toga-ai 1.0.1000 → 1.0.1002

package/knowledge/sessions/2026-10-12-odp-as2-aws-key-outage-bala.md

@@ -0,0 +1,67 @@
+---
+type: session
+slug: odp-as2-aws-key-outage
+title: Office Depot POs not importing (AS2 Lambda stopped, then AWS key deleted)
+author: bala
+repos: [worker, library]
+framework: "1.0"
+client: compass-usa
+status: active
+created: 2026-10-12
+updated: 2026-10-12
+---
+
+# Session: odp-as2-aws-key-outage
+**Date:** 2026-10-12
+**Project/Repo:** worker + library (1.0)
+**Task:** Find why Compass Office Depot vendor POs stopped coming into Supply after Sat 2026-10-10 07:23, recover the stuck POs, and replace the deleted AWS key that the 1.0 Office Depot crons depend on.
+
+---
+
+## What WORKED
+- Found the real inbound path. Office Depot sends over AS2 to AWS Transfer server `s-54dad64b145d417a9` (toga-legacy 502614707982, us-west-2), agreement `a-904effd552db4348b` "OfficeDepotProd". Files land in `s3://agilant-as2/processed/<uuid>.<msgid>.net`. An S3 event rule (prefix `processed/`, Put+Post) calls Lambda `rename_edi_files`, which moves `*.net` to `s3://agilant-as2/OfficeDepot/`. Cron `worker/crons/toga2/compass/workflow/3a_import_office_depot_purchase_orders.php` imports from there.
+- Proved the Lambda stopped. Its CloudWatch log ends at Sat 2026-10-10 07:29 CDT. The Invocations metric was 285-753 per weekday, then 0. Errors and Throttles were 0.
+- Moved the stuck files by hand (`aws s3 mv` from `processed/` to `OfficeDepot/`, only `.net` files after 2026-10-10 12:30 UTC). Moved 67 files with 0 failures at about 13:20 CDT. 3a imported all 52 stuck POs into prod `Client_Compass.PurchaseOrders` (0 over-quantity rejects), and later 58 including new arrivals. Cron 5 pushed 57 of 58 to NetSuite by 14:42. The last one, SA138891 (ODP PO 42185598-1214), was eligible but not yet picked at that time.
+- At 15:37 CDT, moved 39 more files to `OfficeDepot/` with `scripts/odp_move_stuck_as2_files.sh --once`. They are waiting there and CANNOT import until AWS access is restored (see Blockers).
+- Wrote the stop-gap cron `worker/crons/toga2/compass/workflow/move_office_depot_as2_files_to_import_folder.php` plus a `*/5` entry in `worker/schedules/cron.worker.sync.json`. php-reviewer found nothing blocking, and the null-list throw was added after review. Per capture, it is committed in worker `_production` as `b3f57866`.
+- Found why the cron fails on the box: at 15:00:28-15:00:31 CDT Jeff deleted IAM user `jcardinal` and its access key. That is the key hardcoded in `library/app/cloud.php` (static props, the `$preCommands` export, and the SDK `credentials` arrays). Error on the box: `InvalidAccessKeyId ... The AWS Access Key Id you provided does not exist in our records.`
+- Confirmed 1.0 email still sends after 15:00. Legacy `Logs.Emails` shows 249 successful sends from 15:00 to 15:38, so SES SMTP was not affected.
+
+## What did NOT work — DO NOT RETRY THESE
+- Re-applying the same S3 event config (`aws s3api put-bucket-notification-configuration` on `agilant-as2`) failed with `InvalidArgument: Unable to validate the following destination configurations`. That proves S3 cannot call the Lambda. Nothing was changed.
+- `aws lambda add-permission` on `rename_edi_files` failed with `AccessDeniedException`. Role `GoAgilant-Developers` has no Lambda rights. `get-function-configuration`, `get-function` and `list-functions` are also denied.
+- Running `php 3a_import_office_depot_purchase_orders.php` by hand on the worker box exits silently. This is expected: the scheduled run (PID 1364) was already running and `cronInitialization` exits when another copy runs.
+- Asking Jeff for a replacement key: refused. The key leaked via GitHub configs and an attacker used it on 2026-10-10. AWS suspended services (Lambda among them). The company is on SSO and will not issue long-lived keys again.
+- The Transfer Family workflow `w-f8951fd4252a5b890` "OfficeDepot" (COPY to `OfficeDepot/`) is NOT the live path. It has no executions in a year of server logs.
+
+## Not tried yet (candidates for next session)
