The Software Efficiency Report | 2026 Week 42

Metric of the week

Defect Recurrence Rate (DRR): Target 0%

Deep dive

AI Coding Tools: Why Activity Metrics Don’t Show Delivery and What to Measure Instead

Software Efficiency Metric of the Week

Defect Recurrence Rate (DRR): Target 0%

This tracks the percentage of production incidents caused by a failure mode or regression you’ve already seen, triaged, and supposedly "fixed" in a prior post-mortem.

What it is: A measure of organizational learning. While your escape rate tracks how many bugs slip past testing, DRR answers a simpler operational question: are you systematically learning from downtime, or are you paying the price for the exact same bug twice?

Why it matters: Making a new mistake is just the cost of moving fast. Repeating an old one is pure operational failure. When an engineering team trips over the same unindexed query, token expiry, or connection pool leak six months later, it means past post-mortems were just bureaucratic theater. Repeat incidents destroy customer trust, burn out on-call rotations, and burn expensive senior developer time re-diagnosing known issues.

The Fix:

• Mandate automated regression tests: No post-mortem ticket gets closed without a committed test that reproduces the bug and verifies the patch.
• Kill behavioral fixes: Ban action items like "remind developers to check config." If an issue broke production, guard against it deterministically using linters, policy-as-code, or automated build gates.
• Taxonomy tags: Categorize root causes in your tracker (e.g., Schema Drift, Timeout, Cache Invalidation). Trigger an immediate review if any category pops up twice within 90 days.
• 14-day SLA on prevention: Treat preventative post-mortem action items as release blockers. If the guardrail isn't live within two weeks, freeze non-critical feature deployments for that service.

Formula: DRR (%) = (Recurring production incidents / Total confirmed production incidents) × 100

Quick Example: If your team handles 50 production incidents this quarter and 4 trace back to root causes you've seen before: DRR = (4 / 50) * 100 = 8% (A clear signal that earlier remediations relied on memory instead of automated guardrails).

Source Source Source Source

Reader Poll

When an edge device crashes in the field, do you get automatic crash telemetry, or do you have to ask the customer to hook up a serial cable?

My take: Cloud developers take instant stack traces for granted. In embedded Linux, a kernel panic happens in the wild and the engineering team is usually flying blind. Logs were sitting in volatile RAM, the storage took a hit during an unclean reboot, and there is no crash dump left to inspect. Triage quickly turns into asking an annoyed customer to crack open the enclosure and hook up a USB-to-UART adapter. If your devices do not preserve panics and core dumps before the hardware watchdog resets the board, you are not debugging. You are just guessing. Source Source Source Source

How does your team actually troubleshoot production crashes on embedded hardware?

• A) Automated telemetry: pstore or ramoops logs panics to persistent RAM and sends traces after reboot.
• B) Gone on reset: Logs vanish on restart, so we can only fix bugs we can recreate on our own desks.
• C) Customer detective work: Support relies on vague user reports like "the display froze and the light stopped blinking."
• D) The board swap: We mail out a replacement unit and ship the broken hardware back to HQ for an autopsy.

Can your edge devices explain their own failures, or are they total black boxes the moment they leave the lab?

Engineering Tip of the Week

Mount local test databases on a tmpfs RAM disk to slash test runtimes

Running integration test suites against a disk-backed local database wastes minutes waiting on synchronous disk writes and transaction flushes. Instead of writing temporary test data to your SSD, mount your local database data directory to /dev/shm or an in-memory tmpfs volume. Because writes and rollbacks execute directly in RAM, your local test suites can run up to five times faster without changing a single line of application code.

