toga-ai 1.0.210 → 1.0.212

package/knowledge/1.0/apps/library/INDEX.md

@@ -3,6 +3,7 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [Library (1.0 Framework) Architecture](architecture.md) | `library` is the shared library repository for **all 1.0 (legacy) applications** — the `App_` framework. | library/_.php, library/app/, library/browser/ |
+| [App_Sso — Reusable 1.0 SSO Initiation (SP-initiated SAML via saml.togahub.com)](features/app-sso-initiation.md) | `App_Sso` (`library/app/sso.php`) is the **1.0 port of the 2.0 SAML gateway's SP-initiated SSO initiation**, packaged as a reusable, framework-level capability | library/app/sso.php, library/sso/togahub_private_key.key |
 | [Diagnostic Dialog — View Recommended Services Routing](features/diagnostic-dialog-view-recommended-services.md) | `App_Model_Toga_Diagnostic::initializeDiagnosticDialog()` renders the device modal used across all TOGa service request views. | library/app/model/toga/diagnostic.php |
 | [Elite Freshservice Sync (library)](features/elite-freshservice-sync.md) | `App_Api_Toga2` in `library/app/api/toga2.php` orchestrates bidirectional sync between TOGA 2 and TOGaDesk. | library/app/api/toga2.php |
 | [Branded HTML Email Templates (App_Email_Template)](features/email-templates.md) | `App_Email_Template` (`app/email/template.php`) is the base class for branded HTML emails in the 1.0 (`App_`) framework. | library/app/email/template.php, library/app/email/agilant.php |

