feat: isms management review (clause 9.3)#3481
Merged
Merged
Conversation
Tenth ISMS document type management_review, cloned from the internal audit (9.2) and monitoring (9.1) patterns: - IsmsManagementReview / IsmsReviewInput / IsmsReviewAction models with server-generated MR-YYYY-NN and A-NN references under the per-document lock, an immutable recordedAt, and attendees frozen at selection - ten Inputs (9.3.2) rows seeded per review at creation, idempotent by inputKey; outputs ship with clause-9.3 template text - chair and attendees default to the Roles (5.3) Top Management and SPO holders, deduped for small teams - chair sign-off locks the review (inputs and outputs frozen, sign-off slot correctable); action tracking stays live to closure and open actions carry forward to the next review's input (a) at display and export time, never copied - submit gate assertManagementReviewComplete mirrors the ticket's document validation for complete reviews; agenda-pack reviews never block - reviews/review-inputs/review-actions registers on the generic dispatch, export section builder, narrative (procedure) seeding, and extras threading at both snapshot call sites
ISMS > Management Review detail page for the tenth document type: - ManagementReviewClient shell with the clause-9.3 submit-gate mirror (management-review-constants.ts) and the editable Procedure card - review cards with meeting date (backdatable), immutable recorded-on, chair dropdown from the Roles (5.3) Top Management holder, attendees as a select-to-add list frozen at selection, and the bracketed suitable/adequate/effective conclusion verdict - Inputs (9.3.2) table as the meeting agenda: per-row edit, immediate Discussed? checkbox, add/remove rows - Outputs (9.3.3): decisions + changes template text and the actions arising table with immediate status tracking and full MR-YYYY-NN-ANN references - open actions from earlier reviews render as a read-only carried- forward table on later reviews - single chair sign-off slot that locks the review in the UI exactly as the server enforces it (action tracking and the sign-off slot itself stay live) - vitest coverage incl. admin vs read-only permissions and the locked state; existing ISMS fixtures gained the new reviews register
tofikwest
changed the title
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
cubic analysis
All reported issues were addressed across 67 files
Confidence score: 5/5
- Safe to merge after the addressed issues were fixed.
Linked issue analysis
Linked issue: CS-726: [Feature] Area- Management Review
| Status | Acceptance criteria | Notes |
|---|---|---|
| ✅ | Management Review page (Compliance > ISMS > Management Review) exists and is wired into the ISMS document UI | Frontend page/component added and registered in the document clients. |
| ✅ | Procedure paragraph ships with a hardcoded default and is editable; derivation seeds Procedure narrative | DefaultProcedureText and deriveManagementReviewNarrative implemented; ProcedureCard UI exists. |
| ✅ | Reviews register: create review instances pre-filled with template fields (reference, meetingDate, recordedAt, chair, attendees, status, conclusion) | DB model, migration and services for reviews added; register wiring and create/update handlers present. |
| ✅ | Inputs table (9.3.2) seeded with the 10 default rows and supports the specified columns (where-to-find, discussion notes, discussed flag) | Seed definitions and seed-if-missing implemented; review input types, services and UI rows/table added. |
| ✅ | Actions arising (9.3.3) supported with server-generated references, owner/due/status fields, and carried-forward open actions into next review input (a) | Action model, service, export and UI components present; comments and components indicate carry-forward behavior implemented. |
| ✅ | Chair and attendees default/resolve from ISMS > Roles and are stored/frozen on creation | Participant-resolution util and parse functions added; services and UI use chairOptions and attendee parsing. |
| ✅ | Recorded-on (recordedAt) auto-set and immutable; signing locks the review instance while actions still track to closure | DB default for recordedAt, services enforce sign/lock behavior and only allow limited edits after sign; UI signoff card exists. |
