CedarCopilot wants to merge 16 commits into staging from refactor/agent-files-sections
Live on prod since Sat, 4 of 5 surfaces working
Strict CloudWatch fallback saw 8 success-shaped log lines matching /access-schema.ts, /agent-share-schema.ts, /documents-schema.ts, claude, playbookeditor, but no tied operation was present, so Libra is not calling this working.
Strict CloudWatch fallback saw 93 success-shaped log lines matching pipeline, analytics, quota, aop, but no tied operation was present, so Libra is not calling this working.
Strict CloudWatch fallback saw 4 setup or missing-connection failure log lines matching auth, login, session, token, but that does not prove the deployed behavior is broken for connected users.
Strict CloudWatch fallback found 55 prod failure log lines for mirror.upsertEmailThread failed (Failed query: insert into \), but this domain-wide failure family is not tied to this intent.
Verification reached its budget before a verdict.
Strict CloudWatch fallback found 55 prod failure log lines for mirror.upsertEmailThread failed (Failed query: insert into \), but this domain-wide failure family is not tied to this intent.
internal_only
internal_only
internal_only
internal_only
single_user
Libra measured 4 of 5 production surfaces on prod. 1 surface had under 20 requests, so Libra has not judged it. Libra checks hourly for 3 days after each deploy.
The sharing and permissions epic: one access predicate with two renderings , accessFor for a single document, accessibleFilter as SQL for a listing , replacing the old "the path IS the ACL" rule, plus the product surface on top of it (Share panel, typed share links, access requests, agent sharing, "Shared with me").
The design and its phases are in apps/server/docs/sharing.md.
The last commits on the branch are a pre-merge review pass, and they are the part most worth reviewing closely. Six authorization holes were found and closed:
| What was open | Where |
|---|---|
| Any org member could mint a permanent anonymous public link to any document in the org , a teammate's file, a deal they are not on, an explicitly private folder | documents.createShareLink + 4 siblings, gated on tenancy alone |
| Any org member could read an agent's whole recipient list (names + email addresses) and re-fire invite notifications in their own name | agentSharing.list / resend |
| An authenticated caller could walk guessed UUIDs and learn which were live documents in any tenant, then whether each was private | getFolderVisibility, which took an id and no viewer |
A read-only seat on a deal capped you on your own file inside it, and capped an agent admin , because the resolver short-circuited where the SQL folds with max | resolve.ts floor chain |
Granting to a foreign user:<id> and reading the audience back returned that person's name, address and avatar , a cross-tenant directory | grantAccess + namesFor |
viewerFor trusted its orgId, which the filter renders and the resolver does not , refused per-document, admitted by every listing | viewerFor |
Two of those (the floor fold, and agentIdFromPath scanning deeper than the SQL tests) were divergences between the two renderings , a listing admitting a row the mutation then refuses, which is the exact split this subsystem exists to prevent.
Also in that pass: capped password into a blocking scryptSync on the unauthenticated unlock route, bounded audienceValues, view beacons bound to their token, and a dozen frontend fixes (disjoint cache invalidations, private→public silently dropping the role you picked, a hardcoded "Owner" shown to every viewer of an agent panel, unhandled create rejections, timers leaking past unmount).
pnpm run autofix:local , green: brand check, oxlint --deny-warnings, deps:check, paraglide, mail Jest (all suites), TZ tests, server Vitest 994 files / 12,137 tests.types and types:test clean in both packages.apps/server/src/services/access/__tests__/refusals.test.ts , 11 cases pinning all six refusals against real Postgres (PGlite). The two floor-fold cases were re-run against the old chain to confirm they fail for the right reason rather than passing trivially.origin/staging is merged in. Three conflicts were decisions, not text , files.restoreNode deleted (staging removed it deliberately), readFile keeping this branch's viewer parameter (staging's signature would have dropped the access check), and debugTool.ts taking both sides because they gate different things. Reasoning is in the merge commit.turbo run types but never types:test, so test-file types are unchecked. The merge surfaced nine type errors in tests that no CI check would have caught , two of them pre-existing on staging, in files neither side had touched. All fixed; types:test is back to zero in both packages.visibilityConsequence, previewMove) that fire on panel open; listPendingRequestsFor has no LIMIT; legacy public_token links are invisible to the new panel during the dual-read window. Details in the review notes.🤖 Generated with Claude Code
| Surface | Requests | Errors | p95 | Users | Verdict |
|---|---|---|---|---|---|
| mirror.upsertEmailThread | 526 → 710 | 1 → 2 (0.3%) | 295 ms → 272 ms | 0 | Working 710 requests since the deploy with 2 errors (1 errors in the 526-request baseline before it). p95 272 ms, was 295 ms. |
| model_chunk Conversation Field Updater | 45 → 63 | 0 → 0 (0%) | 1 ms → 1 ms | 0 | Working 63 requests since the deploy with 0 errors (0 errors in the 45-request baseline before it). p95 1 ms, was 1 ms. |
| execute_tool update-conversation-fields | 18 → 30 | 0 → 0 (0%) | 67917 ms → 15786 ms | 0 | Working 30 requests since the deploy with 0 errors (0 errors in the 18-request baseline before it). p95 15786 ms, was 67917 ms. |
| model_step Conversation Field Updater | 17 → 29 | 0 → 0 (0%) | 99587 ms → 36769 ms | 0 | Working 29 requests since the deploy with 0 errors (0 errors in the 17-request baseline before it). p95 36769 ms, was 99587 ms. |
| invoke_agent Conversation Field Updater | 7 → 12 | 0 → 0 (0%) | 78795 ms → 72033 ms | 0 | Insufficient traffic 12 requests, under the 20 Libra needs |
| mirror.upsertEmailThread | 31 → 8 | 0 → 0 (0%) | 307 ms → 279 ms | 0 | Insufficient traffic 8 requests, under the 20 Libra needs |
| model_chunk Conversation Field Updater | 7 → 0 | 0 → 0 (0%) | 1 ms → not measured | 0 | No traffic No requests recorded since this deploy. |
| execute_tool update-conversation-fields | 3 → 0 | 0 → 0 (0%) | 3134 ms → not measured | 0 | No traffic No requests recorded since this deploy. |
| model_step Conversation Field Updater | 3 → 0 | 0 → 0 (0%) | 26988 ms → not measured | 0 | No traffic No requests recorded since this deploy. |
| invoke_agent Conversation Field Updater | 1 → 0 | 0 → 0 (0%) | 44119 ms → not measured | 0 | No traffic No requests recorded since this deploy. |