DEV Community: Nicolas Fränkel

AI-assisted genealogy, a follow-up

Nicolas Fränkel — Thu, 24 Sep 2026 09:02:00 +0000

I got a lot of feedback on my post AI-assisted genealogy, some good, some not so good. In any case, I felt the subject was interesting to a lot of people. Meanwhile, I continue working on my tree, and I have deepened my understanding of the subject. In this post, I want to share again.

Trust, but verify

Let's address the not-so-good feedback first. The gist of it was: AI can hallucinate. It's true in theory: when you ask a question, it provides any answer. The pushback is much less valid when the answer is grounded in data.

The other feedback I had was that genealogy sites weren't trustworthy sources. It's a valid point, which I already acknowledged in the initial post.

The process is always the same.

Pick someone in the tree with unknown parents, and let the assistant do the search. It knows which genealogy sites to browse, and which archives hold the civil records for the place. When it finds the act, it transcribes it, adds the new individuals to the GEDCOM file, links them to their child, and records the source. Then it commits.

Rinse and repeat. Each loop adds one generation on one branch, until no records are found.

—- The loop

I realize that I could have been more detailed, so let me fix it.

GEDCOM has the concept of quality, with the QUAY directive:

The QUAY tag's value conveys the submitter's quantitative evaluation of the credibility of a piece of information, based upon its supporting evidence. Some systems use this feature to rank multiple conflicting opinions for display of most likely information first. It is not intended to eliminate the receiver's need to evaluate the evidence for themselves.

Quality Description

0 Unreliable evidence or estimated data

1 Questionable reliability of evidence (interviews, census, oral genealogies, or potential for bias for example, an autobiography)

2 Secondary evidence, data officially recorded sometime after event

3 Direct and primary evidence used, or by dominance of the evidence

Quality	Description
0	Unreliable evidence or estimated data
1	Questionable reliability of evidence (interviews, census, oral genealogies, or potential for bias for example, an autobiography)
2	Secondary evidence, data officially recorded sometime after event
3	Direct and primary evidence used, or by dominance of the evidence

The table defines guidelines, not precisely defined rules, so I interpreted them:

Genealogy sites are QUAY 2
Official acts, whether civil or parish-based, are QUAY 3

The process is the following:

Mine the huge amount of data available on genealogy sites
Set their QUAY to 2
Check the data is in an official record
If yes, set the data's QUAY to 3
Otherwise, discard the data

Hence, trust, but verify.

Archives and browsing skills

In the original post, I mentioned you should create one skill "per site". As in the previous section, I may have been a bit concise. Let me detail:

One per genealogy site (Geni, Geneanet, etc.)
One skill per archive site, whether city or department archives

Archive sites can be roughly classified along two orthogonal axes.

Account: fully open access vs. required account
Bot protection: I identified the 3 following levels.
- At the lowest, the site is accessible with curl
- Needs a full-fledged browser. For this, I added a small uv-based Python project to steer Playwright.
- Cloudflare-protected (or similar). This is the highest protection level I faced. In some cases, even checking the "I'm a human" checkbox didn't work. To bypass it, I used Chrome in debug mode; I'll write a full-fledged post about it.

Automating account login

I mentioned that some sites require you to be logged in. Of course, you could give your assistant access to your credentials, but that wouldn't be a smart thing to do.

For the highest bot protection, there's no alternative but to start Chrome in debug mode, log in, and let the assistant steer the browser via the debug port. It's fragile: anything that closes the browser ends the run.

For other sites, you should use Playwright with stored sessions. It goes like this:

Launch a browser with a persistent session
Log in to the sites you want to use
Close the browser. The profile has stored the authentication data.

Later on, the assistant can start the browser within the context of the same session: the assistant will have the same access as the user who logged in. Session length depends on the exact site, so you should do it before an unattended run.

The benefit over the debug approach is that it survives closing the browser.

Leveraging genealogy sites

My original advice was to mine genealogy sites with a premium subscription, then switch to official records. Since then, I have refined the approach.

First, I have made it a cycle. After uncovering new ancestors in records, I went back to genealogy sites. In some cases, these ancestors were already part of others' trees, and I could jump a couple of generations again. Even if these later jumps are much smaller than the initial ones, it still means fewer tokens pinpointing the exact act in a record.

These new ancestors don't automatically come into your tree. Most genealogy sites have the concept of a smart match. They run heuristics able to match (hence the name) people from unrelated trees. Some sites are better than others for this. You need to be very careful when you accept a match, as it can corrupt a whole branch of your tree, by adding unrelated people. Hence, I tend to be very conservative. On the other hand, you can discover new spelling variants of your ancestors' names. Perhaps you missed an act because the assistant didn't search for the correct variant?

Finally, most (all?) of these sites have two tiers: full data access and limited data access. Full access is unlocked during a trial period, either when you register or when you subscribe. Subscription can be expensive. Worse, some sites only offer a yearly subscription package. I had no qualms about registering email addresses.

Leveraging Topola

I still use and love Topola, the GEDCOM viewer.

Among its features, it allows displaying a thumbnail for an INDI in the tree. It works with the first OBJE object associated with the INDI. Other OBJE are displayed in the right-side panel. If you have photographs of your ancestors, it's a nifty feature.

I like order, so I follow these rules:

The profile picture must be a portrait. If I have no portrait, I crop an existing one to serve as such.
All OBJE that reference images are set in chronological order. Thus, the right panel displays them in the same order.

Transcriptions

Transcriptions are essential. Acts are images, and you want their data to be easily accessible.

From the beginning, I delegated the transcription process to the assistant. Your ability to decipher cursive script depends on several factors:

The writing style of the clerk. The further back in time you go, the less standard the writing style is and the harder it is to decipher.
Your familiarity with the language. Depending on your tree, you may have ancestors with acts in foreign languages.
The act's age. The older the act, the harder it is to recognize some expressions, and the more the orthography is "fluid".

For these reasons, I started with transcriptions made by the assistant. I noticed it was quite careful sometimes: where I would have inferred a word, it decided to put a placeholder. It did the same for letters. I tried several alternatives.

I asked for the best tool available and Transkribus. It's a paid online tool, with lots of model choices. Some models are premium, others are free. It also gives you 50 free transcriptions a month. You just need to agree to wait in the queue, as runners for freeloaders are few.

I tried 3 or 4 times after having exceeded my assistant quota. Results were abysmally bad, producing only gibberish, not even word soup. I read later that you had to train the model on your own document. It means you need to transcribe one or two pages of a record, and the results would improve over subsequent acts of the same record. Honestly, I won't use it again.
To save my assistant tokens, I also tried a local setup. I leveraged kraken with dedicated models depending on the language and the era. It was much better than Transkribus, but nowhere near the assistant capabilities. Whether I missed a configuration step or assistants have made huge leaps in ability, I'll never know. In the end, I just scrapped the skill.
A very good surprise is Filae. It's a small French genealogy site. However, its transcription capabilities are second to none for French handwriting. I used it a couple of times with amazing results. The only issue is that it seems that they switched off this service. A pity.

Hiccups and hurdles

Now that I've fleshed out more details about creating your family tree, here are some issues I have encountered, for fun. In no particular order:

Three or even four generations of ancestors who lacked imagination and gave a child their first name. Now, you have a bunch of people in the same place with the same first name and last name.
You get used to records being births, baptisms, marriages, deaths, or burials? What about a bit more variety, mixing some of them into the same one? Binary-searching for an act by date is now much more challenging.
Mixed act types in a single record is just the beginning. It gets even better when dates aren't monotonic, i.e., in no order. It's the case for some notarial records I stumbled upon.

Conclusion

I'm still working on the project, and now have more than 1200 people and span 13 generations on a branch. I hope this additional advice will be helpful if you choose to follow the same path.

To go further:

Originally published at A Java Geek on September 20^th, 2026.

World geography gotchas

Nicolas Fränkel — Thu, 17 Sep 2026 09:02:00 +0000

Years ago, a colleague of mine told me about two pockets of foreign land surrounded by Switzerland: Campione d'Italia and Büsingen am Hochrhein, respectively Italy and Germany. Both are enclaves of their respective country in Swiss territory:

An enclave is a part of the territory of a state that is enclosed within the territory of another state. To distinguish the parts of a state entirely enclosed in a single other state, they are called true enclaves. A true enclave cannot be reached without passing through the territory of a single other state that surrounds it.

