CedarCopilot/cedar-mail

Branch: staging

[2026-09-08] merging staging to main

merged#2737CedarCopilot

CedarCopilot wants to merge 1 commit into main from staging

Live on prod, no production signal yetTimeline and evidence

Opened
Sep 8, 2026, 7:58 PM
No findings
Sep 8, 2026, 8:03 PM
Merged
Sep 8, 2026, 8:19 PM
Live on prod
Sep 8, 2026, 8:19 PM
Observed 2 days
Sep 8, 2026, 8:19 PM
Pipelines steady after this deploy
Sep 8, 2026, 8:19 PM
Unobserved
Live on prod, no production signal yet
Sep 11, 2026, 7:43 PM

Behaviors Libra is checking

Conversation reviews dispatch drafter through the shared run-subagent routing path while preserving the dedicated post-event executor behavior.Workingmedium confidence

Post-deploy production telemetry shows 2,831 concrete review-conversation invocations from 2026-09-09T04:02:16Z through 2026-09-11T15:52:49Z. Shared routing produced 1,696 drafter-targeted run-subagent calls and 1,686 dedicated post-event executor events through.

prod, checked Sep 11, 2026, 7:43 PM

When the cedar-automation-model-experiment flag is enabled for configured automation patterns, those runs use the Sol model through the separate automation-sol Understudy workload while unflagged runs retain their existing model path.Inconclusivelow confidence

Verification reached its 130s outer budget before the verifier returned. Libra is keeping this intent verifying until the next check.

prod, checked Sep 11, 2026, 6:43 PM

Each reviewed conversation receives one conversation-scoped execution row, parented to the sweep run, that is reused by routed subagent executions.Inconclusivelow confidence

Unable to complete the production verification: telemetry showed direct `agent_executions` database inserts, but the available results did not expose execution IDs or enough parent/child linkage to establish exactly one review execution per conversation. No verdict was issued.

prod, checked Sep 11, 2026, 7:41 PM

Conversation-review triage excludes crm-updater and strategist from its candidate list, preventing either subagent from being dispatched by the morning review sweep while leaving other trigger types unchanged.Not checked

prod

Conversation reviews dispatch the next-steps subagent through run-subagent and its dedicated NEXT_STEPS_TASKS_TOOLS allowlist instead of the unrestricted generic automation path.Not checked

prod

Review-dispatched next-steps runs receive triggerSource=conversation_update so they do not interpret the review as an event occurrence or require an event payload.Not checked

prod

Failures attributed to this change

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 8, 2026, 8:30 PM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 8, 2026, 8:30 PM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 8, 2026, 8:30 PM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 8, 2026, 8:45 PM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 8, 2026, 9:15 PM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 8, 2026, 9:20 PM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 8, 2026, 9:45 PM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 9, 2026, 2:20 AM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 9, 2026, 5:30 AM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 9, 2026, 3:06 PM

[ERROR] draft.thread_id_unrecoverableIntroducedmedium confidence

unknown

prod, first seen Sep 14, 2026, 2:56 PM

Libra has verdicts on 1 of 16 tracked behaviors on prod; 15 are still being checked. Libra attributed 11 failures to this change at medium confidence and is still confirming them. Libra checks hourly for 3 days after each deploy.

Greptile Summary

This change introduces blocking regressions in document authorization, meeting ingestion, conversation-review dispatch, and CRM configuration rollback. It also adds a TypeScript assertion that violates an explicit repository requirement and must be corrected before merging.

T-Rex validation blocked

The focused CRM rollback reproduction did not complete before the execution environment timed out. The rollback sequence still deletes the field without removing the separately persisted CRM mapping.

Confidence Score: 0/5

Not safe to merge: the authorization bypass, failed meeting ingestion, missing conversation-review work, stale CRM mapping risk, and explicit repository requirement must be addressed first.

Four blocking product failures were identified, including one authorization issue.

