Ahead of Main

Ahead of Main #5: Agent Skills go neutral, Claude Code closes fail-open gaps, and MCP retries get a stop sign

Mon, 26 Oct 2026 00:00:00 GMT

A quiet window, and this issue says so. The one structural change is that Agent Skills is no longer an Anthropic project: it now sits next to MCP in a neutral foundation. Claude Code shipped three small releases, mostly security hardening. The research section has three papers worth your time, two of them on the harness questions this issue keeps returning to.

The top 3

1. Agent Skills now lives at the Agentic AI Foundation

On 22 October Anthropic announced it is donating Agent Skills, the SKILL.md folder format for giving an agent reusable knowledge and workflows, to the Agentic AI Foundation, which is hosted by the Linux Foundation. The foundation already holds MCP. Anthropic also handed over the name, logo, GitHub organisation and the agentskills.io domain. Maintainers will act as individuals, with engineers from Anthropic, Google, OpenAI and others. The proposed roadmap covers versioned releases, a formal proposal process, and security guidance for people who write and install skills. By Anthropic’s own figures, more than 70 agent platforms have integrated the format, about a million skills have been published and nearly 280 million installed.

Why it matters: a skill is now a portable artifact rather than a Claude feature. A folder you write once is meant to run in ChatGPT, Cursor, Copilot and VS Code as well. The same post says skills can bundle executable scripts, and the roadmap lists security guidance as a future item, so a million published skills with no vetting story is the part to watch. Treat an installed skill like an installed dependency.

Source: Anthropic, Donating Agent Skills to the Agentic AI Foundation, agentskills repository

2. Three Claude Code releases close places where safety checks failed open

2.1.309 fixes PowerShell hooks that did not block when the hook program exited with code 2, and Windows PreToolUse and PermissionRequest hooks that failed open when Git for Windows was not installed. 2.1.310 fixes the same family: hooks whose command was only quoted strings let a call through when Git Bash was missing. 2.1.309 also stops sandboxed commands and auto-accepted edits from modifying the file passed with --mcp-config, and stops sandboxed Bash on macOS and Linux from running shell startup files outside the sandbox. A disabled MCP server could previously be reconnected by a later permission prompt in print and SDK sessions; that is fixed too.

Why it matters: these are fixes, not new features, but they share a shape: a guard that existed on paper and did nothing in a particular environment. If you use hooks as a control, a missing interpreter or a platform you did not test is a way for the control to vanish. Upgrade, then test the failure path of every blocking hook on every platform your team uses.

Source: Claude Code CHANGELOG, 2.1.309 and 2.1.310

3. A timed-out MCP call now tells the model not to repeat it

2.1.310 changes the error for an MCP tool call that times out in a non-interactive session while the server’s elicitation (a question the server asked the user) is unanswered. It now tells Claude that no answer came and not to repeat the call. Issue 4 covered 2.1.307 retrying HTTP MCP calls only for read-only or idempotent tools; this is the model-side counterpart. Separately, 2.1.310 stops requests failing on gateways that reject the effort-2025-11-24 beta value or mid-conversation system messages, by retrying without them.

Why it matters: repeat behaviour is being decided in two places, the client’s transport retry and the model’s own next move, and both now lean on what the server declares about its tools. A server that asks questions in unattended runs needs a plan for the unanswered case.

Source: Claude Code CHANGELOG, 2.1.310

Signal radar

Skill supply chain is the next MCP-registry problem

WATCH Medium confidence.

Issue 4 cited a third-party analysis suggesting most MCP registry servers go stale. Skills have the same shape at larger scale, and they can carry scripts. The foundation’s roadmap names security guidance for authors and installers but gives no date. Expect the first public write-ups of a malicious or broken popular skill before that guidance lands. This is an inference from the numbers, not a reported incident.

Source: Anthropic announcement

Cursor’s Origin marketplace and cloud agents

WATCH Speculative, unverified.

A secondary outlet, tech-insider.org, reports Cursor shipped a public app marketplace called Origin on 13 October, plus cloud agents that manage up to 300 repositories. I could not reach Cursor’s changelog to confirm the dates or the numbers. Its only support here is that single article, so treat it as a lead to check.

Source: tech-insider.org, summary of Cursor’s October releases (secondary, unverified)

Research frontier

What open-source projects tell their coding agents: a census of AGENTS.md and CLAUDE.md

CONTEXT Horizon: already shipping. Single author (Pawel Zarzycki); no institution stated.

arXiv 2610.31715. A census of 22,854 popular, active GitHub repositories in thirteen languages, reading each root AGENTS.md and CLAUDE.md as one instruction set. 26.3% of repositories have agent instructions, rising to 59.6% among the most-starred, and where both files exist CLAUDE.md usually just points to AGENTS.md. Of the directives, 74.0% give no reason. Projects split on AI attribution: commit-message rules more often forbid it, while pull-request rules more often require disclosure. A third of instruction sets look tool-generated, and four in five were edited after creation.

Why it matters: this is the first large look at what teams actually put in these files, and the gap is the “why”. A rule with no reason is hard for an agent to apply to a case it wasn’t written for, and hard for the next maintainer to judge. If you keep one of these files, give each rule its reason in a short clause, and make one file the source of truth with the other pointing to it.

StateMirror: catching hallucinated tool calls before they run

WATCH Horizon: 12 months. Sun Yat-sen University and Singapore Management University.

arXiv 2610.32648. Coding agents often propose actions that can’t work in the real environment: a path that doesn’t exist, a package that isn’t installed. Across 4,398 agent trajectories, each such mistake cost a median of 3 extra steps and 22.4K tokens to recover from. StateMirror sits at the harness boundary, extracts what each action assumes (files, packages, commands) by analysing the code and command, and checks those assumptions against the live repository before running anything. On 2,508 actions it caught these mistakes with 0.940 precision and 0.817 F1, beating the strongest LLM judge by 35.3% F1, in about 1.5 ms instead of 17.7 s and with no tokens. On 79 live tasks it cut execution time by 15.8% and tokens by 11.8% without lowering the solve rate. These are the authors’ own figures.

