What Edu is reading this week (Jun 14 - 20, 2026)

Posted on Jun 20, 2026

A week heavy on local LLM coding setups, token-trimming tooling, dotfile managers, ZFS self-hosting, and a couple of supply-chain security reminders.

What Edu is reading this week (Jun 14 - 20, 2026)

Local AI & Coding Agents

AI Tooling

  • yvgude/lean-ctx / chopratejas/headroom: Two takes on cutting agent token usage — LeanCTX is a local Rust binary that controls what an agent reads and remembers, while Headroom compresses tool outputs, logs, and RAG chunks before they reach the LLM, both claiming 60-95% fewer tokens.
  • alibaba/open-code-review: A hybrid code review tool combining deterministic pipelines with an LLM agent for line-level comments, with a built-in ruleset for NPE, thread-safety, XSS, and SQL injection.
  • Gentleman-Programming/gentle-ai: Not an agent installer but an ecosystem configurator — it supercharges whatever coding agent you use (Claude Code, OpenCode, Cursor) with persistent memory, Spec-Driven Development workflows, curated skills, MCP servers, an AI provider switcher, a security-first teaching persona, and per-phase model assignment so each SDD step can run on a different model.
  • mge1512/pcd: Post-Coding Development (“Piccadilly”) — the specification, not source code, is the human deliverable. A structured Markdown spec captures what software must do and an LLM produces the implementation, tests, docs, and audit bundle; the target language is chosen by the deployment template, so the same untouched spec could yield a Go binary today and a Rust one in 2045. The repo’s own reference tools were generated from PCD specs with zero hand-written code.
  • AI Economics for Dummies: McSweeney’s satirical word problem on the economics of running an AI business at a multi-billion-dollar monthly loss.

Cloud, Containers & Infrastructure

Linux & Systems

Security

  • A backdoor in a LinkedIn job offer: A fake recruiter, a crypto repo, and a remote code execution payload hidden in a test file.
  • Hundreds of AUR packages compromised: Hundreds of orphaned packages on the Arch User Repository were compromised, a reminder of the trust model behind community repos.
  • curl summer of bliss: The curl project will pause vulnerability report handling for the month of July 2026 to give maintainers a break.
  • NVIDIA/SkillSpector: A security scanner for AI agent skills, detecting vulnerabilities and malicious patterns.
  • Banned Book Library: Hacking a WiFi smart bulb into a hidden device that serves a library of banned books.

Development, Web & Fun

Gaming, Fun & Misc