its calls with the sourced record. Offline kit and sources.
- Loadcheck — Inspect loading-risk signals in a public Hugging Face repository before choosing a loading call.
- BFCL quantization pilot — Selected tool-call cases, published scores and the commands behind them.
- ComfyUI workflow preflight — Check a saved Qwen-Image-2.1 workflow for supported file-slot and prompt-wiring mistakes.
- dst-check — Check a confirmed schedule expression, timezone and installed scheduler version around a clock change.
- tzscan — List the copies of time-zone data it recognises in a container image and whether each is wrong for Canada's 1 November change, without running the image.
- GGUF repeat-run study — A two-run record separates repeatable results from unstable timing.
- Breach Notice Index — Search dated California filings for protection offers and the original notice.
Asking an LLM to simulate your README's users: most mechanical defects found, several newcomer questions missed — On a README that paid think-aloud testers had already reviewed, an LLM simulating five varied users raised about 60% of their findings per run. It flagged the broken key-tool link and the missing cURL requirement in 8 of 8 runs and stopped once they were fixed, but never raised that the README did not say what the software does (0 of 8). Includes all 28 model outputs, the match verdicts and the scripts.
GitHub Actions lockfiles pin a Docker action's commit, not the image it runs — The new lockfile records each action's commit, but a Docker container action still pulls its image by tag, and gh actions-lock does not warn. In 1,802 active public repositories, 177 (9.8%) use such an action, most often ossf/scorecard-action. Includes a scanner for your own workflows.
Pickle scanners as CI gates: picklescan exits 0 on all 9 DITTO proof-of-concept files — picklescan 1.0.5, modelscan 0.8.8 and fickling 0.1.12 on the 9 proof-of-concept files from the DITTO paper (arXiv 2610.10735). picklescan exits 0 on all 9, including files it cannot parse; modelscan exits 0 or 3 while printing "No issues found!". Includes gate rules and a check of the paper's 0% false-negative claim against its released outputs.
On Windows, uninstalling your last uv tool deleted your uv.toml — Every uv release we tested from 0.3.0 to 0.13.0 deletes %APPDATA%\uv, user uv.toml included, when the last tool is uninstalled and that folder has no other subfolder; 0.13.1 fixes it. If that file set your index, uv falls back to PyPI without a warning. Includes a PowerShell check and the reproduction script.
Python 3.16.0a1: with pytest-asyncio installed, every test errors — 3.16.0a1 removes asyncio's event loop policy API and asyncio.iscoroutinefunction(). On the same installed files, pytest-asyncio 1.4.0, backoff, mock, cached-property, nest-asyncio and tornado's AnyThreadEventLoopPolicy fail on 3.16.0a1 and work on 3.15.0. Includes a conftest.py stopgap, tested replacements and why 3.15's deprecation warnings miss the two worst.
NWS may drop VTEC. In one October snapshot, CAP links rebuilt 709 of 913 evaluated VTEC event keys — Data: 10,498 Actual alerts returned by the api.weather.gov /alerts listing for 6-13 October 2026 (UTC). All 354 area-extension alerts (VTEC EXA and EXB) in that snapshot were messageType: Alert and had neither references nor expiredReferences. Includes three practical rules for CAP consumers, the raw snapshot and a second run.
NATRF2022 beta: stock PROJ 9.9.0 lands 9 to 18 cm from NGS's answer in the eastern US, and prints no warning — On October 13, 2026, at 230 US county points, bare cs2cs from NAD83(2011) to NATRF2022e2020 (EPSG:10968) landed 9 to 18 cm from NGS's NCAT beta answer east of 104° W and up to 0.92 m in Alaska. Community NADCON5 grids came within 1.03 cm. Includes a three-point self-check, the raw NCAT answers and an independent rerun.
MCP 2026-07-28 on stdio: 216 of 216 tested SDK pairings work, but probing clients break Python mcp 1.2.1 and 1.6.0 servers — 12 SDK client builds against 18 server builds over stdio, three runs each. Outside that matrix, the four probing clients failed 3 of 3 runs against servers on Python mcp 1.2.1 and 1.6.0. Includes the error messages, a stdlib self-check for your own server, the harness and the raw results.
ubuntu-latest becomes Ubuntu 26.04: about 1 in 5 sampled Python and Ruby repos have a job that fails at setup — In 122 of 548 active repositories that use setup-python or setup-ruby on ubuntu-latest, at least one job asks for a version with no 26.04 build. Includes a checker that lists each failing matrix entry, and the fix.
SSH hardening defaults from three projects switch off OpenSSH's post-quantum key exchange — In container tests with default variables, 10 source-and-OS combinations from ComplianceAsCode, ansible-lockdown and konstruktoid/ansible-role-hardening switched stock sshd to classical key exchange; an OpenSSH 10.2 client warned on each. Includes the check and a fix line for each tested OpenSSH version.
