toga-ai 1.0.1104 → 1.0.1106

package/knowledge/1.0/apps/library/INDEX.md

@@ -33,6 +33,7 @@
 | [NetSuite SuiteQL/REST API Reference](features/netsuite-suiteql-api-reference.md) | Working reference for the Agilant NetSuite REST/SuiteQL integration (`App_Api_Netsuite_Rest`): auth, SuiteQL mechanics, table schemas, type/status codes, perfor |
 | [NetSuite SuiteQL/REST Shim — Field Semantics](features/netsuite-suiteql-rest-shim.md) | Non-obvious NetSuite SuiteQL/REST field semantics behind `App_Api_Netsuite_Rest` shims (signs, `tl.id`==line, `iscogs`, ShipItem cost, `createdFrom`, shim-shape |
 | [NetSuite Sync Alert Monitor (App_SystemMonitor_NetSuiteIntegration)](features/netsuite-sync-alert-monitor.md) | 1.0 monitor `App_SystemMonitor_NetSuiteIntegration` — flags stale per-client NetSuite sync checkpoints (>48h) to ClickUp; open when a sync-stale alert is missin |
+| [Running library (1.0) on PHP 8.4 / 8.5 — deprecations that kill requests](features/php-8-5-runtime-compatibility.md) | Which library calls/signatures fatal a 1.0 app on PHP 8.4/8.5, the guard pattern that stays PHP 7.2 safe, what is fixed and what is still open; open before movi |
 | [Startech PC Matic B2B Sync (library)](features/startech-pcmaticb2b-sync.md) | PC Matic B2B bidirectional ticket sync between TOGaDesk 1.0 and TOGA 2.0 (`App_Api_Toga2`); open for ticket-type maps, StarTech client onboarding, the per-clien |
 | [App_Api_Toga2 — TOGa2 API Client & 1.0↔2.0 Sync Bridge](features/toga2-api-client-and-bridge.md) | `App_Api_Toga2` — the 1.0-side client for the TOGa2/api2 REST API + cross-framework sync routines (`send`/`authenticate`, options DSL, `syncWithToga`/`syncWithT |
 | [Transfer order ↔ PO link reconcile (both directions, header + line, from NetSuite)](features/transfer-order-purchase-order-link-reconcile.md) | `App_Api_Toga2::reconcileTransferOrderPurchaseOrderLinks()` makes one TO's PO links (upstream + downstream, header + line) match NetSuite; open before touching |

