toga-ai 1.0.1206 → 1.0.1207

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -50,6 +50,7 @@
 | [_Model::save() vs raw _Query — no atomic conditional update](features/model-save-vs-query-atomic-update.md) | `_Model::save()` can't do an atomic conditional update or a second write on the same instance; open before writing a row-claim/optimistic-concurrency guard, a r |
 | [NetSuite REST Client (_Component_Api_Netsuite) — record writes & SuiteQL](features/netsuite-rest-client.md) | Shared 2.0 `_underscore` NetSuite REST client (`_Component_Api_Netsuite`) — record GET/write, SuiteQL, auth, escaping, logging; open before any 2.0 NetSuite cal |
 | [NetSuite Sales Order sync — ship-to address, phone, and PO reference sourcing](features/netsuite-salesorder-address-phone-sync.md) | Where the shared NetSuite SO importer (`_Trait_Netsuite_SalesOrder`) sources SO#, PO#, and ship-to phone, and the traps in changing it; open before editing this |
+| [Non-prod Aurora clusters (account 975050298201) — layout, settings, recovery, access limits](features/nonprod-aurora-clusters.md) | Which non-prod 2.0 Aurora MySQL clusters exist in account 975050298201 (us-east-1) after TRUE-83406, the settings every one copies, how to delete/restore a clus |
 | [Note records have NO author — every `*Notes` model's `contactId` is unwritten](features/note-record-authorship.md) | Every `*Notes` model declares a `contactId` FK but no code writes it — note authorship is unrecoverable from 2.0 data; open before building any note author disp |
 | [NOTIFICATION email templates — block JSON rendered server side (_Component_EmailBlocks + _Component_EmailBranding)](features/notification-email-blocks.md) | How client-built (NOTIFICATION) emails are stored as block JSON, rendered to safe HTML on the server, merged with `{{group.field}}` tokens and branded per clien |
 | [Notification engine (rule-driven in-app notifications from record change logs)](features/notification-engine.md) | Platform (all 2.0 apps) in-app notifications: data rules on Core turn a record's change log into Client.Notifications rows; open when adding a notification kind |

package/knowledge/2.0/apps/_underscore/features/aurora-binlog-configuration.md

@@ -11,6 +11,7 @@ owners: ["rgirish"]
 files: []
 related:
   - ../architecture.md
+  - nonprod-aurora-clusters.md
   - ../../../../1.0/apps/worker1.5/features/database-backups.md
 ---
 
@@ -48,7 +49,7 @@ Live check on us-east-1 writers: `log_bin = ON`.
 
 ### Non-prod (account 975050298201, us-east-1)
 
-- 19 single-instance clusters (`sandbox-dev`, `sandbox-client`, `stage`, `demo`, `client-*`, `qa-*`, `qc-*`), engine `3.10.3`.
+- Single-instance clusters, engine `3.10.3` — current list in [Non-prod Aurora clusters](nonprod-aurora-clusters.md).
 - All on `true-rds-cluster-parameters` with `binlog_format = OFF` (`log_bin = 0`). No Global Database.
 
 ### Who reads the binlog (2026-10-29: nobody)

package/knowledge/2.0/apps/_underscore/features/nonprod-aurora-clusters.md

@@ -0,0 +1,81 @@
+---
+title: Non-prod Aurora clusters (account 975050298201) — layout, settings, recovery, access limits
+framework: "2.0"
+repo: _underscore
+project: _Underscore
+client: shared
+type: feature
+status: active
+updated: 2026-10-29
+owners: ["rgirish"]
+files: []
+related:
+  - ../architecture.md
+  - aurora-binlog-configuration.md
+  - ../../api2/workflows/environment-configuration-and-provisioning.md
+  - ../workflows/local-db-refresh-from-beta.md
+---
+
+Which non-prod 2.0 Aurora MySQL clusters exist in account 975050298201 (us-east-1) after TRUE-83406, the settings every one copies, how to delete/restore a cluster safely, how to tell an empty cluster without DB access, and what the GoAgilant-Developers SSO role cannot do (KMS); open before creating, deleting or loading a non-prod DB cluster.
+
+## Summary
+
+One **all-in-one** Aurora MySQL cluster per non-prod environment: `Core`, `Client_*`, `Logs`, `Logs_*`, `Archive_*` all in the same cluster. No environment shares a cluster. Production is separate: 4 per-family clusters in account `654654170868` (see [binlog doc](aurora-binlog-configuration.md)).
+
+## How it works
+
+### Clusters (as of 2026-10-29)
+
+| Cluster | Databases |
+|---|---|
+| `sandbox-dev`, `sandbox-client` | full DB sets (unchanged) |
+| `qa-alpha` | `Core`, `Logs`, `Client_True`, `Client_Elite`, `Logs_True`, `Logs_Elite`, `Archive_True` (restored from final snapshot) |
+| `qc-security` | `Core`, `Logs`, `Client_Compass`, `Logs_Compass` (restored from final snapshot) |
+| `dev`, `qa`, `stage`, `uat`, `hotfix`, `demo`, `sandbox` | **empty** — created 2026-10-29, no TOGA databases yet |
+
+- The 7 new clusters match the environment list. AWS identifiers cannot start with `_`, so env `_qa` → cluster `qa`.
+- Endpoint: `<name>.cluster-cb860gg2qw2n.us-east-1.rds.amazonaws.com`.
+- Loading `Core` / `Client_*` / `Logs` into the new clusters is a follow-up ticket. Seed them per [environment provisioning](../../api2/workflows/environment-configuration-and-provisioning.md) (base `Logs` included).
+- Prod data into non-prod: only `stage` and `demo`, masked (ticket rule A17). Prod is 4 clusters, so it is dump + load per database, not a snapshot copy.
+
+### Settings every non-prod cluster copies (from `sandbox-dev`)
+
+- Engine `aurora-mysql` `8.0.mysql_aurora.3.10.3`.
+- One writer `<name>-writer`, `db.t4g.medium`, `us-east-1a`.
+- Subnet group `true-test-db-subnet-group`; security group `sg-075195ac9152313d3`.
+- Cluster parameter group `true-rds-cluster-parameters`; instance parameter group `true-rds-parameters`.
+- Encrypted with the account's RDS KMS key; not public; backup retention 1 day.
+- Enhanced monitoring 60 s via `rds-monitoring-role`.
+- Master user `admin`, plain `--master-user-password` (not Secrets Manager — see Gotchas).
+- Tags `Environment=<name>`, `Ticket=<ticket>`.
+
+### Admin passwords — where they live (never copy values here)
+
+- `dev`, `sandbox`: same as `api2/Config/sandbox-dev.ini` `[database]`.
+- `qa`, `stage`, `uat`, `hotfix`, `demo`: same as `api2/Config/stage.ini` `[database]`.
+- Developer plans to rotate them; after that, the ini files are the source.
+
+### Delete and restore a cluster
+
+1. Always delete with `--final-db-snapshot-identifier final-<name>-<date>`.
+2. To bring it back: `restore-db-cluster-from-snapshot` with the same cluster id → same endpoint, data, and admin password.
+3. Restore creates **no instance**. Run `create-db-instance` for a new writer (`<name>-writer`) or the cluster cannot serve.
+
+### Is a cluster empty? (no DB access needed)
+
+- CloudWatch `AWS/RDS` `VolumeBytesUsed` ~140 MB = MySQL system files only, no TOGA databases.
+- toga-db MCP `list_schemas` returns `[]` for clusters it cannot see, so an empty list alone is not proof.
+
+## Gotchas
+
+- **No KMS rights for `GoAgilant-Developers`** in 975050298201 (`kms:DescribeKey` denied):
+  - `create-db-cluster --manage-master-user-password` fails `KMSKeyNotAccessibleFault ... KMS key [null]` (the Secrets Manager key). Use `--master-user-password` with the RDS key — that works.
+  - Restoring encrypted snapshots in the same account works.
+  - Copying prod snapshots across accounts needs KMS rights the role does not have.
+- **us-west-1 RDS** is blocked for this role by an org SCP.
+- **`api2/Config/stage.ini` is CRLF.** A script reading values from it must strip `\r`, or AWS rejects the password with "Input can't contain control characters".
+- **RDS console "Databases" count** lists each cluster AND its writer instance as rows (19 clusters showed as "38").
+- **Leftovers from the 2026-10-29 cleanup:** 15 deleted clusters (`qa-task`, `qa-hotfix`, `qa-beta`, `qa-gamma`, `qc-task`, `qc-hotfix`, `qc-alpha`, `qc-beta`, `qc-gamma`, `qc-performance`, `client-alpha`, `client-beta`, `client-gamma`, old `stage`, old `demo`) keep final snapshots `final-<name>-2026-10-29` (storage cost; cleanup is a separate task). Their Elastic Beanstalk envs (`api-*`, `worker-*`, `websocket-*`) still exist and point at missing databases — separate ticket.
+
+## Change history
+- 2026-10-29 — First version: 7 new empty env clusters, 15 old clusters deleted, qa-alpha/qc-security restored, KMS limits, recovery steps (TRUE-83406) (rgirish)

package/knowledge/INDEX.md

@@ -22,7 +22,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 
 ## 2.0 framework
 
-- **_underscore** (_Underscore) _(framework core)_ — 118 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
+- **_underscore** (_Underscore) _(framework core)_ — 119 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
 - **worker2** (Worker) — 102 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
 - **api2** (API) — 29 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
 - **dbchanges2** (Database Changes) _(framework core)_ — 24 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1206",
+  "version": "1.0.1207",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",