—- Enclave and exclave

Enclaves can be seen from different perspectives. From a bird's-eye view, they are fun:

If the enclave and its surrounding country are at odds (or worse), the life of its inhabitants can be hell. However, this post is about software, so let's focus on that. Imagine having to design systems for one of these two towns. Take Campione, for example. This is what you could have to deal with, depending on the domain you tackle:

Domain	Quirk	Impact on systems
Taxation and customs	Since 2020, Campione has been part of the EU customs territory, but it stays outside the EU VAT area. A local consumption tax applies instead, with Swiss VAT rates. Before 2020, the town was de facto in the Swiss customs territory.	Online shops and accounting software need one exception for customs and another for tax.
Public services	Italian law applies, but firefighters, ambulances, and healthcare come from Switzerland. The Carabinieri, the Italian police, provide security.	Systems for the police, emergency services, and hospitals apply Italian law to services that Switzerland delivers.
Currency	The Swiss franc is the main operating currency, though the euro is officially legal tender. Salaries are paid in Swiss francs.	Payment and banking systems handle two currencies, and payroll crosses the border.
Address and geolocation	Campione uses Swiss postal codes (CH-6911) and Swiss phone numbers (+41), except for the town hall, which has an Italian +39 number. Poste Italiane processes the mail.	Address validation, shipping, and phone systems see a Swiss postal code and a Swiss prefix on an Italian address.
Vehicle registration	Vehicles must be registered in Italy, in Como, and carry Italian license plates. Some used to have Swiss Ticino plates, but this is no longer allowed.	Plate validation fails if it derives the country from the address.
Data privacy	Campione falls under the GDPR and the Italian Privacy Code, but many services, such as healthcare and utilities, are Swiss. Data flows across the border.	Any system that stores personal data falls under both Italian and Swiss privacy law.
Healthcare	Residents can get Swiss hospital care through bilateral agreements, but insurance contracts must comply with Italian law.	Health insurance systems check eligibility on the Swiss side and contracts on the Italian side.
Education	Schools are Italian, but students may attend Swiss schools because they are closer.	Student and scholarship systems enroll pupils in a school across the border and follow two curricula.

Enclaves are an extreme case, but gotchas are common.

Livigno, a few valleys east, is Italian and outside both the EU customs territory and the VAT area.
The Canary Islands are Spanish and in the EU, but outside the VAT area. Currency, tax, customs, mail, phone, and law are separate attributes: none of them follows from a country code.

Conclusion

Wherever you work, chances are high that you'll have to deal with this kind of thing when designing software. There are plenty of enclaves to start with. The real world is much more complex than we expect. Be sure to research first.

To go further:

Originally published at A Java Geek on September 13^th, 2026.

Build an AI Agent (From Scratch)

Nicolas Fränkel — Thu, 10 Sep 2026 09:02:00 +0000

This review is about Build an AI Agent (From Scratch) by Jungjun Hur and Younghee Song from Manning.

Facts

10 chapters
$29.29 (at the time of this writing)
315 pages

Chapters

Building your first LLM agent
1. What is an AI agent?
2. The brain of AI agents: LLMs
3. Enabling actions: Tool use
4. Implementing a basic ReAct agent
Developing advanced agent capabilities
1. Building knowledge bases with RAG
2. Adding memory to your agent
3. Planning and reflection for complex tasks
4. Empowering agents with code execution
5. Orchestrating multi-agent systems
6. Evaluating agents

Pros and cons

At Manning, I consider the following two books to be references:

Kubernetes in Action by Marko Lukša. It's the book that taught me the foundations of Kubernetes. Fun fact: I got it from the author at a conference in exchange for Swiss chocolate.
API Design Patterns. I read it while working on the Apache APISIX API gateway. At this time, I was deeply involved in (RESTful) APIs. I had read a lot on APIs; I had researched a lot; I held talks on APIs; I talked with lots of people about APIs. And yet, the book was a revelation, full of brilliant insights.

I think that Build an AI Agent is as fundamental to me as the other two were.

While there are few chances that you will actually build an AI agent, this book teaches you the basics (and more) of how they operate. It starts with the agent loop, then proceeds to tools, then to MCP, etc.

The only thing I would like to see for the next edition is for the developers to beef up the evaluating agents part.

Conclusion

If you use AI agents and want to understand what happens when you use them, this is the book for you. I think it should belong in the library of any engineer worthy of the name.

Originally published at A Java Geek on September 6^th, 2026.

AI-assisted genealogy

Nicolas Fränkel — Thu, 03 Sep 2026 09:02:00 +0000

My son recently came to me to brag about using AI to find our ancestors. While the results were correct, I didn't learn anything new, as it stopped at my grandparents. I was never very interested in my genealogy, but I decided to see if AI would be a good tool for this. TL;DR: Yes, it is, and even more than that. In a little less than one month, I managed to gather more than 600 individuals and get back 12 generations in some branches.

In this post, I want to explain how I did it so that you can do the same.

Setup

I decided to handle the project like any other software project:

git.
A git provider. I'm using both Codeberg and GitHub. See below for the rationale.
Cloudflare Pages to visualize the tree.

I searched a bit about how to store data and found the GEDCOM format specification:

The word GEDCOM is an acronym for GEnealogical Data Communication. GEDCOM was created by The Church of Jesus Christ of Latter-day Saints as the specification for exchanging genealogical data between different family tree software products. The original GEDCOM specification was released in 1984, and the last update to it was version 5.5 in 1996 with an incremental upgrade to version 5.5.1 released in 2019.

—- About GEDCOM

The latest 5.x specification version is 5.5.1, re-released as a standard in 2019. FamilySearch rebooted the specification in 2021 to create v7.0, which is still maintained today. Few tools are actually compatible with it. For this reason, I limited myself to using 5.5.1.

GEDCOM 101

GEDCOM is a structured format, based on indentation level. The indentation is not space-based, but relies on a leading number. It looks something like this (spaces added for better readability):

0 @I1@ INDI                                   # 1
  1 NAME John Martin /Doe/                    # 2
  1 SEX M
  1 BIRT
    2 DATE 1 JAN 1970
    2 PLAC Paris, 8e, Paris, France
    2 SOUR @S1@                               # 3
      3 PAGE Birth certificate EA68410

The base entity is the INDI, an individual
Last name is defined between slashes
Source with ID

As I mentioned, I added extra spaces. The following snippet is the correct format:

0 @I1@ INDI
1 NAME John Martin /Doe/
1 SEX M
1 BIRT
2 DATE 1 JAN 1970
2 PLAC Paris, 8e, Paris, France
2 SOUR @S1@
3 PAGE Birth certificate EA68410

The loop

The process is always the same.

Pick someone in the tree with unknown parents, and let the assistant do the search. It knows which genealogy sites to browse, and which archives hold the civil records for the place. When it finds the act, it transcribes it, adds the new individuals to the GEDCOM file, links them to their child, and records the source. Then it commits.

Rinse and repeat. Each loop adds one generation on one branch, until no records are found.

What worked with the assistant

Most AI-related advice also applies to professional projects.

Switch model according to the task: Your token quota is limited by nature, unless you pay per token (but in this case, you're rich and tokens aren't an issue). It's not efficient to use super powerful models such as Fable 5 to send emails. However, it's equally inefficient to use a weak model for complex multi-step tasks: you will probably get wrong results.
Create skills: When you start either repeating the same instructions or notice that the assistant does come to the same conclusion over and over, it's time to create a skill. Skills are reusable sets of instructions, scripts, assets, and references. However, the biggest benefit of skills is that they don't bloat the context by default: they are triggered if their description matches the prompt. Skills can be orthogonal.

