September 2026 Summaries

TypeSafe AI’s Jev, released in September 2026, is presented as a fast, low-cost “System One” decision model that classifies, scores, or selects from predefined options rather than generating language, using a training approach called reinforcement learning for calibrated decisions. The open-source jev-router project uses Jev as a local proxy for Claude Code, evaluating each user-written message to select an appropriate Claude model tier, from Haiku for mechanical tasks to Sonnet, Opus, or optionally Fable for more demanding work. To preserve prompt-cache efficiency and reduce disruptions during ongoing work, the router can raise a session’s model tier but generally does not lower it, while tool calls retain the tier assigned to their originating message. It includes safeguards such as explicit model pins, secret scanning, and questions designed to detect attempts to manipulate routing decisions, treating Jev’s classifications as advisory rather than authoritative. A local dashboard and reporting tools expose routing outcomes, probabilities, estimated costs, and savings without logging prompts or keys, while setup supports macOS and Linux services, Claude Code by default, and additional Codex CLI routing options.

Pulumi and TypeSafe AI developed GeoDeploy, an open-source prototype that combines Pulumi’s infrastructure automation with TypeSafe’s Jev SystemOne decision model to select, provision, and manage Kubernetes deployments across AWS, Azure, and Google Cloud. Users provide target user geographies, data-residency requirements, a container image and architecture, workload specifications, provider limits, and a budget; the tool then gathers live cloud pricing, calculates capacity and monthly costs deterministically, and asks Jev to choose only among vetted regional candidates. Responsibilities are deliberately separated: TypeScript performs pricing and technical calculations, Jev makes constrained qualitative choices such as regional suitability and deployment-module posture, and Pulumi provisions cloud resources. Jev returns typed selections, scores, probabilities, and confidence levels rather than free-form text, while confidence gates, candidate validation, audit records, and deterministic fallbacks prevent uncertain AI outputs from driving high-risk decisions. GeoDeploy can also monitor CPU utilization and recommend or apply scaling changes according to confidence thresholds, although the authors note that real production autoscaling should incorporate additional metrics such as latency and error rates.

Pulumi Neo redesigned recovery for long-running hosted agent tasks by treating the full working directory, rather than Git repositories or conversation history alone, as the essential unit of continuity. Its earlier Git-based reconstruction could restore commits and patches but often lost generated files, dependency state, scratch output, local commits, and non-repository files, while also failing when remotes disappeared, diffs became too large, or patches no longer applied. The new system uses Kopia to create encrypted, incremental, task-scoped workspace snapshots in object storage, separating event replay for model memory from filesystem restoration for agent-created state. The service acts as a control plane that authenticates tasks and issues short-lived, prefix-scoped credentials, while runtimes directly restore and checkpoint data, with per-task repository passwords and trusted cleanup preventing agents from deleting durable history. A staged rollout through disabled, shadow, and enabled modes retained Git reconstruction as a fallback, allowing snapshot behavior to be validated before it became authoritative. The design excludes recreatable caches where appropriate, uses retention and maintenance to control costs, and adds detailed observability for independent failures in authorization, snapshots, restores, and event replay. As Neo introduced managed workers, lease-based ordering ensured that tool results and snapshot pointers advanced together, preventing stale workers from overwriting newer recovery state. Internal testing found that snapshot restores were faster and more reliable than legacy recovery, illustrating that resilient agent systems must preserve both conversational context and the workspace in which the agent performs its work.

Pulumi’s experimental component state migrations feature enables component authors to upgrade or redesign reusable infrastructure components without replacing the cloud resources they already manage. Using an AWS VPC example, the text follows a network from the legacy AWSX VPC component to the modern AWSX version and finally to directly managed AWS resources, while preserving AWS resource IDs and dependencies such as an external security group. Because Pulumi state tracks resource URNs, component hierarchy, names, and parent relationships in addition to provider IDs, upgrades that reorganize resources require migrations beyond ordinary aliases. Migration callbacks transform old state records into new ones and define successor mappings so Pulumi can preserve dependencies and references across the stack. Authors can bundle, order, and retain migrations with their components, allowing users to skip intermediate versions and upgrade through normal preview and update workflows without manually editing state. Users should review previews for any remaining in-place provider changes, while component maintainers should test migrations and distribute them with component releases.

Effective coding-agent workflows rely on keeping durable, verifiable guidance in repositories rather than chat context, with short, concrete, regularly maintained instruction files supplemented by task-specific files, tests, and hooks. Research cited in the piece suggests that long or stale configuration files can reduce adherence, instructions can be lost during session compaction, and mandatory behaviors such as test execution, secret scanning, or deployment-policy enforcement are more reliable when implemented as deterministic hooks or external gates. It recommends starting fresh sessions rather than transferring flawed transcripts to stronger models, using concise human-written handoff notes, and treating parallel subagents cautiously because they can greatly increase token costs and coordination failures without improving results. The piece also argues for assigning clear interfaces and ownership when delegating work instead of relying on coordinator agents, planning verification before coding, separating code generation from review, and using fresh contexts for reviewers. Finally, it advises committing once current tests pass, avoiding unnecessary revisions that can undo correct work, limiting retries, and applying infrastructure previews and mandatory policies before deployment.

European companies are increasingly reassessing their reliance on US hyperscale cloud providers in response to rising costs, regulatory questions such as NIS2, data-residency demands, and concerns about foreign government access or account restrictions. Infrastructure specialist Waldemar Kindler recommends testing European alternatives such as Scaleway, Hetzner, and OVHcloud while reducing dependencies and improving portability. Cloud economist Sarbjeet Johal argues that organizations should avoid disrupting stable, cost-effective systems unless major business changes justify a migration, noting the tension between consolidating vendors and pursuing best-of-breed services. Hopsworks CEO Jim Dowling, whose company moved workloads from AWS to OVHcloud and Hetzner and reduced costs by 62%, attributes its successful migration to Kubernetes-based architecture and avoiding proprietary cloud APIs. The discussion also examines whether EU regions, sovereign-cloud offerings, encryption, and European subsidiaries protect customers from US legal reach, while framing cloud choice as both a technical and economic issue and a broader question of Europe’s digital sovereignty.

Pulumi ESC now supports OIDC onboarding for AWS, Azure, and Google Cloud directly through the Pulumi CLI via the new `pulumi env setup` command, allowing users, scripts, and agents to configure short-lived cloud credentials without relying on hard-coded secrets or completing setup in the Pulumi Cloud console. The command provides interactive, cloud-specific prompts to collect authentication details, target accounts, and access policies, then displays a proposed configuration before creating the required identity provider, roles, policy attachments, and an ESC environment for each account. For AWS, users can authenticate with existing credentials or AWS SSO and select policies such as AdministratorAccess, ReadOnlyAccess, or a custom policy ARN. Non-interactive flags are also available for automation, and the feature is included in the latest Pulumi CLI after authenticating with Pulumi Cloud.