{
 "updated": "2026-10-27",
 "about": "The Constraint Atlas: limits on what builders can do, each with evidence, interventions, the experiment we run, measured progress and next actions. Numbers come from Tensorust's own pulls; every value names its source and date.",
 "constraints": [
  {
   "id": "security-fix-latency",
   "domain": "Software supply chain",
   "status": "measuring",
   "title": "Security fixes take weeks to reach the code that needs them",
   "limit": "A fixed version on crates.io protects nobody until it is in each project's Cargo.lock. When the fix only ships in a new major version, cargo update cannot reach it at all.",
   "headline": "17 days after the first zip crate advisory, 16.4% of zip downloads were a patched version.",
   "evidence": [
    {
     "label": "zip downloads on a patched version (9.0.5+), Oct 26",
     "value": "16.4% (257,801 of 1,575,385)",
     "source": "https://tensorust.com/articles/zip-crate-cve-rust-dependents-stuck/",
     "source_name": "Tensorust, from crates.io daily downloads",
     "date": "2026-10-26"
    },
    {
     "label": "Same share, Oct 17",
     "value": "0.6%",
     "source": "https://tensorust.com/articles/zip-crate-cve-rust-dependents-stuck/daily.csv",
     "source_name": "daily.csv",
     "date": "2026-10-17"
    },
    {
     "label": "Top-300 zip dependents whose requirement cannot reach the fix",
     "value": "232 of 300 (77%)",
     "source": "https://tensorust.com/articles/zip-crate-cve-rust-dependents-stuck/data.csv",
     "source_name": "data.csv",
     "date": "2026-10-27"
    },
    {
     "label": "Advisories published on zip, Oct 9 to Oct 26",
     "value": "13 (1 critical, 6 high, 6 medium)",
     "source": "https://tensorust.com/articles/zip-crate-cve-rust-dependents-stuck/advisories.csv",
     "source_name": "advisories.csv",
     "date": "2026-10-26"
    }
   ],
   "interventions": [
    "Automated, tested upgrade pull requests, so the fix is one click instead of a chore someone schedules.",
    "Maintainers backporting security fixes to the previous major version.",
    "Downstream crates widening their version requirements so cargo update can reach the fix."
   ],
   "experiment": "We shipped fix mode in the free <a href=\"https://github.com/Mattbusel/tensorust-cargo-check\">Tensorust Cargo Check</a> GitHub Action (v1.1.0, Oct 27): on a schedule it applies the smallest in-requirement upgrade that clears each advisory or yanked version, runs the project's tests and opens one pull request. We track the patched share of high-profile advisories daily and will publish how many fix pull requests merge and how fast.",
   "progress": [
    {
     "date": "2026-10-17",
     "value": "0.6% of zip downloads patched"
    },
    {
     "date": "2026-10-18",
     "value": "5.1%"
    },
    {
     "date": "2026-10-24",
     "value": "14.1%"
    },
    {
     "date": "2026-10-25",
     "value": "15.3%"
    },
    {
     "date": "2026-10-26",
     "value": "16.4%"
    }
   ],
   "next_actions": [
    "Run <code>cargo tree -i zip</code> (or any crate) to see who pulls in a vulnerable version.",
    "Add the Cargo Check Action with <code>fix: true</code> to get a weekly tested upgrade pull request.",
    "Agents: POST your Cargo.lock to <code>https://api.tensorust.com/v1/audit/cargo-lock</code> for the exact fix commands ($0.05 over HTTP 402, or an API key)."
