toga-ai 1.0.1083 → 1.0.1085

package/knowledge/clients/prudential/profile.md

@@ -17,7 +17,7 @@ project: _Underscore
 client: prudential
 type: profile
 status: active
-updated: 2026-10-18
+updated: 2026-10-19
 owners: ["jcardinal", "rgirish", "bala", "mhammontree"]
 files: []
 related:
@@ -121,6 +121,13 @@ The order-created cron branches on this id; the shipped/delivered crons branch o
   The 15-minute `prudential_auth_rejection_alert.php` cron now alerts on them — see
   features/service-request-auth-rejection-alert.md.
 
+- **Daily "Prudential REQ's Processing Report" recipients are hardcoded.** Sent by 1.0
+  `worker/crons/notifications/reports/prudential_exception_report.php` (NOT the sibling
+  `reports/prudential/` folder), scheduled in `worker/schedules/cron.worker.notification.json` as
+  "Prudential Exception Report (9:00 AM)". Recipients = the `$emailTo` PHP array near the top of the
+  file (a hardcoded list of togatech.com addresses, all TO, no CC); no DB table or setting. To add or
+  remove someone: edit that array, deploy worker `_production` (CodePipeline `Worker`). (TRUE-82925)
+
 - **SR number race (TRUE-82209: ServiceNow bursts → 1062 `Duplicate entry 'SR…'` → 400 `EV-10`, SR lost).** Fixed by
   per-client record numbers from `RecordNumbers` (TRUE-82715; SR series continues); the `usleep` stopgap in `_Model_Prudential_ServiceRequest::prePost()`
   is removed. Load-test with a distinct contact + serial per call and `customer.uuid` set. See

package/knowledge/clients/rate/INDEX.md

@@ -8,11 +8,12 @@
 | [Rate Monthly Reconciliation Report](features/monthly-reconciliation-report.md) | 1.0 | Monthly cron that emails an Excel reconciliation of Rate subscription orders + PayPal payments; open when changing the report columns, filters, or recipients. |
 | [Rate SalesOrder → NetSuite CashSale Export (postPost)](features/netsuite-cashsale-export.md) | 2.0 | How a Rate SalesOrder postPost writes a NetSuite CashSale (ship-to address + line-item internalId resolution); open when touching Rate's NetSuite export. |
 | [Rate PayPal Subscription Purchase & Webhook Pipeline](features/paypal-subscription-purchase-webhook.md) | 2.0 | How Rate PayPal subscription purchases are created (browser primary, webhook fallback) and how the worker2 webhook handles lifecycle events; open before touchin |
-| [Rate SAML SSO](features/saml-sso.md) | 2.0 | How Rate users sign in via Azure AD SAML through the TOGa gateway, plus assertion attributes and the loan-officer upsert; open when debugging Rate login or user |
+| [Rate SAML SSO](features/saml-sso.md) | 2.0 | How Rate users sign in via Azure AD SAML through the TOGa gateway, plus assertion attributes and the loan-officer upsert (and why the LO is usually missing); op |
 | [Service Card Entitlement Display](features/service-card-entitlements.md) | 2.0 | How Rate's home/services pages render one service card per purchased entitlement (per-entitlement, own pinned address for warranty); open when touching service |
 | [Rate Service-Purchase Confirmation Emails (Tech / Warranty)](features/service-purchase-emails.md) | 2.0 | How Rate purchase-confirmation emails (tech vs warranty) are triggered from the entitlement postPost and sent off-thread from DB-stored templates; open when edi |
 | [Rate Tech-Support Subscription Cancellation (portal self-service)](features/subscription-cancellation.md) | 2.0 | Portal self-service cancellation of a Rate tech-support subscription (cancel at PayPal, wind down to period end); open before touching the cancel flow, the two- |
 | [Rate Whole Home Warranty Per-Address Purchase Guard](features/whole-home-warranty-purchase-guard.md) | 2.0 | The `prePost` guard enforcing one active Whole Home Warranty per validated address (global), via USPS DPV + unit-level dedup; open before touching the WH guard, |
 | [Rate](profile.md) | 2.0 | Rate client profile (mortgage/lending; home warranty + home tech support on TOGa View, SAML SSO); open when starting any Rate work. |
+| [Rate — Fill a customer-sent active-subscriptions report from Client_Rate](workflows/active-subscriptions-report-data.md) | 2.0 | How to fill missing columns (address, loan officer, payments) in a report Rate sends us, by hand from prod `Client_Rate`, and how to match their rows; open when |
 | [Rate — Annual SSL Certificate Renewal (4 Home Warranty / Home Tech Support domains)](workflows/annual-ssl-certificate-renewal.md) | 2.0 | How to generate the four Rate CSRs each year, what to send the GR System team, and what never to send; open when Rate's certs are near expiry. |
 | [Rate — Backfill a Missed PayPal Sale (Toga + NetSuite reconciliation)](workflows/paypal-sale-backfill-and-reconciliation.md) | 2.0 | How to put a PayPal sale that Toga or NetSuite missed back into both systems, by hand; open when reconciling Rate PayPal vs Toga vs NetSuite or when a webhook w |

