[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Adds first-class org-custom frameworks and requirements, and lets you link policies, tasks, requirements, and required evidence types to controls in a new Documents tab. Updates scoring to use submission time, ignores controls without artifacts, hardens multi-tenant safety, removes control-template auto-linking, and fixes policy alerts when a pending version is cleared.

• New Features

  • Create custom frameworks and requirements (new APIs + sheets).
  • Link policies, tasks, requirements, and evidence form types to a control; manage in a new Documents tab.
  • Map controls to platform or org-custom requirements on create/link.
  • Framework pages: add/link requirements and link existing controls; lists/search/compliance include custom frameworks.
  • Scoring respects required document types, uses EvidenceSubmission.submittedAt, and excludes controls with no artifacts.
  • UX polish: org-scoped cache in control options (useApiSWR), requirement sheet resets on close.
  • Control template create no longer auto-links framework requirements; removed frameworkId param and added a regression test.

• Migration

  • Split per-org data into CustomFramework and CustomRequirement; FrameworkInstance/RequirementMap support platform or custom IDs.
  • Composite FKs enforce tenant consistency; DB checks require exactly one of each ID pair.
  • Existing org data is migrated and references repointed.
  • Step: run database migrations before deploy; no manual data steps required.

^{Written for commit a7389a1. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Apr 20, 2026 5:37pm
comp-framework-editor	Canceled		Apr 20, 2026 5:37pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal (staging)	Skipped		Apr 20, 2026 5:37pm

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ carhartlewis
❌ Lewis Carhart

---

Lewis Carhart seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cubic-dev-ai]

3 issues found across 64 files

Note: This PR contains a large number of files. During the trial, cubic reviews up to 50 files per PR. Paid plans get a higher limit.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/controls/[controlId]/components/useControlOptions.ts">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/controls/[controlId]/components/useControlOptions.ts:33">
P1: This hook uses raw `useSWR` instead of the project's `useApiSWR` wrapper, which scopes the SWR cache key by organization ID. Without org scoping, switching organizations will return stale cached control options from the previous org.

Use `useApiSWR` from `@/hooks/use-api-swr` to stay consistent with the rest of the codebase and get automatic org-scoped cache invalidation.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/AddCustomRequirementSheet.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/AddCustomRequirementSheet.tsx:46">
P2: Form state is not reset when the sheet is closed without submitting. The sibling `LinkRequirementSheet` handles this via a `useEffect` that clears state on close. Add a similar effect here so reopening the sheet always shows a clean form.</violation>
</file>

<file name="apps/api/src/frameworks/frameworks-scores.helper.ts">

<violation number="1" location="apps/api/src/frameworks/frameworks-scores.helper.ts:270">
P1: Controls with no associated policies, tasks, or document types are now counted as incomplete (`hasAnyArtifact` is false), dragging down the compliance score. The old code excluded such controls from the calculation entirely. If frameworks commonly have controls that haven't been fully configured with artifacts yet, this will cause unexpected score drops for users.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[claudfuen]

🎉 This PR is included in version 3.25.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