package/knowledge/1.0/apps/library/features/error-capture-1-0.md

@@ -6,8 +6,8 @@ project: Library
 client: shared
 type: feature
 status: active
-updated: 2026-10-20
-owners: ["jcardinal", "mhammontree", "bala", "snaredla"]
+updated: 2026-10-22
+owners: ["jcardinal", "mhammontree", "bala", "snaredla", "rgirish"]
 files:
   - library/app/error/capture.php
   - library/app/error.php
@@ -123,13 +123,14 @@ Two things are specifically 1.0:
 - **A `*/` inside PHP docblock prose silently closes the comment early.** Writing something like `list*/fetch*` in a `/** … */` block ends the docblock at the `*/`, and `php -l` then reports a confusing `syntax error, unexpected token` on a later line. Hit while documenting the NetSuite throw sites. Avoid the literal `*/` in docblock text.
 - **⚠ A grouped `Logs.Issue` row can show a STALE error id — read the live api2 transaction log for the current error.** Two facts combine to mislead: (1) `Event.errorMessage` is **`varchar(255)`**, so a long API response is **truncated** — often before the trailing error id; and (2) `Logs.Issue.subject` / `Issue.errorMessage` hold the **first-occurrence** text, so a long-lived issue keeps showing the error id from whenever it was first seen even after the per-call error has changed. Observed 2026-08-17: issue `3H` still displayed `EO-1` / `3G-6` (the original undefined-method fatal) while the current per-call failure was actually `EV-11` (an FK 1451 on a DELETE). **To see what is failing *now*, read the live api2 transaction log (`Logs_<client>.Api.responsePayload`) for the specific call — not the grouped `Issue` row.**
 - **Any PHP warning inside capture code would kill the request.** 1.0's `App_Error::handleError()` routes **every** PHP warning into `handleException()`, which renders the red box and calls `exit()` — so a single warning raised while capturing (an unreachable IMDS endpoint is the everyday case: `file_get_contents` warns before returning `false`) terminates the request or cron mid-run while reporting an unrelated error. 2.0's equivalent handler *throws*, which a `catch` absorbs. `captureException()` therefore sets `App_Error::setThrowExceptionsEnabled(false)` for its own duration and restores it in `finally`. This disables the **handler**, not real throws — `App_Query` raises a plain `throw new Exception` on DB errors, so genuine failures still reach the catch. **This is a general 1.0 trap for any code that must not escalate**, not just error capture.
-- **Open, root cause not proven: `Class "App_Error_Capture" not found` hides the real error.** Seen once on tools prod (PHP 8.5, 2026-10-13, first Compass VIP "Check file" click; the next click worked). `App_Error::handleException` (`library/app/error.php` ~line 402) calls `App_Error_Capture::captureException()`; the library autoloader's `require_once` of `app/error/capture.php` itself raised an error, so the handler crashed and the original error was lost. Suspect: a PHP 8.5 deprecation in `capture.php` promoted to a fatal on first compile. Next step: pull the tools EB logs for that time to find the original error.
+- **Open, root cause not proven: `Class "App_Error_Capture" not found` hides the real error.** Seen once on tools prod (PHP 8.5, 2026-10-13, first Compass VIP "Check file" click; the next click worked). `App_Error::handleException` (`library/app/error.php` ~line 402) calls `App_Error_Capture::captureException()`; the library autoloader's `require_once` of `app/error/capture.php` itself raised an error, so the handler crashed and the original error was lost. Suspect: a PHP 8.5 deprecation in `capture.php` promoted to a fatal on first compile. Likely candidate: `ReflectionProperty::setAccessible()` (deprecated 8.5) — guarded with `PHP_VERSION_ID < 80100` on TRUE-83059 (see [PHP 8.5 runtime compatibility](./php-8-5-runtime-compatibility.md)); not proven. Next step: pull the tools EB logs for that time to find the original error.
 - **No typed properties anywhere in `library/`.** 1.0 runs **PHP 7.2**; a deploy failed with `syntax error, unexpected '?'` on `private static ?string $memoryReserve`. Nine typed properties across `error.php`, `error/capture.php`, and `exception/business.php` were converted to untyped with `@var` docblocks. Parameter and return types are fine (7.0/7.1).
 - **An early `return` can make a fallback unreachable.** Two bugs in the first EB-environment attempt: a `return` when `get-config` was not executable skipped the `describe-tags` fallback entirely — i.e. the fallback was dead on the only platform that needed it — and the CLI call omitted `App_Cloud::$preCommands`, so it did not authenticate the way every other 1.0 AWS call does. (`$preCommands` now assumes `WorkloadsRuntime`, which has `ec2:*` — see [1.0 AWS credentials](./app-cloud-aws-credentials.md).)
 - **Fingerprint scheme changes re-group existing issues once.** Moving to file+function frames and the class+entryPoint fallback changes hashes, so open issues re-fingerprint on first occurrence after deploy. Deliberate; merge old hashes onto the curated Issue with the Tools merge-fingerprint box.
 - **⚠ The legacy pre-Sentry handler dumps the entire config on any error it renders.** `library/app/DELETE_DOA_PRE-SENTRY_error.php` is a dead-named but still-reachable handler whose `htmlBacktrace()` does `print_r($entry['args'])` for **every** frame. On 2026-08-05 a real error page on **https://towfoundation.togaview.com** rendered ~26 pages containing the whole config array — production DB host/user/password, SES SMTP credentials, NetSuite credentials, Payeezy API key/secret/merchant token, SSL Store token — plus ticket PII. The current `library/app/error.php` is safe (it dumps only under `App_Registry::inDevMode()`), but **both** handlers gate on `inDevMode()`, so the affected host was **evaluating as dev mode in production**. Two actions: (1) verify `inDevMode()` per host in production before trusting any error page not to leak, and (2) delete the legacy handler. Rotation of every exposed credential **was escalated to Jeff on 2026-08-05; confirmation that it was completed is still owed** — treat those credentials as compromised until confirmed. (No values are recorded here or anywhere in the KB.)
 
