@@ -1,3 +1,20 @@
+## [3.66.1](https://github.com/trycompai/comp/compare/v3.66.0...v3.66.1) (2026-06-01)
+
+
+### Bug Fixes
+
+* **api:** avoid registering duplicated device when the status is flipping to compliant ([b103710](https://github.com/trycompai/comp/commit/b1037104271c5c750bc7a5d111c98d3672b39c40))
+* **api:** exclude deactivated owners from acting-user fallback ([ec6a1fa](https://github.com/trycompai/comp/commit/ec6a1fa9beff9fe474dba37785a06bb0ae834ba8))
+* **api:** support API key auth on upload-submission endpoint ([9570390](https://github.com/trycompai/comp/commit/957039077d3681a7c90cb1f246a3a5aeb6a3a8a1))
+* **app:** fit requirements table columns ([318330e](https://github.com/trycompai/comp/commit/318330ef7b3d55b51152c1eee4c31cc960d8bd9c))
+* **app:** keep removed multi-select values in the dropdown ([4dc1a12](https://github.com/trycompai/comp/commit/4dc1a12d4491fef3b0aecbaf10787db21b09559d))
+* **app:** prevent duplicate publish all submissions ([8b0b863](https://github.com/trycompai/comp/commit/8b0b863923d8f30fd6be2d7713424cb5935dcca0))
+* **app:** resolve archived policy and compliance UI tasks ([d8ce450](https://github.com/trycompai/comp/commit/d8ce45093d87a3f7222fc14123ca88a82043f9c5))
+* **app:** resolve small linear tasks ([424d863](https://github.com/trycompai/comp/commit/424d863458ccfd9059611515239e86895fee6c5f))
+* **app:** search integrations by name ([4db9154](https://github.com/trycompai/comp/commit/4db91546dfefa9b010bedbc65aedf7a781ce6a0b))
+* **app:** warn before invalidating policy acknowledgments ([76e106f](https://github.com/trycompai/comp/commit/76e106f1ab125ddbeaaa9945e2be39185b45230b))
+* **device-agent:** make serial number extraction more robust on agent ([85f0b1e](https://github.com/trycompai/comp/commit/85f0b1e52d3f978935fddf6858eec6f6239a4e69))
+
 # [3.66.0](https://github.com/trycompai/comp/compare/v3.65.1...v3.66.0) (2026-05-29)
 
 
 
@@ -122,6 +122,29 @@ describe('ActingUserResolver', () => {
       );
     });
 
+    it('filters out deactivated / inactive members so uploads cannot be attributed to offboarded owners', async () => {
+      // Regression guard — without these filters, the oldest "owner"-role
+      // Member would win even if the user has been deactivated/offboarded,
+      // attributing API-driven mutations to someone who no longer has access.
+      mockDb.member.findFirst.mockResolvedValueOnce({ userId: 'usr_owner' });
+      const req = makeReq({
+        userId: undefined,
+        isApiKey: true,
+        apiKeyName: 'X',
+      });
+
+      await resolver.resolve(req, 'org_1');
+
+      expect(mockDb.member.findFirst).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: expect.objectContaining({
+            deactivated: false,
+            isActive: true,
+          }),
+        }),
+      );
+    });
+
     it('picks the OLDEST owner deterministically (orderBy createdAt asc)', async () => {
       // Determinism matters — re-running the same automation should always
       // attribute to the same user, even if newer owners are added/removed.
 
@@ -91,21 +91,26 @@ export class ActingUserResolver {
   }
 
   /**
-   * Find the oldest owner of an organization. Oldest is deterministic and
-   * stable: removing a recently-added owner doesn't change the attribution
+   * Find the oldest ACTIVE owner of an organization. Oldest is deterministic
+   * and stable: removing a recently-added owner doesn't change the attribution
    * target, removing the oldest one just promotes the next one. Matches the
-   * pattern used elsewhere (e.g. tasks/task-notifier.service.ts).
+   * pattern used elsewhere (e.g. tasks/tasks.service.ts:getApiKeyActorUserId).
    *
    * Member.role is a comma-separated string (e.g. "owner,admin"), so we use
    * Prisma's `contains` filter — same query shape as the 19+ other owner
    * lookups in this codebase.
+   *
+   * `deactivated: false` + `isActive: true` excludes offboarded owners so we
+   * don't attribute new mutations to a user who no longer has org access.
    */
   private async findOrgOwnerUserId(
     organizationId: string,
   ): Promise<string | null> {
     const owner = await db.member.findFirst({
       where: {
         organizationId,
+        deactivated: false,
+        isActive: true,
         role: { contains: 'owner' },
       },
       orderBy: { createdAt: 'asc' },
 
