Decision models arrive, guard hooks learn to fail closed, and Haiku 5.5's price has a catch

Each issue of DEV Ahead looks at the layer underneath developer news: early signals, capabilities you can adopt this week, and shifts in the economics of building software. This one starts with a new entry on the Disruption Watch that went straight to “Hitting the market”.

The top 3

1. Decision models went from a repo pattern to a Microsoft product in four days

In the week before, Unsloth, SGLang and LiteLLM each added a “decision model” API. On 9 October Microsoft announced Microsoft-Decision-1, a 9B model post-trained from Qwen3.5-9B that doesn’t generate text. You give it fixed options (yes or no, multiple choice, a rating, or a rubric for grading an agent’s action) and it returns a calibrated probability for each. It’s in Foundry now, with OpenRouter listed as coming, at a reported $0.042 per million input tokens with output free. The accuracy and latency claims are Microsoft’s own.

Why it matters: the “should the agent proceed?” step in an agent graph (route, approve, escalate to a human) is turning into a cheap classifier call with a threshold you tune, instead of a prompted frontier-model call whose confidence is a guess. Confidence-gated human review becomes a priced, auditable feature.

Sources: Runtime Wire, TestingCatalog

2. Claude Code guard hooks were fail-open until 2.1.295

2.1.295 added onFailure: "block" for command and HTTP hooks: a hook that can’t start, times out, or exits with an unexpected code now blocks the action instead of letting it through. The same release fixed a mod hook silently receiving truncated tool input, “so a guard could pass content it never saw”, and a reload window where calls got past another mod’s guard. 2.1.296 fixed managed PreToolUse denials that refused a call but didn’t end the turn.

Why it matters: if you built a guard hook (say, blocking force-pushes), a crash in the guard meant the push went ahead. Policy-as-code is only as good as its failure behaviour, and that’s what decides whether a client can trust “we enforce it in code”.

Source: Claude Code CHANGELOG, 2.1.295 and 2.1.296

3. Haiku 5.5’s $0.10 / $0.50 is real, but there’s a 100K step and a tokenizer tax

Anthropic’s model overview lists Haiku 5.5 with a 1M-token context window, 128K max output and pricing “from $0.10 / $0.50 per MTok” (Haiku 4.5 was $1 / $5). Two secondary sources say prompts over 100K tokens bill at $0.50 / $2.50, and that the newer tokenizer counts the same text as about 30% more tokens. I didn’t see the tier table on Anthropic’s page itself, so confirm it before you budget around it. Claude Code 2.1.296 added the two knobs that exploit the price: CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL and per-subagent autoCompactWindow.

Why it matters: the headline is a roughly tenfold list-price drop, but the real saving depends on keeping subagent context under 100K and re-measuring cost per merged change with the new token counts. A fan-out subagent that reads a 400K repo dump loses most of the discount.

Sources: Anthropic, Claude Haiku 5.5 overview, eesel.ai, VKTR

Signal radar

Inference servers and gateways are where multi-model agents break right now

ACT NOW High confidence, if you run any of these. Unverified individually.

The agents-radar infrastructure digest lists a run of quiet correctness bugs: vLLM output corrupted after prefix-cache hits in v0.30 and v0.31 (advice: pin v0.29.0); LiteLLM losing tool_result.is_error in Anthropic-to-OpenAI translation, so a failed tool looks like a success to the next model; LiteLLM’s A2A config dropping temperature, max_tokens and top_p; Ollama tool calls breaking with format: "json". None are outages, and agents hide this class of bug well. Skip if you only call first-party APIs.

Source: agents-radar, AI Infrastructure Digest, 12 October

Claude’s apps gateway is quietly becoming an enterprise LLM gateway

WATCH Medium confidence.

Across 2.1.295 and 2.1.296 the changelog adds per-upstream model allow-lists that also apply on failover, Bedrock, Vertex and Foundry upstreams with a time-to-first-byte limit, request IDs that match an audit log, a spend cap and managed policies. That’s the feature list of a LiteLLM-style proxy, shipped by the model vendor. I have the changelog only, not the docs.

Source: Claude Code CHANGELOG, 2.1.295 and 2.1.296

A terminal status protocol is spreading between agent CLIs

WATCH Medium confidence.

Pi added the OSC 7501 Program Status Protocol in early October; a week later Claude Code 2.1.295 supports it, so terminals that implement it can show an agent as working, waiting on you, or done. Two tools in a week is how a de facto standard starts. Next to watch for: a terminal or tmux status line that reads it.

Source: Claude Code CHANGELOG, 2.1.295

Mistral Large 4: preview now, open weights promised for late October

WATCH Medium confidence.

