[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Ships the offboarding checklist with access revocation tracking, evidence uploads/export, and onboard/offboard date tracking across People and integrations. Also adds universal step‑repair for Cloud Security auto‑remediation, enables API key/service token mutations with clear audit attribution, sets Frameworks to default to a Controls view, fixes OOMs in task evidence export, hardens offboarding exports/validations, and fixes a multi‑select dropdown focus trap.

• New Features

  • API: Offboarding checklist with template CRUD, per‑member checklist, complete/uncomplete with notes/evidence, pending members, per‑vendor access revocations, and ZIP export (per member or all). Adds employment event evidence endpoints and onboard/offboard date fields and filters; auto‑sets offboardDate on deactivate.
  • Cloud Security: API key and service token callers can mark exceptions/revoke/update AWS scan mode; mutations attributed via an ActingUser resolver with audit labels like [via API key "…"]. Auto‑remediation adds universal step‑repair on AWS validation errors, validates required params before execution, normalizes plans to backfill service‑linked role AWSServiceName (plus prompt mapping), and improves configure‑only diffs.
  • UI: Employee Offboarding tab (checklist, access revocations, summary), Overview banner/todos, People list shows onboard/offboard dates, Settings to manage checklist template, Frameworks default to Controls tab with requirement identifiers, and offboarding evidence download via app route. DS compatibility updates; use accent badge for critical items.
  • Integrations: Set onboardDate from Google Workspace user creationTime and generic employee startDate; DSL accepts startDate.
  • Docs/DB: OpenAPI updated; People queries accept onboard/offboard date filters. Prisma migrations add Member.onboardDate/offboardDate and offboarding checklist/access revocation tables. Dependency bump: @trycompai/design-system → 1.1.19.

• Bug Fixes

  • Evidence export: Prevent OOM by loading automation headers first and streaming each automation with cursor‑based batching; add deterministic ordering; extract mappers and JSON builder.
  • Offboarding hardening: Sanitize ZIP paths and prefix dangerous CSV chars; include member ID in export folder names; scope revocation lookups by org; validate date query params; roll back completion if evidence upload fails; count completions only for enabled items; scope attachment deletion to member/event type; clear file inputs after uploads; validate tab param; show error state in TodosOverview; display “Until {date}” when only an end date is set.
  • UI: Close MultipleSelector dropdown on blur to prevent it blocking adjacent form controls.

^{Written for commit b837dfb. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor (staging)	Ready	Preview, Comment	May 21, 2026 5:06am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app (staging)	Skipped		May 21, 2026 5:06am
portal (staging)	Skipped		May 21, 2026 5:06am

[cubic-dev-ai]

20 issues found across 55 files

Confidence score: 2/5

• Several high-confidence backend issues are concrete and user-impacting (8/10), including unsanitized ZIP entry filenames in apps/api/src/offboarding-checklist/offboarding-export.service.ts and unscoped tenant/member deletes in apps/api/src/offboarding-checklist/access-revocation.service.ts and apps/api/src/people/people.controller.ts.
• There is meaningful data integrity risk in apps/api/src/offboarding-checklist/offboarding-checklist.service.ts: completeItem can remain completed when evidence upload fails, leaving partial state that should be rolled back.
• Additional medium issues (6–7/10) in checklist/export flows suggest regression potential rather than just style concerns, such as CSV formula injection handling and pending-offboarding count mismatches in apps/api/src/offboarding-checklist/offboarding-export.service.ts and apps/api/src/offboarding-checklist/offboarding-checklist.service.ts.
• Pay close attention to apps/api/src/offboarding-checklist/offboarding-export.service.ts, apps/api/src/offboarding-checklist/access-revocation.service.ts, apps/api/src/people/people.controller.ts, apps/api/src/offboarding-checklist/offboarding-checklist.service.ts - security scoping, path/input sanitization, and transactional consistency need tightening before merge.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/AccessRevocationList.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/AccessRevocationList.tsx:52">
P2: Using a single `processingVendorId` causes incorrect loading/disabled behavior when multiple row actions overlap. Track processing per vendor (or globally lock actions) to avoid prematurely re-enabling controls during in-flight requests.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/settings/components/OffboardingChecklistSettings.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/settings/components/OffboardingChecklistSettings.tsx:57">
P2: Rolling back with a full-list snapshot can clobber other in-flight item updates. Revert only the failed item field (or revalidate from server) instead of restoring `data: previous`.</violation>
</file>

<file name="apps/api/src/offboarding-checklist/offboarding-checklist.controller.ts">

<violation number="1" location="apps/api/src/offboarding-checklist/offboarding-checklist.controller.ts:251">
P2: Use a DTO with class-validator rules for `revokeVendorAccess` body instead of an inline type, and enforce all-or-none evidence fields with a 400 response on partial payloads.</violation>
</file>

