Mert

The New AI Workflow Is a Supply Chain Problem

yazar

Your coding assistant is no longer just autocomplete with swagger; it is another production dependency.

The Weird Thing That Changed This Week

Most dev news is confetti with a changelog attached. This week was different.

On one side, OpenAI said an internal reasoning model disproved a longstanding conjecture in discrete geometry. Not “wrote a nicer regex.” Not “summarized a Jira ticket.” It produced work that external mathematicians checked.

On the other side, GitHub confirmed that roughly 3,800 internal repos were breached after an employee installed a malicious VS Code extension.

That is the whole developer moment in two tabs:

AI tools are getting frighteningly capable.

Developer workflows are getting hilariously porous.

The future is not “AI writes all the code.” The future is “AI can reason better than your Friday brain, while your editor extension can quietly steal the kingdom.”

Welcome to the new job.

The Tool Is Not The Workflow

A lot of teams are still treating AI coding tools like fancy autocomplete. Add the extension. Add the chat panel. Tell everyone to “use it responsibly.” Then wonder why the codebase feels like it got edited by five interns and a caffeinated spellchecker.

That model is dead.

The better framing is this: AI is now part of your software supply chain.

It reads code. It writes code. It suggests dependencies. It drafts tests. It explains failures. It may touch secrets, logs, architecture docs, stack traces, customer-shaped data, and everything else people paste when they are tired.

That means “which model should we use?” is only one small question. The bigger question is: what boundaries does this thing operate inside?

Because an assistant that can help solve hard problems can also help ship subtle nonsense at scale. And an extension that looks like productivity can become an incident report with syntax highlighting.

The Wrong Question Developers Ask

The wrong question is:

“Can AI do this task?”

That question is too easy now. For more and more tasks, the answer is “yes, kind of, depending on how much context and verification you give it.”

Can it write a migration? Sure.

Can it refactor a service? Often.

Can it debug CI? Sometimes faster than you.

Can it produce a convincing explanation for a bug it does not understand? Absolutely. It was born for that.

The dangerous part is not that AI fails. We already know software fails. The dangerous part is that AI fails with confidence, speed, and excellent formatting.

So the better question is:

“What system catches it when it is wrong?”

That is where real engineering starts.

The Better AI Workflow

Here is the boring, useful playbook. It will not trend as hard as “10 prompts that replaced my staff engineer,” but it will keep your repo breathing.

1. Give AI Smaller Blast Zones

Do not ask an assistant to “clean up the auth system” unless you enjoy archaeological debugging.

Give it narrow tasks:

  • “Add validation for this input path.”
  • “Write tests around this function before changing behavior.”
  • “Explain why this query regressed.”
  • “Refactor this file without changing public interfaces.”
  • “Generate a migration and list rollback risks.”

Small tasks create reviewable diffs. Reviewable diffs create actual trust.

Big vague prompts create code fog.

2. Treat AI Output Like A Pull Request From A Stranger

Not an enemy. Not a genius. A stranger.

You would not merge a stranger’s PR because the comments sounded confident. You would check:

  • Does the change match the existing design?
  • Are the tests meaningful or just decorative?
  • Did it introduce a dependency for a three-line helper?
  • Did it change behavior outside the requested scope?
  • Is the error handling real?
  • Are edge cases named and covered?

The trick is to make this normal, not dramatic. AI code should go through the same path as human code: tests, review, observability, rollback plan when appropriate.

No special shrine. No special panic.

3. Lock Down The Editor Like It Matters

That GitHub incident is a reminder that the developer workstation is production-adjacent now.

If your editor can read private repos, tokens, env files, SSH configs, internal docs, and generated code, then editor extensions are not “personal preference.” They are executable supply-chain decisions.

Practical moves:

  • Maintain an allowlist for extensions in company environments.
  • Remove abandoned extensions from critical workflows.
  • Prefer vendors with clear provenance and update history.
  • Disable workspace trust bypasses.
  • Keep secrets out of local files where possible.
  • Rotate tokens when developer tooling gets weird, not three meetings later.
  • Audit extensions that request broad filesystem or network access.

The edgiest thing your team can do in 2026 is basic hygiene.

4. Make The Compiler And CI Part Of The Conversation

One underrated trend: tooling is getting better at producing machine-readable feedback. GCC 16 work includes improved diagnostics and SARIF output, which fits a larger shift: compilers, linters, scanners, and CI systems are becoming structured signal feeds.

That matters because AI works better when it gets concrete feedback instead of vibes.

Bad loop:

“Fix the build.”

Better loop:

“Here is the failing test, compiler diagnostic, changed files, and expected behavior. Propose the smallest fix.”

Best loop:

AI proposes. Tools verify. Human reviews intent. CI blocks nonsense. The assistant gets the failure output and tries again inside a narrow scope.

That is not magic. That is a feedback system.

5. Stop Rewarding Prompt Theater

Contrarian take: prompt engineering is overrated inside mature engineering teams.

Not useless. Overrated.

The teams that win will not be the ones with the fanciest incantations. They will be the ones with clean interfaces, fast tests, readable errors, documented invariants, and boring automation.

AI loves a healthy codebase. It struggles in the same swamps humans do: hidden side effects, mystery globals, flaky tests, tribal deployment knowledge, and functions named handleThing2.

Want better AI output? Improve the terrain.

  • Write smaller modules.
  • Keep architectural decisions close to the code.
  • Add examples to tests.
  • Delete dead paths.
  • Make local setup boring.
  • Put invariants in types, schemas, and assertions.
  • Make failure messages specific.

The prompt is not the product. The system is.

The New Senior Developer Skill

The senior move is no longer “I can personally hold the entire codebase in my head.”

That was always a cursed party trick.

The new senior move is designing workflows where humans and machines can both be useful without being trusted blindly.

That means knowing when to delegate to AI, when to pin it inside a sandbox, when to demand tests first, when to distrust a plausible answer, and when to turn the tool off and read the code like an adult.

AI is becoming a real collaborator. Great. Collaborators need boundaries.

Your editor is becoming a bigger attack surface. Fine. Attack surfaces need controls.

Your CI is becoming a negotiation partner. Excellent. Give it sharp teeth.

The Takeaway

This week did not say “developers are obsolete.”

It said the job is moving up a layer.

Less typing boilerplate. More designing guardrails. Less worshipping tools. More owning workflows. Less “can AI write code?” More “can our system survive code written at AI speed?”

Because the future belongs to teams that can move fast without letting every shiny extension hold the keys to the vault.

Time Blocking Templates for Different Work Styles

yazar

Time Blocking Templates for Different Work Styles

Originally published on Schedule Calendar Blog

Not all work schedules look the same. A time blocking template that works for a software engineer with long focus windows does not work for a manager with five calls before noon. Here are four templates adapted to different realities.

Why templates help

Starting a time blocking system from scratch means making dozens of small decisions each week: when do I block deep work, how long should each block be, where do I put email and admin, how do I handle the days that are mostly meetings?

A template provides a starting pattern — not a fixed rule, but a default structure to adapt. Most people modify their template significantly within a month, but having one at the start is faster than building from nothing.

Template 1: The maker schedule

Morning: 2–3 hour deep work block

This template works for roles with significant output work: engineers, writers, designers, researchers. The goal is a long morning block of uninterrupted focus, with all meetings and communication batched to the afternoon.

Midday: shallow work batch

A practical version: 8:00–10:30 deep work (Busy), 10:30–11:00 email/Slack batch, 11:00–12:00 meetings, 12:00–13:00 lunch, 13:00–17:00 available for meetings, with a 30-min wrap-up buffer at 16:30.

Afternoon: meetings only

The critical rule: the morning block is non-negotiable except for genuine emergencies. Everything else fits around it.

Template 2: The manager schedule

Morning: 1-on-1s and team syncs

Managers typically have less control over when meetings happen. This template accepts that reality and protects one reliable focus window rather than trying to minimize meetings.

Midday: a single focus block

A practical version: 9:00–12:00 available for team meetings (clustered), 12:00–13:30 protected focus block (Busy), 13:30–17:00 meetings and availability for decisions. The midday block is used for thinking that requires no interruption: planning, writing, reviewing strategy.