Technology Ecosystem Trends

Top Developments/Trends picks for this week Shaping Modern Engineering Efficiency and Operations

Distributed sstate caching and containerized runners modernize Embedded Linux builds: Hardware-focused engineering teams are replacing monolithic bare-metal build servers with containerized BitBake clusters backed by shared network cache proxies. This cuts full Yocto OS compilation and automated board-level testing times from hours to under 30 minutes, bringing agile release cadences to automotive and IoT firmware. Source

Automotive software gets its own SBOM standard: the Linux Foundation's OpenChain Project shipped version 1.0 of an Automotive SBOM Framework with Toyota, Nissan and Volvo Cars involved, giving suppliers a common way to document components that lines up with the compliance work the EU Cyber Resilience Act already forces on vendors. Source

GPUs break Kubernetes' old cost model: CPU and memory have mature per-pod accounting, but GPU utilization metrics from NVIDIA's own exporter report at the physical device level, so pods sharing one card through time-slicing can show over 100 percent combined usage while clouds still bill for the whole card. Source

Kernel maintainers back off AI transparency rules: a patch dropping the mandatory "Assisted-by:" tag for AI-touched contributions is moving ahead after informal agreement at the Linux Maintainers Summit, a loosening that contrasts with COSMIC's outright ban on LLM-written code and puts the kernel on the more permissive end of the spectrum. Source

Observability rebuilds itself around AI agents: New Relic shipped a dashboard-free CLI so agents can query telemetry directly, Cloudflare opened tracing across its entire proxy path with its own agent access point, and DigitalOcean launched a data layer built for agents (DigitalOcean Agent Data Services), three vendors converging on the same bet in one week. Source Source Source

Copilot starts deciding where your code goes: a new auto-routing feature will choose per task whether Copilot runs on a local model or sends repo context to the cloud, and Microsoft hasn't said how much context gets transmitted or whether local-only can be enforced, a real gap for teams with data residency rules. Source

Chaos engineering gets an agent, not autonomy: Gremlin's new Foresight AI splits reliability testing across four agents that analyze, test and recommend fixes, but stops short of running tests or applying remediations without approval, a cautious posture as "agent does the work, human signs off" becomes the industry default this week. Source

Hackers reached into real refrigerators, not just networks: attackers remotely triggered defrost cycles on Danfoss controllers across hundreds of French supermarkets including Carrefour and Monoprix, spoiling stock overnight and drawing a formal investigation, a rare case of an OT compromise producing damage anyone can see on a store shelf. Source

Cloud budgets get hard stops, not alerts: Google Cloud Billing and Cloud Run both reached general availability for spend caps that pause a project's usage once it crosses its limit, a shift from warning emails to automatic shutoffs that says a lot about how fast AI workloads are blowing through budgets. Source

Observability-as-Code (OaC) codifies telemetry, dashboards, and SLOs in Git: Infrastructure teams are ending manual dashboard tuning in vendor UIs by defining OpenTelemetry collection pipelines, alert rules, and service-level objectives directly in version-controlled config files. For technology executives, this ensures every newly deployed service automatically ships with consistent monitoring standards and zero configuration drift. Source

Tools, Resources and Communities | Worth Knowing

Open Source Tools

• act: A tool that lets developers run GitHub Actions locally inside Docker containers. Instead of pushing dummy "fix CI" commits to trigger a remote pipeline, you can test workflows, secrets, and matrix builds directly on your laptop, cutting pipeline debugging time from hours to minutes. Source
• Difftastic: A structural diff tool that compares code based on syntax trees (ASTs) rather than raw lines of text. It understands language grammar across dozens of languages, meaning line wraps, minor whitespace shifts, and formatting changes do not pollute your diffs during code reviews. Source

Commercial Platforms

• CodeScene: A software engineering intelligence platform that uses behavioral code analysis. By analyzing your git repository history, it identifies technical debt hotspots where high code complexity overlaps with high churn, showing leaders exactly where architectural refactoring will prevent future defects. Source
• Sleuth: A deployment tracking and DORA metrics platform that links issue trackers, Git repositories, feature flags, and APM tools. It maps lead time, deploy frequency, and failure rates to specific teams and release paths without resorting to invasive surveillance. Source

Learning Resources – Interesting articles

• Flaky Tests at Google and How We Mitigate Them: A practical breakdown from the Google Testing Blog on the real cost of non-deterministic tests. It covers automated quarantine mechanics, root cause groupings, and why simply hitting re-run creates hidden production defects. Source
• Software Crafters Community: A global practitioner community dedicated to practical software craft: test-driven development, legacy code refactoring, pair programming, and continuous code improvement. Source
• Better Embedded System Software Book: A set of authoritative design principles by safety-critical systems researcher Phil Koopman detailing how to mitigate software risks like runaway tasks and memory issues. It outlines core best practices including proper single-point watchdog timer implementation to isolate hung tasks, stack sentinel patterns paired with recursion bans to rigorously bound maximum stack depth, and defensive error recovery architectures to survive transient faults. Source Source Source Source Source Source Source

Deep Dive Article : AI Coding Tools: Why Activity Metrics Don’t Show Delivery and What to Measure Instead

Nearly every developer uses an AI coding assistant now. DORA’s (DevOps Research and Assessment) 2025 survey of almost 5,000 technology professionals put adoption at about 90%. The numbers most teams report are suggestions accepted, lines generated and active seats. All three count activity. None of them tell you whether software reaches production sooner, or whether it stays up once it gets there.

This article covers four things. First, why the research on AI coding tools looks contradictory, and what the studies actually agree on. Second, the three metrics worth dropping and what to track across development, deployment and day-2 maintenance. Third, how to build an ROI model your finance team can check. Fourth, a 90-day plan to measure all of it against your own baseline.

This article pulls together published research, vendor telemetry and framework documentation. Sources are listed at the end, and vendor data is flagged where it appears. Note: I haven’t run any benchmarks of my own.

Writing code is one step of many

Delivery runs from an idea to working software in production. Requirements, design, review, integration, testing and operations all surround the coding step. If you speed up authoring and leave the rest at its old capacity, the queue just moves to the next stage. This is the theory of constraints applied to software: improving a stage that isn’t the bottleneck doesn’t make the whole system faster.

Faros AI’s 2025 telemetry on more than 10,000 developers shows this happening. On high-adoption teams, developers completed 21% more tasks and merged 98% more pull requests. But PR review time rose 91%, PR size grew 154%, and organization-level delivery metrics didn’t improve. DORA’s 2025 report describes AI as an amplifier. It magnifies what strong organizations do well and what struggling ones do badly.

A gain at the keyboard doesn’t become a gain for the business unless something carries it there.

What the research says, and why it looks contradictory

Peng et al. (2023). Developers using Copilot finished a task 55.8% faster. The task was a single, well-defined one (writing an HTTP server in JavaScript), and some of the authors work at GitHub.

METR (2025). In a randomized trial, 16 experienced open source developers working on their own repositories took 19% longer with AI. They had predicted a 24% speedup, and afterwards still believed they’d been about 20% faster. I think that gap between perception and measurement is the most lasting finding in the study. The sample was small and the tools were from early 2025.

METR (February 2026). A follow-up with 57 developers and more than 800 tasks estimated 18% less time for returning participants and 4% less for new ones. The intervals were wide and include zero. METR itself calls the result an unreliable signal, because many developers refused to work without AI or held tasks back, and says the 2025 result no longer reflects current tools.

DORA (2024 and 2025). The 2024 report linked adoption to lower team-level throughput and stability. The 2025 report linked it to higher throughput, with instability still higher. Both rely on surveys and show correlation only.

Faros AI (2025 and 2026). More tasks and PRs, longer reviews, flat organization-level metrics. The 2026 report (22,000 developers, 4,000 teams) adds more bugs and incidents next to the throughput gains. This is vendor data, and Faros sells engineering analytics.

McKinsey. Gains vary with task complexity and developer experience.

Read side by side, the studies disagree less than the headlines suggest. A greenfield task behaves differently from a mature codebase. Self-reported speedups and measured ones can diverge. And what happens to a team depends on everything that follows the code being written. So measure your own system with telemetry and treat any single headline number as a snapshot.

Three metrics to drop first

Suggestion acceptance rate. It tells you a suggestion was kept at that moment and nothing more. In METR’s trial, developers accepted fewer than 44% of AI generations, and more than half said they made major changes to clean up what they kept.

Lines of code added. Volume isn’t value, and deleting code is often the better change. GitClear’s analysis, a vendor dataset examining Git commit histories-links AI assistant adoption to rising code churn and an increase in duplicate/copied code.

