---
title: "The AI stack moved from models to operations"
description: "A larger model got the headline. The more important changes happened in agent workflows, protocols, security, and regulation."
source: "https://blog.dvx.ventures/signals/ai-infrastructure-gets-operational"
site: "DVx Blog"
publisher: "DVx Ventures"
type: "DVx Signal — Builder"
issue: "001"
published: "2026-07-30"
updated: "2026-07-31"
last_verified: "2026-07-31"
---

# DVx Signal — Builder 001 — The AI stack moved from models to operations

> A larger model got the headline. The more important changes happened in agent workflows, protocols, security, and regulation.

This week’s read

## The model release was not the biggest change

Five changes matter this week. Opus 5 held its price. Coding agents moved into issue queues. MCP removed sessions from its core. GitHub added checks before workflows run and packages install. Europe changed the compliance calendar.

AI systems are getting easier to deploy and harder to govern casually.

01

Model release

## Opus 5 gives you more room at the same list price

![GitHub Copilot model picker with Claude Opus 5 selected.](https://blog.dvx.ventures/signals/001/covers/claude-opus-5.png)

*GitHub’s launch artwork shows Claude Opus 5 in Copilot’s model picker. [Open the announcement ↗](https://github.blog/changelog/2026-07-24-claude-opus-5-is-now-available-in-github-copilot/)*

- **What changed** — Anthropic released `claude-opus-5` on July 24 through its API, Amazon Bedrock, Google Cloud, and Microsoft Foundry. It has a one-million-token context window, a 128,000-token maximum output, and thinking enabled by default. List price remains $5 per million input tokens and $25 per million output tokens, the same as Opus 4.8. GitHub started a gradual Copilot rollout that day.
- **Why you should care** — The one-million-token window is not the decision. Ask whether the extra reasoning improves the task enough to justify more tokens or latency. Treat a model swap as an operating change.
- **What to do next** — Run three fixed tasks against your current model and Opus 5. Score success, time, edits, and cost. Keep your default unless Opus wins.

Primary sources [Anthropic model documentation](https://platform.claude.com/docs/en/about-claude/models/whats-new-opus-5); [GitHub Copilot release, July 24](https://github.blog/changelog/2026-07-24-claude-opus-5-is-now-available-in-github-copilot/).

02

Agentic engineering

## The coding agent just left the editor

![GitHub Copilot code review comment generated with Linear MCP and a repository agent skill.](https://blog.dvx.ventures/signals/001/covers/github-agent-workflows.jpg)

*GitHub’s release artwork shows a Copilot review comment using Linear MCP and a repository agent skill. [Open the announcement ↗](https://github.blog/changelog/2026-07-29-copilot-code-review-agent-skills-and-mcp-now-generally-available/)*

- **What changed** — GitHub made its Linear integration generally available on July 23. An assigned issue can launch an agent and return a draft pull request. GitHub added a separate Copilot app policy on July 27, extended managed settings to the app and cloud agent, then added repository skills and read-only MCP context to code review on July 29.
- **Why you should care** — The ticket is becoming the prompt. Repository instructions are becoming the operating manual. Approval policy is becoming the safety boundary. These rules can no longer live in one engineer’s editor.
- **What to do next** — Pick one low-risk issue class. Require acceptance criteria, tests, a draft pull request, human review, and approved tools. Produce one repeatable issue template and one reviewed agent run.

Primary sources [Linear integration, July 23](https://github.blog/changelog/2026-07-23-copilot-cloud-agent-for-linear-is-now-generally-available/); [app policy](https://github.blog/changelog/2026-07-27-manage-github-copilot-app-access-with-a-dedicated-policy) and [managed settings, July 27](https://github.blog/changelog/2026-07-27-enterprise-managed-settings-now-apply-to-the-github-copilot-app/); [code review skills and MCP, July 29](https://github.blog/changelog/2026-07-29-copilot-code-review-agent-skills-and-mcp-now-generally-available/).

03

Protocol

## MCP removed sessions from the core

![Before and after MCP topology: sticky sessions versus stateless requests across server instances.](https://blog.dvx.ventures/signals/001/covers/mcp-stateless-topology.png)

*MCP’s migration diagram shows sticky routing and shared session state before, then any request reaching any instance after. [Open the release note ↗](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/)*

- **What changed** — MCP `2026-07-28` made the core protocol stateless. `initialize`, `initialized`, and `Mcp-Session-Id` are gone, so a request can reach any server instance. Tasks moved to an extension. Roots, Sampling, and Logging are deprecated. Official SDKs retain backward compatibility.
- **Why you should care** — Stateless does not mean no state. It means the protocol no longer holds it for you. Scaling gets easier. Your application now owns job handles, authorization, recovery, and compatibility.
- **What to do next** — Inventory clients and servers by protocol version and SDK. Search for sessions, initialization hooks, old Tasks, deprecated capabilities, and literal error codes. Pin versions until tests pass.

Primary sources [MCP final specification changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog); [May release candidate and timeline](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/); [GitHub MCP Server support, July 23](https://github.blog/changelog/2026-07-23-github-mcp-server-supports-the-next-mcp-specification/).