   ],
   "tools": [
    {
     "name": "Cargo Check Action (free, fix mode)",
     "url": "https://github.com/Mattbusel/tensorust-cargo-check"
    },
    {
     "name": "Cargo.toml checker",
     "url": "/tools/cargo-toml-checker/"
    },
    {
     "name": "RustSec advisories",
     "url": "/rust/advisories/"
    },
    {
     "name": "Crate Portfolio (weekly monitoring)",
     "url": "/tools/crate-portfolio/"
    }
   ]
  },
  {
   "id": "ai-inference-price",
   "domain": "AI compute",
   "status": "measuring",
   "title": "The same AI job can cost 1,500 times more depending on the model you pick",
   "limit": "What builders can afford to automate is capped by price per token, and most teams pay far more than the cheapest model that does the job.",
   "headline": "Across 71 models we track, output prices run from $0.40 to $600 per million tokens.",
   "evidence": [
    {
     "label": "Models tracked with dated prices",
     "value": "71",
     "source": "https://api.tensorust.com/v1/llm/models",
     "source_name": "Tensorust LLM price table",
     "date": "2026-10-23"
    },
    {
     "label": "Cheapest output price (gpt-5-nano, gpt-4.1-nano, gemini-2.5-flash-lite)",
     "value": "$0.40 per 1M tokens",
     "source": "https://developers.openai.com/api/docs/pricing",
     "source_name": "provider pricing pages",
     "date": "2026-10-23"
    },
    {
     "label": "Highest output price (o1-pro)",
     "value": "$600 per 1M tokens",
     "source": "https://developers.openai.com/api/docs/pricing",
     "source_name": "OpenAI pricing",
     "date": "2026-10-23"
    }
   ],
   "interventions": [
    "Route each task to the cheapest model that passes your own test set, instead of one default model for everything.",
    "Batch and cached-input pricing for work that is not interactive.",
    "Open-weight models on rented GPUs when volume is high enough."
   ],
   "experiment": "We record every price change daily and publish the history. The <a href=\"/tools/ai-cost-audit/\">AI Cost Audit</a> applies it to one team's real usage and keeps watching for cheaper options as prices move.",
   "progress": [
    {
     "date": "2026-10-23",
     "value": "71 models, $0.40 to $600 per 1M output tokens"
    }
   ],
   "next_actions": [
    "Price your workload across every model: <code>https://api.tensorust.com/v1/llm/cheapest?input_tokens=...&amp;output_tokens=...</code> (free).",
    "Check the <a href=\"/tools/llm-api-cost/\">LLM API cost calculator</a> before you pick a default model."
   ],
   "tools": [
    {
     "name": "LLM API cost calculator",
     "url": "/tools/llm-api-cost/"
    },
    {
     "name": "AI Cost Audit",
     "url": "/tools/ai-cost-audit/"
    },
    {
     "name": "LLM price history API",
     "url": "/developers/"
    }
   ]
  },
  {
   "id": "gpu-compute-price",
   "domain": "AI compute",
   "status": "measuring",
   "title": "Renting a top GPU costs half as much from the cheapest cloud as from the typical one",
   "limit": "Training and serving your own models is capped by GPU rental prices, and the spread between clouds is wide and moves daily.",
   "headline": "The cheapest H100 offer fell from $1.99 to $1.39 an hour between Oct 24 and Oct 26; the median stayed at $3.99.",
   "evidence": [
    {
     "label": "H100 cheapest / median per hour, 38 offers",
     "value": "$1.39 / $3.99",
     "source": "/llm/gpu-prices/",
     "source_name": "Tensorust GPU price tracker (17+ clouds)",
     "date": "2026-10-26"
    },
    {
     "label": "A100 cheapest / median per hour, 43 offers",
     "value": "$0.60 / $2.00",
     "source": "/llm/gpu-prices/",
     "source_name": "Tensorust GPU price tracker",
     "date": "2026-10-26"
    },
    {
     "label": "B200 cheapest / median per hour, 16 offers",
     "value": "$5.43 / $7.49",
     "source": "/llm/gpu-prices/",
     "source_name": "Tensorust GPU price tracker",
     "date": "2026-10-26"
    }
   ],
   "interventions": [
    "Price competition from smaller clouds and marketplaces.",
    "Builders shopping by the hour instead of signing long commitments.",
    "New GPU generations pushing older cards down the price curve."
   ],
   "experiment": "We record the cheapest and median price of every GPU across 17+ clouds every day and publish the history, so the curve is public instead of locked in sales calls.",
   "progress": [
    {
     "date": "2026-10-24",
     "value": "H100 cheapest $1.99"
    },
    {
     "date": "2026-10-25",
     "value": "H100 cheapest $1.99"
    },
    {
     "date": "2026-10-26",
     "value": "H100 cheapest $1.39"
    }
   ],
   "next_actions": [
    "Compare today's prices before you rent: <a href=\"/llm/gpu-prices/\">GPU prices</a>.",
    "Agents: <code>https://api.tensorust.com/v1/gpu/cheapest/H100</code> (free)."
   ],
   "tools": [
    {
     "name": "GPU prices today",
     "url": "/llm/gpu-prices/"
    },
    {
     "name": "GPU price history API",
     "url": "/developers/"
    }
   ]
  }
 ],
 "license": "CC BY 4.0",
 "url": "https://tensorust.com/atlas/"
}