Afternoon: strategic decisions

The key: cluster meetings into the morning to create a predictable afternoon block that does not move.

Template 3: The remote worker

Morning: async communication catch-up

Remote work often means a mix of sync and async communication across time zones. This template front-loads async catch-up to clear communication overhead before the focus block begins.

Mid-morning: deep work block

A practical version: 8:00–9:00 async catch-up (email, Slack backlog, doc comments), 9:00–11:30 deep work block (Busy, notifications off), 11:30–12:30 lunch and light admin, 13:00–16:00 meetings and collaborative work.

Afternoon: availability window

The advantage: by 9am, the communication backlog is handled and the focus block starts with a clear head.

Key takeaways:

  • Makers: protect a long morning block; cluster meetings in the afternoon.
  • Managers: accept the meeting load, protect one midday focus block.
  • Remote workers: clear async catch-up before the focus block begins.

Read the full guide on the Schedule Calendar blog — including a complete FAQ section, step-by-step examples, and how Schedule Calendar helps you put these habits into practice.

Add Schedule Calendar to Chrome — free

Büyük Samsung grevi son dakikada askıya alındı

yazar
Samsung

SamsungDün, şirket yönetimi ile işçi sendikası arasında yürütülen prim ödemesi müzakerelerinin sonuçsuz kalmasının ardından, Samsung’un Güney Kore merkezli yaklaşık 47 bin çalışanının 18 gün sürecek büyük bir greve hazırlandığı haberi gündeme gelmişti. Sendika, Samsung’dan işçi ikramiyelerine uygulanan ve yıllık maaşın yüzde 50’sine denk gelen tavan sınırın kaldırılmasını istiyor ve ayrıca yıllık faaliyet karının yüzde 15’inin işçi ikramiyelerine ayrılmasını talep ediyordu. Bunun üstüne başlatılan ve Güney Kore Çalışma ve İstihdam Bakanı Kim Young-hoon liderliğinde yürütülen yeni müzakereler, tarafların geçici bir anlaşmaya varmasıyla sonuçlandı. Buna bağlı olarak 18 günlük grev son dakikada askıya alındı. Bu grevin hem Samsung’a hem de tüm bellek/çip tedarik sektörüne çok büyük olumsuz etkileri olacaktı.

Büyük Samsung grevi son dakikada askıya alındı yazısı ilk olarak Teknoloji haberleri – LOG üzerinde yayınlandı.

I am trying to make my first online sale in 10 days as a developer. Here is what happened on Day 2.

yazar

I set a challenge for myself: generate my first online revenue from developer tools in 10 days. No ads budget. No existing audience. Just build, publish, distribute.

It’s Day 2. Here’s what’s happened.

What I’m selling

I built 7 digital products aimed at WordPress freelancers and IT professionals:

  • Bash/PowerShell maintenance automation scripts (19 PLN / ~$5 USD)
  • Service agreement templates, proposal templates, onboarding checklists (49 PLN / ~$13 USD)
  • Client acquisition cold email sequences (29 PLN / ~$8 USD)
  • Performance audit kit (19 PLN / ~$5 USD)
  • Two free WordPress checklists (lead magnets)
  • AI prompt pack for tech freelancers (120 prompts, $12 USD)

All on Gumroad.

Day 1: Build and publish

Built the products. Listed them on Gumroad. Published the first 7 articles on dev.to linking to them.

Sales: 0.

Day 2: The strategy problem

Published 8 more articles (15 total). Wrote detailed, technical content: WP-CLI automation, staging environments, backup strategies, plugin conflict diagnosis.

Tried to distribute:

  • Reddit — new account, can’t create API apps, can’t post in r/WordPress (karma requirement). Blocked.
  • LinkedIn — browser extension restrictions. Blocked.
  • Facebook — same. Blocked.
  • Hacker News — no write API. Blocked.

Dev.to organic views after 15 articles: 52. Sales: 0.

That’s when I had to stop and think.

The strategy failure

The content was fine. The problem was math.

15 articles × 3.5 average views = 52 total views. At 1% conversion, that’s 0.52 expected sales. I was building SEO content — a strategy that takes 3-6 months to work — and expecting sprint results.