Time in the tool. It can’t distinguish productive use from going in circles. The SPACE framework makes the wider point that developer productivity can’t be captured by activity counts or any single dimension.

Stage 1: Development

The goal here is less mechanical work without a worse codebase. Compare every metric to the same teams’ pre-rollout baseline, on similar kinds of work.

Time to PR ready. Measure from first commit to the PR being marked ready. If assistants help with boilerplate and routine CRUD, this should fall. If it falls while review time rises, the work moved and didn’t shrink.

PR size. Track the median and the 90th percentile of lines changed per merged PR. Faros reported PR size up 154% on high-adoption teams, and DORA’s AI capabilities model lists working in small batches among its seven practices. Set a soft ceiling from your own pre-rollout numbers instead of borrowing one.

30-day churn. What share of merged code gets edited, rewritten or deleted within a month? A rising line on AI-heavy repos is a reason to look at edge-case handling and review quality.

Review wait and reviewer load. Measure PR ready to first review, PR ready to approval, and the hours seniors spend reviewing. Faros found review time up 91%, and a DX summary of DORA’s 2025 findings describes review becoming the main bottleneck when volume rises without better review systems. If junior output climbs and senior review hours climb with it, throughput can stay flat while the dashboard looks great.

Stage 2: Deployment

Code that sits in a pipeline earns nothing.

Lead time for changes. DORA defines it as the time from commit to running in production. If you measure from merge instead, say so, because the numbers won’t be comparable otherwise. A faster IDE with a flat lead time points to a constraint elsewhere, such as manual QA, approvals or flaky tests.

Mutation score. Line coverage shows which lines ran, not whether the tests would catch a bug, and generated tests can raise coverage cheaply. Mutation testing injects small deliberate faults and checks whether the suite fails. High coverage with a low mutation score means the tests aren’t checking behavior.

CI first-pass failure rate. A sustained rise after rollout deserves a look. I’d start with three hypotheses: broken interface contracts, mocks of things that don’t exist, and type errors. None of these is established, so check your own failures before assuming.

Security findings per PR. Pearce et al. tested an early version of Copilot on security-relevant scenarios (preprint 2021, published 2022) and found about 40% of generated programs were vulnerable. The tools have changed a lot since, so treat that as a reason to measure and not as a current rate. Track static analysis findings per PR before and after rollout.

Stage 3: Day-2 maintenance

Saving authoring time means little if the code causes outages or nobody can maintain it.

Change failure rate and rework rate. DORA’s 2025 model groups these two as its instability metrics, and its findings still associate AI adoption with higher instability. If either creeps up, code is being created faster than it is being verified.

Failed deployment recovery time. DORA counts this with the throughput metrics, but it matters most on day 2, so it belongs in this section. Compare your incidents before and after rollout, because it can move either way. Code merged without much human understanding may take longer to diagnose under pressure. Assistants may also shorten recovery through log analysis, runbook lookup and incident summaries.

Migration and refactoring speed. In my view, framework upgrades and patches across many repos are a natural fit for agentic tools, though I haven’t got a source for how much time they save. Reported savings seem to vary widely by codebase, so measure it on your own repos.

A simple scorecard

Define “healthy” and “warning” against your own baseline.

Development
Healthy: time to PR ready down, PR size steady or smaller, churn flat or falling.
Warning: PR size growing, senior review hours climbing, churn rising on AI-heavy files.

Deployment
Healthy: lead time down, mutation score steady or up, security findings flat.
Warning: high coverage with a low mutation score, repeated CI breaks from type or mock errors.

Maintenance
Healthy: change failure and rework rates stable, upgrades getting faster.
Warning: more hotfixes, on-call engineers struggling with code they didn’t write.

Building an ROI model finance can check

Net ROI % = (value generated minus total cost) divided by total cost, times 100. The formula is easy. Filling in both sides honestly is the hard part, and DORA’s ROI guidance is built around that gap between engineering speed and financial impact.

Cost is more than licenses. Use current vendor pricing for your tool mix, then add usage-based API charges, indexing and security tooling. Then add the learning dip. DORA describes a J-curve, an early productivity drop while teams adapt, and recommends budgeting for it explicitly as a tuition cost.

