What IBM Shipped for Bob Since Self-Hosted GA: Premium Packages, DevSecOps, and the Model Router, Read for Maximo
🎯 Who this is for: Maximo leads, architects, and the people who sign off on tooling. You have read Parts 1 to 8, or at least Part 5, and you want to know what changed between the self-hosted release and today, 10 November 2026. You want it read through a Maximo lens and you want to know what IBM did not say. You do not need to know COBOL or RPG.
Series: IBM Bob for Maximo Teams | Part 9 of 9 (finale) | Read time: ~35 minutes
Previous: Part 8, Bob Shell in CI | Series index: Start here
🔥 Six Weeks of Announcements, and the Word "Maximo" Appears Nowhere
Between 1 October and 10 November 2026, IBM published a self-hosting release, two Bob blog posts, a DevSecOps package announcement at TechXchange, an IDE release with a dozen new features, four Bob Shell builds, and a headline about Anthropic's Claude Mythos coming to IBM Concert. If you manage a Maximo estate, someone has forwarded you at least one of these with the note "does this change anything for us?"
The honest answer has two halves.
First half: almost none of it is about Maximo. We read every Bob blog post, newsroom item, and changelog in the window. The word "Maximo" does not appear in any of them. IBM shipped nothing labelled for Maximo, and there is no Maximo premium package.
Second half: some of it matters a lot anyway. Maximo Manage 9.2 now runs exclusively on Java 25, and IBM now sells a package that upgrades Java estates. Maximo installs are built from Ansible and Terraform, and IBM now sells a package that scans infrastructure code and catches secrets. Your pilot from Part 5 depends on knowing which model answered, and IBM has now explained how the router chooses.
This part goes through each item, says what it means for a Maximo shop, and closes the series with a dated scorecard and an updated open-questions list.
💡 Key insight: "Nothing for Maximo" and "nothing that affects Maximo" are different statements. IBM announced the first. You still have to work out the second for your own estate.
A note on labels, carried from Part 5. [IBM] means the claim is on an IBM page, and we give the page and date. [GH] means we read it from a public GitHub repository through the GitHub API on 10 November 2026. [TMG] means it is our assessment. We did not run the premium packages against a customer's Maximo code to write this part.
📌 The Short Version
| Question | Short answer (as of 10 Nov 2026) | Source |
|---|---|---|
| Is there a Maximo premium package? | No. Four packages: DevSecOps, Java Modernization, Z, i | Bob docs, premium packages overview [IBM] |
| Is there a .NET or standalone security package? | No. Security is the DevSecOps package | Same |
| What Java does Manage need now? | Java 25, exclusively, from the April 2026 feature channel release of 9.2 | IBM support flash 7270573 [IBM] |
| Can Bob upgrade Maximo custom Java? | The Java upgrade workflow targets 8/11 to 17/21/25 on Maven or Gradle projects; Maximo specifics are untested by IBM in public | Java Modernization docs [IBM]; [TMG] |
| What is new in security? | DevSecOps package: SafeWrite, Trivy/Opengrep/KICS, secrets, AI scans, Ansible/Terraform skills, PR review "in November" | IBM announcement, 27 Oct 2026 [IBM] |
| How are models picked? | Three tiers (Fast, Premium, Ultra), routed on the first request, kept for prompt caching | Bob blog, 4 Nov 2026 [IBM] |
| Which models? | Not named. IBM says it evaluates "over 150 frontier open-weight models" | Same |
| Maximo at TechXchange? | None found | TechXchange newsroom hub [IBM] |
| Claude Mythos and Bob? | The 9 Nov Concert announcement does not mention Bob | IBM announcement, 9 Nov 2026 [IBM] |
| Maximo assets that changed? | Script-optimizer knowledge files (21 Oct), demo #270 (13 Oct), ibm-mas/cli .bob plans (Nov), MAF Local Dev Mode wording (6 Nov) | GitHub [GH] |
🧰 The Four Premium Packages, as of 10 November 2026
IBM's premium packages overview page lists four packages and calls them "optional add-ons that extend IBM Bob with specialized capabilities for specific platforms and workflows" [IBM, bob.ibm.com/docs/ide/premium-packages/pkg-index].
| Package | IBM's one-line description | Maximo relevance [TMG] |
|---|---|---|
| DevSecOps | "Real-time vulnerability scanning, secret detection, and supply chain risk analysis in the IDE" | High for repos that hold Maximo config, scripts, integration code, and MAS install IaC |
| Java Modernization | "AI-assisted tooling for analyzing and migrating Java applications" | High for shops with custom MBO, field, bean, and crontask classes |
| Z | "IBM Bob capabilities tailored for IBM Z mainframe development" | Low to medium: only if Maximo integrates with mainframe finance, HR, or supply systems |
| i | "IBM Bob capabilities extended to IBM i application development" | Low to medium: only if Maximo integrates with IBM i inventory, purchasing, or ERP |
Three things are not on the list, and we say so plainly because they get asked about:
- There is no Maximo package. Maximo-specific Bob material from IBM is the two free skills covered in Part 4, published in the
ibm-self-serve-assets/building-blocksrepository. - There is no .NET package. If your Maximo estate includes .NET integration middleware, Bob's core agent is what you get.
- There is no standalone security package. Security scanning is the DevSecOps package. The Concert Secure Coder mentioned at Think 2026 is a separate IBM Concert item, and we only saw it in search snippets.
How they install. The overview page says that when Bob launches, it "automatically checks whether your subscription includes any premium package entitlements" and prompts you to install any package you are entitled to [IBM]. So entitlement is tied to the subscription, not to a download you control. For a regulated estate, that means the package set on each developer machine follows procurement, and you should pin versions using the "Updating a premium package" page, which lets you update to the latest or a specific version.