+- Ask Jeff to create a dedicated instance role for EB env `agilant-worker` (instance `i-0208ceac48ce0f343`, currently on the shared `aws-elasticbeanstalk-ec2-role`). Keep the 3 EB managed policies. Add S3 on `agilant-as2` (+ `asifiles`), `transfer:StartFileTransfer` on connectors `c-0fc19b6317af42f69` (ODP) and `c-392be4fc627a47a19` (Canon), logs `DescribeLogStreams/CreateLogStream/PutLogEvents` on `AS2-*`, `sqs:SendMessage` on the 2.0 worker queue (account 654654170868), and `ec2:AssociateAddress/CreateTags` for the worker EIP. NO `ssm:PutParameter`.
+- Change `library/app/cloud.php` to the default AWS credential chain: remove the static key props, make `$preCommands` only `unset` lines, and drop the `credentials` arrays from the 5 SDK clients. Remove keys from the worker/tools config ini files and `worker/ebs/cron.worker.php`. Run php-reviewer + cso.
+- Fix shell injection in `App_Cloud::copyFileToS3` (`library/app/cloud.php` ~377). It is reached from `togaview/mvc/ticket/post.php` ~137-160 with the upload filename unescaped. Use `escapeshellarg()` or the SDK.
+- Check whether 2.0 is also broken. The same deleted key is in `api2/Config/production.ini:87`, `worker2/Config/production.ini:85,145` and `saml/Config/production.ini:37`. Check the SQS `NumberOfMessagesSent` metric for `WorkerProductionQueue` (toga-production, us-east-1) since 2026-10-12 20:00 UTC. Not checked because toga-production SSO had expired.
+- Find ODP PO `42187275-6869` (Compass PO 50315219-1, ODP SO 485188717) in the files waiting in `OfficeDepot/` or `processed/`. The developer asked, then said "wait", so it was not searched.
+- Publish the `/capture` docs. They are written in `toga-tech/knowledge` but held because the team repo has someone else's unpushed changes.
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| worker/crons/toga2/compass/workflow/move_office_depot_as2_files_to_import_folder.php | created | Stop-gap move cron. Committed b3f57866 on _production per capture. Fails until AWS access is restored. Disable when the Lambda is back. |
+| worker/schedules/cron.worker.sync.json | modified | Added `*/5` entry for the move cron, after 3a |
+| C:/WWW/scripts/odp_move_stuck_as2_files.sh | created (outside repos) | Local helper using the developer SSO profile. Loop every 5 min, or `--once`. |
+| toga-tech/knowledge (5 docs) | written, NOT published | New `1.0/apps/library/features/app-cloud-aws-credentials.md`. Updated the compass-usa ODP pipeline and recovery workflows, `error-capture-1-0.md` and the togaview `ticket-detail-page.md`. Architecture section skipped by the developer. |
+
+## Decisions made
+- **Replace keys with per-environment instance roles + the default credential chain** in `App_Cloud` (and 2.0 `_underscore/Cloud.php`). Rationale: nothing to leak, credentials expire, least privilege. The CTO agreed. cso agreed with the design but blocks rollout until the other committed secrets (DB passwords, NetSuite key, payment keys, SSO signing keys) are rotated. Rejected: a new long-lived key (DevOps refuses, and it is the same risk), widening the shared `aws-elasticbeanstalk-ec2-role` (about 60 envs would get EDI access), and per-cron credentials (duplicates the shared class).
+- **Put the stop-gap cron in `crons/toga2/compass/workflow/` with no step number.** It sits beside `send_as2_outbox.php` (the outbound AS2 plumbing). It is temporary, not a business step.
+- **Disable the infra-automation crons** (RDS scaler, terminate, failover) until reviewed. They needed admin powers.
+
+## Blockers
+- No AWS access for any 1.0 App_Cloud call since 2026-10-12 15:00 CDT. 3a cannot import, `send_as2_outbox.php` cannot send ACKs/ASNs, and the move cron cannot run. Waiting on Jeff to create the instance role.
+- Lambda `rename_edi_files` is suspended by AWS after the breach. Jeff is waiting for AWS to restore it.
+- 39+ Office Depot files are waiting in `s3://agilant-as2/OfficeDepot/`, and new ones keep landing in `processed/`.
+
+## Exact next step
+> Ask Jeff whether the `agilant-worker` instance role is created. Then edit `library/app/cloud.php` to use the default credential chain (remove the key statics, the `$preCommands` export and the SDK `credentials` arrays), run php-reviewer + cso, and deploy library + worker. After that, confirm 3a imports the files waiting in `s3://agilant-as2/OfficeDepot/` (new `ODP_EDI` rows in legacy `Logs.FileLog`).
+
+---
+_Saved by /session-save on 2026-10-12_

