Libra CodeHub

CedarCopilot/cedar-mail

Branch: staging

[2026-09-06] merging staging to main

merged#2709CedarCopilot

CedarCopilot wants to merge 4 commits into main from staging

Not deployedTimeline and evidence
  1. Opened
    Sep 6, 2026, 8:55 PM
  2. No findings
    Sep 6, 2026, 11:18 PM
  3. Merged
    Sep 6, 2026, 11:32 PM
  4. Live on staging, live on prod, observed
    Pending
  5. Not deployed

    Not deployed

    Pending

Libra has no production signal for this change yet because it has not deployed. Libra checks hourly for 3 days after each deploy.

Greptile Summary

This change removes legacy subagent routing guidance from review triage, adds a backfill for that guidance, includes CRM deal details in task-management context, and changes organization-cron representative ranking. It should not merge until the data migration safely preserves existing guidance, rollout covers all stored documents, CRM text is isolated from agent instructions, and Slack ranking uses live connection health.

Confidence Score: 0/5

The change is not safe to merge because it can lose stored routing guidance, let external CRM content influence autonomous mutations, and select unusable Slack delivery identities.

Focused executions reproduced each reported failure in the affected paths, including before-and-after behavior for legacy review guidance and stale Slack selection.

Files Needing Attention: apps/server/src/services/agenda/review-triage.ts, apps/server/src/db/migrations/scripts/migrate-when-to-use-into-description.ts, apps/server/src/mastra/tools/task/linked-crm-deals.ts, and apps/server/src/services/playbook/manifest-utils.ts

Security Review

CRM-controlled deal names and stages are inserted directly into an autonomous task-management prompt. Instruction-shaped CRM content can reach task and conversation mutation capabilities without interactive approval.

T-Rex T-Rex Logs

What T-Rex did

  • T-Rex posted a finding-comment-proof for a P1 finding and attached initial artifacts to support the review context.
  • T-Rex produced additional P1 finding proofs (proofs 1, 2, and 3) and validated them against review comments, with supporting logs and one shell script artifact where relevant.
  • General contract validation confirmed the migration changes, removing older guidance and clarifying scope and backfill requirements.
  • A multiline when-to-use repro was run to verify parsing behavior and showed the updated description persisted without the old when_to_use line.
  • CRM prompt-injection reproduction was executed, with focused outputs showing injectedInstructionPresent true and related tests passing.

View all artifacts

T-Rex Ran code and verified through T-Rex

Comments Outside Diff (4)

  1. General comment

    P1 Legacy subagent trigger conditions are silently removed from review triage without an automatic all-account migration

    • Bug
      • A stored subagent whose routing condition exists only in when_to_use no longer supplies that condition to the review-triage classifier. The executed before/after reproduction used ONLY after a real prospect meeting. Never draft for an inbound email.: it was present before the change and absent after it. Therefore existing user and organisation documents cannot safely remain unmigrated; triage can choose a reviewer without seeing its stored trigger condition.
    • Cause
      • ReviewerCandidate.whenToUse and its prompt concatena
Show production surfaces and changed-file mapping

Production surfaces

Libra has not measured any production surfaces for this change yet.