| ✅ | Validation and document-generation rules for producing the Clause 9.3 exported document implemented (procedure present, meeting date/chair/attendees set, all Inputs discussed?, chair signature) | Validation messages and export-section builder for management_review added; export input/resolvers and document sections implemented to produce the 9.3 doc. |
Tip: instead of fixing issues one by one fix them all with cubic
Re-trigger cubic
Review-round fixes: - re-read the sign-off state INSIDE the locked transaction for every mutation gated on "unsigned" (review update/delete, input CRUD, action create/delete) — a concurrent chair sign-off could previously commit between the pre-read and the lock and be overwritten - signed reviews now accept only owner / due date / status on their actions; the description is part of the frozen minutes - action rows patch only dirty fields, so an untouched owner belonging to a former member no longer fails unrelated edits - review details and input rows exit edit mode when the lock lands - attendee picker resets to its placeholder after each selection and saves are serialized so replacement PATCHes cannot drop each other - attendee lists are deduped by member before persisting - client attendee parsing requires a non-empty memberId, mirroring the server schema - edited seeded input rows record source=manual (audit-controls precedent)
…com:trycompai/comp into tofik/cs-726-feature-area-management-review
claudfuen
pushed a commit
that referenced
this pull request
Jul 22, 2026
# [3.107.0](v3.106.0...v3.107.0) (2026-07-22) ### Bug Fixes * **api:** resolve comments left by Cubic-dev-ai from Production-Deploy PR ([#3483](#3483)) ([e489af6](e489af6)) * **app:** show the actual error reason when comment deletion fails ([#3485](#3485)) ([25ac1d9](25ac1d9)) * **isms:** management review deploy-review fixes ([#3486](#3486)) ([49fcd6a](49fcd6a)) ### Features * isms management review (clause 9.3) ([#3481](#3481)) ([b201b7e](b201b7e))
Contributor
|
🎉 This PR is included in version 3.107.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated pull request to merge tofik/cs-726-feature-area-management-review into dev.
It was created by the [Auto Pull Request] action.
Summary by cubic
Adds the Management Review (ISO 27001 clause 9.3) as a first-class ISMS document with a procedure paragraph, reviews register, export, and UI to record minutes, inputs, outputs, actions, and chair sign‑off. Hardens sign‑off locking and attendee handling; delivers CS‑726 with auditor‑defensible defaults and submit gating.
New
management_reviewdocument type with Prisma models and migration: reviews, inputs (9.3.2), and actions (9.3.3), plus MR‑YYYY‑NN and ANN references and immutable recordedAt.Procedure paragraph auto-seeded (seed‑if‑empty) and editable; rendered in exports.
Reviews register and UI: chair from Roles Top Management; attendees default to Chair + SPO (deduped and frozen at selection); status; bracketed suitable/adequate/effective conclusion; single chair sign‑off that locks the review (inputs/outputs freeze; actions keep tracking).
Inputs table: 10 ISO‑mandated rows pre‑seeded with “What it covers” and “Where to find it”, editable notes, and Discussed? checkbox; rows can be added/edited/removed.
Outputs and Actions: default text for decisions and changes; server-issued ANN refs, owner, due date, and status; open actions auto carry forward into the next review’s input (a) as a read‑only list.
Export and snapshot: section builder and extras freeze action owner display names; added to export payload and snapshot; document never goes platform‑drift stale.
API/UI: services for reviews, inputs, and actions; wired into generic registers; Management Review page with Procedure, per‑review details, Inputs, Outputs, Actions, Carried‑Forward list, and Sign‑off; chair picker from Roles; attendee multi‑select from People; comprehensive tests.
Submit gate (document approval) per CS‑726: procedure present; at least one complete review with meeting date, chair, ≥1 attendee, all inputs discussed, and chair signature. Agenda‑pack (incomplete) reviews do not block.
Locking/attendees hardening: sign‑off state re‑read inside locked transactions; signed reviews restrict action edits to owner/due/status only; action patches send only dirty fields; UI exits edit mode on lock; attendee saves serialized and deduped; client requires non‑empty memberId; edited seeded inputs mark source=manual.
Migration
management_reviewdocument type.Top ManagementandSecurity & Privacy Ownerroles are assigned for sane defaults.Written for commit 97cc2fd. Summary will update on new commits.