[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Adds an internal-organization flag so platform admins are excluded in customer orgs but included as real members in internal orgs, and introduces a new ISMS “Roles, Responsibilities & Authorities” document (ISO 27001 5.3) with seeded roles, member assignments, audit-route selection, and PDF/DOCX exports. Applies the participation rule consistently across assignments, approvers, notifications, compliance, device views, and Trigger jobs, and gates Roles submission with server/client validation.

• New Features

  • Internal org participation: DB Organization.isInternal (default false) with admin toggle + confirmation; single rule via isOrgParticipant in @trycompai/auth/participation with dependency‑free mirrors for Trigger bundles (API + app) used across API/services, schedules/notifiers/device queries, and SelectAssignee; helpers orgParticipantMemberWhere/orgParticipantMemberWhereForFlag and getOrgIsInternal.
  • ISMS Roles (CS-698): new roles_and_responsibilities type with four seeded governance roles, custom roles, member assignments with clause‑7.2 competence, Internal Auditor route (in_house/external/training_planned) with validation, team‑size band (1–3 vs 4+), idempotent seeding and submit‑for‑approval gate; new services (IsmsRoleService, IsmsRoleAssignmentService), UI page/components, and export integration (PDF/DOCX). DB adds IsmsRole/IsmsRoleAssignment, enums (IsmsCompetenceBasis, IsmsAuditRoute), and a unique (documentId, roleKey) index; wizard generation order updated.

• Bug Fixes

  • Trigger.dev deploy: replace @trycompai/auth/participation imports in API notifiers with a local, dependency‑free mirror; add a drift‑guard spec and Jest mapper for @trycompai/auth/participation to source to keep tests green.
  • Security: reject assignee IDs that aren’t members of the org across tasks, task items, policies, risks, and vendors; keep approver/assignee checks consistent and require active members where needed.
  • Notifications/schedules/automation: use the shared participation where‑fragments, make mention filters spread‑safe, align browser‑automation and consolidate org lookups; add regression tests to ensure automation‑failure notifiers apply the internal‑org participant filter.
  • Compliance/devices/digests: respect internal orgs; skip the internal‑flag query when no platform admins are present.
  • Utilities/tests: strict YYYY‑MM‑DD parsing for date inputs; serialize Roles submit to avoid races; scope Roles lookups to the new doc type; add PointerEvent test shim and new unit tests.

^{Written for commit f37aa34. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor (staging)	Ready	Preview, Comment	Jul 10, 2026 8:00pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app (staging)	Skipped		Jul 10, 2026 8:00pm
portal (staging)	Skipped		Jul 10, 2026 8:00pm

[cubic-dev-ai]

2 issues found across 45 files

Confidence score: 3/5

• In apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/OrganizationDetail.tsx, the update path hits an API route gated by a hardcoded global admin role, so custom roles can be incorrectly blocked from a sensitive setting; merging as-is risks breaking delegated admin workflows for orgs using custom RBAC. Route this mutation through the existing API permission guard before merging.
• In apps/api/src/tasks/task-notifier.service.ts, the new internal-org participant filter lacks regression tests, so future changes to orgParticipantMemberWhereForFlag could silently misroute or suppress automation-failure notifications. Add internal-organization and customer-organization coverage to de-risk this behavior.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/tasks/task-notifier.service.ts">

<violation number="1" location="apps/api/src/tasks/task-notifier.service.ts:1093">
P3: Automation-failure notifications have no regression coverage for the new internal-org participant filter. Add cases for internal and customer organizations so a change to `orgParticipantMemberWhereForFlag` cannot silently route notifications to the wrong recipients.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/OrganizationDetail.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/OrganizationDetail.tsx:58">
P2: Custom roles cannot be granted access to this sensitive organization setting because this mutation reaches an API route gated by the hardcoded global `admin` role. Route this update through the API permission guard with an explicit RBAC permission instead of `PlatformAdminGuard`'s role-string check.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[claudfuen]

🎉 This PR is included in version 3.101.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