Approvals survive new policies, moved sessions stay linked, and suppressed findings get one list

An MCP server approved before any blocking policy existed used to end up blocked anyway when a policy arrived later. Creating a blocking policy now replays the project's recorded decisions onto it, so an approval means what it said, and servers blocked only for some users read Restricted instead of Blocked. Sessions that move between agents now stay linked in both directions, suppressed Watchdog findings gather in one list with the provenance behind each, and the device agent gains a walkthrough for Claude Code on the web.

Features

• Standing approvals are honored when a blocking policy is created #5322 - Creating a blocking shadow MCP policy, or turning one blocking, now replays recorded approval decisions onto it in the same transaction: approvals get their bypass audience, denials get block rules, and a policy that cannot express a scoped approval refuses creation and names the servers instead of silently widening what was recorded. The inventory also distinguishes a server blocked for everyone from one blocked only for some, with a new Restricted state and reasons that name a denied review explicitly. (Author: @daviddanialy)
• Moved sessions stay linked #5459 - When a session moves between agents, a lineage edge now links the original to its continuation, and the Agent Sessions panel shows both directions with navigation between them. (Author: @simplesagar)
• Suppressed findings live on the Watchdog page #5528 - Every suppressed finding, whether by exclusion rule, manual dismissal, or automated sweep, now sits in one collapsible section with the provenance behind it, a restore action, and a link to the rule behind rule-based suppressions. The listings API covers rule exclusions it previously missed (#5521), and risk results carry converged suppression fields (#5513). (Author: @dennnis-ez)
• See what the research agent actually did #5452 - For organizations on the MCP approval rollout, a research run's review page now shows its per-action trace: every search and page fetch in order, with the outcome, the injection judge's verdict, and a bounded preview of the untrusted text it saw. Only previews are stored, and no new inference runs. (Author: @daviddanialy)
• The device agent reaches Claude Code on the web #5489 - A new walkthrough covers Anthropic-hosted Claude Code on the web, with a self-contained script and a SessionStart hook that revives the daemon each session. The platform tiles also stack their labels so all four fit a row (#5548). (Author: @subomi)
• Author and distribute skills over Platform MCP #5544 - OAuth-authenticated clients can list, read, create, and re-version skills in a project and distribute one to an exact plugin or assistant, with conflict-safe versioning so concurrent authors cannot silently overwrite each other. (Author: @adaam2)
• Pay-as-you-go bills reflect everything that ran #5515 - Invoices now bill platform-initiated inference alongside customer-facing spend. (Author: @danielkov)

Bug fixes

• Internal #5467 - Groundwork with no customer-visible surface: product-feature APIs gain explicit organization scoping and authorization (#5466, #5469, #5468, @walker-tx); demo organization sessions align enforced scopes with reported grants (#5535, @adaam2). (Author: @walker-tx)