 ## Change history
+- 2026-10-22 — `setAccessible()` guarded for PHP 8.5 in `error.php` / `capture.php`; likely cause of the open handler crash (TRUE-83059) (rgirish)
 - 2026-10-20 — Fixed `\Error` reflection + prod trace dump in `handleException` (TRUE-82959) (snaredla)
 - 2026-10-15 — Vision has no Logs capture (Sentry only); open `\Error` reflection leak in `error.php` (TRUE-82793) (mhammontree)
 - 2026-10-13 — Open issue: handler crash `App_Error_Capture not found` on tools prod hides the real error (TRUE-82662) (bala)

package/knowledge/1.0/apps/library/features/php-8-5-runtime-compatibility.md

@@ -0,0 +1,58 @@
+---
+title: Running library (1.0) on PHP 8.4 / 8.5 — deprecations that kill requests
+framework: "1.0"
+repo: library
+project: Library
+client: shared
+type: feature
+status: active
+updated: 2026-10-22
+owners: ["rgirish"]
+files:
+  - library/app/error.php
+  - library/app/error/capture.php
+  - library/app/apitransaction.php
+  - library/app/string.php
+  - library/app/cloud.php
+  - library/app/email.php
+  - library/app/model/servicerequest.php
+  - library/app/soaptransaction.php
+related:
+  - error-capture-1-0.md
+  - ../../walmart-activate/workflows/deploy-to-elastic-beanstalk-al2023.md
+  - ../../tools/workflows/deploy-to-elastic-beanstalk-al2023.md
+---
+
+Which library calls/signatures fatal a 1.0 app on PHP 8.4/8.5, the guard pattern that stays PHP 7.2 safe, what is fixed and what is still open; open before moving any 1.0 app to PHP 8.4+.
+
+## Summary
+
+`App_Error::handleError` turns every PHP error, including `E_DEPRECATED`, into `handleException()`, which renders and calls `exit`. So on PHP 8.4/8.5 one deprecation — even a compile-time one raised when the autoloader loads a file — ends the request. library must stay PHP 7.2 safe (other 1.0 apps still run 7.2), so fixes are version guards or 7.1-valid syntax, never 8.x-only syntax.
+
+## How it works
+
+Fix patterns (TRUE-83059, commit `d28f9b23`):
+
+| Deprecated in | Call / pattern | Fix |
+|---|---|---|
+| 8.5 | `curl_close()` (`app/apitransaction.php`) | call only when `PHP_VERSION_ID < 80000` |
+| 8.5 | `xml_parser_free()` (`app/string.php`) | call only when `PHP_VERSION_ID < 80000` |
+| 8.5 | `ReflectionProperty::setAccessible()` (`app/error.php` x3, `app/error/capture.php`) | call only when `PHP_VERSION_ID < 80100` |
+| 8.4 | implicit nullable `string $x = null` | explicit `?string $x = null` (valid since 7.1) |
+
+Implicit-nullable fixes so far: `App_Cloud::getDatabaseInstances`, `App_Cloud::sendOverAs2Connector`, `App_Email::setQueueForSending`, `App_Model_ServiceRequest::triggerStatusEvent`.
+
+**Find the rest:** run `php -l` with a PHP 8.4+ binary and `-d display_errors=1` on each file — it prints compile-time deprecations per file. Runtime-only ones (`curl_close`, `setAccessible`, `utf8_decode`) need a grep.
+
+## Gotchas
+
+- **Still open as of 2026-10-22 (will exit any 1.0 app on 8.4/8.5 that loads them):**
+  - `app/soaptransaction.php` — `__setSoapHeaders` / `__doRequest` return types do not match `SoapClient`.
+  - implicit nullable params: `app/edi.php`, `app/api/nycdoe.php`, `app/api/DOA_nycdoe.php`, `app/api/nycdoev2.php`, `app/api/mcafee.php`, `browser/modal.php`, `browser/sidebar.php`, several `app/model/togadesk/*`.
+  - `app/tdemailtoticket.php` has a parse error.
+  - `App_Model_ServiceRequest::ajaxLoadItemDialog` uses `utf8_decode` (deprecated 8.2).
+- An app only dies on files it loads — Walmart Activate runs on 8.5 with the open list above because it never loads those classes. A new 8.5 app must re-check its own load path.
+- Local dev on PHP 8.2 does not show 8.4/8.5 deprecations — test with an 8.5 binary.
+
+## Change history
+- 2026-10-22 — Created: guard pattern, fixed list, open list from the Walmart Activate 8.5 move (TRUE-83059) (rgirish)