Changed files → surfaces

  • apps/mail/modules/agents/components/AgentSettingsSection.tsxno production surface mapped
  • apps/server/scripts/cancel-vendor-bucket-tasks.tsno production surface mapped
  • apps/server/src/agent-admin/cli.tsno production surface mapped
  • apps/server/src/db/migrations/scripts/__tests__/migrate-when-to-use-into-description.test.tsno production surface mapped
  • apps/server/src/db/migrations/scripts/migrate-when-to-use-into-description.tsno production surface mapped
  • apps/server/src/mastra/agents/on-event-orchestrator-agent.tsno production surface mapped
  • apps/server/src/mastra/routeHandlers/event-execution/__tests__/handleExecuteExternalCrm.link-field-seed.test.tsno production surface mapped
  • apps/server/src/mastra/routeHandlers/event-execution/__tests__/handleExecuteExternalCrm.test.tsno production surface mapped
  • apps/server/src/mastra/routeHandlers/event-execution/handleExecuteExternalCrm.tsno production surface mapped
  • apps/server/src/mastra/tools/agenda/__tests__/reviewConversationFanOut.test.tsno production surface mapped
  • apps/server/src/mastra/tools/event-execution/runSubagentTool.tsno production surface mapped
  • apps/server/src/mastra/tools/task/__tests__/linked-crm-deals.test.tsno production surface mapped
  • apps/server/src/mastra/tools/task/__tests__/next-steps-preview.readonly.test.tsno production surface mapped
  • apps/server/src/mastra/tools/task/__tests__/next-steps-prompt.test.tsno production surface mapped
  • apps/server/src/mastra/tools/task/__tests__/status-label.test.tsno production surface mapped
  • apps/server/src/mastra/tools/task/linked-crm-deals.tsno production surface mapped
  • apps/server/src/mastra/tools/task/next-steps-preview.tsno production surface mapped
  • apps/server/src/mastra/tools/task/next-steps-prompt.tsno production surface mapped
  • apps/server/src/mastra/tools/task/status-label.tsno production surface mapped
  • apps/server/src/mastra/tools/task/updateNextStepsAndTasksTool.tsno production surface mapped
  • apps/server/src/mastra/utils/context-formatting/conversation-context.tsno production surface mapped
  • apps/server/src/scripts/agent-doc-type-smoke.tsno production surface mapped
  • apps/server/src/scripts/seed-coaching-agent.tsno production surface mapped
  • apps/server/src/services/agenda/review-triage.tsno production surface mapped
  • apps/server/src/services/agent-workspace/__tests__/agent-folders.test.tsno production surface mapped
  • apps/server/src/services/agent-workspace/__tests__/agent-header.test.tsno production surface mapped
  • apps/server/src/services/agent-workspace/agent-create.tsno production surface mapped
  • apps/server/src/services/agent-workspace/agent-header.tsno production surface mapped
  • apps/server/src/services/agent-workspace/agent-read.tsno production surface mapped
  • apps/server/src/services/agent-workspace/types.tsno production surface mapped
  • apps/server/src/services/aop/__tests__/subagent-frontmatter.test.tsno production surface mapped
  • apps/server/src/services/aop/aop-agents.tsno production surface mapped
  • apps/server/src/services/aop/subagent-frontmatter.tsno production surface mapped
  • apps/server/src/services/coaching/agent-template.tsno production surface mapped
  • apps/server/src/services/crm/__tests__/conversations.field-approval-reconcile.test.tsno production surface mapped
  • apps/server/src/services/crm/__tests__/crm-field-sync-full.test.tsno production surface mapped
  • apps/server/src/services/crm/__tests__/crm-pull-refresh.field-seed.test.tsno production surface mapped
  • apps/server/src/services/crm/crm-pull-refresh.tsno production surface mapped
  • apps/server/src/services/documents/__tests__/doc-type-registry.test.tsno production surface mapped
  • apps/server/src/services/documents/playbook-resource-seeds.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/author-subagent.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/curated-agenda-migration.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/drafter-seed.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/frontmatter-grants.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/golden-output-regression.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/org-cron-representative.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/playbook-renderers.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/reference-resolver.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/subagent-frontmatter.test.tsno production surface mapped
  • apps/server/src/services/playbook/__tests__/verify-subagent-doc.test.tsno production surface mapped
  • apps/server/src/services/playbook/agent-defaults/index.tsno production surface mapped
  • apps/server/src/services/playbook/author-subagent.tsno production surface mapped
  • apps/server/src/services/playbook/get-playbook-section.tsno production surface mapped
  • apps/server/src/services/playbook/manifest-utils.tsno production surface mapped
  • apps/server/src/services/playbook/playbook-execution-triggers.tsno production surface mapped
  • apps/server/src/services/playbook/playbook-renderers.tsno production surface mapped
  • apps/server/src/services/playbook/reference-resolver.tsno production surface mapped
  • apps/server/src/services/playbook/resolve-playbook-context.tsno production surface mapped
  • apps/server/src/services/playbook/seed-playbook.tsno production surface mapped
  • apps/server/src/services/playbook/subagent-frontmatter.tsno production surface mapped
  • apps/server/src/services/playbook/templates/__tests__/inbound-email-notifier.test.tsno production surface mapped
  • apps/server/src/services/playbook/templates/inbound-email-notifier.tsno production surface mapped
  • apps/server/src/services/playbook/verify-subagent-doc.tsno production surface mapped
  • apps/server/src/subagent-admin/cli.tsno production surface mapped
  • apps/server/src/trpc/routes/__tests__/agent-router-auth.test.tsno production surface mapped
  • apps/server/src/trpc/routes/admin-subagent.tsno production surface mapped
  • apps/server/src/trpc/routes/agent.tsno production surface mapped
  • apps/server/src/trpc/routes/aop.tsno production surface mapped
  • apps/server/tests/scripts/cancel-vendor-bucket-tasks-selection.test.tsno production surface mapped
  • docs/design/f8-agent-log.mdno production surface mapped