Libra CodeHub

CedarCopilot/cedar-mail

Branch: staging

feat(tasks): org-admin read-only view of a teammate's tasks/agenda

merged#2826CedarCopilot

CedarCopilot wants to merge 7 commits into staging from feat/org-admin-task-view

Live on prod, 0 of 2 surfaces working, less than a day leftTimeline and evidence
  1. Opened
    Sep 19, 2026, 9:02 AM
  2. No findings
    Sep 21, 2026, 5:24 AM
  3. Merged
    Sep 21, 2026, 5:35 AM
  4. Live on prod
    Sep 21, 2026, 5:35 AM
  5. Observed 18 hours, 2 surfaces, 0 requests
    Sep 21, 2026, 5:35 AM
  6. Pipelines steady after this deploy
    Sep 21, 2026, 5:35 AM
  7. Watching

    Live on prod, 0 of 2 surfaces working, less than a day left

    Sep 21, 2026, 11:49 PM

Behaviors Libra is checking

Viewing a teammate's agenda makes the editor strictly read-only, blocking typing, task completion, snoozing, deletion, invocation, field changes, Slack sends, keyboard shortcuts, and drag or cross-day movement.Inconclusivelow confidence

Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.

prod, checked Sep 21, 2026, 9:05 PM
Tasks loaded for a teammate's agenda are not upserted into the administrator's personal task store, preventing stale teammate tasks from changing the admin's badges or notifications after switching views.Inconclusivelow confidence

Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.

prod, checked Sep 21, 2026, 9:40 PM
The teammate view hides agenda refill and rerun controls so an administrator cannot accidentally run unscoped actions against their own agenda while viewing someone else's.Inconclusivelow confidence

Strict CloudWatch fallback found 5 prod failure log lines for [UpdateExternalCrmWorkflow] Driver update failed (Value \), but the failure is not tied to this intent.

prod, checked Sep 21, 2026, 9:42 PM
Task-group and board/list grouping queries use the selected target user so an admin sees the teammate's read-only task organization.Inconclusivehigh confidence

Since 2026-09-21T12:35:20Z in production, no direct taskGroups.listGroups span, tRPC route, span attribute, or tied CloudWatch log execution was found. The exact and broader task/group OTEL searches produced no matching procedure telemetry; the only group-related result was 40.

prod, checked Sep 21, 2026, 10:35 PM
Only org admins with the existing administered-user permission model can request another user's tasks or task groups, while unauthorized users remain restricted to their own data.Inconclusivelow confidence

Verification reached its 120s wall-clock budget before a tied verdict. Libra is keeping this intent verifying until the next check.

prod, checked Sep 21, 2026, 10:37 PM
If the task-admin-view feature flag is disabled or revoked, stale administered-user session state is ignored and all document, task, and grouping requests fall back to the caller's own scope.Inconclusivelow confidence

Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.

prod, checked Sep 21, 2026, 10:50 PM

Libra found 2 production surfaces on prod but could not judge any of them yet. 2 surfaces had no requests at all. Libra checks hourly for 3 days after each deploy.

Summary

  • Feature-flagged (cedar-task-admin-view PostHog flag, off by default) picker letting org owners/admins view a teammate's tasks , List, Kanban, and Agenda , reusing the real row/card/column components with every write path removed, rather than a parallel interactive surface.
  • userTasks.listUserTasks and taskGroups.listGroups accept targetUserId, authorized through the existing task:user (SELF_OR_ORG_ADMIN) policy in services/auth/authorize.ts , no policy table changes needed.
  • Agenda required the most care: editor.setEditable(false) alone doesn't stop a keymap-bound transaction from syncing to the teammate's live Y.Doc, so every mutating handler and keyboard shortcut in AgendaTaskNode/DateHeadingNode (8 + 2 handlers) now also checks editor.isEditable directly, and the drag extensions aren't mounted at all while administering.
  • Both read-only views wire useScopeHonoured/ScopeNotHonouredNotice , the existing runtime check (already used by /brain/playbooks) that catches a route silently answering with the caller's own rows instead of the teammate's.