Price. IBM's product page says: "First month free on IBM Bob Premium packages for Java Modernization and IBM i. New subscribers only. Offer available until Dec 31st, 2026" [IBM, ibm.com/products/ai-coding-agent, read 10 Nov 2026]. No price is given for the DevSecOps package in the 27 October announcement. Bob Premium Package for i is "an add-on to a paid Bob base plan, not a separate download" [IBM, Bob blog, 6 Oct 2026], and we assume the others work the same way, but we did not find that stated for each package.
☕ Java Modernization, Mapped to Maximo's Java Estate
This is the package most Maximo teams should look at first, because MAS has moved the Java floor twice in eighteen months.
The Java level Manage requires, verified
We checked IBM's support flash "IBM Maximo Manage: Transition to Java 25 from Maximo Application Suite 9.2 support announcement" (support page node 7270573) on 10 November 2026. It says [IBM]:
| Manage release | Java support stated by IBM |
|---|---|
| Manage 9.2, April 2026 feature release and later | "full support for Java 25"; "based exclusively on Java 25, and no compatibility mode is supported or applicable" |
| Manage 9.1 and earlier 9.2 feature releases (March 2025 through March 2026) | Java 17 |
| Manage 8.6.x, 8.7.x, 9.0.x, and 9.1 releases up to February 2025 | Java 8 compatibility mode (Java 11) |
The same flash says "the runtime Liberty version has been upgraded to support Java 25," that "some existing JARs like ant.jar are affected due to compatibility issues," and that you must "thoroughly test customizations, reports, automation scripts, and web services." The Manage 9.2 what's-new page also lists "Migration to Java 25" for Maximo Manage and Maximo Optimizer.
⚠️ Correction note: an earlier TMG post in the Java Extensions series described Java 17 as remaining the Manage baseline in 9.2. IBM's support flash says otherwise for the April 2026 feature release and later. Plan against Java 25 if your target is current Manage 9.2.
What the package offers
From the Java Modernization overview and workflows pages [IBM, bob.ibm.com/docs/ide/premium-packages/java-modernization]:
| Workflow or feature | What IBM says it does | Maximo use [TMG] |
|---|---|---|
| Java upgrade workflow | "Upgrade from Java 8 or 11 to modern versions (17, 21, or 25) with AI-driven validation and agentic fixes" | Custom MBO, field, bean, MIF processing, and crontask classes compiled for 8 or 11 |
| Liberty modernization workflow | Migrates "from traditional WebSphere to the Liberty runtime," guided by an IBM Application Modernization Accelerator (AMA) plan; needs an AMA bundle from AMA 4.6.0 or later | Not for Manage itself, which IBM already runs on Liberty. Useful for your own adjacent apps that still run on traditional WebSphere |
| UI modernization workflow | Component-by-component UI migration; you must create back/ and front/ directories | Not relevant to Maximo screens. Possibly relevant to custom portals beside Maximo |
| Unit test generation workflow | "Strategy-first test generation with generate–run–fix loops and JaCoCo coverage integration" | Tests for custom logic, if you can isolate it from a running Maximo server |
| Java Vulnerability Remediation workflow | Uses the OSV database to find vulnerable dependencies and update them | Third-party JARs bundled in your customization archive |
| spring-boot-to-quarkus skill | Migrates Spring Boot apps to Quarkus | Only for Spring Boot integration services you own |
| OpenRewrite integration | "Deterministic recipe automation for code transformations" | Repeatable API migrations across many classes |
| Build tools | "The package supports both Maven and Gradle" | Check this first (see below) |
You start a workflow with the Start Workflow button in the chat panel or with the /start-java-mod skill command [IBM].
The Maximo gap nobody mentions: the build
The package supports Maven and Gradle. Many Maximo customization projects have neither. We regularly see custom classes compiled by an old Ant script, by an IDE project that points at a copy of businessobjects.jar, or by someone's laptop. In MAS, the result is packaged into a customization archive, as covered in our Java Extensions series.
If your Maximo Java has no Maven or Gradle build, the first job is to create one. That is a human job, and it is worth doing anyway, because a reproducible build is the only way to prove what is in the archive. Bob can help write the pom.xml, but you have to supply the Maximo JARs from your own MAS image as provided dependencies. IBM does not publish them to a public Maven repository.
A quick way to see what you have. Run this against an extracted customization archive to list each class's compiled Java level. Class file major version 52 is Java 8, 55 is Java 11, 61 is Java 17, 65 is Java 21, and 69 is Java 25.
# Inventory the compiled Java level of every class in a customization archive.
# Run in a scratch directory; never run code from the archive itself.
mkdir -p /tmp/custarch && cd /tmp/custarch
unzip -q -o /path/to/your-customization-archive.zip
find . -name '*.class' | while read -r c; do
major=$(javap -v "$c" 2>/dev/null | awk '/major version/ {print $3}')
echo "$major $c"
done | sort | awk '{count[$1]++} END {for (m in count) print "major", m, ":", count[m], "classes"}'
# Third-party JARs are the other half of the risk (IBM names ant.jar as affected).
find . -name '*.jar' -printUpgrade, or convert to an automation script?
