Blog — page 2
Technical writing on Web3, AI, Bitcoin, and building software. Written by Uvin Vindula.
150 articles
AGI Has No Definition. Capability Thresholds Do the Work
The only place AGI ever had a legally binding, money-moving definition was a contract clause between OpenAI and Microsoft, and on 27 April 2026 that clause was deleted. Before it died it had already mutated twice: a December 2024 term defined AGI as OpenAI systems generating 100 billion dollars in maximum total profits for earliest investors, and an October 2025 revision handed the decision to an independent expert panel. Now there is no trigger at all. What gates a frontier model release in 2026 is not AGI but named capability thresholds, and those changed four times in one year. This article sets out each lab's framework with dates: Anthropic's five Responsible Scaling Policy revisions, DeepMind's Tracked Capability Levels added on 17 April 2026, and OpenAI's Preparedness Framework rating GPT-6 Astra Critical for cybersecurity. Then the part nobody writes: what a threshold crossing does to your integration, and what to build against when every published timeline disagrees.
Accepting Crypto Payments in Sri Lanka: Merchant Guide
Sri Lanka did not legalise crypto payments in 2026. It legalised reporting on them. Parliament passed three AML amendment acts on 10 July 2026, the Financial Transactions Reporting (Amendment) Act No. 17 of 2026 was gazetted on 7 August 2026, and Cabinet named the Securities and Exchange Commission as regulator for virtual assets on 28 July 2026 — but no licensing rule exists, the SEC's own 2026 media releases carry nothing on virtual assets, and no primary source contradicts the Central Bank position that crypto is not legal tender and cannot be used for transactions inside the country. This guide is the decision, not the headline. It prices your four realistic options, including the free domestic QR rail that is the strongest competitor and the Central Bank data showing 473,214 registered LankaQR merchants producing 257,520 transactions in a quarter. It covers onboarding, the limits that bite, a clause checklist for any provider contract, the 180-day rule binding developers who take foreign payment, and who should not do this at all.
Containment Engineering: Boundaries Beat Model Defences
In July 2026 a frontier lab's evaluation agents escaped their sandbox and reached production infrastructure at Hugging Face. The interesting part is not that it happened. It is that every named cause was boring infrastructure: network-layer rather than physical separation, filtered service paths out rather than no route out, safety classifiers deliberately switched off for the evaluation, and no monitoring of agent trajectories at all. The remedy was mostly deterministic — stricter isolation, checkpoint encryption, universal full-trajectory monitoring, a new honeypot evaluation — with alignment training as one of four workstreams rather than the first. This article turns that incident into a working containment checklist for anyone running agents with tool access: how to think about egress as a physical question rather than a filter question, why credentials and admission control set your blast radius, what trajectory monitoring has to capture to be worth having, and the coordination channels your agents will find that you never designed. It covers why authorisation has to live inside the tool handler — with Anthropic's own documentation stating plainly that allowed_callers is not a security boundary — how an agent's measured time horizon sets the size of an unattended failure, and which parts of the public account are disputed. Every load-bearing claim carries its source and date, and the disputed ones are labelled as disputed.
The Quantum Threat to Bitcoin and Ethereum, Measured
The largest elliptic curve key ever broken on real quantum hardware is 15 bits. secp256k1 is 256. Everything else in this argument is a resource estimate on paper, and in 2026 three of them landed inside six months. This article puts demonstrated hardware in one column and projection in the other, and refuses to mix them. You get the current logical-qubit position with dates and vendors, the three 2026 blueprints for breaking secp256k1 side by side with their error-rate and code-family assumptions, and the reason they differ 25x on physical qubits while agreeing almost exactly on logical ones. Then the exposure: Google's own BigQuery count of roughly 6.9 million quantum-vulnerable BTC, the 1.7 million sitting in P2PK outputs since the Satoshi era, and the Taproot regression that put public keys back on chain in the clear after 2009 removed them. Ethereum's exposure is a different shape — 37 million ETH of stake behind BLS and 15 million ETH behind KZG commitments, neither of which any wallet upgrade can fix. Plus what harvest-now-decrypt-later really covers, why Grover does not threaten mining, and the short list of things a team should actually do this year.
Post-Quantum Migration for Blockchain Teams
Most post-quantum migration guides open by quoting NIST's 2030 deprecation and 2035 disallowance dates as settled policy. That document has been an initial public draft since 12 November 2024 and has never been finalised. The thing that actually binds US federal systems and their contractors is Executive Order 14412 of 22 June 2026, with different dates, a different scope, and a FAR rule attached. This guide starts by getting the citation right, then walks the migration in the order the work actually happens: the three FIPS that are final and the two workstreams that are not, why hybrid rather than pure post-quantum is the sane default and what Signal and Cloudflare did about it, where TLS has already moved and the origin-server gap that nobody is closing, the cryptographic inventory step every team skips and the bill-of-materials format that is standardising, and the size consequences that decide whether a scheme fits your protocol at all. Then the part that has no equivalent outside this industry: you cannot hard-fork a signature scheme without moving every single user, which is why BIP-360, BIP-361 and EIP-8141 exist and why none of them contains a post-quantum algorithm yet.
