Adding TypeSafe Jev to a Mac computer-use agent first made it slower: 178 s for a 6-task suite, vs 140 s for the same agent without Jev. That's from the agy-cua bench: Gemini in Antigravity driving macOS apps through the accessibility tree, zero screenshots. Jev picks each action from a closed list of on-screen elements. v0: Jev decides one step at a time, but Gemini is still called before every step. 40 planner turns, 178 s. v1: Gemini hands over a whole sequence. Each step must meet a stated postcondition, the verified window state feeds the next step instead of a re-read, and the run halts on the first miss. 16 turns, 95 s, $0.034 total. Gemini wait drops from 117 s to 56 s. Google's own computer-use arm: 410 s, 94 screenshots, $0.094. Every arm passes 6/6. My take: a fast decider pays off only when it lets you delete calls to the slow model. Bolted on as one more hop per step, it costs you. Caveat: the author's own harness and numbers. They also threw out an earlier 6.8x claim for this parity re-run, which makes me trust it more.

Nov 16: Claude Opus 4.8, Claude Opus 5 and GPT-5.6 Terra leave every GitHub Copilot surface: Chat, inline edits, ask and agent modes, code completions (changelog, Oct 15). Suggested swaps: Opus 4.8 and Opus 5 → Claude Opus 5.5. GPT-5.6 Terra → GPT-6.1 Sol or GPT-6 Luna. The part admins miss: on Business and Enterprise, the replacements switch on automatically only under default model enablement. If you turned the global default off, or explicitly disabled that model, nobody sees Opus 5.5 or GPT-6.1 Sol until you enable its model policy in Copilot settings. One exception: Opus 4.8 stays for individual subscribers on annual plans. Two checks before Nov 16: grep workflows and integrations for the three old model names, and if your org opted out of defaults, turn on the replacement policies.

CodeQL still skips PHP, Shell/Bash, Terraform HCL, Dockerfiles, JSP, and Blazor on pull requests. AI Scan for PRs is now generally available to cover those gaps (changelog, Oct 15). It runs automatically when code scanning and the repo's effective AI Scan setting are on. Findings sit next to CodeQL with an "AI" badge and can include a risk explanation plus a suggested autofix. The catch that matters for rulesets: findings are advisory. They do not fail the code scanning check and cannot block merges. No fork PRs, no Dependabot PRs. No Copilot license required — private or internal orgs need Code Security or GHAS. Billing is Code Security AI Credits (Advanced Security SKU). Set a budget before you turn it on org-wide, or the first week of PHP and Terraform PRs will surprise finance.

Cloudflare Tunnel's default route ceiling just moved from 1,000 to 50,000 per account — CIDR and hostname routes for Tunnel and Mesh, automatic, no ticket (changelog, Oct 16). Published applications (public hostnames) are not routes. Those still sit at roughly 5,000–10,000 per tunnel, depending on config size. The other limit moved with a price: every account still includes 1,000 tunnels. Past that, Tunnels for Platforms lets you buy more at $4.50 per tunnel per month — one tunnel per device, end customer, or environment. Inactive tunnels still count. Disconnecting cloudflared does not free a slot; you have to delete the tunnel. If you're scaling one-per-customer, reconcile orphans in the Usage card before you buy.

Cloudflare Gateway can now hand matching HTTP traffic to your own Worker: a Forward action in HTTP policies, public beta on all Zero Trust plans (changelog, Oct 15). The Worker gets the request plus Gateway context: connection metadata, user identity, device posture when available. It can rewrite requests and responses, return a coaching page, or run background work like a Slack alert or an R2 capture. Gateway keeps the proxy connection, TLS decryption and upstream routing. The order matters if you were running a separate proxy for this: - HTTP request policies run before Forward policies, so a request blocked there never reaches your code. - Gateway inspects the original body before your Worker sees it, and a body-inspection Block can interrupt the Worker. - The final response is inspected again before it goes back to the user. The Worker adds steps inside the policy chain; it doesn't route around it. Keep allow/deny in policies and give the Worker what a policy can't express.

"Generate Fix" on a code scanning alert was free. Once Agentic autofix is on, that button is replaced by Assign to Copilot (changelog, Oct 15). What changes: Copilot explores relevant files, proposes a patch, re-runs CodeQL to confirm the alert closes, iterates if needed, then opens a draft PR with the validation trail. Up to 25 alerts can go into one PR. Default-branch alerts only. Three gates before the button appears: 1) Enterprise "Agentic autofix" policy 2) Org or repo Code Security setting 3) A Copilot billing method on file Each run burns Code Security AI Credits plus Actions minutes. Set the SKU budget before anyone batch-assigns 25 alerts.

OpenRouter's Armor beta puts TypeSafe Jev in front of every agent tool call and asks one question before the call runs: is this out of policy? Their pitch is blunt — regex filters miss intent. A decision model can block payments, deletes, and outbound messages that an allowlist would let through. The launch video shows the guard firing mid-run. Same window: StackOne shipped Tool Policies with tool/field/value/PII plus semantic rules on every agent tool call, per user and group. Semantic rules run on Jev — they say they picked it after benchmarking against Clef and Laya on real connector fields. My take: two vendors, same slot. The gate belongs at the tool boundary, not inside the system prompt. If your agent can spend money or send mail, decide before execute.

Cloudflare Stream's WebRTC live is now GA, and billing for it starts today, Oct 15: standard Stream rates per minute of video delivered (changelog). If you built on it during the beta, three things to check: - Usage. WebRTC delivery now shows up in Stream analytics and the billable usage charts. Look there first if beta test inputs are still wired into a page. - Your player. WebRTC was rebuilt on Cloudflare Realtime and moved to current WHIP/WHEP: trickle ICE, server and client offer modes, counter-offers. Re-test your player library instead of assuming beta behavior carries over. - The two URLs. A live input's API response carries webRTC (WHIP, to broadcast) and webRTCPlayback (WHEP, to watch). A browser can go live with no broadcast app. Stream is the one-to-many broadcast layer. Many-to-many stays on Realtime itself.