Java 25 forces the question for every custom class. You have two IBM-provided Bob paths: the paid Java upgrade workflow, and the free maximo_java_conversion skill from Part 4, which converts Maximo Java classes to Python, Jython, JavaScript, Nashorn, or ECMAScript automation scripts.
| Signal in the class | Lean toward | Why [TMG] |
|---|---|---|
| Field validation, defaulting, simple cross-field checks | Convert to script | Small logic, object or attribute launch points fit well, and no more compiled code to carry through the next Java change |
| Status-change checks on one object | Convert to script | Object launch point plus canChangeStatus-style logic is a common, testable pattern |
| Simple crontask that runs a query and updates a few records | Convert to script | Script-based crontasks exist and avoid a rebuild of the archive |
| Large class (hundreds of lines) with inheritance across several MBOs | Upgrade in place | Conversion risks behavior drift; review cost will be high |
| Depends on third-party JARs (HTTP clients, PDF, XML libraries) | Upgrade in place, then run OSV remediation | Scripts cannot easily carry that dependency tree |
| MIF processing classes or custom handlers | Upgrade in place unless the logic is trivial | Integration behavior is hard to retest fully |
| Calls into MBO internals, reflection, or overridden framework methods | Upgrade in place, carefully | Java 17 and 25 module rules break reflective access that used to work |
| Code nobody understands | Neither yet | Document it first. Bob's explain features help; a decision without understanding is a guess |
Two warnings. First, both paths produce code that must be reviewed by someone who knows Maximo. The free skill and the paid workflow are not Maximo-aware in the same way your senior developer is, and IBM's Java package documentation does not mention Maximo at all. Second, converting to scripts moves the risk, it does not remove it. Scripts need the same MboSet discipline Part 5 listed: no count() where notExist() will do, logging through object-specific loggers, and no save() or close() on sets you did not create.
💡 Key insight: The cheapest Java class to upgrade is the one you delete. Java 25 is a good moment to ask which customizations are still needed at all, before you pay coins or people to modernize them.
The free month
If you want to try this, the timing is reasonable. The free first month on the Java Modernization and i packages runs through 31 December 2026, for new subscribers only [IBM]. Use it on a copy of your customization source with a Maven build already in place. If you spend the free month creating the build, you have not tested the package.
🛡️ DevSecOps: What Was Announced on 27 October, and What Is Still Coming
The only Bob item on IBM's TechXchange 2026 newsroom hub is the announcement "Securing AI-assisted software delivery with IBM Bob Premium Package for DevSecOps," published 27 October 2026 and written by Jay Talekar and Michael Kwok [IBM]. We re-read it on 10 November. The docs pages and the IDE 2.3.0 changelog add detail.
What is in the package
| Capability | What IBM says | Status on 10 Nov 2026 |
|---|---|---|
| SafeWrite | "Intercepts AI-proposed file edits and package-install commands in memory." Replaces newly introduced vulnerable dependency versions with "the nearest fixed version," "blocks installations when no known fix is available, and rejects direct edits to lockfiles" | Shipped |
| Rule-based scanning | Trivy, Opengrep with Bob rules, and KICS for code and IaC; findings in the Bob Findings panel with severity, file, line, and rule ID | Shipped |
| Secrets detection | "Identify exposed secrets, tokens, and credentials before they reach version control" | Shipped |
| Supply chain risk | Scans dependency manifests "for known CVEs, package popularity signals, and release age on every file open and save" | Shipped |
| Fix Supply Chain Vulnerabilities workflow | Remediates dependencies and runs your test suite at each stage | Shipped |
| Attack surface scan (/attack-surface-scan) | Top-down; builds a model of the project and hunts for vulnerabilities; uses Bobcoins | Shipped |
| File sweep scan (/file-sweep-scan) | Bottom-up, every eligible file, multi-round review; "uses more Bobcoins than the attack surface scan" | Shipped |
| Ansible skill (/ansible-automation) | Write, refactor, review playbooks and roles; convert shell scripts and runbooks; Molecule tests | Shipped |
| Terraform skill (/terraform-devops in docs) | Create, refactor into modules, plan-mode tests with mock providers, plan and deploy "with mandatory human approval at every destructive step" | Shipped |
| Security dashboard | Historical scan results by project and branch | Shipped |
| Intelligent PR reviews | /review comment on a GitHub pull request; runs "through Bob Shell as a GitHub Actions workflow"; severity, blocking flag, and a "ready-to-use prompt" per comment, then a readiness verdict; advisory only | Announced as "available in November"; no GA docs page found |
| watsonx.governance extension | Identifies AI agents, assesses them against governance policies, and registers them "in the AI Inventory" | Announced; watsonx Governance appeared in the Bob Marketplace on 1 Oct |
The AI-driven scans are described as read-only: they "do not read secret files and run against a Git snapshot of the code" [IBM]. The IDE 2.3.0 changelog says the add-on now ships three extensions: IBM.bob-devsecops, bob-security-watch, and bob-prreview-remote [IBM]. That third name suggests the PR review client is already in the bundle, but IBM has not published a page that tells you how to switch it on.
GitHub and GitHub Enterprise are first. "GitLab support is planned for the next release" [IBM]. If your Maximo code lives in GitLab, Azure DevOps, or Bitbucket, the PR review is not for you yet.
The command-name conflict
IBM's own GitHub repository IBM/bob-devsecops (created 23 October 2026, last pushed 24 October) has a README that lists different command names from the docs [GH; IBM].
| Function | Bob docs, "Workflows and skills" page | IBM/bob-devsecops README |
|---|---|---|
| Supply chain fix | Workflow named Fix Supply Chain Vulnerabilities (started from the chat panel) | /supply-chain-fix-vulnerabilities |
| Terraform skill | /terraform-devops | /terraform-this |
| Attack surface scan | /attack-surface-scan | /attack-surface-scan |
| File sweep scan | /file-sweep-scan | /file-sweep-scan |
| Ansible skill | /ansible-automation | /ansible-automation |
This is small, but it matters if you write runbooks or house rules that name commands. Check the installed extension's own command list and write what your version actually exposes. Do not copy either source blindly.