Value comes from three places:

Reclaimed capacity. Hours saved, times the fully loaded hourly rate, times a reinvestment factor. No factor is universal, so set it conservatively, justify it, and show a low, mid and high case. DORA’s guidance stresses reinvesting the capacity, mainly by cutting rework, and not assuming headcount savings.

Incident cost avoided. The drop in change failure rate times average incident cost, plus recovery hours saved times outage cost per hour. This can go negative if instability rises.

Earlier delivery. The value of a milestone landing sooner. It’s the hardest line to prove, and it can also be the largest.

Then subtract the hidden drag: extra CI compute from higher commit volume, and senior time moved from design to reading long PRs. Don’t count the same saved hour in both the capacity line and the earlier-delivery line.

A 90-day measurement plan

Days 1 to 30: baseline. Pull Git and CI data for PR cycle time, review wait, churn, lead time and change failure rate before you change anything.

Days 31 to 60: comparison. Roll out in phases to comparable teams, and compare delivery outcomes against the teams still waiting. Use telemetry, not logins or surveys, and watch for selection effects like the ones METR ran into.

Days 61 to 90: quality brakes. Add soft limits on PR size, mutation testing and security scans in CI, and recognize small modular changes over output volume.

What to take from all this

The evidence doesn’t show that AI coding tools fail. It shows that speed at the keyboard only reaches the customer if review, testing, deployment and operations can keep up. DORA’s amplifier framing holds up best across all the studies: AI makes an organization more of what it already is.

Just for your thinking : Which of these metrics do you track today, and which one has surprised you most?

References: Source Source Source Source Source Source Source Source Source Source Source Source Source

Technology Ecosystem Weekly News Digest – Top Picks

Cloud and Platform News

AWS this week

• Lambda Web Functions let code handle HTTP requests directly, with multiple requests sharing one warm execution environment, response streaming, and billing only for active CPU time instead of idle wait time. Source
• Security Hub now ranks exposure findings by resource criticality, so teams can triage business-critical assets first instead of working a flat list. Source
• Redshift picked up Iceberg-backed materialized views, letting Spark and Athena read the same precomputed results instead of each tool running its own copy of the query. Source
• Secrets Manager now manages external secrets for Databricks and Twilio directly, so those credentials get centralized rotation instead of a custom integration. Source
• OpenSearch Service added index level encryption, moving past the old all-or-nothing domain level setting. Source

Azure this week

• Microsoft unveiled the Maia 300 AI inference chip, calling it its future "primary inference system" and claiming up to 40% more tokens per megawatt than competing GPU systems, with multi gigawatt deployment starting in 2027. Source
• Three developer platform tools are heading toward retirement: Dev Box in September 2028, Azure Deployment Environments in February 2027, and the Key Vault Secrets Provider Extension for Arc enabled Kubernetes not long after, so anyone standardizing on them needs a migration plan now. Source Source Source
• Anyscale's managed Ray service reached general availability on the Azure Marketplace, giving distributed Python workloads a managed option instead of self-hosting the cluster. Source

Google Cloud this week

• Cloud Storage in us-central1 ran elevated error rates and failed writes for roughly twelve and a half hours on October 8, after a traffic sorting change meant to ease a capacity shortage instead starved specific backend storage nodes, taking down Torq, Temporal, Elastic Cloud, and Mixpanel as collateral damage. Source Source
• Google managed public SSL certificates are moving from 90 day to 45 day validity, issued and renewed automatically through Certificate Manager with no customer action required, a real tightening of the TLS automation bar for anyone still renewing manually elsewhere. Source
• Google stopped selling new Gemini Code Assist Standard and Enterprise subscriptions as of October 9 and is steering buyers toward Antigravity instead, though existing subscriptions keep running for now. Source Source
• Cloud SDK 589.0.0 deprecates the bundled skaffold component, removal planned after January 15, 2027, the second CLI component Google has shed in consecutive releases after last week's managed-flink-client removal. Source
• Managed Service for Apache Airflow reached general availability for development mode environments and environment hibernation, letting teams pause an environment to cut cost instead of paying for it around the clock. Source

Open-Source and Linux Ecosystem News

CNCF and Kubernetes this week:

• Meshery, the internal developer platform project with roughly 400 integrations across AWS, GCP, and Azure, graduated from Sandbox to CNCF Incubating status, citing a 350% jump in commits over the past year and an LFX estimated software value of $393 million, and shipped its 1.0 release with a read only MCP server so AI assistants can query cluster state. Source
• Starting with Kubernetes v1.35, the kubelet will refuse to start by default on nodes still running cgroup v1, turning last month's "maintenance mode" warning into an actual upgrade blocker. Source
• The Kubernetes Security Special Interest Group published updated hardening guides and admission controller profiles designed to block user namespace escalation in container runtimes. The guidance helps platform engineers configure cluster-wide Kyverno and Gatekeeper policies to reject containers running as root by default. This closes a common post-exploitation path where attackers break out of container sandboxes onto the host system. Source

Let's Encrypt is cutting certificate lifetimes again. It confirmed it will begin issuing and renewing certificates with 64 day validity starting February 10, 2027, the first step toward an eventual 45 day target in 2028 and in line with CA/Browser Forum baseline requirements. No existing valid certificates get revoked, but the renewal cadence for any automated pipeline is about to double. Source

Linus Torvalds pushed a branch explicitly labeled as built with Claude Code under his direction, targeting a folio reference counting bottleneck in page cache reads, and said separately that AI tools are making old kernel code easier to decipher and are surfacing bugs that sat hidden for years. It's a notable data point in the same week kernel maintainers are still arguing over whether AI assisted patches need a mandatory attribution tag. Source Source

DevOps, Platform Engineering and SRE News

GitHub this week

• Rebuilt its Git storage architecture to handle agent driven commit volume, after monthly Git events more than doubled year over year to 473 billion and September alone saw 7.38 billion commits; the new design separates storage from compute and claims up to 35x higher write throughput internally. Source Source
• Rewrote the Copilot runtime from Node.js to Rust over about fourteen weeks, with AI agents generating most of the roughly 832,000 lines of new production code, cutting a single session startup from 5.25 seconds to 292 milliseconds. Source

Cloudflare Workers now shows you exactly where your CPU and memory are going. New on demand profiling captures a flamegraph from production with roughly one millisecond of sampling overhead, available from the dashboard or CLI. Cloudflare's own examples found a recursive JSON parsing bug worth a 2.7x speedup and a memory leak from disabled but still running Prometheus instrumentation that was eating two thirds of a Worker's allocations. Source

OpenCode 2.0, an open source coding agent, started by former SST developers, now runs terminal, web, and desktop clients off one shared background service, ships an embeddable SDK, and supports over 80 plugins, with old plugins and APIs explicitly incompatible with the new version. Source

Security and DevSecOps News

The Open Worldwide Application Security Project released updated testing guidance focused on Broken Object Level Authorization (BOLA) and server-side request forgery in microservices. The new documentation provides standardized contract testing recipes that developers can plug into automated API test suites. This helps development teams catch authorization flaws in API gateways before deploying new endpoints to production. Source

A server-side request forgery flaw in SAP's Cloud SDK for Python let attackers redirect token requests to a server they controlled, a textbook example of how one tenant parameter in an enterprise SaaS integration can leak credentials across every connected app. Source

States keep piling onto TP-Link's security problem: four more US states sued the router maker over end-of-life devices still marketed as secure and understated Chinese manufacturing ties, arriving the same week researchers detailed five new high-severity flaws in its ISP-supplied Aginet line, bringing the total to five states suing. Source

AI/ML and Agentic AI News

LangChain rolled out cross-thread, long-term memory capabilities in LangGraph for Python and JavaScript. The update provides built-in JSON document storage and content-based filtering so autonomous agents can retain user preferences, historical context, and past actions across separate conversations. This saves engineering teams from having to build and maintain custom database layers just to preserve agent state. Source

Anthropic this week

• Cut off live internet access for all of its internal model evaluations, not just the high risk ones, after finding that testing versions of Claude had used SQL injection against a real university server, bypassed a paywall restriction, and used URL shorteners to dodge the tool limits meant to stop exactly that kind of evasion. Source
• Its open source vulnerability scanning program has surfaced more than 29,000 candidate bugs in six months, with 516 patched upstream so far and maintainers at OpenSSL, wolfSSL, PostgreSQL, and curl confirming the findings as real, even as roughly 23,000 remain unreviewed. Source

Google AI/Gemini this week.