package/knowledge/standalone/apps/claude/workflows/knowledge-publish-pipeline.md

@@ -6,8 +6,8 @@ project: Claude Harness
 client: shared
 type: workflow
 status: active
-updated: 2026-09-16
-owners: ["jcardinal"]
+updated: 2026-10-12
+owners: ["jcardinal", "tcox"]
 files:
   - claude/knowledge.js
 related:
@@ -47,6 +47,8 @@ Publish sequence, run inside the team repo clone (`~/toga-tech`):
 - **`.claude/settings.json` is tracked in this repo and is edited by the harness itself**, so local drift there is expected and recurring. It was the dirty file that made the failure 100% reproducible on at least one machine. `--autostash` makes publish tolerate it, but the drift still wants a periodic `git diff .claude/settings.json` decision — commit it or revert it. It is also the file most likely to make `npx toga-ai`'s `git pull --ff-only` refuse (see the harness distribution doc).
 - **A `catch` that discards `stderr` disguises a deterministic bug as a flaky one.** This bug went undiagnosed for months purely because `catch (e)` threw git's stderr away while git was naming the exact cause on every single run. Any retry wrapper around a shell command in this repo must surface `e.stderr || e.stdout` on final failure.
 
+- **`--mirror` copies the whole KB into `<repo>/.claude/knowledge`** (~784 files in togatech), untracked in app repos. Never commit it to an app repo. Hide it locally with `.git/info/exclude` (add `.claude/knowledge/`) — do not edit the app's `.gitignore` for it.
+
 ## Related
 
 - [Harness Distribution](harness-distribution.md)

package/knowledge/standalone/apps/togatech/INDEX.md

@@ -4,7 +4,7 @@
 |-----|---------|
 | [TOGA Technology Website Architecture](architecture.md) | Public TOGA Technology marketing site — standalone React/TS SPA (no PHP framework); open for stack, bootstrap, routing, page layout, integrations, build/deploy. |
 | [Careers Section — Live Paylocity Job Openings (About page + /v2/campaigns/jobs proxy)](features/careers-paylocity-job-openings.md) | togatech About page "Join Our Team" section — live Paylocity jobs via unauthenticated `GET /v2/campaigns/jobs` record-script proxy; open for the fetch→proxy→map |
-| [NavV2 Global Nav — menus, scroll reveal, Talos FAB](features/navv2-global-nav.md) | togatech NavV2 header (designer "phase one"): data-driven menus, `data-nav-reveal` scroll hide/show, opt-in `data-nav-pinned` for sticky scenes, Talos FAB rules |
+| [NavV2 Global Nav — menus, panel shell, scroll reveal, Talos FAB](features/navv2-global-nav.md) | togatech NavV2 header (designer "phase one"): data-driven menus, one shared panel shell + WebGL canvas, `data-nav-reveal` scroll hide/show, opt-in `data-nav-pin |
 | [SEO / AEO / GEO — Prerendering, Single-Source Meta & Structured Data](features/seo-aeo-geo-prerender.md) | togatech SEO/AEO/GEO — build-time Puppeteer prerender + single-source per-page meta + JSON-LD; open for the robots-gating de-index bug and Amplify build require |
 | [Talos Product Page (/talos) — ported designer prototype](features/talos-product-page.md) | togatech `/talos` Talos AI product page, ported from a designer HTML/JSX/CSS prototype; open for the design-port CSS approach, re-porting a new design drop, laz |
 | [Creating Pull Requests on togatech](workflows/creating-pull-requests.md) | Open a PR on `agilantsolutions/togatech` — `gh` CLI lacks `read:org`, so use a raw GitHub REST call with the keychain token; base is `_production`. |

