toga-ai 1.0.1091 → 1.0.1093

package/knowledge/1.0/apps/library/features/app-cloud-aws-credentials.md

@@ -6,7 +6,7 @@ project: Library
 client: shared
 type: feature
 status: active
-updated: 2026-10-19
+updated: 2026-10-20
 owners: [jcardinal, mhammontree, bala, snaredla]
 files:
   - library/app/cloud.php
@@ -75,7 +75,7 @@ CodePipeline `Worker` (502, us-west-2) sources `_production` of **both** `agilan
 - `togadesk` `ebs/check_s3fs.php` + `ebs/register_instance_to_shared_application_load_balancer.php` now assume `WorkloadsRuntime` (TRUE-82718, PR #622, merged 2026-10-13); togaview fix is PR #307 (opened). The s3fs **mount** cannot assume a role — it uses the instance role directly: see [asifiles s3fs mount](../../togadesk/features/s3fs-asifiles-file-storage.md).
 - **Every 1.0 app that bootstraps `library` needs `aws/aws-sdk-php` in its own `composer.json`** (since TRUE-82705). Without it any App_Cloud call fatals `Class 'Aws\Credentials\CredentialProvider' not found`. Hidden trigger: on prod/worker/bigworker, `App_Database::getDatabaseReaderHost()` (`library/app/database.php` ~156) calls `App_Cloud::getParameter('database_reader_endpoint')` whenever its cache file `databaseReadHost.txt` is older than 30-60 s. The fatal hits before the cache is rewritten, so the cache stays stale and **every** reader-DB request fails — the app looks fully down (TRUE-82793: Vision PunchOut for Canon / S&P Global via SAP Ariba returned HTTP 500). Fix = add `"aws/aws-sdk-php": "^3.328"` and pin `composer.lock` to worker's prod versions (aws-sdk-php 3.328.1, guzzle 7.9.2, promises 2.0.4, psr7 2.7.0, jmespath 2.8.0 — PHP 7.2 safe); EB runs `composer install --no-dev` on deploy (`vendor/` is gitignored).
   - Has it (`_production`): worker, togadesk (`^3.337`), togaview, tools, toga (TRUE-82714, 63c5ed0; confirmed 2026-10-16), vision (TRUE-82793, merged + deployed 2026-10-15).
-  - store: fixed on branch (TRUE-82856, ae1861f4f — same pins plus aws-crt-php 1.2.7, psr/http-client 1.0.3, polyfill-mbstring 1.31.0; verified on PHP 7.2.33); needs merge + deploy. Its `.ebextensions/015_install_composer.config` already runs `composer install --no-dev`.
+  - store: fixed on branch (TRUE-82856, ae1861f4f — same pins plus aws-crt-php 1.2.7, psr/http-client 1.0.3, polyfill-mbstring 1.31.0; verified on PHP 7.2.33); **still unmerged on 2026-10-20** — caused the S&P Global Ariba PunchOut outage (TRUE-82959: every store page HTTP 500 at `library/app/cloud.php:127`; Guided Buying shows "Unable to connect to supplier's website"). Needs merge + deploy. Its `.ebextensions/015_install_composer.config` already runs `composer install --no-dev`.
   - **Missed by the audit (TRUE-82935): the 1.0 `api` repo** (no composer at all) and **togadesk's email cron** (`crons/tickets.php` loads only `desk/vendor/autoload.php`; the root togadesk composer with aws is not loaded there). Both stopped `App_Cloud`: [Talos ticket API](../../api/features/talos-ticket-endpoint.md), [email intake](../../togadesk/features/email-to-ticket-intake.md). Audit per **entry point**, not per repo: a CLI cron or sub-app can load a different autoloader than the web app.
   - The missing class throws **`Error`, not `Exception`** — `catch (Exception)` around an App_Cloud call does not catch it; use `\Throwable` where a fallback is meant.
   - Not changed on TRUE-82856: walmarttechservices — GitHub repo `agilantsolutions/walmarttechservices` no longer exists ("Repository not found", checked 2026-10-16); webhook — reported no longer active by the developer (2026-10-16). Removal / deprecation is left to the owners.
@@ -84,6 +84,7 @@ CodePipeline `Worker` (502, us-west-2) sources `_production` of **both** `agilan
 - Every long-lived key still in code across repos (SES SMTP, s3fs, ALB scripts, other accounts): [audit 2026-10-13](../../../../2.0/apps/worker2/features/cross-account-aws-access.md#long-lived-keys-still-in-code-audit-2026-10-13).
 
