toga-ai 1.0.1106 → 1.0.1107

package/knowledge/1.0/apps/library/features/app-cloud-aws-credentials.md

@@ -6,7 +6,7 @@ project: Library
 client: shared
 type: feature
 status: active
-updated: 2026-10-20
+updated: 2026-10-19
 owners: [jcardinal, mhammontree, bala, snaredla]
 files:
   - library/app/cloud.php
@@ -75,7 +75,7 @@ CodePipeline `Worker` (502, us-west-2) sources `_production` of **both** `agilan
 - `togadesk` `ebs/check_s3fs.php` + `ebs/register_instance_to_shared_application_load_balancer.php` now assume `WorkloadsRuntime` (TRUE-82718, PR #622, merged 2026-10-13); togaview fix is PR #307 (opened). The s3fs **mount** cannot assume a role — it uses the instance role directly: see [asifiles s3fs mount](../../togadesk/features/s3fs-asifiles-file-storage.md).
 - **Every 1.0 app that bootstraps `library` needs `aws/aws-sdk-php` in its own `composer.json`** (since TRUE-82705). Without it any App_Cloud call fatals `Class 'Aws\Credentials\CredentialProvider' not found`. Hidden trigger: on prod/worker/bigworker, `App_Database::getDatabaseReaderHost()` (`library/app/database.php` ~156) calls `App_Cloud::getParameter('database_reader_endpoint')` whenever its cache file `databaseReadHost.txt` is older than 30-60 s. The fatal hits before the cache is rewritten, so the cache stays stale and **every** reader-DB request fails — the app looks fully down (TRUE-82793: Vision PunchOut for Canon / S&P Global via SAP Ariba returned HTTP 500). Fix = add `"aws/aws-sdk-php": "^3.328"` and pin `composer.lock` to worker's prod versions (aws-sdk-php 3.328.1, guzzle 7.9.2, promises 2.0.4, psr7 2.7.0, jmespath 2.8.0 — PHP 7.2 safe); EB runs `composer install --no-dev` on deploy (`vendor/` is gitignored).
   - Has it (`_production`): worker, togadesk (`^3.337`), togaview, tools, toga (TRUE-82714, 63c5ed0; confirmed 2026-10-16), vision (TRUE-82793, merged + deployed 2026-10-15).
-  - store: fixed on branch (TRUE-82856, ae1861f4f — same pins plus aws-crt-php 1.2.7, psr/http-client 1.0.3, polyfill-mbstring 1.31.0; verified on PHP 7.2.33); **still unmerged on 2026-10-20** — caused the S&P Global Ariba PunchOut outage (TRUE-82959: every store page HTTP 500 at `library/app/cloud.php:127`; Guided Buying shows "Unable to connect to supplier's website"). Needs merge + deploy. Its `.ebextensions/015_install_composer.config` already runs `composer install --no-dev`.
+  - store: fixed on branch (TRUE-82856, ae1861f4f — same pins plus aws-crt-php 1.2.7, psr/http-client 1.0.3, polyfill-mbstring 1.31.0; verified on PHP 7.2.33); needs merge + deploy. Its `.ebextensions/015_install_composer.config` already runs `composer install --no-dev`.
   - **Missed by the audit (TRUE-82935): the 1.0 `api` repo** (no composer at all) and **togadesk's email cron** (`crons/tickets.php` loads only `desk/vendor/autoload.php`; the root togadesk composer with aws is not loaded there). Both stopped `App_Cloud`: [Talos ticket API](../../api/features/talos-ticket-endpoint.md), [email intake](../../togadesk/features/email-to-ticket-intake.md). Audit per **entry point**, not per repo: a CLI cron or sub-app can load a different autoloader than the web app.
   - The missing class throws **`Error`, not `Exception`** — `catch (Exception)` around an App_Cloud call does not catch it; use `\Throwable` where a fallback is meant.
   - Not changed on TRUE-82856: walmarttechservices — GitHub repo `agilantsolutions/walmarttechservices` no longer exists ("Repository not found", checked 2026-10-16); webhook — reported no longer active by the developer (2026-10-16). Removal / deprecation is left to the owners.
@@ -84,7 +84,6 @@ CodePipeline `Worker` (502, us-west-2) sources `_production` of **both** `agilan
 - Every long-lived key still in code across repos (SES SMTP, s3fs, ALB scripts, other accounts): [audit 2026-10-13](../../../../2.0/apps/worker2/features/cross-account-aws-access.md#long-lived-keys-still-in-code-audit-2026-10-13).
 