Why it matters: it is the deterministic version of the pre-tool-use hooks this issue’s Top 3 is about. A cheap check on state, not a model’s opinion, stops a whole class of wasted turns. You can approximate it today with a PreToolUse hook that verifies paths and packages exist before a command runs. Connects to the Harness layer entry on the Watch board; no status change.

Cache engineering for agents

WATCH Horizon: 2+ years for serving stacks you don’t run yourself. Tsinghua University, with The Chinese University of Hong Kong.

arXiv 2610.28577. Submitted 20 October; featured on Hugging Face Daily Papers on 22 October with 159 upvotes. Today, keeping an agent’s context small means trimming or summarising its history, which invalidates the cached prefix and forces the model to re-read what it kept. The paper lets the agent act on its key-value cache directly instead: drop selected parts from future attention and re-position what stays, without rewriting the history. A policy that rolls tool responses out of the cache scored 1.7 points higher on average and cost 27.7% less than threshold-triggered summarisation. Their serving engine, AKV, reached up to 1.2x output throughput. Code is public.

Why it matters: it reframes context engineering as cache engineering. The cost of an agent run depends on what you can drop without paying to re-read the rest. You can’t use this through a hosted API today, but it is the direction prompt-cache pricing and “compact before the cache expires” features are heading. Connects to the Context engineering entry on the Watch board; no status change.

Papers were found through the arXiv API and Hugging Face Daily Papers, and each was read from its abstract and full-text pages.

New capabilities to adopt

Upgrade to 2.1.310 and test your blocking hooks

ACT NOW

The fail-open fixes only help once you are on the fixed version. Write a throwaway hook that must block, remove its interpreter or break its path, and confirm the tool call is refused. About 20 minutes per platform.

Write one skill and run it in a second agent

ACT NOW

A SKILL.md folder is now meant to be portable. Take a repeated chore of yours and turn it into a skill, then check whether another agent that supports the format runs it the same way. About 45 minutes; see the experiment below.

Scripts that call `claude ultrareview`

WATCH

2.1.309 makes claude ultrareview require workspace trust. Scripts pass --trust-workspace, which takes no value, or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. Only the first is a sensible default; the variable turns the check off. About 5 minutes if you have such a script.

Source: Claude Code CHANGELOG, 2.1.309 and 2.1.310

Disruption watch

One entry is new and the rest held. The full board, with history, is on the Watch page.

New: Portable agent skills. Hitting the market. Evidence: the 22 October donation to a neutral foundation, 70-plus integrating platforms and about a million published skills (all Anthropic’s figures). It enters at that rung rather than Watching because the adoption claim is already broad; no independent count exists. What to do differently: write reusable agent procedures as skills, and vet the ones you install.
Harness layer, Hitting the market, held. The 2.1.309 and 2.1.310 fixes are repair work and add history, not a rung.
MCP and tool protocols, Repricing the work, held. The “do not repeat the call” error adds to the repeat-semantics story from issue 4.
Everything else held. Open-weight models, app generation, autonomous QA, design generation, pricing pressure and AI-native infrastructure had no verified dated news this window. That is a lack of evidence, not a fresh check.

Practice shifts

Test the failure path of every guard

ACT NOW

On Monday, list the hooks, sandbox settings and permission rules you rely on. For each, break the thing it depends on (interpreter, path, network) and see whether it blocks or lets the call through. A control you have never seen fail closed is a guess.

Version your procedures as skills, not prompts

WATCH

If you paste the same multi-step instructions into agents, move them into a folder with a SKILL.md, commit it, and review changes like code. A portable format makes that worth doing now.

Decide what a server does when nobody answers

CONTEXT

If your MCP server asks questions mid-call, define behaviour for an unattended run: a safe default, or a clear failure the model will not retry.

This week’s experiment

Build a skill and find out how portable it really is. 45–60 minutes.

Build: pick a chore you repeat, such as “review a pull request against our checklist” or “write release notes from merged PRs”. Write it as a skill folder: a SKILL.md with a name, a description that says when to use it, and numbered steps, plus one small script it calls. Install it in Claude Code, then in one other agent that lists Agent Skills support.

Done when:

The skill runs end to end in both agents on the same sample input.
You have written down every difference in output or behaviour, and whether it came from the skill file or the agent.
The script fails visibly, not silently, when its input is missing.
A three-line note says what you would check before installing someone else’s skill.

Sourcing: Anthropic’s announcement and the Claude Code changelog were read directly. The three papers were read on arXiv; their figures are the authors’ own. The agentskills repository page was read for its star count only. The Cursor item rests on one secondary article and is marked unverified.

Originally published at https://aheadofmain.com/issues/2026-10-26/. The full Disruption Watch board is at https://aheadofmain.com/watch/.

Ahead of Main #4: Claude Code logs every blocked tool call, MCP retries get selective, and fork subagents get a fix

Thu, 22 Oct 2026 00:00:00 GMT

A quiet window, and I’d rather say so than pad it. The movement is in four Claude Code releases (2.1.304 to 2.1.307) that make permission decisions visible and make MCP tool calls safer to retry. No Disruption Watch entry moved up a rung; one is new. I couldn’t reach arXiv from this run, so there is no paper below.

The top 3

1. Claude Code now emits an event for every tool call something stopped, and mods can demand a human

2.1.304 lets a mod’s tool.check answer decider: "person": only the permission dialog or a host callback can approve the call, and it is refused with the mod’s reason where nobody can be asked. The hook also receives e.isReadOnly. 2.1.307 adds a claude_code.safety_event OpenTelemetry event for each tool call that a permission rule, auto mode, a safety check, a hook or the sandbox stopped, prompted or sent back. Last issue’s classifier-verdict fields on tool_decision events point the same way.

