274 files changed

Libra does not show diffs here. View the full diff on GitHub.

• modified.claude/skills/account-setup-from-transcript/SKILL.md+305-3
• removed.cursor/skills/account-setup-from-transcript/SKILL.md+0-3356
• modified.dependency-cruiser.cjs+79-0
• modified.github/workflows/ci.yml+13-0
• modified.github/workflows/prod-deploy.yml+10-0
• modified.github/workflows/staging-deploy.yml+10-0
• modifiedAGENTS.md+2-2
• modifiedAWS_DOCUMENTATION.md+1-0
• modifiedapps/mail/app/(routes)/agents/playbook/page.tsx+11-5
• modifiedapps/mail/app/(routes)/brain/playbooks/chat-agent/page.tsx+5-1
• modifiedapps/mail/app/(routes)/brain/playbooks/page.tsx+55-8
• modifiedapps/mail/app/(routes)/brain/playbooks/routing/page.tsx+26-4
• modifiedapps/mail/app/(routes)/playground/components/PlaybookEditor.tsx+6-0
• modifiedapps/mail/app/(routes)/playground/components/UserSettingsEditor.tsx+0-30
• modifiedapps/mail/app/(routes)/playground/notification-test.tsx+47-131
• modifiedapps/mail/app/(routes)/settings/appearance/page.tsx+25-4
• modifiedapps/mail/app/(routes)/settings/danger-zone/page.tsx+13-0
• modifiedapps/mail/app/(routes)/settings/general/page.tsx+75-32
• modifiedapps/mail/app/(routes)/settings/notifications/page.tsx+79-97
• modifiedapps/mail/app/(routes)/settings/security/page.tsx+33-8
• modifiedapps/mail/app/(routes)/settings/signature/page.tsx+18-5
• modifiedapps/mail/messages/en.json+80-16
• addedapps/mail/modules/administeredUser/components/AdminNotice.tsx+51-0
• addedapps/mail/modules/administeredUser/components/AdministeredUserBanner.tsx+46-0
• addedapps/mail/modules/administeredUser/components/AdministeredUserBar.tsx+45-0
• addedapps/mail/modules/administeredUser/components/AdministeredUserPicker.tsx+179-0
• addedapps/mail/modules/administeredUser/components/DocumentOwnerBanner.tsx+109-0
• addedapps/mail/modules/administeredUser/components/ScopeNotHonouredNotice.tsx+66-0
• addedapps/mail/modules/administeredUser/context.tsx+220-0
• addedapps/mail/modules/administeredUser/contract.ts+188-0
• addedapps/mail/modules/administeredUser/hooks/use-org-admin-access.ts+43-0
• addedapps/mail/modules/administeredUser/index.ts+19-0
• addedapps/mail/modules/administeredUser/permission-error.ts+24-0
• modifiedapps/mail/modules/aop/components/ActionQueueView.tsx+12-4
• modifiedapps/mail/modules/aop/components/AgentDocHeader.tsx+22-3
• modifiedapps/mail/modules/aop/components/AgentFieldsCallout.tsx+13-3
• modifiedapps/mail/modules/aop/components/CrmAgentConfigPanel.tsx+17-3
• modifiedapps/mail/modules/aop/components/PlaybookSettingsPanel.tsx+19-7
• modifiedapps/mail/modules/aop/components/StrategicOverviewConfigPanel.tsx+13-3
• modifiedapps/mail/modules/aop/hooks/use-aops.ts+7-2
• modifiedapps/mail/modules/brain/components/AopManageDialogs.tsx+11-6
• modifiedapps/mail/modules/brain/components/PlaybookAopSection.tsx+17-3
• modifiedapps/mail/modules/brain/components/PlaybookFileTree.tsx+11-1
• modifiedapps/mail/modules/cedar-os/__tests__/__mocks__/auth-client.ts+11-4
• modifiedapps/mail/modules/company/components/CompanyExplorer.tsx+40-7
• modifiedapps/mail/modules/conversations/components/ConversationSearchCommandBar.tsx+5-1
• modifiedapps/mail/modules/documents/playbook/CompositePlaybookDocument.tsx+23-9
• modifiedapps/mail/modules/documents/playbook/PlaybookDocument.tsx+45-4
• modifiedapps/mail/modules/documents/playbook/PlaybookDocumentCreateDialog.tsx+8-0
• modifiedapps/mail/modules/documents/playbook/PlaybookStageNode.tsx+5-3