package/knowledge/1.0/apps/tools/workflows/deploy-to-elastic-beanstalk-al2023.md

@@ -6,8 +6,8 @@ project: Tools
 client: shared
 type: workflow
 status: active
-updated: 2026-10-08
-owners: [jcardinal, bala]
+updated: 2026-10-22
+owners: [jcardinal, bala, rgirish]
 files:
   - tools/.ebextensions/004_http_to_https.config
   - tools/.ebextensions/008_setup_ldap.config
@@ -17,7 +17,7 @@ files:
   - tools/.ebextensions/050_register_instance_to_shared_application_load_balancer.config
   - tools/.platform/hooks/prebuild/01-install-php-pgsql.sh
   - tools/.platform/hooks/prebuild/02-install-php-redis.sh
-  - tools/ebs/git.json
+  - tools/.platform/hooks/postdeploy/01_link_resources.sh
   - tools/ebs/setup_export_cache_folders.php
   - tools/_/app/framework.php
   - tools/_/app/frameworkindex.php
@@ -55,9 +55,9 @@ The `application.ini` sets `include_path = ".:/var/www/library"`, upload/post li
 
 The replacement is pure bash via a cfn-init `files:` block that writes `/tmp/clone_git_repos.sh` (mode `000755`) plus a `container_commands` entry that runs `bash /tmp/clone_git_repos.sh`. It clones:
 - `agilantsolutions/library`   branch `_production` → `/var/www/library`
-- `agilantsolutions/resources` branch `_production` → `/var/app/ondeck/resources`
+- `agilantsolutions/resources` branch `_production` → `/opt/resources`, then `.platform/hooks/postdeploy/01_link_resources.sh` runs `ln -sfn /opt/resources /var/app/current/resources`.
 
-`ebs/git.json` was corrected to match: branch `_production` for both repos and the resources path set to `/var/app/ondeck/resources`.
+Tools no longer ships `ebs/git.json`. Store and Walmart Activate clone `resources` straight into the AL2023 staging dir `/var/app/staging/resources` instead (see [Walmart Activate deploy](../../walmart-activate/workflows/deploy-to-elastic-beanstalk-al2023.md)).
 
 ### Native PHP extensions — prebuild hooks (phpredis, pgsql)
 Native PECL extensions are installed by `.platform/hooks/prebuild/*.sh` scripts, not `.ebextensions`. `02-install-php-redis.sh` installs phpredis (needed for the Redis sessions below); `01-install-php-pgsql.sh` installs pgsql (needed only by the Talos "Knowledge Bases" create flow). Both target the platform php `php-common-8.5.6`. The durable AL2023 gotchas:
@@ -105,7 +105,7 @@ The deploy clones `agilantsolutions/library` and `resources` via `020_setup_git_
 
 ## Gotchas (durable AL2023 / EB rules)
 - **php-fpm on AL2023 defaults to `clear_env=yes`, so `getenv()` cannot see EB environment properties.** An EB environment property (e.g. `GITHUB_TOKEN`) that is set correctly still returns `false` from `getenv()` under php-fpm on AL2023, because the FPM pool strips the environment. Read such a value from **`getenv()` AND `$_SERVER` AND `$_ENV`** (the property reaches PHP via the superglobals even when `getenv()` is blind), and fall back to a config key for local dev. Never log/echo the value.
-- **Write new-deploy files to `/var/app/ondeck/<path>`, never `/var/www/html/<path>` during `container_commands`.** While container_commands run, `/var/www/html` still symlinks to the **old** app. After the deploy swap, `/var/app/ondeck` becomes `/var/app/current` (= `/var/www/html`). Writing to `/var/www/html` during container_commands writes into the currently-running old app.
+- **Write new-deploy files to `/var/app/staging/<path>`, never `/var/www/html/<path>` during `container_commands`.** On AL2023 the new bundle is unpacked to `/var/app/staging` (`/var/app/ondeck` is the old AL1 name — it does not exist here). While container_commands run, `/var/www/html` still symlinks to the **old** app. After the deploy swap, `/var/app/staging` becomes `/var/app/current` (= `/var/www/html`). Writing to `/var/www/html` during container_commands writes into the currently-running old app.
 - **Only `/var/log/eb-activity.log` (and `cfn-init.log`) are captured in EB bundle snapshots.** Custom log files under `/var/log/` are invisible unless you SSH the instance. Deploy scripts should log to `/var/log/eb-activity.log`.
 - **CodePipeline-dependent scripts are no-ops for apps without a pipeline.** `setup_git_libraries.php` silently does nothing when the DB has no `CodePipelineEnvironments` row — fatal for a brand-new app, since nothing gets cloned and the failure is silent.
 - **Make clone failures block the deploy.** The bash clone script does `exit 1` on clone failure so the deploy fails visibly, rather than succeeding and serving 500s.
@@ -118,3 +118,7 @@ The deploy clones `agilantsolutions/library` and `resources` via `020_setup_git_
 
