Shadow MCP approvals now bound distribution, trusted issuer links for enterprise authorization, and a fail-open fix in realtime enforcement

A Shadow MCP approval granted for one audience can no longer be used to distribute the same direct-remote MCP server to a wider one. Every path that expands an audience, from plugin assignment and attachment to remote URL edits, backend changes, publication retries, and re-enabling, re-checks the current approval, while narrowing, removal, and disabling stay open. Organization admins can also link a user session issuer to a trusted remote session issuer through the API, giving enterprise-managed authorization an explicit trust anchor instead of a database edit. This release also fixes realtime risk enforcement failing open when an operation id was not a UUID.

Features

• Shadow MCP approvals enforced across distribution #6197 - Distribution and publication retry through Platform MCP, assignment expansion in the dashboard and Platform MCP, plugin attachment, remote URL edits, MCP backend changes, first-endpoint auto-attachment, and re-enable all require an approval that covers the whole target audience. Enforcement rolls out through legacy, report, and enforce modes with a direct-remote distribution kill switch, and an invalid or unavailable rollout state fails closed for expanding writes. (Author: @TristanSpeakEasy)
• Distribution admission reported from Platform MCP #6240 - Reading a plugin or a Shadow MCP review now includes a distribution_admission projection with the rollout mode, whether coverage is complete, and bounded counts of missing audiences, so an agent can tell whether an existing plugin is covered and what repair is needed before it acts. A reviewed Shadow MCP workflow skill keeps approval, registration, assignment, distribution, and browser authorization as separate confirmed steps. (Author: @TristanSpeakEasy)
• Link user session issuers to trusted remote session issuers #6336 - Organization admins can set trusted_remote_session_issuer_id on a user session issuer to point it at an active organization-level or global trusted issuer. Deleting, moving, or migrating an issuer fails safely while active trust links reference it, with the references listed in the preflight, and metadata refreshes persist and revalidate the trusted issuer's public JWK Set atomically. (Author: @bflad)
• Documentation, policy, and terms links on the consent card #6232 - The RFC 9728 protected-resource display metadata a remote MCP server publishes, its resource name, documentation, policy, and terms of service, is stored on the issuer a direct-remote Platform MCP attachment creates, re-probed when the server is updated, exposed on remoteMcp.discoverProtectedResourceMetadata, and linked from the consent card. (Author: @daviddanialy)
• Private network access for hosted MCP servers #6236 - An admin-only Network Access page configures Tailscale private ingress and chooses how each hosted MCP server is exposed. Behind the gram-network-ingress-rollout flag and dormant until the supporting infrastructure rolls out, so the custom-domain page is unchanged for everyone else. (Author: @TristanSpeakEasy)

Bug fixes

• Realtime risk enforcement no longer fails open on opaque operation ids #6384 - Enforcement dispatched over pub/sub accepts operation ids that are not UUIDs instead of letting the operation through unchecked. (Author: @vishalg0wda)
• Directory syncs defer to the running replacement #6398 - An identity map sync that loses the single-writer lock now steps aside for the sync that holds it instead of failing and retrying. (Author: @vishalg0wda)