<file name="apps/api/src/offboarding-checklist/offboarding-checklist.service.ts">

<violation number="1" location="apps/api/src/offboarding-checklist/offboarding-checklist.service.ts:49">
P2: `createTemplateItem` has a race condition for `sortOrder`; concurrent creates can assign the same order value.</violation>
</file>

<file name="apps/app/src/hooks/use-access-revocations.ts">

<violation number="1" location="apps/app/src/hooks/use-access-revocations.ts:49">
P2: Add a file-size check before base64 conversion to avoid loading oversized evidence files into browser memory.</violation>
</file>

<file name="apps/api/src/offboarding-checklist/access-revocation.service.ts">

<violation number="1" location="apps/api/src/offboarding-checklist/access-revocation.service.ts:204">
P2: Avoid calling the full `getAccessRevocations` path in completion sync; it does expensive attachment fetches that are unnecessary for count checks.</violation>
</file>

<file name="apps/app/src/hooks/use-employment-evidence.ts">

<violation number="1" location="apps/app/src/hooks/use-employment-evidence.ts:32">
P2: Add a client-side file size check before `readAsDataURL` to avoid loading oversized files into memory before the server rejects them.</violation>
</file>

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Avoid calling the full getAccessRevocations path in completion sync; it does expensive attachment fetches that are unnecessary for count checks.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/offboarding-checklist/access-revocation.service.ts, line 204:

<comment>Avoid calling the full `getAccessRevocations` path in completion sync; it does expensive attachment fetches that are unnecessary for count checks.</comment>

<file context>
@@ -0,0 +1,233 @@
+      return;
+    }
+
+    const { totalVendors, revokedCount } = await this.getAccessRevocations(
+      organizationId,
+      memberId,
</file context>

[cubic-dev-ai]

P2: Add a client-side file size check before readAsDataURL to avoid loading oversized files into memory before the server rejects them.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/hooks/use-employment-evidence.ts, line 32:

<comment>Add a client-side file size check before `readAsDataURL` to avoid loading oversized files into memory before the server rejects them.</comment>

<file context>
@@ -0,0 +1,95 @@
+
+  const uploadEvidence = useCallback(
+    (file: File): Promise<AttachmentMetadata> => {
+      return new Promise((resolve, reject) => {
+        const reader = new FileReader();
+        reader.onload = async () => {
</file context>

[tofikwest]

@cubic-dev-ai review it

[cubic-dev-ai]

@cubic-dev-ai review it

@tofikwest I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

16 issues found across 74 files

Confidence score: 2/5

• I’m rating this as high merge risk because several high-confidence issues are user-impacting: unhandled archive errors in apps/api/src/offboarding-checklist/offboarding-export.service.ts can crash exports, and unbounded findMany in the same flow can cause memory spikes on large organizations.
• There are concrete data-integrity concerns: onDelete: Cascade in packages/db/prisma/schema/offboarding-checklist.prisma can remove historical completion records, and failed evidence upload in apps/api/src/offboarding-checklist/access-revocation.service.ts can leave partial revocation data behind.
• Auth and state-consistency gaps could cause incorrect behavior after merge, including missing Authorization forwarding in apps/app/src/app/api/offboarding-export/route.ts and reactivation not clearing offboardDate in apps/api/src/integration-platform/services/generic-employee-sync.service.ts.
• Pay close attention to apps/api/src/offboarding-checklist/offboarding-export.service.ts, packages/db/prisma/schema/offboarding-checklist.prisma, apps/api/src/offboarding-checklist/access-revocation.service.ts, and apps/app/src/app/api/offboarding-export/route.ts - they contain crash, data-loss, transactional consistency, and auth-forwarding risks.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/overview/components/ToDoOverview.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/overview/components/ToDoOverview.tsx:69">
P2: The offboarding tab collapses loading/error into an empty state, so failed fetches appear as “No pending offboardings.” Handle SWR loading/error states before showing the empty-success message.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/OffboardingChecklist.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/OffboardingChecklist.tsx:73">
P2: Opening download URLs with `window.open(..., '_blank')` without `noopener,noreferrer` leaves `window.opener` exposed. Add `noopener,noreferrer` to the window features.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkControls.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkControls.tsx:177">
P2: This per-row computation repeatedly scans tasks and re-sorts evidence submissions, causing avoidable O(n×m) render-time work for larger control lists.</violation>
</file>

<file name="apps/api/src/integration-platform/services/generic-employee-sync.service.ts">

<violation number="1" location="apps/api/src/integration-platform/services/generic-employee-sync.service.ts:198">
P2: Reactivating a member does not clear `offboardDate`, so active members can remain marked as offboarded.</violation>