 ## Related
 - [Tools architecture](../architecture.md)
+- [Walmart Activate deploy (same AL2023 pattern, Apache proxy)](../../walmart-activate/workflows/deploy-to-elastic-beanstalk-al2023.md)
+
+## Change history
+- 2026-10-22 — Staging dir corrected `/var/app/ondeck` → `/var/app/staging`; resources now `/opt/resources` + postdeploy symlink (TRUE-83059) (rgirish)

package/knowledge/1.0/apps/walmart-activate/INDEX.md

@@ -0,0 +1,5 @@
+# walmart-activate (Walmart Activate) — 1.0 knowledge
+
+| Doc | Summary |
+|-----|---------|
+| [Deploying Walmart Activate to Elastic Beanstalk (PHP 8.5 / Amazon Linux 2023)](workflows/deploy-to-elastic-beanstalk-al2023.md) | How walmart-activate (walmart.truesolutions.com) deploys on EB PHP 8.5 / AL2023 — Apache proxy, git clone of library/resources/dbchanges, Redis sessions, no s3f |

package/knowledge/1.0/apps/walmart-activate/workflows/deploy-to-elastic-beanstalk-al2023.md

@@ -0,0 +1,54 @@
+---
+title: Deploying Walmart Activate to Elastic Beanstalk (PHP 8.5 / Amazon Linux 2023)
+framework: "1.0"
+repo: walmart-activate
+project: Walmart Activate
+client: shared
+type: workflow
+status: active
+updated: 2026-10-22
+owners: ["rgirish"]
+files:
+  - walmart-activate/.ebextensions/001_platform.config
+  - walmart-activate/.ebextensions/005_php_cve_2026_mitigation.config
+  - walmart-activate/.ebextensions/009_setup_phpini.config
+  - walmart-activate/.ebextensions/020_setup_git_libraries.config
+  - walmart-activate/.platform/hooks/prebuild/02-install-php-redis.sh
+  - walmart-activate/.platform/hooks/prebuild/03-setup-cache-folder.sh
+  - walmart-activate/.platform/httpd/conf.d/http_to_https.conf
+  - walmart-activate/_/app/framework.php
+  - walmart-activate/ebs/git.json
+  - walmart-activate/.htaccess
+related:
+  - ../../tools/workflows/deploy-to-elastic-beanstalk-al2023.md
+  - ../../library/features/php-8-5-runtime-compatibility.md
+  - ../../../../clients/walmart/profile.md
+---
+
+How walmart-activate (walmart.truesolutions.com) deploys on EB PHP 8.5 / AL2023 — Apache proxy, git clone of library/resources/dbchanges, Redis sessions, no s3fs; open before touching `.ebextensions`/`.platform` or deploying it.
+
+## Summary
+
+walmart-activate moved from AL1 to EB PHP 8.5 / Amazon Linux 2023 on TRUE-83059, copying the Tools/Store pattern (Store: TRUE-83055). Shared AL2023 rules (ini via cfn-init `files:`, rediscluster via `ini_set()`, PECL redis install, clone fails the deploy) live in the [Tools deploy doc](../../tools/workflows/deploy-to-elastic-beanstalk-al2023.md) — not repeated here. This doc holds only what differs for Walmart.
+
+## Steps
+
+1. `001_platform.config` sets `aws:elasticbeanstalk:environment:proxy: ProxyServer: apache`. AL2023 defaults to nginx, which ignores the root `.htaccess` front controller (`!-f`/`!-d` → `index.php`).
+2. `009_setup_phpini.config` writes `/etc/php.d/application.ini` (`include_path = ".:/var/www/library"`) with a cfn-init `files:` block.