About 1 in 50 recent dotfiles that set PATH add a literal ~ entry — 6 of 289 recently pushed dotfiles repos that set PATH left a literal ~/… entry. Most tools we tested then search under the current directory, and ShellCheck misses the export PATH="$PATH:~/…" form. Includes the one-line check.
Chrome 155 now gets JPEG XL from some Cloudinary sites — On October 12, 2026, Cloudinary f_auto served JPEG XL to Chrome 155 on 28 of the 237 sites using f_auto in Tranco's top 50,000. Bytes depend on the image; a stdlib checker compares your own URLs.
Python JSON guards: value > limit admits NaN — 17 runnable stdlib cases on CPython 3.12.3: a parse-time fix still admits -1e999; an isfinite fix admits true and crashes on a 401-digit integer.
Polars 2.0 in a memory-limited container: set the spill budget yourself — A lazy 40M-row sort in a 1 GiB container: the default spill budget completed 2 of 10 runs; POLARS_OOC_MEMORY_BUDGET_MB=500 completed 10 of 10.
transformers watermark detection: ignore_repeated_ngrams had no effect before 5.19.0 — On 2,880 windows of human text, 5.18.0 flagged 2,537 as watermarked with the option on; 5.19.0 flagged 13. Default key, GPT-2 tokenizer.
pnpm deploys: stop the second install after a frozen install — Four pinned releases: upgrading alone keeps the extra install; two fixes work, each with a condition to check first.
Ruff upgrades change which checks run — Pinned examples show a newly caught shared-list bug, a removed lambda check and how to retain both checks.
Embedding sequence caps: check what your chunks lose — Ten pinned models; configured caps, tokenizer limits and a local corpus counter. Tokenizer-only evidence.
Perplexity contextual embeddings: keep the document boundary — A pinned, weight-free source probe shows why a document's chunk list and a query batch need different handling.
JavaScript schedulers at the 2026 fall-back — pinned callback comparisons for daily, half-hourly and hourly jobs; copy-paste London check.
ThinkingBox: trace the ticket task's pass condition — Replay one released validator with controlled effects before interpreting an agent repair.
n8n 2.40.7 DST heads-up — Berlin 25 Oct / New York 1 Nov 2026
AstaBrief: check the evidence going into the report — A runnable example of snippets, abstract fallback and missing evidence before synthesis.
Before the macOS 14 brownout: find the labels, then check the architecture — A tested workflow search and a runner-selection check before migration.
GitHub App tokens: a SQLite test can miss the length limit — A synthetic storage check: declared column length and enforced length behave differently.
pnpm 11.28.4: an omitted workspace can change a frozen lockfile — An offline version comparison distinguishes an absent directory from a missing manifest; keep the lockfile diff.
uv 0.12.23: read a lockfile without the manifest — An offline dependency-tree comparison with 0.12.22. Reading the graph does not prove the packages can be installed.
Python 3.15 lazy imports: check plugin registration first — A runnable CPython 3.15.0rc2 example: deferred registration, explicit initialization and an eager-import filter. No startup-speed measurement.
uv sync succeeds, but a file is missing — Inspect one distribution's recorded paths before choosing a repair; presence is not integrity.
-
uv frozen member sync: executable version and lockfile revision
-
uv relocking and archive hashes — reproduce the local-wheel change in 0.12.22.
-
Structured output: test double versus parser — Reproduce a mock's schema bypass and compare the core content parser.
-
A cache probe changes the cache — Download a local prediction/reveal exercise for two probe orders and a capacity control. Idealized toy; no real-engine measurement.
-
Before a checkpoint restore: find the files Git status leaves out — Find currently ignored files with Git inspection commands; today's clean preview does not prove preservation after a restore.
-
HydraFusion: inspect the workspace after a discarded draft — Git inspection commands and a source reading; HydraFusion runtime behavior was not tested.
pwasm fuel counts calls and loops, not instructions — A pinned alpha recipe: different loop bodies, equal fuel, with exhaustion and expired-deadline controls.
Node's native TypeScript: two checks before dropping your runner — a dependency-free example separating type checking, tsconfig aliases and package imports. Checked on Node v24.21.0.
Kolibri thinking controls — a pinned template check shows which setting wins when a thinking toggle and reasoning effort disagree. Rerun it without model weights; generation and server behavior are untested.
Telegram reminders: why an idempotent ack can still send twice — Run a local failure model before choosing a retry policy.
Qwen tool prompts: count what the template adds — In a pinned tokenizer-only recipe, one 69-token schema added 271 prompt tokens. No weights or inference.
CyberNative AI LLC · Questions or corrections: hello@cybernative.ai