package/knowledge/1.0/apps/library/features/app-sso-initiation.md

@@ -0,0 +1,106 @@
+---
+title: App_Sso — Reusable 1.0 SSO Initiation (SP-initiated SAML via saml.togahub.com)
+framework: "1.0"
+repo: library
+project: Library
+client: shared
+type: feature
+status: active
+updated: 2026-06-26
+owners: [jcardinal]
+files:
+  - library/app/sso.php
+  - library/sso/togahub_private_key.key
+related:
+  - ../architecture.md
+  - ./mvc-page-pattern-and-app-skeleton.md
+  - ../../../2.0/apps/saml/features/downstream-integration-contract.md
+  - ../../apps/tools/features/saml-sso-auth.md
+  - ../../apps/tools/workflows/deploy-to-elastic-beanstalk-al2023.md
+---
+
+## Summary
+
+`App_Sso` (`library/app/sso.php`) is the **1.0 port of the 2.0 SAML gateway's SP-initiated SSO
+initiation**, packaged as a reusable, framework-level capability so **any 1.0 `App_` app** can
+adopt SSO through `saml.togahub.com` without touching 2.0. It is the 1.0 counterpart to the 2.0
+`_Model_Core_ClientAuthentication::singleSignOnServiceUrl()` builder described in the
+[SAML downstream integration contract](../../../2.0/apps/saml/features/downstream-integration-contract.md).
+
+Design intent (read before adopting): the class is **config-driven and has NO Core DB
+dependency** — a consuming 1.0 app never queries Core. The team's standing preference is **not to
+modify 2.0**; 1.0 SSO initiation logic lives here in `App_Sso`. This is the canonical doc to
+follow for any future "add SSO to `<1.0 app>`" request.
+
+## How it works
+
+`App_Sso::initiate(array $params): string` builds a signed SAML 2.0 `AuthnRequest` and returns the
+full IdP redirect URL (`idpSsoUrl?QUERY&Signature=...`). It uses the **HTTP-Redirect binding**:
+
+1. Build the `AuthnRequest` XML, then encode it for the redirect binding:
+   `XML → gzdeflate → base64 → urlencode`.
+2. Build the **RelayState** payload `{v:1, time, domain, urlParameters}` and encrypt it with
+   `App_String::encryptWithKey` (AES-256-CBC, output `base64(iv . ciphertext)`). This is
+   **byte-for-byte compatible** with the 2.0 `_String::encryptWithKey`, so the gateway `/acs` can
+   decrypt the RelayState the 1.0 app produced.
+3. Sign the assembled query string with `openssl_sign` + `OPENSSL_ALGO_SHA256` using the bundled
+   private key, and append `&Signature=<base64>`.
+   - `SIGNATURE_ALGORITHM = http://www.w3.org/2001/04/xmldsig-more#rsa-sha256`
+   - `PRIVATE_KEY_PATH = __DIR__/../sso/togahub_private_key.key`
+     (`library/sso/togahub_private_key.key`, the togahub signing key, copied from the 2.0
+     `_underscore` `Assets/ssl`).
+
+### Parameters
+**Required:** `idpSingleSignOnServiceUrl`, `idpEntityIdentifier`, `assertionConsumerServiceUrl`,
+`domainUuid`, `apiSecretAccessToken`. **Optional:** `urlParameters`.
+Throws `InvalidArgumentException` on a missing required param; `RuntimeException` on signing failure.
+
+### Deliberate deviation from 2.0
+`App_Sso` emits a **valid** closing tag `</samlp:AuthnRequest>`, whereas the 2.0 builder emits a
+malformed `<\samlp:AuthnRequest>`. `App_Sso` is the corrected version — this is intentional, not a
+bug to "fix back."
+
+## Adopting SSO in another 1.0 app (step-by-step)
+
+(a) **Config — add a `[saml]` section** with:
+`idp_single_sign_on_service_url`, `idp_entity_identifier` (= `https://saml.togahub.com/meta`),
+`assertion_consumer_service_url` (= `https://saml.togahub.com/acs`), `domain_uuid`,
+`api_secret_access_token` (+ `..._previous` for rotation), and the client uuid(s) the consumer
+validates against. Document **where** these secrets live; never paste the values.
+
+(b) **Initiation route** (e.g. `mvc/sso/initiate/get.php`): guard `isLoggedIn`, read `config[saml]`,
+call `App_Sso::initiate([...])`, then `App_MVC::routeTo($url); exit;`.
+
+(c) **Handoff consumer route** `mvc/sso/get.php`: base64-decode the `?saml=` payload, JSON-parse,
+decrypt the client/user values with the shared API secret (**current then previous** key, for a
+rotation grace window), validate the UUIDs, look up the user, and establish the session. See the
+Tools implementation in [Tools SAML SSO Consumer & Persona-Gated Auth](../../apps/tools/features/saml-sso-auth.md).
+
+(d) **Register a `Core.Domains` row** (`uuid, clientId, appId, environmentId, domain =
+https://<app-host>/sso`). The `uuid` **MUST equal** the config `domain_uuid` (use a fixed uuid, not
+`UUID()`). The gateway resolves client + environment + return URL from this row.
+
+(e) **AWS — the app host MUST have a working HTTPS (443) listener + an ACM cert covering that exact
+hostname**, or the gateway's return redirect to `https://<host>/sso` fails with a connection
+timeout. See the gotcha below.
+
+## Gotchas / known issues
+
+- **Return-leg "connection timeout" is usually a missing HTTPS listener, not code.** When a SAML
+  SSO return leg times out in the browser, **verify the EB/ALB HTTPS (443) listener + ACM cert
+  cover the EXACT return hostname before debugging PHP/SAML.** Diagnosis signature: `curl` to the
+  public `https://` URL **from the instance itself** returns `http=000` after the full timeout,
+  while `curl http://127.0.0.1` with a `Host:` header returns `200` fast. Reusable for any TOGA app
+  behind Elastic Beanstalk; see the
+  [Tools EB deploy workflow](../../apps/tools/workflows/deploy-to-elastic-beanstalk-al2023.md).
+- **Consumer route runs mid-render in 1.0.** The 1.0 framework runs `mvc/sso/get.php` **inside** the
+  page render (`frameworkindex → body → loadFile`) after `common/header.php` has already emitted
+  output, so headers are sent. `session_regenerate_id(true)` (and any `http_response_code` on the
+  failure path) fatals with "headers already sent." Guard `session_regenerate_id` with
+  `if (!headers_sent())`. The proper long-term fix is to route `/sso` **before any output** and
+  `exit`; until then this is a known architectural limitation any 1.0 consumer inherits.
+
+## Change history
+- 2026-06-26 — Built `App_Sso::initiate()`: 1.0 port of the 2.0 SP-initiated SSO builder, config-driven with no Core DB dependency, RelayState encrypted via `App_String::encryptWithKey` (2.0-compatible), rsa-sha256 query signing with the bundled togahub key, and a corrected `</samlp:AuthnRequest>` closing tag. Captured the 5-step adoption guide and the HTTPS-listener / mid-render headers-sent gotchas for any 1.0 app adopting SSO (jcardinal)
+</content>
+</invoke>