package/knowledge/clients/rate/features/monthly-reconciliation-report.md

@@ -7,13 +7,14 @@ client: rate
 type: client-feature
 status: active
 updated: 2026-09-16
-owners: ["rgirish"]
+owners: ["rgirish", "bala"]
 files:
   - worker/crons/notifications/reports/rate/send_monthly_rate_purchases_report.php
   - worker/schedules/cron.worker.notification.json
 related:
   - clients/rate/features/saml-sso.md
   - clients/rate/profile.md
+  - clients/rate/workflows/active-subscriptions-report-data.md
 ---
 Monthly cron that emails an Excel reconciliation of Rate subscription orders + PayPal payments; open when changing the report columns, filters, or recipients.
 

package/knowledge/clients/rate/features/saml-sso.md

@@ -5,17 +5,19 @@ project: SAML SSO Gateway
 client: rate
 type: client-feature
 status: active
-updated: 2026-09-16
-owners: ["rgirish"]
+updated: 2026-10-19
+owners: ["rgirish", "bala"]
 files:
   - _underscore/Model/Rate/ClientAuthentication.php
   - saml/Controller/Index.php
   - toga2-view/src/hooks/useAuthenticationFlow.ts
+  - toga2-view/src/routes.tsx
 related:
   - 2.0/apps/saml/architecture.md
   - 2.0/apps/saml/features/rate-user-provisioning.md
+  - clients/rate/workflows/active-subscriptions-report-data.md
 ---
-How Rate users sign in via Azure AD SAML through the TOGa gateway, plus assertion attributes and the loan-officer upsert; open when debugging Rate login or user provisioning.
+How Rate users sign in via Azure AD SAML through the TOGa gateway, plus assertion attributes and the loan-officer upsert (and why the LO is usually missing); open when debugging Rate login, user provisioning, or loan officer data.
 
 ## Summary
 Rate uses Azure AD as its IdP (`login.rate.com`). Users sign in at Rate's portal, which redirects to the TOGa SAML gateway at `saml.togahub.com/acs`. On success the gateway redirects the browser back to the Rate frontend with a `?saml=` encrypted payload.
@@ -23,7 +25,7 @@ Rate uses Azure AD as its IdP (`login.rate.com`). Users sign in at Rate's portal
 ## How it works
 
 ### SAML assertion attributes
-Rate's Azure AD sends these attributes in the assertion:
+Rate's Azure AD sends these attributes in the assertion (`ClientAuthentication.php` ~L19-23 reads only these):
 | Attribute key | Description | Required |
 |---|---|---|
 | `borrowerID` | Borrower UUID — used as `c_borrowerId` to identify/create users | Yes |
@@ -32,7 +34,7 @@ Rate's Azure AD sends these attributes in the assertion:
 | `lastName` | Last name | No (null-safe) |
 | `phoneNumber` | Phone number | No (null-safe) |
 
-`borrowerID` is a UUID string (not numeric).
+`borrowerID` is a UUID string (not numeric). No loan officer attribute is sent.
 