 ## Change history
+- 2026-10-20 — store aws-sdk fix still unmerged; caused S&P Global PunchOut outage (TRUE-82959) (snaredla)
 - 2026-10-19 — aws-sdk-php audit missed `api` + togadesk email cron; `Error` not `Exception` (TRUE-82935) (jcardinal)
 - 2026-10-16 — aws-sdk-php: store fixed (TRUE-82856), vision deployed, walmarttechservices + webhook not changed (repo gone / reported inactive) (mhammontree)
 - 2026-10-15 — aws-sdk-php requirement: reader-host crash path, per-app audit, vision fixed (TRUE-82793) (mhammontree)

package/knowledge/1.0/apps/library/features/error-capture-1-0.md

@@ -6,8 +6,8 @@ project: Library
 client: shared
 type: feature
 status: active
-updated: 2026-10-13
-owners: ["jcardinal", "mhammontree", "bala"]
+updated: 2026-10-20
+owners: ["jcardinal", "mhammontree", "bala", "snaredla"]
 files:
   - library/app/error/capture.php
   - library/app/error.php
@@ -119,7 +119,7 @@ Two things are specifically 1.0:
 
 - **Looking for a 1.0 cron fatal? Query `Logs.Issue` on environment `prod`, ordered by `dtLastOccurred`.** The legacy `Logs.Errors` and `Vision_Log.ErrorLog` tables do **not** carry 1.0 cron fatals — searching them wastes time (2026-09-18, DOE outbound-cron outage). Uncaught exceptions reach here via `App_Error::handleException` → `captureException()`, which returns the short quotable reference. **A `catch` BYPASSES capture** — if you catch per record, call `App_Error_Capture::captureException($e)` yourself, and put only the returned reference (never `$e->getMessage()`, which can carry a raw vendor response body) into an email or log.
 - **Vision does not capture — use Sentry.** `vision/config.prod.ini` has no `[database_toga2logs]` section, so vision errors never reach `Logs.Issue`; only Sentry project `vision` has them. Do not search `Logs.Issue` for vision errors.
-- **Open, not fixed (TRUE-82793): a PHP `\Error` (e.g. class not found) breaks the Sentry path and prints the stack trace on the prod page.** `library/app/error.php` ~646 builds `ReflectionProperty('\ErrorException' or '\Exception', 'message')`; `setValue` on an `\Error` throws `Cannot access protected property Error::$message`, which hides the real error, and the catch (~653) calls `debugVar($sentryException, false)`, which prints the full trace to the client (info leak). Fix idea: use `'\Error'` when `$exception instanceof \Error`.
+- **`\Error` and `\Exception` declare `$message` separately — reflect the right base class.** `App_Error::handleException` (`library/app/error.php` ~646) reflected `\Exception::$message` on a PHP `\Error` (e.g. class not found) → `Cannot access protected property Error::$message`, so the error never reached Sentry, and the catch `debugVar()`-ed the full trace onto the prod page (TRUE-82793). Fixed on library branch TRUE-82959: reflect `'\Error'` when `instanceof \Error`, else `'\Exception'`; the catch now `error_log()`s and only `debugVar()`s under `App_Registry::inDevMode()`.
 - **A `*/` inside PHP docblock prose silently closes the comment early.** Writing something like `list*/fetch*` in a `/** … */` block ends the docblock at the `*/`, and `php -l` then reports a confusing `syntax error, unexpected token` on a later line. Hit while documenting the NetSuite throw sites. Avoid the literal `*/` in docblock text.
 - **⚠ A grouped `Logs.Issue` row can show a STALE error id — read the live api2 transaction log for the current error.** Two facts combine to mislead: (1) `Event.errorMessage` is **`varchar(255)`**, so a long API response is **truncated** — often before the trailing error id; and (2) `Logs.Issue.subject` / `Issue.errorMessage` hold the **first-occurrence** text, so a long-lived issue keeps showing the error id from whenever it was first seen even after the per-call error has changed. Observed 2026-08-17: issue `3H` still displayed `EO-1` / `3G-6` (the original undefined-method fatal) while the current per-call failure was actually `EV-11` (an FK 1451 on a DELETE). **To see what is failing *now*, read the live api2 transaction log (`Logs_<client>.Api.responsePayload`) for the specific call — not the grouped `Issue` row.**
 - **Any PHP warning inside capture code would kill the request.** 1.0's `App_Error::handleError()` routes **every** PHP warning into `handleException()`, which renders the red box and calls `exit()` — so a single warning raised while capturing (an unreachable IMDS endpoint is the everyday case: `file_get_contents` warns before returning `false`) terminates the request or cron mid-run while reporting an unrelated error. 2.0's equivalent handler *throws*, which a `catch` absorbs. `captureException()` therefore sets `App_Error::setThrowExceptionsEnabled(false)` for its own duration and restores it in `finally`. This disables the **handler**, not real throws — `App_Query` raises a plain `throw new Exception` on DB errors, so genuine failures still reach the catch. **This is a general 1.0 trap for any code that must not escalate**, not just error capture.
@@ -130,6 +130,7 @@ Two things are specifically 1.0:
 - **⚠ The legacy pre-Sentry handler dumps the entire config on any error it renders.** `library/app/DELETE_DOA_PRE-SENTRY_error.php` is a dead-named but still-reachable handler whose `htmlBacktrace()` does `print_r($entry['args'])` for **every** frame. On 2026-08-05 a real error page on **https://towfoundation.togaview.com** rendered ~26 pages containing the whole config array — production DB host/user/password, SES SMTP credentials, NetSuite credentials, Payeezy API key/secret/merchant token, SSL Store token — plus ticket PII. The current `library/app/error.php` is safe (it dumps only under `App_Registry::inDevMode()`), but **both** handlers gate on `inDevMode()`, so the affected host was **evaluating as dev mode in production**. Two actions: (1) verify `inDevMode()` per host in production before trusting any error page not to leak, and (2) delete the legacy handler. Rotation of every exposed credential **was escalated to Jeff on 2026-08-05; confirmation that it was completed is still owed** — treat those credentials as compromised until confirmed. (No values are recorded here or anywhere in the KB.)
 
 ## Change history
+- 2026-10-20 — Fixed `\Error` reflection + prod trace dump in `handleException` (TRUE-82959) (snaredla)
 - 2026-10-15 — Vision has no Logs capture (Sentry only); open `\Error` reflection leak in `error.php` (TRUE-82793) (mhammontree)
 - 2026-10-13 — Open issue: handler crash `App_Error_Capture not found` on tools prod hides the real error (TRUE-82662) (bala)
 - 2026-10-12 — Removed the committed-AWS-key gotcha: key deleted, `App_Cloud` assumes `WorkloadsRuntime` (TRUE-82705) (jcardinal)

package/knowledge/2.0/apps/worker2/features/qa-qc-review-pipeline.md

@@ -6,8 +6,8 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-10-06
-owners: ["jcardinal", "ajean"]
+updated: 2026-10-20
+owners: ["jcardinal", "ajean", "kyalamarthi"]
 files:
   - worker2/Worker/Clickup/QaReview.php
   - worker2/Worker/Clickup/QcReview.php
@@ -68,6 +68,8 @@ the QA/QC branch — see [QA/QC branch automation](./qa-qc-branch-automation.md)
 `_Worker_Clickup::handleDevelopmentFinished` is the entry to the QA chain. Fires when a task
 **enters** "Development Finished". **Moved off the legacy leaving-trigger** — the old code triggered
 when a task *left* a status; the QA/QC entry must be on entering the status.
+The same `case 'development finished':` first stamps `Team.Tasks.dtDone` for every sprint task, outside
+the scope check — see [Team Sprint Management](./team-sprint-management.md) (data model).
 