I have created several skills:

more than a couple to know how to navigate a site
one to transcribe record images into plain text (see below)
two for autonomous sessions (see below)
- Transcribe records into plain text: All records you will get will either be PDFs or images. PDFs are hard to parse, and images even more so. In the long run, it pays to parse and transcribe them once, so they can be reused cheaply afterwards.
- The assistant can make mistakes: It does the research, so its mistakes are research mistakes. It may misread a name on a scan, or pick the wrong person when two of them share a first name, a surname, and a village. However, my experience is that Claude Code is pretty good on transcriptions, and it's cautious by default.
- Set up grammar checks: The bigger the GEDCOM file, the more chances the assistant will break it at some point. If you notice it after many commits, it will be a mess to straighten it back. Make sure to check the GEDCOM structure at every commit. Either use local pre-commit hooks or a remote job on GitHub/GitLab/whatever.
- Long-running autonomous tasks: After a while, I got frustrated waiting for my quota to reset, and treated myself to Claude Max. I now had a gazillion tokens to use. It was not long before I started to run sessions overnight or while at work. If you are in this case, you need to come up with a strong structure so you don't find out at the end of the whole session that you have drifted.

I found out that my sweet spot was:

A subagent to avoid polluting the main agent's context
Serial subagents, not parallel, since I don't have a deadline, and it avoids facing the quota limit mid-month
The subagent works, commits in a worktree branch, the main agent checks and merges

What I learned about genealogy

Here are the things I learned. For genealogy experts, they may seem obvious. However, if you're a beginner, I hope they might be helpful.

Different countries have different potential: Depending on the country, you may get widely different results with the same process. Results may even differ for places inside the same country.

For this reason, and depending on where your ancestors stem from, the tree will probably be unbalanced. In some cases, it may even be quite limited.

A lot of data is already there: There are plenty of genealogy websites around. All of these I stumbled upon have a free tier. If you can find a common ancestor with someone who already did the work upwards for you, why not use it?
Work of others can be wrong: While you will populate your tree very fast with third-party work, don't take it as proof. You need to verify the facts with a legitimate administrative certificate.

For the record, I stumbled upon a collateral family member who supposedly died in Switzerland. Since he was the only one, I spent a bit of time trying to find his death certificate, to no avail. It turns out that he died in France in a hunting accident, but next to the border. It made the news in a local Swiss newspaper, and the person inferred that he had died there. Trust, but verify.

People are genuinely trying to help: Everyone I have contacted on these sites has answered. Everyone tried to help. In the worst case, I got nothing that I could use. In the best case, actually two, I got connected to historians who wrote books on the subject.
Birth certificates help push boundaries: Birth certificates mention the parents and their own birth date and place. If you can loop over several times, you will get a few generations in no time.

Marriage certificates are the next best thing. You'll find the groom and bride's parents' names, but will probably miss their own birth data.

French marriages usually happened at the bride's parish: I had never heard of this tradition, but Claude Code apparently did. In the past, for marriages happening between people from different towns, the tradition was to hold it at the bride's parish.

Treat it as a heuristic rather than a rule. I had a couple of cases when my ancestors didn't follow the tradition.

French civil acts are public 75 years after the event's date: In France, if you want a civil act, you need to prove you're either the person in the act or a direct ancestor. But that rule is removed if the act dates back 75 years or more. You can actually access the birth certificate of public figures such as Général de Gaulle this way, and search for their ancestors.
In small hamlets, everyone had the same surname: Because some of them also had the same first name, they had to add a discriminant. The discriminant was fortunately sometimes written in civil records. When it wasn't, it got extremely confusing.

Savoy is a good example of such surname things. They added a second surname there. You can read more about it here (in French).

GEDCOM allows defining a place format: I came to know about GEDCOM by working on the project, so the TIL items are a very long list. However, I think this one takes first place.

Different countries have different location structures. GEDCOM has a powerful and flexible scheme for locations, which allows defining the format, then the value.

  2 PLAC Lyon, 7e, Rhône, France
  3 FORM Ville, Arrondissement, Département, Pays

Visualization with Topola on Cloudflare Pages

The more people you add to your tree, the harder it is to visualize the GEDCOM model in your head. I searched for a couple of visualization solutions and found:

Gramps: It's a desktop-based application, available for many different platforms. It works pretty well, but its internal storage is SQLite. Though you can import GEDCOM, you need to clear the existing data first: you can't override them.
Topola Genealogy Viewer: Topola provides an interactive website for you to display a GEDCOM 5.5.1 file. It's the software I chose.

Topola also allows you to display the tree from one single static GEDCOM file. You can use it in a build process, e.g., a GitHub workflow, to generate the visualization website. The tree holds data about people who are still alive. I keep it private for this reason. GitHub Pages are public by default, so I didn't want to go this route.

I checked for options and found Cloudflare Pages. It's the first time I've used it, and it's amazing:

It integrates natively with GitHub
You can configure authentication. The easiest one is OTP on a list of allowed emails you configure.
It creates a subdomain for each branch, so you can preview changes!

The only downside is a limit of 500 builds a month, more than enough for a free offer and a hobby project.

This is also the reason for the two git providers. Codeberg hosts the repository I work on. GitHub only holds a mirror, because Cloudflare Pages builds from it.

Conclusion

I never thought about genealogy before. However, it's a lot of fun, and I'm hooked on it now. In one month, the assistant got me what some people spend years searching for. I hope this post gave you ideas and set you on the path.

To go further:

Originally published at A Java Geek on August 30^th, 2026.

Solving Gradle metadata and Renovate integration

Nicolas Fränkel — Thu, 20 Aug 2026 09:02:00 +0000

My current company has settled on using Gradle. It doesn't make me very happy, but you need to learn to work with constraints. Plus, I must admit that the developers who actually implemented the build files did a pretty good job overall: they used Kotlin instead of Groovy, they moved code to regular plugins, etc.

This week, I worked on improvements to a new project and set up Renovate. Renovate is similar to Dependabot in that it checks for new versions of your dependencies and automatically creates PRs for you. However, I quickly noticed that merges of new dependency versions failed the build. Here's the full story on why, and how I fixed the issue.

Supply chain hardening

In the last few years, one of the big issues in the IT world has been supply chain attacks. Depending on others' work isn't a new thing:

The woolen coat, for example, which covers the day-labourer, as coarse and rough as it may appear, is the produce of the joint labour of a great multitude of workmen.

—- Adam Smith, The Wealth of Nations

The software world has increased the phenomenon a lot due to two factors:

Digitized assets make the reproduction cost-free. You can distribute as many copies as you want.
Open Source has created many projects that serve as foundations for others, from full-fledged operating systems to specialized libraries, e.g., curl. Mandatory illustration:

For hackers, it creates an interesting attack vector:

Working with external dependencies and plugins from third-party repositories exposes your build to significant supply chain risks. Dependencies are the most commonly attacked part of the software supply chain, and every artifact you consume, including transitively pulled-in binaries, needs to be both legitimate and unchanged.

To illustrate the risk, consider building an application that uses the trusty-lib:1.0 library from a public repository. If an attacker successfully replaces trusty-lib in the repository with a malicious version having the same coordinates (trusty-lib:1.0), your next build will download the compromised code without any warning.

—- Verifying Dependencies

This type of attack is known as a supply chain attack. In recent years, there have been more than a couple of such attacks.

Verifying dependencies

The Java platform introduced dependency verification via JAR signing in early versions. It was present at the latest in 1.2. You can check the process documentation if you're interested. In short, a signed JAR has specific files in its META-INF folder.

JAR signing never became popular, and I can only assume the reasons why:

The process was (and still is) complicated
DevOps didn't exist
Certificates were expensive

Over JARs carrying their signature files, people preferred a weaker form of verification: no signature, but a short fingerprint of the file itself. This guarantees integrity. Integrity means you're downloading the exact file that you intend to.

Integrity verification is widespread because it's simple. You first download the file. Then, you run a dedicated application on the file to generate its hash. If the generated hash and the advertised hash match, the file is the original file; if not, it has been tampered with.