+3. `020_setup_git_libraries.config` (bash) clones every entry in `ebs/git.json`: `library` → `/var/www/library`, `resources` → `/var/app/staging/resources`, `dbchanges` → `/var/www/dbchanges`. Branch is `_production` when EB property `ENVIRONMENT=prod`, else `_<ENVIRONMENT>`. A missing `ENVIRONMENT` or a clone error exits 1 and fails the deploy.
+4. `030_dbchanges.config` runs `php /var/www/dbchanges/index.php`.
+5. Prebuild hooks: `02-install-php-redis.sh` (`php8.5-pecl-redis6`, excludes `php8.1-*`, copies `redis.so` into the platform `extension_dir`); `03-setup-cache-folder.sh` creates `/var/www/cache`.
+6. `.platform/httpd/conf.d/http_to_https.conf` redirects on `X-Forwarded-Proto != https`.
+7. `App_Framework_Walmart::startSession()` (`_/app/framework.php`) sets rediscluster with `ini_set()`; if the extension is loaded but `session_start()` fails, it logs and falls back to file sessions. `reset.php` clears the session through the same method.
+8. `005_php_cve_2026_mitigation.config`: its file-watch cron skips while `/var/app/staging` (or `/var/app/ondeck`) exists, so it does not fire mid-deploy.
+
+## Gotchas
+
+- **No s3fs, no symlinks (decided TRUE-83059).** The AL1 s3fs mount, `links.*.json` (pointed at togadesk uploads) and old `ebs` scripts were removed. Walmart writes nothing to `storage_folder`/`export_folder`: the only signature save (`mvc/verify/get.php`) passes empty data, and `App_Model_ServiceRequestSignature::save` writes a file only when `signatureData` is truthy. **If a Walmart flow ever writes documents or exports, bring back s3fs or S3 first.**
+- **Staging dir is `/var/app/staging`** on AL2023. `/var/app/ondeck` is AL1 only.
+- **File-session fallback is per instance.** With more than one instance, a Redis outage logs users out when the load balancer switches instance. Check `error_log` for `Redis session store unreachable`.
+- **PHP 8.5 deprecations are fatal in 1.0** — this app depends on the library fixes in [PHP 8.5 runtime compatibility](../../library/features/php-8-5-runtime-compatibility.md).
+- **OPEN security issue (pre-existing, not fixed):** `.htaccess` rewrites only when the file does not exist (`!-f`), so under Apache the committed `config.*.ini` (DB credentials) and `ebs/git.json` (GitHub clone token) are served as plain files. Proposed fix: a `.platform/httpd/conf.d` deny file — `FilesMatch` for `config.*.ini` / `*.json`, `DirectoryMatch` for `ebs`, `.ebextensions`, `.platform`, `.git`. Also `009` sets `display_errors = On` in prod. Never copy credential values out.
+
+## Change history
+- 2026-10-22 — Moved to PHP 8.5 / AL2023 (Apache proxy, bash git clone, Redis via `ini_set`); dropped s3fs/symlinks; logged open config-exposure issue (TRUE-83059) (rgirish)

package/knowledge/INDEX.md

@@ -4,7 +4,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 
 ## 1.0 framework
 
