DEV Community: Tomasz

MatrAIx consists of 8.3 billion agent-persons who statistically represent the entire human population

Tomasz — Fri, 28 Aug 2026 20:52:27 +0000

It is an open-source research community that has created an infrastructure for simulating user behavior. At its core is a database of 8.3 billion virtual agents (personas) that statistically represent the entire human population, allowing digital products and AI to be tested without involving real people.

How are users created?
Personas are created using a hybrid approach—combining real-world data (Wikipedia, surveys) and synthetic data (generated by AI). Each of the 8.3 billion personas has 1,290 detailed traits (demographics, psychology, skills) and is then materialized as an LLM agent that makes decisions.

How do you use them technically?

Resources: Download a ready-made set of 1 million personas from Hugging Face (or the full 8B dataset).
Requirements: You’ll need Docker, uv (Python), Node.js, and API keys (primarily from Anthropic).
Setup: Clone the repo, install dependencies, and download the data.
Running: Create test tasks (surveys, chat, browser, app) and run them on individual personas, in batch mode, or via the Playground GUI.
Applications: Market research, chatbot testing, website usability assessment, and evaluation of AI models for different user groups.

The developers emphasize that MatrAIx is intended for preliminary testing and hypothesis evaluation, but does not fully replace final testing with real people. An interesting application is simulating user behavior in applications (Web & App UI/UX): Agents interact with websites or apps (by controlling the browser or default API) to test purchase paths and the intuitiveness of the interface.

What does the trained data look like (data structure)?
It consists of structured attribute profiles (JSON / Parquet).

Before an agent is used, its attributes are dynamically converted into a system prompt for the LLM.

On the project website, you'll find something interesting: graphical interface at matraix.ai/playground

You select a persona (e.g., from the Persona-1M database based on filters such as age, country, and education).
You choose one of 8 tasks (e.g., Web Browsing or Survey).
You run the simulation and observe in real time (or analyze in the summary) how that profile performs the assigned task.

Website: matraix.ai

What do you think of this project?
In what areas can this project be used?

OpenSparrow v3.3 — Click Statistics, Production Readiness Check, and Deployment Hardening

Tomasz — Thu, 20 Aug 2026 18:25:47 +0000

OpenSparrow v3.3 is a stability‑focused and deployment‑focused release that brings real‑world operational visibility, a production‑readiness checklist, and a full hardening pass across environment variables and configuration defaults.

This update introduces an optional Click Statistics module, expands the Admin Health Check into a proper production‑readiness validator, and tightens deployment settings for anyone running OpenSparrow outside a local dev box. Below is a detailed breakdown of what changed, why it matters, and how it improves day‑to‑day operations.

Click Statistics

A new optional module — off by default, and off genuinely means off.
When the module disabled, no collector script is emitted, nothing is downloaded, and the endpoint returns 204 without writing even if a page stays open across a toggle‑off.

Records who clicked what, when, on which page, and optionally the table/record in context (“Record Table And Record” can be turned off to keep entries to just user/time/element)
Log tab: recent clicks newest‑first, filterable by element and user, with a Top Elements rollup of the 20 most‑clicked elements
Retention: “Delete Automatically After N days” (default 90, 0 = keep forever) enforced by the notifications cron so the table doesn’t grow unbounded

Admin Health Check: Production Readiness tab

Health Check now includes a dedicated tab answering is this deployment actually production‑ready? instead of just “is the database reachable.

It validates:

APP_ENV
demo mode being off
secure cookies
HTTPS (including behind reverse proxies via X-Forwarded-Proto / CF-Visitor)
display_errors off
Argon2id availability
minimum password length of 12
API rate limiting configuration
SESSION_SAMESITE
trusted‑proxy‑header configuration

Existing checks were refreshed as well — minimum supported PHP version now correctly requires 8.4, matching the rest of the codebase.

