toga-ai 1.0.259 → 1.0.261

package/knowledge/1.0/apps/tools/INDEX.md

@@ -7,5 +7,6 @@
 | [Tools MVC — Routing, CSRF & App_Database Access Patterns](features/mvc-data-access-patterns.md) | The load-bearing 1.0 (`App_`) framework conventions a developer needs when adding a page to the Tools app — URL routing, CSRF, and DB access through `App_Databa | tools/_/app/nav.php, tools/mvc/get.php |
 | [Tools Persona-Gated Navigation (App_Nav)](features/persona-gated-navigation.md) | `App_Nav` is the Tools app's two-level, **persona-gated** navigation. | tools/_/app/nav.php, tools/mvc/get.php |
 | [Tools SAML SSO Consumer & Persona-Gated Auth (App_Auth)](features/saml-sso-auth.md) | `App_Auth` is the Tools app's authentication layer: it consumes the SAML gateway `?saml=` handoff (see the 2.0 SAML downstream integration contract), establishe | tools/_/app/auth.php, tools/mvc/sso/initiate/get.php, tools/mvc/sso/get.php, tools/mvc/login/get.php, tools/mvc/login/post.php, tools/mvc/logout/get.php, tools/mvc/get.php, tools/config.production.ini, tools/config.local.ini |
+| [Talos Knowledge Base Admin UI (KB Documents + Vocabulary)](features/talos-kb-documents-admin.md) | A Tools (1.0) admin UI to browse/fix the Talos knowledge-base documents and manage the transcript-cleanup vocabulary — without a deploy. | tools/mvc/talos/kb-documents/get.php, tools/mvc/talos/kb-documents/post.php, tools/mvc/talos/vocabulary/get.php, tools/mvc/talos/vocabulary/post.php, tools/_/app/talos/s3.php, tools/_/app/worker.php, tools/_/app/nav.php |
 | [Talos Pricing UI (Onboarding, Dashboard, Benchmarks, Cost Factors + Estimator)](features/talos-pricing-ui.md) | The 1.0 (tools app) face of the **Talos Pricing Platform** — a "Talos Pricing" nav folder with four pages plus a client-side estimate engine. | tools/_/app/nav.php, tools/_/app/talos/estimator.php, tools/mvc/talos/onboarding/get.php, tools/mvc/talos/onboarding/post.php, tools/mvc/talos/pricing/get.php, tools/mvc/talos/benchmarks/get.php, tools/mvc/talos/factors/get.php, tools/mvc/talos/factors/post.php, tools/assets/css/style.css |
 | [Deploying Tools to Elastic Beanstalk (PHP 8.5 / Amazon Linux 2023)](workflows/deploy-to-elastic-beanstalk-al2023.md) | How the **Tools** 1.0 app boots on Elastic Beanstalk running `PHP 8.5 on 64bit Amazon Linux 2023/4.13.1 (aarch64)`. | tools/.ebextensions/004_http_to_https.config, tools/.ebextensions/006_mount-s3fs.config, tools/.ebextensions/007_setup_export_cache_folders.config, tools/.ebextensions/008_setup_ldap.config, tools/.ebextensions/009_setup_phpini.config, tools/.ebextensions/020_setup_git_libraries.config, tools/.ebextensions/050_register_instance_to_shared_application_load_balancer.config, tools/ebs/git.json |