 ### Frontend SAML landing (`useAuthenticationFlow.ts`)
 1. If `?saml=` is in the URL: strip it immediately via `window.history.replaceState` (prevents stale payload replay on refresh), then call `/v2/auth/encrypted-user-uuid`.
@@ -40,15 +42,30 @@ Rate's Azure AD sends these attributes in the assertion:
 3. On error: navigate to `/login`.
 
 ### Loan officer upsert
-After successful auth, if `urlParameters` contains `loid` + `loname`:
+Source: the loan officer reaches us **only** as `loid` (short numeric, e.g. `38623`) + `loname` query params on the landing link Rate sends the borrower. `routes.tsx` (~L52-57) saves every non-`saml` query param to localStorage `urlParameters`. The raw assertion / RelayState / landing URL is never stored.
+
+After successful auth, if `urlParameters` contains `loid` + `loname` (`useAuthenticationFlow.ts` ~L72-115):
 1. Fetch the user's Contact to get their Customer UUID.
-2. Search `Contacts` by `c_loid` — PUT to update name if found; POST to create with `contactType = 'Loan Officer'` (UUID `d1f67efc-a984-aebc-42f5-5313f44f52ed`) linked to the customer.
+2. Search `Contacts` by `c_loid` (global, not per customer) — PUT to update name if found; POST to create with `contactTypeId = 1` 'Loan Officer' (UUID `d1f67efc-a984-aebc-42f5-5313f44f52ed`) linked to the customer.
+
+No `loid` in the link → no `/v2/contacts?...c_loid` call, no loan officer row. Prod 2026-10-19: only 9 loan officer Contacts in `Client_Rate` (first 2026-06-14) vs 734 customers.
+
+Options for more coverage (not built):
+- Ask Rate to add a loan officer attribute to the assertion next to `borrowerID`; read it in `ClientAuthentication.php`.
+- Backfill: send Rate the `Customers.c_borrowerId` list; Rate maps borrower → loan officer.
 
 ## Gotchas
 - **`?saml=` replay** — the frontend strips the param immediately after processing. Before this fix, refreshing replayed the stale payload → EZ-1 "Invalid User".
 - **New users silently not created (Apr 2 – Jun 11 2026)** — `_Database::register()` auto-starts a lazy transaction; the saml gateway never called `transactionCommit()`, so all new user INSERTs were rolled back silently. Fixed by adding `_Database::transactionCommit()` before the redirect in `saml/Controller/Index.php`.
 - **Both saml and _underscore must be deployed together** — saml pulls `_underscore` at EB build time. A fix in `_underscore` requires a saml redeploy to take effect.
+- **Loan officer never linked to a second borrower (bug, not fixed).** The `c_loid` lookup is global; if the LO exists it only PUTs `firstName`/`lastName`. `Contacts.customerId` stays the first borrower, so later borrowers of the same LO show none. One Contact row = one customer, so the model cannot hold one LO for many borrowers as-is; a fix needs a link table or a per-customer LO row.
+- **`borrowerId` is not the loan officer id.** `Customers.c_borrowerId` / `Users.c_borrowerId` is Rate's IdP UUID, one per customer (prod 2026-10-19: 734 customers, 734 distinct). LO ids are short numerics in `Contacts.c_loid`. The SSO default role `roleId = 1` is *named* 'Loan Officer' (`ClientAuthentication.php` ~L74) — it is only the access role.
+- **Missing LOs cannot be recovered from our side** — nothing that carried them is persisted. Only Rate can supply them.
 