@@ -1,9 +1,16 @@
 import { Test, TestingModule } from '@nestjs/testing';
+import { BadRequestException } from '@nestjs/common';
 import { EvidenceFormsController } from './evidence-forms.controller';
 import { EvidenceFormsService } from './evidence-forms.service';
+import { ActingUserResolver } from '../auth/acting-user.service';
 import { HybridAuthGuard } from '../auth/hybrid-auth.guard';
 import { PermissionGuard } from '../auth/permission.guard';
-import type { AuthContext as AuthContextType } from '../auth/types';
+import type {
+  AuthContext as AuthContextType,
+  AuthenticatedRequest,
+} from '../auth/types';
+
+jest.mock('@db', () => ({ db: {} }));
 
 jest.mock('../auth/auth.server', () => ({
   auth: { api: { getSession: jest.fn() } },
@@ -61,10 +68,17 @@ describe('EvidenceFormsController', () => {
     userRoles: ['admin'],
   };
 
+  const mockActingUser = {
+    resolve: jest.fn(),
+  };
+
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
       controllers: [EvidenceFormsController],
-      providers: [{ provide: EvidenceFormsService, useValue: mockService }],
+      providers: [
+        { provide: EvidenceFormsService, useValue: mockService },
+        { provide: ActingUserResolver, useValue: mockActingUser },
+      ],
     })
       .overrideGuard(HybridAuthGuard)
       .useValue(mockGuard)
@@ -298,26 +312,71 @@ describe('EvidenceFormsController', () => {
   });
 
   describe('uploadSubmission', () => {
-    it('should call service.uploadSubmission with correct params', async () => {
+    it('should call service.uploadSubmission with the session userId', async () => {
       const body = { fileUrl: 'https://example.com/file.pdf' };
       const mockResult = { id: 'sub_upload' };
       mockService.uploadSubmission.mockResolvedValue(mockResult);
+      mockActingUser.resolve.mockResolvedValue({
+        userId: 'user_1',
+        source: 'session',
+      });
 
+      const req = {} as AuthenticatedRequest;
       const result = await controller.uploadSubmission(
         'org_1',
-        mockAuthContext,
         'security-awareness',
         body,
+        req,
       );
 
       expect(result).toEqual(mockResult);
+      expect(mockActingUser.resolve).toHaveBeenCalledWith(req, 'org_1');
       expect(service.uploadSubmission).toHaveBeenCalledWith({
         organizationId: 'org_1',
         formType: 'security-awareness',
-        authContext: mockAuthContext,
+        userId: 'user_1',
         payload: body,
       });
     });
+
+    it('should attribute to the org owner when called with API key auth', async () => {
+      const body = { fileUrl: 'https://example.com/file.pdf' };
+      const mockResult = { id: 'sub_upload' };
+      mockService.uploadSubmission.mockResolvedValue(mockResult);
+      mockActingUser.resolve.mockResolvedValue({
+        userId: 'owner_user',
+        source: 'org-owner-fallback',
+        callerLabel: 'via API key "CI"',
+      });
+
+      const req = {} as AuthenticatedRequest;
+      await controller.uploadSubmission('org_1', 'meeting', body, req);
+
+      expect(service.uploadSubmission).toHaveBeenCalledWith({
+        organizationId: 'org_1',
+        formType: 'meeting',
+        userId: 'owner_user',
+        payload: body,
+      });
+    });
+
+    it('should throw BadRequestException when no owner can be resolved', async () => {
+      mockActingUser.resolve.mockResolvedValue({
+        userId: null,
+        source: 'org-owner-fallback',
+        callerLabel: 'via API key',
+      });
+
+      await expect(
+        controller.uploadSubmission(
+          'org_1',
+          'meeting',
+          { fileUrl: 'x' },
+          {} as AuthenticatedRequest,
+        ),
+      ).rejects.toBeInstanceOf(BadRequestException);
+      expect(service.uploadSubmission).not.toHaveBeenCalled();
+    });
   });
 
   describe('reviewSubmission', () => {
 
@@ -1,10 +1,15 @@
+import { ActingUserResolver } from '@/auth/acting-user.service';
 import { AuthContext, OrganizationId } from '@/auth/auth-context.decorator';
 import { HybridAuthGuard } from '@/auth/hybrid-auth.guard';
 import { PermissionGuard } from '@/auth/permission.guard';
 import { RequirePermission } from '@/auth/require-permission.decorator';
-import type { AuthContext as AuthContextType } from '@/auth/types';
+import type {
+  AuthContext as AuthContextType,
+  AuthenticatedRequest,
+} from '@/auth/types';
 import { AuditRead } from '@/audit/skip-audit-log.decorator';
 import {
+  BadRequestException,
   Body,
   Controller,
   Delete,
@@ -14,6 +19,7 @@ import {
   Patch,
   Post,
   Query,
+  Req,
   Res,
   UseGuards,
 } from '@nestjs/common';
@@ -32,7 +38,10 @@ import { EvidenceFormsService } from './evidence-forms.service';
   required: false,
 })
 export class EvidenceFormsController {
-  constructor(private readonly evidenceFormsService: EvidenceFormsService) {}
+  constructor(
+    private readonly evidenceFormsService: EvidenceFormsService,
+    private readonly actingUser: ActingUserResolver,
+  ) {}
 