The Maximo angle: secrets
Maximo estates leak credentials in predictable places. These are the places to point the secrets scanner at first.
| Where secrets hide in a Maximo estate | Example of what leaks | What to do [TMG] |
|---|---|---|
| Copies of maximo.properties from 7.6 days, kept "for reference" | Database user and password (mxe.db.user, mxe.db.password) | Delete or vault them; never commit them |
| Exported end point and external system definitions | Integration usernames, passwords, API keys for HTTP end points | Strip credentials from exports before committing |
| Postman collections and environment files | MAS API keys, maxauth headers | Keep environments out of Git; use variables |
| Shell scripts and runbooks for MAS installs | OpenShift tokens, IBM entitlement keys | Move to a secret manager; scan history too |
| Automation script source exported to Git | Hard-coded credentials for outbound calls | Move to system properties or a vault, then rotate |
| CI variables printed in logs | Bob API keys (see Part 8) | Mask them; never echo |
Two limits. First, the scanners see files. Automation scripts that only exist in the Maximo database are invisible to them. If you want them scanned, export them into a repository first, which is a good habit anyway. Second, IBM does not say whether Opengrep's Python rules handle Jython 2.7 syntax well. Expect some noise on older scripts, and measure it before you trust the count.
The secrets scanner complements the .bobignore and workspace-trust controls from Part 3 and the hooks from Part 7. .bobignore stops the agent reading a file. The scanner tells you the file exists. You want both.
The Maximo angle: infrastructure code for the MAS install
MAS is installed onto OpenShift, and IBM's own tooling for that is the MAS CLI and its Ansible collection. Many shops also keep Terraform for the cluster itself. That is exactly the code the Ansible and Terraform skills and the KICS IaC scanner were built for.
Useful first tasks, all in a non-production branch:
- Run the IaC scan across the repository that holds your MAS install playbooks and cluster Terraform. Triage only High and Critical findings in the first pass.
- Ask
/ansible-automationto review one role you maintain yourself, not IBM's collection, and compare its findings with your own review. - Use the Terraform skill's plan-mode tests with mock providers, which IBM says need no cloud credentials. That keeps real cluster credentials out of the agent's reach.
- Do not use "plan and deploy" against a live cluster during a pilot. IBM says there is human approval at every destructive step. Your change process should still own that decision.
🖥️ The Z and i Packages, Briefly
Most Maximo shops can skip this section. Read it if Maximo exchanges data with a mainframe or an IBM i system, which is common in utilities, transport, and manufacturing: purchasing, inventory, general ledger, and HR feeds through the Maximo Integration Framework.
| Package | What IBM lists [IBM] | Why a Maximo team might care [TMG] |
|---|---|---|
| Z | Workflows for a data dictionary (DD.json), program and application docs, refactoring COBOL and PL/I, generating service programs, explaining code, extracting business rules, optimizing COBOL, planning transformation to Java, and validating transformed code. Covers COBOL, PL/I, JCL, REXX, HLASM, CICS, IMS, MQ, and Db2 | Document the mainframe side of a Maximo financial or HR interface, so the integration team understands the field mappings at both ends |
| i | RPG Modernization, Business Rules Extraction, RPGUnit Test Plan, RPGUnit Test Suite, SQL Index Strategy Advisor, plus "Understand" and the /Review_SQL and /Review_RPG commands | Understand what an IBM i purchasing or inventory program does before you change the Maximo side of the interface |
The notable item is Understand, described in IBM's 6 October 2026 Bob blog post "IBM Bob Premium Package for i: three months of shipping, and why Understand matters" (by Peter Ma and Tim Rowe). It is an application knowledge base: one scan stores dependency metadata in a Db2 schema and then reports blast radius and a Low, Medium, or High modernization effort. The same post says Business Rules Extraction now covers RPG II and RPG III, and that the i package is "now available with IBM Bob on-premises" [IBM].
For a Maximo integration team, blast radius is the useful idea. Before you change an outbound purchase order interface, knowing which RPG programs read that feed is worth more than any code generation.
🔀 How the Model Router Works
On 4 November 2026 the IBM Bob Team published "How the Bob model router works" [IBM, bob.ibm.com/blog/how-the-model-router-works]. We re-read it on 10 November. It is the most detailed explanation IBM has given of how SaaS Bob chooses a model, and it partly answers a question that Part 2 left open.
Three tiers
| Tier | IBM's description | Cost effect |
|---|---|---|
| Fast | "Routine, well-scoped work where speed and cost matter most" | Fewer Bobcoins |
| Premium | "Everyday engineering tasks that need stronger reasoning" | More |
| Ultra | "The hardest problems that need the most capable models" | Most |
IBM says: "The tier decides how many Bobcoins a task costs." That is the first public statement we have seen that ties Bobcoin cost directly to a routing decision.
Routing happens once, on the first request
The post describes two steps:
- Classify. "Your first request goes to a set of custom classification models." These are trained on data from IBM's internal Bob usage.
- Route. A routing engine picks the model with the best quality for its cost, using a routing table.
Then the key sentence: "Tasks typically stay on the assigned model on purpose to keep its prompt cache. Missing the cache has both performance and cost implications" [IBM].
How a model gets into the routing table
| Stage | What IBM describes |
|---|---|
| 1. Offline evaluation | Public suites such as SWE-bench and Terminal-Bench ("over 40 benchmarks are run"), plus BobBench, IBM's proprietary suites, organized by technology stack, use case, core feature (such as subagents and search), and premium package (Z, i, Java, DevOps) |
| 2. Harness engineering | System prompts and the agent harness are tuned for each model, with the model providers |
| 3. Online A/B testing | Randomized tests on internal users; IBM cites "170,000 IBMers and millions of tasks every month"; trajectories and cache hits are measured, not only task success |
| 4. Router config rollout | Configuration tested internally, then rolled out externally |
| 5. Human decisions | AI ethics committee review and IBM legal review, including "establishing indemnity," before a model enters the harness. IBM says this "can cause delays in adopting the latest model" |
The claims, and what the post leaves out
- "As of today Bob is used by over 170,000 IBMers" [IBM]. Part 5 tracked IBM's adoption figures at 100,000+ in June 2026. This is the newest number. It is IBM-reported.
- "Bob evaluates over 150 frontier open-weight models" [IBM]. Note the verb: evaluates, not routes to. And note open-weight. IBM's FAQ, quoted in Part 2, names Anthropic Claude among the model families used on SaaS. Claude is not an open-weight model. The router post does not explain how that fits, and it does not say whether proprietary models are in the routing table.