Why it matters: the harness is becoming something you can audit, not only configure. A rule like “a model may never approve this action” is now expressible, and the refusal stream can go into the same place as the rest of your telemetry. For unattended jobs that means reviewing what an agent was stopped from doing, not just what it did.

Source: Claude Code CHANGELOG, 2.1.304 and 2.1.307

2. HTTP MCP tool calls are retried only if they’re read-only or idempotent

2.1.307 fixes HTTP MCP tool calls being sent twice when the connection closed mid-call; only read-only or idempotent tools are now retried. The same release fixes headless claude -p runs where MCP servers stayed “timed out” after the machine slept, and where they reported “needs authentication” while the macOS login keychain was locked. 2.1.306 fixes an API error being masked as “prompt is too long” in sessions with many MCP tools.

Why it matters: the changelog doesn’t say how “read-only or idempotent” is decided. The obvious reading is the tool annotations a server declares (readOnlyHint, idempotentHint), but that is an inference. If it holds, a server that mislabels a write as read-only can get it executed twice, and a gateway that drops the hint can quietly disable retries. Last issue flagged a report of exactly that kind of annotation loss in LiteLLM, from a community digest that I didn’t verify. Idempotency is becoming part of an MCP server’s contract.

Source: Claude Code CHANGELOG, 2.1.306 and 2.1.307

3. The fork-subagent default from last issue got a patch within five days

Issue 3 covered fork subagents switching on by default in scripted runs (2.1.302). 2.1.307 now tells each fork launched together which launch is its own, so forks are “much less likely” to try to start each other’s work. 2.1.304 also improves responsiveness when many subagents run at once. 2.1.307 adds /claude-api api-version to move API code to API version 2026-10-21; I couldn’t find what that version changes.

Why it matters: a default shipped, a duplicate-work failure mode showed up in the design, and it was patched within a week. Treat harness defaults as a moving dependency and pin the ones your jobs rely on. “Much less likely” is Anthropic’s wording and unmeasured; count tokens before and after. Run the API version command on a branch and read the diff rather than applying it blind.

Source: Claude Code CHANGELOG, 2.1.304 and 2.1.307

Signal radar

Most MCP servers look abandoned

WATCH Medium confidence.

Oktopost’s analysis of the official registry, published 27 September (a third-party blog, not registry data), says it listed 35,491 servers from 20,581 publishers as of 24 September. Of servers listed at least 90 days, 54.5% have only ever published one version, and 78.7% published nothing in the last 90 days. If that holds, “is there an MCP server for X” is the easy question. “Is it maintained, and does it implement the current spec fully” decides whether you can depend on it, and the retry change above makes that vetting matter more.

Source: Oktopost

Policy that a model can’t satisfy

WATCH Medium confidence.

decider: "person" is a small switch with a large implication: a rule that cannot be approved by another model or a hook. Teams that put a classifier in front of their tools will want a short list of actions it may not approve. Watch whether other agent runtimes add the same idea to their permission models.

Source: Claude Code CHANGELOG, 2.1.304

ASE 2026’s agentic workshops will turn into papers

WATCH Medium confidence.

AgenticDev and MAS-GAIN (multi-agent systems for automated software engineering) ran at ASE 2026 in Munich, 12 to 16 October. I read only the workshop pages, not any accepted paper, so I can’t say what was shown. Accepted papers usually reach arXiv within weeks.

Sources: AgenticDev 2026, MAS-GAIN 2026

Research frontier

No paper read at source this window: arXiv and Hugging Face were unreachable from the environment that wrote this issue, and I won’t describe a paper from its title. The ASE workshop pages above are the only lead.

New capabilities to adopt

Run `/auto-mode-setup` in your busiest repo

ACT NOW

2.1.304 adds a guided setup that reads your project and recent sessions to teach auto mode about your environment, now also on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions. It should cut pointless permission stops without a blanket allow-list. About 15 minutes, plus reading what it wrote before you trust it.

Export `claude_code.safety_event` if you already run OpenTelemetry

ACT NOW

One event per tool call that something stopped, prompted or sent back, which gives you a weekly view of what your unattended jobs were refused. About 30 minutes if a collector is already running; skip it otherwise.

Audit `allowedMcpServers` after upgrading to 2.1.305 or later

ACT NOW

Managed stdio servers in managed-mcp.json that use ${VAR} only in env are no longer filtered by the allowlist, so one your list left out now loads on upgrade. Use deniedMcpServers to keep it off. The same release adds sandbox.allowNestedUserNamespaces, which the changelog says lets sandboxed commands get around the sandbox’s file protections; don’t enable it casually. About 15 minutes.

Source: Claude Code CHANGELOG, 2.1.304, 2.1.305 and 2.1.307

Disruption watch

One entry is new; no status moved. The full board, with history, is on the Watch page.

New: Observable and auditable agent actions: Watching. Evidence: classifier-verdict fields (2.1.301), decider: "person" and isReadOnly (2.1.304), safety_event (2.1.307). One vendor so far, hence Watching. What to do differently: decide which actions a model may never approve, and where the refusal log goes.
MCP and tool protocols: Repricing the work, held. Idempotent-only retries make annotations load-bearing.
Agentic coding: Repricing the work, held. The fork-subagent patch is a fix, not a new rung; cost is still unmeasured.
Everything else held. App generation, autonomous QA, AI-native infrastructure and design generation had no dated news this window; that is a lack of evidence, not a fresh check.

Practice shifts

Make every write tool idempotent, and annotate it honestly

ACT NOW

On Monday, go through each MCP tool you own. Accept an idempotency key, or make the operation naturally repeatable, then set the read-only and idempotent hints accurately. A retry layer may now resend whatever you marked safe.

Treat the refusal stream as data

WATCH

Export one unattended job’s safety events for a week and read what was blocked. Repeated prompts are either a rule to write or an agent behaviour to fix.

Keep a short list of what a model may not approve

CONTEXT

If a classifier or hook approves tool calls, name the handful of actions it must never approve (deleting, publishing, spending) and route those to a person.

This week’s experiment

Find out what actually happens to an MCP tool call when the connection drops. 60–90 minutes.

Build: a small MCP server over HTTP (TypeScript or Python SDK) with three tools: get_item (read-only), put_item (idempotent: it takes an idempotency_key and returns the stored result on a repeat) and append_note (a write that is not idempotent). Annotate each accurately. Each tool increments a counter in a file. Make the server close the connection after executing, before it sends the response, on the first call to each tool. Connect Claude Code 2.1.307 or later and ask it to call all three.

Done when:

You have the counter value for each tool after the dropped connection.
You’ve recorded which tools ran twice and which ran once, and whether that matches the changelog’s “only read-only or idempotent tools are retried”. If the counters disagree with the annotations, write down what does drive it.
put_item with the same key returns the stored result on the retry.
A three-line README says what you’d now refuse to ship without annotations.

Sourcing: the Claude Code changelog was read directly. The registry statistics come from one third-party analysis. Anthropic’s newsroom had no developer-facing post dated in this window.

Originally published at https://aheadofmain.com/issues/2026-10-22/. The full Disruption Watch board is at https://aheadofmain.com/watch/.

Ahead of Main #3: Fork subagents are on by default, open weights split in two, and Claude Design gets an end date

Mon, 19 Oct 2026 00:00:00 GMT

A quiet window, and I’d rather say so than pad it. Nothing on the Disruption Watch moved up a rung. The two things worth your time are a default change in Claude Code that affects every scripted run, and a split in what “open weights” means for client work.

The top 3

1. Claude Code 2.1.302 turned fork subagents on for scripted use

Fork subagents are now on by default in claude -p, the Agent SDK, the desktop app and VS Code. CLAUDE_CODE_FORK_SUBAGENT=0 switches them off. The desktop app and VS Code now run the main conversation’s subagents in the background, and at most 12 prompt or agent hooks for one event run at once; the rest queue. The release also adds CLAUDE_CODE_AUTO_MODE_MODEL to pick the model for the client-side auto-mode classifier.

Why it matters: any unattended job (scheduled routines, CI scripts, anything on the SDK) may now spawn forks that inherit context. That changes both cost and what your agent.spawn hooks see, without you touching a line. Re-run one scheduled job and compare tokens before and after the upgrade.

Source: Claude Code CHANGELOG, 2.1.302

2. Open weights got cheap in two different ways

Meta published Muse Spark Open weights on 15 October: 816B parameters, 42B active, 1M context, under a custom “Muse Model License” with limited commercial terms. One outlet reports a $20M revenue threshold; I couldn’t confirm the terms, and the benchmarks are Meta’s own. Separately, DeepSeek released V4.1 Flash under MIT in September, then began routing V4-Pro requests to Flash at Flash rates, about $0.30 in and $1.20 out per million tokens at peak.

Why it matters: “open” now splits into MIT, which you can build into a client product, and licence-gated, where you need to read the clause before you quote. And a lab retiring its top model into a cheap tier is a pricing move, not only a release. The client question becomes “why am I paying for the big tier?”

Sources: The New Stack, Trending Topics on the licence, The Next Web, TechNode

3. Standalone Claude Design closes on 14 December 2026

In 2.1.302, /design-sync and /design-login warn that standalone Claude Design shuts on 14 December 2026. The changelog is the only source; I found no Anthropic post, so what happens to existing designs is unknown.

Why it matters: a design-generation product from a frontier lab is being retired or folded in within months of launch. If any work lives there, export it now. More broadly, treat generated-design tools as unstable suppliers, not a stable layer to build a service on.

Source: Claude Code CHANGELOG, 2.1.302

Signal radar

Early signals, before they’re news. Being wrong here is acceptable; being obvious isn’t.

MCP servers on spec 2026-07-28 are failing when they omit three fields

ACT NOW Medium confidence.

2.1.302 fixed handling of servers on that protocol version that omit resultType, ttlMs or cacheScope, which had caused missing tools or failed calls. Spec adopters are shipping partial implementations and clients are tolerating it by patch. If you publish or run an MCP server, set all three explicitly rather than relying on the client’s leniency.

Source: Claude Code CHANGELOG, 2.1.302

Gateways don’t honour MCP tool annotations yet

WATCH Medium confidence, unverified.

A LiteLLM issue (#44093, reported in the agents-radar digest; I didn’t read the issue itself) says MCP tool pins ignore outputSchema and readOnlyHint. If a read-only hint is lost at the proxy, a policy that relies on it silently stops working. This is the second week of “MCP at the gateway” items, and the first correctness bug in that pattern.

Source: agents-radar, AI Infrastructure Digest, 19 October

Research frontier

No paper this window that I could read at source, and I won’t explain a paper from its title. Back next issue.

New capabilities to adopt

Decide on fork subagents for every unattended job

ACT NOW

Run one scheduled job twice, once with CLAUDE_CODE_FORK_SUBAGENT=0, and compare tokens and results. About 15 minutes.

Put the auto-mode classifier on a cheaper model

ACT NOW

CLAUDE_CODE_AUTO_MODE_MODEL sets the model that checks tool calls in client-side auto mode, so permission checks don’t have to use your main model. Try a small model and watch for over-blocking. About 10 minutes.

Classifier telemetry and a hook concurrency cap

WATCH

2.1.301 adds classifier_verdict, permission_mode and classifier_category to tool_decision events, so you can see why something was allowed or denied. Worth wiring only if you already export OpenTelemetry. And since more than 12 prompt or agent hooks on one event now queue, keep model-calling hooks few.

Source: Claude Code CHANGELOG, 2.1.301 and 2.1.302

Disruption watch

No entry moved. The full board, with history, is on the Watch page.

Ultra-cheap and open-weight models: Repricing the work. Held; Muse Spark Open and DeepSeek V4.1 Flash add evidence.
Design generation: Accelerating. Held; Claude Design closing is consolidation, not a breakthrough.
Harness and plugin layer: Hitting the market. Held; more control surface, no new rung.
MCP and tool protocols: Repricing the work. Held; partial spec implementations being patched around.
Everything else held, several for lack of new evidence rather than after a fresh check: app generation, autonomous QA and AI-native infrastructure had no dated news this window.

Practice shifts

Treat harness defaults as dependencies, and pin them

ACT NOW

List the environment variables and settings your unattended jobs depend on: CLAUDE_CODE_FORK_SUBAGENT, model aliases that can now fall back silently, the auto-mode model. Pin them explicitly and note the version you tested against. Two defaults changed in one release.

Run the classifier and the router on a cheaper tier than the worker

WATCH

A settable classifier model, cheap open-weight tiers and decision-style endpoints all point the same way: a small model for allow, deny and route, a larger one for the work. Measure agreement on a labelled sample before you trust it.

Check licences the way you check prices

CONTEXT

“Open weights” no longer means “I can ship this to a client”. Put a licence line next to the price line in any model comparison you send.

This week’s experiment

Measure what fork subagents change in your own setup. 45–60 minutes.

Build: in a throwaway repo, scaffold a Claude Code mod with one agent.spawn hook (the built-in plugin-authoring skill does the scaffolding). The hook appends agentId, model and the first 200 characters of the prompt to .claude/spawn-log.jsonl, and rewrites model to the Haiku alias for any workflow agent whose prompt starts with “search” or “triage”. Run the same three-subagent task twice, with and without CLAUDE_CODE_FORK_SUBAGENT=0.

Done when:

The log has one row per spawned agent in both runs, and you can say whether the hook fired for forks.
At least two agents were rewritten to Haiku.
You’ve broken the hook on purpose and noted whether the spawn was refused or went through.
Your README has one line with the token difference between the two runs.

Sourcing: Anthropic’s newsroom had no developer-facing post in this window. Items marked unverified come from community digests rather than primary sources.

Originally published at https://aheadofmain.com/issues/2026-10-19/. The full Disruption Watch board is at https://aheadofmain.com/watch/.

Ahead of Main #2: Hooks can now steer subagents, MCP permission rules got stricter, and Git is being rebuilt for agents

Thu, 15 Oct 2026 00:00:00 GMT

A quiet window on news, a busy one in the harness. The real movement is in Claude Code’s hook and permission layer (2.1.299 and 2.1.300). Nothing on the Disruption Watch moved up a rung; one entry is new.

The top 3

1. Hooks can now steer individual workflow agents, not just approve or refuse them

In 2.1.300 the agent.spawn mod hook can rewrite a workflow agent’s prompt and model; before, it could only refuse. Agent hooks now honour their own model setting, and updatedInput from PreToolUse and PermissionRequest hooks is validated like Claude’s own input: unknown keys are dropped, and input the tool rejects denies the call. In 2.1.299, turn.start fires for subagent turns too (tell them apart with e.agentId), and UserPromptSubmit hooks run before a skill or command expands, so a blocking hook also stops embedded shell commands.

Why it matters: policy can now sit at the point where a subagent is created and decide which model and instructions it gets. “Cheap model for triage, big model for planning” becomes enforced in code instead of a line in CLAUDE.md. For client work, that’s a cost and safety control you can show, not just describe.

Source: Claude Code CHANGELOG, 2.1.299 and 2.1.300

2. An MCP permission rule you wrote may now match fewer servers than you think

2.1.299 changed MCP allow rules so mcp__a reaches only the server named a. A server named a__b now needs mcp__<server>__* with the full normalised name. It also fixed deny and ask rules that didn’t apply when the normalised server name contained a double underscore. Cloud sessions and Remote Control connectors now negotiate MCP protocol version 2026-07-28 by default (MCP_PROTOCOL_NEGOTIATION=legacy opts out).

Why it matters: under the old behaviour a deny rule could silently fail to apply to a server with a double underscore in its name. Re-read your permissions rules. And if a scheduled job’s MCP connector behaves differently this week, the new default protocol version is the first suspect.

Source: Claude Code CHANGELOG, 2.1.299

3. Git forges are being rebuilt for agent concurrency

Cursor’s Origin, an agent-oriented Git forge with pull requests, review, GitHub mirroring and cloud agents, has been in early beta for paid plans since August. A Towards AI piece reports GitLab reworking parts of its source-control architecture for many agents reading, cloning and retrying against one repo at once. Origin publishes no repository-size, concurrency or benchmark figures, and I found no independent test.

Why it matters: when ten agents work one repo, the bottleneck stops being the model and becomes branches, locks and review. The question to start asking is which of your workflows break at five parallel agents on one repo, before a client asks.

Sources: Towards AI, Flavio Copes on Cursor Origin

Signal radar

MCP gateways are growing access control

WATCH Medium confidence, unverified.

The self-hosted side is adding the same controls vendors are adding first-party: LiteLLM now scopes MCP server access per request through an x-mcp-servers header and can suppress prompts or resources per server (reported in the agents-radar digest; I didn’t read the PRs). Two independent projects adding per-request MCP scoping in one week is the start of a pattern. The product shape to watch for is an “MCP firewall”.

Source: agents-radar, AI Infrastructure Digest, 15 October

Gemini 4 Argon’s useful detail is the price, not the model

CONTEXT Medium confidence.