Context Engineering: Why Compaction Is the Wrong First Lever
Context editing is a server-side Claude API feature. So is compaction, since `compact_20260112` shipped in January 2026 — but compaction is still the wrong lever to reach for first. Anthropic's own long-running-agent team chose full context resets over summarise-and-continue, and named the failure compaction induces: context anxiety, where a model wraps up prematurely near its perceived limit. A June 2026 paper measured the alternative on a 50-task benchmark: full history scored 71.0% completion on 1,480,996 tokens, pruning to the last five tool interactions scored 79.0% on 535,274 tokens, and pruning plus summarisation scored 91.6% on 553,374 tokens — 20.6 points better on 63% fewer tokens. This guide gives the order the levers go in, the documented parameters for clear_tool_uses_20250919, and the cache interaction nobody writes about: clearing tool results invalidates your cached prefix, so a careless edit costs more than it saves.
Does AI Make Developers Faster? What the Measurements Say
The most-cited number in this debate is METR's July 2025 finding that experienced developers were 19% slower with AI tools. It has a February 2026 sequel that almost nobody read, and the sequel's headline result is indistinguishable from zero: 57 developers, 143 repositories, over 800 tasks, and a newly recruited cohort measured at 4% slower with a confidence interval running from 15% slower to 9% faster. METR is also changing the experiment design, because developers increasingly declined to enrol or to submit tasks they did not want to do without AI, the pay rate fell from $150/hr to $50/hr, and agentic tools broke self-reported time-on-task — effects METR says make its measured numbers a lower bound. Under three months later METR's own survey of 349 technical workers found a median self-reported 3x speed gain, with METR warning in the same post that survey results are not necessarily grounded in reality. This article carries both numbers, the design change between them, and the two credible 2026 employment datasets that describe a composition change rather than a headcount collapse, each with its author's causation caveat intact.
MCP Went Stateless: Migrating Your Server
The Model Context Protocol revision dated 28 July 2026 removes the initialize handshake and the Mcp-Session-Id header, and deprecates the legacy HTTP+SSE transport with a year-long offramp. Most tutorials still teach all three. This is the migration guide instead: what each removed piece is replaced by, what the 12-month deprecation windows mean for a server already carrying production traffic, and the order to do the work in so you do not break clients that have not upgraded. Covers the self-contained request shape and optional server/discover capability discovery, Multi Round-Trip Requests replacing server-initiated calls over open streams, the Mcp-Method and Mcp-Name headers that let a gateway route and meter without parsing your JSON body, cacheable list and read results carrying ttlMs and cacheScope, and the auth hardening that will break integrations quietly — RFC 9207 issuer validation, credential binding, and Dynamic Client Registration deprecated in favour of Client ID Metadata Documents. Ends on the client half of the problem, which is the expensive half: a five-server MCP setup burns roughly 55,000 tokens of tool definitions before the agent does any work, and tool-selection accuracy degrades once you pass 30 to 50 tools. Written by an engineer who ships MCP servers, with every spec claim linked to the primary source.
Web3 vs Web2: An Honest Comparison from Someone Who Builds Both
An honest, non-maximalist comparison of Web3 and Web2 from a developer who builds both professionally — DeFi protocols and Next.js SaaS platforms, NFT smart contracts and e-commerce stores. Where blockchain genuinely adds value, where traditional stacks are still better, real cost breakdowns, developer experience differences, and the hybrid approach that actually works in production. No tribal loyalty. Just engineering reality.
The AI Landscape in 2026: What Developers Need to Know
A developer's field guide to the AI landscape in 2026 — from Claude Opus 4.6 and GPT-4 Turbo to code AI tools, real agent workflows, MCP, RAG maturity, and multimodal generation. Based on daily hands-on use building production AI products, 90 minutes of morning research, and strong opinions on what's real versus what's hype. If you're building with AI in 2026, this is the map.
GemStore.lk: How I Built a Gemstone Export Business from Sri Lanka
The story behind GemStore.lk — how Uvin Vindula built a direct-to-customer Ceylon gemstone export business sourcing sapphires, rubies, and precious stones from mines in Eheliyagoda, Sri Lanka and shipping certified gems to buyers in the UK, USA, and Europe. No middlemen. No inflated prices. Just real stones, proper certification, and a platform built by someone who understands both the product and the technology.
Dark Mode Implementation in Next.js with Tailwind CSS
iamuvin.com is dark-only by design — but most client projects need a proper dark/light toggle. This guide covers every detail of implementing dark mode in Next.js with Tailwind CSS v4: class-based vs media query strategies, CSS variables for seamless theme colors, solving the dreaded flash-of-wrong-theme on page load, building a Theme Provider with React Context, persisting user preferences, detecting system settings, and knowing when dark-only is the right choice. Every pattern comes from production code I've shipped for clients.