[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Adds control family grouping so large frameworks are easier to browse, plus fixes custom framework link handling so policies, tasks, and documents show up correctly. Run Prisma migrations when deploying; no breaking changes—families are optional and the UI falls back to a flat list.

• New Features

  • Framework controls: grouped view with collapsible families, search, pagination, and a family filter; auto-enables when families exist, otherwise shows the flat list.
  • New UI components and tests: FrameworkControlsGrouped, FamilyFilterDropdown, GroupedControlRow, shared helpers/tests.
  • Framework editor: Control Family column (combobox) to set/edit families, Manage Families dialog (rename/delete with impact preview), batch updates and hooks.
  • API/DB: controlFamily on control templates; per-instance FrameworkControlFamily; diff/preview now describe family changes; manifest/export/import/sync/rollback include families.
  • Build config: transpiles @trycompai/design-system and updates Tailwind content paths.

• Bug Fixes

  • Custom frameworks: policies, tasks, and documents now appear by merging framework-scoped and direct links with dedup across all read paths (detail, list, requirement views), fixing compliance scores.
  • Write-side sync mirrors direct policy/task/document links into framework-scoped junctions for all custom framework instances using a control; fast no-op when an org has no custom frameworks.
  • Unlink cascades run in a single transaction and clean up framework-scoped links for custom frameworks; guarded to avoid deleting explicitly-scoped links.
  • Utilities/tests: shared dedup helpers; unit tests for controls and custom-framework sync.

^{Written for commit a32ec37. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor (staging)	Ready	Preview, Comment	May 26, 2026 3:27pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app (staging)	Skipped		May 26, 2026 3:27pm
portal (staging)	Skipped		May 26, 2026 3:27pm

[cubic-dev-ai]

No issues found across 45 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[cubic-dev-ai]

2 issues found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/frameworks/frameworks.service.ts">

<violation number="1" location="apps/api/src/frameworks/frameworks.service.ts:353">
P2: Deduplication order is inconsistent between `findAll` and `findOne`. Since `deduplicateById` keeps the first occurrence, direct tasks win in `findAll` but framework tasks win in `findOne`. This can produce different `controls` arrays for the same task depending on the endpoint, leading to inconsistent compliance scores.</violation>
</file>

<file name="apps/api/src/controls/sync-custom-framework-links.ts">

<violation number="1" location="apps/api/src/controls/sync-custom-framework-links.ts:57">
P1: Wrap the multi-table link writes in a transaction to avoid partial sync state when one `createMany` fails.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Wrap the multi-table link writes in a transaction to avoid partial sync state when one createMany fails.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/controls/sync-custom-framework-links.ts, line 57:

<comment>Wrap the multi-table link writes in a transaction to avoid partial sync state when one `createMany` fails.</comment>

<file context>
@@ -0,0 +1,92 @@
+
+  const fiIds = customFiIds.map((r) => r.frameworkInstanceId);
+
+  await Promise.all([
+    control.policies.length > 0 &&
+      prisma.frameworkControlPolicyLink.createMany({
</file context>

[cubic-dev-ai]

P2: Deduplication order is inconsistent between findAll and findOne. Since deduplicateById keeps the first occurrence, direct tasks win in findAll but framework tasks win in findOne. This can produce different controls arrays for the same task depending on the endpoint, leading to inconsistent compliance scores.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/frameworks/frameworks.service.ts, line 353:

<comment>Deduplication order is inconsistent between `findAll` and `findOne`. Since `deduplicateById` keeps the first occurrence, direct tasks win in `findAll` but framework tasks win in `findOne`. This can produce different `controls` arrays for the same task depending on the endpoint, leading to inconsistent compliance scores.</comment>

<file context>
@@ -232,41 +280,90 @@ export class FrameworksService {
+            controls: (controls as any[]).filter((c) => fwControlIds.has(c.id)),
+          }))
+        : [];
+      const allTasks = deduplicateById([
+        ...mappedDirectTasks,
+        ...mappedFrameworkTasks,
</file context>

Suggested change

	const allTasks = deduplicateById([
	...mappedDirectTasks,
	...mappedFrameworkTasks,
	const allTasks = deduplicateById([
	...mappedFrameworkTasks,
	...mappedDirectTasks,