toga-ai 1.0.1065 → 1.0.1067

package/knowledge/2.0/apps/_underscore/features/customer-locations-files-notes.md

@@ -15,6 +15,7 @@ files:
   - _underscore/Model/Client/CustomerNote.php
   - dbchanges2/Core/2026-10-17b - CustomerLocationsFilesNotesActivity.sql
   - dbchanges2/Client/2026-10-17b - CustomerLocationsFilesNotes.sql
+  - dbchanges2/Core/2026-10-17d - CustomerNotesRecordFieldNames.sql
 related:
   - ./record-hard-delete.md
   - ./record-activity-timeline.md
@@ -66,6 +67,9 @@ RecordFields 2801-2814 cover the three new records.
 - **`_contactCount` must stay non-stored** — a stored self-aggregate deadlocks the save cascade
   ([details](./model-save-parent-cascade-stored-field-deadlock.md)).
 - **Assets link to a customer through Contacts** (`Units.contactId → Contacts.customerId`), not directly.
+- **Copied RecordFields need `name`.** `CaseNotes` RecordFields 2743-2749 have NULL `name` (not fixed), so the
+  copy 2809-2814 came out NULL too; filled by `Core/2026-10-17d`. Set `name` on every new RecordField.
 
 ## Change history
+- 2026-10-17 — Filled NULL `name` on RecordFields 2809-2814 (Core/2026-10-17d). (jcardinal)
 - 2026-10-17 — Created: primaryLocationId, _contactCount, Locations_Customers, Customers_Files, CustomerNotes (TRUE-82870). (jcardinal)

package/knowledge/2.0/apps/toga25-blox/INDEX.md

@@ -4,4 +4,5 @@
 |-----|---------|
 | [TOGa Blox 2.5 — Architecture](architecture.md) | Shared React+TS SOURCE library for the new platform apps (new platform apps first; replaces toga-blox for all apps over time); read the ADR for full detail, not |
 | [Old blox (toga-blox) straight port inside toga25-blox](features/old-blox-port.md) | Old `@agilant/toga-blox` code copied unchanged into toga25-blox (blox-v1 layer); open before touching any old component, its checks/config, or merging Storybook |
+| [GitHub Actions → AWS role via OIDC (trust policy + sub claim)](workflows/github-actions-aws-oidc-role.md) | How a GitHub Actions job assumes an AWS IAM role with OIDC, and the `sub` claim trap; open before creating or debugging any GitHub-to-AWS role ("Not authorized |
 | [Moving an old app from @agilant/toga-blox onto toga25-blox](workflows/moving-an-old-app-onto-toga25-blox.md) | Planned steps to switch an old app off the `@agilant/toga-blox` npm package onto toga25-blox source with zero import edits; open before moving any old app. |

package/knowledge/2.0/apps/toga25-blox/workflows/github-actions-aws-oidc-role.md

@@ -0,0 +1,47 @@
+---
+title: GitHub Actions → AWS role via OIDC (trust policy + sub claim)
+framework: "2.0"
+repo: toga25-blox
+project: TOGa Blox 2.5
+client: shared
+type: workflow
+status: active
+updated: 2026-10-17
+owners: [jcardinal]
+files:
+  - toga25-blox/.github/workflows/apps-build.yml
+  - toga25-blox/docs/ci-and-deploy.md
+related:
+  - ../architecture.md
+  - ../../../standards/secrets-and-build-credentials.md
+---
+How a GitHub Actions job assumes an AWS IAM role with OIDC, and the `sub` claim trap; open before creating or debugging any GitHub-to-AWS role ("Not authorized to perform sts:AssumeRoleWithWebIdentity").
+
+## Summary
+
+Today's only user: toga25-blox `apps-build.yml` job `app-deps` → role
+`arn:aws:iam::975050298201:role/github-actions-toga25-blox` (non-prod) → reads Secrets Manager `build/*` in
+prod `654654170868` (secret layout: [secrets standard](../../../standards/secrets-and-build-credentials.md)).
+
+## Steps (new role or new repo)
+
+1. Check the repo's OIDC subject format first:
+   `gh api repos/<owner>/<repo>/actions/oidc/customization/sub`.
+   - `use_immutable_subject: true` → token `sub` = `repo:<owner>@<ownerId>/<repo>@<repoId>:<context>`
+     (toga25-blox: `repo:agilantsolutions@44615971/toga25-blox@1388231315:<context>`).
+   - otherwise → `repo:<owner>/<repo>:<context>`.
+2. In the role trust policy (provider `token.actions.githubusercontent.com`), set `aud` =
+   `sts.amazonaws.com` and `StringLike` `token.actions.githubusercontent.com:sub` to a **list holding both
+   forms** (immutable + name), each ending `:*` or the exact context.
+3. Workflow needs `permissions: id-token: write` and `aws-actions/configure-aws-credentials` with the role ARN.
+4. Prove it with a real run — the job log shows the assumed role, not just a green YAML lint.
+
+## Gotchas
+
+- **Name-only `sub` in the trust policy fails silently forever** on a repo with immutable subjects. The
+  `app-deps` job failed on every run from 2026-09-28 (when added) until 2026-10-17 for this reason.
+- `toga25-blox/docs/ci-and-deploy.md` setup steps 33-37 still show only the name form — fix them when next
+  in that repo.
+
+## Change history
+- 2026-10-17 — Created: root cause of `app-deps` never passing (immutable OIDC subject); trust now lists both forms (TRUE-82870). (jcardinal)