   @Get()
   @RequirePermission('evidence', 'read')
@@ -213,18 +222,25 @@ export class EvidenceFormsController {
   @ApiOperation({
     summary: 'Upload a file as an evidence submission',
     description:
-      'Upload a PDF or image file and create a submission for the given form type, bypassing form-specific validation',
+      'Upload a PDF or image file and create a submission for the given form type, bypassing form-specific validation. ' +
+      "Accepts session, API key, or service token auth. For API key / service token callers without an explicit user attribution, the submission is attributed to the org's oldest owner.",
   })
   async uploadSubmission(
     @OrganizationId() organizationId: string,
-    @AuthContext() authContext: AuthContextType,
     @Param('formType') formType: string,
     @Body() body: unknown,
+    @Req() req: AuthenticatedRequest,
   ) {
+    const acting = await this.actingUser.resolve(req, organizationId);
+    if (!acting.userId) {
+      throw new BadRequestException(
+        'Cannot attribute this submission — your organization must have at least one user with the "owner" role.',
+      );
+    }
     return this.evidenceFormsService.uploadSubmission({
       organizationId,
       formType,
-      authContext,
+      userId: acting.userId,
       payload: body,
     });
   }
 
@@ -648,15 +648,15 @@ export class EvidenceFormsService {
   async uploadSubmission(params: {
     organizationId: string;
     formType: string;
-    authContext: AuthContext;
+    userId: string;
     payload: unknown;
   }) {
     const parsedType = evidenceFormTypeSchema.safeParse(params.formType);
     if (!parsedType.success) {
       throw new BadRequestException('Unsupported form type');
     }
 
-    const userId = this.requireJwtUser(params.authContext);
+    const { userId } = params;
 
     const parsed = uploadSubmissionBodySchema.safeParse(params.payload);
     if (!parsed.success) {
 
@@ -3,7 +3,7 @@
 import { Input, Spinner } from '@trycompai/design-system';
 import { Close } from '@trycompai/design-system/icons';
 import MultipleSelector from '@trycompai/ui/multiple-selector';
-import { useEffect, useRef } from 'react';
+import { useEffect, useMemo, useRef, useState } from 'react';
 import type { ConnectionVariable, VariableValue } from './ConnectionVariablesForm';
 
 interface ConnectionVariableMultiSelectProps {
@@ -31,6 +31,30 @@ export function ConnectionVariableMultiSelect({
   const isGitHubRepos = variable.id === 'target_repos';
   const parsedConfigs = isGitHubRepos ? normalizedSelectedValues.map(parseRepoBranch) : [];
 
+  const reposForSelector = isGitHubRepos
+    ? parsedConfigs.map((config) => config.repo)
+    : normalizedSelectedValues;
+
+  // Remembers every value that has appeared in the multi-select during the
+  // lifetime of this component so that values the user removes (clicking the
+  // X on a tag) remain available as re-selectable options in the dropdown.
+  // Without this, free-form multi-selects like Google Workspace's
+  // `sync_excluded_emails` have an empty dropdown (no fetchOptions, no static
+  // options), so a removed tag can only be brought back by retyping it.
+  const [seenValues, setSeenValues] = useState<Set<string>>(() => new Set(reposForSelector));
+  useEffect(() => {
+    setSeenValues((prev) => {
+      let next: Set<string> | null = null;
+      for (const v of reposForSelector) {
+        if (v && !prev.has(v)) {
+          if (!next) next = new Set(prev);
+          next.add(v);
+        }
+      }
+      return next ?? prev;
+    });
+  }, [reposForSelector]);
+
   useEffect(() => {
     if (
       variable.hasDynamicOptions &&
@@ -77,21 +101,31 @@ export function ConnectionVariableMultiSelect({
     onChange(newValues);
   };
 
-  const reposForSelector = isGitHubRepos
-    ? parsedConfigs.map((config) => config.repo)
-    : normalizedSelectedValues;
   const isCreatable = isGitHubRepos || options.length === 0;
 
+  const combinedOptions = useMemo(() => {
+    const map = new Map<string, { value: string; label: string }>();
+    for (const option of options) {
+      map.set(option.value, { value: option.value, label: option.label });
+    }
+    for (const v of seenValues) {
+      if (!map.has(v)) {
+        map.set(v, { value: v, label: v });
+      }
+    }
+    return Array.from(map.values());
+  }, [options, seenValues]);
+
   return (
     <div className="space-y-3">
       <MultipleSelector
         value={reposForSelector.map((value) => ({
           value,
-          label: options.find((option) => option.value === value)?.label || value,
+          label: combinedOptions.find((option) => option.value === value)?.label || value,
         }))}
         onChange={(selected) => handleRepoSelectionChange(selected.map((item) => item.value))}
-        defaultOptions={options.map((option) => ({ value: option.value, label: option.label }))}
-        options={options.map((option) => ({ value: option.value, label: option.label }))}
+        defaultOptions={combinedOptions}
+        options={combinedOptions}
         placeholder={variable.placeholder || `Select ${variable.label.toLowerCase()}...`}
         creatable={isCreatable}
         emptyIndicator={