Maven Central provides such a hash for each artifact it offers for download. For example, here's the download page for the Log4J2 SLF4J bridge:

log4j-slf4j2-impl-2.26.1-cyclonedx.xml            2026-06-29 07:47     26067      
log4j-slf4j2-impl-2.26.1-cyclonedx.xml.asc        2026-06-29 07:47       856      
log4j-slf4j2-impl-2.26.1-cyclonedx.xml.md5        2026-06-29 07:47        32      
log4j-slf4j2-impl-2.26.1-cyclonedx.xml.sha1       2026-06-29 07:47        40      
log4j-slf4j2-impl-2.26.1-sources.jar              2026-06-29 07:47     23459      
log4j-slf4j2-impl-2.26.1-sources.jar.asc          2026-06-29 07:47       856      
log4j-slf4j2-impl-2.26.1-sources.jar.md5          2026-06-29 07:47        32      
log4j-slf4j2-impl-2.26.1-sources.jar.sha1         2026-06-29 07:47        40      
log4j-slf4j2-impl-2.26.1.jar                      2026-06-29 07:47     30212      
log4j-slf4j2-impl-2.26.1.jar.asc                  2026-06-29 07:47       856      
log4j-slf4j2-impl-2.26.1.jar.md5                  2026-06-29 07:47        32      
log4j-slf4j2-impl-2.26.1.jar.sha1                 2026-06-29 07:47        40      
log4j-slf4j2-impl-2.26.1.module                   2026-06-29 07:47      3524      
log4j-slf4j2-impl-2.26.1.module.asc               2026-06-29 07:47       856      
log4j-slf4j2-impl-2.26.1.module.md5               2026-06-29 07:47        32      
log4j-slf4j2-impl-2.26.1.module.sha1              2026-06-29 07:47        40      
log4j-slf4j2-impl-2.26.1.pom                      2026-06-29 07:47      5141      
log4j-slf4j2-impl-2.26.1.pom.asc                  2026-06-29 07:47       856      
log4j-slf4j2-impl-2.26.1.pom.md5                  2026-06-29 07:47        32      
log4j-slf4j2-impl-2.26.1.pom.sha1                 2026-06-29 07:47        40

Note the three associated files for each published file:

.asc: a GPG signature file
.md5: a MD5 hash
.sha1: a SHA1 hash

While Maven Central provides these files, it is up to consumers to verify the integrity (or authenticity) of the downloaded files.

Gradle verification

Gradle does help with signature or hash verification by automating the process. During the build process, it verifies the integrity or the authenticity of dependencies. To generate the file, run:

./gradlew --write-verification-metadata sha256,pgp

It creates an XML file similar to the following (sample taken from the documentation):

<verification-metadata
  xmlns="https://schema.gradle.org/dependency-verification"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="https://schema.gradle.org/dependency-verification
                      https://schema.gradle.org/dependency-verification/dependency-verification-1.4.xsd">
  <components>
    <!-- BOTH SIGNATURE AND CHECKSUM -->
    <component group="com.google.guava" name="failureaccess" version="1.0.3">
      <artifact name="failureaccess-1.0.3.jar">
        <pgp value="BDB5FA4FE719D787FB3D3197F6D4A1D411E9D1AE"/>
        <sha256 value="cbfc3906b19b8f55dd7cfd6dfe0aa4532e834250d7f080bd8d211a3e246b59cb"
            origin="Verified"
            reason="Added manually to fix CI"/>
      </artifact>
    </component>
    <!-- CHECKSUM ONLY -->
    <component group="antlr" name="antlr" version="2.7.7">
      <artifact name="antlr-2.7.7.jar">
        <sha256 value="88fbda4b912596b9f56e8e12e580cc954bacfb51776ecfddd3e18fc1cf56dc4c"
            origin="Verified"
            reason="Artifact is not signed"/>
      </artifact>
    </component>
    <!-- SIGNATURE ONLY -->
    <component group="com.beust" name="jcommander" version="1.78">
      <artifact name="jcommander-1.78.jar">
        <pgp value="C70B844F002F21F6D2B9C87522E44AC0622B91C3"/>
        <pgp value="DCBA03381EF6C89096ACD985AC5EC74981F9CDA6"/>
      </artifact>
    </component>
  </components>
</verification-metadata>

Gradle compares dependencies' hash or signature against data in the file above.

Note that the process is not foolproof: if the library has already been compromised, the command will write the hash/signature of the compromised library. Gradle's documentation doesn't try to sugarcoat it:

Gradle can automatically generate a dependency verification file by downloading all your dependencies and recording their checksums or signatures. This is called bootstrapping.

However, bootstrapping has a critical security limitation: it trusts whatever is currently in your repositories. If a malicious dependency has already been introduced into your build (or into a repository you use), Gradle will record the compromised artifact's checksum or signature.

This is why you must review the generated verification file. Bootstrapping is convenient for getting started or updating your verification file, but it's not a substitute for manual verification of critical dependencies.

—- Generating and Bootstrapping Verification Metadata

However, once you have bootstrapped the metadata file with safer dependencies, Gradle guarantees the same dependencies will be used in other environments, including CI.

The issue with Renovate and its fix

So far, I have explained how Gradle verifies dependencies and how useful it is. It's time to introduce Renovate and the issue I faced.

Renovate opened a PR.
I merged it.
It broke the build, and I had to manually regenerate the metadata file in a new PR.

I wrongly thought that Gradle only verified artifacts listed in the metadata file, and that a new, unlisted dependency version would pass. In fact, the build breaks in case of new dependency version pairs that aren't listed in the metadata. It makes sense, as otherwise, the metadata file would soon be made irrelevant.

I considered several solutions, including discarding Renovate or Gradle metadata. However, I finally settled on postUpgradeTasks.commands:

A list of commands that are executed after Renovate has updated a dependency but before the commit is made.

—- postUpgradeTasks.commands

We can generate the metadata file again by using this directive.

{
    "$schema": "https://docs.renovatebot.com/renovate-schema.json",                 // 1
    "postUpgradeTasks": {
        "commands": [
            "./gradlew --write-verification-metadata pgp,sha256 --refresh-keys --export-keys dependencies" // 2
        ],
        "fileFilters": [
            "gradle/verification-metadata.xml",                                     // 3
            "gradle/verification-keyring.gpg",                                      // 3
            "gradle/verification-keyring.keys"                                      // 3
        ],
        "installTools": {
            "java": {}                                                              // 4
        }
    }
}

Standard JSON schema
The exact command to run
Renovate is only allowed to update these files
Renovate runs in a dedicated container, without Java. Since Gradle relies on a JDK, you need to install it first.

Now, every Renovate PR for a Gradle dependency will regenerate the metadata file. It's not a perfect solution, though. The warning about the initial bootstrap still stands: if the downloaded dependency is compromised, the metadata is generated with the wrong hash and signature. I think that's the price to pay.

Conclusion

I started using Renovate on projects I didn't initiate. It allows me to learn about its issues and how to fix them. Renovate's configuration options page has become my new friend.

To go further:

Originally published at A Java Geek on August 16^th, 2026.

GitHub agentic workflows and Renovate

Nicolas Fränkel — Thu, 06 Aug 2026 09:02:00 +0000

I've been a big fan of Renovate for a couple of years already. Renovate scans your repositories, detects outdated package versions, and opens pull requests to automatically bump them. It's similar to Dependabot in that it keeps your dependencies up to date. If I had to compare them in one sentence, I'd say Renovate is less integrated in the GitHub ecosystem, but handles more ecosystems and, more importantly, is extensible. My current company is a happy Renovate user, and I already started to use it in some repositories.

I have previously written about Agentic Workflows. As a reminder, you first create the workflow in Markdown with a very loose syntax. Then, you "compile" it to generate a GitHub Workflow-compliant YAML file, suffixed with .lock.yml.

In this post, I want to describe the problem when combining the two, how I tried to fix it, and the correct solution.

The core problem

Renovate is very eager to please. By default, it scans all ecosystems used for dependencies: build.gradle.kts, pom.xml, pyproject.toml, Dockerfile, GitHub workflows, etc. Most "manual" GitHub workflows use GitHub actions, which are versioned dependencies.

The generated lock of agentic workflows does make use of GitHub actions, in particular gh-aw-actions/setup.

When Renovate worked on my repository, it did what it always does. It searched for candidate files, found my documentation-review workflow’s lock file, scanned the dependencies, and opened a PR bumping the SHA to the latest, including gh-aw-actions/setup. So far, so good.

However, it created an interesting problem. The action SHA pointed to a new version of gh-aw-actions. The script body inside the same file didn't change, but referenced a helper script that the new version didn't provide. The workflow failed.

