[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Ships ISO 27001 (ISMS) foundational documents end to end: deterministic generation from platform data, approvals, and PDF/DOCX export, with a clean UI and framework-editor mappings. Also hardens OAuth token refresh with per-connection single-flight (short, ownership-checked lease, bounded timeout, fail-safe reuse) and keeps the Integration Builder test dialog from hanging via an independent polling backstop.

• New Features

  • Six documents: 4.1 Context, 4.2 Parties & Requirements, 4.3 Scope, 5.1 Leadership, 6.2 Objectives — derived from platform data with drift detection and preserved manual overrides (CS-437, CS-438).
  • Approvals lifecycle with versioned snapshots; any content edit reverts approved docs to draft.
  • Branded exports to PDF and DOCX (jspdf + jspdf-autotable, docx) with rich cover and metadata.
  • Framework Editor: ISMS templates with framework-scoped requirement mapping and control-template links; org documents inherit links on setup.
  • Registers: generic create/update/delete endpoints across all four registers, concurrency-safe position allocation, Zod-validated payloads.
  • App UI: overview and detail pages for all six docs (drift banner, approval, linked controls, export) and a setup wizard for non-derivable inputs; the ISO 27001 tab appears when ISO 27001 is active and the is-isms-enabled flag is on.

• Migration

  • Enable is-isms-enabled in PostHog for target orgs and ensure ISO 27001 is active.
  • Optional: in Framework Editor, map ISMS templates to requirements and link control templates; org docs will inherit links on setup.
  • Run the ISMS setup wizard and Generate All (or regenerate per document) to seed content.

^{Written for commit 08313a5. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Jun 15, 2026 4:20pm
comp-framework-editor (staging)	Ready	Preview, Comment	Jun 15, 2026 4:20pm
portal (staging)	Ready	Preview, Comment	Jun 15, 2026 4:20pm

[cubic-dev-ai]

3 issues found across 205 files

Confidence score: 3/5

• In apps/app/src/app/(app)/[orgId]/documents/isms/hooks/useIso27001FrameworkId.ts, returning null before /v1/frameworks finishes causes loading/error states to look like “framework not active,” which can hide ISMS UI and show the wrong empty state to users on slow or failed requests — separate loading/error from inactive-state return values before merging.
• In apps/framework-editor/app/(pages)/frameworks/[frameworkId]/isms-documents/page.tsx, the route can be opened directly without enforcing ISMS-enabled/active-ISO rollout checks, so users may access ISMS documents when rollout should block it — add server/client guard validation on route entry before merging.
• In apps/framework-editor/app/(pages)/frameworks/[frameworkId]/isms-documents/page.tsx, authorization relies on a hardcoded admin-role helper instead of RBAC permission checks, which can deny valid custom-role users and drift from the API access model — switch to RBAC permission-based gating to align behavior before merging.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/documents/isms/hooks/useIso27001FrameworkId.ts">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/documents/isms/hooks/useIso27001FrameworkId.ts:34">
P2: Hook conflates loading/error with "framework not active" by returning null before `/v1/frameworks` resolves. This can hide ISMS UI and show incorrect empty-state messaging during slow/failed requests.</violation>
</file>

<file name="apps/framework-editor/app/(pages)/frameworks/[frameworkId]/isms-documents/page.tsx">

<violation number="1" location="apps/framework-editor/app/(pages)/frameworks/[frameworkId]/isms-documents/page.tsx:12">
P2: Route authorization uses a hardcoded admin-role helper instead of RBAC permission checks. This blocks custom-role permission grants and violates the API RBAC access model.</violation>

<violation number="2" location="apps/framework-editor/app/(pages)/frameworks/[frameworkId]/isms-documents/page.tsx:17">
P2: ISMS documents page is reachable without validating ISMS-enabled/active-ISO rollout conditions. Users can access this route directly even when ISMS rollout should be disabled.</violation>
</file>

<sub>Partial review: This PR has more than 100 files, so cubic reviewed the highest-priority files first.
For a deeper review of large PRs, comment @cubic-dev-ai ultrareview. Learn more.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Hook conflates loading/error with "framework not active" by returning null before /v1/frameworks resolves. This can hide ISMS UI and show incorrect empty-state messaging during slow/failed requests.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/documents/isms/hooks/useIso27001FrameworkId.ts, line 34:

<comment>Hook conflates loading/error with "framework not active" by returning null before `/v1/frameworks` resolves. This can hide ISMS UI and show incorrect empty-state messaging during slow/failed requests.</comment>

<file context>
@@ -0,0 +1,41 @@
+  );
+
+  return useMemo(() => {
+    const frameworks = data?.data ?? [];
+    const match = frameworks.find(
+      (instance) =>
</file context>

[cubic-dev-ai]

P2: ISMS documents page is reachable without validating ISMS-enabled/active-ISO rollout conditions. Users can access this route directly even when ISMS rollout should be disabled.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/framework-editor/app/(pages)/frameworks/[frameworkId]/isms-documents/page.tsx, line 17:

<comment>ISMS documents page is reachable without validating ISMS-enabled/active-ISO rollout conditions. Users can access this route directly even when ISMS rollout should be disabled.</comment>

<file context>
@@ -0,0 +1,22 @@
+
+  const { frameworkId } = await params;
+
+  const templates = await serverApi<IsmsDocumentTemplate[]>(
+    `/isms-document-template?frameworkId=${frameworkId}`,
+  );
</file context>

[cubic-dev-ai]

P2: Route authorization uses a hardcoded admin-role helper instead of RBAC permission checks. This blocks custom-role permission grants and violates the API RBAC access model.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/framework-editor/app/(pages)/frameworks/[frameworkId]/isms-documents/page.tsx, line 12:

<comment>Route authorization uses a hardcoded admin-role helper instead of RBAC permission checks. This blocks custom-role permission grants and violates the API RBAC access model.</comment>

<file context>
@@ -0,0 +1,22 @@
+}: {
+  params: Promise<{ frameworkId: string }>;
+}) {
+  const isAllowed = await isAuthorized();
+  if (!isAllowed) redirect('/auth');
+
</file context>

[claudfuen]

🎉 This PR is included in version 3.83.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