[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Adds read-only views that link policies, controls, and tasks so users can see policy evidence and which policies a task implements. Also redesigns the Control Mappings UI with framework badges and a safer unlink flow. Addresses Linear SALE-48.

• New Features

  • New API: GET /v1/policies/:id/evidence-tasks and GET /v1/tasks/:taskId/policies.
  • /v1/policies/:id/controls now includes framework names derived from requirementsMapped.
  • New hooks and UI: usePolicyEvidenceTasks, useTaskPolicies, PolicyEvidenceTasks, and TaskPolicies.
  • Mappings rendered as @trycompai/design-system tables with per-cell links (open in new tab).
  • Control Mappings uses Popover + Command to add, and a confirm dialog to unlink.

• Bug Fixes

  • Both join endpoints require policy:read and task:read.
  • Guarded task-based endpoint with task access checks; all joins scoped by organizationId.
  • Unified visibility: drafts included; only archived rows are excluded.
  • Improved empty/error states and tab fallbacks to avoid blank pages.

^{Written for commit 5e30bfb. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Apr 29, 2026 2:09pm
comp-framework-editor (staging)	Ready	Preview, Comment	Apr 29, 2026 2:09pm
portal (staging)	Ready	Preview, Comment	Apr 29, 2026 2:09pm

[cubic-dev-ai]

3 issues found across 18 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/superpowers/plans/2026-04-24-policy-evidence-tasks.md">

<violation number="1" location="docs/superpowers/plans/2026-04-24-policy-evidence-tasks.md:126">
P2: The `getTaskPolicies` query does not filter out draft policies, despite the plan requiring draft/archived filtering.</violation>

<violation number="2" location="docs/superpowers/plans/2026-04-24-policy-evidence-tasks.md:1140">
P3: The displayed policy count uses unfiltered API `count` instead of the filtered visible policy total, which can produce inconsistent UI.</violation>
</file>

<file name="apps/api/src/tasks/tasks.controller.spec.ts">

<violation number="1" location="apps/api/src/tasks/tasks.controller.spec.ts:610">
P3: The test claims to validate `NotFoundException` but only asserts the error message, so it can pass on the wrong exception type/status.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: The getTaskPolicies query does not filter out draft policies, despite the plan requiring draft/archived filtering.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/superpowers/plans/2026-04-24-policy-evidence-tasks.md, line 126:

<comment>The `getTaskPolicies` query does not filter out draft policies, despite the plan requiring draft/archived filtering.</comment>

<file context>
@@ -0,0 +1,1368 @@
+      select: expect.objectContaining({
+        id: true,
+        controls: expect.objectContaining({
+          where: { archivedAt: null },
+        }),
+      }),
</file context>

[cubic-dev-ai]

P3: The displayed policy count uses unfiltered API count instead of the filtered visible policy total, which can produce inconsistent UI.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/superpowers/plans/2026-04-24-policy-evidence-tasks.md, line 1140:

<comment>The displayed policy count uses unfiltered API `count` instead of the filtered visible policy total, which can produce inconsistent UI.</comment>

<file context>
@@ -0,0 +1,1368 @@
+  return (
+    <Section
+      title="Policies"
+      description={`${count} polic${count === 1 ? 'y' : 'ies'} whose controls this task demonstrates.`}
+    >
+      <Stack gap="4">
</file context>

[cubic-dev-ai]

P3: The test claims to validate NotFoundException but only asserts the error message, so it can pass on the wrong exception type/status.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/tasks/tasks.controller.spec.ts, line 610:

<comment>The test claims to validate `NotFoundException` but only asserts the error message, so it can pass on the wrong exception type/status.</comment>

<file context>
@@ -512,6 +516,151 @@ describe('TasksController', () => {
+
+      await expect(
+        controller.getTaskPolicies(orgId, 'tsk_404', authContext),
+      ).rejects.toThrow('Task not found');
+    });
+
</file context>

Suggested change

	).rejects.toThrow('Task not found');
	).rejects.toMatchObject({ message: 'Task not found', status: 404 });

[claudfuen]

🎉 This PR is included in version 3.35.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