How to Build a Reliable Node.js Document Classifier with Auditable Evidence Trails

·1 views

A software architecture guide outlines how to build a failure-bounded topic classification system using Node.js, semantic search, reranking, and a large language model constrained by a versioned topic catalog. The design separates semantic retrieval, reranking, and classification into distinct pipeline stages rather than collapsing them into a single call, so each failure point can be identified and replayed. Every classification decision must store a full evidence chain — including source revision, embedding revision, catalog revision, and reranker output — rather than just a final topic label. The system is built around four core invariants that tie each derived artifact back to the exact source revision that produced it, preventing data errors when models or taxonomies are updated. Sensitive document content is kept out of routine logs, with access and deletion policies applied equally to source documents and any retained evidence snippets.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Dev team cuts Quarkus CI pipeline time from 11 minutes to 5 minutes without paid tools

A development team running a Quarkus monorepo on GitHub Actions free-tier runners reduced their CI pipeline duration from 9–11 minutes down to approximately 5 minutes 20 seconds. The gains were achieved without self-hosted runners, larger GitHub runners, or paid caching services. Investigation revealed the bottleneck was not dependency downloads or Maven compilation, but duplicated Quarkus work such as repeated augmentation, redundant application boots, and unnecessary infrastructure startup. The team deliberately avoided splitting integration tests into per-service matrix jobs, as doing so would have multiplied fixed setup costs across each parallel cell. Instead, optimisations focused on eliminating duplicated work within existing jobs while keeping the overall job count small.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Run a Local LLM on Apple Silicon Using MLX or llama.cpp

Mac users with M1 through M4 chips can run large language models entirely on-device using two leading tools: Apple's MLX framework and the community-built llama.cpp engine. MLX is installable as a Python package and can load a 4-bit quantized 3B model in minutes, requiring no API keys or cloud connectivity. The two tools differ in scope — MLX is optimized for Apple's unified memory architecture, while llama.cpp supports a broader range of hardware including Linux and Windows systems. Both frameworks support quantized model formats and offer OpenAI-compatible server modes for application development. Running models locally eliminates per-token costs and keeps user prompts private, with the setup working fully offline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

npm Supply Chain Attacks Expose Gap in Artifact-Level Dependency Auditing

When a compromised npm package is reported, teams often check their current dependency tree — but this can miss vulnerable versions that existed only briefly during a past build. The Keyv-related package compromise, disclosed by Aikido on August 4, illustrated how a malicious release can spread and be patched before most teams finish assessing their exposure. The core challenge is that modern CI pipelines, lockfile updates, and Docker caching mean a clean scan today says little about what an artifact built yesterday actually contained. Experts argue the useful unit of analysis is not the current repository state but a specific artifact tied to a specific build and its resolved package set. A proposed approach involves accepting lockfiles, build timestamps, artifact digests, and CI logs to reconstruct past builds and classify exposure as confirmed, possible, or unknown — with human review required before any remediation action.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

10 Warning Signs Your Windows PC May Be Compromised and How to Spot Them

Windows users can detect potential security threats by monitoring unusual system activity such as unknown processes in Task Manager, unexpected CPU or RAM spikes, and new startup programs added without user knowledge. Suspicious PowerShell executions, unrecognized USB connections, and sudden changes to Windows Defender settings are also red flags worth investigating. Many legitimate Windows tools like Task Manager and Event Viewer exist for this purpose, but most users do not check them regularly enough to catch threats early. A lightweight monitoring tool called SysPulse has been developed to address this gap by offering real-time process tracking, executable path visibility, and Telegram-based security alerts. The goal is not to replace antivirus software but to give users greater visibility into what is happening on their systems at any given time.

0 comments Read more at DEV Community