Files Needing Attention: apps/server/src/mastra/tools/document/writeDocumentTool.ts; apps/server/src/mastra/tools/meetings/syncMeetingTool.ts; apps/server/src/mastra/tools/event-execution/createAndLinkEventsTool.ts; apps/server/src/services/playbook/playbook-execution-triggers.ts; apps/server/src/mastra/tools/config/config-write-tool.ts

Security Review

File-scoped agents can create organization knowledge-base documents through URL and upload import paths without the normal file-grant authorization.

T-Rex Logs

What T-Rex did

Reviewed the document grant bypass test, its configuration, and the bypass output.
Executed the meeting storage failure test and inspected its output.
Executed the reviewConversation fan-out test script and reviewed the resulting logs.
Attempted the CRM mapping rollback test and its validation, noting the reproduction timed out.
Validated the zero-dispatch behavior in the review flow by running agenda/reviewConversationTool with the playbook execution triggers, using the evidence script and before/after logs.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

General comment

Conversation reviews with only crm-updater and strategist now perform zero work
- Bug
  - The new candidate filter removes both agents before triage. When an account's review block contains only crm-updater and/or strategist, the function returns { path: 'none', dispatches: [] } without invoking the triage classifier or either agent. The executable before/after comparison confirms the prior revision did not satisfy this zero-dispatch behavior while candidate 2 does.
- Cause
  - REVIEW_EXCLUDED_SUBAGENT_NAMES contains crm-updater and strategist, and the filtered-candidates-empty branch returns early in runPlaybookSectionExecution before triage and the dispatch loop.
- Fix
  - Do not merge if conversation reviews are expected to retain CRM field synchronization or strategist/MEDDPICC updates. Provide no-even

Show production surfaces and changed-file mapping

Production surfaces

Libra has not measured any production surfaces for this change yet.