The wrong fix

I have to admit I didn't understand the above synchronization issue at first.

To fix it, I created a new non-agentic GitHub workflow. Whenever Renovate upgrades lock.yml, the workflow automatically recompiles the agentic workflow. This introduced a subtler bug. The trigger fired on any change to docs-review.lock.yml, not just gh-aw-actions version bumps.

In my case, Renovate later opened a separate PR to pin the Node.js version inside the same file: the recompile workflow triggered, ran gh aw compile, and overwrote the file, rolling back the node-version change Renovate had just made.

The actual solution

After the second rollback, I realized something was fishy and understood the root cause. The compiler generates the whole lock file from a single gh-aw release. The action pin and the inline scripts inside the file must match. Renovate bumped the former and left the latter untouched.

The solution was much simpler. It consisted of two parts.

Exclude the lock file from Renovate

Renovate has an ignorePaths entry. I added the lock file and agentics-maintenance.yml, another workflow that the compilation generates:

"ignorePaths": [
  ".github/workflows/docs-review.lock.yml",
  ".github/workflows/agentics-maintenance.yml"
]

Update the actual source, then recompile everything

The real source of version pins is .github/aw/actions-lock.json, a manifest file that gh aw compile reads to resolve action SHAs. Renovate can't update this file yet. There's an open feature request to support it. In the meantime, gh aw update-actions refreshes the manifest. I kept my recompile workflow but narrowed its trigger to this single file. When the manifest changes, the workflow fires and runs bare gh aw compile, regenerating all compiled artifacts at once.

on:
  pull_request:
    branches: [master]
    paths:
      - .github/aw/actions-lock.json

GH_TOKEN=${{ secrets.GITHUB_TOKEN }} gh aw compile

The gh-aw documentation warns against editing generated references by hand: you should run gh aw compile to regenerate them. It boils down to the same split: the manifest owns the pins, the compiler owns the generated outputs.

Conclusion

Generated files are not dependency files, even when they contain version strings. We all know we shouldn't change generated files. New tools shouldn't change this approach.

In our case, Renovate should only know about the source, not the generated files, even when they are under source control. Ergo, filter out files generated by agentic workflows.

To go further:

Originally published at A Java Geek on August 2^nd, 2026.

Two nasty surprises in Home Assistant's config

Nicolas Fränkel — Thu, 09 Jul 2026 07:02:00 +0000

Last year, I motorized the rolling shutters on the southern façade of my apartment. My idea was to manage them via Home Assistant. I had a couple of automations in mind:

In the evening, roll down the shutters of my bedroom
In the morning:
- If it's too hot outside, roll down all shutters
- If it's too cold outside, roll down all shutters
- In other cases, roll up all shutters but my bedroom's

Living in France, I added the official Météo France integration. The integration provides different measurements, including air temperature for my city. Here's the historical data. As you can see, it was pretty hot.

I could have used the temperature directly in the automation, but I wanted to define boolean sensors for "too hot" and "too cold" so I could reuse them across different automations. I defined two custom sensors:

template:
  - binary_sensor:
    - name: "Hot outside"
      unique_id: hot_outside_condition
      device_class: heat
      state: >
        {{ states('sensor.mycity_temperature') | float(0) >= 20 }}
    - name: "Cold outside"
      unique_id: cold_outside_condition
      device_class: cold
      state: >
        {{ states('sensor.mycity_temperature') | float(0) < 10 }}

At this point, you can use the time for the trigger, and a sensor defined for the condition:

  alias: Close all shutters in the morning when it's hot
  description: Close all shutters if it's already hot in the morning
  triggers:
    - trigger: time
      at: 06:00:00                               # 1
  conditions:
    - condition: state
      entity_id: binary_sensor.hot_outside
      state:
        - 'on'
  actions:
    - action: cover.close_cover
      metadata: {}
      data: {}
      target:
        entity_id:
          - cover.volet_salon_gauc_low_speed     # 2
          - cover.middle_shutter_low_speed       # 2
          - cover.s_so_rs100_io_low_speed_3      # 2
          - cover.s_so_rs100_io_low_speed_2      # 2
          - cover.s_so_rs100_io_low_speed        # 2

Time is relative to the timezone of the Home Assistant instance.
Unrelated, but I noticed that I need to work on my naming scheme

This year, I woke up earlier than last year. Because I was awake when the automation was supposed to run, I noticed it didn't. After fiddling a bit around, I noticed that the problem was related to the time. The UI showed a weird timezone: Paris/+1. If you're familiar with European time zones, you know about summer time. We move one hour forward during summer, then back again in autumn. However, it showed Paris/+1 instead of Paris/+2, though I was in summer.

I didn't know if it was a bug or not, but it felt like it was. The trigger time is relative to the instance's timezone, as callout <1> pointed out. Stuck one hour behind, my automation fired exactly on schedule. It was just an hour late compared to the actual time outside. In any case, you can override the timezone in the configuration.

I did, and immediately lost the connection. It turns out that once you override a single line in the homeassistant section, you lose all parameters set via the UI. It comprises the temperature unit, the distance metric, but also the URL you can access it. It falls back to the IP.

The fix is straightforward: set every line again.

homeassistant:
  name: Home
  time_zone: Europe/Paris
  latitude: <redacted>
  longitude: <redacted>
  elevation: <redacted>
  radius: 30
  unit_system: metric
  currency: EUR
  country: FR
  internal_url: http://home.local:8123

Note that once you use YAML-based configuration, the whole UI block becomes invalid.

After the changes, the automation worked as expected. Still, I shouldn't have to set the timezone manually for summer time to apply correctly. And I definitely shouldn't lose all UI-related settings because of it. Both feel like bugs on Home Assistant's side, and a quick search confirmed they are:

Time-based automations can get stuck on the pre-Daylight Saving Time offset until Home Assistant restarts: issue on core#153175, closed as not planned
Setting a single key under homeassistant disables the whole General settings page in the UI, not just the key set: issue on frontend#14628, also closed as not planned

Good luck on your Home Assistant path. I hope the above can be helpful.

To go further:

Originally published at A Java Geek on July 5th, 2026.

On programming languages, targets, and platforms

Nicolas Fränkel — Thu, 25 Jun 2026 09:02:00 +0000

I started as a Java developer, but for some time now, I have broadened my horizons. Recently, I thought about how early languages were dedicated to a single target and platform, and now they are broadening their focus. In this post, I want to write down my thoughts in the hope that it may be useful to others, probably to my future self.

Definitions

You may have been wondering about the title terms. I'm pretty sure that if you read this post, you have a pretty good picture of what a programming language is. Some may disagree on some finer points or raise a hair-splitting one, but it's not a PhD thesis, only a post on my blog. I must define what I mean by target and platform in the context of this post before going further.

Target
A target only makes sense in the context of compiled programming languages. For example, C's target is native code, and Java's is bytecode.

Platform
A platform is the system that will ultimately run the target. Native code runs on the operating system; bytecode on the JVM.

Early programming languages

Early programming languages had a single target and platform. I mentioned C and Java, but Ruby, Python, JavaScript, etc., were all the same.

Programming language	Target	Platform
C	Native code	Operating system
C++	Native code	Operating system
Java	Bytecode	JVM
Python	-	Python runtime
TypeScript	JavaScript	Browser & server-side JS
JavaScript	-	Browser

I believe it was the case for a long time. It changed at some point, though.

Multi-target is the new black

The first time I heard about multi-target was in Scala. Scala came from the era of single-target and targeted bytecode on the JVM platform. However, in 2015, Martin Odersky announced Scala.js, which added JavaScript to Scala's target.

The original article was published on InfoWorld, but it seems to have redirection issues nowadays. Here's the introduction on a copy:

Scala, developed as a functional and object-oriented language for the JVM, is now multiplatform, with developers using it in abundance on JavaScript via Scala.js, Scala founder Martin Odersky says.

With Scala.js, developers write code in Scala, and the code is then compiled to JavaScript, analogous to using Microsoft's TypeScript. Developers can leverage their Scala skills in Web development. "[Scala is] very popular on JavaScript now," Odersky said at the Scala Days conference in San Francisco.