 ### Review-field reset on status ENTRY (`_Worker_Clickup::resetReviewFieldOnStatusEntry`)
 
@@ -221,8 +223,9 @@ Batch) QC Review → Stage or Client Review → To Deploy → **manual** deploy.
 - **`_Component_Api_Clickup::ACCESS_TOKEN` is a hardcoded, committed ClickUp token.** It must be
   **rotated and moved to an environment variable**. (Only the location is recorded here — never the
   value.) See also [ClickUp credential rotation](../workflows/clickup-credential-rotation.md).
-- **Pre-existing unescaped `custom_id` SQL sites** exist in `worker2/Worker/Clickup.php` — a separate
-  ticket to escape/cast them.
+- **Pre-existing unescaped SQL in `worker2/Worker/Clickup.php`** — `custom_id`, and `$taskId` (from
+  `$payload->task_id`) interpolated into Team SQL file-wide with no `_Database::escape()`. Separate
+  ticket. New SQL in this file must escape `$taskId` — do not copy the old pattern.
 
 ## Related
 
@@ -231,6 +234,7 @@ Batch) QC Review → Stage or Client Review → To Deploy → **manual** deploy.
 - [ClickUp custom-field conventions](./clickup-custom-field-conventions.md)
 
 ## Change history
+- 2026-10-20 — Development Finished case now also stamps `dtDone` (moved from `ui review`); unescaped `$taskId` gap recorded (kyalamarthi; TRUE-82723)
 - 2026-10-06 — BE Review `Conflict` now routes to Rework + revert like Denied (QaReview + FeatureReview) (jcardinal)
 - 2026-10-01 — DevFinished CatchUp (cron 86); QC Batch turned on (id 75); review fields reset to Needs Review on entry; Stage deploys confirmed manual (ajean; worker2 PR #178, dbchanges2 PR #504)
 - 2026-09-25 — Scope narrowed to Dev Sprints `90116585845` (jcardinal)

package/knowledge/2.0/apps/worker2/features/team-sprint-management.md

@@ -6,10 +6,11 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-10-01
+updated: 2026-10-20
 owners: ["jcardinal", "kyalamarthi", "ajean"]
 files:
   - worker2/Worker/Team/Sprint.php
+  - worker2/Worker/Clickup.php
   - worker2/Config/production.ini
   - _underscore/Model/Team/Sprint.php
   - dbchanges2/Core/2026-09-29a - Record sprint and design CronJobs.sql
@@ -19,6 +20,7 @@ related:
   - ./clickup-work-type-automation.md
   - ./clickup-project-routing.md
   - ./clickup-general-automation.md
+  - ./qa-qc-review-pipeline.md
   - ./committed-secrets-and-config-debt.md
   - ../workflows/sprint-clickup-folder-repoint.md
   - ../workflows/php-runtime-upgrade-dependency-audit.md
@@ -224,6 +226,17 @@ values matter:
   `dtDone IS NOT NULL` is the Power BI "done" test used by the KPI tiles and burndown; `dtCompleted IS
   NOT NULL` is the "Complete" test used by the per-dev segment breakdown. Do not substitute one for the
   other.
+- **`dtDone` is stamped on the FIRST ClickUp move to `development finished`** (since 2026-10-20,
+  TRUE-82723; before that it was `ui review`). Writer: the `taskStatusUpdated` webhook switch in
+  `Worker/Clickup.php`, `case 'development finished':` — for any task with a `sprint N` tag, **before
+  and outside** `isTaskInQaQcScope()`; `dtDone IS NULL` guard keeps the first time. So every
+  `dtDone`-based consumer (Power BI, tools `/developer`, api2 sprint Record Scripts) now counts a task
+  done at Development Finished. Old rows were **not** backfilled — rows stamped under the UI Review
+  rule keep their value. `dtCompleted` (set on `complete`) is unchanged. The comment in
+  `dbchanges2/Core/2026-04-30 - Team Tasks dtDone dtCompleted.sql` ("captured when task reaches UI
+  Review") is stale; the migration already ran — do not edit it.
+- **Only that webhook sets `dtDone`.** `Capture*`, `SprintLock`, and `Clickup/DevFinished/CatchUp` do
+  not — a missed webhook, or a task with no `Tasks` row yet in that sprint, leaves `dtDone` NULL.
 - **`sprintPointsNow` / `sprintPointsAtLock`** — the points measured by every dashboard metric below
   use `sprintPointsNow` (current state), not the at-lock value.
 
