Resources
Everything we have written down in one place - engineering articles, a plain-language glossary, and the open-source code behind our products. Start anywhere; they all link back to each other.
From the blog
Notes from the team on how we build governed AI, audit AI-generated code, and run data pipelines.
What are AI agents, and when do you actually need one?
A script that emails you when a metric drops is not an agent. An agent is a model that decides its own next step, calls a tool, reads the result, and decides again - in a loop - until the job is done. That loop is the whole idea, and it is also the reason agents are harder to trust. Here is when the loop is worth it, and when a plain prompt or a fixed workflow will beat it.
Read articleCost control for LLM apps: tokens, caching, and model choice
A team we talked to was paying to resend the same 6,000-token system prompt on every single request - the model re-read their entire policy manual thousands of times a day. Their bill was mostly repetition, not intelligence. LLM cost is not a mystery; it is a small number of habits. Here are the ones that move the bill.
Read articleDesigning a chatbot that won't invent your pricing
The scariest chatbot failure is not "I don't know." It is a confident, well-formatted, completely wrong price - the kind a customer screenshots and holds you to. A language model will always fill a gap with something plausible unless you design the gap out. Here is how to ground a chatbot in your real numbers and teach it to say "let me check" instead of guessing.
Read articleChannel to shell: a blind audit of a 3-million-line AI assistant
We already pulled this open-source project apart by its CVE feed. This time we read it cold - 3.2 million lines, no brief, no advisory list - and the blind pass surfaced 71 issues the advisory feed never will. Nine are Critical, and they are all the same path: an untrusted chat message reaching a terminal, a URL fetch, or a code-exec tool with nothing guarding the gap.
Read articleVersion ranges are a coin-flip: nearly half the CVEs flagged on one repo were already fixed
We pinned a heavily-audited open-source project at one exact release and computed which advisories a standard version-range check says it is exposed to: 34. Then we read the source for all 34. Sixteen - 47% - were already fixed. Version-range matching is triage, not a finding.
Read articleWhat an AI code auditor actually finds: patterns from 164 findings
Across four AI-generated codebases - 181 files and ~45k lines - YCAudit has raised 164 findings. The same failure modes keep coming back: secrets in .env, unvalidated LLM output reaching real actions, and missing tests for the one invariant that mattered. Here are the numbers.
Read articleAuditing a governed agent: what YCAudit found in Yopa
We pointed YCAudit at Yopa - a Foundry agent we built specifically to be governed and human-approved - and it still surfaced 48 findings, including a committed .env and zero automated tests on the drawer that is the agent's only write path. Here is the full run.
Read articleInside a YCAudit run: auditing YedaFlow end-to-end
We pointed YCAudit at our own YedaFlow repo - 101 files, ~10k lines - and let all 14 stages run. Here is what a real audit report looks like, and why every finding ships as a root-caused spec for a coding agent instead of a silent fix.
Read articleIntroducing YCAudit: a skeptical second pass for AI-generated code
AI writes code fast and ships the happy path. YCAudit is the slow second pass: it reads a repository cold, raises findings across twelve dimensions, root-causes each one, and hands back fix specs - never silent edits. Here is the introduction.
Read articleRAG vs. fine-tuning: a practical decision guide
Your support bot needs to answer from 4,000 help-desk articles that change every week. Do you retrain the model or retrieve the articles? Almost always: retrieve. Here is the decision guide - what RAG and fine-tuning each actually do, when to reach for which, and why most teams start with the wrong one.
Read articleOpen-sourcing YedaFlow: the pipeline substrate for governed agents
A public Foundry pipeline pattern for resolving messy order data, detecting cited exceptions, and giving governed agents clean operational state.
Read articleOpen-sourcing Yeda AI's Foundry agents: Yoca and Yopa
Two public Foundry agent examples show cited recommendations, human approval, deterministic fixtures, and governed action boundaries.
Read articleAI & data glossary
Plain-language definitions of the terms that come up across our articles - from RAG and embeddings to prompt injection and governance.
Open the glossaryOpen source
The public slices of our agent and pipeline work, Apache-2.0 licensed, each runnable locally with a deterministic fixture - clone and read the pattern end to end.
Browse on GitHub