Deployment hardening

A broad pass through .env.example and includes/config.php:

every environment variable is now documented
numeric config values are clamped to sane ranges
APP_TIMEZONE and SESSION_SAMESITE are validated instead of trusted blindly
new settings cover: APP_URL, STORAGE_PATH, SESSION_COOKIE_NAME, DB_SSLMODE, API rate limiting, statement/SMTP/HTTP client timeouts, session idle timeout, Argon2 tuning, and a trusted‑proxy IP list

Additional hardening:

API throttle now fails open (instead of blocking all requests) if its state store becomes unwritable
libpq connection‑info values are quoted
CSP report URI restricted to same‑origin

Also in this release

Optional first name, last name, email, and phone fields on admin user accounts (informational only — not used for login, ownership, or notifications)
Logo and favicon refreshed; login/admin brand text sized down to match
Large internal cleanup: PHP/JS variable names expanded from abbreviations to full words, public API endpoints moved behind typed controllers (App\Controller), and die() / exit() replaced with a typed exception hierarchy — no behavior change, but relevant if you track the codebase

Following this series?

OpenSparrow v3.2 — Per‑User Access Control, Materialized Views in RAG, and a Business Design Refresh

Websites

https://opensparrow.org

OpenSparrow v3.2 - Per-User Access Control, Materialized Views in RAG, and a Business Design Refresh

Tomasz — Thu, 13 Aug 2026 14:22:39 +0000

OpenSparrow v3.2 is a security‑focused and consistency‑focused release that strengthens access boundaries, improves AI‑driven aggregate queries, and unifies the entire admin and frontend experience under one design system.

This update introduces per‑user access control across all major scopes, brings materialized‑view support to RAG aggregate queries, and delivers a full visual refresh that aligns every UI surface with the new Business design language.

Below is a detailed breakdown of the changes, including how they work, why they matter, and what they unlock for real deployments.

Per-user access control

New Users → Access tab. Each user gets independent allow‑lists across five scopes — tables, views, printouts, boards, workflows — stored as user_table_access in config.

The default is unrestricted: an absent or empty list means “no restriction”, not “no access”. To fully cut a user off, deactivate the account instead.

Enforced at the API boundary by default, not just hidden in the UI — os_api_action() / os_api_dispatch() gate table, view, print, board, and workflow endpoints, and FK/file/comment/mass‑edit/data‑cleanup endpoints were extended to respect the same restrictions
Granting a board or workflow does not implicitly grant the tables it touches — a board whose table isn’t granted won’t show up, and a workflow drops if any step targets a table the user can’t reach
Hidden tables (no menu entry, no grid) can’t be ticked and are granted automatically
Delegated FK lookups and the schema endpoint are now scoped to what the requesting user can actually access, and the file listing is filtered by record ownership

RAG: materialized views as aggregate views

The aggregate‑view feature from 3.1 (attach a PostgreSQL view to a table so the AI assistant can answer exact “total/how many” questions) now also accepts materialized views, flagged as such in the admin UI — useful when the aggregate query is expensive enough that you’d rather refresh it on a schedule than recompute it on every chat message.

Views sync also discovers materialized views alongside regular ones.

A unified “Business” look

The admin panel, setup wizard, and frontend were unified onto a single Business 4+1 color palette and one system‑ui font stack, replacing a mix of ad-hoc colors and font declarations across dozens of JS/CSS files.

Every front‑end button now shares one height, weight, border radius, and font size instead of drifting per page.

Also in this release

CRM demo: richer install description, plus optional demo‑user and audit‑history install toggles
Release packaging excludes creator/, dist-local/, and storage/tmp/ from image and release archives
Admin docs updated to match actual current module behavior across several sections

Websites

opensparrow.org

Discussion

I encourage a substantive discussion, and I'll do my best to answer any questions regarding implementation and configuration.

OpenSparrow v3.1 - RAG assistant, Record Image Galleries, and Workflow Stored Procedures

Tomasz — Thu, 06 Aug 2026 06:12:57 +0000

Automation rules can now call out to n8n, the RAG assistant can answer exact aggregate questions via admin-configured views, tables can have their own image galleries, workflow steps can run a PostgreSQL stored procedure, and the grid gets conditional row highlighting.