You’ve seen the launch. The extra angle: secondary sources say the $2 / $10 per million token introductory rate doubles to $4 / $20 after the promotion (end date unconfirmed), and that the “1M” figure is an output limit, not an input window. It runs against the “everything gets cheaper” story: a frontier price that is explicitly temporary. I couldn’t retrieve Google’s own post.

Sources: eesel.ai, VKTR

Research frontier

PreciseCoder: debugging beyond unit-test rewards

WATCH Horizon: 12 months. Institution not listed in my source.

arXiv 2610.18755. The paper argues that rewarding a model only when unit tests pass teaches shallow fixes: make the test green rather than fix the cause. Instead it guides debugging with structural analysis of the code and a trace of how the failure happens. I saw a summary, not the numbers.

Why it matters: if a fix is judged by whether the failure trace now makes sense, “the agent edits the test until it passes” gets harder to fall into. You can approximate it today: require your agent to state the root cause and cite the failing trace before it edits anything.

Beyond the Verdict: agentic code judging with verifiable feedback

WATCH Horizon: 12 months. Institution not listed in my source.

arXiv 2610.18760. The judge is an agent that runs tests and cites the results as evidence, rather than giving a one-word pass or fail. A sibling paper the same day (2610.18766) does the same for LLM-as-judge evaluation.

Why it matters: it replaces a judge’s opinion with a judge’s evidence. It would matter if code-review bots start attaching reproducible evidence to each comment. Two papers on one day pointing the same way is a mild signal, not proof.

Both summaries come from a digest listing; I couldn’t open the abstract pages this window. Treat them as pointers.

New capabilities to adopt

Audit MCP permission rules after the matching change

ACT NOW

Open your settings.json files, list every mcp__… rule, and test one deny rule per server. About 15 minutes.

Enforce model tiers with an agent.spawn hook

ACT NOW

Rewrite a workflow agent’s model and prompt at creation time, so “Haiku for triage” is code, not habit. Pair it with turn.start to log every subagent turn. About 45 minutes; this is the experiment below.

Routines keep their environment when edited

CONTEXT

2.1.299: routines keep their environment even if the original was deleted, and scheduled tasks no longer fire early or repeatedly when daylight saving ends. No action unless you run self-hosted environments.

Source: Claude Code CHANGELOG, 2.1.299 and 2.1.300

Disruption watch

One new entry; nothing moved up. The full board is on the Watch page.

New: Source control and review built for many agents on one repo: enters at Watching. Evidence: Cursor Origin in beta, GitLab reportedly reworking for agent concurrency. No independent benchmarks. Note the point where your multi-agent runs on one repo start colliding, and what you do then.
MCP and tool protocols: Repricing the work. Held; cloud default is now the 2026-07-28 spec.
Ultra-cheap and open-weight models: Repricing the work. Held, with a counter-signal in Argon’s temporary price.
Harness and plugin layer: Hitting the market. Held; spawn-time rewriting adds depth, not a rung.
Everything else held. Design generation, app generation and autonomous QA had no dated news in this window.

Practice shifts

Put the policy at agent creation, not in the prompt

ACT NOW

Take the “use the cheap model for search” line out of CLAUDE.md and put it in a hook that sets the model when the agent is spawned. A prompt rule is advice; a spawn hook is enforcement, and it leaves a log you can show. Keep CLAUDE.md for judgement calls.

Treat permission rule names as code that can drift

ACT NOW

MCP rule matching changed under existing configs. Add a small test that, for each MCP server you use, a deny rule really blocks one known tool. Run it after every Claude Code upgrade.

Plan for parallel agents on one repo

WATCH

Decide how many agents may touch one repository, who merges, and what the review queue looks like. The tooling around Git is being rebuilt for this, but nothing is proven yet.

This week’s experiment

Make your model-tier rule enforceable. 45–60 minutes.

Build: a Claude Code mod in a throwaway repo (scaffold it with the built-in plugin-authoring skill) with one agent.spawn hook. It logs agentId, model and the first 200 characters of the prompt to .claude/spawn-log.jsonl, and rewrites model to the Haiku alias for any workflow agent whose prompt starts with “search” or “triage”. Add a turn.start hook that appends the same agentId when subagent turns begin.

Done when:

A workflow with three agents produces three spawn-log rows, two of them rewritten to Haiku.
You’ve broken the hook on purpose (throw an error) and written down whether the spawn was refused or went through.
Your README has one line on what you’d need before trusting this on a client project.

Sourcing: the Claude Code changelog was read directly. Items marked unverified come from the agents-radar community digests rather than primary sources.

Originally published at https://aheadofmain.com/issues/2026-10-15/. The full Disruption Watch board is at https://aheadofmain.com/watch/.

Ahead of Main #1: Decision models arrive, guard hooks learn to fail closed, and Haiku 5.5's price has a catch

Mon, 12 Oct 2026 00:00:00 GMT

Each issue of DEV Ahead looks at the layer underneath developer news: early signals, capabilities you can adopt this week, and shifts in the economics of building software. This one starts with a new entry on the Disruption Watch that went straight to “Hitting the market”.

The top 3

1. Decision models went from a repo pattern to a Microsoft product in four days

In the week before, Unsloth, SGLang and LiteLLM each added a “decision model” API. On 9 October Microsoft announced Microsoft-Decision-1, a 9B model post-trained from Qwen3.5-9B that doesn’t generate text. You give it fixed options (yes or no, multiple choice, a rating, or a rubric for grading an agent’s action) and it returns a calibrated probability for each. It’s in Foundry now, with OpenRouter listed as coming, at a reported $0.042 per million input tokens with output free. The accuracy and latency claims are Microsoft’s own.

Why it matters: the “should the agent proceed?” step in an agent graph (route, approve, escalate to a human) is turning into a cheap classifier call with a threshold you tune, instead of a prompted frontier-model call whose confidence is a guess. Confidence-gated human review becomes a priced, auditable feature.