• modifiedapps/mail/modules/documents/playbook/PlaybookTriggerNode.tsx+5-3
• modifiedapps/mail/modules/documents/playbook/SubagentCreateDialog.tsx+7-1
• modifiedapps/mail/modules/documents/playbook/TriggerNode.tsx+6-3
• modifiedapps/mail/modules/documents/playbook/WebhookTriggerPanel.tsx+14-4
• modifiedapps/mail/modules/documents/playbook/playbookExtensions.ts+14-5
• modifiedapps/mail/modules/documents/playbook/structure/index.tsx+6-4
• modifiedapps/mail/modules/documents/playbook/useDocumentCreation.tsx+4-0
• modifiedapps/mail/modules/documents/playbook/usePlaybookAop.ts+13-2
• modifiedapps/mail/modules/documents/playbook/useSubagentCreation.tsx+10-1
• modifiedapps/mail/modules/home/components/DisplayArtifactPanel.tsx+11-1
• modifiedapps/mail/modules/userSettings/hooks/use-settings.ts+30-0
• modifiedapps/mail/providers/client-providers.tsx+22-19
• addedapps/mail/tests/modules/administeredUser/contract-coverage.test.ts+174-0
• addedapps/mail/tests/modules/administeredUser/permission-error.test.ts+48-0
• addedapps/mail/tests/modules/administeredUser/scope-not-honoured-notice.test.tsx+62-0
• modifiedapps/mail/tests/modules/conversations/conversationSearchFilterRow.test.tsx+1-1
• addedapps/mail/tests/modules/playbook/playbook-document-owner.test.tsx+103-0
• modifiedapps/server/.claude/skills/cedar-configuration/SKILL.md+18-12
• modifiedapps/server/.claude/skills/cedar-configuration/cedar-system-knowledge.md+18-0
• modifiedapps/server/.claude/skills/cedar-configuration/playbook-design.md+3-3
• modifiedapps/server/.claude/skills/playbook-authoring/SKILL.md+77-1
• modifiedapps/server/.claude/skills/playbook-instruction-eval/live-thread-search-eval.ts+27-12
• modifiedapps/server/.claude/skills/sherlock/SHERLOCK_SYSTEM_KNOWLEDGE.md+1-1
• modifiedapps/server/.claude/skills/tasks/SKILL.md+4-0
• modifiedapps/server/scripts/backfill-drafter.ts+290-36
• addedapps/server/scripts/drafting-health.ts+136-0
• modifiedapps/server/scripts/lib/backfill-cli-utils.ts+49-0
• addedapps/server/scripts/stage4-plan.ts+157-0
• addedapps/server/scripts/verify-drafter-migration.ts+138-0
• modifiedapps/server/src/db/migrations/scripts/account-setup/__tests__/phase9-notifications.test.ts+3-4
• modifiedapps/server/src/db/migrations/scripts/account-setup/phase9-notifications.ts+7-4
• modifiedapps/server/src/lib/__tests__/cedar-routes.test.ts+67-1
• modifiedapps/server/src/lib/cedar-routes.ts+91-13
• modifiedapps/server/src/lib/schemas.ts+11-8
• modifiedapps/server/src/mastra/agents/on-event-execution-agent.ts+17-9
• modifiedapps/server/src/mastra/agents/on-event-orchestrator-agent.ts+27-7
• addedapps/server/src/mastra/mcp/external/__tests__/flat-args.test.ts+211-0
• addedapps/server/src/mastra/mcp/external/__tests__/mutating-actions-are-administrable.test.ts+257-0
• addedapps/server/src/mastra/mcp/external/__tests__/no-bare-user-id-inputs.test.ts+248-0
• modifiedapps/server/src/mastra/mcp/external/__tests__/scope-map.test.ts+97-0
• addedapps/server/src/mastra/mcp/external/flat-args.ts+106-0
• modifiedapps/server/src/mastra/mcp/external/scope-map.ts+116-29
• modifiedapps/server/src/mastra/mcp/external/server.ts+32-9
• addedapps/server/src/mastra/skills/__tests__/automation-skill-tools.test.ts+52-0
• addedapps/server/src/mastra/skills/account-config/__tests__/allowlist-splice.test.ts+62-0
• addedapps/server/src/mastra/skills/account-config/__tests__/cedar-configuration-docs.test.ts+90-0
• addedapps/server/src/mastra/skills/account-config/__tests__/contextual-instructions.test.ts+265-0
• modifiedapps/server/src/mastra/skills/account-config/contextual-instructions.ts+149-7
• modifiedapps/server/src/mastra/skills/account-config/index.ts+26-14
• modifiedapps/server/src/mastra/skills/account-config/tools/__tests__/apply-systems-change.test.ts+54-23
• modifiedapps/server/src/mastra/skills/account-config/tools/__tests__/applyConfigChangeTool.test.ts+113-4
• addedapps/server/src/mastra/skills/account-config/tools/__tests__/get-sent-emails-authorization.test.ts+247-0
• addedapps/server/src/mastra/skills/account-config/tools/__tests__/read-connection-settings-authorization.test.ts+322-0
• modifiedapps/server/src/mastra/skills/account-config/tools/apply-systems-change.ts+41-17
• modifiedapps/server/src/mastra/skills/account-config/tools/applyConfigChangeTool.ts+152-45
• modifiedapps/server/src/mastra/skills/account-config/tools/getSentEmailsTool.ts+73-8
• modifiedapps/server/src/mastra/skills/account-config/tools/readConnectionSettingsTool.ts+41-5
• modifiedapps/server/src/mastra/skills/index.ts+46-0
• modifiedapps/server/src/mastra/tools/__tests__/drafting-executor-live-mail-grant.test.ts+38-2
• modifiedapps/server/src/mastra/tools/__tests__/tool-grant.test.ts+13-0
• modifiedapps/server/src/mastra/tools/config/__tests__/configTool.test.ts+213-38
• addedapps/server/src/mastra/tools/config/__tests__/configureStrategistTool.test.ts+120-0
• addedapps/server/src/mastra/tools/config/__tests__/listOrgMembers.test.ts+270-0
• modifiedapps/server/src/mastra/tools/config/__tests__/workspaceWriteTool.test.ts+68-11
• modifiedapps/server/src/mastra/tools/config/config-read-tool.ts+98-9
• modifiedapps/server/src/mastra/tools/config/config-tool-shared.ts+9-0
• modifiedapps/server/src/mastra/tools/config/config-write-tool.ts+160-89
• modifiedapps/server/src/mastra/tools/config/configTool.ts+64-25
• modifiedapps/server/src/mastra/tools/config/configureStrategistTool.ts+36-3
• addedapps/server/src/mastra/tools/config/connection-write-tool.ts+102-0
• modifiedapps/server/src/mastra/tools/config/systems-write-tool.ts+9-3
• modifiedapps/server/src/mastra/tools/config/workspace-write-tool.ts+26-12
• addedapps/server/src/mastra/tools/document/__tests__/document-redirect-authorization.test.ts+474-0
• modifiedapps/server/src/mastra/tools/document/__tests__/documentTool.test.ts+198-0
• modifiedapps/server/src/mastra/tools/document/__tests__/readDocumentTool.by-id.test.ts+3-2
• modifiedapps/server/src/mastra/tools/document/__tests__/writeDocumentTool.test.ts+6-3
• modifiedapps/server/src/mastra/tools/document/displayDocumentTool.ts+13-2
• modifiedapps/server/src/mastra/tools/document/documentTool.ts+182-22
• modifiedapps/server/src/mastra/tools/document/listDocumentsTool.ts+19-7
• modifiedapps/server/src/mastra/tools/document/readDocumentTool.ts+16-2
• modifiedapps/server/src/mastra/tools/document/writeDocumentTool.ts+44-31
• modifiedapps/server/src/mastra/tools/event-execution/__tests__/draft-tools-sibling-guard.test.ts+0-6
• modifiedapps/server/src/mastra/tools/event-execution/__tests__/drafter-executor-prompt.test.ts+26-3
• modifiedapps/server/src/mastra/tools/event-execution/onEventExecutionDraftEmailTool.ts+0-36
• modifiedapps/server/src/mastra/tools/event-execution/onEventExecutionDraftSlackTool.ts+5-53
• modifiedapps/server/src/mastra/tools/event-execution/orchestrator-dispatch-tools.ts+48-2
• modifiedapps/server/src/mastra/tools/family-tool-names.ts+21-1
• modifiedapps/server/src/mastra/tools/mail/__tests__/liveMailTools.test.ts+51-6
• modifiedapps/server/src/mastra/tools/mail/__tests__/mailTool.live-actions.test.ts+5-2
• modifiedapps/server/src/mastra/tools/mail/__tests__/mailTool.test.ts+6-0
• modifiedapps/server/src/mastra/tools/mail/mailTool.ts+16-6
• modifiedapps/server/src/mastra/tools/mail/readLiveThreadTool.ts+24-8
• modifiedapps/server/src/mastra/tools/subagent-tool-allowlists.ts+1-1
• modifiedapps/server/src/mastra/tools/task/__tests__/taskTool.test.ts+111-15
• modifiedapps/server/src/mastra/tools/task/listTasksTool.ts+50-29
• modifiedapps/server/src/mastra/tools/task/taskTool.ts+125-62
• modifiedapps/server/src/mastra/tools/ui-config/__tests__/uiConfigTool.test.ts+96-5
• modifiedapps/server/src/mastra/tools/ui-config/uiConfigTool.ts+19-1
• modifiedapps/server/src/mastra/utils/__tests__/target-user-scope.test.ts+80-24
• modifiedapps/server/src/mastra/utils/approval-policy.ts+6-1
• modifiedapps/server/src/mastra/utils/target-user-scope.ts+72-26
• addedapps/server/src/services/agent-action-queue/__tests__/execution-read-scope.test.ts+278-0
• modifiedapps/server/src/services/agent-action-queue/queries.ts+85-6
• modifiedapps/server/src/services/aop/__tests__/automations-service.test.ts+9-1
• addedapps/server/src/services/aop/__tests__/custom-field-management-ownership.test.ts+242-0
• modifiedapps/server/src/services/aop/__tests__/custom-field-management.test.ts+5-110
• modifiedapps/server/src/services/aop/automations.ts+9-1
• modifiedapps/server/src/services/aop/custom-field-management.ts+48-32
• addedapps/server/src/services/auth/__tests__/authorize.test.ts+1047-0
• removedapps/server/src/services/auth/__tests__/org-access.test.ts+0-75
• addedapps/server/src/services/auth/__tests__/role-reads-confined-to-authority.test.ts+406-0
• addedapps/server/src/services/auth/__tests__/target-user-id-reaches-the-authority.test.ts+372-0
• addedapps/server/src/services/auth/authorize.ts+526-0
• removedapps/server/src/services/auth/org-access.ts+0-53
• addedapps/server/src/services/crm/__tests__/company-merge-authorization.test.ts+224-0
• modifiedapps/server/src/services/crm/__tests__/conversation-members.test.ts+143-32
• addedapps/server/src/services/crm/__tests__/strategic-catalog-authorization.test.ts+278-0
• modifiedapps/server/src/services/crm/company-merge.ts+37-25
• modifiedapps/server/src/services/crm/conversation-members.ts+56-15
• modifiedapps/server/src/services/crm/overview-instance.ts+183-1
• modifiedapps/server/src/services/documents/__tests__/playbook-doctype.test.ts+21-1
• modifiedapps/server/src/services/documents/convention-paths.ts+29-0
• modifiedapps/server/src/services/documents/triggers/board-webhooks.ts+12-3
• addedapps/server/src/services/integrations/crm/__tests__/salesforce-owner-emails.test.ts+176-0
• modifiedapps/server/src/services/integrations/crm/salesforce.ts+83-0
• removedapps/server/src/services/notifications/__tests__/post-meeting-draft-recipient-warning.test.ts+0-37
• modifiedapps/server/src/services/notifications/__tests__/user-whatsapp-notifier.test.ts+10-24
• removedapps/server/src/services/notifications/notification-dispatcher.ts+0-106
• modifiedapps/server/src/services/notifications/types.ts+9-32
• modifiedapps/server/src/services/notifications/user-imessage-notifier.ts+5-29
• removedapps/server/src/services/notifications/user-notification-registry.ts+0-179