- The post names no vendors and no models. No Claude, no Mistral, no Granite. No routing table is published, and there is no change log for routing table updates.
- The post does not say whether you can see which tier or model handled a task.
- The post does not mention Maximo.
What this means for repeatability and for your pilot
Part 5's pilot measures Bobcoins per accepted task and treats "which model answered" as an open question. The router post changes the design in three ways [TMG]:
| Router fact | Effect on a Maximo pilot | What to change in the ledger |
|---|---|---|
| Tier is chosen on the first request | How you phrase the opening prompt can set the tier, and therefore the cost and the model, for the whole task | Standardize the first prompt for each task family; store a hash of it |
| Task stays on its model | A follow-up that turns a small task into a large one may run on a Fast-tier model | Start a new task when scope changes, and log it as a new row |
| Routing table changes after A/B tests and rollouts | Two identical tasks a month apart may run on different models | Record dates; re-run a small control set every two weeks |
| Tier decides coins | Coin variance across similar tasks may be tier variance, not waste | Record the tier if Bob shows it; ask IBM if it does not |
Here are the columns we would add to the Part 5 ledger. They cost nothing to record and they make the numbers explainable later.
# Additions to the Part 5 ledger (ledger.csv)
first_prompt_sha256, # hash of the exact opening prompt, to prove prompts were standardized
tier_observed, # Fast | Premium | Ultra | unknown (if Bob does not show it)
task_split, # yes if scope changed and a new task was started
control_task, # yes for the fixed control tasks re-run every two weeks
bob_version # IDE or Shell version, e.g. 2.3.0 / 2.0.9A simple way to produce the hash on any developer machine:
# Save the opening prompt exactly as sent, then hash it for the ledger.
printf '%s' "$(cat prompts/A-convert-validation-class.txt)" | sha256sum | cut -c1-16The control set is the important part. Pick three tasks you know well, one per task family, and run them every two weeks with the same opening prompt. If coins or review results jump without any change on your side, the router probably changed. That is a finding worth writing down, not noise to average away.
What this means for regulated estates
For a regulated Maximo estate (utilities, nuclear, defense, public sector), the router post has one reassuring point and one worrying one [TMG].
Reassuring: there is a documented human gate, AI ethics and legal review including indemnity, before a model goes into production. That is more process than many AI tools describe.
Worrying: you are not told when the routing table changes, which models are in it, or which model answered your prompt. If your risk review needs to name the model that processed your code, SaaS Bob still cannot give you that. The alternative remains self-hosted Bob, which Part 2 showed runs one core model that you choose, with static routing at GA. That trade is unchanged by this post.
💡 Key insight: The router post explains how models are chosen. It does not tell you which model was chosen. For a pilot, the first is enough if you log carefully. For some risk reviews, only the second will do.
🧩 Other IDE 2.3.0 Changes Worth Knowing
Bob IDE 2.3.0 shipped in October 2026. The changelog has no November entries as of 10 November [IBM, bob.ibm.com/docs/ide/changelog]. These four features are the ones a Maximo lead should know about.
| Feature (changelog title) | What it does [IBM] | Maximo consideration [TMG] |
|---|---|---|
| "Web search (experimental)" | Adds a web_search tool | Bob can now pull in forum posts and blogs about Maximo. Some are wrong or out of date. Require a source link for any web-derived claim in review. We found no policy that disables it; ask IBM |
| "Centralized OpenTelemetry configuration policy" | New OtelConfiguration and EnableTelemetry policies; external OTEL allowlists and bob.operation.input/output spans | A route to your own agent-action log, which helps the audit gap Part 3 described. Check what the input and output spans contain before sending them anywhere: they may hold code and prompts |
| "Track office_edit changes with auto-backup and restore" | Edits made through office_edit are backed up and can be restored | Maximo teams live in Word specs and Excel data-load sheets. Backup is good. Keep the originals in version control anyway |
| "Attach external files and images to chat" | Attach files from outside the workspace | Handy for MAS pod logs and screenshots. Risky for anything with credentials; logs often contain them. .bobignore protects the workspace, not a file you attach yourself |
Other 2.3.0 items are covered in earlier parts: PermissionRequest and PermissionResolved hook events and MCP configuration inside plugins in Part 7, workspace profile overrides and plugins in Part 6, and the Bob Shell 2.0.6 to 2.0.9 builds, including npm distribution as @ibm/bob, in Part 8. The 2.3.0 fixes also include CVE patches, and "Cost cap cleared when maxCost set to 0," which matters if you set cost caps in pilots.
🎤 TechXchange 2026 and the Anthropic News: What Was Not Said
We are stating this plainly because second-hand summaries tend to fill gaps.
| Claim you may hear | What IBM's pages say (read 10 Nov 2026) |
|---|---|
| "IBM announced Bob for Maximo at TechXchange" | The TechXchange 2026 newsroom hub has one Bob item, the DevSecOps announcement. None of the 26 to 28 October items on the hub mentions Maximo |
| "Bob now uses Claude Mythos" | The 9 November 2026 announcement "IBM plans to bring Anthropic's Claude Mythos cyber reasoning into IBM Concert" is about IBM Concert (Concert Protect: "Scan. Prove. Fix."), with GA "planned for early 2027." It does not mention Bob |
| "IBM and Anthropic announced something new for Bob" | We found no Bob-specific Anthropic news after September 2026. The router post names no vendors |
| "IBM's Maximo team saved 69% with Bob" (repeated in a new release) | The 1 October self-hosting release has no 69% figure. A search-engine summary repeated it; we did not find it on any IBM page in this window. Part 4 and Part 5 cover what the original sentence does and does not say |
The Mythos announcement does describe IBM's relationship with Anthropic, including Project Glasswing, which it says "focused on internal security research and evaluation." That is context, not a Bob feature. If someone on your steering committee links Mythos to your Bob pilot, ask them for the IBM page.