Sources: Runtime Wire, TestingCatalog

2. Claude Code guard hooks were fail-open until 2.1.295

2.1.295 added onFailure: "block" for command and HTTP hooks: a hook that can’t start, times out, or exits with an unexpected code now blocks the action instead of letting it through. The same release fixed a mod hook silently receiving truncated tool input, “so a guard could pass content it never saw”, and a reload window where calls got past another mod’s guard. 2.1.296 fixed managed PreToolUse denials that refused a call but didn’t end the turn.

Why it matters: if you built a guard hook (say, blocking force-pushes), a crash in the guard meant the push went ahead. Policy-as-code is only as good as its failure behaviour, and that’s what decides whether a client can trust “we enforce it in code”.

Source: Claude Code CHANGELOG, 2.1.295 and 2.1.296

3. Haiku 5.5’s $0.10 / $0.50 is real, but there’s a 100K step and a tokenizer tax

Anthropic’s model overview lists Haiku 5.5 with a 1M-token context window, 128K max output and pricing “from $0.10 / $0.50 per MTok” (Haiku 4.5 was $1 / $5). Two secondary sources say prompts over 100K tokens bill at $0.50 / $2.50, and that the newer tokenizer counts the same text as about 30% more tokens. I didn’t see the tier table on Anthropic’s page itself, so confirm it before you budget around it. Claude Code 2.1.296 added the two knobs that exploit the price: CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL and per-subagent autoCompactWindow.

Why it matters: the headline is a roughly tenfold list-price drop, but the real saving depends on keeping subagent context under 100K and re-measuring cost per merged change with the new token counts. A fan-out subagent that reads a 400K repo dump loses most of the discount.

Sources: Anthropic, Claude Haiku 5.5 overview, eesel.ai, VKTR

Signal radar

Inference servers and gateways are where multi-model agents break right now

ACT NOW High confidence, if you run any of these. Unverified individually.

The agents-radar infrastructure digest lists a run of quiet correctness bugs: vLLM output corrupted after prefix-cache hits in v0.30 and v0.31 (advice: pin v0.29.0); LiteLLM losing tool_result.is_error in Anthropic-to-OpenAI translation, so a failed tool looks like a success to the next model; LiteLLM’s A2A config dropping temperature, max_tokens and top_p; Ollama tool calls breaking with format: "json". None are outages, and agents hide this class of bug well. Skip if you only call first-party APIs.

Source: agents-radar, AI Infrastructure Digest, 12 October

Claude’s apps gateway is quietly becoming an enterprise LLM gateway

WATCH Medium confidence.

Across 2.1.295 and 2.1.296 the changelog adds per-upstream model allow-lists that also apply on failover, Bedrock, Vertex and Foundry upstreams with a time-to-first-byte limit, request IDs that match an audit log, a spend cap and managed policies. That’s the feature list of a LiteLLM-style proxy, shipped by the model vendor. I have the changelog only, not the docs.

Source: Claude Code CHANGELOG, 2.1.295 and 2.1.296

A terminal status protocol is spreading between agent CLIs

WATCH Medium confidence.

Pi added the OSC 7501 Program Status Protocol in early October; a week later Claude Code 2.1.295 supports it, so terminals that implement it can show an agent as working, waiting on you, or done. Two tools in a week is how a de facto standard starts. Next to watch for: a terminal or tmux status line that reads it.

Source: Claude Code CHANGELOG, 2.1.295

Mistral Large 4: preview now, open weights promised for late October

WATCH Medium confidence.

Public preview at $1.36 / $4.18 per million tokens during a launch sale. Independent numbers are less flattering than Mistral’s: Artificial Analysis Index 38, behind GLM-5.3, Kimi K3 and DeepSeek V4.1 Flash. Weights are promised by month end with no licence named. A Western lab is still shipping open weights, but the open-weight lead remains with Chinese labs.

Sources: Capital & Compute, BetaNews

Research frontier

CheckerBench: can long-horizon agents write static-analysis checkers?

WATCH Horizon: 12 months. Institution not verified.

arXiv 2610.07557. 300 tasks built from 297 real CVEs across 167 repositories. Each asks a coding agent to write a static-analysis checker (a rule that finds that class of bug automatically), graded by running it, across 21 model-and-harness combinations. Per secondary write-ups: average pass rate 32%, best 45%; Python best (65%), C/C++ worst (25%). By harness, OpenCode averaged 37%, Claude Code 34% and Hermes Agent 26%.

Why it matters: “turn this CVE into a reusable lint rule” is a realistic agent job for Python and JavaScript today, but not yet for C/C++. And the same models moved by about ten points depending on the harness, which is evidence for treating your hooks, skills and tool setup as the asset.

Sources: AI Weekly, Lilys

New capabilities to adopt

Make guard hooks fail closed

ACT NOW

Add onFailure: "block" to every enforcement hook, then break each one on purpose to check. --debug now logs each command hook’s outcome and duration. 10–15 minutes.

Pin workflow agents to Haiku 5.5 and compact subagents early

ACT NOW

CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL runs every workflow agent on one model; autoCompactWindow lets a subagent compact before the main conversation does. 30 minutes to wire, a week to measure. Note that /cost now prices Sonnet 5.5 cache reads at $0.10/M (was $0.20), so older baselines are off.

Source: Claude Code CHANGELOG, 2.1.296

Try Microsoft-Decision-1 as a gate once it’s on OpenRouter

WATCH

Calibrated yes or no scores at roughly $0.04 per million input tokens. Foundry-only for now. 30–45 minutes to compare against a prompted Haiku 5.5 on 50 labelled cases.

Disruption watch

The board this newsletter tracks from issue to issue. Each entry sits on a four-step ladder: Watching, Accelerating, Hitting the market, Repricing the work. The full board is on the Watch page.