 ## Change history
-- 2026-10-20 — store aws-sdk fix still unmerged; caused S&P Global PunchOut outage (TRUE-82959) (snaredla)
 - 2026-10-19 — aws-sdk-php audit missed `api` + togadesk email cron; `Error` not `Exception` (TRUE-82935) (jcardinal)
 - 2026-10-16 — aws-sdk-php: store fixed (TRUE-82856), vision deployed, walmarttechservices + webhook not changed (repo gone / reported inactive) (mhammontree)
 - 2026-10-15 — aws-sdk-php requirement: reader-host crash path, per-app audit, vision fixed (TRUE-82793) (mhammontree)

package/knowledge/2.0/apps/worker2/features/creating-worker-actions.md

@@ -6,8 +6,8 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-10-20
-owners: [jcardinal, dfranks, mhammontree, tcox, bala, ajean, rgirish]
+updated: 2026-10-22
+owners: [jcardinal, dfranks, mhammontree, tcox, bala, ajean, rgirish, snaredla]
 files:
   - worker2/Worker/
   - worker2/Controller/Index.php
@@ -544,10 +544,15 @@ Rules: rename **both sides in one PR and one deploy**; grep every repo for the o
   host — a separate connection that cannot see the job's own uncommitted insert (not replication
   lag). Call `_Database::setIsReadHostEnabled(false)` for the job, as `_Email` (TRUE-80448) and
   [8x8 survey import](./8x8-post-call-survey-import.md) do.
+- **Vendor named args must match the vendor's param names exactly** (PhpSpreadsheet
+  `Alignment::setVertical(verticalAlignment:)`, not `vertical:`). A wrong name is a runtime fatal;
+  `php -l` does not catch it. The vendor tree needs PHP 8.5; an older local PHP can load it only by
+  registering composer's `ClassLoader` by hand (skip `platform_check.php`).
 - See [architecture.md](../architecture.md) for the always-HTTP-200 rule and the
   commit-before-SQS transaction pattern that the worker relies on.
 
 ## Change history
+- 2026-10-22 — Gotcha: vendor named args must match vendor param names; PHP 8.5 vendor tree. (snaredla)
 - 2026-10-20 — Debug-mode `runTask` capped at depth 5 (`X-Toga-Worker-Depth`), throws on non-2xx, 300 s timeout; local ini needs `[api] worker` (TRUE-82934). (jcardinal)
 - 2026-10-08 — Direct POST needs the worker key in `Authorization`, runs synchronously, writes no `WorkerJobs` row. (rgirish)
 - 2026-10-06 — Absent-row section: a 200 + MessageId send can still produce no row for up to 1h (failed first delivery hidden by the visibility timeout). (ajean)

package/knowledge/INDEX.md

@@ -23,7 +23,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 ## 2.0 framework
 
 - **_underscore** (_Underscore) _(framework core)_ — 114 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
-- **worker2** (Worker) — 92 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
+- **worker2** (Worker) — 93 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
 - **api2** (API) — 27 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
 - **dbchanges2** (Database Changes) _(framework core)_ — 23 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)
 - **toga2-supply** (TOGa Supply) — 9 doc(s) → [2.0/apps/toga2-supply/INDEX.md](2.0/apps/toga2-supply/INDEX.md)

package/knowledge/clients/office-depot/INDEX.md

@@ -2,6 +2,7 @@
 
 | Doc | Framework | Summary |
 |-----|-----------|---------|
+| [ODP Monthly Talos Call Transcript Report (worker2 cron)](features/odp-call-transcript-monthly-report.md) | 2.0 | Monthly xlsx of ODP Talos voice-agent calls, built from S3 session reports and emailed; open before any ODP call reporting work. |
 | [Office Depot Phone Tech Support](features/odp-tech-support.md) | standalone | Office Depot's phone agent guides store associates through Tier-1 support and records Desk tickets; open for its client-specific prompt, tools, tuning and deplo |
 | [TOGaRefresh 2026 — linkBuilderRefresh URL Routing (ODP)](features/togarefresh2026-linkbuilder-routing.md) | 1.0 | In TOGaRefresh 2026, service-builder buttons must route via `App_Model_ServiceRequest::linkBuilderRefresh()` (`serviceselection`), not legacy `linkBuilder()` (` |
 | [Office Depot](profile.md) | standalone | Office Depot uses TOGa Voice for inbound store-associate tech support and Desk ticketing; open for client scope and links to its voice configuration. |

package/knowledge/clients/office-depot/features/odp-call-transcript-monthly-report.md