 ## Related
 - [SAML architecture](2.0/apps/saml/architecture.md)
 - [Rate user provisioning](2.0/apps/saml/features/rate-user-provisioning.md)
+- [Rate active-subscriptions report data](clients/rate/workflows/active-subscriptions-report-data.md)
+
+## Change history
+- 2026-10-19 — Documented loan officer source (landing-link `loid` only), the global-lookup link gap, and borrowerId vs `c_loid` (TRUE-82942) (bala)

package/knowledge/clients/rate/profile.md

@@ -14,7 +14,7 @@ project: SAML SSO Gateway
 client: rate
 type: profile
 status: active
-updated: 2026-10-14
+updated: 2026-10-19
 owners: ["rgirish", "bala", "mhammontree", "tcox"]
 files: []
 related:
@@ -29,6 +29,7 @@ related:
   - clients/rate/features/home-warranty-terms-content.md
   - clients/rate/workflows/annual-ssl-certificate-renewal.md
   - clients/rate/workflows/paypal-sale-backfill-and-reconciliation.md
+  - clients/rate/workflows/active-subscriptions-report-data.md
 ---
 Rate client profile (mortgage/lending; home warranty + home tech support on TOGa View, SAML SSO); open when starting any Rate work.
 

package/knowledge/clients/rate/workflows/active-subscriptions-report-data.md

@@ -0,0 +1,45 @@
+---
+title: "Rate — Fill a customer-sent active-subscriptions report from Client_Rate"
+framework: "2.0"
+project: SAML SSO Gateway
+client: rate
+type: workflow
+status: active
+updated: 2026-10-19
+owners: ["bala"]
+files:
+  - worker/crons/notifications/reports/rate/send_monthly_rate_purchases_report.php
+related:
+  - ../profile.md
+  - ../features/monthly-reconciliation-report.md
+  - ../features/saml-sso.md
+  - ../features/service-card-entitlements.md
+  - ../workflows/paypal-sale-backfill-and-reconciliation.md
+---
+How to fill missing columns (address, loan officer, payments) in a report Rate sends us, by hand from prod `Client_Rate`, and how to match their rows; open when Rate asks for subscription data or names in their own template.
+
+## Summary
+Rate sends a PayPal-based template (customer name, email, product, start date, ...) and asks us to fill gaps. Pull from `Client_Rate` (read-only), match each row carefully, and flag disagreements instead of overwriting. Loan officer is usually not available — see [SAML SSO](../features/saml-sso.md) *Loan officer upsert*.
+
+## How it works
+
+### Join path
+- `Subscriptions` → `Entitlements` (`Entitlements.subscriptionId`) → `Contacts` (`Entitlements.contactId`) → `Customers` (`Contacts.customerId`).
+- Address: `Entitlements.serviceAddressId` → `Addresses` + `States.code` (column is `code`, not `abbreviation`). `Contacts.primaryContactAddressId` points at the same address.
+- Payments: `Entitlements_SalesOrders` → `SalesOrders` → `SalesOrders_Payments` → `Payments`.
+- Loan officer: `Contacts` with `contactTypeId = 1` and `c_loid`, owned by the customer (`customerId`). Rarely present.
+
+### Matching a report row to our data
+1. Match on name + address + start date, not email alone.
+2. The report email (PayPal email) can differ from `Users.email` / `ContactEmailAddresses` (seen: one letter off; a different gmail).
+3. `Customers.name` can be a different household member than the name in the report.
+4. Fill only proven matches. List unmatched rows for the requester.
+
+## Gotchas
+- **Premium Tech Support ($9.97) entitlements have no address** — the tech support checkout never collects one. Only Whole Home Warranty ($89.97) has one. A blank address there is correct, not missing data.
+- **`Subscriptions.isActive` can disagree with Rate's PayPal-based template.** Flag it; do not change either side.
+- **`Logs_Rate.Api` is ~3.9M rows.** Broad `LIKE` scans on `requestPayload` / `route` over months time out (300s). Always filter a narrow `dtStamp` window plus `userId`.
+- The [monthly reconciliation report](../features/monthly-reconciliation-report.md) cron uses the same joins; reuse its SQL as a starting point.
+
+## Change history
+- 2026-10-19 — Created from the TRUE-82942 Rate active-subscriptions data request (bala)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1083",
+  "version": "1.0.1085",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",