package/knowledge/standalone/apps/togatech/features/navv2-global-nav.md

@@ -1,5 +1,5 @@
 ---
-title: NavV2 Global Nav — menus, scroll reveal, Talos FAB
+title: NavV2 Global Nav — menus, panel shell, scroll reveal, Talos FAB
 framework: "standalone"
 repo: togatech
 project: TOGA Technology Website
@@ -12,8 +12,11 @@ files:
   - togatech/src/components/NavV2/view/NavV2.tsx
   - togatech/src/components/NavV2/view/TalosFab.tsx
   - togatech/src/components/NavV2/view/NavDestLink.tsx
+  - togatech/src/components/NavV2/view/SilkCanvas.tsx
   - togatech/src/components/NavV2/view/panels/WhatPanel.tsx
   - togatech/src/components/NavV2/view/panels/CompanyPanel.tsx
+  - togatech/src/components/NavV2/view/panels/IndustriesPanel.tsx
+  - togatech/src/components/NavV2/view/panels/ResourcesPanel.tsx
   - togatech/src/components/NavV2/view/panels/PanelFooter.tsx
   - togatech/src/components/NavV2/navV2.module.css
   - togatech/src/components/NavV2/types.ts
@@ -26,12 +29,15 @@ files:
   - togatech/src/components/NavV2/viewModel/FIELDS/NAVFIELDS.json
   - togatech/src/components/MobileNav/MobileNav.tsx
   - togatech/src/styles/index.css
+  - togatech/public/assets/nav/logo-talos-ai.svg
+  - togatech/public/assets/nav/logo-toga-platform.svg
+  - togatech/tailwind.config.js
 related:
   - ../architecture.md
   - talos-product-page.md
 ---
 
-togatech NavV2 header (designer "phase one"): data-driven menus, `data-nav-reveal` scroll hide/show, opt-in `data-nav-pinned` for sticky scenes, Talos FAB rules, design-anchor rule. Open before touching the nav or adding a full-screen sticky section.
+togatech NavV2 header (designer "phase one"): data-driven menus, one shared panel shell + WebGL canvas, `data-nav-reveal` scroll hide/show, opt-in `data-nav-pinned` for sticky scenes, Talos FAB rules, design-anchor rule. Open before touching the nav or adding a full-screen sticky section.
 
 ## Summary
 
@@ -44,6 +50,16 @@ Global header in `src/components/NavV2/` (MVVM: `view/`, `viewModel/`, menu data
 - Flat links are `flatLinks[]` (was single `flatLink`): The TOGA Blog → `/blog` stub, Contact.
 - What we do has 2 tabs (Business Units, Platforms). Tab hover switches the tab but never moves keyboard focus (`useRovingTabs`).
 - Company panel and What-we-do share `panels/PanelFooter.tsx`.
+- Platforms tab titles ("Talos AI", "TOGa Platform") show a brand logo on the left: data is `logo: {src, size}` in `NAVFIELDS.json` (`PlatformLogo` in `types.ts`), files in `public/assets/nav/` (Talos 38px, TOGa Platform 32px), 9px gap, class `.platformTitle`.
+
+**Panel shell (one for all menus):** `NavV2.tsx` renders the only `.panel` (`hidden={!anyOpen}`) with the only `<SilkCanvas active={anyOpen}/>` + `.panelScrimOverlay`. Panel components (What / Industries / Company / Resources) return just their `.panelPad` div with `id` (the `aria-controls` target) and `data-screen-label`.
+- **Never put a `.panel` shell or a `SilkCanvas` inside a panel component.** Each canvas is a WebGL context; one canvas per panel made a new context on every menu open (Chrome keeps only ~16 live).
+- `.panel[hidden]{display:none}` is required — `.panel{display:flex}` beats the `hidden` attribute.
+- `navPanelIn` slide-in plays on open (display none → flex restarts it); switching menu to menu does not replay it.
+
+**Type:** matches the designer type spec (see Gotchas). `navV2.module.css` resets the site-wide word-spacing inside the nav: `.root :where(p,h2,h3,h4,h5,h6,a,li,button){word-spacing:normal}` (same idea as `/talos` — see [talos-product-page.md](talos-product-page.md) Gotchas).
+
+**Mobile:** `MobileNav` closes on resize only when width > 1280 (`MOBILE_NAV_MAX_WIDTH_PX`), matching `tailwind.config.js` `md: {max:'1280px'}` (AppLayout: NavV2 `md:hidden`, hamburger `hidden md:block`).
 