🔧 The Maximo-Relevant IBM Assets That Did Change
These are small. They are also the only IBM-published changes in the window that touch Maximo and Bob together. We checked each through the GitHub API on 10 November 2026 [GH].
| Asset | What changed | Date | What it means [TMG] |
|---|---|---|---|
| maximo-script-optimizer skill, ibm-self-serve-assets/building-blocks, path ibm-bob/skills/maximo-code-optimization | Commit 8ab8576, message "[Updated] to alight with the new data changes." In the skill folder it changed link targets in knowledge/INDEX.md and the "Related" lines in core/performance-optimization.md and core/security-best-practices.md. SKILL.md itself is unchanged since 12 June 2026 and still says version 1.0.0 | 21 Oct 2026 | Housekeeping, not new capability. The commit touched over 300 files across the repository. If you pinned the June commit as Part 4 advised, you lose nothing by staying on it |
| IBM/dsce-sample-apps issue #270 | Demo submission "AI-Powered Maximo Automation Script Optimization with IBM Bob," using the "Maximo-script-optimizer" skill; industry tagged Manufacturing; now closed | 13 Oct 2026 | An IBM demo of the same skill. It says "Developers remain responsible for reviewing, validating, and testing optimized scripts." No metrics |
| ibm-mas/cli, .bob folder | IBM's MAS CLI team keeps Bob config in-repo: .bob/custom_modes.yaml (a code-python mode, last changed June), .bob/rules/ (general guidelines, a Python guide, Tekton rules), .bob/skills/ (test-driven development skills), and .bob/plans/. Three new plan files arrived with the 2 Nov commit adding install-cpi and configure-mcpi; a plan was edited on 5 Nov | Nov 2026 | The best public example of an IBM Maximo-adjacent team using Bob's config formats. A model for the house-rules layout in Part 6 |
| ibm-mas/maf-local-dev-mode | 4 Nov: setup video added. 6 Nov: PR #18 "remove-support-term" changed "Supported versions: MAS 9.1.21+ and MAS 9.2.1+" to "Compatible versions" in the README and issue templates. Latest release is still v0.0.1-beta.6 (22 Sep) | 4–6 Nov 2026 | The version range is unchanged. The wording change suggests IBM does not want this read as a formal support statement. Treat it as a beta developer tool, as Part 4 did |
Nothing else turned up. No new Maximo skill, no update to maximo_java_conversion, and no IBM write-up of Bob calling the MAS 9.2 Maximo MCP server end to end.
🧭 Worked Scenarios
These are planning scenarios built from the facts above. They are not results from a customer engagement.
Scenario 1: A utility with 60 custom Java classes, moving to Manage 9.2
The upgrade team has a target of the current 9.2 feature release, so Java 25 applies. The inventory script above shows 41 classes at major version 52 (Java 8) and 19 at 55 (Java 11), plus 7 third-party JARs.
| Step | Owner | Tool |
|---|---|---|
| 1. Retire classes no one can justify | Functional lead | A meeting, not an agent |
| 2. Sort the rest with the upgrade-or-convert table | Tech lead | This part |
| 3. Convert the small validation and defaulting classes | Developer | maximo_java_conversion skill (free), plus review |
| 4. Create a Maven build for what is left | Developer | By hand, with Bob's help on the pom.xml |
| 5. Run the Java upgrade workflow on a copy | Developer | Java Modernization package (free first month to 31 Dec 2026) |
| 6. Run OSV remediation on the JARs | Developer | Java Vulnerability Remediation workflow |
| 7. Regression test in a 9.2 non-production environment | Test lead | Your test pack; IBM's flash says test customizations, reports, scripts, and web services |
Count each class as a ledger row, using Part 5's metrics. The question is not "did Bob upgrade it" but "how many review hours did each accepted class cost, and did any defect escape."
Scenario 2: The security team wants the DevSecOps package on the MAS install repo
The repository holds Ansible playbooks, Terraform for the cluster, and some shell scripts. A secrets scan finds an IBM entitlement key in a three-year-old script, and the IaC scan raises 140 findings.
What to do: rotate the key first, because it is in Git history even after you delete the file. Then triage the IaC findings by severity and by whether the resource is actually deployed. Run the AI attack-surface scan once, and record its Bobcoin cost, since IBM says larger projects consume more. Do not enable the PR review in CI until IBM publishes its GA documentation and your GitHub Actions secrets handling follows Part 8.
Scenario 3: The pilot that changed halfway through
In week four of a Part 5 pilot, coins per accepted task for Family B (script review) drop by a third, and two reviewers say the output got "chattier." Nothing changed on your side.
With the router columns in the ledger, you can check. The control task for Family B shows the same drop on the same date, and the opening prompt hash is unchanged. The likeliest explanation is a routing change. Record it, split the analysis at that date, and ask IBM in writing whether a routing table rollout happened. Without the control task, you would have credited your team with an improvement they did not make.
⚠️ Pitfalls and Troubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
| Someone asks you to "buy the Maximo package" | There is none | Point to the premium packages overview page |
| Java upgrade workflow will not start on Maximo code | No Maven or Gradle build | Create a build with the Maximo JARs as provided dependencies |
| Converted script behaves differently from the Java | Different launch point or event timing | Match the launch point to where the Java ran; test status and save paths |
| Classes compile but fail at runtime on Java 25 | Reflection or removed APIs; old JARs (IBM names ant.jar) | Upgrade the JAR; remove reflective access; test in a 9.2 environment |
| A runbook command does not exist | Docs and README disagree on command names | Use the installed extension's own command list |
| Secrets scan finds nothing in automation scripts | Scripts live in the database | Export scripts to Git, then scan |
| Lots of Opengrep noise on old scripts | Jython 2.7 syntax under Python rules (unconfirmed) | Measure false positives before reporting a count |
| PR review cannot be set up | GA docs not published as of 10 Nov | Wait; do not wire a half-documented action into CI |
| Coins per task swing without cause | Tier chosen on first request; router changes | Standardize first prompts; run control tasks |
| Bob quotes a forum post as fact | web_search is on | Require source links in review; ask IBM about a policy to disable it |
| Attached log leaked a password into a prompt | External file attach bypasses .bobignore | Redact logs before attaching; add it to house rules |
| A slide says "Bob uses Claude Mythos" | Confusion with the IBM Concert announcement | Show the 9 Nov page; it does not mention Bob |
📋 Scorecard: As of 10 Nov 2026
One table to take into a steering meeting. Every row has a date because these move.