package/knowledge/2.0/standards/secrets-and-build-credentials.md

@@ -12,6 +12,7 @@ related:
   - ../apps/_underscore/features/cloud-secrets-manager.md
   - ../apps/api2/architecture.md
   - ../apps/toga25-blox/architecture.md
+  - ../apps/toga25-blox/workflows/github-actions-aws-oidc-role.md
 ---
 
 Every secret a machine (build, CI, app) reads lives in one place, AWS Secrets Manager in the production account; open before adding, reading, or rotating any credential.
@@ -44,7 +45,7 @@ Secret is encrypted with KMS key `alias/toga-secrets` (key policy lets non-prod
 ### Build readers today (non-prod `975050298201`)
 
 - `amplify-platform-build` — Amplify service role; inline policy `platform-build-secrets-read` grants `secretsmanager:GetSecretValue` on prod `secret:build/*` + `kms:Decrypt` on `toga-secrets` via Secrets Manager. Attached to Amplify app `toga25-desk` (`d311sdoq12ddne`).
-- `github-actions-toga25-blox` — GitHub OIDC provider (`token.actions.githubusercontent.com`), scoped to repo `agilantsolutions/toga25-blox` only, same policy shape. Used by `.github/workflows/apps-build.yml`.
+- `github-actions-toga25-blox` — GitHub OIDC provider (`token.actions.githubusercontent.com`), scoped to repo `toga25-blox` only (trust `sub` lists both the immutable `agilantsolutions@44615971/toga25-blox@1388231315` form and the name form — see [GitHub Actions → AWS OIDC role](../apps/toga25-blox/workflows/github-actions-aws-oidc-role.md)), same policy shape. Used by `.github/workflows/apps-build.yml`.
 - **Open item:** production Amplify builds need their own `amplify-platform-build` role in the **prod** account (same-account read — no cross-account sharing needed there).
 
 ## Adding a secret / a reader

package/knowledge/INDEX.md

@@ -34,7 +34,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **toga25-supply** (TOGa 2.5 Supply) — 26 doc(s) → [2.0/apps/toga25-supply/INDEX.md](2.0/apps/toga25-supply/INDEX.md)
 - **toga25-iq** (TOGa IQ) — 1 doc(s) → [2.0/apps/toga25-iq/INDEX.md](2.0/apps/toga25-iq/INDEX.md)
 - **toga25-desk** (TOGa Desk 2.5) — 1 doc(s) → [2.0/apps/toga25-desk/INDEX.md](2.0/apps/toga25-desk/INDEX.md)
-- **toga25-blox** (TOGa Blox 2.5) — 3 doc(s) → [2.0/apps/toga25-blox/INDEX.md](2.0/apps/toga25-blox/INDEX.md)
+- **toga25-blox** (TOGa Blox 2.5) — 4 doc(s) → [2.0/apps/toga25-blox/INDEX.md](2.0/apps/toga25-blox/INDEX.md)
 - **toga-blox** (TOGa Blox) — 15 doc(s) → [2.0/apps/toga-blox/INDEX.md](2.0/apps/toga-blox/INDEX.md)
 
 ## standalone framework

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1065",
+  "version": "1.0.1067",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/skills/finish/SKILL.md

@@ -577,7 +577,16 @@ developer the list name and leave the status alone.
 
 ## Step 17 — Report
 
-Short list:
+Short list. **Start the report with the ticket line — REQUIRED, always first** (team rule,
+2026-10-17), so the developer can get back to the ticket:
+
+```
+**Ticket:** TRUE-82870 — https://app.clickup.com/t/8577082/TRUE-82870
+```
+
+Link = `https://app.clickup.com/t/<CLICKUP_WORKSPACE_ID>/<TICKET>` with the ticket's custom id
+(`CLICKUP_WORKSPACE_ID` = `8577082`, the TOGA ClickUp workspace). Add the ticket title after
+the link when known.
 
 1. KB: publish status (Step 5).
 2. **Central ids — REQUIRED, always present, never skipped** (team rule, 2026-10-17). Its own