Automations: n8n webhooks

The Automations admin is now split into two tabs - Record (the existing field-update/notification/create-record rules) and n8n. The n8n tab lets a rule fire an outgoing webhook to an n8n workflow instead of (or alongside) the built-in actions, with webhook credentials encrypted at rest. Useful for handing off to Slack, email marketing, or any of the hundreds of services n8n already integrates with, without writing custom PHP.

RAG assistant: aggregate views

The AI assistant used to be limited to whatever was on the current grid page, so it had to refuse "how many / total" questions about the whole table. In 3.1, an admin can attach a PostgreSQL view (schema.view) to a table under RAG settings - a pre-vetted, read-only aggregate query. When that table's page is open, the assistant runs the view (capped at a configurable row limit) and gets the exact figures fenced into the prompt as authoritative data, separate from page content and record text.

The model still never writes or chooses the query itself - it only ever sees the output of a view an admin explicitly configured, with an extra guard that skips owner-restricted tables since a plain view has no per-user filter. The result: questions like "what's the total invoice value this quarter" get an exact answer instead of "I can only see this page."

Record image galleries

New per-table image galleries - configure an image column and records show a thumbnail strip in the grid plus an upload gallery on the edit form.

Comes with full Cypress E2E coverage and demo data (contact photos in the CRM demo).

Workflow steps: PostgreSQL procedure hook

Workflow steps can now call a PostgreSQL stored procedure as part of a guided flow, in addition to the existing table-form steps. The CRM demo ships a worked example. Combined with the record-image upload option added to workflow steps, workflows can now do a lot more than collect form fields.

Grid: conditional row highlighting

Schema-configured row highlight rules color entire grid rows based on column conditions - e.g. flag overdue invoices or high-value deals at a glance - seeded with an invoice example in the CRM demo.

Grid hover/crosshair styling was also reworked: a vertical column highlight alongside the existing row highlight, solid accent header fills, and a fix for the FK cell tooltip getting stuck over open dropdowns.

Also in this release

Notes reminders now take a date and time, not just a date
Optional CRM demo install directly from the first-run setup wizard
RAG: grid context now built from the actual data model and fenced in the prompt, with a hardened no-answer/partial-answer prompt
Security: all admin write actions are now guarded by require_not_demo(), closing a demo-mode bypass in five admin actions; additional CSRF/demo-mode gaps fixed
License compliance pass: SPDX headers, NOTICE file, canonical FSF license texts, and initials-on-color avatars replacing bundled stock photos
spw_* system tables now carry COMMENT ON descriptions for easier DB introspection

Following this series?

OpenSparrow v3.0 - GDPR Anonymization Goes Production, User Records/Comments, and Ollama Cloud

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

OpenSparrow v3.0 - GDPR anonymization, ETL, PostgreSQL-Native Config, and a Unified UI

Tomasz — Sat, 25 Jul 2026 09:32:17 +0000

OpenSparrow v3.0 is out. The GDPR anonymization module introduced in 2.9 is now fully covered by end-to-end tests and runs on the new PostgreSQL-native config store, the user menu gets a "My comments" panel and a restyled "My records" list, and the RAG assistant can talk to Ollama Cloud.

Data Anonymization (GDPR/EDPB) - hardened for production

The anonymization module (System > Anonymization) - per-column rules with a date threshold, dry-run preview, EDPB-style risk reports, and a scheduled cron worker - now has full end-to-end test coverage, so rule creation, scheduling, and the dry-run/report flow are regression-tested on every release. It also picked up a dedicated tile on the admin overview dashboard for quicker access alongside ETL, Print, and Workflows.

Under the hood, anonymization rules moved along with the rest of the app's configuration onto the new spw_config PostgreSQL store (see below), which means rule changes now get the same optimistic locking and full audit trail as everything else - no more silently-clobbered config files.

User Records & My Comments

My comments - a new panel in the avatar menu lists every comment you've written, newest first. Each entry shows the start of the comment plus which table/record it belongs to; clicking it jumps straight to that record's Comments tab.
My records restyled - the existing "My records" quick list (records assigned to you, configured per table in admin) now shows the assignment date next to each entry, and a bug where the admin's "clear config" action didn't actually persist has been fixed.