| Area | Status (as of 10 Nov 2026) | Evidence | Maximo readiness [TMG] |
|---|---|---|---|
| Maximo premium package | None | Premium packages overview [IBM] | n/a |
| Java Modernization package | GA; Java 8/11 to 17/21/25; Maven/Gradle; free first month to 31 Dec 2026 | Docs; product page [IBM] | Worth a trial on a copy with a real build |
| Manage Java level | Java 25 only, from the April 2026 feature release of 9.2 | Support flash 7270573 [IBM] | Forces a decision per custom class |
| Maximo Java-to-script skill | Free on GitHub; unchanged in this window | [GH] | Usable with review |
| Maximo script-optimizer skill | Free; knowledge-file link cleanup 21 Oct; SKILL.md v1.0.0 unchanged | [GH] | Usable with review |
| DevSecOps package | Announced 27 Oct; scanners, SafeWrite, AI scans, Ansible/Terraform skills shipped | Announcement; docs [IBM] | Good fit for secrets and MAS IaC |
| DevSecOps PR review | "Available in November"; GitHub first; no GA docs found | Announcement [IBM] | Wait |
| DevSecOps pricing | Not published in the announcement | [IBM] | Ask for a quote |
| Z and i packages | GA; i adds Understand (6 Oct), runs on-premises | Bob blog [IBM] | Only for integration partners' code |
| Model router | Three tiers, first-request routing, BobBench; no vendors named | Bob blog, 4 Nov [IBM] | Log it in every pilot |
| Model disclosure on SaaS | Still none | Router post; FAQ [IBM] | Blocking for some risk reviews |
| IDE | 2.3.0 (October); no November entries | Changelog [IBM] | Pin a version |
| Bob Shell | 2.0.9 (October); npm @ibm/bob with auto-update | Changelog [IBM] | Pin a version in CI |
| TechXchange Maximo content | None found | Newsroom hub [IBM] | n/a |
| Anthropic news for Bob | None found; Mythos is a Concert item, GA early 2027 | 9 Nov announcement [IBM] | n/a |
| Bob plus MAS 9.2 MCP, end to end | Not demonstrated publicly | No IBM write-up found | Supported in principle only |
| Maximo 69% claim | Not repeated in this window's releases; still no method | [IBM] | Do not cite for planning |
✅ The Open Questions Checklist, Refreshed
Part 5 ended with sixteen open questions. Here is what moved by 10 November 2026, followed by the questions this window added. Keep using Part 5's status column: Open, Asked, Answered, Accepted risk.
Part 5's items, re-checked
| # (Part 5) | Question | Change since 6 Oct 2026 | Status |
|---|---|---|---|
| 1 | Self-hosted audit logging | No new IBM statement in the sources we read | Open |
| 2 | SaaS audit scope (prompts, tool calls, edits to SIEM) | OTEL policy and bob.operation spans in 2.3.0 give a do-it-yourself route; SIEM scope unchanged | Partly addressed |
| 3 | SaaS model versions and routing policy | Router post explains tiers and the process; still no model names, no routing table, no per-task disclosure | Partly addressed |
| 4 | Bobcoin economics | "The tier decides how many Bobcoins a task costs"; tokens per coin still unpublished | Partly addressed |
| 5 | Group policies on Bob Shell | Policies page still says IDE only; Shell changelog lists EnforcedHooks | Open, with a conflict |
| 6 | SOC 2, FedRAMP, ISO 42001 | Nothing new found | Open |
| 7 | Guardrail mechanisms | SafeWrite is a documented, concrete guardrail (DevSecOps only); the general guardrails are still undocumented | Partly addressed |
| 8 | Maximo 69% methodology | Not repeated; no method | Open |
| 9 | Customer metric consistency | Product page still shows a "~3 days" Java uplift story | Open |
| 10 | Self-hosted GPU sizing | Nothing new found | Open |
| 11 | Self-hosted model list | Not re-checked this round | Open |
| 12 | WCA end-of-support date | Nothing new found | Open |
| 13 | Self-hosted GA date | Unchanged | Use Part 5's wording |
| 14 | Bob 1.0 versus GA | Unchanged | Use Part 5's wording |
| 15 | Rollback and git | Not re-checked this round | Open |
| 16 | Bob plus MAS 9.2 MCP end to end | Still no public demonstration | Open |
New questions from this window
| # | New question | Why it matters for Maximo | Ask |
|---|---|---|---|
| N1 | Can a user or admin see which tier and model handled each task? | Pilot measurement and risk reviews | IBM technical sales |
| N2 | Is there notice or a change log when the routing table changes? | Repeatability across a multi-month upgrade | IBM |
| N3 | Are proprietary models (such as Claude) in the routing table, given "150+ open-weight models"? | Data handling and indemnity review | IBM |
| N4 | When is the DevSecOps PR review GA, and where are its docs? | CI design in Part 8 | IBM |
| N5 | Which command names are correct for the DevSecOps package? | Runbooks and house rules | IBM, or the installed extension |
| N6 | What does the DevSecOps package cost? | Budget | IBM sales |
| N7 | Does the Java upgrade workflow work on Maximo customization projects, and does IBM have guidance for provided Maximo JARs? | The main Maximo use of the package | IBM |
| N8 | Do Opengrep's Bob rules handle Jython 2.7 automation scripts? | False-positive rate | IBM, or measure it |
| N9 | Can web_search be disabled by group policy? | Control over unvetted sources | IBM |
| N10 | Where is the schema for PermissionRequest and PermissionResolved hooks? | Policy enforcement in Part 7 | IBM |
| N11 | Does Bob Shell support the MCP 2026-07-28 specification yet? | MCP connections from CI | IBM |
| N12 | What is the support status of MAF Local Dev Mode, given "Supported" became "Compatible"? | Whether to rely on it in delivery | IBM MAS team |
💡 Key insight: The list got longer, not shorter. That is normal for a product that ships every few weeks. The point of the checklist is not to reach zero. It is to know which unknowns you have accepted and who signed for them.