@@ -0,0 +1,48 @@
+---
+title: ODP Monthly Talos Call Transcript Report (worker2 cron)
+framework: "2.0"
+repo: worker2
+project: Worker
+client: office-depot
+type: client-feature
+status: draft
+updated: 2026-10-22
+owners: [snaredla]
+files:
+  - worker2/Worker/Client/OfficeDepot/CallTranscriptReport.php
+  - dbchanges2/Core/2026-10-16a - ODP call transcript monthly report cron.sql
+related:
+  - ../profile.md
+  - odp-tech-support.md
+  - ../../../2.0/apps/worker2/features/creating-worker-actions.md
+  - ../../../2.0/apps/worker2/features/cross-account-aws-access.md
+  - ../../../standalone/apps/voice-to-voice/features/post-call-lambda.md
+---
+
+Monthly xlsx of ODP Talos voice-agent calls, built from S3 session reports and emailed; open before any ODP call reporting work.
+
+## Summary
+
+worker2 cron action `Client/OfficeDepot/CallTranscriptReport/Generate`. PHP port of the Talos team's one-time `build_report.py` (handover 2026-10-19). Source of truth is S3, not TOGaDesk. Status: code reviewed, NOT yet run against real S3 data.
+
+## How it works
+
+1. Lists `s3://talos-voice-to-voice/odp/processed/` and `odp/upload/`; keys `{ticket}_{sessionId}_{ticketRefId}/session_report.json`.
+2. Prefilters by S3 `LastModified` within the month ±2 days, then keeps rows whose `ended_at` falls in the month (wall-clock, offset dropped).
+3. Builds sheets Summary / All Calls / `YYYY-MM` (16 columns). Ticket number links to `https://togadesk.togatech.com/desk/?route=tickets/manage&id={tickets.id}` via one batched lookup on `DB_TOGADESK1` (TOGaDeskSupport). Lookup failure = no links; report still sends.
+4. Emails serviceops@ and jhammontree@togatech.com. Params: `month` (`YYYY-MM`), `emailTo` (array, for tests).
+5. Cron row (Core, dbchanges2) ships `isActive=0`, `0 6 1 * *`, `maxExecutionTime` 600.
+
+Decisions:
+- S3 read error throws — never email a partial report. Only unparsable JSON is skipped and listed in job output.
+- Temp xlsx holds caller PII: written in a random 0700 folder, always deleted.
+- Fewer than 50 (or zero) calls adds a warning to the email body and subject.
+- Credentials: `_Cloud::getCredentialProvider()` (WorkloadsRuntime role, s3:* in every account; no IAM change).
+
+## Gotchas
+
+- Why not the DB: TOGaDeskSupport has the ODP Talos tickets (clientid 3, origin `TALOS`, dept 322) and transcripts in `tickets_replies` (`=== Updated/Full Conversation Transcript ===`, `[Customer]:` / `[AI Assistant]:`), and `tickets.referenceId` = session report `ticket_reference_id` (251/251 for Aug). But Session ID and caller ID exist only in S3, and Talos QA writes test tickets (`[BEHAVIOR TEST]`, `AUTOMATED ... TEST`) into the live ODP dept. Start ODP call reporting from S3.
+- Open: bucket owner account and region (`us-east-1` assumed) not confirmed. Confirm before setting `isActive=1`.
+
+## Change history
+- 2026-10-22 — Built the cron action and cron row (inactive); S3 chosen as source over TOGaDesk. (snaredla)

package/knowledge/clients/office-depot/profile.md

@@ -7,15 +7,18 @@ apps:
   - togadesk
   - api
   - dbchanges
+  - worker2
+  - dbchanges2
 project: TOGa Voice
 client: office-depot
 type: profile
 status: active
-updated: 2026-10-19
-owners: [akhokhani, mhammontree, jcardinal]
+updated: 2026-10-22
+owners: [akhokhani, mhammontree, jcardinal, snaredla]
 files: []
 related:
   - features/odp-tech-support.md
+  - features/odp-call-transcript-monthly-report.md
   - ../../standalone/apps/voice-to-voice/architecture.md
   - ../../standalone/apps/voice-to-voice/features/ticket-api-integration.md
   - ../../1.0/apps/togadesk/architecture.md
@@ -32,6 +35,7 @@ Office Depot is the production support client of the standalone Python/LiveKit T
 
 - [ODP support agent](features/odp-tech-support.md) owns ODP prompt, settings, billing tenant and deployment target.
 - Talos call files reach Desk tickets (TOGaDesk clientid 3) through the 1.0 `api`: [Talos ticket API](../../1.0/apps/api/features/talos-ticket-endpoint.md). ODP's own Desk env `odp-togadesk-prod` has an open deploy failure: [asifiles s3fs mount](../../1.0/apps/togadesk/features/s3fs-asifiles-file-storage.md).
+- [Monthly call transcript report](features/odp-call-transcript-monthly-report.md) — worker2 cron, built from S3 session reports.
 - [Voice architecture](../../standalone/apps/voice-to-voice/architecture.md) maps SIP, LiveKit, shared services and operational checks.
 - [Ticket API](../../standalone/apps/voice-to-voice/features/ticket-api-integration.md) owns signing and client/department routing.
 - [Post-call Lambda](../../standalone/apps/voice-to-voice/features/post-call-lambda.md) owns recordings/transcript attachments and its dated outage evidence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1106",
+  "version": "1.0.1107",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",