toga-ai 1.0.212 → 1.0.213

package/knowledge/1.0/apps/tools/INDEX.md

@@ -2,8 +2,8 @@
 
 | Doc | Summary | Files |
 |-----|---------|-------|
-| [Tools (1.0 Internal-Tools App) Architecture](architecture.md) | **Tools** is a standalone 1.0 (`App_`) application that houses many small internal tools behind simple interfaces, gated by Client_True staff persona. | tools/index.php, tools/_/app/framework.php, tools/_/app/frameworkindex.php, tools/_/app/auth.php, tools/_/app/nav.php, tools/common/header.php, tools/common/footer.php, tools/mvc/get.php, tools/mvc/_TEMPLATE/get.php, tools/docs/ADDING_A_TOOL.md |
+| [Tools (1.0 Internal-Tools App) Architecture](architecture.md) | **Tools** is a standalone 1.0 (`App_`) application that houses many small internal tools behind simple interfaces, gated by Client_True staff persona. | tools/index.php, tools/_/app/framework.php, tools/_/app/frameworkindex.php, tools/assets/img/favicon/favicon.ico, tools/assets/img/favicon/favicon-32x32.png, tools/assets/img/favicon/favicon-16x16.png, tools/assets/img/favicon/apple-touch-icon.png, tools/_/app/auth.php, tools/_/app/nav.php, tools/common/header.php, tools/common/footer.php, tools/mvc/get.php, tools/mvc/_TEMPLATE/get.php, tools/docs/ADDING_A_TOOL.md |
 | [Tools — Developers Folder (UUID & Password Generators)](features/developer-tools.md) | The first two tools shipped in the Tools app, both under the **Developers** folder and gated to personas **Development Team** / **TOGa Technology**. | tools/mvc/developers/uuid/get.php, tools/mvc/developers/password/get.php |
-| [Tools Persona-Gated Navigation (App_Nav)](features/persona-gated-navigation.md) | `App_Nav` is the Tools app's two-level, **persona-gated** navigation. | tools/_/app/nav.php |
+| [Tools Persona-Gated Navigation (App_Nav)](features/persona-gated-navigation.md) | `App_Nav` is the Tools app's two-level, **persona-gated** navigation. | tools/_/app/nav.php, tools/mvc/get.php |
 | [Tools SAML SSO Consumer & Persona-Gated Auth (App_Auth)](features/saml-sso-auth.md) | `App_Auth` is the Tools app's authentication layer: it consumes the SAML gateway `?saml=` handoff (see the 2.0 SAML downstream integration contract), establishe | tools/_/app/auth.php, tools/mvc/sso/initiate/get.php, tools/mvc/sso/get.php, tools/mvc/login/get.php, tools/mvc/login/post.php, tools/mvc/logout/get.php, tools/mvc/get.php, tools/config.production.ini |
 | [Deploying Tools to Elastic Beanstalk (PHP 8.5 / Amazon Linux 2023)](workflows/deploy-to-elastic-beanstalk-al2023.md) | How the **Tools** 1.0 app boots on Elastic Beanstalk running `PHP 8.5 on 64bit Amazon Linux 2023/4.13.1 (aarch64)`. | tools/.ebextensions/004_http_to_https.config, tools/.ebextensions/006_mount-s3fs.config, tools/.ebextensions/007_setup_export_cache_folders.config, tools/.ebextensions/008_setup_ldap.config, tools/.ebextensions/009_setup_phpini.config, tools/.ebextensions/020_setup_git_libraries.config, tools/.ebextensions/050_register_instance_to_shared_application_load_balancer.config, tools/ebs/git.json |

package/knowledge/1.0/apps/tools/architecture.md

@@ -6,12 +6,16 @@ project: Tools
 client: shared
 type: architecture
 status: active
-updated: 2026-06-25
+updated: 2026-06-26
 owners: [jcardinal]
 files:
   - tools/index.php
   - tools/_/app/framework.php
   - tools/_/app/frameworkindex.php
+  - tools/assets/img/favicon/favicon.ico
+  - tools/assets/img/favicon/favicon-32x32.png
+  - tools/assets/img/favicon/favicon-16x16.png
+  - tools/assets/img/favicon/apple-touch-icon.png
   - tools/_/app/auth.php
   - tools/_/app/nav.php
   - tools/common/header.php
@@ -57,14 +61,22 @@ calling the parent initialize.
 
 No per-host `stylePath` subfolder — one `assets/css/style.css`. Uses TOGA Technology logos in
 `assets/img` (`toga-brandmark-white.png` in the dark sidebar; `toga-horizontal-colored.png` on
-login/welcome). A fixed left two-column shell: dark left sidebar (`.app-nav`) with brand at top,
+login). **Favicons are app-local** under `assets/img/favicon/` (`apple-touch-icon.png` 180x180,
+`favicon-32x32.png`, `favicon-16x16.png`, `favicon.ico`, sourced from togatech.com) and registered
+in `_/app/frameworkindex.php` — **not** the shared `resources/images/favicon/` (Agilant) set
+referenced via `__ASSETS__`. **Convention:** a per-app favicon/brand asset belongs under that app's
+own `/assets`, never the shared `resources` repo, so changing one 1.0 app's favicon never affects
+sibling apps. A fixed left two-column shell: dark left sidebar (`.app-nav`) with brand at top,
 persona-filtered nav in the middle, pinned footer with the user's name + a ghost "Log out"
 button; content area on the right. **No top header bar** (see Critical rules).
 
 ## Home route
 
 `/` (`mvc/get.php`) renders a persona-filtered dashboard of available tools (tiles grouped by
-folder) when logged in, via `App_Nav::visibleGroups()`, or a welcome/sign-in card when not.
+folder) when logged in, via `App_Nav::visibleGroups()`. When **not** logged in, `/` immediately
+routes to `/login` (one-step SSO sign-in — no intermediate welcome card). A persona-less but
+authenticated user gets the dashboard's explicit empty-state (see
+`features/persona-gated-navigation.md`).
 
 ## Adding a tool
 
@@ -79,3 +91,6 @@ Create `mvc/<folder>/<tool>/get.php` (copy `mvc/_TEMPLATE/get.php`), add one ent
   **accepted this for now** (developer decision, 2026-06-25). Future remediation: git-ignore the
   config files and rotate all exposed credentials. (Location only — no values recorded here.)
 - **SSO initiation + replay defense are open items** — see `features/saml-sso-auth.md`.
+
+## Change history
+- 2026-06-26 — Documented app-local favicons under `assets/img/favicon/` (registered in `_/app/frameworkindex.php`, not the shared `resources/` set) + the per-app-asset convention; refreshed the home-route description for one-step SSO sign-in and the persona-less empty-state (jcardinal)

package/knowledge/1.0/apps/tools/features/persona-gated-navigation.md

@@ -6,10 +6,11 @@ project: Tools
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-06-26
 owners: [jcardinal]
 files:
   - tools/_/app/nav.php
+  - tools/mvc/get.php
 related:
   - ../architecture.md
   - ./saml-sso-auth.md
@@ -40,5 +41,25 @@ An action's `route` (e.g. `/developers/uuid`) maps **1:1** to `mvc/<route>/get.p
 tool means creating that file and adding one entry to `definition()` — see
 `docs/ADDING_A_TOOL.md` and the architecture doc.
 
+## Authorization model — authentication and authorization are separate
+
+**Authentication (SSO) and authorization (persona-gated nav) are independent.** Any valid,
+active Client_True user authenticates and gets a session (see
+[saml-sso-auth](./saml-sso-auth.md)) **regardless of personas** — having zero matching personas
+does **not** block login. Authorization is then applied entirely by `App_Nav::definition()`
+folder/action `personas` gates.
+
+**Persona-less user (authenticated, zero tools):** `App_Nav::render()` skips every folder/action
+the user lacks personas for, and skips now-empty groups, so the left rail renders **no links**.
+The home dashboard (`mvc/get.php`) detects the empty result and shows an explicit empty-state
+rather than a blank page:
+- subtitle: *"There are no tools available for you to see."*
+- a card: *"Your account doesn't have access to any tools. Tool access is granted by persona —
+  if you believe you should have access, contact the development team."* + a Log out action.
+
+This is intentional: a valid user is never shown a broken/blank dashboard, and access is granted
+purely by assigning personas — no code change is needed to grant a user access to an existing tool.
+
 ## Change history
+- 2026-06-26 — Documented the authorization model: authentication (SSO) and authorization (persona-gated nav) are separate — any valid user logs in regardless of personas; a persona-less user gets an empty left rail and an explicit dashboard empty-state ("no tools available", contact-dev card + Log out) instead of a blank page (jcardinal)
 - 2026-06-25 — Built App_Nav: hard-coded two-level persona-gated navigation; render() for the left rail, visibleGroups() for the dashboard, personasForRoute() for page self-guarding; route maps 1:1 to mvc/<route>/get.php (jcardinal)

package/knowledge/1.0/apps/tools/features/saml-sso-auth.md

@@ -68,6 +68,9 @@ auto-created.
 ### Page guarding
 - `requireAuth([personas])` at the top of each page; `hasAnyPersona()` is `array_intersect`
   against the cached session personas. App_Nav uses the same cached data to filter the nav.
+- **Authentication ≠ authorization.** A session establishes for **any** valid/active user even
+  when they have **zero** matching personas; in that case the nav is empty and the dashboard shows
+  an explicit empty-state — see [persona-gated-navigation](./persona-gated-navigation.md).
 
 ### Dev bypass (double-gated, fails closed in prod)
 `mvc/login/post.php` permits **email-only** login **only** when config `[internal] dev_mode`

package/knowledge/1.0/apps/tools/workflows/deploy-to-elastic-beanstalk-al2023.md

@@ -117,16 +117,18 @@ setup — the git clone (`020`) deliberately does **not** use it (see gotchas).
   e.g. `GIT=$(which git || echo /usr/bin/git)`.
 - **cfn-init `files:` runs before `container_commands`** — the correct pattern for writing a
   script and then executing it in the same config.
-- **A SAML SSO return-leg "connection timeout" is usually a missing HTTPS listener, not code.**
+- **A SAML SSO return-leg "connection timeout" is a missing HTTPS listener, not code. (CONFIRMED + RESOLVED.)**
   When the gateway's return redirect to `https://<host>/sso` times out in the browser, verify the
   **EB/ALB HTTPS (443) listener + ACM cert cover the EXACT return hostname before debugging
-  PHP/SAML.** This bit Tools after the domain was switched from `togahub.com` to `togatech.com` and
-  no 443 listener existed for the new hostname. Diagnosis signature: `curl` to the public `https://`
-  URL **from the instance itself** returns `http=000` after the full timeout, while
-  `curl http://127.0.0.1` with a `Host:` header returns `200` fast. Reusable for any TOGA app behind
-  Elastic Beanstalk.
+  PHP/SAML.** Root cause for Tools was **confirmed**: the `tools.togatech.com` EB environment had
+  **no HTTPS (443) listener configured at all**. Adding the HTTPS:443 listener (with an ACM cert
+  covering the exact return hostname) fixed the SSO return leg completely — **no code change was
+  involved.** Diagnosis signature: `curl` to the public `https://` URL **from the instance itself**
+  returns `http=000` after the full timeout, while `curl http://127.0.0.1` with a `Host:` header
+  returns `200` fast. Reusable for any TOGA app behind Elastic Beanstalk.
 
 ## Change history
+- 2026-06-26 — CONFIRMED + RESOLVED the SAML SSO return-leg gotcha: the `tools.togatech.com` EB environment had no HTTPS (443) listener at all; adding the HTTPS:443 listener + ACM cert covering the exact return hostname fixed the SSO return leg with no code change (jcardinal)
 - 2026-06-26 — Added the SAML SSO return-leg gotcha: a "connection timeout" on `https://<host>/sso` was a missing EB/ALB HTTPS (443) listener for the new `togatech.com` hostname (not PHP/SAML); documented the curl `http=000` vs `127.0.0.1` 200 diagnosis (jcardinal)
 - 2026-06-26 — Documented the AL2 → AL2023 (PHP 8.5) EB migration for Tools: package renames
   (`libstdc++48`→`libstdc++`, `php73-ldap`→`php-ldap`, drop `libcurl`), php ini via cfn-init

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.212",
+  "version": "1.0.213",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",