Public preview at $1.36 / $4.18 per million tokens during a launch sale. Independent numbers are less flattering than Mistral’s: Artificial Analysis Index 38, behind GLM-5.3, Kimi K3 and DeepSeek V4.1 Flash. Weights are promised by month end with no licence named. A Western lab is still shipping open weights, but the open-weight lead remains with Chinese labs.

Sources: Capital & Compute, BetaNews

Research frontier

CheckerBench: can long-horizon agents write static-analysis checkers?

WATCH Horizon: 12 months. Institution not verified.

arXiv 2610.07557. 300 tasks built from 297 real CVEs across 167 repositories. Each asks a coding agent to write a static-analysis checker (a rule that finds that class of bug automatically), graded by running it, across 21 model-and-harness combinations. Per secondary write-ups: average pass rate 32%, best 45%; Python best (65%), C/C++ worst (25%). By harness, OpenCode averaged 37%, Claude Code 34% and Hermes Agent 26%.

Why it matters: “turn this CVE into a reusable lint rule” is a realistic agent job for Python and JavaScript today, but not yet for C/C++. And the same models moved by about ten points depending on the harness, which is evidence for treating your hooks, skills and tool setup as the asset.

Sources: AI Weekly, Lilys

New capabilities to adopt

Make guard hooks fail closed

ACT NOW

Add onFailure: "block" to every enforcement hook, then break each one on purpose to check. --debug now logs each command hook’s outcome and duration. 10–15 minutes.

Pin workflow agents to Haiku 5.5 and compact subagents early

ACT NOW

CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL runs every workflow agent on one model; autoCompactWindow lets a subagent compact before the main conversation does. 30 minutes to wire, a week to measure. Note that /cost now prices Sonnet 5.5 cache reads at $0.10/M (was $0.20), so older baselines are off.

Source: Claude Code CHANGELOG, 2.1.296

Try Microsoft-Decision-1 as a gate once it’s on OpenRouter

WATCH

Calibrated yes or no scores at roughly $0.04 per million input tokens. Foundry-only for now. 30–45 minutes to compare against a prompted Haiku 5.5 on 50 labelled cases.

Disruption watch

The board this newsletter tracks from issue to issue. Each entry sits on a four-step ladder: Watching, Accelerating, Hitting the market, Repricing the work. The full board is on the Watch page.

• New: Small decision models as control nodes: enters at Hitting the market. Evidence: Microsoft-Decision-1 shipped on 9 October, after three inference projects added decision-model APIs the week before. Stop prompting a big model for approve, route and escalate steps; measure a small scorer against labelled cases.
• Ultra-cheap and open-weight models: Repricing the work. Haiku 5.5’s price confirmed on Anthropic’s page; Mistral Large 4 weights due.
• Agentic coding, orchestration, context engineering, MCP, app generation: Repricing the work. Held.
• Harness and plugin layer, AI-native infrastructure, autonomous QA: Hitting the market. Held. CheckerBench is a ceiling reading for QA, not a move.
• Design generation, pricing pressure on dev work: Accelerating. Held.

Practice shifts

Design every guard to fail closed, then test the failure

ACT NOW

List every hook that enforces a rule (force-push, destructive deletes, secrets). Add onFailure: "block", then break each one (rename the script, make it time out) and confirm the action is refused.

Give each subagent a context budget, not just a model

ACT NOW

For every delegated job, write down model, effort and maximum context. With a possible price step at 100K tokens, a triage agent that gets a bounded excerpt is cheaper than one that gets the repo. Track cost per merged change, not per token.

Replace “ask the big model if it’s safe” with a thresholded score

WATCH

Wherever a graph asks a model to approve, route or grade, record a numeric confidence and a threshold, and send the uncertain middle to a human.

This week’s experiment

Build a guard that fails safe and measures itself. 45–60 minutes.

Build: a PreToolUse command hook on the Bash tool, in a throwaway repo, with onFailure: "block". The script reads the tool-call JSON from stdin, asks Haiku 5.5 for a 0–1 “safe to run” score on the command, and denies below 0.8. Send the model only the command string, so context stays tiny. Log timestamp, command, score, latency and token usage to .claude/guard-log.jsonl.

Done when:

1. ls is allowed and something like rm -rf ~/some-dir is denied, with a score in the log.
2. You rename the script so it can’t start, run any Bash command, and Claude Code refuses it rather than running it.
3. The log has at least five rows, and you can state the added latency per call and the cost of those five calls.

---

Sourcing: the Claude Code changelog and Anthropic’s model page were read directly; the paper figures come from secondary write-ups. Items marked unverified come from community digests.