package/knowledge/1.0/apps/tools/INDEX.md

@@ -5,5 +5,5 @@
 | [Tools (1.0 Internal-Tools App) Architecture](architecture.md) | **Tools** is a standalone 1.0 (`App_`) application that houses many small internal tools behind simple interfaces, gated by Client_True staff persona. | tools/index.php, tools/_/app/framework.php, tools/_/app/frameworkindex.php, tools/_/app/auth.php, tools/_/app/nav.php, tools/common/header.php, tools/common/footer.php, tools/mvc/get.php, tools/mvc/_TEMPLATE/get.php, tools/docs/ADDING_A_TOOL.md |
 | [Tools — Developers Folder (UUID & Password Generators)](features/developer-tools.md) | The first two tools shipped in the Tools app, both under the **Developers** folder and gated to personas **Development Team** / **TOGa Technology**. | tools/mvc/developers/uuid/get.php, tools/mvc/developers/password/get.php |
 | [Tools Persona-Gated Navigation (App_Nav)](features/persona-gated-navigation.md) | `App_Nav` is the Tools app's two-level, **persona-gated** navigation. | tools/_/app/nav.php |
-| [Tools SAML SSO Consumer & Persona-Gated Auth (App_Auth)](features/saml-sso-auth.md) | `App_Auth` is the Tools app's authentication layer: it consumes the SAML gateway `?saml=` handoff (see the 2.0 SAML downstream integration contract), establishe | tools/_/app/auth.php, tools/mvc/sso/get.php, tools/mvc/login/get.php, tools/mvc/login/post.php, tools/mvc/logout/get.php |
+| [Tools SAML SSO Consumer & Persona-Gated Auth (App_Auth)](features/saml-sso-auth.md) | `App_Auth` is the Tools app's authentication layer: it consumes the SAML gateway `?saml=` handoff (see the 2.0 SAML downstream integration contract), establishe | tools/_/app/auth.php, tools/mvc/sso/initiate/get.php, tools/mvc/sso/get.php, tools/mvc/login/get.php, tools/mvc/login/post.php, tools/mvc/logout/get.php, tools/mvc/get.php, tools/config.production.ini |
 | [Deploying Tools to Elastic Beanstalk (PHP 8.5 / Amazon Linux 2023)](workflows/deploy-to-elastic-beanstalk-al2023.md) | How the **Tools** 1.0 app boots on Elastic Beanstalk running `PHP 8.5 on 64bit Amazon Linux 2023/4.13.1 (aarch64)`. | tools/.ebextensions/004_http_to_https.config, tools/.ebextensions/006_mount-s3fs.config, tools/.ebextensions/007_setup_export_cache_folders.config, tools/.ebextensions/008_setup_ldap.config, tools/.ebextensions/009_setup_phpini.config, tools/.ebextensions/020_setup_git_libraries.config, tools/.ebextensions/050_register_instance_to_shared_application_load_balancer.config, tools/ebs/git.json |

package/knowledge/1.0/apps/tools/features/saml-sso-auth.md

@@ -6,16 +6,20 @@ project: Tools
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-26
 owners: [jcardinal]
 files:
   - tools/_/app/auth.php
+  - tools/mvc/sso/initiate/get.php
   - tools/mvc/sso/get.php
   - tools/mvc/login/get.php
   - tools/mvc/login/post.php
   - tools/mvc/logout/get.php
+  - tools/mvc/get.php
+  - tools/config.production.ini
 related:
   - ../architecture.md
+  - ../../library/features/app-sso-initiation.md
   - ../../../2.0/apps/saml/features/downstream-integration-contract.md
   - ../../../clients/true/features/users-personas-data-model.md
 ---
@@ -30,6 +34,18 @@ auto-created.
 
 ## How it works
 
+### Wiring overview
+- **`/sso/initiate`** (`mvc/sso/initiate/get.php`) — guards `isLoggedIn`, reads `config[saml]`,
+  calls `App_Sso::initiate([...])` and `App_MVC::routeTo($url); exit;`. Initiation now uses the
+  reusable 1.0 [`App_Sso`](../../library/features/app-sso-initiation.md) library class (no longer a
+  placeholder).
+- **`/sso`** (`mvc/sso/get.php`) — the handoff consumer (below).
+- **Core.Domains** — a fixed-uuid row registers this app's return domain so the gateway resolves
+  client/environment/return URL: `uuid 2927bc15-e347-4358-a430-fb28f9446d27`, `clientId 1` (True),
+  `appId 30`, `environmentId 1` (production), `domain https://tools.togatech.com/sso`. The uuid
+  **equals** config `domain_uuid` (created in `dbchanges2/Core/2026-06-26a - ToolsSsoDomain.sql`,
+  applied to live Core).
+
 ### Consuming the `?saml=` handoff (`mvc/sso/get.php` → `App_Auth`)
 1. Length-guard `$_GET['saml']`, then base64-decode → `json_decode` → read `payload.client`
    and `payload.user`.
@@ -42,7 +58,8 @@ auto-created.
 4. Load the active Client_True user: `WHERE uuid = ? AND isActive = 1`. No match → fail closed.
 
