[claude-yolo]

Night shift report

WHY THIS MATTERS: Enterprise security teams get a new Compliance API surface: seven new pages document Security posture (the claude.ai Security Center), covering its controls, attestations and results, sending its events to a SIEM, OCSF mapping, and change detection. Claude Code also changed in ways users will notice. Fast mode now runs on Google Cloud's Agent Platform (Vertex), and cloud environments' network access levels were reworked, with Trusted and Custom merged into Limited. The claude_code.safety_event OTel event has also been quietly dropped, which matters to anyone alerting on it. Two support articles went into tombstones. The Claude Code version is unchanged at 2.1.322.

HIGHLIGHTS:

• New: Compliance API Security posture (content/en/manage-claude/compliance-security-posture/, 7 pages). The API reads automatic, manual and information-only controls, attestations (completed / accepted_risk / control_failed) and current results; it cannot create attestations. The Activity Feed now carries Security posture events, and the org endpoints return posture results.
• Fast mode on Agent Platform (Vertex) for Fable 5.2, requires v2.1.322+. The region must be global, us or eu (VERTEX_REGION_CLAUDE_FABLE_5_2). On Vertex, /fast is not saved as the default and "fastMode": true in settings does nothing; -p runs need --settings '{"fastMode": true}'. If Vertex refuses it, Claude Code falls back to standard speed and backs off for 30 minutes after a 403/404.
• Cloud environment network access reworked. There are now three levels instead of four. Trusted and Custom are folded into Limited, with an Allow package managers checkbox. Saved environments migrate without losing reach: Custom with a bare * opens as Full.
• claude_code.safety_event is gone. v2.1.312+ never sends it; v2.1.307–311 stops at the next feature-flag refresh, though Bedrock/Vertex/Foundry sessions can keep sending it. The docs now point to tool_decision, which doesn't always say which check refused a call.
• New env var CLAUDE_CODE_DISABLE_FEATURE_FLAGS (v2.1.319+) replaces DISABLE_GROWTHBOOK, which still works.
• Advisor is now available on Claude Platform on AWS (v2.1.300+), per feature-availability.
• New errors.md entries: login refresh failing on a full disk or exhausted quota/inodes, "The search failed, so this is not a 'no matches' result" (ripgrep failure), and forked Remote Control sessions that fail to start. The ~/.claude.json corruption guide now covers .claude.json.corrupted.<timestamp> files.
• Claude Desktop v5.1231.0 changelog: scheduled tasks now show run status. MCP servers added in Desktop now follow Claude Code managed-settings allow/deny lists. Windows data moves to %LOCALAPPDATA%\Claude-Data. 3P gets organizationAnnouncement, inferenceModels IDs now match exactly (claude-opus-5 no longer allows claude-opus-5-5), and desktopHome's Unified Claude switch-on is pushed back to Dec 17, 2026. There is also a new 3P page, scheduled-tasks.md.
• Government: new admin-api-keys.md and analytics-api.md pages. A read-only Analytics API (token usage and cost by member, model and product) is off by default and needs a key created by the Primary Owner.
• Tombstones (2 new): the support article "Get started with Claude dashboards" redirected to "...get-started-with-claude-data", which looks like a product rename to Claude Data. "Redeem the Mac mini and Claude Team offer through CDW" returns 404, so the promotion looks over.
• discovery.json: only the date changed; no new sources or repos.
• Noise: whats-new index links lost their .md suffix, and there were small edits to support, MCP community and GitHub mirror pages.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning