Libra CodeHub

CedarCopilot/cedar-mail

Branch: staging

fix(aop): seed Strategist strategic-overview fields on org-template init

merged#2533CedarCopilot

CedarCopilot wants to merge 0 commits into staging from fix/seed-strategist-overview-fields

Live on prod, no production signal yetTimeline and evidence
  1. Opened
    Aug 20, 2026, 3:15 PM
  2. Merged
    Aug 20, 2026, 6:24 PM
  3. Live on prod
    Aug 20, 2026, 6:24 PM
  4. Observed 36 hours
    Aug 20, 2026, 6:24 PM
  5. Pipelines steady after this deploy
    Aug 20, 2026, 6:24 PM
  6. Unobserved

    Live on prod, no production signal yet

    Aug 22, 2026, 6:20 AM

Behaviors Libra is checking

AOP context behavior from aop/user-aops.ts keeps working in prod.Inconclusivelow confidence

Strict CloudWatch fallback saw 1,974 success-shaped log lines matching pipeline, analytics, quota, aop, but no tied operation was present, so Libra is not calling this working.

prod, checked Aug 22, 2026, 3:20 AM
Authentication and access behavior from lib/auth.ts keeps working in prod.Inconclusivelow confidence

Strict CloudWatch fallback saw 71 setup or missing-connection failure log lines matching auth, login, session, token, but that does not prove the deployed behavior is broken for connected users.

prod, checked Aug 22, 2026, 4:20 AM
CRM integration behavior from account-setup/<id>.ts keeps working in prod.Inconclusivelow confidence

Strict CloudWatch fallback found 84 recent prod failure log lines for [UpdateExternalCrmWorkflow] Driver update failed (Step updateOpportunityField failed: HTTP 400: [{\), but the same failure had 136 log lines in the comparable pre-deploy baseline. Libra is not blaming this PR.

prod, checked Aug 22, 2026, 5:20 AM
Data model behavior from scripts/rollout-strategist-overview.ts keeps working in prod.Inconclusivelow confidence

Strict CloudWatch fallback found 2 recent prod failure log lines for [executeExternalCrm] Deal owner reassignment failed (non-critical) (Target user is already the owner), but the same failure had 1 log lines in the comparable pre-deploy baseline. Libra is not blaming this PR.

prod, checked Aug 22, 2026, 6:20 AM

Libra has verdicts on 0 of 4 tracked behaviors on prod; 4 are still being checked. Libra checks hourly for 3 days after each deploy.

Problem

The Strategist system agent owns the strategic-overview scorecard , the 8 MEDDPICC fields plus on_track/forecast/the_play/how_we_win/risks. But those fields are only seeded by seedDefaultStandaloneAops (the auth signup hook + a one-off migration).

Org-template initialization , the playground's "Initialize from Org" (initializeUserFromOrgTemplates) and the account-setup onboarding scripts (phase1b-init-user-aops.ts) , builds each rep's Deals AOP straight from the org AOP's customFieldDefinitions, which don't include the strategic-overview seed. org-aops.ts never references it. So a white-glove-onboarded org gets the Strategist agent + <ref> wired up, but its owned fields never get created , the MEDDPICC tab renders a layout with nothing behind it, and the agent has nowhere to write.

Fix

Extract one idempotent, additive gap-fill helper and run it on every org-template init path:

  • services/aop/user-aops.ts , new ensureDealsStrategicOverviewSeed(db, userId): gap-fills the strategic-overview fields + tab layout onto an existing Deals AOP. Reuses computeStrategicSeedGapFill; never overwrites a rep's edits; no-ops when present; never creates a stray AOP.
  • services/organizations/organizations.ts , initializeUserFromOrgTemplates calls it after AOP init, so the playground path and any runtime caller are self-sufficient rather than relying on a separate follow-up.
  • account-setup/phase1b-init-user-aops.ts , calls it after the AOP loop, so future white-glove onboardings are correct by construction.
  • rollout-strategist-overview.ts , adds a BACKFILL_EMAILS env allowlist to scope the existing repair to a known-affected set.

Backfill (already run)

Audited all users with agent_settings->>'agentExecutionEnabled' = true (excludes legacy users). 12 users across 6 orgs were affected and have been backfilled via rollout-strategist-overview.ts (idempotent; strategist <ref> was already present for all , only fields/layout + ownership were added):

OrgReps
Aspirealyssa.reese, emily.trapasso, jacob.doty, shawn, zachary.zander
Voomajason, jtaylor
Pirroskeenan, xander
Pax AItrey
Understudy Labsluis
Fractional AIvarun

Post-backfill re-audit: 0 agent-exec users still missing the fields.

Test plan

  • ensureDealsStrategicOverviewSeed is a thin wrapper over the already-tested computeStrategicSeedGapFill (idempotent, additive).
  • Backfill dry-run + real run verified against the DB (all 12 now carry all 8 MEDDPICC + the_play + layout).
  • Server typecheck.

šŸ¤– Generated with Claude Code

Greptile Summary

This PR adds an additive strategic-overview gap-fill to the runtime and account-setup org-template initialization paths and adds email allowlist scoping to the rollout script.

  • Adds ensureDealsStrategicOverviewSeed for existing Deals AOPs.
  • Invokes the helper after runtime and scripted org-template provisioning.
  • Adds BACKFILL_EMAILS scoping to the existing rollout script.

Confidence Score: 3/5

The PR should not merge until the stale-snapshot update and case-sensitive allowlist filtering are corrected.

The new gap-fill can overwrite a concurrent AOP edit, and the rollout allowlist can silently skip a valid target when the supplied email casing differs from the stored value.

Files Needing Attention: apps/server/src/services/aop/user-aops.ts; apps/server/src/db/migrations/scripts/rollout-strategist-overview.ts

Important Files Changed

FilenameOverview
apps/server/src/services/aop/user-aops.tsAdds the strategic-overview gap-fill helper, but its non-atomic snapshot write can replace edits made concurrently.
apps/server/src/services/organizations/organizations.tsCalls the new helper after org AOP initialization; the added import violates the absolute-i
Show production surfaces and changed-file mapping

Production surfaces

Libra has not measured any production surfaces for this change yet.

Changed files → surfaces

  • apps/server/src/db/migrations/scripts/account-setup/phase1b-init-user-aops.tsno production surface mapped
  • apps/server/src/db/migrations/scripts/rollout-strategist-overview.tsno production surface mapped
  • apps/server/src/lib/auth.tsno production surface mapped
  • apps/server/src/services/aop/user-aops.tsno production surface mapped
  • apps/server/src/services/organizations/organizations.tsno production surface mapped