RAG assistant: Ollama Cloud

The AI assistant's admin settings gained an encrypted Ollama Cloud API key field - stored encrypted at rest, sent as a Bearer token, and never shown back in the UI (only whether one is configured, with a button to clear it). This lets the assistant use the paid Ollama Cloud tier instead of a local Ollama install. The cloud connectivity check timeout was also bumped from 8s to 30s after real-world testing showed the shorter window was too aggressive.

Also in this release

Application configuration (schema, menu, dashboard, calendar, automations, users, anonymization rules...) moved from JSON files into a spw_config PostgreSQL table with optimistic locking and full change history
New Print module for block-based report templates
Views got grid-style filters, row grouping with subtotals, and inline drill-down
A UI unification pass across admin and frontend - shared search/filter bar, one button component, unified typography, collapsed row actions
Multiple Kanban boards, a private Notes panel with reminders, and a configurable password policy for users
New admin module - System > ETL. Define named source connections (MySQL, MariaDB, PostgreSQL, SQLite, or a CSV file over FTP/FTPS), then jobs that load them into local PostgreSQL tables.

Following this series?

OpenSparrow v2.9 - GDPR Anonymization, Automation Emails, and a PHP 8.4 Refactor

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

OpenSparrow v2.9 – GDPR Anonymization, Automation Emails, and a PHP 8.4 Refactor

Tomasz — Mon, 06 Jul 2026 18:11:44 +0000

OpenSparrow v2.9 is out. The headline feature is a full data anonymization module for GDPR compliance, alongside new automation actions, dashboard/calendar filtering, and a codebase modernized for PHP 8.4.

Data Anonymization (GDPR/EDPB)

New admin module — System → Anonymization. Define per-column rules (table, column, replacement value) to scrub PII on a schedule.

Four tabs — Rules (CRUD + run history), Schedule (manual/daily/weekly/monthly + Run Now), Suggestions (scans your schema's column names against a PII keyword dictionary and proposes rules), Dictionary (edit keywords, purge old logs)
Dry-run preview — see exactly how many rows each rule would affect via COUNT(*) with the rule's WHERE clause, before touching any data
EDPB compliance reports — every run writes a structured JSON report (linkability/inference/single-out risk assessment per rule) to a dedicated report table, viewable and downloadable from Run History
A companion CLI cron worker enforces the configured frequency window internally, so a simple daily OS scheduler entry covers all modes

Automations: email actions

The rule engine gains an email action — queue a message to be sent when a rule fires, with templated recipients/subject/body ({{ record.field }}, {{ old_record.field }}, {{ current_user.id }}, {{ today }}). Delivery runs async through the notifications cron with retry/attempt tracking and header-injection protection.

Also added: numeric/date comparison operators (>, <, >=, <=) and change-detection operators (changed, changed_from, changed_to) for writing more precise trigger conditions, plus a quick enable/disable toggle and a "Duplicate rule" button.

Dashboard & calendar filters

Dashboard — a global period filter (All time / Today / 7d / 30d / This month) reloads every widget; count/sum cards now show deltas vs. the previous period, and widgets can be exported to CSV directly from the dashboard
Calendar — a filter bar lets you toggle event sources on/off per configured table color

PHP 8.4 refactor

The whole backend was modernized for PHP 8.4: enums for user roles, readonly classes and constructor property promotion, #[\Override] attributes on interface implementations, json_validate(), first-class callable syntax, and hardened type hints across the DB/repository layer. CI now targets PHP 8.4/8.5.

Page bootstrapping was also consolidated — the repeated session/CSRF/CSP-header boilerplate that used to be copy-pasted at the top of every page now lives in a single os_page_bootstrap() / os_boot_app() helper.

Following this series?

OpenSparrow v2.8 – Kanban board, MySQL Gateway, and major security hardening

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

OpenSparrow v2.8 – Kanban board, MySQL Gateway, and major security hardening

Tomasz — Fri, 26 Jun 2026 14:01:04 +0000

OpenSparrow v2.8 is out. This one's focused on security, new visualization options, and better multi-database support.