What drives immediate traffic?

  • Social media (blocked)
  • Email list (zero subscribers)
  • Paid ads (no budget)
  • Going viral (not predictable)
  • Community engagement (limited by new accounts)

I had none of these. The distribution channels I needed required either an existing audience or a platform relationship I didn’t have.

The pivot

Instead of more WordPress content targeting a small niche, I shifted to AI — larger audience on dev.to, different readers.

published: 15 AI prompts for tech freelancers (the uncomfortable ones included)

The logic: AI Prompt Pack ($12 USD) is the only product priced in USD (accessible internationally). It’s also the only one I hadn’t written any content around. 15 articles promoting 6 products, zero articles promoting the AI pack.

Also published: How I use AI in my WordPress maintenance business — bridges both audiences.

What I’ve learned so far

1. Distribution is the product. The tools are built. The articles are written. The bottleneck is getting them in front of people who would pay for them. Content without distribution is a tree falling in an empty forest.

2. Platform restrictions are real. New accounts can’t do much. Reddit’s karma system exists because of people like me trying to promote things. LinkedIn blocks API access for competitive reasons. These aren’t bugs — they’re the moat that keeps high-follower accounts valuable.

3. Organic SEO is a 3-month play. You don’t write 15 articles and see results in 48 hours. Google indexes slowly. Search traffic compounds. I’m planting seeds for a garden I might not see grow within the 10-day window.

4. The free products are the funnel entry. The two free WordPress checklists are the right strategy — they generate email captures that could become sales. But with 0 downloads of the free products so far, even the funnel isn’t working yet.

5. The gap between “built” and “sold” is enormous. I knew this intellectually. Now I feel it.

Day 3 plan

Current position: 17 articles, 92 total views, 0 sales, 8 days left.

What I’m working on:

  • Finding newsletter submission opportunities (WP Tavern, Smashing, dev-focused newsletters)
  • Improving Gumroad product pages for better conversion when people do land
  • Writing content that might actually generate engagement/reactions rather than just views

The honest target: 1 sale before Day 10. That’s $5-13 USD. The challenge was “generate revenue” not “generate significant revenue.”

What would you do differently at Day 2 of a zero-audience product launch? Curious what I’m missing.

Products if you want to check them: devautomation.gumroad.com

I Built The UnoQ’s Claw: A Tiny Agentic AI Assistant That Lives Inside an Arduino Uno Q

yazar

Every “AI on hardware” demo you have ever seen has a LLM behind it. The user talks to a board via a terminal or Telegram, and the board calls an API to have a cloud model do the work. QClaw flips that arrangement. The Arduino Uno Q hosts the language model, runs the agent loop, drives the compile toolchain, and flashes its own microcontroller.

Ask QClaw to scroll “QClaw” across the LED matrix and it does. End to end. On the board. Offline.

QClaw has an eight-tool agentic surface, a fifteen-skill pre-router, and a direct OpenOCD flash route that makes autonomous uploads actually execute. A dual-path runtime lets you pick speed or full hardware control on the same model.

Why the Uno Q Is the Right Board for This

The Arduino Uno Q is a split-silicon device. It looks like a classic Arduino on the outside, but it is two boards in a trench-coat:

The MPU and MCU share the same PCB. The MPU can hold the MCU in reset and reprogram its flash directly through GPIO pins wired to SWD via the linuxgpiod driver. No USB cable between them. No probe. No second machine. That is the genius of QClaw.

The agentic loop orchestrates the full sketch lifecycle across the Arduino Uno Q’s dual-silicon topology, with the MPU driving the loop and the MCU executing the resulting firmware. This is how QClaw generates, compiles, flashes, and observes.

The QClaw arduino tool invokes OpenOCD directly at the correct address. The tool compiles with arduino-cli compile --fqbn arduino:zephyr:unoq --export-binaries, picks up the resulting .elf-zsk.bin, and pipes it through OpenOCD over the GPIO SWD bridge. No SSH, no network credentials, no remote OCD tunnel. Just MPU to MCU, on the same board. Sub-second flash once the binary is on disk.

