[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Adds always-on SoA justifications, improves background checks with admin retry/cancel/delete and an hourly reconciliation, and adds Admin Finding Templates management. Implements CS‑424, CS‑416, CS‑475, and CS‑473.

• New Features

  • Background Checks: Admin endpoints and UI to retry (free), cancel, and delete; retries increment rerunCount and use per-attempt idempotency keys keyed to the record; ignore vendor webhooks after local cancel; hourly job polls for stale in‑flight checks and updates statuses and report snapshots.
  • SoA: Adds family‑based default inclusion justifications with a generic fallback; stores and shows justification for both YES and NO; allows editing for both states and keeps the dialog open on save failure.
  • Admin: Adds Finding Templates management under Admin → Finding Templates; list with search/filter/pagination, create/edit sheet, and delete dialog; uses use-admin-finding-templates over GET /v1/finding-template.

• Bug Fixes

  • SoA: Fixes missing justification on YES defaults and inconsistent display in table/mobile views.
  • People: Excludes auditor‑only members from background‑check requirements and hides the Background Check tab; members with auditor plus another role are still required.
  • Background Checks: Moves admin Retry/Cancel/Delete into the status card footer for clarity via a new actions slot.

^{Written for commit dcd4b4d. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Jun 2, 2026 9:41pm
comp-framework-editor (staging)	Ready	Preview, Comment	Jun 2, 2026 9:41pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal (staging)	Skipped		Jun 2, 2026 9:41pm

[linear]

CS-424

CS-416

[cubic-dev-ai]

2 issues found across 9 files

Confidence score: 3/5

• There is a concrete behavior risk in apps/api/src/soa/utils/soa-answer-parser.ts: forcing a default justification for YES answers conflicts with the SOA rule that allows empty justification, and could hide when the model returned no justification.
• A smaller UI/data-handling issue in apps/app/src/app/(app)/[orgId]/documents/statement-of-applicability/components/SOATableRow.tsx uses || instead of ??, so intentionally saved empty strings can be overwritten by defaults.
• Given the medium-severity backend rule mismatch (5/10, high confidence) plus a low-severity frontend fallback issue, this looks mergeable with caution but carries real regression risk.
• Pay close attention to apps/api/src/soa/utils/soa-answer-parser.ts and apps/app/src/app/(app)/[orgId]/documents/statement-of-applicability/components/SOATableRow.tsx - justification emptiness semantics may be unintentionally changed across parsing and display.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/soa/utils/soa-answer-parser.ts">

<violation number="1" location="apps/api/src/soa/utils/soa-answer-parser.ts:192">
P2: YES answers are now forced to store a default justification instead of allowing null/blank, which conflicts with the SOA rule to allow empty justification for applicable controls and can mask when the model provided no rationale.

(Based on your team's feedback about allowing blank justification for YES SOA answers.) [FEEDBACK_USED].</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/documents/statement-of-applicability/components/SOATableRow.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/documents/statement-of-applicability/components/SOATableRow.tsx:80">
P3: Using `||` instead of `??` causes empty-string justification values to be silently discarded, falling back to the column mapping default instead of preserving the user's explicitly saved empty value.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: YES answers are now forced to store a default justification instead of allowing null/blank, which conflicts with the SOA rule to allow empty justification for applicable controls and can mask when the model provided no rationale.

(Based on your team's feedback about allowing blank justification for YES SOA answers.) .

View Feedback

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/soa/utils/soa-answer-parser.ts, line 192:

<comment>YES answers are now forced to store a default justification instead of allowing null/blank, which conflicts with the SOA rule to allow empty justification for applicable controls and can mask when the model provided no rationale.

(Based on your team's feedback about allowing blank justification for YES SOA answers.) .</comment>

<file context>
@@ -163,12 +172,24 @@ export function parseAndProcessSOAAnswer(
+      ? llmJustification
+      : llmJustification && !isInsufficientDataAnswer(llmJustification)
+        ? llmJustification
+        : (getInclusionJustification(closure) ?? DEFAULT_INCLUSION_JUSTIFICATION);
 
   send({
</file context>

[cubic-dev-ai]

P3: Using || instead of ?? causes empty-string justification values to be silently discarded, falling back to the column mapping default instead of preserving the user's explicitly saved empty value.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/documents/statement-of-applicability/components/SOATableRow.tsx, line 80:

<comment>Using `||` instead of `??` causes empty-string justification values to be silently discarded, falling back to the column mapping default instead of preserving the user's explicitly saved empty value.</comment>

<file context>
@@ -77,9 +77,7 @@ export function SOATableRow({
-      displayIsApplicable === false
-        ? (answerData.answer ?? question.columnMapping.justification ?? null)
-        : null;
+      answerData.answer || question.columnMapping.justification || null;
   } else {
     // Normal logic: processedResult / column mapping until user saves (then branch above)
</file context>

Suggested change

	answerData.answer || question.columnMapping.justification || null;
	answerData.answer ?? question.columnMapping.justification ?? null;

[cubic-dev-ai]

2 issues found across 27 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/frameworks/frameworks-people-score.helper.ts">

<violation number="1" location="apps/api/src/frameworks/frameworks-people-score.helper.ts:22">
P2: Background-check eligibility is gated by a hardcoded `'auditor'` role string instead of RBAC role metadata, which can break custom-role behavior.</violation>
</file>

<file name="apps/api/src/background-checks/background-check-retry.ts">

<violation number="1" location="apps/api/src/background-checks/background-check-retry.ts:117">
P2: The retry error handler performs a stale status write that can clobber a successful concurrent retry.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Background-check eligibility is gated by a hardcoded 'auditor' role string instead of RBAC role metadata, which can break custom-role behavior.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/frameworks/frameworks-people-score.helper.ts, line 22:

<comment>Background-check eligibility is gated by a hardcoded `'auditor'` role string instead of RBAC role metadata, which can break custom-role behavior.</comment>

<file context>
@@ -8,6 +8,20 @@ const COMPLETED_BACKGROUND_CHECK_STATUSES = [
+    .split(',')
+    .map((r) => r.trim())
+    .filter(Boolean);
+  return roles.length > 0 && roles.every((r) => r === 'auditor');
+}
+
</file context>

[cubic-dev-ai]

P2: The retry error handler performs a stale status write that can clobber a successful concurrent retry.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/background-checks/background-check-retry.ts, line 117:

<comment>The retry error handler performs a stale status write that can clobber a successful concurrent retry.</comment>

<file context>
@@ -0,0 +1,145 @@
+      // check rather than colliding with a prior attempt's idempotency key.
+      idempotencyKey: `comp-background-check:${existing.id}:${attempt}`,
+    });
+  } catch (error) {
+    // Restore the prior status (retry is only allowed from 'failed' or
+    // 'cancelled'). Forcing 'failed' here would strip a cancelled check of the
</file context>

[claudfuen]

🎉 This PR is included in version 3.67.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