—- Scala.js lets you compile Scala to JavaScript

While Scala was the first I had heard about, other languages started to target JavaScript: I know at least Kotlin and Clojure, two originally JVM-bound languages. From that point on, it seemed every language started to add more targets. When they didn't, third parties tried to do it.

I believe that Kotlin was the epitome of such a strategy. It started with JavaScript, but the team later added native with LLVM and is currently working on WebAssembly, as far as I know. Java developers weren't left behind. The GraalVM project, managed by Oracle, allows them to generate native code. A third-party project, TeaVM, targets JavaScript and WebAssembly. It seems that nowadays lots of languages target Wasm.

Here's a small excerpt of languages and what targets and platforms they support at the time of this writing. It can't be exhaustive and obviously focuses on the JVM ecosystem, which I happen to know better.

Programming language	Native/supporting project	Target	Platform
Java	Native	Bytecode	JVM
	GraalVM	Native code	Desktop OS
	TeaVM	JavaScript	Browser
		WebAssembly	Wasm runtime
		C	-
Kotlin	Native	Bytecode	JVM
		JavaScript	Browser
		JavaScript	Server-side runtimes
		Native	Desktop OS
			iOS
			Android
Dart	Native	JavaScript	Browser
	Native	WebAssembly	Wasm runtime
	DartNative	Native	Desktop OS
			iOS
			Android
Rust	Native	Native code	Desktop OS
	Native via a `target`	WebAssembly	Wasm runtime
	rustc_codegen_jvm	Bytecode	JVM
Zig	Native	Native code	Desktop OS
Zig	Zig and WebAssembly	WebAssembly	Wasm runtime
Swift	Native	Native code	Desktop OS
	Native	ARM machine code	Android
	SwiftWasm	WebAssembly	Wasm runtime
Python	Native	Python runtime	Desktop OS
	jythonc (archived)	Bytecode	JVM
	py2wasm	WebAssembly	Wasm runtime

Again, this is just a snapshot of projects I know at the time of this writing.

Discussion

Programming languages were initially focused on a single target and platform. With time, more and more languages broaden their horizon. It comes either as part of the language itself or is an effort from third parties.

It made sense so far. The bigger your organization's investment in a programming language, the harder it is to pivot to another one. In that light, GraalVM's native is a value proposition for Java-heavy organizations using Kubernetes. The JVM was meant for long-running tasks, while Kubernetes is built on the idea of stopping pods and starting new ones.

However, with the fast progress of AI, I wonder whether the trend will continue. Some might question the value. Instead of GraalVM'ifying existing Java applications, why not rewrite them directly in Rust, which natively compiles to machine code? This won't happen for core applications at the beginning, but I expect some may experiment with peripheral ones. If the experience nets benefits in terms of resource usage, then it may gnaw at core apps.

I'm very interested in the next few years to understand whether I'm imagining things, or if it will be a complete upheaval of the landscape.

To go further:

Originally published at A Java Geek on June 21^st, 2026.

Seasons time-lapse - the video

Nicolas Fränkel — Thu, 11 Jun 2026 09:02:00 +0000

In the first post of this series, I focused on the project foundations: what should I do to create a video from photos taken from the same position year after year? I dedicated the second part to aligning images. It wasn't as easy as I expected. I stumbled upon new concepts, such as ORB and RANSAC.

In this third and final post, I want to tackle the video creation itself, explain some "artistic" decisions, and leave the door open to future work.

Order

The decision with the greatest impact was about ordering pictures. I had several options available. The first thing that came to mind was to order by time of day. There were several problems:

I mostly run at lunch time. Thus, the passing of time would have been skewed toward a range from noon to 2PM.
The summer time vs. winter time change would have required a slight change in the pipeline.
Most importantly, the passing of seasons could have made the video weirdly looking. Frame X could be a sunny blue sky with man-high corn plants, frame X+1 a barren field under the snow, and then frame X+2 in summer again.

I decided instead to first order by day of the year, and only then by time of day. To get the time, I chose the EXIF metadata embedded in the picture itself.

Exif is supported by almost all digital camera manufacturers.

The metadata tags defined in the Exif standard cover a broad spectrum:

Camera settings: This includes static information such as the camera model and make, and information that varies with each image such as orientation (rotation), aperture, shutter speed, focal length, metering mode, and ISO speed information

Image metrics: Pixel dimensions, resolution, colorspace, and filesize

Date and time information, digital cameras will record the current (local) date and time set on the device and save this in the metadata

Location information

A thumbnail for previewing the picture on the camera's LCD screen, in file managers, or in photo manipulation software

Descriptions

Copyright information

— Wikipedia

I already extracted the EXIF data to get the location.

Images to video

In essence, a video is just a rapid succession of images. With enough frames per second, it gives the illusion of movement.

To get a feel of what it would look like, I did a straightforward montage. I had three realizations:

Creating the video is slow.
Just putting images one after another was not very aesthetically pleasing.
The video was quite short.

For point 1, I added code to make the video from a limited sample of pictures. For points 2 and 3, I interpolated frames between the pictures. Interpolation wasn't as easy as I had thought.

Imagine the pixel with coordinates (1,1) and color rgb(150,50,100) on picture 1. The same pixel in picture two has the same coordinates (1,1), but color rgb(50,250,120). I naively thought that if you inserted a single frame between them, the pixel's color would be the average of both colors' values: rgb((150+50)/2, (50+250)/2, (100+120)/2). This approach holds for images taken from the same location with the same angle, which is my use case.

In theory, there's no difference between theory and practice; in practice, there is.

It turns out that even with images within the same location and angle, there are elements moving between two consecutive images. The most frequent elements are clouds, but because images are not 100% aligned, most elements of interest move slightly. If you apply the above algorithm, clouds will become transparent or appear out of thin air, or probably both at the same time. It doesn't render nicely.

To improve the rendering, I applied the Gunnar-Farnebäck optical flow.

Optical Flow: Optical flow is known as the pattern of apparent motion of objects, i.e., it is the motion of objects between every two consecutive frames of the sequence, which is caused by the movement of the object being captured or the camera capturing it. Consider an object with intensity I (x, y, t), after time dt, it moves to by dx and dy, now, the new intensity would be, I (x+dx, y+dy, t+dt).

— GeeksForGeeks

You're welcome to read more of the mathematical foundations. Suffice it to say that it fits my use case. Note that frames with too many differences, such as those to or from a fog or snow picture, confuse the algorithm. In this case, I fall back to the simple color blending above. To check whether the fallback activates or not, the computation takes into account:

The average magnitude of the Farneback flow vectors across all pixels. It models large motion.
The mean absolute difference of grayscale pixel values between the two frames. It represents a large change in overall appearance.

Above a certain threshold, fall back.

I showed the work in progress on the first post, but here it is again:

Future works

I'm wondering how to even better align the images. The biggest problems are my lack of knowledge in the field and the lack of guaranteed reference points in the landscape I chose. For the former, I'll dig deeper using Claude Code. For the latter, the project is configurable enough to be reused with another picture set. I have fewer of them, but I'm pretty sure I'll be able to use more of them. A bit of disalignment makes the video more dynamic, though.

I'd also like to use another image set to validate the code's "productization". While I don't plan to make it a product, I'm still interested in whether it's possible and how much freedom it gives people.

Another axis is Open Sourcing it. You noticed I didn't publish the sources yet. The project is Python, and it's not a language I excel in. Plus, all the code has been generated with Claude Code. Thus, I don't feel very comfortable. If you are interested in helping me publish it, feel free to ping me.

Finally, I'm thinking about adding a filter option. For this project, I have something impressionist in mind. More specifically, I want to try both a Turner's style and a Seurat pointillist one. I like their respective work, even though their styles are quite far apart.

If I can implement both, then nothing would stop potential users from implementing their own.

Conclusion

I had this project in mind for ages. However, only Claude Code allowed me to make it a reality. For once, I have more fun creating something than coding. I actually didn't write a single line of code by myself.

Have I joined the dark side?

Originally published at A Java Geek on June 7^th, 2026.

