fix(isms): harden internal-audit validation and edge cases from deploy review

[github-actions]

Follow-up to #3468, addressing the cubic findings raised on the production deploy PR (#3463) against the merged CS-724 code. Six of the eight findings were real; both remaining ones are answered on their threads.

Fixes

• Planned-date order enforced — an audit can no longer end before it starts. Client: zod cross-field rule with an inline error on the end-date field. Server: validated on create, and on update against the effective schedule (dto values merged over the stored row), so partial updates can't sneak an inverted range in — while moving both dates together still works.
• Linked findings always keep a clause label — a finding created (or re-linked) via the API without clauseOrControl now inherits the control row's reference, and deleting a control row first labels any linked label-less findings with its reference. The SetNull FK can no longer strand a finding with neither link nor label in the generated document.
• Add-control-row form gains the optional Notes field (the table showed the column but the form couldn't fill it).
• Row editor shows the control-reference validation error instead of a silently disabled Save.
• Programme read view preserves paragraph breaks (whitespace-pre-wrap) so it matches what was typed.
• Sign-off "N of 3 signed" badge trims names, matching the API's normalization of whitespace-only signatories to null.
• Corrected the F-NN doc comment to state the real guarantee (max + 1 over surviving rows).

Answered on the #3463 threads (not changed)

• F-NN reuse after deleting the newest finding — findings are draft rows until published; every published version freezes its findings in the version contentSnapshot, so a reused reference in a new draft cannot rewrite history. Persisting a sequence table isn't warranted in v1.
• isms.service.ts length — the file predates the 300-line cap and holds every ISMS document lifecycle gate (roles, monitoring, internal audit) by design; splitting it is a standalone refactor rather than a deploy-review fix.

The ninth finding on #3463 (update-policy-helpers.ts S3 orphan on policy regenerate) belongs to #3471, not CS-724.

Verification

• 500 ISMS API jest tests green (+6 new: date-order create/update incl. the merged-schedule case, clause-label inheritance and explicit-label precedence, control-delete backfill)
• 176 ISMS app vitest tests green (+2 new schema tests)
• bun run --filter '@trycompai/app' build (the Vercel gate) exits 0

Linear: CS-724

[linear]

CS-724

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	Jul 22, 2026 2:08am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		Jul 22, 2026 2:08am
portal	Skipped		Jul 22, 2026 2:08am

[cubic-dev-ai]

cubic analysis

All reported issues were addressed across 13 files

Confidence score: 5/5

• Safe to merge after the addressed issues were fixed.

Linked issue analysis

Linked issue: CS-724: [Feature] Area- Internal Audit

Status	Acceptance criteria	Notes
✅	Enforce planned-date order on create and update (including merged-schedule validation and allowing moving both dates together)	Server now asserts date order in create and update (merged schedule check) and client schema enforces the same constraint; unit tests cover rejecting inverted ranges and allowing fixes that move both dates together.
✅	Linked findings always keep a clause label: findings inherit control reference when clauseOrControl omitted; explicit clause text wins; deleting a control backfills label-less linked findings	Finding create/update logic now derives clauseOrControl from the linked control when missing; resolveControl returns controlRef; deletion path updates linked findings before deleting the control. Tests exercise inheritance and backfill behavior.
✅	Add optional Notes field to the Add-Control-Row form so the Notes column can be filled on create	The Add control form now includes a notes Controller mapped to a Textarea with the Notes placeholder described in the issue.
✅	Row editor surfaces control-reference validation error instead of silently disabling Save	The controlRef input is wrapped in Field + FieldError and renders fieldState.error?.message so validation errors will be visible instead of silently disabling save.
✅	Planned end date input surfaces validation errors (client)	Planned end date Controller in the form now includes Field + FieldError to show validation messages; the client schema enforces ordering.
✅	Programme read view preserves paragraph breaks	Read-only rendering now wraps the programme text with whitespace-pre-wrap so multi-line paragraphs preserve breaks as requested.
✅	Sign-off 'N of 3 signed' badge trims names so whitespace-only signatories don’t count	Signed-count logic now trims name values before counting, matching API normalization of whitespace-only signatories to null.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[claudfuen]

🎉 This PR is included in version 3.106.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