M3 followup after testing prod candidate

[lukaszgryglicki]

cc @mlehotskylf @ahmedomosanya - prod/main version of #5241.

Signed-off-by: Łukasz Gryglicki lgryglicki@cncf.io

Assisted by OpenAI

Assisted by GitHub Copilot

Assisted by Claude

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: aa23e742-9985-47a9-a1de-5748589f867e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟡 Changes recommended

Manager decisions and rollback writes remain non-atomic, allowing concurrent requests to overwrite or reopen completed decisions.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Make approval status updates atomic and conditional · New
• Add test coverage for GitLab organization removal · New

What changed in this PR

Ports the M3 production-candidate follow-up from PR #5241, improving manager-request handling and company/approval-list edge cases.

Changes:

• Adds conflict handling for already-decided manager requests.
• Improves company parent selection and timestamp ordering.
• Allows approval-list removals when no repositories exist.

File	Description
docs/​M3_ORG_LENS_API.md	Documents manager-request conflicts.
cla-backend-legacy/​internal/​store/​companies.go	Compares normalized creation timestamps.
cla-backend-legacy/​internal/​store/​companies_test.go	Tests timestamp ordering.
cla-backend-go/​v2/​cla_manager/​service.go	Defines pending/conflict state.
cla-backend-go/​v2/​cla_manager/​requests.go	Adds decision checks and recovery logic.
cla-backend-go/​v2/​cla_manager/​requests_test.go	Tests decisions, ACL recovery, and conflicts.
cla-backend-go/​v2/​cla_manager/​handlers.go	Maps decided requests to HTTP 409.
cla-backend-go/​swagger/​cla.v2.yaml	Declares conflict responses.
cla-backend-go/​signatures/​repository.go	Handles missing repositories during removals.
cla-backend-go/​signatures/​approval_list_removal_test.go	Tests repository-free GitHub removal.
cla-backend-go/​company/​repository_external_id.go	Distinguishes parent from signing-entity rows.
cla-backend-go/​company/​repository_external_id_test.go	Tests parent creation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.