• modifiedapps/server/src/services/notifications/user-slack-notifier.ts+58-232
• modifiedapps/server/src/services/notifications/user-whatsapp-notifier.ts+14-44
• modifiedapps/server/src/services/organizations/__tests__/org-admin.test.ts+12-62
• addedapps/server/src/services/organizations/members.ts+64-0
• modifiedapps/server/src/services/organizations/org-admin.ts+13-65
• modifiedapps/server/src/services/playbook/__tests__/drafter-seed.test.ts+4-3
• modifiedapps/server/src/services/playbook/__tests__/guarded-write.test.ts+128-11
• modifiedapps/server/src/services/playbook/__tests__/playbook-webhook-registration.test.ts+9-6
• addedapps/server/src/services/playbook/__tests__/trigger-summary.test.ts+71-0
• modifiedapps/server/src/services/playbook/agent-defaults/__tests__/agent-defaults.test.ts+4-3
• modifiedapps/server/src/services/playbook/agent-defaults/drafter.ts+105-8
• modifiedapps/server/src/services/playbook/agent-defaults/index.ts+13-6
• modifiedapps/server/src/services/playbook/backfill/__tests__/drafter-migration.test.ts+375-7
• addedapps/server/src/services/playbook/backfill/__tests__/drafter-notify-patch.test.ts+421-0
• addedapps/server/src/services/playbook/backfill/__tests__/drafting-policy.test.ts+595-0
• addedapps/server/src/services/playbook/backfill/__tests__/gate-prose-proposal.test.ts+158-0
• modifiedapps/server/src/services/playbook/backfill/__tests__/label-rules-cleanup.test.ts+2-4
• addedapps/server/src/services/playbook/backfill/__tests__/stage4-plan.test.ts+188-0
• addedapps/server/src/services/playbook/backfill/cross-cutting-sections.ts+131-0
• addedapps/server/src/services/playbook/backfill/cross-cutting.ts+66-0
• modifiedapps/server/src/services/playbook/backfill/drafter-migration.ts+482-50
• addedapps/server/src/services/playbook/backfill/drafter-notify-patch.ts+524-0
• addedapps/server/src/services/playbook/backfill/drafter-notify-prior.ts+68-0
• addedapps/server/src/services/playbook/backfill/drafting-policy.ts+815-0
• addedapps/server/src/services/playbook/backfill/gate-prose-proposal.ts+383-0
• modifiedapps/server/src/services/playbook/backfill/label-rules-cleanup.ts+2-141
• modifiedapps/server/src/services/playbook/backfill/prose-compare.ts+40-0
• addedapps/server/src/services/playbook/backfill/stage4-plan.ts+521-0
• modifiedapps/server/src/services/playbook/guarded-write.ts+23-4
• addedapps/server/src/services/playbook/playbook-path-access.ts+154-0
• modifiedapps/server/src/services/playbook/playbook-webhook-registration.ts+76-14
• modifiedapps/server/src/services/playbook/seed-playbook.ts+21-13
• addedapps/server/src/services/playbook/trigger-summary.ts+75-0
• modifiedapps/server/src/services/playbook/write-document-guarded.ts+9-2
• modifiedapps/server/src/services/users/__tests__/categorized-key-access.test.ts+27-1
• addedapps/server/src/services/users/__tests__/staff-only-agent-execution.test.ts+278-0
• modifiedapps/server/src/services/users/__tests__/user-settings-merge.test.ts+6-3
• modifiedapps/server/src/services/users/__tests__/user-settings.test.ts+8-4
• addedapps/server/src/services/users/staff-only-settings.ts+135-0
• modifiedapps/server/src/services/users/user-settings.ts+22-2
• addedapps/server/src/trpc/assert-actor.ts+87-0
• addedapps/server/src/trpc/routes/__tests__/admin-agent-toggles-staff-gate.test.ts+239-0
• addedapps/server/src/trpc/routes/__tests__/admin-crm-sync-staff-gate.test.ts+353-0