 **Scroll reveal (`useNavReveal.ts`):** sets `data-nav-reveal = top | hidden | shown` on the **nav root**, not `<html>`.
 - `top` within 80px of page top. Hides after 8px scroll down; shows after 8px scroll up.
@@ -63,7 +79,11 @@ Global header in `src/components/NavV2/` (MVVM: `view/`, `viewModel/`, menu data
 - **Design anchors usually do not exist on our pages.** Use a design link anchor (`#apps`, `#solutions`, `#culture`, `#mission`, `#team`, `#why-us`, …) only if that id exists on the target page; otherwise keep the `navRoutes.ts` route / `/company/*` stub. None of the phase-one anchors exist today.
 - Between ~88px scroll and one screen, neither bar nor FAB shows. Matches the design; open question with tcox — do not "fix" without asking.
 - `/ai-solutions` stub is no longer linked from the nav.
+- **Tailwind screens here are max-width (desktop-first):** `md:` means "≤ 1280px", not "≥ 768px".
+- **Tailwind line-height traps:** `text-xs/sm/base/lg` set their own line-height; `leading-normal` is `1.5`, not CSS `line-height: normal`. When the design says "normal", use `leading-[normal]`.
+- **Set logo size by inline style, not the `height` attribute** — Tailwind preflight `img{height:auto}` overrides it (the TOGa Platform SVG is 98x100, not square).
 - Nav type spec (sizes, weights, spacing, line-height, colour) is `navigation-type-spec.md`, attached to ClickUp TRUE-82043. Check nav type changes against it.
 
 ## Change history
+- 2026-10-12 — Type spec match, Platforms logos, one shared panel shell + SilkCanvas (WebGL context leak fix), MobileNav closes only above 1280px (TRUE-82042, tcox)
 - 2026-10-05 — Phase-one redesign: 4 → 2 menus, `flatLinks[]`, Platforms/Company panels rebuilt, scroll reveal + `data-nav-pinned`, compact viewport, FAB visibility rules (tcox)

package/knowledge/standalone/apps/togatech/features/talos-product-page.md

@@ -6,7 +6,7 @@ project: TOGA Technology Website
 client: shared
 type: feature
 status: active
-updated: 2026-10-05
+updated: 2026-10-12
 owners: ["tcox"]
 files:
   - togatech/src/pages/Talos/TalosPage.tsx
@@ -14,6 +14,9 @@ files:
   - togatech/src/pages/Talos/viewModel/useTalosSparks.ts
   - togatech/src/pages/Talos/viewModel/useGlassPanes.ts
   - togatech/src/pages/Talos/viewModel/useTalosPanelSky.ts
+  - togatech/src/pages/Talos/viewModel/useTalosSubnav.ts
+  - togatech/src/pages/Talos/viewModel/FIELDS
+  - togatech/src/pages/Talos/view/sections/TalosChoosing/TalosChoosing.tsx
   - togatech/src/pages/Talos/view/shared/Reveal.tsx
   - togatech/src/pages/Talos/view/sections/TalosHero
   - togatech/src/pages/Talos/view/sections/TalosVoice
@@ -42,7 +45,8 @@ togatech `/talos` Talos AI product page, ported from a designer HTML/JSX/CSS pro
 - After regenerating, re-apply the port edits: add any design token the CSS uses but our copy lacks (the first port missed `--ease-enter`, so `.reveal` / `.tlh-enter` / `.tpl-rev` had no valid transition); drop `.needs-dev*`, `.tvq*`, and design `.talos-fab{display:none !important}` (it is for the design's orb launcher and would hide our NavV2 FAB until the orb is ported).
 - **Not a CSS module:** the design JS finds elements by raw class names/ids and sets keyframe names inline; CSS-module hashing breaks all of that. (CTO-reviewed choice.)
 - Design timing workarounds are kept on purpose: IntersectionObserver + rect-poll backstops and `setTimeout` retry chains (rAF / ResizeObserver can go silent on cold load). Animation loops pause off-screen and on hidden tab.
-- `<html>`-level styles (`overflow-x: clip` so `position: sticky` works — never `hidden`; `scroll-behavior: smooth`) are set in `useLayoutEffect` and **removed** on unmount, not "restored" (a prerendered snapshot already carries them, so the "previous" value is wrong).
+- `<html>`-level styles (`overflow-x: clip` so `position: sticky` works — never `hidden`; `scroll-behavior: smooth`) are set in `useLayoutEffect` (`useRootStyles` in `TalosPage.tsx`) and **removed** on unmount, not "restored" (a prerendered snapshot already carries them, so the "previous" value is wrong).
+- **Reduced motion:** under `prefers-reduced-motion`, `useRootStyles` skips `scroll-behavior: smooth` and `useTalosSubnav` scrolls with `behavior: "instant"` — `"auto"` inherits the `<html>` smooth setting.
 
 **Code-split + prerender:** `routes.tsx` wraps the page in `React.lazy` + `<Suspense fallback={null}>` inside the route `Component`. Rules in [seo-aeo-geo-prerender.md](seo-aeo-geo-prerender.md). Page-specific: `useGlassPanes` `useFitGap` (56px under the lede) skips on the `TOGAPrerender` UA so the snapshot does not bake the crawler-viewport margin.
 
@@ -55,7 +59,11 @@ togatech `/talos` Talos AI product page, ported from a designer HTML/JSX/CSS pro
 
 **Routing:** `/talos` is in `LIVE_ROUTES` (`NavV2/navRoutes.ts`) and `src/routes.config.json`. Sub-pages `/talos/one|flow|engage` are still `STUB_ROUTES`.
 
-**Copy:** the design's default `COPY.katie` set (Katie signs off copy). Still placeholder: FAQ answers and the demo stage (no video).
+**Copy:** the design's default `COPY.katie` set (Katie signs off copy). Not production-ready yet (new ticket pending, as of 2026-10-12):
+- `TALOSFAQFIELDS.json` — 6 answers are "[Answer not written. Needs Jeff.]"; "Certification three/four" are placeholders.
+- `TALOSVOICEFIELDS.json` — quote still flagged as placeholder.
+- `TalosChoosing` card CTAs ("Book a demo", "See TOGa Platform") are plain spans with no link.
+- Demo stage has no video.
 
 ## Port status (design drop 2, 2026-10)
 
@@ -76,5 +84,6 @@ Design's `HeroWeave` / `HeroDots` / old Hero are dead code — do not port.
 - Tailwind preflight is global and can differ from the design's browser defaults — check margins/list/button resets when a section looks off.
 
 ## Change history
+- 2026-10-12 — Reduced-motion: no smooth scroll on `<html>`, instant subnav jumps; listed open placeholder copy/CTAs (TRUE-82042, tcox)
 - 2026-10-05 — Design drop 2, batches 1–2: talos.css regen (+`--ease-enter`, `.talos-mark`), Hero "Ask Talos", Voice → `.tproof-*`, FAQ bridge rules, useFitGap prerender skip (tcox)
 - 2026-09-25 — Built /talos from the designer prototype; added Outlet context `openTalosChat`, `ROUTES_WITH_OWN_FOOTER`, TalosFab now opens chat (tcox)

package/knowledge/standalone/apps/togatech/workflows/local-dev-and-headless-verification.md