<violation number="2" location="apps/api/src/integration-platform/services/generic-employee-sync.service.ts:241">
P2: `startDate` is written without validating date parseability, so malformed provider values can fail sync writes.</violation>
</file>

<file name="apps/app/src/app/api/offboarding-export/route.ts">

<violation number="1" location="apps/app/src/app/api/offboarding-export/route.ts:27">
P2: Forward the incoming Authorization header to the backend export API; otherwise token-authenticated callers will be rejected.</violation>
</file>

<file name="apps/api/src/offboarding-checklist/offboarding-export.service.ts">

<violation number="1" location="apps/api/src/offboarding-checklist/offboarding-export.service.ts:33">
P1: Add explicit `archive` error handling; unhandled archiver errors can crash the export path.</violation>

<violation number="2" location="apps/api/src/offboarding-checklist/offboarding-export.service.ts:116">
P2: Vendor evidence paths are collision-prone; include a unique prefix (e.g., attachment id) in the archive filename.</violation>

<violation number="3" location="apps/api/src/offboarding-checklist/offboarding-export.service.ts:157">
P1: `exportAllOffboardings` uses unbounded `findMany`; paginate with cursor batching to avoid memory spikes on large org exports.</violation>
</file>

<file name="apps/api/src/offboarding-checklist/offboarding-checklist.service.ts">

<violation number="1" location="apps/api/src/offboarding-checklist/offboarding-checklist.service.ts:187">
P2: `evidenceRequired` is not enforced when completing an item, so required-evidence tasks can be completed without any evidence.</violation>

<violation number="2" location="apps/api/src/offboarding-checklist/offboarding-checklist.service.ts:363">
P2: Default template seeding is race-prone and can insert duplicate default items for a new organization under concurrent requests.</violation>
</file>

<file name="packages/db/prisma/schema/offboarding-checklist.prisma">

<violation number="1" location="packages/db/prisma/schema/offboarding-checklist.prisma:32">
P1: Using `onDelete: Cascade` on `templateItem` can erase historical offboarding completion records when a template item is deleted.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx:300">
P2: Status filter label can display "Active" while data is actually filtered as "All People" when offboard date filtering is applied.</violation>
</file>

<file name="apps/api/src/offboarding-checklist/access-revocation.service.ts">

<violation number="1" location="apps/api/src/offboarding-checklist/access-revocation.service.ts:108">
P1: If evidence upload fails, the revocation record is left behind because this flow does not roll back the earlier create.</violation>

<violation number="2" location="apps/api/src/offboarding-checklist/access-revocation.service.ts:143">
P2: Undoing a revocation does not delete its evidence attachments, leaving orphaned attachment data.</violation>

<violation number="3" location="apps/api/src/offboarding-checklist/access-revocation.service.ts:204">
P2: Completion sync is doing expensive full access-revocation hydration just to calculate counts, which adds avoidable overhead to each mutation.</violation>
</file>

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: exportAllOffboardings uses unbounded findMany; paginate with cursor batching to avoid memory spikes on large org exports.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/offboarding-checklist/offboarding-export.service.ts, line 157:

<comment>`exportAllOffboardings` uses unbounded `findMany`; paginate with cursor batching to avoid memory spikes on large org exports.</comment>

<file context>
@@ -0,0 +1,214 @@
+    const archive = archiver('zip', { zlib: { level: 9 } });
+    archive.pipe(output);
+
+    const members = await db.member.findMany({
+      where: { organizationId, offboardDate: { not: null }, deactivated: true },
+      include: { user: { select: { name: true, email: true } } },
</file context>

[cubic-dev-ai]

P1: Add explicit archive error handling; unhandled archiver errors can crash the export path.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/offboarding-checklist/offboarding-export.service.ts, line 33:

<comment>Add explicit `archive` error handling; unhandled archiver errors can crash the export path.</comment>

<file context>
@@ -0,0 +1,214 @@
+    memberId: string;
+    output: NodeJS.WritableStream;
+  }) {
+    const archive = archiver('zip', { zlib: { level: 9 } });
+    archive.pipe(output);
+
</file context>

[cubic-dev-ai]

P1: Using onDelete: Cascade on templateItem can erase historical offboarding completion records when a template item is deleted.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/db/prisma/schema/offboarding-checklist.prisma, line 32:

<comment>Using `onDelete: Cascade` on `templateItem` can erase historical offboarding completion records when a template item is deleted.</comment>

<file context>
@@ -0,0 +1,57 @@
+
+  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  member       Member                       @relation(fields: [memberId], references: [id], onDelete: Cascade)
+  templateItem OffboardingChecklistTemplate @relation(fields: [templateItemId], references: [id], onDelete: Cascade)
+  completedBy  User                         @relation("OffboardingChecklistCompletedBy", fields: [completedById], references: [id], onDelete: Cascade)
+
</file context>