• addedapps/server/src/trpc/routes/__tests__/admin-data-subrouter-target-gate.test.ts+244-0
• addedapps/server/src/trpc/routes/__tests__/admin-integrity-account-health-staff-gate.test.ts+332-0
• addedapps/server/src/trpc/routes/__tests__/admin-router-target-gate.test.ts+160-0
• addedapps/server/src/trpc/routes/__tests__/admin-subrouter-target-gate.test.ts+245-0
• addedapps/server/src/trpc/routes/__tests__/agent-action-queue-execution-scope.test.ts+708-0
• modifiedapps/server/src/trpc/routes/__tests__/analytics-guard.test.ts+50-17
• addedapps/server/src/trpc/routes/__tests__/aop-agents-list-scope.test.ts+288-0
• modifiedapps/server/src/trpc/routes/__tests__/aop-agents-router.test.ts+14-5
• addedapps/server/src/trpc/routes/__tests__/aop-create-playbook-document-owner.test.ts+243-0
• addedapps/server/src/trpc/routes/__tests__/aop-list-scope.test.ts+236-0
• addedapps/server/src/trpc/routes/__tests__/aop-sent-email-scope.test.ts+295-0
• addedapps/server/src/trpc/routes/__tests__/aop-staff-delegation.test.ts+207-0
• modifiedapps/server/src/trpc/routes/__tests__/credential-vault-org-admin.test.ts+20-4
• addedapps/server/src/trpc/routes/__tests__/crm-owner-reassignment-authority.test.ts+231-0
• modifiedapps/server/src/trpc/routes/__tests__/files-restore-node.test.ts+26-2
• modifiedapps/server/src/trpc/routes/__tests__/files-router-auth.test.ts+184-4
• addedapps/server/src/trpc/routes/__tests__/files-router-permission-request.test.ts+293-0
• modifiedapps/server/src/trpc/routes/__tests__/integrations-mcp-delete.test.ts+18-3
• modifiedapps/server/src/trpc/routes/__tests__/integrations-mcp-org-scope.test.ts+7-2
• modifiedapps/server/src/trpc/routes/__tests__/settings-router.test.ts+238-23
• modifiedapps/server/src/trpc/routes/__tests__/user-tasks-conversation-scope.test.ts+12-1
• modifiedapps/server/src/trpc/routes/admin-account-health.ts+48-6
• modifiedapps/server/src/trpc/routes/admin-boards.ts+5-1
• modifiedapps/server/src/trpc/routes/admin-crm-sync.ts+94-8
• modifiedapps/server/src/trpc/routes/admin-email-analysis.ts+25-0
• modifiedapps/server/src/trpc/routes/admin-integrity.ts+76-14
• modifiedapps/server/src/trpc/routes/admin-notifications.ts+26-75
• modifiedapps/server/src/trpc/routes/admin.ts+207-59
• modifiedapps/server/src/trpc/routes/agent-action-queue.ts+214-30
• modifiedapps/server/src/trpc/routes/analytics-access.ts+26-11
• modifiedapps/server/src/trpc/routes/analytics.ts+4-4
• modifiedapps/server/src/trpc/routes/aop-agents.ts+117-18
• modifiedapps/server/src/trpc/routes/aop.ts+520-234
• modifiedapps/server/src/trpc/routes/cedar-admin.ts+6-1
• modifiedapps/server/src/trpc/routes/crm.ts+22-19
• modifiedapps/server/src/trpc/routes/documents.ts+63-13
• modifiedapps/server/src/trpc/routes/files.ts+164-57
• modifiedapps/server/src/trpc/routes/integrations.ts+21-53
• modifiedapps/server/src/trpc/routes/org-admin.ts+46-6
• modifiedapps/server/src/trpc/routes/organisation.ts+11-24
• modifiedapps/server/src/trpc/routes/settings.ts+184-102
• modifiedapps/server/src/trpc/routes/statistics.ts+44-45
• modifiedaws/docs/staging-deploy.md+16-0
• addedaws/scripts/__tests__/plan-surface-scope.test.sh+196-0
• addedaws/scripts/last-deployed-sha.sh+100-0
• modifiedaws/scripts/plan-surface-scope.sh+107-28
• modifieddocs/changelogs/2026-W36.md+56-0
• addeddocs/design/admin-config-permissions-revamp.md+1027-0
• modifieddocs/design/drafter-system-agent.md+234-1
• modifieddocs/testing/phase4-manual-test-guide.md+7-2