October 27 agent guide: Copilot SDK identity, LFM3, and Genie 4

This October 27 agent guide covers the control changes that landed after the October 26 feed closed and before October 28 began. GitHub gave Copilot SDK apps an organization identity. Anthropic published Claude Code 2.1.311, which keeps a long standard-context session alive by compacting it. Liquid AI released the LFM3 family, a set of open-weight models around 2B parameters aimed at on-device agents. Google DeepMind announced Genie 4, a real-time world model that is still a research preview. None of these items is a new frontier chat model for the public API.

The October 26 feed already recorded Copilot assisted permissions, GPT-6.1 Terra inside Copilot, and Greptile bug detection with GPT-6 Astra. Those items stay in the earlier briefing. October 27 is a different problem: who an unattended agent authenticates as, how a coding agent survives a long context, and which small model can run the loop on a device.

What shipped on October 27

Four primary sources define the day. Times below use India Standard Time when a UTC timestamp exists. Liquid and DeepMind dated their posts October 27 without a clock, so those two sit as same-day announcements rather than as a minute-level sequence.

Copilot SDK server-to-server authentication

GitHub’s October 27 changelog says Copilot now supports server-to-server authentication for GitHub Apps installed on organizations, in public preview. A service built with the GitHub Copilot SDK can make requests on behalf of an organization without a signed-in user’s credentials. Usage is attributed and billed to the organization that owns the installation. The organization’s model policies, budgets, and spending controls still apply.

The setup GitHub describes is short. Give the GitHub App the read-only Copilot Requests organization permission. Install the app on the organization. Pass a short-lived installation access token to the Copilot SDK. Organization owners can see which apps have access, find app-attributed rows in the AI usage CSV through the app_client_id field, and stop an app by suspending or uninstalling it.

That identity is the piece unattended agents were missing. A pull-request reviewer or a nightly triage job that borrowed a developer token failed when that person was offboarded, hit a personal budget, or lost a seat. An installation token keeps the job attached to the organization. It does not grant a new model, and it does not turn assisted permissions off. Assisted permissions, covered in the October 26 governance note, still decide which commands may run. Server-to-server auth decides which organization pays and which policy set applies.

Treat the preview limits as real. The changelog does not say the permission works for user-owned apps or for apps installed only on a personal account. It names organizations. Confirm the app_client_id column on a single test installation before a fleet of agents shares one token. If the CSV does not show the app, the job is still riding a user identity and the rollout is not done.

Claude Code 2.1.311 on the India clock

GitHub published Claude Code v2.1.311 at 2026-10-26T21:51:23Z. That is 03:21 on October 27 in India, which is why this guide dates the release October 27 even though the UTC calendar day is October 26. The tag is not a model launch. It is a control release for people who already run Claude Code, including self-hosted runners, subagents, and Remote Control.

The fix with the widest effect is for standard-context sessions. The notes say a request that ran over 200K tokens could stop with the message "Usage credits required for 1M context." Claude Code now compacts the conversation and continues. A related fix stops the model from seeing stale MEMORY.md and CLAUDE.md content right after automatic compaction when those files were edited earlier in the session. Long jobs that looked like a billing wall were, in this case, a compaction gap.

Agent wiring changed in four places that show up in production logs. Subagents can use MCP tools from servers that finish connecting after the subagent starts. SubagentStop hooks run once when a subagent finishes, instead of about twice a minute while it is still running. An interrupt takes effect even while an MCP server has not answered a resource read. A subagent’s isolated worktree is no longer removed while a background subagent it started is still working in that worktree.

Self-hosted runners gained two flags: --hold-idle-file and --max-hold-min. They keep an idle session while the host reports processes it left running. Background agents in auto mode that wait on their own shells no longer start a new main conversation turn on every wake. Teams that count hook fires or session turns should expect those counts to drop after the upgrade, and should treat the drop as the fix rather than as a missing event.

Upgrade the hosts that stop near 200K tokens first. Then check one SubagentStop hook and confirm it fires once. Leave the 2.1.310 role split for Cloud sessions and Remote Control in place. That earlier release, covered in the October 24 scheduling guide, is still the policy change. 2.1.311 is the session-survival change.

Liquid LFM3 for on-device agents

Liquid AI announced LFM3 on October 27, 2026. The post describes a family of models around 2B parameters, branched from LFM3-1.7B-Base, covering text, vision, audio, omni, and two decision models. Weights are open and available on Hugging Face, in Liquid’s playground, and through the Liquid AI API. The LFM3-VL-2B documentation names the LFM Open License v1.0. That is not Apache 2.0. Read the license before any commercial deploy, and do not copy an Apache attribution line from another model.