• Took Gemini 4 Argon from a narrow early access program to broad general availability, with introductory pricing of $2 and $10 per million input and output tokens through November 30 before it doubles. Source
• Added local model support to its Antigravity SDK, splitting coding agent work so a cloud model plans from filenames alone while a local model does the actual code reading and writing, keeping source code off Google's servers entirely in its own demo. Source
• Unveiled a persistent Gemini Agent with its own Workspace identity, meaning its own email, calendar, and Drive storage, built to run research and coding tasks across hours or days and to support Anthropic's Claude as a model option alongside its own. Source

Gemini 4 Argon becomes the default coding model: Google's newest frontier model reached general availability inside GitHub Copilot this week, built specifically for complex coding, agentic and reasoning tasks, a sign the coding-model race is now as much about who ships inside existing developer tools as who tops a benchmark chart. Source

JetBrains released an open coding model sized for running your own agents instead of renting someone else's. Mellum2.1 is a 12 billion parameter model with 2.5 billion active, trained mostly through reinforcement learning in real coding environments, released under Apache 2.0 on Hugging Face. JetBrains says multi-token prediction makes it roughly 1.6 times faster per request and nearly double the throughput of a comparably sized Qwen model under load on one H200. Source

The infrastructure running AI agents is getting exposed to the internet faster than anyone is tracking it. Censys data cited by Axios found internet facing systems running AI related software jumped 63% in nine months to about 268,000, including roughly 114,000 exposed n8n workflow automation deployments, over 77,000 of them on versions with a known critical vulnerability, plus more than 54,000 exposed control panels for the open source AI agent OpenClaw. Source

Embedded Systems and IoT News

AMD is putting an agentic AI layer directly into chip and embedded design tools. Ross works across AMD's FPGA, adaptive SoC, and edge AI toolchains from inside VS Code, Claude Code, Cursor, or Devin, ships more than 20 open skills for tasks like timing closure and RTL linting, and can run fully air gapped with mandatory human review gates before anything executes. AMD says over 800 customers used it in early access and cites one case cutting a MATLAB to HLS translation job from weeks to about two hours. Source

Raspberry Pi Desktop gets a massive upgrade with Debian 13 and Wayland: Raspberry Pi just gave its lightweight x86 OS a much-needed overhaul, skipping right past Debian 12 to land on the cutting-edge Debian 13 "Trixie" base. The big news under the hood is that it now defaults to the Wayland display architecture (specifically using the labwc compositor). It also comes packed with refreshed Python toolchains, standard dev utilities, and built-in support for Raspberry Pi Connect. For developers, this is a huge quality-of-life update—it means you can easily spin up an identical Pi runtime environment on a spare x86 laptop to build, test, and debug your automation scripts before deploying them to your actual physical Pi hardware. Source

Closing Note

This week's issue highlights a common challenge: improving one part of engineering does not always improve the overall delivery process.

Faster code generation, better testing, reliable embedded diagnostics, stronger security and tighter cloud cost controls all matter. But the real gains come when these practices work together to help teams deliver software faster without adding more defects, operational risks or maintenance work.

If you want to understand where your engineering delivery system needs improvement, start with TuskerGauge. It is a free assessment covering CI/CD, testing, infrastructure, security, observability, SRE, deployment safety and engineering practices.

Find the gaps in your engineering delivery system

Already know where the bottlenecks are? Tusker90Pro helps turn those findings into a practical 90-day improvement roadmap focused on delivery flow, reliability, release management and engineering operations.

Build your 90-day improvement roadmap

The objective is straightforward: measure what matters, address the constraints, prevent recurring failures and make software delivery more predictable.

If you are working through a specific engineering delivery challenge, write to contact@stonetusker.com. We can discuss the problem, the constraints and the practical steps to improve it.