[cubic-dev-ai]

P1: If evidence upload fails, the revocation record is left behind because this flow does not roll back the earlier create.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/offboarding-checklist/access-revocation.service.ts, line 108:

<comment>If evidence upload fails, the revocation record is left behind because this flow does not roll back the earlier create.</comment>

<file context>
@@ -0,0 +1,233 @@
+    });
+
+    if (evidence) {
+      await this.attachmentsService.uploadAttachment(
+        organizationId,
+        revocation.id,
</file context>

[cubic-dev-ai]

P2: The offboarding tab collapses loading/error into an empty state, so failed fetches appear as “No pending offboardings.” Handle SWR loading/error states before showing the empty-success message.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/overview/components/ToDoOverview.tsx, line 69:

<comment>The offboarding tab collapses loading/error into an empty state, so failed fetches appear as “No pending offboardings.” Handle SWR loading/error states before showing the empty-success message.</comment>

<file context>
@@ -48,6 +63,11 @@ export function ToDoOverview({
+  const { data: pendingData } = useApiSWR<PendingOffboardingResponse>(
+    '/v1/offboarding-checklist/pending',
+  );
+  const pendingOffboardings = pendingData?.data?.members ?? [];
+
   const isOnboardingInProgress = !!onboardingTriggerJobId;
</file context>

[cubic-dev-ai]

P2: Default template seeding is race-prone and can insert duplicate default items for a new organization under concurrent requests.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/offboarding-checklist/offboarding-checklist.service.ts, line 363:

<comment>Default template seeding is race-prone and can insert duplicate default items for a new organization under concurrent requests.</comment>

<file context>
@@ -0,0 +1,384 @@
+  }
+
+  private async seedDefaultsIfNeeded(organizationId: string) {
+    const count = await db.offboardingChecklistTemplate.count({
+      where: { organizationId },
+    });
</file context>

[cubic-dev-ai]

P2: evidenceRequired is not enforced when completing an item, so required-evidence tasks can be completed without any evidence.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/offboarding-checklist/offboarding-checklist.service.ts, line 187:

<comment>`evidenceRequired` is not enforced when completing an item, so required-evidence tasks can be completed without any evidence.</comment>

<file context>
@@ -0,0 +1,384 @@
+      throw new NotFoundException('Template item not found');
+    }
+
+    const completion = await db.offboardingChecklistCompletion.create({
+      data: {
+        organizationId,
</file context>

[cubic-dev-ai]

P2: Status filter label can display "Active" while data is actually filtered as "All People" when offboard date filtering is applied.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx, line 300:

<comment>Status filter label can display "Active" while data is actually filtered as "All People" when offboard date filtering is applied.</comment>

<file context>
@@ -254,7 +296,9 @@ export function TeamMembersClient({
             <SelectTrigger>
-              <SelectValue placeholder="Active" />
+              <SelectValue placeholder="Active">
+                {{ all: 'All People', active: 'Active', pending: 'Pending', deactivated: 'Deactivated' }[statusFilter] ?? 'Active'}
+              </SelectValue>
             </SelectTrigger>
</file context>

Suggested change

	{{ all: 'All People', active: 'Active', pending: 'Pending', deactivated: 'Deactivated' }[statusFilter] ?? 'Active'}
	{{ all: 'All People', active: 'Active', pending: 'Pending', deactivated: 'Deactivated' }[effectiveStatusFilter] ?? 'Active'}

[cubic-dev-ai]

P2: Completion sync is doing expensive full access-revocation hydration just to calculate counts, which adds avoidable overhead to each mutation.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/offboarding-checklist/access-revocation.service.ts, line 204:

<comment>Completion sync is doing expensive full access-revocation hydration just to calculate counts, which adds avoidable overhead to each mutation.</comment>

<file context>
@@ -0,0 +1,233 @@
+      return;
+    }
+
+    const { totalVendors, revokedCount } = await this.getAccessRevocations(
+      organizationId,
+      memberId,
</file context>

[cubic-dev-ai]

P2: Undoing a revocation does not delete its evidence attachments, leaving orphaned attachment data.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/offboarding-checklist/access-revocation.service.ts, line 143:

<comment>Undoing a revocation does not delete its evidence attachments, leaving orphaned attachment data.</comment>

<file context>
@@ -0,0 +1,233 @@
+      throw new NotFoundException('Revocation record not found');
+    }
+
+    await db.offboardingAccessRevocation.delete({
+      where: { id: revocation.id },
+    });
</file context>

[tofikwest]

@Marfuen take a look to bug report please, a lot of finding