-- **library** (Library) _(framework core)_ — 39 doc(s) → [1.0/apps/library/INDEX.md](1.0/apps/library/INDEX.md)
+- **library** (Library) _(framework core)_ — 40 doc(s) → [1.0/apps/library/INDEX.md](1.0/apps/library/INDEX.md)
 - **worker** (Worker) — 43 doc(s) → [1.0/apps/worker/INDEX.md](1.0/apps/worker/INDEX.md)
 - **dbchanges** (Database Changes) _(framework core)_ — 1 doc(s) → [1.0/apps/dbchanges/INDEX.md](1.0/apps/dbchanges/INDEX.md)
 - **worker1.5** (Worker 1.5) — 0 doc(s) → [1.0/apps/worker1.5/INDEX.md](1.0/apps/worker1.5/INDEX.md)
@@ -12,6 +12,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **togaview** (TOGa View) — 8 doc(s) → [1.0/apps/togaview/INDEX.md](1.0/apps/togaview/INDEX.md)
 - **webhook** (Webhook) — 1 doc(s) → [1.0/apps/webhook/INDEX.md](1.0/apps/webhook/INDEX.md)
 - **walmarttechservices** (Walmart Tech Services) — 1 doc(s) → [1.0/apps/walmarttechservices/INDEX.md](1.0/apps/walmarttechservices/INDEX.md)
+- **walmart-activate** (Walmart Activate) — 1 doc(s) → [1.0/apps/walmart-activate/INDEX.md](1.0/apps/walmart-activate/INDEX.md)
 - **test** (Test) — 18 doc(s) → [1.0/apps/test/INDEX.md](1.0/apps/test/INDEX.md)
 - **toga** (TOGa) — 4 doc(s) → [1.0/apps/toga/INDEX.md](1.0/apps/toga/INDEX.md)
 - **store** (Store) — 4 doc(s) → [1.0/apps/store/INDEX.md](1.0/apps/store/INDEX.md)

package/knowledge/clients/walmart/profile.md

@@ -7,11 +7,12 @@ apps:
   - worker
   - library
   - walmarttechservices
+  - walmart-activate
 client: walmart
 type: client-feature
 status: active
-updated: 2026-10-16
-owners: ["mhammontree"]
+updated: 2026-10-22
+owners: ["mhammontree", "rgirish"]
 files:
   - library/app/client/walmart.php
   - library/app/email/walmartb2c.php
@@ -33,7 +34,7 @@ Walmart = client ID **7** in `TOGA.Clients`. All Walmart B2C tech services (serv
 
 | Field | Value |
 |-------|-------|
-| `TOGA.Clients.id` | `7` |
+| `TOGA.Clients.id` | `7` — **unresolved, code disagrees:** `App_Client_Walmart::TOGA_CLIENT_ID = 6` and walmart-activate `mvc/verify/get.php` creates customers/service requests with `clientId = 6`; `worker/crons/toga/toga_walmart_order_reminder.php` uses `7`. Check `TOGA.Clients` before relying on either. |
 | Primary domain | `walmart.truesolutions.com` |
 | Former domain | `walmarttechservices.com` (decommissioned 2026) |
 | Former site repo | `walmarttechservices` — GitHub repo no longer exists (checked 2026-10-16) |
@@ -44,7 +45,7 @@ Walmart = client ID **7** in `TOGA.Clients`. All Walmart B2C tech services (serv
 
 - `library/app/client/walmart.php` — `App_Client_Walmart` — sends registration confirmation emails; reads `requireRegistrationUrl` from `TOGA.Clients` to build the registration link.
 - `library/app/email/walmartb2c.php` — `App_Email_WalmartB2C` — base email class for all Walmart B2C transactional emails.
-- `walmart-activate/` — PHP MVC app serving all customer-facing Walmart routes.
+- `walmart-activate/` — PHP MVC app serving all customer-facing Walmart routes. Runs on EB PHP 8.5 / AL2023 — see [deploy doc](../../1.0/apps/walmart-activate/workflows/deploy-to-elastic-beanstalk-al2023.md).
 
 ## DB field: requireRegistrationUrl
 

package/knowledge/registry.json

@@ -147,6 +147,16 @@
       "library"
     ]
   },
+  {
+    "repo": "walmart-activate",
+    "project": "Walmart Activate",
+    "framework": "1.0",
+    "role": "app",
+    "dependsOn": [
+      "library",
+      "dbchanges"
+    ]
+  },
   {
     "repo": "talos",
     "project": "TOGa Talos Chat",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1104",
+  "version": "1.0.1106",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/scripts/hooks/start-gate.js

@@ -412,8 +412,11 @@ function buildContext(data) {
   return ctx;
 }
 
+/* /tmp too: on macOS os.tmpdir() is /var/folders/.../T, but agents often save to /tmp (= /private/tmp),
+ * so ticket-reader's save of an inline ClickUp result was blocked and /start could not verify. */
 function safeZonePrefixes() {
   const bases = [path.join(os.homedir(), '.claude'), os.tmpdir(), process.env.TEMP, process.env.TMP];
+  if (process.platform !== 'win32') bases.push('/tmp');
   const out = new Set();
   for (const b of bases) if (b) out.add(canon(b));
   return [...out];