Test plan

  • pnpm --filter @zero/mail run types , clean (only pre-existing unrelated errors in conversationTool.ts)
  • pnpm --filter @zero/server run types , clean (same pre-existing errors)
  • pnpm --filter @zero/mail exec jest tests/modules/administeredUser/contract-coverage.test.ts , 3/3 passing
  • pnpm deps:check , 0 violations
  • Manually traced every addKeyboardShortcuts() handler in AgendaTaskNode.tsx/DateHeadingNode.tsx for the editor.isEditable guard
  • Manual click-through in a running dev app (not done in this session , no browser access)
  • Create the cedar-task-admin-view PostHog flag in prod and roll out to a pilot admin before wider release

🤖 Generated with Claude Code

RetriggerConfidence Score: 4/5

The PR is not yet safe to merge because the teammate task views still silently misrepresent all tasks as Misc when the group query fails, and the explicit inferred-type rule remains unsatisfied.

Findings

  1. P1 Footer mutates wrong agenda ▶
  2. P1 Group loading hides tasks ▶
  3. P2 Assertions bypass inferred types ▶
Fix with agent prompt 
### Issue 1
apps/mail/modules/agentCanvas/components/AgendaDocument.tsx:1601-1603
When an administrator views a teammate's current agenda, this footer remains interactive even though the surface is read-only. Its count query and `agenda.refill`/`agenda.rerun` mutations do not carry `targetUserId`, and both server mutations operate on `ctx.sessionUser.id`. The footer therefore combines the teammate's displayed agenda with the administrator's task count, and clicking “Pull in more” or “Re-execute” unexpectedly modifies the administrator's own agenda. Hide or fully scope these controls while ad
Show production surfaces and changed-file mapping

Production surfaces

SurfaceRequestsErrorsp95UsersVerdict
taskGroups.listGroups0 → 00 → 0 (0%)not measured0No traffic
No requests recorded since this deploy.
userTasks.listUserTasks0 → 00 → 0 (0%)not measured0No traffic
No requests recorded since this deploy.

Changed files → surfaces

  • apps/mail/modules/administeredUser/contract.tsno production surface mapped
  • apps/mail/modules/agentCanvas/components/AgendaDocument.tsxno production surface mapped
  • apps/mail/modules/agentCanvas/components/DateHeadingNode.tsxno production surface mapped
  • apps/mail/modules/agentCanvas/extensions/AgendaTaskNode.tsxno production surface mapped
  • apps/mail/modules/userTasks/components/AdministeredTaskKanban.tsxno production surface mapped
  • apps/mail/modules/userTasks/components/AdministeredTaskList.tsxno production surface mapped
  • apps/mail/modules/userTasks/components/TaskKanbanBoard.tsxno production surface mapped
  • apps/mail/modules/userTasks/components/TaskListView.tsxno production surface mapped
  • apps/mail/modules/userTasks/hooks/use-administered-tasks.tsno production surface mapped
  • apps/mail/modules/userTasks/hooks/use-task-admin-view-flag.tsno production surface mapped
  • apps/mail/modules/userTasks/utils/group-tasks-by-task-group.tsno production surface mapped
  • apps/mail/modules/userTasks/utils/task-due-bucket.tsno production surface mapped
  • apps/mail/tests/modules/agentCanvas/agenda-editor.test.tsno production surface mapped
  • apps/mail/tests/modules/agentCanvas/helpers/agendaTaskHarness.tsxno production surface mapped
  • apps/server/src/services/posthog/posthog.tsno production surface mapped
  • apps/server/src/trpc/routes/__tests__/user-tasks-conversation-scope.test.tsno production surface mapped
  • apps/server/src/trpc/routes/task-groups.tsno production surface mapped
  • apps/server/src/trpc/routes/user-tasks.tsno production surface mapped