package/knowledge/1.0/apps/tools/features/talos-kb-documents-admin.md

@@ -0,0 +1,88 @@
+---
+title: Talos Knowledge Base Admin UI (KB Documents + Vocabulary)
+framework: "1.0"
+repo: tools
+project: Tools
+client: shared
+type: feature
+status: active
+updated: 2026-06-30
+owners: [jcardinal]
+files:
+  - tools/mvc/talos/kb-documents/get.php
+  - tools/mvc/talos/kb-documents/post.php
+  - tools/mvc/talos/vocabulary/get.php
+  - tools/mvc/talos/vocabulary/post.php
+  - tools/_/app/talos/s3.php
+  - tools/_/app/worker.php
+  - tools/_/app/nav.php
+related:
+  - ./mvc-data-access-patterns.md
+  - ./persona-gated-navigation.md
+  - ../architecture.md
+  - ../../../2.0/apps/worker2/features/talos-transcript-ingestion.md
+---
+
+## Summary
+
+A Tools (1.0) admin UI to browse/fix the Talos knowledge-base documents and manage the
+transcript-cleanup vocabulary — without a deploy. It is the human front-end to the worker2
+[Talos Transcript Ingestion](../../../2.0/apps/worker2/features/talos-transcript-ingestion.md)
+pipeline. A new **"Talos Knowledge Base"** nav group (personas *Development Team* / *TOGa
+Technology*) exposes two pages.
+
+## Pages
+
+### `/talos/kb-documents` — approved-doc browser
+- KB list derived from the **actual S3 sub-folders** under `development-team/` (title-cased,
+  e.g. `office-depot` → "Office Depot") — not from `Team.KnowledgeBases`.
+- Lists approved docs excluding `*.metadata.json`; columns Meeting Date (`n/j/y`) / Title /
+  Size / Last modified (`n/j/y g:i A`).
+- Clickable rows open an overlay **modal** with a type-aware preview: text inline; PDF via a
+  presigned S3 URL in an iframe; Office files via the Google Docs viewer (presigned URL; MS
+  Office viewer noted as an alternative); unsupported → download/delete only.
+- Download + delete are icon buttons in the modal. **Delete enqueues the worker `SyncKb`
+  re-sync** so Bedrock reflects the removal.
+
+### `/talos/vocabulary` — cleanup vocabulary manager
+Single tabbed page: Prompt Template, Applications, Clients, People, Business Terms, Examples,
+Replacements. (The old standalone `/talos/replacements` page was folded in here and deleted.)
+Classic view → Edit → Save per tab, with **full-set reconciliation** (transactional, rolls
+back on error), trash-icon row removal, and an auto-dismissing toast. Backs the `Team.*`
+prompt/replacement tables that the worker2 pipeline reads at runtime.
+
+## Helpers
+
+- **`App_Talos_S3`** (`_/app/talos/s3.php`) — S3 client; list KB slugs; list/count approved;
+  presigned URL; get/delete; slug sanitize+lowercase; approved-prefix path guard.
+- **`App_Worker::enqueue()`** (`_/app/worker.php`) — inserts a `Core.WorkerJobs` row and sends
+  the `{"workerJobId": id}` SQS message, so a 1.0 app can enqueue worker2 jobs.
+
+## Deploy prerequisites
+
+- `aws/aws-sdk-php` installed in `tools/vendor` (S3 + SQS).
+- New `tools/config.*.ini` sections (none exist yet): `[database_core2]` (writable 2.0 Core,
+  dbname `Core`), `[worker]` (`queue_url` / `queue_region`), `[aws]` (production).
+- Apply the dbchanges2 `Team/2026-06-30a..e` + `Core/2026-06-30a` migrations in order.
+- Verify the Bedrock KB region / data-source name against the live account (TODOs in code).
+
+## Gotchas
+
+- **KB list is derived from S3, not the DB.** The browse UI enumerates live S3 folders under
+  `development-team/`; `Team.KnowledgeBases` is not the source of truth for what's shown.
+- **Delete is not just an S3 delete** — it also enqueues a worker `SyncKb` job to re-sync the
+  Bedrock data source.
+- No new secret literals introduced; credentials come from the new config sections above.
+
+## Change history
+
+- 2026-06-30 — Built the Talos KB admin UI: `/talos/kb-documents` (S3-derived KB list, approved
+  doc browser with type-aware preview modal, download + delete-with-resync) and `/talos/vocabulary`
+  (tabbed prompt/vocabulary/replacements manager with transactional full-set reconciliation;
+  folded in and deleted the old `/talos/replacements`). Added `App_Talos_S3` and
+  `App_Worker::enqueue()` (1.0 → worker2 SQS) helpers and the "Talos Knowledge Base" nav group. (jcardinal)
+
+## Related docs
+
+- [Talos Transcript Ingestion Pipeline](../../../2.0/apps/worker2/features/talos-transcript-ingestion.md) — the worker2 backend.
+- [Tools MVC — Routing, CSRF & App_Database Access Patterns](./mvc-data-access-patterns.md)