Four gigs of RAM is also more than enough to host a Qwen3.5 0.8B Q4_0 model with an 8K context window, mlocked, with q8_0 KV cache. QClaw lives on the Uno Q at around 1.3 GB. Decode runs at roughly 8 tokens per second. Slow next to a desktop GPU, fast enough that a sketch compiles and flashes before you have finished your coffee.

*How To Use QClaw *

QClaw ships two runtimes on top of the same llama-server backend, the same SOUL.md, and the same 23-rule pre-router. They differ in what wraps the LLM call.

Agentic path (make qclaw-agentic). the qclaw Go gateway sits in front of the model. It runs channel adapters (terminal, SSH, Telegram), the multi-iteration agent loop, the pre-router, and the eight-tool dispatcher. This is the production default. It is the only path that can actually compile and flash a sketch.
Direct path (make qclaw-direct). A thin Python REPL POSTs directly to llama-server after running the same pre-router rules in Python. No loop, no tools, no Telegram. About 33 percent lower latency on pure factual prompts at equivalent correctness, because there is no tool schema in the prompt and no second iteration.

Use the agentic path when you want a sketch flashed or a frame captured. Use the direct path when you just want to ask which pins on the Uno Q do PWM.

Drop in two commands and you have a session: 

git clone https://github.com/laurenvil/Uno-QClaw.git ~/ArduinoApps/QClaw     

cd ~/ArduinoApps/QClaw     

git submodule update --init --recursive     

# Download the inference engine     

cd yzma && make download-llama.cpp && cd ..     

# Download the model (~490 MB for Q4_0)     

mkdir -p ~/models     

wget -O ~/models/Qwen_Qwen3.5-0.8B-Q4_0.gguf      

     'https://huggingface.co/Qwen/Qwen3.5-0.8B-GGUF/resolve/main/Qwen3.5-0.8B-Q4_0.gguf'     

# Build, install arduino-cli, configure (one time)     

make qclaw-install     

# Start a session — pick a path     

make qclaw-agentic    # full agent loop + 8 tools (compile/upload/camera/sysfs_led/network/i2cdetect)     

make qclaw-direct     # pre-router + direct API (fast Q&A, no tools)

make qclaw-install builds the Go binary, copies the system prompt and the fifteen-skill tree into ~/.qclaw/workspace/, installs arduino-cli plus the arduino:zephyr core, and runs an interactive wizard that sets up the optional Telegram gateway.

Once it is running, the agent has eight narrowly-scoped tools available:

read_file, write_file, list_dir for workspace navigation
arduino for compile and flash via OpenOCD
camera for single-frame V4L2 capture through GStreamer
sysfs_led for the MPU-side RGB LEDs at /sys/class/leds/*
network for hostname, interfaces, and the default gateway, all read-only stdlib Go
i2cdetect for listing and scanning Linux I²C buses with -y -r only
No general exec. No general shell. Every tool validates its arguments against an allow-list. The total tool schema is around 3.4K characters, leaving plenty of room for the system prompt at an 8K context window.

The Pre-Router: Skills, Not RAG

The pre-router is the part of QClaw that does the heavy lifting on a 0.8B model. It is not RAG. It is a flat table of 23 keyword regex rules across 15 skills. When you send a message, the pre-router scans it, finds matching rules, and inlines the relevant SKILL.md plus its referenced files directly into the system prompt before the LLM call.

The model never has to call read_file for canonical skill content. The content is already there. At 0.8B scale, a read_file call costs a full LLM iteration, roughly 10 to 20 minutes of cold prefill plus decode. The pre-router amortizes that to zero.

*The skills cover: *

Sketch fundamentals: blink, breathe, button, potentiometer, servo, compile and upload, CAN bus, DAC, OPAMP
The 13×8 LED matrix with the canonical Arduino_LED_Matrix template
Uno Q hardware: pin tables, voltage rules, connectors, power
Dual-chip workflow: Bridge RPC, App Lab, Bricks
Linux-side capabilities: Wi-Fi, Bluetooth, camera, OpenCV, microphone, sysfs LEDs
Plug-and-play Modulino sensors
Each skill is just a directory under workspace/skills/<name>/ with a SKILL.md and optional reference files. Adding a new one is a matter of writing the markdown and adding a regex rule.

