server@1.3.0

Minor Changes

• 18bc769: Enforce allow-all shadow MCP policies in the hook path. Under an allow_all policy every non-Gram-hosted MCP server is permitted unless a risk_policy:block grant names its URL; bypass grants and the fail-closed inventory checks remain block_all concepts and are skipped. Projects are now limited to one enabled shadow MCP blocking policy so dispositions can never conflict at enforcement time.
• becc03b: Add shadow_mcp_blocked_urls to risk policy create/update payloads. Allow-all shadow MCP policies carry a canonical blocked-URL list stored as risk_policy:block RBAC grants held by the all-users principal — the mirror of shadow_mcp_allowed_urls, which reconciles into risk_policy:bypass grants on block-all policies. The two lists are disposition-exclusive: blocked URLs are only valid on allow_all policies and allowed URLs only on block_all policies. Blocked URLs may name servers not yet observed in the project inventory (proactive blocking).

Patch Changes

• 679d489: Let the project's managed assistant act on risk findings, not just read them.
  Adds platform_list_risk_exclusions and platform_create_risk_exclusion for
  suppressing a whole class of findings, plus
  platform_mark_risk_false_positive and
  platform_unmark_risk_false_positive for dismissing (and restoring)
  specific findings. The writes go through the same risk service methods the
  dashboard uses, so they stay gated on org admin and audited against the
  invoking user. Exact and regex match values are fingerprinted before they reach
  the model, so platform_create_risk_exclusion reuses an equivalent existing
  exclusion rather than duplicating one the model had no way to recognise.

  Also keeps the assistant's context from ballooning while it triages: the
  agent-facing findings listing now defaults to 25 results and caps at 50
  (a 200-row page was tens of thousands of tokens that stayed in context for the
  rest of the turn), and the new platform_get_risk_rule_breakdown answers
  "which rules fire most" in one small call instead of many large pages.

• 6ca548f: Add the chatgpt and chatgpt-work sources to the product-surface taxonomy now that ChatGPT/Work compliance usage is admitted to the summaries. The compliance importer now routes Work rows to the chatgpt-work hook source (ChatGPT and unknown surfaces stay chatgpt) so the per-product split survives summarization — hook_source is a summary GROUP BY dimension while the raw codex.compliance.product attribute is not, and summaries outlive the raw-row TTL. Also: a chatgpt chat source alias, ChatGPT/ChatGPT Work labels and the OpenAI mark in the dashboard label/icon maps and onboarding live-tail, broadened "OpenAI Compliance Logs" settings copy, and local seed fixtures emitting compliance-shaped chatgpt:usage:metrics rows for both products.

• f8ff561: Codex-product compliance COSTS rows (codex:usage:metrics) now meter cost only. Their token counts previously rode on gen_ai.usage.* keys, which the ClickHouse agent-usage predicates sum on top of the Codex OTEL stream — the token source of truth — double counting token metering for orgs running both feeds. The raw counts are preserved under new codex.compliance.*_tokens attributes (summed by nothing) because the compliance feed also covers surfaces OTEL never sees (cloud-delegated tasks, GitHub code review); a future surface-partitioned metering pass can promote them. Parked non-Codex rows (chatgpt:usage:metrics) keep their gen_ai.usage.* token counts since the compliance feed is ChatGPT/Work's only usage source.

• 62fce4c: Emit OpenTelemetry metrics for the device-integration sync pipeline: gram.device_integration.sync.outcome (sync runs by provider and outcome) and gram.device_integration.sync.auto_pause (schedules auto-paused after a streak of credential rejections). These back the sync-failure-rate and auto-pause monitors for the MDM integrations rollout.

• 11b3586: Fix OAuth token exchanges failing with invalid_client against providers that strictly decode HTTP Basic credentials (e.g. Snowflake): client id and secret are now form-urlencoded before being placed in the Authorization header, per RFC 6749 §2.3.1.

• d4d8de2: The project assistant can now create project skills from complete SKILL.md content. The new platform_create_skill tool uses the same validation, versioning, permissions, feature gating, and audit logging as manual skill creation.

• 9161dc7: Internal data changes to the risk findings backfill tooling.

• af439f5: Internal schema changes to the risk findings store.

• 1dbad64: Internal data changes to risk finding ingestion.

• ae3979c: Admit chatgpt:usage rows (ChatGPT/Work usage+spend from the OpenAI compliance COSTS import, previously retained but unread) into the agent-usage predicates of attribute_metrics_summaries_mv and chat_session_summaries_mv, via atomic MODIFY QUERY migrations. ChatGPT tokens now count toward tokens-under-management and appear in usage/cost analytics going forward, matching how Claude Chat (Anthropic Admin Analytics) and Cursor (Admin API) polled usage already bill. Applies to new rows only — previously parked rows are retained but not backfilled into the summaries. Also updates the stale MV comments that claimed no new codex:usage rows are written (the compliance import writes them, cost-only since the token double-count fix).

• 3e1ad9e: Exclude unattributed authz challenges from the challenge buckets endpoint so the Challenges page pagination and totals match what is rendered

• b131cea: Project assistant tool calls now render Claude-style: the assistant precedes each tool batch with a terse activity phrase ("Investigating failures in the last 30 days") which becomes the heading of a single collapsed tool group. Consecutive batches merge into one group whose heading advances (with shimmer) as the investigation progresses, groups never auto-expand, and the global thinking loader hides while a tool group is streaming. The dashboard output-channel guidance instructs the model to emit the phrase before every tool call.