New: Small decision models as control nodes: enters at Hitting the market. Evidence: Microsoft-Decision-1 shipped on 9 October, after three inference projects added decision-model APIs the week before. Stop prompting a big model for approve, route and escalate steps; measure a small scorer against labelled cases.
Ultra-cheap and open-weight models: Repricing the work. Haiku 5.5’s price confirmed on Anthropic’s page; Mistral Large 4 weights due.
Agentic coding, orchestration, context engineering, MCP, app generation: Repricing the work. Held.
Harness and plugin layer, AI-native infrastructure, autonomous QA: Hitting the market. Held. CheckerBench is a ceiling reading for QA, not a move.
Design generation, pricing pressure on dev work: Accelerating. Held.

Practice shifts

Design every guard to fail closed, then test the failure

ACT NOW

List every hook that enforces a rule (force-push, destructive deletes, secrets). Add onFailure: "block", then break each one (rename the script, make it time out) and confirm the action is refused.

Give each subagent a context budget, not just a model

ACT NOW

For every delegated job, write down model, effort and maximum context. With a possible price step at 100K tokens, a triage agent that gets a bounded excerpt is cheaper than one that gets the repo. Track cost per merged change, not per token.

Replace “ask the big model if it’s safe” with a thresholded score

WATCH

Wherever a graph asks a model to approve, route or grade, record a numeric confidence and a threshold, and send the uncertain middle to a human.

This week’s experiment

Build a guard that fails safe and measures itself. 45–60 minutes.

Build: a PreToolUse command hook on the Bash tool, in a throwaway repo, with onFailure: "block". The script reads the tool-call JSON from stdin, asks Haiku 5.5 for a 0–1 “safe to run” score on the command, and denies below 0.8. Send the model only the command string, so context stays tiny. Log timestamp, command, score, latency and token usage to .claude/guard-log.jsonl.

Done when:

ls is allowed and something like rm -rf ~/some-dir is denied, with a score in the log.
You rename the script so it can’t start, run any Bash command, and Claude Code refuses it rather than running it.
The log has at least five rows, and you can state the added latency per call and the cost of those five calls.

Sourcing: the Claude Code changelog and Anthropic’s model page were read directly; the paper figures come from secondary write-ups. Items marked unverified come from community digests.

Originally published at https://aheadofmain.com/issues/2026-10-12/. The full Disruption Watch board is at https://aheadofmain.com/watch/.

Ahead of Main

Ahead of Main #5: Agent Skills go neutral, Claude Code closes fail-open gaps, and MCP retries get a stop sign

The top 3

1. Agent Skills now lives at the Agentic AI Foundation

2. Three Claude Code releases close places where safety checks failed open

3. A timed-out MCP call now tells the model not to repeat it

Signal radar

Skill supply chain is the next MCP-registry problem

Cursor’s Origin marketplace and cloud agents

Research frontier

What open-source projects tell their coding agents: a census of AGENTS.md and CLAUDE.md

StateMirror: catching hallucinated tool calls before they run

Cache engineering for agents

New capabilities to adopt

Upgrade to 2.1.310 and test your blocking hooks

Write one skill and run it in a second agent

Scripts that call claude ultrareview

Disruption watch

Practice shifts

Test the failure path of every guard

Version your procedures as skills, not prompts

Decide what a server does when nobody answers

This week’s experiment

Ahead of Main #4: Claude Code logs every blocked tool call, MCP retries get selective, and fork subagents get a fix

The top 3

1. Claude Code now emits an event for every tool call something stopped, and mods can demand a human

2. HTTP MCP tool calls are retried only if they’re read-only or idempotent

3. The fork-subagent default from last issue got a patch within five days

Signal radar

Most MCP servers look abandoned

Policy that a model can’t satisfy

ASE 2026’s agentic workshops will turn into papers

Research frontier

New capabilities to adopt

Run /auto-mode-setup in your busiest repo

Export claude_code.safety_event if you already run OpenTelemetry

Audit allowedMcpServers after upgrading to 2.1.305 or later

Disruption watch

Practice shifts

Make every write tool idempotent, and annotate it honestly

Treat the refusal stream as data

Keep a short list of what a model may not approve

This week’s experiment

Ahead of Main #3: Fork subagents are on by default, open weights split in two, and Claude Design gets an end date

The top 3

1. Claude Code 2.1.302 turned fork subagents on for scripted use

2. Open weights got cheap in two different ways

3. Standalone Claude Design closes on 14 December 2026

Signal radar

MCP servers on spec 2026-07-28 are failing when they omit three fields

Gateways don’t honour MCP tool annotations yet

Research frontier

New capabilities to adopt

Decide on fork subagents for every unattended job

Put the auto-mode classifier on a cheaper model

Classifier telemetry and a hook concurrency cap

Disruption watch

Practice shifts

Treat harness defaults as dependencies, and pin them

Run the classifier and the router on a cheaper tier than the worker

Check licences the way you check prices

This week’s experiment

Ahead of Main #2: Hooks can now steer subagents, MCP permission rules got stricter, and Git is being rebuilt for agents

The top 3

1. Hooks can now steer individual workflow agents, not just approve or refuse them

2. An MCP permission rule you wrote may now match fewer servers than you think

3. Git forges are being rebuilt for agent concurrency

Signal radar

MCP gateways are growing access control

Gemini 4 Argon’s useful detail is the price, not the model

Research frontier

PreciseCoder: debugging beyond unit-test rewards

Beyond the Verdict: agentic code judging with verifiable feedback

New capabilities to adopt

Audit MCP permission rules after the matching change

Enforce model tiers with an agent.spawn hook

Routines keep their environment when edited

Disruption watch

Practice shifts

Put the policy at agent creation, not in the prompt

Scripts that call `claude ultrareview`

Run `/auto-mode-setup` in your busiest repo

Export `claude_code.safety_event` if you already run OpenTelemetry

Audit `allowedMcpServers` after upgrading to 2.1.305 or later