[dev] [Marfuen] mariano/nist-sp800-53-readiness

[github-actions]

This is an automated pull request to merge mariano/nist-sp800-53-readiness into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Adds control family grouping with per‑framework assignments and a grouped UI for large frameworks like NIST SP800‑53, with URL‑persisted filters and clearer change summaries. Includes numeric sorting, idempotent rollback, and a fix for the family combobox Clear action; covers Linear CS-389–CS-393.

• New Features

  • UI: Group controls by family with expand/collapse and “expand all”; search + family filter with counts; state in URL (?q, ?families pipe‑separated); ungrouped go to a safe UNCATEGORIZED_FAMILY bucket; numeric sort for control names.
  • Framework editor: controlFamily column with a searchable combobox (add/clear, idempotent selection; Clear now works reliably), plus a Manage Families dialog to rename/delete with batched updates; tests updated for the sentinel.
  • API/versioning: controlFamily included in manifests, diffs, export/import, sync apply, and rollback; change summaries show family edits; empty strings normalized to null; undo payload tracks family changes and rollback restores them idempotently; sync applies family updates even when controls are otherwise edited.

• Migration

  • Run database migrations and rebuild.
  • New FrameworkControlFamily table scopes family per framework instance; data backfilled and migrations squashed; old undo payloads remain supported.

^{Written for commit d0b9517. Summary will update on new commits. Review in cubic}

[Marfuen]

@cubic-dev-ai re-review this

[cubic-dev-ai]

@cubic-dev-ai re-review this

@Marfuen I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

2 issues found across 45 files

Confidence score: 3/5

• There is a concrete regression risk in apps/api/src/frameworks/framework-versioning/framework-rollback.service.ts: using create during rollback can fail when control-family rows already exist, so rollback may not complete reliably without an idempotent restore approach (upsert or createMany + skipDuplicates).
• The sorting issue in docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md is moderate impact: localeCompare without { numeric: true } can misorder identifiers like AC-10 vs AC-2, which affects correctness/readability but is less likely to break runtime behavior.
• Pay close attention to apps/api/src/frameworks/framework-versioning/framework-rollback.service.ts and docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md - rollback idempotency and numeric control sorting should be validated before merge.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx">

<violation number="1" location="apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx:197">
P2: Deleting a family sets `controlFamily` to an empty string instead of `null`, which creates inconsistent "no family" states and can send unexpected payloads to the API.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[Marfuen]

@cubic-dev-ai re-review this

[cubic-dev-ai]

@cubic-dev-ai re-review this

@Marfuen I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

3 issues found across 45 files

Confidence score: 3/5

• There is a concrete regression risk in apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.test.ts: the tests assert family: "Other" while implementation uses UNCATEGORIZED_FAMILY ("__uncategorized__"), which can mask or introduce incorrect grouping behavior for uncategorized controls.
• docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md describes sorting with localeCompare but without numeric-aware options, so IDs like AC-10 vs AC-2 can be ordered incorrectly; this is user-visible if copied into implementation.
• Overall this looks manageable, but the combination of a medium-high severity grouping mismatch and a numeric sorting pitfall makes this more than a low-risk merge.
• Pay close attention to apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.test.ts and docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md - sentinel-vs-label assumptions and non-numeric sorting guidance could lead to inconsistent behavior.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx">

<violation number="1" location="apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx:197">
P2: Deleting a family sets `controlFamily` to an empty string instead of `null`, which creates inconsistent "no family" states and can send unexpected payloads to the API.</violation>
</file>

<file name="docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md">

<violation number="1" location="docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md:450">
P2: Control names with numeric suffixes sort incorrectly because `localeCompare` lacks the `{ numeric: true }` option. Without it, "AC-10" sorts before "AC-2" as a plain string comparison.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Control names with numeric suffixes sort incorrectly because localeCompare lacks the { numeric: true } option. Without it, "AC-10" sorts before "AC-2" as a plain string comparison.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md, line 450:

<comment>Control names with numeric suffixes sort incorrectly because `localeCompare` lacks the `{ numeric: true }` option. Without it, "AC-10" sorts before "AC-2" as a plain string comparison.</comment>

<file context>
@@ -0,0 +1,1057 @@
+      ungrouped.push(...groupItems);
+      continue;
+    }
+    const sorted = groupItems.sort((a, b) => a.control.name.localeCompare(b.control.name));
+    families.push({ name, displayName: name, items: sorted });
+  }
</file context>

[Marfuen]

@cubic-dev-ai re-review this

[cubic-dev-ai]

@cubic-dev-ai re-review this

@Marfuen I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 45 files

Confidence score: 3/5

• There is a concrete user-impacting behavior in apps/framework-editor/app/components/table/ComboboxCell.tsx: re-selecting the already selected option clears the value, which risks accidental data loss.
• Given the moderate severity (5/10) and high confidence (8/10), this is more than a cosmetic issue and introduces some merge risk unless idempotent selection behavior is restored.
• Pay close attention to apps/framework-editor/app/components/table/ComboboxCell.tsx - make selecting the current option a no-op and keep removal limited to the explicit Clear action.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx">

<violation number="1" location="apps/framework-editor/app/(pages)/controls/ControlsClientPage.tsx:197">
P2: Deleting a family sets `controlFamily` to an empty string instead of `null`, which creates inconsistent "no family" states and can send unexpected payloads to the API.</violation>
</file>

<file name="docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md">

<violation number="1" location="docs/superpowers/plans/2026-05-21-nist-sp800-53-controls-grouping.md:450">
P2: Control names with numeric suffixes sort incorrectly because `localeCompare` lacks the `{ numeric: true }` option. Without it, "AC-10" sorts before "AC-2" as a plain string comparison.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>