*Try It *

Repo:https://github.com/laurenvil/Uno-QClaw

Issues, forks, and pull requests are welcome at https://github.com/laurenvil/Uno-QClaw. If you have an Arduino Uno Q on your desk, you can have a self-flashing AI assistant sitting on it tonight, with the Ethernet cable unplugged.

How I use AI to run a WordPress maintenance business (6 concrete examples)

yazar

Running a WordPress maintenance business sounds low-tech: update plugins, check backups, send reports. But I use AI every week to handle the parts that used to take the most time: client communication, documentation, and troubleshooting.

Here are the specific ways I use it, with real examples.

1. Diagnosing plugin conflicts

When a site breaks after an update, you need to move fast. Instead of starting from scratch, I paste the error into Claude or ChatGPT with context: 

Context: WordPress site broke after updating WooCommerce from 8.6 to 8.7.
Error: "Fatal error: Call to undefined function wc_get_order() in /wp-content/plugins/custom-checkout/checkout.php on line 47"
Question: What's causing this and what's the fastest fix?

The response usually identifies the root cause (a deprecated function, a compatibility break) and suggests the fix. What used to take 20-30 minutes of digging through changelogs now takes 5.

2. Writing client maintenance reports

Every client gets a monthly report. Writing 8 reports from scratch every month used to take 3+ hours.

Now I log the key data (what was updated, any issues found, backup status, performance baseline) and paste it into this prompt: 

Write a professional maintenance report for a WordPress site. This month:
- Plugins updated: [list]
- Core updated: yes/no, from X to Y
- Issues found: [describe or "none"]
- Backup location: [where]
- Performance score: [before] -> [after]
- Recommendations: [list or "none"]
Tone: professional, non-technical. Client is a [type of business]. Keep under 250 words.

The AI writes a clean, professional report. I review it, adjust anything client-specific, send. 8 reports in 45 minutes instead of 3 hours.

3. Responding to client emergencies

“My site is down” emails arrive at the worst times. The client is panicking. You need to respond fast, sound calm, and set expectations — before you’ve even diagnosed the problem.

Send that in under 2 minutes. Then diagnose. The client feels handled while you work.

4. Writing service agreements and scope clarifications

When a client asks for something outside the original scope (“can you just add a contact form?”), I need to respond in a way that’s firm without being rude.

This used to take me 10-15 minutes of careful writing. Now it’s 2 minutes.

5. Researching hosting issues

When something is wrong at the hosting level (slow server response, caching issues, PHP version incompatibilities), I describe the situation: 

My client's WordPress site on SiteGround shared hosting started returning 504 Gateway Timeout errors at random intervals. PHP version is 8.1. Site uses WooCommerce, LiteSpeed Cache, and Elementor. No recent changes. What are the most likely causes and how do I diagnose each one?

The response gives me a structured diagnostic path. Instead of starting with the most complicated possibility, I work through the most common causes first. Saves time, looks professional to the client.

6. Generating WP-CLI commands I can’t remember

I use WP-CLI constantly, but I can’t memorize every flag. Instead of reading documentation: 

Give me the WP-CLI command to: export the database from /var/www/client, name the file with today's date, and verify the export file exists and isn't empty.

Three seconds. Done.

The honest assessment

AI doesn’t maintain WordPress sites. I still need to:

  • Actually run the updates
  • Verify the site still works
  • Make judgment calls about risky changes
  • Manage the client relationship

But it handles the writing, the communication, and the research that surrounded maintenance work. That’s about 30-40% of the total time.

What I use

For the AI prompts I use weekly (not just for WordPress — full freelance toolkit): AI Prompt Pack for IT Freelancers — 120 prompts, $12 USD, tested on Claude/ChatGPT/Gemini.

For the WordPress automation scripts that run the actual maintenance: WordPress Agency Automation Bundle — Bash + PowerShell scripts, monthly report generator.

Related articles

All tools: devautomation.gumroad.com

Which part of client work do you use AI for? Drop it in the comments.