The text model, LFM3-1.7B, has a 256K-token context window. Liquid says the model fits in about 1 GB at 4-bit precision and was post-trained to run inside agent harnesses such as Hermes Agent, Pi, and OpenClaw, including tool search across a large tool list. The architecture note is specific: 24 layers, of which 13 are gated short convolutions with kernel size 7, five are sliding-window attention with a 256-token window, and six are global attention. Pre-training is stated as 22T tokens, with a final 3.5T-token mid-training stage that extends context to 256K and adds a larger share of agent traces and tool calls. Those figures are vendor-reported.

Liquid’s own write-up draws a useful line. It says LFM3-1.7B leads on instruction following and function calling on BFCL and ToolSandbox relative to the models in its table, and that larger models still win on agentic coding and knowledge. Use the small model for a local triage loop, a tool router, or a specialist fine-tune on one GPU. Do not retire a larger coding model because a 1.7B card won a function-calling slice.

What the vision card actually specifies

LFM3-VL-2B is the first LFM vision model that takes video. The docs list 1.73B language parameters, a 164M hybrid vision encoder, and a 25M projector, with a 128K context. Videos are sampled at 2 frames per second. The model thinks inside a thinking block before it answers, and enable_thinking can be set to false for a direct answer. Transformers loading uses trust_remote_code. Point and box coordinates are normalized to a 0-1000 range and are approximate. The model does not generate or edit images.

Liquid’s category table, which the company describes as an unweighted mean across 62 evaluations, lists an average of 71.4 for LFM3-VL-2B against 64.0 for Qwen3.5 2B. The same table lists the agentic category at 42.5, against 56.1 for GPT-5.6 Luna and 62.4 for Gemini 3.5 Flash Lite. The small model is ahead of its size class on the vendor average and behind those larger models on the agentic slice. Re-bench the actual screenshots and tool traces before a routing change. A printed average is not a substitute for the task.

Decision models beside the cloud decisions API

The same release adds d1-2B, built on the vision model, and d1-Omni-2B, built on the omni model. Liquid says they do not write an answer. They take a situation and a list of questions and return a calibrated probability for each question in one forward pass. That is a different job from the OpenAI Decisions API covered in the October 24 scheduling guide, which is a cloud endpoint for a hot decision path. d1 is an on-device classifier with a license to read. It is not a drop-in replacement for that API, and it is not a coding agent.

A practical split is easy to test. Keep scheduled multi-step work on the cloud agent runtime that already has traces. Put a single yes-or-no gate, such as "does this screenshot show a logged-in error," on d1 only after the probabilities are calibrated on local examples. If the license blocks the deployment, stay on the cloud path.

Genie 4 as a research preview, not a runtime

Google DeepMind announced Genie 4 on October 27 as a new world model for real-time interactive simulation. The post says the model is natively multimodal, generating ambient sound, music, and interactive dialogue with the scene. Gemini Omni anchors appearance. Other Gemini models supply reasoning so the simulation stays coherent. The rollout described on the page is a research preview for trusted testers. DeepMind says a broader release will start with Google AI Ultra subscribers in Project Genie and early access partners of the Gemini API and Google AI Studio. There is no general developer endpoint in the announcement.

The agent detail that is technically specific sits in one paragraph. Gemini 3.8 Flash acts as a guiding agent in the loop. As Genie 4 generates the world, Gemini observes the scene, breaks a goal into steps, reviews incoming frames, and checks that each step succeeded. If the user intervenes, the plan changes. A later section describes an experiment in which Gemini 4 Argon breaks a robotics task into captions that Genie 4 renders, including a checkers example with Apptronik’s Apollo. DeepMind labels that work as an experiment inside the research post, not as a shipping robot API.

The limitations section is as important as the demo. DeepMind says visual details and object permanence can drift as a simulation runs longer, after complex prompt edits, or while the camera moves. Complex physical interactions, real-time audio accuracy, legible text, spatial accuracy, and long-term consistency are listed as open research. Every video and audio output is marked with SynthID. Those constraints make Genie 4 a place to explore training scenes for agents, not a place to execute a customer workflow.

Google Cloud’s note on Gemini Robotics Embodied Reasoning 2 is dated October 28, 2026 on the live page. That day is not complete, so this guide does not treat the cloud preview as an October 27 release. Teams that need a robot control API should wait for the next briefing rather than infer availability from the Genie 4 post.

What this October 27 agent guide means for developers

Three code paths changed, and they do not stack into one framework.

