[emilieschario]

Summary

• A sub-organization can invite or add only people who are already members of its parent organization.
• Add Member search on a sub-org is limited to active parent members, and the add and invite mutations reject anyone else.
• Accepting a sub-org invitation still requires a current parent membership.

Test plan

• Parent-member invite, alias match, pending-invite rejection, and accept-after-leaving-parent unit tests
• Child-org invite router tests
• Admin addMember rejection and success tests
• Parent-member search unit tests
• Mobile error-copy tests

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The increment correctly restores transient-failure resilience on the post-deploy lease check: the in-flight renewal is still awaited first, then renew() starts a new fresh read that retries transientRenewalFailures, and the new fixture plus test exercise that retry path. No new issues in the changed lines.

Assumptions: [INFERENCE] Tests were not executed in this read-only review; conclusions come from reading services/auto-routing-benchmark/scripts/deploy.mjs (renewal memoization and finally reset), the fixture, and the new test.

Files Reviewed (3 files)

• services/auto-routing-benchmark/scripts/deploy.mjs
• services/auto-routing-benchmark/scripts/deploy.test.mjs
• services/auto-routing-benchmark/test/fixtures/deploy-wrangler.mjs

Previous Review Summaries (3 snapshots, latest commit 8b8a333)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 8b8a333)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

The follow-up commit correctly forces a fresh post-deploy lease read, but the new renewOnce() call bypasses the renewal retry path, so a single transient wrangler/D1 error after a successful deploy now fails the run as unverified.

Assumptions: [INFERENCE] Tests were not executed in this read-only review. The org-gating files from the previous review are unchanged since commit 897a706e8 and were not re-analyzed; the only increment is services/auto-routing-benchmark/scripts/deploy.mjs.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
services/auto-routing-benchmark/scripts/deploy.mjs	306	Post-deploy renewOnce() no longer retries transientRenewalFailures, unlike the previous renew() call

Files Reviewed (1 file)

• services/auto-routing-benchmark/scripts/deploy.mjs - 1 issue

Previous review (commit 897a706)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The follow-up commit closes both prior findings: a live-parent check now gates the child-org accept and admin add paths, and Add Member uses a bounded server-side parent-member search that excludes existing child members. No new defects were found in the changed code.

Assumptions: [INFERENCE] Tests were not executed in this read-only review; the new SQL was validated by reading it against the schema (unique (organization_id, kilo_user_id) on organization_memberships, non-null is_bot default false, organizations.deleted_at soft delete) rather than by running the suites.

Files Reviewed (8 files)

• apps/web/src/app/admin/api/organizations/hooks.ts
• apps/web/src/app/admin/components/OrganizationAdmin/AddMemberDialog.tsx
• apps/web/src/app/admin/components/OrganizationAdmin/parent-member-search.ts (removed)
• apps/web/src/app/admin/components/OrganizationAdmin/AddMemberDialog.test.ts (removed)
• apps/web/src/routers/organizations/organization-admin-router.ts
• apps/web/src/routers/organizations/organization-admin-router.test.ts
• packages/web-shared/src/lib/organizations/organizations.ts
• packages/web-shared/src/lib/organizations/organizations.test.ts

Previous review (commit a5b32bb)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Executive Summary

The parent-membership gating is enforced on invite and admin add, but the accept path never re-checks that the parent organization is still live, so an invitation issued before the parent was deleted can still grant child membership.

Assumptions: [INFERENCE] Parent organizations can be deleted while their child organizations remain (confirmed: markOrganizationAsDeleted soft-deletes only the org row and keeps memberships/children); the child-org SSO/seat flows were not exercised.

Issue Details (click to expand)

WARNING

File	Line	Issue
packages/web-shared/src/lib/organizations/organizations.ts	759	Accept path verifies parent membership but not that the parent org is live, unlike the invite path
apps/web/src/routers/organizations/organization-admin-router.ts	1028	admin.addMember has the same missing live-parent check (noted in the comment above)

SUGGESTION

File	Line	Issue
apps/web/src/app/admin/components/OrganizationAdmin/AddMemberDialog.tsx	60	Parent search fetches the entire parent org via withMembers and filters client-side

Files Reviewed (11 files)

• apps/web/src/app/admin/components/OrganizationAdmin/AddMemberDialog.test.ts
• apps/web/src/app/admin/components/OrganizationAdmin/AddMemberDialog.tsx - 1 issue
• apps/web/src/app/admin/components/OrganizationAdmin/parent-member-search.ts
• apps/web/src/components/organizations/OrganizationMembersCard.tsx
• apps/web/src/components/organizations/members/InviteMemberDialog.tsx
• apps/web/src/routers/organizations/organization-admin-router.test.ts
• apps/web/src/routers/organizations/organization-admin-router.ts - same defect noted in the accept-path comment
• apps/web/src/routers/organizations/organization-members-router.test.ts
• apps/web/src/routers/organizations/organization-members-router.ts
• packages/web-shared/src/lib/organizations/organizations.test.ts
• packages/web-shared/src/lib/organizations/organizations.ts - 1 issue

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-flash-latest · Input: 35.9K · Output: 5.6K · Cached: 257.2K}

_{Review guidance: REVIEW.md from base branch main}

[iscekic]

bot: Reviewed the membership checks, invitation acceptance, parent-member search, and deployment renewal fix. No actionable findings. The focused deployment regression checks pass, and CI is green.