AI gateways: why and how

Nicolas Fränkel — Thu, 04 Jun 2026 09:02:00 +0000

Before working for 2 years on the Apache APISIX API gateway, I was mainly oblivious to API gateways. It's only by working with them that I understood their value. Decoupling the client and the server unlocks a lot of options: moving authentication to the API Gateway, securing APIs, deduplicating API requests, etc.

In this post, I want to describe how the same pattern applies to AI.

AI gateways

AI gateways work in a similar way. They proxy requests and responses between an AI client and its LLM backend(s). Likewise, it unlocks many improvements:

AI management: single glass pane to address multiple AI models and providers, simplifying the complexity of integrating and switching between different services.
Compliance and governance: enforce security, data privacy, and compliance in a single place.
Cost control: intelligent routing, semantic caching, and budget management.
Avoiding lock-in: clients depend on an abstraction under control; the gateway manages server API updates and even migrations to a new provider.
Scalability and reliability: supports automatic failover and load balancing.
Observability: need I say more?

My use-case

I love Claude Code; it's amazing, and my experience is more than positive. It has one problem, though: Anthropic is a US-based company, and subject to the Patriot Act. By design, Anthropic must comply with any US government request to access all of my data. As a non-US citizen, I have no right to object. I have no right to be told.

On the other hand, Mistral AI is a European Union-based company. I have heard pretty good stuff about it, especially devstral:

Today we introduce Devstral, our agentic LLM for software engineering tasks. Devstral is built under a collaboration between Mistral AI and All Hands AI 🙌, and outperforms all open-source models on SWE-Bench Verified by a large margin. We release Devstral under the Apache 2.0 license.

— Devstral

It would be amazing if I could use Claude Code while routing the calls to devstral. AI gateways are a perfect fit.

Available AI gateways

In case you are in need of an AI gateway, please do your due diligence. Because it's exploratory work, I did a pretty shallow search, not deep research. These are the ones that surfaced.

LiteLLM:

LiteLLM is an open-source library that gives you a single, unified interface to call 100+ LLMs — OpenAI, Anthropic, Vertex AI, Bedrock, and more — using the OpenAI format.

Call any provider using the same completion() interface — no re-learning the API for each one

Consistent output format regardless of which provider or model you use

Built-in retry / fallback logic across multiple deployments via the Router

Self-hosted LLM Gateway (Proxy) with virtual keys, cost tracking, and an admin UI

— Getting Started

Bifrost:

Bifrost is a high-performance AI gateway that unifies access to 20+ providers OpenAI, Anthropic, AWS Bedrock, Google Vertex, Azure, and more, through a unified API. Deploy in seconds with zero configuration and get automatic failover, load balancing, semantic caching, and enterprise-grade governance. In sustained benchmarks at 5,000 requests per second, Bifrost adds only 11 µs of overhead per request.

— Overview

OpenRouter:

OpenRouter provides a unified API that gives you access to hundreds of AI models through a single endpoint, while automatically handling fallbacks and selecting the most cost-effective options. Get started with just a few lines of code using your preferred SDK or framework.

— Quickstart

I chose Bifrost for several reasons. It's self-hosted, it's close to the metal (it's written in Go), and the quickstart is dead simple via npx. It is also available via a Docker image. It has a UI, which is great for exploring features. Finally, it has baked-in observability.

Bifrost 5-minute quick start

Starting Bifrost is a single command:

npx -y @maximhq/bifrost

The menu's first item shows the telemetry dashboard. It's quite useful.

The first step is to create a model provider for Mistral. Go to Models > Model Providers. Then click on + Add New Provider. Finally, choose + Add new key and fill the fields accordingly. You should have previously generated a Mistral API key.

The second step is to create a routing rule so that Claude Code requests targeting any of Anthropic's models target Mistral instead. Go to Models > Routing Rules. Click on + New rule, then inside the opening menu, on + Add Target.

Provider: Mistral AI
Model: devstral-2512

Leave all other fields blank.

Before launching Claude Claude, export the following environment variables:

export ANTHROPIC_BASE_URL=http://localhost:8080/anthropic     # 1
export ANTHROPIC_AUTH_TOKEN=sk-dummy                          # 2

Use the local Bifrost instead of the default Anthropic URL
Unused, but necessary

It should just be a matter of starting Claude Code and having fun. Unfortunately, it fails.

❯ hello
  ⎿  API Error: 422 {"type":"error","error":{"type":"api_error","message":"provider API error (status 422)"}}

Debugging the setup

Failures are always great opportunities to understand a solution better. On the provider, click on Edit Provider Config. Set the switch of the Debugging tab.

Then, in Observability > LLM Logs, select the failing request. Find the section named Raw Response from Mistral. It looks something like this:

{
  "object": "error",
  "message": {
    "detail": [
      {
        "type": "enum",
        "loc": [
          "body",
          "reasoning_effort"
        ],
        "msg": "Input should be 'none' or 'high'",
        "input": "medium",
        "ctx": {
          "expected": "'none' or 'high'"                // 1
        }
      }
    ]
  },
  "type": "invalid_request_error",
  "param": null,
  "code": null,
  "raw_status_code": 422
}

There's a mismatch between the request sent by Claude Code and what Mistral expects.

At this point, I had pinpointed the issue. I opened a bug report. The feedback came back in less than an hour, and the fix attempt was in a couple of weeks. It still doesn't work, but I found a workaround.

export CLAUDE_CODE_DISABLE_THINKING=1

Extended thinking is the reasoning Claude emits before responding. On models that support adaptive reasoning, the effort level is the primary control for how much thinking happens; the settings below turn thinking on or off and control how it displays.

— Extended thinking

At this point, it works, but at the cost of a lack of higher reasoning.

Budget management

The above is good for a personal setup, but in enterprise settings, you'll rarely see this approach, if ever. What you regularly see, however, is a monthly spending limit. This situation has two issues:

Users must be able to track their usage. Without precise tracking, they run the risk of consuming too many tokens too early.
If you overspend, you are stuck until the counter resets, which generally happens at the start of the next month. Ask me how I know.

AI gateways in general, and Bifrost in particular, allow lots of options to handle both. I'll leave the metering aside for this post to focus on the usage itself. The AI gateway could do a couple of things to help manage the budget.

Set a daily cap. It's better to be capped for half an hour at the end of the day than for more than a day at the end of the month.
Redirect request using specific models to other models. You can use it to prevent users from using expensive models. At the moment of this writing, Claude Opus tokens cost at least 5 times more than Claude Sonnet's.
Degrade model when over-budget. Once users have gone over a specific budget, redirect requests to a less expensive model.
Redirect to self-hosted model when over-budget.

These are just a couple of the use cases that you could implement.

Simple fallback

In this section, I want to demo the last item. In an enterprise setting, you could host the fallback on a cloud instance or even self-host. In the context of this post, I'll limit myself to falling back to a local llama-server if above the set limit.

The first step is to define a spending limit. Go to the Mistral provider defined earlier. Set the limit in the Governance tab. Here's where I set the cap to 100,000 tokens daily for demo purposes.

The second step is to add a Llama Server provider. It's type custom.

API Structure: The base is OpenAI, because llama-server is compatible. Remember to limit the Allowed Request Types to what the model can actually do. For my model, it's Chat Completion and Chat Completion Stream.
Network: Set the Base URL to http://localhost:<port>. Because Bifrost binds on port 8080, I run llama-server on 8081.

The third and final step is to add a fallback to the existing routing rule.

With the low number of tokens set, you'll hit the ceiling after one or two requests.

On the next request, Bifrost will:

Evaluate the condition
Prevent the request from reaching Mistral
And send it to the fallback Llama server instead.

Bifrost logs the two requests, the first one to Mistral AI and the second to Llama. Here's a sample:

Conclusion

AI gateways are a fantastic architectural improvement. Bifrost looks great on paper, and the dashboard seems quite exhaustive.

Unfortunately, a Bifrost bug currently prevents the implementation of my extended thinking. I hope maintainers fix it fast and I can work further on AI gateways "for real".

However, when it works, I'll be able to leverage Claude Code's amazing client with the LLM of my choice, including Devstral.

To go further:

Originally published at A Java Geek on May 31^st, 2026.