🗺️ Where the Series Leaves You
Ten parts, one thread: understand the tool, control it, connect it to Maximo carefully, and measure it yourself.
| Part | Question answered | Takeaway |
|---|---|---|
| 0: Series Index | Where do I start? | The map |
| 1: What IBM Bob Is | What is it? | IDE, Shell, agent, and modes, from Project Bob to self-hosted |
| 2: Models, Security, Self-Hosted | What does it run on? | SaaS auto-routes; self-hosted runs one model you choose |
| 3: Governance, Pricing, Bobcoins | How do we control and pay for it? | Lock auto-approve; treat audit as incomplete |
| 4: Bob Meets Maximo | What can it do against Maximo? | Four doors, opened in order; two free IBM skills |
| 5: Pilot Playbook | How do we decide? | Measure accepted work, review hours, and defect escapes |
| 6: Maximo House Rules | How do we teach it our standards? | Rules, modes, and skills in the repo |
| 7: Hooks and MCP Guardrails | How do we stop it doing the wrong thing? | Hooks and MCP limits as enforcement |
| 8: Bob Shell in CI | Can it run unattended? | API keys, flags, and limits for CI |
| 9: What Shipped Since Self-Hosted GA | What changed, and does it matter for Maximo? | No Maximo package; Java 25 makes the Java package relevant; log the router |
What to do this month
- Inventory your custom Java with the script above and sort it with the upgrade-or-convert table.
- Decide on the Java Modernization trial before 31 December 2026 if you want the free month, and have a Maven build ready first.
- Run a secrets scan on every repository that holds Maximo configuration, scripts, or install code, with or without Bob.
- Add the router columns to your pilot ledger and pick your control tasks.
- Send the new questions N1 to N12 to IBM in writing, along with Part 5's blocking items.
🔎 Open Items and Discrepancies
- Java level. IBM's support flash says Manage 9.2 from the April 2026 feature release is Java 25 only. An earlier TMG Java Extensions post said Java 17 stays the Manage baseline in 9.2. The flash is the authority.
- DevSecOps command names. The docs and the
IBM/bob-devsecopsREADME disagree on the supply chain fix command and the Terraform skill name. - "Updated 21 Oct" on the optimizer skill. Summaries describe this as an update to the skill. On GitHub it is a repository-wide cleanup; inside the skill it changed only links in knowledge files, and
SKILL.mdis unchanged since 12 June 2026. - "150+ frontier open-weight models" versus the FAQ's naming of Claude among SaaS model families. The router post does not reconcile the two.
- PR review "available in November." As of 10 November, no GA docs page was found, although
bob-prreview-remoteships in the 2.3.0 bundle. - Group policies and Bob Shell. The policies page says IDE only; the Shell changelog lists
EnforcedHooks. - MCP 2026-07-28 support. The 1 October blog says the client supports it; the Shell MCP page says the version is not yet supported.
References
- How the Bob model router works, 4 Nov 2026 (Bob blog)
- Securing AI-assisted software delivery with IBM Bob Premium Package for DevSecOps, 27 Oct 2026 (IBM)
- IBM plans to bring Anthropic's Claude Mythos cyber reasoning into IBM Concert, 9 Nov 2026 (IBM)
- IBM TechXchange 2026 newsroom hub (IBM Newsroom)
- IBM Bob Premium Package for i: three months of shipping, and why Understand matters, 6 Oct 2026 (Bob blog)
- Run Bob on your own infrastructure, 1 Oct 2026 (Bob blog)
- Premium packages overview (Bob docs)
- IBM Bob Premium Package for Java Modernization (Bob docs)
- Java Modernization workflows (Bob docs)
- IBM Bob Premium Package for DevSecOps (Bob docs)
- DevSecOps workflows and skills (Bob docs)
- Bob IDE changelog (Bob docs)
- Bob Shell changelog (Bob docs)
- IBM Bob product page (IBM)
- IBM Maximo Manage: Transition to Java 25 from Maximo Application Suite 9.2 support announcement (IBM Support)
- IBM/bob-devsecops (GitHub)
- maximo-code-optimization skill, ibm-self-serve-assets/building-blocks (GitHub)
- IBM/dsce-sample-apps issue #270 (GitHub)
- ibm-mas/cli (GitHub)
- ibm-mas/maf-local-dev-mode (GitHub)
Continue the Series
This is the last part. Here is every earlier part, in order:
- Part 0, Series Index
- Part 1, What IBM Bob Is
- Part 2, Models, Security, and Self-Hosted on OpenShift
- Part 3, Governance, Pricing, and Bobcoins
- Part 4, Bob Meets Maximo
- Part 5, Piloting Bob on Maximo
- Part 6, Maximo House Rules for Bob
- Part 7, Hooks and MCP Guardrails
- Part 8, Bob Shell in CI
About TheMaximoGuys: We help Maximo developers and teams navigate the move to MAS 9 with practical, no-hype guidance grounded in how the platform actually behaves.
Published by TheMaximoGuys | November 2026
Manasa Ganga
Surendra Katta
Venkat Achanta