Board (Kanban) view
New module — visualize your records as draggable cards organized into lanes. Each lane represents a status value (enum recommended). Drag a card to another lane and it updates instantly, with the change logged to the audit trail and restricted by record ownership.
Configure it from the new Board tab in the admin panel. The CRM demo now ships with a ready-made "Deals Board" grouped by Stage.

MySQL Gateway improvements
You can now connect to external MySQL databases and manage them alongside.
Add a MySQL table to the routing list, it auto-discovers columns from INFORMATION_SCHEMA and writes them to schema.json. New admin panel section lists all MySQL-routed tables with a per-table sync button.

Security hardening

Ownership guards — mass edit, duplicate, and delete now respect row ownership on restricted tables. Calendar drag-and-drop also enforces this.
Random setup password — the initial admin account gets a random 24-character password instead of hardcoded admin/admin
Session protection — storage/sessions/ now has .htaccess denying direct web access on Apache
File uploads security — uploads are now stored outside the web docroot (storage/files/), closing a potential exposure
Config import hardening — rejects empty archives, enforces 512 KB per-file limits, validates JSON properly

Infrastructure improvements

Web-root restructure — all web entry points now live in public/; backend code stays outside the docroot
Cypress test overhaul — 18 spec files, new seed endpoint, admin panel tests now fully active
CI/CD — added source integrity checks, version tag validation, PHP 8.1–8.3 syntax checks
Docs update — removed all references to default credentials, updated for random setup password

Small but useful

Linked record count badges now show on grid expand buttons — tells you how many related records exist before you click
Calendar API now queries only the visible month — better performance on large datasets
Login attempts table auto-purges rows older than 30 days

Following this series?

OpenSparrow v2.7 – Enhanced RAG, rebuilt admin UI, and Automations (beta)

OpenSparrow v2.6 – AI-powered search (RAG), bulk operations, and keyboard shortcuts

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

OpenSparrow v2.7 – Enhanced RAG, rebuilt admin UI, and Automations (beta)

Tomasz — Tue, 09 Jun 2026 15:11:04 +0000

v2.7 is out. This release focuses on AI improvements, a major admin UI overhaul, and the first iteration of workflow automations.

RAG enhancements
The AI module got a significant upgrade. Better document parsing, improved query handling, and now Ollama connections support SSL verification toggle — useful if you're running it locally with custom certificates.

Admin panel redesign
The admin UI has been completely rebuilt with:

Card-based editors for cleaner form layouts
Inline item panel for faster configuration
Refactored styles and improved visual hierarchy
Inner-tabs for better information organization

Automations (beta)
We're introducing workflow automations — still early, but usable. You can create if-then rules with:

OR group logic for complex conditions
3 action types to start
Run log to track executions
User picker for assignment actions

This is beta. Expect improvements in v2.8.

Security & quality

CSP nonces and XSS hardening across the admin panel
Unified session enforcement and role checks
Expanded Cypress E2E test suite to 12 spec files (~300 tests) — fixed 3 flaky tests

One-click deployment
Deploy to Render or Railway directly from GitHub — no manual server setup needed.

Other improvements

Server-side search with load-more pagination
Row cap for large tables (configurable)
Better CSV import with delimiter and encoding options
Improved malformed data parsing

Following this series?

OpenSparrow v2.6 – AI-powered search (RAG), bulk operations, and keyboard shortcuts

OpenSparrow v2.3 – visual admin panel, zero dependencies, now with ERD and M2M support

OpenSparrow – open-source admin panel builder, zero dependencies, v2.1 just dropped

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

What AI features would be useful in your own projects? Drop your thoughts in the comments.

OpenSparrow v2.6 – AI-powered search (RAG), bulk operations, and keyboard shortcuts

Tomasz — Thu, 28 May 2026 15:42:30 +0000

OpenSparrow v2.6 is out. This one's a big step forward — RAG (Retrieval-Augmented Generation) integration, bulk grid operations, and a whole new UX layer.

RAG & AI integration

You can now upload documents and let users ask questions against them. The system retrieves relevant sections and generates answers using an LLM (supports Ollama locally or any OpenAI-compatible API).