04

Security

## GitHub added checkpoints before untrusted code runs

![GitHub Actions release artwork announcing approval holds for potentially malicious workflows.](https://blog.dvx.ventures/signals/001/covers/github-actions-workflow-approval.jpg)

*GitHub’s release artwork for the new workflow approval gate. [Open the announcement ↗](https://github.blog/changelog/2026-07-28-github-actions-holds-unproven-workflows-for-approval/)*

- **What changed** — GitHub now holds some suspicious Actions workflows in public repositories until a write-access collaborator approves them. npm scans packages before install availability, normally adding five minutes. Dependabot also added OpenSSF malicious package advisories across several ecosystems.
- **Why you should care** — These checks can stop credential theft before code runs. Workflow holds only cover public repositories on github.com. Dependabot requires malware alerting. Package automation may now pause or fail.
- **What to do next** — Enable malware alerts. Assign workflow approval. Wait 15 minutes before automations consume a new package. Keep CI credentials narrow.

Primary sources [Actions workflow holds](https://github.blog/changelog/2026-07-28-github-actions-holds-unproven-workflows-for-approval/); [npm publish-time scanning](https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata); [Dependabot coverage](https://github.blog/changelog/2026-07-28-dependabot-alerts-on-malicious-packages-across-more-ecosystems).

05

Regulation

## Europe changed the AI calendar, not the obligation

![AI Act graphic encircled by twelve European Union stars.](https://blog.dvx.ventures/signals/001/covers/eu-ai-omnibus.jpg)

*“AI Omnibus enters into force,” © European Union, via the European Commission. [Open the announcement ↗](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force)*

- **What changed** — Regulation (EU) 2026/1744 entered into force on July 27. It extends some SME measures to small mid-caps, expands sandbox access, and moves high-risk application dates to December 2, 2027 for Annex III and August 2, 2028 for Annex I product systems.
- **Why you should care** — Some EU-facing companies gained time and support. The inventory still needs to name each system, company role, risk category, and effective date.
- **What to do next** — Build that register. Have counsel verify the calendar and company-size treatment.

Primary sources [European Commission summary, July 27](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force); [official legislative text](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32026R1744).

One workflow to try · 30 minutes

## Run a model-swap gate before changing your default

1. **Input** Choose one real coding issue with fixed context, acceptance criteria, and tests.
2. **Mode** Give your current model and Opus 5 twelve minutes each in the same harness.
3. **Output** Save both diffs, test results, elapsed time, token cost, and required edits.
4. **Proof** Name the winner on the scorecard. Write “no change” if the evidence is close.

Do not merge either result during the test. The scorecard is the artifact.

Portfolio watchlist

## Three places to keep watching

### Product & engineering

MCP compatibility and repeatable agent tasks moving from editors into issue queues and review.

### GTM & operations

EU sandbox eligibility, small-mid-cap treatment, and launch calendars for regulated products.

### Security, data & policy

Copilot app defaults, MCP credentials, Actions approval ownership, Dependabot alerts, and npm publishing delays.

Term of the week

## Stateless protocol

Each request contains enough information for any compatible server instance to handle it. The application can still keep state by passing an explicit handle such as `job_id`. Stateless MCP simplifies routing. It does not remove authorization, recovery, or state design.

Field Manual impact

## Manual 01 still holds

**The AI Workbench** still holds. Route by task and promote a model only when evidence supports the change. Feed the Opus 5 and GitHub pilots into **Manual 02: Coding With Agents**. Write **Manual 06: Harness Engineering** against MCP’s July 28 lifecycle, not the old session-based core.

## Source ledger

| Development | Announcement or publication | Availability or effective date |
| --- | --- | --- |
| Claude Opus 5 | July 24, 2026 | API and multi-cloud availability July 24. Copilot rollout began July 24. |
| GitHub agent workflows | July 23, 27, and 29 | Linear and code review features are GA. Managed settings apply on sign-in, restart, or the next task. |
| MCP `2026-07-28` | Release candidate announced May 21 | Final specification July 28. Support varies by SDK and client. |
| GitHub supply-chain controls | July 28, 2026 | Actions protection, npm scanning, and Dependabot expansion released that day. |
| EU AI Omnibus | Adopted July 8; published July 24 | Entered into force July 27. Cited high-risk dates begin in 2027. |

**Verification notes**

- Research window: July 23 to 30, 2026. The MCP preview and EU adoption predate the window. Their final release, publication, or entry into force occurred inside it.
- Links and titles were opened and checked July 30. Primary sources are used.
- Anthropic capability language is vendor-supplied. Unverified benchmark rankings were omitted.
- GitHub scope limits are explicit. Workflow holds currently cover public repositories on github.com. Code review MCP calls are read-only. Copilot Business or Enterprise administrators must enable Opus 5.
- No confidential portfolio information is included.
- The AmitOS voice pass was completed July 31. The published copy contains no em dashes.

---

*Source: https://blog.dvx.ventures/signals/ai-infrastructure-gets-operational — DVx Blog, published by [DVx Ventures](https://dvx.ventures).*