@@ -412,9 +425,6 @@ see [TOGa Talos Sprint Dashboard API](../../api2/features/sprint-dashboard-api.m
   one map for both jobs. This pattern is replicated identically in `SprintLock()`, `CaptureSprintEnd()`,
   and `CaptureSprintDaily()` — fix all three together.
 
-## Change history
-- 2026-09-25 — renamed product references from "TOGa IQ" to "TOGa Talos" (rebrand; TOGa IQ is now the separate `toga25-iq` app) (jcardinal)
-
 ## Related
 
 - [Worker (worker2) Architecture](../architecture.md)
@@ -426,6 +436,7 @@ see [TOGa Talos Sprint Dashboard API](../../api2/features/sprint-dashboard-api.m
 - [Record Scripts](../../api2/features/record-scripts.md)
 
 ## Change history
+- 2026-10-20 — `dtDone` now stamped on first move to `development finished`, not `ui review`; no backfill (kyalamarthi; TRUE-82723, worker2 `cc5f001`)
 - 2026-10-01 — getSprint() deterministic + null-safe; JSON run summaries; SprintEnd skips before capture; release-notes key from `[talos] api_key`; SprintLock copies/resets Condition; new ResetInProgress + scheduled warning wrappers; cron rows recorded in dbchanges2 (ajean; worker2 PR #178, #179)
-- 2026-09-25 — Condition write removed from SprintLock (reversed 2026-10-01) (jcardinal)
+- 2026-09-25 — Condition write removed from SprintLock (reversed 2026-10-01); "TOGa IQ" → "TOGa Talos" rebrand (jcardinal)
 - 2026-09-16 — Repointed to the Dev Sprints folder; tables reset (kyalamarthi)

package/knowledge/clients/spglobal/profile.md

@@ -5,13 +5,16 @@ apps:
   - library
   - worker
   - vision
+  - store
 project: Worker
 client: spglobal
 type: profile
 status: active
-updated: 2026-10-15
-owners: ["jcardinal", "mhammontree"]
-files: []
+updated: 2026-10-20
+owners: ["jcardinal", "mhammontree", "snaredla"]
+files:
+  - store/_/app/framework.php
+  - store/common/spglobal/welcome/get.php
 related:
   - ../../1.0/apps/worker/features/netsuite-togasupply-per-client-sync.md
   - ../../1.0/apps/library/features/app-cloud-aws-credentials.md
@@ -28,4 +31,4 @@ S&P Global TOGa-Supply NetSuite integration client on the shared 1.0 worker+libr
 ## Integration touchpoints
 
 - **`worker` / `library` (1.0)** — shared togasupply sync engine + `App_Api_Toga2` bridge.
-- **`vision` (1.0) — PunchOut from SAP Ariba** (same flow as Canon). Outage example + fix: TRUE-82793, see [1.0 AWS credentials](../../1.0/apps/library/features/app-cloud-aws-credentials.md#gotchas). Vision errors are in Sentry only, not `Logs.Issue`.
+- **`store` (1.0) — PunchOut from SAP Ariba** (Classic Buyer + Guided Buying) lands on `spglobal.togacommerce.com`: spglobal host block in `store/_/app/framework.php`, client code in `store/common/spglobal/`. Not vision (that is Canon's flow). A store HTTP 500 shows in Guided Buying as "Unable to connect to supplier's website". Outage 2026-10-20 (TRUE-82959): store missing `aws/aws-sdk-php`, see [1.0 AWS credentials](../../1.0/apps/library/features/app-cloud-aws-credentials.md#gotchas).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1091",
+  "version": "1.0.1093",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",