• Copilot SDK jobs that run without a person at the keyboard should take an installation token from an organization-owned GitHub App. Log app_client_id. Keep user tokens for interactive IDE sessions.
• Claude Code hosts on long refactors should move to 2.1.311 and expect compaction past 200K tokens. Recount SubagentStop hooks. Add --hold-idle-file only on self-hosted runners that already report leftover processes.
• On-device experiments should start with LFM3-1.7B on one tool harness and a fixed task list. Load LFM3-VL-2B with trust_remote_code only inside a sandbox. Leave Genie 4 on the waitlist.

Observability does not change because the model got smaller. A local LFM3 loop still needs the same trace of tool name, arguments, and result that a cloud agent writes. The MCP authorization pattern in the enterprise guide still applies when a subagent gains tools that connect late, which is exactly the 2.1.311 fix. A late-connecting server is not a reason to skip the allowlist.

What it means for businesses

The budget question is which identity the agent spends under. Server-to-server Copilot usage lands on the organization that owns the GitHub App, under that organization’s model policy and budget. A team can no longer assume an agent job is capped by one engineer’s seat. Owners should name the app, set the budget, and review the CSV before the job is scheduled.

LFM3 changes a different line on the bill. Tokens on a device the company already owns are not metered by an API, which is why a 2B model is attractive for a high-volume gate. The license, the fine-tune data, and the quality on the company’s own tickets still decide whether that gate is allowed. Genie 4 does not change a production budget this week because there is no general API to buy.

A one-day pilot

1. 01
   Separate the identities

   Create one GitHub App, grant Copilot Requests, install it on a non-production organization, and run a single Copilot SDK call with the installation token. Confirm the row shows app_client_id.
2. 02
   Upgrade one Claude Code host

   Pin 2.1.311 on a repository that previously stopped past 200K tokens. Run the same long task and confirm the session compacts instead of stopping. Check that a SubagentStop hook fires once.
3. 03
   Bench one local model

   Run LFM3-1.7B on a fixed set of tool calls the team already scores. Record license review, failure cases, and latency on the target device. Do not change the default coding model in the same change.
4. 04
   Park the world model

   If simulation is a real requirement, join the Genie 4 waitlist and write down the scenes that need to stay consistent for more than a short session. Do not block the three steps above on that access.

Common mistakes

• Treating server-to-server auth as a way around model policy. The changelog says organization policies and budgets still apply.
• Dating Claude Code 2.1.311 as October 26 in India. The tag time is October 27 at 03:21 IST. The UTC date is the one that causes the mix-up.
• Calling LFM3 Apache 2.0. The vision docs name the LFM Open License v1.0.
• Reading the vision average of 71.4 as a win over GPT-5.6 Luna on agent tasks. Liquid’s own agentic column lists 42.5 against 56.1.
• Putting a customer workflow on Genie 4 because the demo shows a robot. The post is a trusted-tester preview and lists object permanence as unsolved.
• Pulling the October 28 robotics cloud post into this day. The live page date is October 28, so it is outside this window.

Conclusion

October 27 did not add another flagship API model. It added an organization identity for Copilot SDK agents, a Claude Code release that compacts instead of stopping, an open-weight 2B family for on-device loops, and a world-model preview that is not callable for general development yet. The useful order is identity, then session survival, then a licensed local bench. Simulation access can wait.

Related reading

• Copilot assisted permissions and the October 26 governance note: /blog/github-copilot-assisted-permissions-governance-october-2026
• Scheduled OpenAI agent runs and Claude Code 2.1.310: /blog/openai-agent-automations-october-2026
• How routing changed on October 22 and 23, including the Decisions API: /blog/kimi-k31-pro-decisions-api-routing-october-2026
• Copilot managed settings and agent hooks: /blog/github-copilot-argon-managed-settings-agent-hooks-october-2026
• MCP authorization for enterprise tool calls: /blog/mcp-enterprise-managed-authorization-ema-guide
• What to log when an agent calls tools: /blog/agent-observability-stack-clients
• A smaller open-weight cost comparison from earlier in October: /blog/minimax-m31-flash-agent-cost-october-2026
• A map of agentic AI topics: /topics/agentic-ai

Need this control board run on a stack?

Bacancy Technology reviews agent identity, session limits, and on-device model choices against the systems a team already runs. The October 27 releases are concrete enough to pilot in a day and specific enough to get wrong if the license, the billing identity, or the preview status is skipped. Talk to the team through the consulting page or the contact form.

Consulting: /consulting/ . Contact: /contact/ .

Sources: GitHub Changelog, October 27, 2026, github.blog . Claude Code v2.1.311, published 2026-10-26T21:51:23Z, GitHub . Liquid AI, October 27, 2026, liquid.ai — lfm3 and docs.liquid.ai — lfm3 vl 2b . Google DeepMind, October 27, 2026, deepmind.google — genie 4 a new generation of world simulation .