 ### Session establishment (`establishSession()`)
-- Calls `session_regenerate_id(true)`, then caches the user and **persona names** in `$_SESSION`.
+- Calls `session_regenerate_id(true)` **guarded by `if (!headers_sent())`** (see gotcha), then
+  caches the user and **persona names** in `$_SESSION`.
 - Persona lookup (read-only `db_true`):
   `SELECT p.name FROM Users u JOIN Users_Personas up ON up.userId=u.id JOIN Personas p ON p.id=up.personaId WHERE u.uuid = <escaped>`.
 - The session cookie is set **HttpOnly + SameSite=Lax** in `App_Framework_Tools::initialize()`
@@ -57,20 +74,33 @@ auto-created.
 is truthy **and** `App_Registry::inDevMode()` — both must hold. When used it writes a `SECURITY`
 line to `error_log`.
 
+### One-step sign-in
+Home route `/` (`mvc/get.php`), when not logged in, does `App_MVC::routeTo('/login'); return;` so the
+SSO button is the only click — the previous welcome-card "Sign in" → `/login` intermediate step was
+removed.
+
 ## Gotchas / known issues
 
-- **SSO initiation is not implemented in this 1.0 app.** Building the signed AuthnRequest lives
-  in 2.0 `_underscore` (`singleSignOnServiceUrl()`); login here points at a configurable
-  `[saml] initiation_url` **placeholder**. Open item: needs a gateway initiation entry point or
-  a ported builder.
+- **Consumer route runs mid-render → headers already sent.** The 1.0 framework runs `mvc/sso/get.php`
+  **inside** the page render (`frameworkindex → body → loadFile`) after `common/header.php` has
+  emitted output, so `session_regenerate_id(true)` fatals ("cannot be regenerated after headers
+  already sent"). Fixed by guarding with `if (!headers_sent())`. **Known architectural limitation:**
+  the failure path (`tools_ssoFail → http_response_code` at `mvc/sso/get.php:23`) *also* fatals on
+  headers-sent; the proper long-term fix is to route `/sso` **before any output** and `exit`. Any
+  1.0 app adopting this consumer pattern inherits this — see
+  [App_Sso](../../library/features/app-sso-initiation.md).
 - **No app-side replay defense.** The handoff token carries no nonce/timestamp the app verifies.
   Recommend the gateway embed `iat` + `jti`.
 
 ## Config keys
 
 `[database_true]` (read-only Client_True); `[saml]` `api_secret_access_token` /
-`api_secret_access_token_previous`, `initiation_url`, `client_authentication_uuid`,
-`domain_uuid`, `true_client_uuid`; `[internal]` `dev_mode`.
+`api_secret_access_token_previous`, `client_authentication_uuid`, `domain_uuid`,
+`true_client_uuid` (plus the IdP/ACS urls used by initiation); `[internal]` `dev_mode`. **Secret
+location:** `config.production.ini` holds the plaintext production secrets — including the shared
+Core `API_SECRET_ACCESS_TOKEN` — in its `[saml]` section (committed; developer explicitly accepted
+this). Document **where** they live, never the values.
 
 ## Change history
+- 2026-06-26 — Wired up real SSO initiation via the new 1.0 `App_Sso` library class (`/sso/initiate`), replacing the `initiation_url` placeholder; registered the fixed-uuid Core.Domains return row (dbchanges2 `2026-06-26a`); fixed the `session_regenerate_id` headers-already-sent fatal (guarded with `!headers_sent()`) and documented the mid-render failure-path limitation; collapsed home → `/login` to one-step sign-in; noted prod secrets live in `config.production.ini [saml]` (jcardinal)
 - 2026-06-25 — Built App_Auth: SAML `?saml=` handoff consumer with dual-key decrypt, hash_equals client-uuid check, fail-closed 401, persona-cached session (HttpOnly+SameSite=Lax), and a double-gated dev bypass. Initiation + replay defense left as open items (jcardinal)

package/knowledge/1.0/apps/tools/workflows/deploy-to-elastic-beanstalk-al2023.md

@@ -117,8 +117,17 @@ setup — the git clone (`020`) deliberately does **not** use it (see gotchas).
   e.g. `GIT=$(which git || echo /usr/bin/git)`.
 - **cfn-init `files:` runs before `container_commands`** — the correct pattern for writing a
   script and then executing it in the same config.
+- **A SAML SSO return-leg "connection timeout" is usually a missing HTTPS listener, not code.**
+  When the gateway's return redirect to `https://<host>/sso` times out in the browser, verify the
+  **EB/ALB HTTPS (443) listener + ACM cert cover the EXACT return hostname before debugging
+  PHP/SAML.** This bit Tools after the domain was switched from `togahub.com` to `togatech.com` and
+  no 443 listener existed for the new hostname. Diagnosis signature: `curl` to the public `https://`
+  URL **from the instance itself** returns `http=000` after the full timeout, while
+  `curl http://127.0.0.1` with a `Host:` header returns `200` fast. Reusable for any TOGA app behind
+  Elastic Beanstalk.
 
 ## Change history
+- 2026-06-26 — Added the SAML SSO return-leg gotcha: a "connection timeout" on `https://<host>/sso` was a missing EB/ALB HTTPS (443) listener for the new `togatech.com` hostname (not PHP/SAML); documented the curl `http=000` vs `127.0.0.1` 200 diagnosis (jcardinal)
 - 2026-06-26 — Documented the AL2 → AL2023 (PHP 8.5) EB migration for Tools: package renames
   (`libstdc++48`→`libstdc++`, `php73-ldap`→`php-ldap`, drop `libcurl`), php ini via cfn-init
   `files:` writing `/etc/php.d/application.ini`, bash-based library clone replacing the

package/knowledge/INDEX.md

@@ -4,7 +4,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 
 ## 1.0 framework
 
-- **library** (Library) _(framework core)_ — 9 doc(s) → [1.0/apps/library/INDEX.md](1.0/apps/library/INDEX.md)
+- **library** (Library) _(framework core)_ — 10 doc(s) → [1.0/apps/library/INDEX.md](1.0/apps/library/INDEX.md)
 - **worker** (Worker) — 10 doc(s) → [1.0/apps/worker/INDEX.md](1.0/apps/worker/INDEX.md)
 - **togadesk** (TOGa Desk) — 8 doc(s) → [1.0/apps/togadesk/INDEX.md](1.0/apps/togadesk/INDEX.md)
 - **togaview** (TOGa View) — 6 doc(s) → [1.0/apps/togaview/INDEX.md](1.0/apps/togaview/INDEX.md)
@@ -33,7 +33,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 
 ## standalone framework
 
-- **togatech** (TOGA Technology Website) — 2 doc(s) → [standalone/apps/togatech/INDEX.md](standalone/apps/togatech/INDEX.md)
+- **togatech** (TOGA Technology Website) — 4 doc(s) → [standalone/apps/togatech/INDEX.md](standalone/apps/togatech/INDEX.md)
 - **forward** (Forwarder) — 4 doc(s) → [standalone/apps/forward/INDEX.md](standalone/apps/forward/INDEX.md)
 
 ## Clients

package/knowledge/clients/true/profile.md

@@ -8,7 +8,7 @@ project: _Underscore
 client: true
 type: profile
 status: active
-updated: 2026-06-25
+updated: 2026-06-26
 owners: [jcardinal]
 files: []
 related:
@@ -26,5 +26,8 @@ by staff role (e.g. the planned Toolbox app) reads its `Users` / `Personas` mode
 - **Client identifier:** `True`
 - **SSO mapper:** `_Model_True_ClientAuthentication` (base; matches by email from NameID)
 
-The new **Tools** app (1.0; repo `tools`) reads the `Client_True` DB **read-only** to gate its
-internal tooling by staff persona (see `1.0/apps/tools/`).
+The **Tools** app (1.0; repo `tools`) authenticates True users via **SSO** through
+`saml.togahub.com` and reads the `Client_True` DB **read-only** to gate its internal tooling by
+staff persona (see `1.0/apps/tools/`). Its gateway return domain is registered in `Core.Domains`
+(`uuid 2927bc15-e347-4358-a430-fb28f9446d27`, `clientId 1`, `appId 30`, env 1,
+`https://tools.togatech.com/sso`).

package/knowledge/standalone/apps/togatech/INDEX.md

@@ -3,4 +3,5 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [TOGA Technology Website Architecture](architecture.md) | The public-facing TOGA Technology corporate/marketing website. | togatech/src/main.tsx, togatech/src/App.tsx, togatech/src/routes.tsx, togatech/src/lib/api.ts, togatech/src/lib/contentful.ts, togatech/src/themeConfig/ThemeContext.tsx, togatech/vite.config.ts, togatech/package.json |
-| [SEO / AEO / GEO — Prerendering, Single-Source Meta & Structured Data](features/seo-aeo-geo-prerender.md) | Makes togatech.com visible and citable to search engines **and** AI answer engines (ChatGPT/Perplexity/Claude search, Google AI Overviews). | togatech/vite.config.ts, togatech/scripts/prerender.mjs, togatech/src/routes.config.json, togatech/src/main.tsx, togatech/src/App.tsx, togatech/src/components/SEO/Seo.tsx, togatech/src/components/SEO/JsonLd.tsx, togatech/src/components/SEO/schema.ts, togatech/public/robots.prod.txt, togatech/public/sitemap.xml, togatech/public/llms.txt |
+| [SEO / AEO / GEO — Prerendering, Single-Source Meta & Structured Data](features/seo-aeo-geo-prerender.md) | Makes togatech.com visible and citable to search engines **and** AI answer engines (ChatGPT/Perplexity/Claude search, Google AI Overviews). | togatech/vite.config.ts, togatech/scripts/prerender.mjs, togatech/src/routes.config.json, togatech/src/main.tsx, togatech/src/App.tsx, togatech/src/components/SEO/Seo.tsx, togatech/src/components/SEO/JsonLd.tsx, togatech/src/components/SEO/schema.ts, togatech/src/components/templates/AppLayout.tsx, togatech/src/pages/WhatWeDo/WhatWeDoPage.tsx, togatech/src/pages/WhatWeDo/viewModel/FIELDS/WHATWEDOPAGEFIELDS.json, togatech/src/pages/About/AboutPage.tsx, togatech/src/pages/Contact/ContactPage.tsx, togatech/src/pages/OurPlatform/OurPlatformPage.tsx, togatech/public/robots.prod.txt, togatech/public/sitemap.xml, togatech/public/llms.txt |
+| [Creating Pull Requests on togatech](workflows/creating-pull-requests.md) | How to open a PR against `agilantsolutions/togatech`. | togatech/.git/config |

package/knowledge/standalone/apps/togatech/features/seo-aeo-geo-prerender.md

@@ -6,7 +6,7 @@ project: TOGA Technology Website
 client: shared
 type: feature
 status: active
-updated: 2026-06-19
+updated: 2026-06-26
 owners: ["ajean", "jcardinal"]
 files:
   - togatech/vite.config.ts
@@ -17,6 +17,12 @@ files:
   - togatech/src/components/SEO/Seo.tsx
   - togatech/src/components/SEO/JsonLd.tsx
   - togatech/src/components/SEO/schema.ts
+  - togatech/src/components/templates/AppLayout.tsx
+  - togatech/src/pages/WhatWeDo/WhatWeDoPage.tsx
+  - togatech/src/pages/WhatWeDo/viewModel/FIELDS/WHATWEDOPAGEFIELDS.json
+  - togatech/src/pages/About/AboutPage.tsx
+  - togatech/src/pages/Contact/ContactPage.tsx
+  - togatech/src/pages/OurPlatform/OurPlatformPage.tsx
   - togatech/public/robots.prod.txt
   - togatech/public/sitemap.xml
   - togatech/public/llms.txt
@@ -37,7 +43,15 @@ Makes togatech.com visible and citable to search engines **and** AI answer engin
 1. **robots:** `robotsPlugin` copies `robots.prod.txt` only when `mode === "production"`; beta/gamma/dev get `robots.dev.txt` (`Disallow: /`). `robots.prod.txt` carries an explicit AI-bot allow-list (GPTBot, ClaudeBot, PerplexityBot, …) + `https://` sitemap.
 2. **prerender:** `npm run build` = `tsc && vite build && npx puppeteer browsers install chrome && node scripts/prerender.mjs` (the Chrome-install step was added 2026-06-19 — see gotchas). The script serves `dist/` (reading the original shell once, serving it for all nav routes), snapshots each route in headless Chrome, and writes `dist/<route>/index.html`. Runs in a real browser, so **no SSR/window guards needed**.
 3. **meta:** each page renders `<Seo {...FIELDS.meta} />` — title/description/keywords/canonical/OG/Twitter from one place per page; canonical/OG URLs derived from one `SITE_URL`. `<JsonLd>` (Helmet `<script type="application/ld+json">`) is baked into the snapshot.
-4. **structured data:** Organization + WebSite site-wide (AppLayout), per-page BreadcrumbList (Seo), platform SoftwareApplication (OurPlatform), LocalBusiness×5 (from Contact locations), Person (from About team) — all **derived from existing FIELDS** (single source).
+4. **structured data:** all JSON-LD now lives in **one module — `src/components/SEO/schema.ts`** (the single source of truth), derived from `FOOTERFIELDS.json` (socials/email/phone) and each page's FIELDS JSON, so editing footer/content updates schema automatically. Exports and their render sites (emitted via `<JsonLd>`/Helmet):
+   - `organizationSchema` + `websiteSchema` → **AppLayout** (all pages).
+   - `serviceSchemas` (4 `Service` nodes) → **WhatWeDoPage**.
+   - `platformSchema` (`SoftwareApplication` for the TOGa Platform) → **OurPlatformPage**.
+   - `aboutPageSchema` (`AboutPage`) + `personSchemas` (per leader) → **AboutPage**.
+   - `contactPageSchema` (`ContactPage`) + `localBusinessSchemas` (per office, from `CONTACTPAGEFIELDS.map.locations`) → **ContactPage**.
+   - **Entity graph linked by `@id`:** Organization is `${SITE_URL}/#organization`, WebSite `/#website`, logo `/#logo`. Service/Person/LocalBusiness reference the org via `provider`/`worksFor`/`parentOrganization` `@id`; AboutPage/ContactPage set `isPartOf` the website and `about` the org. Use `@id` cross-references — do not inline duplicate org nodes.
+   - `organizationSchema.logo` is an `ImageObject` (`@id` `/#logo`, `url`, `contentUrl`, `caption "TOGA Technology"`); width/height are intentionally omitted because the logo is an SVG.
+   - `personSchemas` de-dupes a leader who appears in both `boardMembers` and `members` in `ABOUTPAGEFIELDS`, keyed on lowercased trimmed name (a `Set`) — naive emission produced duplicate `Person` nodes.
 
 ## Data model
 None (static marketing site). All copy/meta/NAP/leaders come from `*FIELDS*.json`; structured data is derived from `FOOTERFIELDS.json`, `CONTACTPAGEFIELDS.json` (`map.locations`), and `ABOUTPAGEFIELDS.json` (`teamMembers`).
@@ -57,10 +71,15 @@ None — uniform.
 - **og:image dedupe:** static OG/Twitter tags were removed from `index.html` because `<Seo>` emits per-page ones (Helmet appends rather than replacing pre-existing static tags → duplicates otherwise).
 - **Verified data corrections:** real positioning is *integrated IT services + the ERA TOGa Platform*; real socials are LinkedIn `/toga-tech` + YouTube + Instagram (no Twitter/GitHub/Crunchbase); contact is `website@togatech.com` / `+1 (212) 736-0111`; **5** offices. Prior planning docs had several wrong specifics — verify schema/llms.txt against FIELDS before shipping.
 - **Build size:** JS bundle is ~14.8 MB (4.9 MB gzip) — a real CWV/LCP risk; code-splitting is a separate follow-up.
+- **FIELDS JSON is component-coupled — no free-prose body slot:** each page's `*FIELDS*.json` is shaped to specific components (hero, cardScroll, businessProblems, kpi, carousel), so there is **no place to drop a long prose block**. An audit's "rewrite to 900 words" is not structurally possible without building new components — you can only sharpen titles/descriptions/keywords/card copy that already have slots. (`/our-platform` was left unchanged: it is already content-dense — 7 app modules + 4 stacks + testimonials + KPIs — and the original audit under-counted because that content is JS-rendered.)
+- **`personSchemas` duplicate guard:** a leader can be in both `boardMembers` and `members` in `ABOUTPAGEFIELDS` — `personSchemas` must de-dup by lowercased trimmed name, or it emits duplicate `Person` nodes.
+- **🔴 Brand name is "TOGA Technology" only — never "Agilant":** an earlier draft adding `alternateName: "Agilant"` / "(formerly Agilant)" to the org schema was explicitly reverted. Do not reintroduce "Agilant" in schema, copy, or meta. (Captured as a team brand standard — see Related docs.)
 
 ## Change history
+- 2026-06-26 — SEO improvement effort (PRs #33–#36 → `_production`; SEO health ~61→78 est.). Centralized all JSON-LD into `src/components/SEO/schema.ts` (org/website/platform/service×4/about/contact/localBusiness/person, `@id`-linked graph), de-duped Person nodes, logo→`ImageObject`, sharpened `/what-we-do` meta+copy, added `<lastmod>` to all 7 sitemap URLs. Recorded brand constraint ("TOGA Technology" only, never "Agilant") and the component-coupled-FIELDS limit. (ajean)
 - 2026-06-19 — Merged SEO/AEO into `_production` (resolved ContactPage conflict: reCAPTCHA + Seo/JsonLd, dropped Helmet). Fixed Amplify build: committed `package-lock.json` (npm ci EUSAGE) and added `npx puppeteer browsers install chrome` to the build before prerender. (jcardinal)
 - 2026-06-18 — Initial SEO/AEO/GEO implementation: robots mode-gate + AI allow-list + sitemap/llms; Puppeteer prerender (fail-fast); shared `<Seo>` single-source meta + canonical; JSON-LD (Organization/WebSite/Breadcrumb/SoftwareApplication/LocalBusiness×5/Person×12). PRs #29 + #30, pending merge. (ajean)
 
 ## Related docs
 - standalone/apps/togatech/architecture.md (update its Build/deploy section once PR #30 merges — robotsPlugin gating + prerender step).
+- standalone/apps/togatech/workflows/creating-pull-requests.md — how PRs get opened on this repo (gh CLI is unauthenticated; uses curl + osxkeychain token; base `_production`).

package/knowledge/standalone/apps/togatech/workflows/creating-pull-requests.md

@@ -0,0 +1,47 @@
+---
+title: Creating Pull Requests on togatech
+framework: "standalone"
+repo: togatech
+project: TOGA Technology Website
+client: shared
+type: workflow
+status: active
+updated: 2026-06-26
+owners: ["ajean"]
+files:
+  - togatech/.git/config
+related:
+  - standalone/apps/togatech/features/seo-aeo-geo-prerender.md
+---
+
+## Summary
+How to open a PR against `agilantsolutions/togatech`. The local `gh` CLI is **not usable**
+for this repo (it lacks the `read:org` scope), so PRs are created with a raw GitHub REST
+call authenticated by the token already sitting in the macOS keychain. **Base branch is
+`_production`, not `_main`** (`_main` is stale) — feature branches are cut from `_production`.
+
+## How it works
+1. Branch off `_production` (e.g. `feature/seo-schema`), commit, and push the branch.
+2. Pull the GitHub token from the osxkeychain credential helper rather than relying on `gh`:
+   ```
+   TOKEN=$(printf 'protocol=https\nhost=github.com\n\n' | git credential fill | sed -n 's/^password=//p')
+   ```
+3. POST to the PR API with that token:
+   ```
+   curl -s -X POST \
+     -H "Authorization: token $TOKEN" \
+     -H "Accept: application/vnd.github+json" \
+     https://api.github.com/repos/agilantsolutions/togatech/pulls \
+     -d '{"title":"...","head":"<branch>","base":"_production","body":"..."}'
+   ```
+4. The response JSON contains `html_url` for the new PR. Merge follows the normal review flow.
+
+## Gotchas / known issues
+- **`gh pr create` fails** here — the authenticated `gh` session lacks `read:org`. Do not
+  burn time re-authing `gh`; use the curl path above.
+- **Base is `_production`.** Targeting `_main` opens a PR against a stale branch. (This matches
+  the `worker2` mainline convention — mainline is `_production`, not `_main`.)
+- **Never echo `$TOKEN`** into logs, commit messages, or PR bodies — it is a live credential.
+
+## Change history
+- 2026-06-26 — Documented the curl-based PR flow (gh unauthenticated; base `_production`), captured during the SEO improvement effort (PRs #33–#36). (ajean)

package/knowledge/standalone/standards/brand-naming.md

@@ -0,0 +1,35 @@
+---
+title: Brand Naming — "TOGA Technology" only
+framework: "standalone"
+repo: togatech
+project: TOGA Technology Website
+client: shared
+type: standard
+status: active
+updated: 2026-06-26
+owners: ["ajean"]
+files:
+  - togatech/src/components/SEO/schema.ts
+related:
+  - standalone/apps/togatech/features/seo-aeo-geo-prerender.md
+---
+
+# Brand Naming — "TOGA Technology" only
+
+The company is referenced **only** as "TOGA Technology" in all code, schema, meta, and
+copy. **Never** use "Agilant" — not as a brand name, not as `alternateName`, and not in
+any "(formerly Agilant)" framing.
+
+## Why
+During the 2026-06 SEO effort an earlier draft added `alternateName: "Agilant"` and a
+"(formerly Agilant)" note to the Organization JSON-LD and org description. This was
+**explicitly reverted by the owner**. Surfacing the legacy name in structured data and
+copy is off-brand and creates the wrong entity association for search/AI answer engines.
+
+## Applies to
+- Schema.org JSON-LD (`src/components/SEO/schema.ts`) — no `alternateName: "Agilant"`.
+- Page meta (titles, descriptions), on-page copy, `llms.txt`, and any FIELDS JSON.
+- Any future SEO/content/AEO work on togatech.
+
+## Change history
+- 2026-06-26 — Standard recorded after reverting an "Agilant" alternateName/"formerly" draft in the org schema. (ajean)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.210",
+  "version": "1.0.212",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",