AI infrastructure gets operational

Model release

Claude Opus 5 changes the model-swap calculation

What changed: Anthropic released claude-opus-5 July 24 through its API, Amazon Bedrock, Google Cloud, and Microsoft Foundry. It has a one-million-token context window, 128,000-token maximum output, and thinking enabled by default. List pricing remains $5 per million input tokens and $25 per million output tokens—unchanged from Opus 4.8. GitHub began a gradual Copilot rollout that day.
Why DVx should care: This is a larger operating envelope at the same list price. A drop-in migration can still change token use and latency because thinking is on by default.
What to do next: Run three tasks against the current model at several effort levels. Record success, time, edits, and cost before changing the default.

Anthropic’s Claude Opus 5 model documentation. Open the primary source ↗

Primary sourcesAnthropic model documentation; GitHub Copilot release, July 24.

Agentic engineering

Coding agents are becoming governed workflow infrastructure

What changed: GitHub made its Linear integration generally available July 23: an assigned issue can launch an agent in an ephemeral environment and produce a draft pull request. On July 27, GitHub added separate Copilot app policy and extended managed settings to the app and cloud agent. On July 29, repository skills and read-only MCP context in code review became generally available.
Why DVx should care: Agents are moving from editors into issue queues and review. Ownership, tool access, approvals, and repository standards need shared design.
What to do next: Pilot one issue class in a low-risk repository. Require acceptance criteria, tests, a draft PR, human review, approved MCP, and managed settings.

GitHub’s Copilot code-review release. Open the primary source ↗

Primary sourcesLinear integration, July 23; app policy and managed settings, July 27; code-review skills and MCP, July 29.

Protocol

MCP's new core removes sessions—and introduces a migration

What changed: MCP 2026-07-28 became final July 28 after a May release candidate. Its core is stateless: initialize, initialized, and Mcp-Session-Id are removed, so requests can reach any server instance. Tasks moved to an extension; Roots, Sampling, and Logging are deprecated. The release has breaking changes, although official SDKs preserve backward compatibility.
Why DVx should care: Remote servers can scale without sticky routing or shared sessions. Custom implementations may depend on removed lifecycle behavior, old Tasks, or literal error codes.
What to do next: Inventory clients and servers by protocol and SDK. Flag sessions, initialization hooks, old Tasks, and deprecated capabilities; pin versions until tests pass.

The Model Context Protocol 2026-07-28 specification changelog. Open the primary source ↗

Primary sourcesMCP final specification changelog; May release candidate and timeline; GitHub MCP Server support, July 23.

Security

GitHub added pre-execution and pre-install supply-chain checks

What changed: On July 28, GitHub began holding certain potentially malicious Actions workflows in public repositories until a write-access collaborator approves them. npm now scans packages before install availability, normally adding about five minutes. Dependabot added OpenSSF malicious-package advisories across npm, PyPI, and other ecosystems.
Why DVx should care: These controls can stop credential theft, but workflow holds cover only public github.com repositories, and Dependabot requires malware alerting. npm automation can now fail.
What to do next: Enable malware alerts, assign approval ownership, tolerate a 15-minute package delay, and keep CI secrets least-privileged.

Primary sourcesActions workflow holds; npm publish-time scanning; Dependabot coverage.

Regulation

The EU AI Omnibus is now law, not a proposal

What changed: Regulation (EU) 2026/1744 was adopted July 8, published July 24, and entered into force July 27. It extends some SME measures to small mid-caps, expands sandbox access, and moves application dates for Annex III high-risk systems to December 2, 2027 and Annex I product systems to August 2, 2028.
Why DVx should care: EU-facing companies may gain time and support, but must still inventory, classify, and document systems.
What to do next: Map each EU-facing system to its role, risk category, annex, and effective date. Have counsel verify the calendar and company-size treatment.

Primary sourcesEuropean Commission summary, July 27; official legislative text.

One workflow to try · 30 minutes

Run a model-swap gate

Use one coding issue with fixed context, criteria, and tests. Give the current default and Opus 5 twelve minutes each in the same harness; merge neither.

InputOne real issue, fixed context, acceptance criteria, and tests.
ModeRun the current default and Opus 5 for twelve minutes each.
OutputSave each diff, test result, elapsed time, cost, and required edits.
ProofName the better model for that task—or record “no change” if the evidence is inconclusive.

Portfolio watchlist

Three places to keep watching

Product & engineering

MCP SDK compatibility; repeatable agent tasks moving from editors into issue queues and review.

GTM & operations

EU sandbox and small-mid-cap eligibility; revised claims and launch calendars for regulated products.

Security, data & policy

Copilot app defaults, MCP credentials, Actions approval ownership, Dependabot alerts, and npm publish delays.

Term of the week

Stateless protocol

Each request contains enough routing and negotiation information for any compatible server instance to handle it, without a server-held session. Applications can remain stateful by passing explicit handles such as job_id. “Stateless MCP” simplifies infrastructure; it does not remove state, authorization, or recovery design.

Field Manual impact

No immediate change to Manual 01

The AI Workbench still holds: route by task and promote models through evidence. Feed the Opus 5 and GitHub pilots into Manual 02: Coding With Agents. Draft Manual 06: Harness Engineering against MCP's July 28 lifecycle, not the prior session-based core.

Source ledger

Development	Announcement / publication	Availability / effective date
Claude Opus 5	July 24, 2026	API and multi-cloud availability July 24; Copilot gradual rollout began July 24.
GitHub agent workflows	July 23, 27, and 29	Linear and code-review features are GA; managed settings apply on sign-in, restart, or next task.
MCP `2026-07-28`	Release candidate announced May 21	Final specification July 28; support varies by SDK and client.
GitHub supply-chain controls	July 28, 2026	Actions, npm scanning, and Dependabot expansion released that day.
EU AI Omnibus	Adopted July 8; published July 24	Entered force July 27; cited high-risk application dates begin in 2027.

Verification notes

Research window: July 23–30, 2026. The MCP preview and EU adoption predate the window, but final release, publication, or entry into force occurred inside it.
Links and titles were opened and checked July 30. Primary sources are used throughout.
Anthropic capability language is vendor-supplied; unverified benchmark rankings were omitted.
GitHub scope limits are explicit: workflow holds currently cover public repositories on github.com, code-review MCP calls are read-only, and Copilot Business or Enterprise administrators must enable Opus 5.
No confidential portfolio information is included.