What's new:

RAG Statistics tab in admin — tracks query tokens, response times, document matches, and recent queries
Multilingual auto-response — user questions are answered in their own UI language, no schema changes needed
20-language support — "Ask AI" panel fully translated, plus language dropdown in the test interface

Good for things like: knowledge base Q&A, customer support automation, or letting internal teams ask questions about their own data.

Grid & bulk operations

Mass Edit module — select rows via checkboxes, bulk edit fields, change owners, duplicate, or delete with one click
Keyboard shortcuts — arrow keys to navigate, Tab, Ctrl+C to copy, Ctrl+F to search, Ctrl-hold for help modal — works across all 20 languages
Quick Data Cleanup toolbar — find & replace with live preview, case sensitivity, accent-ignore. Editor-gated with audit trail.

Admin improvements

Renamed "RAG Knowledge Base" to "Centrum AI" (heading is translatable)
Migration Manager — tracks pending cleanup tasks after version upgrades, with automatic backups and audit trail
FK columns render as dropdowns in forms by default

Security & Quality

All bulk operations (mass edit, cleanup, delete) are editor-role gated
CSRF protection on every operation
Full audit trail — every change is logged
20 languages fully supported across all new modules
Fixed regressions in RAG API and CSV import

Following this series?

OpenSparrow v2.3 – visual admin panel, zero dependencies, now with ERD and M2M support

OpenSparrow – open-source admin panel builder, zero dependencies, v2.1 just dropped

Websites

opensparrow.org
github.com/wrobeltomasz/OpenSparrow
demo.opensparrow.org

What AI features would be useful in your own projects? Drop your thoughts in the comments.

OpenSparrow v2.3 – visual admin panel, zero dependencies, now with ERD and M2M support

Tomasz — Thu, 21 May 2026 20:49:14 +0000

Hey

OpenSparrow v2.3 is out. Quick recap if you missed earlier posts — it's an open-source admin panel framework built on PHP 8.1, PostgreSQL, and Vanilla JS. No npm, no Composer, no external libraries. You configure everything visually through /admin.

Live demo: demo.opensparrow.org

What's new

Schema Map (ERD) — visual diagram of your entire database with PNG export
Many-to-Many support — dedicated Builder tab, chip renderer in grids
Virtual computed columns — formula fields without touching the DB
Custom Views — save filtered/sorted perspectives per table
Record Ownership — track who handles what, full history
Performance tab — index advisor, slow query analyzer, bloat detection
Security hardening — 5 audit fixes, better session and input validation

Contributing

Looking for contributors — code, docs, or a short demo screencast.

opensparrow.org
github.com/wrobeltomasz/OpenSparrow

OpenSparrow – open-source admin panel builder, zero dependencies, v2.1 just dropped

Tomasz — Sun, 17 May 2026 18:43:36 +0000

OpenSparrow – open-source admin panel builder, zero dependencies, v2.1 just dropped

Hey everyone!

I want to share a project I've been building — OpenSparrow, an open-source visual admin panel framework.

The idea: connect it to a PostgreSQL database, and you get a fully working admin panel — tables, forms, dashboards, calendar, file uploads — configured entirely through a visual /admin interface. No JSON to write by hand.

The stack is minimalist: PHP 8.1+, PostgreSQL, Vanilla JS. No npm. No Composer. No jQuery. No external libraries on either side. Pure code only.

What you get out of the box:

Visual table builder — create columns, set types, foreign keys, validation rules — all in the UI.
Full CRUD with inline cell editing, searchable FK columns, and subtables.
Dashboard builder — stat cards, KPI cards, bar/pie charts, and data lists with live WHERE filters.
Calendar view + cron-based notifications.
Audit trail + optional record snapshots (full JSONB history of every change).
User roles: Admin, Editor, Viewer.
Security defaults: rate limiting, CSRF, session fingerprinting, HSTS.

LGPL v3 — free for commercial use.

Version 2.1 just released with a major UX overhaul, new modules, and security fixes. More on that in the next post.

Feedback and contributors are very welcome!