AI digest: 2026-11-04

Highlights

• Skills as locked dependencies (APM and Dependabot): Microsoft's APM declares skills, prompts, and MCP servers in apm.yml, installs them into Claude Code, Codex, Copilot, and others with apm install, and pins them in a lockfile. Dependabot now opens update PRs for it.
• Impeccable: 24 design commands for coding agents (/impeccable critique, polish, audit) plus a no-LLM "AI slop" detector. Install with npx impeccable install.
• Claude Code 2.1.318: unattended runs can see when a claude.ai sign-in ends (credential_expires_at, a stderr warning from 10 days before), plus many headless fixes.

New sources

Agents and tooling

• APM: Agent Package Manager: npm-style manifest and lockfile for skills, plugins, and MCP servers across agents.
• Dependabot version updates support APM: update PRs for apm.yml dependencies, all GitHub plans.
• Impeccable: front-end design skill pack and detector (Apache-2.0).
• Humanizer: skill that rewrites AI-sounding prose without adding facts (MIT).
• Claude Code release 2.1.318: sign-in expiry reporting, mod fork effort, no-repo cloud sessions, many fixes.

Frameworks and libraries

• Claude Agent SDK (TypeScript) v0.3.317 and v0.3.318: fail-closed hook matchers; file_unchanged Read result removed.

Models

• Claude text watermark: Mythos 5, Opus 4.7, and Sonnet 4.6 output is watermarked; sampling caveat on Sonnet 4.6.

Topic pages updated

• tooling/skills: APM, Dependabot, Impeccable, Humanizer; open question on the Agent Skills spec rechecked (still no tagged release or security guidance).
• tooling/mcp: MCP servers declared through APM.
• tooling/coding-agents: Claude Code 2.1.318.
• practices/security: pinning skills with Dependabot updates; deniedMcpServers now covers Anthropic-provided servers.
• frameworks/landscape: TypeScript Agent SDK row; OpenAI Agents SDK 0.24.0-alpha.6 noted as a preview only.
• models/claude: text watermark and an open question on which models it covers.