Changed files → surfaces

.claude/skills/account-setup-from-transcript/SKILL.mdno production surface mapped
apps/server/.claude/skills/cedar-configuration/choosing-a-trigger.mdno production surface mapped
apps/server/.claude/skills/cedar-configuration/fields-and-values.mdno production surface mapped
apps/server/.claude/skills/cedar-configuration/playbook-anatomy.mdno production surface mapped
apps/server/docs/design/delegated-dispatch-forcer.mdno production surface mapped
apps/server/src/mastra/agents/automation-agent.tsno production surface mapped
apps/server/src/mastra/index.tsno production surface mapped
apps/server/src/mastra/mcp/external/__tests__/mutating-actions-are-administrable.test.tsno production surface mapped
apps/server/src/mastra/skills/account-config/tools/applyConfigChangeTool.tsno production surface mapped
apps/server/src/mastra/skills/account-config/tools/readConnectionSettingsTool.tsno production surface mapped
apps/server/src/mastra/tools/agenda/__tests__/reviewConversationFanOut.test.tsno production surface mapped
apps/server/src/mastra/tools/config/__tests__/configTool.test.tsno production surface mapped
apps/server/src/mastra/tools/config/config-write-tool.tsno production surface mapped
apps/server/src/mastra/tools/debug/__tests__/debugTool.test.tsno production surface mapped
apps/server/src/mastra/tools/debug/debugTool.tsno production surface mapped
apps/server/src/mastra/tools/document/writeDocumentTool.tsno production surface mapped
apps/server/src/mastra/tools/event-execution/__tests__/createAndLinkEvents-meeting-transcript.test.tsno production surface mapped
apps/server/src/mastra/tools/event-execution/createAndLinkEventsTool.tsno production surface mapped
apps/server/src/mastra/tools/event-execution/runSubagentTool.tsno production surface mapped
apps/server/src/mastra/tools/meetings/__tests__/syncMeetingTool.recorder-grant.test.tsno production surface mapped
apps/server/src/mastra/tools/meetings/__tests__/syncMeetingTool.test.tsno production surface mapped
apps/server/src/mastra/tools/meetings/__tests__/syncMeetingTool.windowing.test.tsno production surface mapped
apps/server/src/mastra/tools/meetings/meetingsTool.tsno production surface mapped
apps/server/src/mastra/tools/meetings/syncMeetingTool.tsno production surface mapped
apps/server/src/mastra/tools/run-sql-query/__tests__/sql-guard.test.tsno production surface mapped
apps/server/src/mastra/tools/subagent-tool-allowlists.tsno production surface mapped
apps/server/src/mastra/tools/task/updateNextStepsAndTasksTool.tsno production surface mapped
apps/server/src/mastra/tools/ui-config/uiConfigTool.tsno production surface mapped
apps/server/src/mastra/workflows/chat/__tests__/agent-bound-chat.test.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/__tests__/delegate-tokens.test.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/__tests__/delegate-tool-scoping.test.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/__tests__/legacy-tool-name-map.test.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/__tests__/resolve-call-agent-id.test.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/delegate-tokens.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/delegate-tool-scoping.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/legacy-tool-name-map.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/mcp-server.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/request-context.tsno production surface mapped
apps/server/src/mastra/workflows/chat/harness/subagents.tsno production surface mapped
apps/server/src/mastra/workflows/chat/run-chat-agent-sdk.tsno production surface mapped
apps/server/src/services/agent-workspace/agent-read.tsno production surface mapped
apps/server/src/services/aop/__tests__/automations-service.test.tsno production surface mapped
apps/server/src/services/aop/__tests__/field-deletion-safety.test.tsno production surface mapped
apps/server/src/services/aop/__tests__/org-custom-fields.test.tsno production surface mapped
apps/server/src/services/aop/__tests__/user-aops.test.tsno production surface mapped
apps/server/src/services/aop/automations.tsno production surface mapped
apps/server/src/services/aop/custom-field-management.tsno production surface mapped
apps/server/src/services/aop/field-deletion-safety.tsno production surface mapped
apps/server/src/services/aop/org-custom-fields.tsno production surface mapped
apps/server/src/services/aop/user-aops.tsno production surface mapped
apps/server/src/services/auth/authorize.tsno production surface mapped
apps/server/src/services/canvas/canvas-crud.test.tsno production surface mapped
apps/server/src/services/canvas/canvas-crud.tsno production surface mapped
apps/server/src/services/crm-sql/sql-guard.tsno production surface mapped
apps/server/src/services/integrations/__tests__/connection-config.test.tsno production surface mapped
apps/server/src/services/integrations/connection-config.tsno production surface mapped
apps/server/src/services/integrations/meetings/provider-ids.tsno production surface mapped
apps/server/src/services/llm/models.tsno production surface mapped
apps/server/src/services/llm/resolve-model.tsno production surface mapped
apps/server/src/services/playbook/__tests__/drafter-review-dispatch.test.tsno production surface mapped
apps/server/src/services/playbook/__tests__/drafter-seed.test.tsno production surface mapped
apps/server/src/services/playbook/__tests__/guarded-write.test.tsno production surface mapped
apps/server/src/services/playbook/__tests__/test-run-subagent.test.tsno production surface mapped
apps/server/src/services/playbook/guarded-write.tsno production surface mapped
apps/server/src/services/playbook/playbook-execution-triggers.tsno production surface mapped
apps/server/src/services/playbook/playbook-webhook-registration.tsno production surface mapped
apps/server/src/services/playbook/test-run-subagent.tsno production surface mapped
apps/server/src/services/posthog/posthog.tsno production surface mapped
apps/server/src/services/users/user-settings.tsno production surface mapped
apps/server/src/trpc/routes/aop.tsno production surface mapped
apps/server/src/trpc/routes/canvas.tsno production surface mapped
aws/scripts/deploy-surface.shno production surface mapped
aws/scripts/deploy-utils.shno production surface mapped