[waleedlatif1]

Summary

• Serialize Chat admission with SCIM suspension, keep stopped runs stopped after reactivation, and revoke OAuth grants on permanent removal.
• Withdraw stale automatic group mappings after renames and read membership-lock and name-matching settings after acquiring the organization lock.
• Show automatic mappings and unassigned policy memberships, refresh affected permission caches, correct empty-policy descriptions, explain mapping conflicts and removal consequences, and update the SCIM, Okta, and Entra guides with a current screenshot.

Type of Change

• Bug fix

Testing

• Real app HTTP suite: 28 scenarios and 181 requests, including Okta/Entra payload emulation. Real PostgreSQL/Redis integration suite: 68 tests. Regression negative controls fail before each fix.
• Admin UI: 16 browser checks, including cached member lists after adding and removing a mapping. Documentation: production build, three guides at 12 viewport widths, provider tabs, screenshot viewer, and links.
• Full repository tests, lint, type-check, all 61 audits, test-type ratchet, artifact generation, and block-registry check pass. Cleanup and test-audit have no remaining findings.
• This run used provider-shaped requests; it does not establish new live-provider validation or certification. The guides retain the scope and limitations of earlier live tests.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 29, 2026 1:48am UTC

[cubic-dev-ai]

All reported issues were addressed across 26 files

<sub>This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issues remain in the reviewed changes.

Summary

Hardens SCIM suspension and removal, fixes automatic mappings after group renames, and makes policy assignments clearer.

• Suspended members’ active Chat runs stop and stay stopped after reactivation.
• Permanent SCIM removal revokes the member’s OAuth grants.
• SCIM group writes and projections follow the latest organization settings.
• SCIM mapping settings show automatic links and missing policy assignments.
• SCIM guides explain how provider setup, workspace access, and policy mappings fit together.

Diagram

sequenceDiagram
  participant Chat as Chat admission
  participant Account as Account row
  participant SCIM as SCIM suspension
  participant Runs as Chat runs
  Chat->>Account: Take shared lock
  Chat->>Runs: Insert run and check suspension
  Chat->>Account: Commit and release lock
  SCIM->>Account: Set suspension after waiting for admission
  SCIM->>Runs: Record durable Stops
  SCIM->>Account: Commit
  Note over Runs: Reactivation does not clear Stops

Loading

_{Reviews (2) · Last reviewed commit: "fix(scim): close provisioning races and ..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 30 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}