[claude-yolo]

Night shift report

WHY THIS MATTERS: No Claude Code release tonight (still v2.1.309), and no changes to the CHANGELOG, tombstones, or discovery. Two security and compliance changes on platform.claude.com matter to enterprise admins. First, the customer-managed encryption key (CMEK) docs were rewritten and split into 8 new pages. One of them changes a rule that admins may already rely on: the old page said CMEK "is allowed with ZDR for both Claude Platform and Claude Enterprise". The new page says that on Claude Platform, CMEK and ZDR can't share a workspace. Second, the Access Transparency Log now defines leaf version 0x02. Anyone running axt-verify on a schedule has to upgrade to v0.2.0 or new events will fail verification. Almost all of the other ~175 modified files are an editorial pass with no content change.

HIGHLIGHTS:

• CMEK and ZDR rule changed (manage-claude/cmek-data-retention.md, new page). On Claude Platform you can attach a key only to a workspace with Standard (30-day) retention. After a key is attached, that workspace can't go back to ZDR; you'd need a new workspace. A ZDR org can still use CMEK by switching one non-default workspace to Standard retention. On Claude Enterprise, CMEK and ZDR can still be used together, but artifacts can't be turned on. The page also lists the three narrow cases where Anthropic may keep records outside your key (legal holds such as NCMEC reports, risk of serious harm, and Commercial Terms D.4 violations), each logged in the Activity Feed.
• CMEK docs reorganized: cmek.md is now a short landing page with cards linking out. 8 new pages: cmek-how-it-works, cmek-key-lifecycle (what rotating, disabling, or deleting your key does), cmek-coverage-claude-platform, cmek-coverage-claude-enterprise, cmek-data-retention, cmek-admin-api, cmek-aws-kms-workspaces (limit an AWS KMS key to named workspaces), and cmek-troubleshooting. The three setup pages (AWS KMS, Google Cloud KMS, Azure Key Vault) each lost about 500 lines to these pages. The Admin API endpoints (/v1/organizations/external_keys, /validate) were moved between pages, not newly added.
• Access Transparency Log leaf version 0x02: same 11 required fields plus one optional field, user_profile_id, which ties in with the recent user profiles launch. Only axt-verify v0.2.0 and later rebuild 0x02 leaves, and your log can start writing them at any time. There's a new "Upgrade for a new leaf version" section and new test-vector hashes. If every new event suddenly fails verification, check for an outdated release first.
• Managed Agents budgets: the rule that budgeted sessions are rejected with a 400 error is now a list of cases: the session's agent, a subagent or workflow agent, or the advisor uses a model with no public list price. Same rule, clearer wording.
• Editorial pass on the platform docs (most of the diff): run-on sentences broken into bullet lists, output fences relabeled from text to json, sample user IDs replaced, code comments and _ = agent lines removed from Managed Agents samples, "public beta" changed to "beta", "per" changed to "for each", and "USD" added to prices in the release notes. No new release-note entries.
• About 55 support articles had small wording changes.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning