toga-ai 1.0.1208 → 1.0.1210

package/knowledge/INDEX.md

@@ -5,9 +5,9 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 ## 1.0 framework
 
 - **library** (Library) _(framework core)_ — 41 doc(s) → [1.0/apps/library/INDEX.md](1.0/apps/library/INDEX.md)
-- **worker** (Worker) — 42 doc(s) → [1.0/apps/worker/INDEX.md](1.0/apps/worker/INDEX.md)
+- **worker** (Worker) — 41 doc(s) → [1.0/apps/worker/INDEX.md](1.0/apps/worker/INDEX.md)
 - **dbchanges** (Database Changes) _(framework core)_ — 1 doc(s) → [1.0/apps/dbchanges/INDEX.md](1.0/apps/dbchanges/INDEX.md)
-- **worker1.5** (Worker 1.5) — 9 doc(s) → [1.0/apps/worker1.5/INDEX.md](1.0/apps/worker1.5/INDEX.md)
+- **worker1.5** (Worker 1.5) — 10 doc(s) → [1.0/apps/worker1.5/INDEX.md](1.0/apps/worker1.5/INDEX.md)
 - **togadesk** (TOGa Desk) — 19 doc(s) → [1.0/apps/togadesk/INDEX.md](1.0/apps/togadesk/INDEX.md)
 - **togaview** (TOGa View) — 9 doc(s) → [1.0/apps/togaview/INDEX.md](1.0/apps/togaview/INDEX.md)
 - **webhook** (Webhook) — 1 doc(s) → [1.0/apps/webhook/INDEX.md](1.0/apps/webhook/INDEX.md)

package/knowledge/clients/prudential/features/order-email-pdf-attachments.md

@@ -1,19 +1,19 @@
 ---
 title: "Prudential: order email PDF attachments (which guide goes on which email)"
 framework: "1.0"
-repo: worker
-project: Worker
+repo: worker1.5
+project: Worker 1.5
 client: prudential
 type: client-feature
 status: active
-updated: 2026-10-23
+updated: 2026-10-29
 owners: ["bala"]
 files:
-  - worker/crons/toga2/prudential/generate_sales_and_purchase_orders_from_service_requests.php
-  - worker/crons/toga2/prudential/transmissions_to_netsuite.php
-  - worker/crons/toga2/prudential/transmit_ordershipped_updates_prudential.php
-  - worker/crons/toga2/prudential/transmit_closecomplete_updates_prudential.php
-  - worker/crons/toga2/prudential_beta/generate_sales_and_purchase_orders_from_service_requests.php
+  - worker1.5/crons/toga2/prudential/generate_sales_and_purchase_orders_from_service_requests.php
+  - worker1.5/crons/toga2/prudential/transmissions_to_netsuite.php
+  - worker1.5/crons/toga2/prudential/transmit_ordershipped_updates_prudential.php
+  - worker1.5/crons/toga2/prudential/transmit_closecomplete_updates_prudential.php
+  - worker1.5/crons/toga2/prudential_beta/generate_sales_and_purchase_orders_from_service_requests.php
   - store/common/prudential/home.php
 related:
   - transmit-ordershipped-email.md
@@ -61,31 +61,37 @@ All three live under `https://external-client-files.s3.us-west-2.amazonaws.com/p
 |---|---|---|
 | `EquipMe-Win11-Sep_2026_1.1.pdf` (since 2026-10-12; history: `v1` → `Sep_2026` → `Sep_2026_1.1`) | `Getting_Started_Guide_Windows11.pdf` | 2,762,485 B |
 | `2026_Aug_PrudentialMacSetupGuide_ZCC.pdf` | `PrudentialMacSetupGuide.pdf` | 7,543,154 B |
-| `Prudential_Instruction-2Page-V1.pdf` | (unchanged) | 100,224 B |
+| `Prudential_DeviceReturnGuide_10-30-2026.pdf` (return guide, since 2026-10-29; was `Prudential_Instruction-2Page-V1.pdf`, 100,224 B) | (unchanged, same name) | 189,076 B |
 
 A new-hire email (Win11 + Mac) is roughly **14 MB** once base64-encoded. Grepping for the attached-as filename will not find the S3 object, search the S3 basename.
 
 **The attached name never changes, so it does not tell you the version.** The email shows `Getting_Started_Guide_Windows11.pdf` and the cron caches to `$cacheFolder/Getting_Started_Guide_Windows11.pdf` whatever URL was fetched. Check the byte size instead (Sep_2026_1.1 = 2,762,485; Sep_2026 = 2,735,276; v1 = 773,591). The old `EquipMe-Win11-v1.pdf` and the S3 object `Getting_Started_Guide_Windows11.pdf` are byte-identical (both the old guide).
 
 ### Swapping the Windows 11 guide: every hardcoded spot
-Recurring task: Prudential sends a new EquipMe Windows 11 PDF from time to time (content or phone-number fixes). There is **no setting or table** for the guide URL. It is a literal in **12 `$pdfUrl2` lines across 5 worker files plus 2 store links**, and all must change together:
+Recurring task: Prudential sends a new EquipMe Windows 11 PDF from time to time (content or phone-number fixes). There is **no setting or table** for the guide URL. It is a literal in **12 `$pdfUrl2` lines across 5 worker1.5 files plus 2 store links**, and all must change together:
 | File | Where |
 |---|---|
-| `worker/crons/toga2/prudential/generate_sales_and_purchase_orders_from_service_requests.php` | `$pdfUrl2` in the order-created branches New (1), Refresh (3), and `else` (Breakfix/Swap/Label). Reclaim (5) attaches only `Prudential_Instruction-2Page-V1.pdf`. |
-| `worker/crons/toga2/prudential/transmit_ordershipped_updates_prudential.php` | Shipped (Dell, vendorId 1): new-hire block, plus the shared block inside `if ($reqType != 'Reclaim')`. |
-| `worker/crons/toga2/prudential/transmit_closecomplete_updates_prudential.php` | Delivered: same two places, same Reclaim guard. |
-| `worker/crons/toga2/prudential/transmissions_to_netsuite.php` | Shipped for Agilant-shipped POs (vendorId 2). Cron is `active: 0`, and prod has 0 vendor-2 POs with `c_dtEmailSentOrderShipped`, so it never fires today. Change it anyway. |
-| `worker/crons/toga2/prudential_beta/generate_sales_and_purchase_orders_from_service_requests.php` | Beta copy of order-created. |
+| `worker1.5/crons/toga2/prudential/generate_sales_and_purchase_orders_from_service_requests.php` | `$pdfUrl2` in the order-created branches New (1), Refresh (3), and `else` (Breakfix/Swap/Label). Reclaim (5) attaches only the return guide. |
+| `worker1.5/crons/toga2/prudential/transmit_ordershipped_updates_prudential.php` | Shipped (Dell, vendorId 1): new-hire block, plus the shared block inside `if ($reqType != 'Reclaim')`. |
+| `worker1.5/crons/toga2/prudential/transmit_closecomplete_updates_prudential.php` | Delivered: same two places, same Reclaim guard. |
+| `worker1.5/crons/toga2/prudential/transmissions_to_netsuite.php` | Shipped for Agilant-shipped POs (vendorId 2). Not scheduled on worker1.5, and prod has 0 vendor-2 POs with `c_dtEmailSentOrderShipped`, so it never fires today. Change it anyway. |
+| `worker1.5/crons/toga2/prudential_beta/generate_sales_and_purchase_orders_from_service_requests.php` | Beta copy of order-created. |
 | `store/common/prudential/home.php` (~L244-245) | Equip Me home page "Document" announcement: `$link` ("Click here") and `$win10Link` ("click here") both point at the guide. The Mac link (`$macLink`) is separate. |
 
 Procedure:
 1. Get the new PDF onto `s3://external-client-files/prudential/` under a **new** basename (never overwrite: the old name is what is live until deploy).
 2. `curl -sI <new url>` must return **200**. A new upload can be private: on 2026-10-12 `EquipMe-Win11-Sep_2026_1.1.pdf` returned **403** while the old file returned 200. Fix the object ACL/policy before deploying (no AWS writes from Claude).
-3. Branch from `_production` in **both** `worker` and `store`.
-4. One global find-replace of the old basename in `worker/crons/toga2/prudential*` and `store/common/prudential/home.php` covers every spot. `grep` the old name after: expect 0 hits; new name: 12 in worker, 2 in store.
+3. Branch from the default branch in **both** `worker1.5` (`_main`) and `store` (`_production`).
+4. One global find-replace of the old basename in `worker1.5/crons/toga2/prudential*` and `store/common/prudential/home.php` covers every spot. `grep` the old name after: expect 0 hits; new name: 12 in worker1.5, 2 in store.
 5. Leave the Mac guide (`$pdfUrl4`, `2026_Aug_PrudentialMacSetupGuide_ZCC.pdf`) alone unless it is the one being swapped. Reclaim stays excluded.
 
-Why step 2 matters: the crons fetch through `safeFetchPdf()`, which returns `false` on a 403, so a private file **silently drops the Windows 11 attachment** (and its sentence) from every email; nothing errors. The store link opens an S3 `AccessDenied` page.
+Why step 2 matters: the crons fetch through `safeFetchPdf()`, which returns `false` on a 403, so a private file **silently drops the attachment** (and its sentence) from every email; nothing errors. The store link opens an S3 `AccessDenied` page.
+
+### Swapping the return guide
+Same steps 1, 2 and 4, with these differences:
+- The basename is used **3 times per spot**: `$pdfUrl3`, the `$cacheFolder` path, and the `addAttachment()` name. The customer sees the S3 basename (no rename on attach).
+- **24 hits in 5 worker1.5 files**: order-created 9 (3 branches), shipped 3 + 3 (both shipped crons), delivered 3, beta order-created 6.
+- `store` has no return-guide link (0 hits in `home.php`), so only `worker1.5` changes.
 
 ### The verbiage has to match what actually attached
 Every attach is guarded by `if ($pdfGuideX !== false)`, but until 2026-08-31 the `$attachmentText` paragraph that *describes* the attachments was unconditional. A failed S3 fetch produced an email whose copy pointed the recipient at guides not on the message — and it always said "guides" plural even when a single guide attached. The rule now, in every branch touched: **derive the sentence from the guards, not from the intent.**
@@ -130,7 +136,7 @@ No committed harness. Build a throwaway `test_<x>_emails.php` next to the cron,
 ## Gotchas
 - **`transmit_closecomplete_updates_prudential.php` still over-promises (~line 447).** Its delivered email hardcodes "Guides for Windows 11 and MacBook devices are provided" with no reference to whether either PDF actually attached — the exact bug fixed everywhere else on 2026-08-31. Left alone deliberately to keep PR #1707's diff to files already being changed. **Worth a follow-up ticket.**
 - **`transmissions_to_netsuite.php` also sends *delivered* emails — with no attachments at all.** It carries its own "New hire equipment has been delivered" / "Your equipment has been delivered" blocks (~L1765 and ~L2149) that make **zero** `addAttachment()` calls, while `transmit_closecomplete_updates_prudential.php` sends the **same two subjects** with the guides attached. **Whether both fire for the same order was not established** — if they do, the recipient gets a duplicate delivered email, one attachment-less. Check this before changing either.
-- **`prudential_beta/` does not match prod.** `crons/toga2/prudential_beta/generate_sales_and_purchase_orders_from_service_requests.php` is `active: 1` on the same schedule but points at the beta DB and still references the retired `Prudential_Return_Instructions.pdf` (and the old `PrudentialMacSetupGuide.pdf`). **A beta test will not reproduce prod attachment behavior.** Only the Win11 guide URL is kept in sync with prod (2026-10-05); the rest is left as-is on purpose.
+- **`prudential_beta/` does not match prod.** `crons/toga2/prudential_beta/generate_sales_and_purchase_orders_from_service_requests.php` is `active: 1` on the same schedule but points at the beta DB and still references the old `PrudentialMacSetupGuide.pdf` (not the `_ZCC` one). **A beta test will not reproduce prod Mac-guide behavior.** The Win11 guide (2026-10-05) and the return guide (2026-10-29) are kept in sync with prod; the Mac guide is left as-is on purpose.
 - **Breakfix / Swap / Label get no Mac guide on the order-created email** (they do get it on shipped and delivered). Known, and left alone on purpose — not a bug to "fix" unasked.
 - The delivered cron (`transmit_closecomplete_updates_prudential.php`) already followed the rule and was deliberately **not** touched.
 
@@ -140,6 +146,7 @@ No committed harness. Build a throwaway `test_<x>_emails.php` next to the cron,
 - [App_Email Side Effects & Test Mode](../../../1.0/apps/library/features/email-test-mode-and-write-free-sends.md)
 
 ## Change history
+- 2026-10-29 — Return guide swapped `Prudential_Instruction-2Page-V1.pdf` → `Prudential_DeviceReturnGuide_10-30-2026.pdf` in all 24 spots, beta included; file paths now worker1.5 (TRUE-83422) (bala)
 - 2026-10-23 — Schedule now `worker1.5/schedules/cron.worker.json`; linked the new order-email-recipients doc (TRUE-83157) (bala)
 - 2026-10-12 — Win11 guide swapped `Sep_2026` → `Sep_2026_1.1` (phone number change); added swap procedure + S3 403 check (bala)
 - 2026-10-05 — Win11 guide swapped `v1` → `Sep_2026` in all 12 cron spots + Equip Me page (bala)

package/knowledge/sessions/2026-10-29-saml-signature-checks-amadda.md

@@ -0,0 +1,79 @@
+---
+type: session
+slug: saml-signature-checks
+title: TRUE-83199 Turn on SAML signature checks — scoping
+author: amadda
+repos: [saml, _underscore, dbchanges2]
+framework: "2.0"
+client: shared
+status: active
+created: 2026-10-29
+updated: 2026-10-29
+---
+
+# Session: saml-signature-checks
+**Date:** 2026-10-29
+**Project/Repo:** saml + _underscore + dbchanges2 (2.0)
+**Task:** Scope TRUE-83199 — make the saml gateway `/acs` check the IdP signature (plus Issuer, Audience, Destination, time window, RelayState client) per client, using new columns on `Core.ClientAuthentications_Sso`. No code written yet; this session was walk-through and agreement only.
+
+---
+
+## What WORKED
+- Confirmed the gap in code: `saml/Controller/Index.php:414-415` checks only `StatusCode === STATUS_SUCCESS`. The signature check (lines 313-412) is commented-out test code with hardcoded certs, RSA_SHA1, ending in `exit`.
+- Git history: the signature test code was added already commented out in `4bcee38` (2024-08-29, "Final changes for Compass SAML"). It was never live.
+- Package: `litesaml/lightsaml` 3.0.3 (+ `robrichards/xmlseclibs` 4.0.0). LightSaml has a built-in signature check (`getSignature()->validate($key)`), so no new library is needed.
+- Decoded the saved Compass test response (`Index.php:245`, inside the comment block): signed twice (Response + Assertion) with RSA-SHA256, Issuer `https://sso.compassmanager.com`, Audience `https://compass.togacommerce.com/?meta`, Destination `https://compass.togacommerce.com/?acs` (old URL), 30-second time window.
+- `entityIdentifier` meaning resolved: it is OUR SP name (sent as `<Issuer>` in our AuthnRequest, `_underscore/Model/Core/ClientAuthentication.php:118`) — except Rate's rows, which hold Rate's IdP metadata URL.
+- ACS URL is built in code, not stored: `samlHostUrl(env) . '/acs'` (`ClientAuthentication.php:6-11,106`). Prod = `https://saml.togahub.com/acs`. One shared `/acs` for all clients; client found by RelayState domain uuid.
+- `/meta` publishes `WantAssertionsSigned="true"` but `/acs` never checks — code does not match what we promise.
+- Read-only queries on `client-sandbox` Core: SSO rows = Compass Group (production, sandbox-client), CompassCanada (production, sandbox-client), Rate (production, beta), True (production). 46 clients total; SSO 4, LOGIN 1, ACTIVE_DIRECTORY 1.
+- User lookup: `_Model_<Client>_ClientAuthentication::getAuthenticatedSsoUser()` (Compass/Rate/True in `_underscore/Model/<Client>/ClientAuthentication.php`) only matches NameID to an active user.
+- Found: Compass `getAuthenticatedSsoUser()` maps any NameID containing `@togatech.com` to fixed user 4273. In client-sandbox `Client_Compass`, 4273 is active with roles Base, Admin, SuperUser, Compass Base, Manager, Refresh Orders (6 of 16).
+
+## What did NOT work — DO NOT RETRY THESE
+- Read-only `toga_query` on `prod` Core (SSO client list) was denied by the Claude Code auto-mode classifier ("The server-side auto mode classifier judged this action dangerous"). Developer said to use sandbox (`client-sandbox`) instead, read-only only.
+- start gate blocked the ticket-reader agent and `cat` during the primer stage; read the earlier session's ticket JSON with the Read tool instead.
+- zsh: unquoted `--include=*.php` fails with "no matches found" — quote it.
+
+## Not tried yet (candidates for next session)
+- Local proof of the hole (dev `http://saml` only, never sandbox/prod): fake SAMLResponse (Success + real username, no signature, encrypted to our public encryption cert) + real RelayState → POST `/acs`. Doubles as the regression test.
+- Check prod: SSO client list and whether user 4273 in prod Compass also has Admin/SuperUser (needs permission or a teammate).
+- Find which Destination/ACS URL each IdP uses today (server access logs), since a Sept 2025 fix `1bc6c37` handles legacy `/?acs`.
+- Get IdP metadata (cert + entity ID) for Compass, CompassCanada, Rate (prod + beta), True, Compass sandbox.
+- CTO second opinion before finalizing approach (schema change + auth change).
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| ~/.claude/projects/-Users-amadda-Desktop-Projects-saml/memory/user-walk-through-before-building.md | created | personal habit note |
+| ~/.claude/projects/-Users-amadda-Desktop-Projects-saml/memory/user-communication-profile.md | created | max 2 simple bullets per reply |
+| ~/.claude/projects/-Users-amadda-Desktop-Projects-saml/memory/MEMORY.md | modified | index lines |
+| (no app repo files changed) | — | saml + dbchanges2 are on branch TRUE-83199; _underscore not switched yet |
+
+## Decisions made
+- Plan agreed (high level), numbered:
+  1. Capture the response at `/acs`.
+  2. Check the signature with the client's saved `idpSigningCertificate` (never the cert inside the response).
+  3. Compare `<Issuer>` with saved `idpEntityIdentifier`.
+  4. Check Audience/Destination = our URLs, NotBefore/NotOnOrAfter valid, RelayState client = SSO row's client.
+  5. On failure: `LOG_ONLY` logs and lets in; `ENFORCE` blocks.
+- Add 3 columns to `Core.ClientAuthentications_Sso`: `idpEntityIdentifier`, `idpSigningCertificate`, `signatureMode` (LOG_ONLY / ENFORCE). Rationale: per-client cert storage; safe rollout. Rejected: turning the old commented code back on (hardcoded certs, SHA1, `exit`).
+- Do not store responses in the DB. Log per-check pass/fail + Issuer, Destination, signing method to Sentry/error_log; never the full response (user data).
+- Keep the shared `/acs` (no per-client ACS URLs) — changing would force every client to reconfigure their IdP.
+- Use LightSaml's built-in signature validation, not hand-written xmlseclibs code.
+
+## Blockers
+- Open questions for the developer / team:
+  1. Put `_underscore` on branch TRUE-83199 (model needs the 3 new fields)?
+  2. Who gets IdP metadata/certs from Compass, CompassCanada, Rate, True?
+  3. Ticket misses CompassCanada and Rate beta — add them?
+  4. Client with no cert saved yet: let in + log "no cert" (proposed) or block?
+  5. Remove or dev-limit the Compass `@togatech.com` → user 4273 shortcut (in this ticket or a new one)?
+  6. Rate's `entityIdentifier` holds its IdP URL, unlike the other rows — clean up when filling the new column?
+  7. Severity ~9/10 (10 if prod 4273 is admin) — who should be told before the fix ships?
+
+## Exact next step
+> Answer blocker questions 1-5 with the developer, then run the `cto` agent for a second opinion on the plan above before writing the dbchanges2 `Core/` SQL file.
+
+---
+_Saved by /session-save on 2026-10-29_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1208",
+  "version": "1.0.1210",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",