Seasons time-lapse - alignment

Nicolas Fränkel — Thu, 28 May 2026 09:02:00 +0000

In the previous post, I described the Seasons project: a time-lapse of hundreds of pictures taken from nearly the same viewpoint over the years. The hardest challenge wasn't taking the pictures or assembling them, but aligning them.

You might have noticed the nearly part about viewpoint in the above paragraph. Indeed, it's an approximation. I'm a human being, not a tripod. The position changes ever so slightly, and so does the exact angle. My phone has changed over the years, from a Samsung S10 to an S21, and now I'm using an iPhone 14 Pro. Each of them has a different camera with a different focal length. The resulting photos look similar but are definitely not identical: slightly different scales and angles. Without any correction, the landscape appears to be moving a lot.

Alignment is the process of warping each photo so it looks like it was taken from exactly the same angle as a reference image.

OpenCV for feature matching

For image-related features, OpenCV is the go-to library.

OpenCV is the world's biggest computer vision library.

OpenCV is open source, contains over 2500 algorithms, and is operated by the non-profit Open Source Vision Foundation.

—- OpenCV

The most straightforward approach is to find key points across images, match them, then compute a geometric transform from the matches. It's feature matching. OpenCV provides an algorithm for that called ORB.

ORB is basically a fusion of FAST keypoint detector and BRIEF descriptor with many modifications to enhance the performance. First it use FAST to find keypoints, then apply Harris corner measure to find top N points among them. It also use pyramid to produce multiscale-features.

—- ORB (Oriented FAST and Rotated BRIEF)

I mentioned two steps above: first, matching key points, then transforming the rest of them. Once key points are matched, you need an algorithm for the transformation. Meet RANSAC:

The RANSAC algorithm is a learning technique to estimate parameters of a model by random sampling of observed data. Given a dataset whose data elements contain both inliers and outliers, RANSAC uses the voting scheme to find the optimal fitting result. Data elements in the dataset are used to vote for one or multiple models. The implementation of this voting scheme is based on two assumptions: that the noisy features will not vote consistently for any single model (few outliers) and there are enough features to agree on a good model (few missing data).

—- RANSAC

I first used a 3x3 matrix, also called homography for the transformation. It resulted in very distorted images with perspective distortion. Every small error in keypoint matching was amplified. I fixed it by using a smaller matrix, 2x3, which only handled translation and uniform scale.

That still left a nondeterministic problem. RANSAC is randomised by design. Run it twice on the same data, and you may get slightly different rotations. For a time-lapse, that means the horizon can drift from frame to frame. The fix was to discard rotation entirely and force it to zero after RANSAC, then recompute the translation analytically from the inlier matches.

The scale tolerance also required careful tuning. The Samsung S10 has a 4.30mm focal length, while the iPhone 14 Pro has a 6.86mm one. A photo from one device is 1.6× the scale of a photo from the other. Any scale gate tighter than that would wrongly reject valid cross-device frames.

There was one more spatial problem. ORB keypoints cluster on high-texture regions — in my photos, trees and rooftops. A transform fitted only from one corner of the image is less stable than one fitted from points spread across the whole frame. The fix was to divide the image into a 4×4 grid and cap the number of keypoints per cell, forcing a more even spatial distribution.

Finally, the output resolution. Each aligned frame produces a valid crop region — the area of the reference frame it fully covers. If you take the intersection of all crops, one frame with an extreme offset shrinks the output for everyone. Instead, the crop boundaries are computed from percentiles across all frames: the worst 15% of frames on each edge are ignored, and any frame that falls outside the resulting crop is dropped.

Neural matching with SuperPoint and LightGlue

ORB works well on scenes with clear texture. In winter, photos with snow-covered fields, foggy mornings, and overcast skies degrade quickly. There is simply not enough distinctive texture for classical descriptors to anchor on. I kept it as a fallback when the following approach doesn't fall within the expected range.

The first step is a pair of Open Source neural models:

SuperPoint is a self-supervised keypoint detector trained to find stable, repeatable points across varying lighting and viewpoints.
LightGlue is a transformer-based matcher that pairs SuperPoint keypoints across two images and produces a confidence score for each match.

Both run locally on Apple Silicon via MPS.

SuperPoint needs a reference image. To avoid extracting its features hundreds of times, they are computed once at startup and reused for every frame.

The first version of the quality score was wrong. I measured it as the fraction of LightGlue matches that survived RANSAC. That made almost every frame poorly aligned.

The root cause was parallax. LightGlue finds geometrically correct matches, the same real-world point in both images, but many are rejected by RANSAC because the scene has depth. Objects at different distances don't move the same way when the camera shifts slightly. The matches aren't wrong; they just don't fit a flat-world model.

The fix was to score alignment using the mean LightGlue confidence of the RANSAC inliers only. With trial and error, I found that a good alignment score sits between 0.82 and 0.96. Frame acceptance went from 19.7% to 53.2%.

Here's the final representation of the alignment pipeline's nominal path:

In the next part, I'll describe how I smoothed the motion between frames using optical flow and the final result.

Originally published at A Java Geek on May 24^th, 2026.

Seasons time-lapse - the foundations

Nicolas Fränkel — Thu, 21 May 2026 09:02:00 +0000

I live close to nature. I regularly go for a run in the countryside. Over several years, during my runs, I've taken pictures from the same position, always roughly the same angle. I had a vague idea in the back of my mind, as an "artistic" project. One day, I'd turn those photos into a time-lapse video, one that would show the passage of seasons across a single place.

Spoiler, here's the work in progress:

However, I knew that this project would take ages. I have no experience in image manipulation and video making. My knowledge of codecs is that the movie I have doesn't play on my Internet box.

The amazing progress in coding assistants made this project possible. I hate the term "vibe coding", and I hope I provided accurate technical direction, but I admit I didn't do anything on my own. I just fed my instructions to the assistant, and it did the job.

In this multi-part series, I aim to reflect on my actions. There's no reason why we can't have a useful retrospective in LLM-assisted projects.

In any regular project, choosing your stack is the most important part. You can refer to Choosing a dependency for them. Vibe-coding adepts will gladly tell you that code is not an asset anymore, but that you can (and should) discard it and start from scratch at every iteration.

After describing my idea and its foundation, I asked the assistant whether to choose between the JVM, Python, or any other stack. It chose Python. At several steps in the process, I asked it to reassess its choice again. Still Python.

My argument for performance got rebuked:

The performance argument doesn't apply. The slow parts — OpenCV operations, neural inference — run as C++/CUDA/Metal underneath regardless of whether you call them from Python or Java. Python's interpreter overhead is irrelevant here.

To keep things in check and help the assistant, I enforce types and tests.

The project is fundamentally a processing pipeline. Steps are:

Inventory: glob all configured directories for photos and extract EXIF metadata, date, focal length, GPS coordinates.
Filter: keep only photos taken within 100 metres of a configured reference GPS point. Many photos lacked GPS data entirely, those are dropped.
Align: warp each photo so it looks like it was taken from exactly the same angle as a reference image. This is the hard part, and it gets its own post.
Order: sort the aligned frames according to a simple algorithm. I chose by day-of-year and time-of-day to assemble a composite year from photos taken across multiple real years.
Render: encode the ordered frames into a video.

The pipeline is driven by a config file at the project root:

[input]
dirs = ["/path/to/photos/1", "/path/to/photos/2"]        # 1
extensions = [".heic", ".jpg", ".jpeg"]                  # 2

[reference]
dir = "reference"
latitude = 46.135536
longitude = 6.111831

[filter]
gps_radius_m = 100.0

[output]
fps = 12
blend = true

The autosave application changed its default location
I changed my phone as well

GPS coordinates are mandatory. The pipeline fails early if they're missing. Without them, the filter step has nothing to anchor to.

To iterate more quickly, I weaved in a --sample flag to run the full pipeline on a random subset of photos. A full run processes hundreds of images and takes minutes; a 50-image sample takes seconds. Iterating on the alignment code was initially too time-consuming without sampling.

The inventory, filter, order, and render steps are largely straightforward. Alignment is not. In the next part, I'll describe how I went from a naive approach that produced wobbly, misaligned frames to a neural matcher that gets most frames right.

Originally published at A Java Geek on May 17^th, 2026.