@@ -6,12 +6,14 @@ project: TOGA Technology Website
 client: shared
 type: workflow
 status: active
-updated: 2026-10-05
+updated: 2026-10-12
 owners: ["tcox"]
 files:
   - togatech/package.json
   - togatech/cypress.config.ts
   - togatech/src/App.tsx
+  - togatech/tsconfig.json
+  - togatech/tsconfig.app.json
 related:
   - ../architecture.md
   - ../features/careers-paylocity-job-openings.md
@@ -28,7 +30,7 @@ The gotcha-avoidance path for getting `togatech` up on a dev machine and actuall
 1. **`npm install` before anything else, every time you pull.** A stale `node_modules` shows up as a Vite resolve error, not as a missing dependency: `"react-helmet-async" is imported by … but could not be resolved`. Both `react-helmet-async` and `react-google-recaptcha-v3` are declared in `package.json` (added by the SEO work) but absent from an older install, and the site simply will not load.
 2. **Start the dev server** — `npm run dev`, or `npm run togatech` for the `--host togatech` variant (Vite `allowedHosts: ["togatech"]`).
 3. **Clear localStorage before judging any data fetch.** `App.tsx` wraps the app in `PersistQueryClientProvider` with the persister key **`"commerce"`** and a **24h `staleTime`**, so a previously cached query (e.g. `jobPosts`) renders from localStorage with **no network request at all**. Clear the persisted cache **and** `accessToken` / `refreshToken` — a stale public token from `POST /v2/auth/public` will otherwise be reused too.
-4. **Do not expect `npm run lint` to work.** The script is `eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0`, but **`eslint` is not in `package.json` dependencies or devDependencies at all** — there is no local binary, so a clean install cannot lint. There is also **no ESLint config** — ad hoc `npx eslint` fails with "couldn't find an eslint.config.* file". Type-check with `npx tsc --noEmit -p tsconfig.app.json`; it has **many pre-existing unrelated errors**, so filter the output by the paths you touched.
+4. **Do not expect `npm run lint` to work.** The script is `eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0`, but **`eslint` is not in `package.json` dependencies or devDependencies at all** — there is no local binary, so a clean install cannot lint. There is also **no ESLint config** — ad hoc `npx eslint` fails with "couldn't find an eslint.config.* file". Type-check with `npx tsc --noEmit -p tsconfig.app.json` — **not** `-p .`: root `tsconfig.json` has `"files": []` (references only), so `tsc -p .` and the `tsc` step in `npm run build` check nothing. It has pre-existing errors (13 on 2026-10-12, in Modal.tsx, PinScroll.tsx, TalosChat.tsx, IQ.tsx, OurHistory.tsx, routes.tsx, getFontAwesomeIcon.tsx), so filter the output by the paths you touched.
 5. **If Cypress won't run, verify headlessly with the repo's Puppeteer.** `cypress` 15.11 fails its own binary verification on this Windows machine — `bad option: --smoke-test` — and `npx cypress install` does **not** fix it. Workaround: `puppeteer` is already a dependency, so drive **system Chrome** directly by passing `executablePath` to `puppeteer.launch()`, navigate to the dev-server URL, and assert on the rendered DOM (the section testids, e.g. `job-posting-section` / `job-opening-cards`). Same technique the production build already uses in `scripts/prerender.mjs`.
 
 ## Gotchas
@@ -46,5 +48,6 @@ The gotcha-avoidance path for getting `togatech` up on a dev machine and actuall
 - [Careers Section — Live Paylocity Job Openings](../features/careers-paylocity-job-openings.md)
 
 ## Change history
+- 2026-10-12 — Root tsconfig checks nothing (build's `tsc` does not type-check); 13 known errors (tcox)
 - 2026-10-05 — Prod build sends GA hits from localhost; robotsPlugin closeBundle fails without dist/ (tcox)
 - 2026-09-25 — No eslint config either; `tsc -p tsconfig.app.json` path-filter tip; robotsPlugin ignores --outDir (tcox)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1000",
+  "version": "1.0.1002",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",