feat(serenity): org-flag brand-create mode, sub-workspace-only pending activation, site_id anchoring (LLMO-6405)

[igor-grubic]

What

Backend for the brand & market management rework (serenity-docs #68, LLMO-6405). Market-scoped inputs move out of brand creation into market creation.

• Create mode (A): createBrandForOrg decides Semrush mode from the org serenity flag (isSerenityActiveForOrg), not the request body. A non-serenity org that sends a market or generatePrompts:true → 403; a bare generatePrompts:false stays a flat create.
• Market-less create (B): a serenity create with no market provisions a bare sub-workspace (no project) via the new provisionBrandSubworkspaceBare; a supplied market keeps the existing project path.
• Pending activation (C): /serenity/activate on a pending brand is sub-workspace-only (ensure sub-workspace + flip active + clear stash) — it never auto-creates a market. The body-driven market path runs only for an already-active brand (reactivation / onboarding API) and never downgrades it on a partial failure (207).
• site_id anchoring (D / R6): upsertBrand writes brands.site_id from baseSiteId even on the Semrush path (anchored by both sub-workspace and primary site).

Tests

Recast the /serenity/activate suite to the new model + added pending sub-workspace-only cases; updated upsertBrand site_id tests; new coverage for provisionBrandSubworkspaceBare. npm test + coverage green locally; type-check + eslint clean. The Postgres IT suite runs here on CI (it can't run in the dev environment).

Related

• UI counterpart: project-elmo-ui#2493 (same branch).
• Draft until CI (incl. IT) is green and docs (serenity.md + OpenAPI) land.

Follow-ups (not in this PR)

• mysticat-data-service migration: tighten active ⇒ site_id NOT NULL + backfill NULL site_id (sequenced after this plumbing).
• OpenAPI brands-v2/serenity + docs/serenity.md updates.

🤖 Generated with Claude Code

[github-actions]

This PR will trigger a minor release when merged.

[MysticatBot]

Hey @igor-grubic,

Verdict: Request changes - three test coverage gaps for new code paths.
Complexity: HIGH - large diff; API surface.
Changes: Reworks brand-create mode detection to use the org-level serenity flag, makes pending activation sub-workspace-only, removes the Semrush site_id skip, and adds provisionBrandSubworkspaceBare (8 files).

Note: CI checks are currently failing - resolve before merge.

Must fix before merge

1. [Important] No controller-level test for provisionBrandSubworkspaceBare failure during create - test/controllers/brands.test.js (details inline)
2. [Important] No assertion that ensureMarketSite is skipped on the bare sub-workspace create path - test/controllers/brands.test.js (details inline)
3. [Important] Missing test for generatePrompts:true (no market) from a non-serenity org triggering 403 - test/controllers/brands.test.js (details inline)

Non-blocking (3): minor issues and suggestions

• nit: deleteAllProjects is called on a known-empty workspace in the provisionBrandSubworkspaceBare catch block - src/support/serenity/brand-provisioning.js:~460. The comment says it tolerates empty workspaces, but it is a wasted API call; consider removing it and calling only releaseFullAllocation.
• nit: Test title "STILL enters Semrush mode for a PENDING draft with generatePrompts:false and no market" is now misleading - it enters Semrush mode because the org is serenity-active, not because of the flag's presence - test/controllers/brands.test.js:~5714.
• suggestion: The double-guard provisionedWorkspaceId && hasText(provisionedWorkspaceId) && provisionedBrandDomain && hasText(provisionedBrandDomain) is redundant since hasText already handles falsy values - a single hasText(x) per variable suffices - src/controllers/brands.js:1718.

---

_{Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 2m 53s | Cost: $7.75 | Commit: 8e40d4ee4c4683cb2e996228ac42b29e5f5e8434
If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[igor-grubic]

Thanks @MysticatBot — addressed in d82c760, and the it-postgres failure was a real one (now fixed).

Must-fix (all done):

1. ✅ Added a controller test — a provisionBrandSubworkspaceBare failure during create surfaces the error (500) and writes no brand row.
2. ✅ The bare-create test now asserts ensureMarketSite is not called (no market domain to mirror on the bare path).
3. ✅ Added a test — a non-serenity org requesting generatePrompts: true (no market) → 403.

CI (it-postgres): the failure was the LLMO-5870 unset+reuse IT test — it created bare brands relying on the old no-anchor→pending demotion. Since a serenity-active org now makes every create a Semrush create (bare sub-workspace → active), the test now creates those brands explicitly pending; the unset/reuse mechanic under test is unchanged.

Nits:

• ✅ Renamed the misleading "STILL enters Semrush mode…" test.
• (nit) deleteAllProjects in the bare catch — kept for symmetry with provisionBrandSubworkspace's cleanup; it's a no-op on a known-empty bare workspace, so no behavior impact. Happy to drop it if you'd prefer.
• (nit) the provisionedBrandDomain && hasText(...) double-guard is required, not redundant: brands.js is under the type-check gate and hasText isn't a TS type-guard, so hasText(string | null) fails tsc without the && narrow.

[aenascut]

Hey! Checked the serenity migration skill in mysticat-data-service against this PR — no impact. Migration talks directly to Semrush APIs + Postgres, bypasses spacecat-api-service entirely, so the brand-create mode switch, provisionBrandSubworkspaceBare, and the pending-activation change don't touch it. The site_id reads in the migration use .get() so any existing NULLs are handled safely too.

Did notice the follow-up you called out — tightening active ⇒ site_id NOT NULL + backfill. We'll keep an eye on that when it lands to make sure the migration's persist step stays in sync. Thanks!

[MysticatBot]

Hey @igor-grubic,

Verdict: Approve - all prior findings addressed, tests well-structured, CI green.
Complexity: HIGH - large diff; API surface.
Changes: Reworks brand-create mode detection to use the org-level serenity flag, makes pending activation sub-workspace-only, removes the Semrush site_id skip, and adds provisionBrandSubworkspaceBare (11 files).
Note: Recommend a human read before merge - this change amends a shared contract (docs/openapi/schemas.yaml). The bot review is a complement to, not a replacement for, a human read here.

Previously flagged, now resolved

• Controller test for provisionBrandSubworkspaceBare failure now verifies 500 + no brand row written.
• Bare-create test now asserts ensureMarketSite is not called (no market domain to mirror).
• Non-serenity org requesting generatePrompts:true now covered with a 403 assertion.

---

_{Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 1m 2s | Cost: $3.37 | Commit: d82c760644408609296bcafae6c159f91b26843e
If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[solaris007]

🎉 This PR is included in version 1.677.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