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -14,6 +14,6 @@
 | [NetSuite REST Client (_Component_Api_Netsuite) — record writes & SuiteQL](features/netsuite-rest-client.md) | `_Component_Api_Netsuite` is the **2.0 `_underscore` NetSuite REST client** — the shared primitive every worker2/api2 NetSuite caller uses for record GETs, Suit | _underscore/Component/Api/Netsuite/Netsuite.php |
 | [Per-Client Database Connections & the Local Logs Trap](features/per-client-database-connections.md) | When `_underscore` serves a request for a client it opens **three distinct per-client database connections**, not one. | _underscore/Database.php, _underscore/ApiRequest.php, _underscore/Model/Client/Logs/Api.php |
 | [Recursive Item Fulfillments (upstream mirroring)](features/recursive-item-fulfillments.md) | In a multi-tier supply chain a sales order (SO) spawns a purchase order (PO) that becomes another SO downstream, and so on. | _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Client/ItemFulfillmentItem.php, _underscore/Model/Client/ItemFulfillmentItemUnit.php, _underscore/Model/Client/ItemFulfillmentPackage.php, _underscore/Model/Compass/AdvanceShippingNotice.php, dbchanges2/Core/2026-02-13 - 75601 - RecursiveItemFulfillmentCreation.sql, dbchanges2/Core/2026-06-04 - RecursiveItemFulfillmentPut.sql |
-| [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, dbchanges2/Core/2026-06-30a - SurfaceMetaGroupAndSalesOrderSections.sql, dbchanges2/Client/2026-06-30a - SurfaceMetaGroupAcl.sql, dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql, dbchanges2/Client/2026-06-29c - SurfaceRecordScriptAcl.sql, dbchanges2/Core/2026-06-29c - SurfaceDebugPhpMethodFix.sql, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php |
+| [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, _underscore/Model/Client/AclRecordScript.php, _underscore/Model/Core/RecordScript.php, dbchanges2/Core/2026-06-30a - SurfaceMetaGroupAndSalesOrderSections.sql, dbchanges2/Client/2026-06-30a - SurfaceMetaGroupAcl.sql, dbchanges2/Client_Quad/2026-07-01a - GrantSurfacesMetaGroupScriptAcl.sql, dbchanges2/Client_CompassCanada/2026-07-01a - GrantSurfacesMetaGroupScriptAcl.sql, dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql, dbchanges2/Client/2026-06-29c - SurfaceRecordScriptAcl.sql, dbchanges2/Core/2026-06-29c - SurfaceDebugPhpMethodFix.sql, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php |
 | [Tracking-Number Bridge Migration (ASN / Item Fulfillment / Item Receipt)](features/tracking-number-bridges.md) | Shipment tracking numbers used to live as **scalar FK columns** (`trackingNumberId`, `returnTrackingNumberId`) directly on the lowest-level "unit"/"item" tables | api2/Component/Api/V2/V2.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnit.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillmentItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Prudential/AdvanceShippingNotice.php, _underscore/Model/Compass/AdvanceShippingNotice.php, _underscore/Trait/Netsuite/ItemFulfillment.php, api2/Component/Api/Cxml/Cxml.php, dbchanges2/Client/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Core/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Client_Prudential/2026-06-15 - ItemFulfillmentTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Quad/2026-06-18a - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19b - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql, dbchanges2/Client_Quad/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql |
 | [Units for Items for Purchase Orders — Data Structure](features/units-for-items-for-purchase-orders.md) | Describes how unit (serialized inventory) data is linked to sales-order and purchase-order line items behind the `units-for-items-for-purchase-orders` TableView |  |

package/knowledge/2.0/apps/_underscore/features/surface-resolver.md

@@ -6,12 +6,16 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-06-30
-owners: [jcardinal]
+updated: 2026-07-01
+owners: [jcardinal, apeterson]
 files:
   - _underscore/Model/Core/Surface.php
+  - _underscore/Model/Client/AclRecordScript.php
+  - _underscore/Model/Core/RecordScript.php
   - dbchanges2/Core/2026-06-30a - SurfaceMetaGroupAndSalesOrderSections.sql
   - dbchanges2/Client/2026-06-30a - SurfaceMetaGroupAcl.sql
+  - dbchanges2/Client_Quad/2026-07-01a - GrantSurfacesMetaGroupScriptAcl.sql
+  - dbchanges2/Client_CompassCanada/2026-07-01a - GrantSurfacesMetaGroupScriptAcl.sql
   - dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql
   - dbchanges2/Client/2026-06-29c - SurfaceRecordScriptAcl.sql
   - dbchanges2/Core/2026-06-29c - SurfaceDebugPhpMethodFix.sql
@@ -113,6 +117,32 @@ which surfaced latent resolution gaps in `_buildBundle`/`_resolveElement`:
   `_Model_<Client>_*` overrides + `Client_ApiPayloadInterceptor` hooks — the Surface layer does
   **not** absorb business logic.
 
+## How a surfaces scripted-API call is authorized (route-level gate)
+
+Authorizing a surfaces script (`meta`, `meta-group`, `debug`) is a **two-layer** check. Get the
+first layer wrong and you get a **403 `EZ-1 AUTHORIZATION`** before any element ACL runs.
+
+1. **Route-level dispatch gate — `Client_<tenant>.AclRecordScripts`.** The surfaces dispatcher
+   authorizes each API script (route + method + phpMethod) via the **CLIENT-tier**
+   `AclRecordScripts` table (cols `uuid`, `recordScriptId` → `Core.RecordScripts`, `roleId` →
+   `Client_<tenant>.Roles`). The check is keyed on the JWT's **`id.client.roles`** (client roles),
+   **NOT** the platform `core.roles` and **NOT** the Core `AclRecordPermissions` chain.
+   `Core.RecordScripts` maps route/method/phpMethod → an ACL "record" (`recordId`). The three
+   surfaces scripts: `meta` (GET, phpMethod `meta`), `meta-group` (GET, `metaGroup`), `debug` (GET,
+   `metaDebug`). `_Model_Core_Surface::resolve/metaGroup` read the caller's roles from
+   **`id.client.roles`** (Surface.php ~lines 56/87).
+2. **Element-level ACL (runs *inside* `meta`/`metaGroup`, AFTER the route gate passes)** — dropping
+   individual surface elements uses a **separate** client-tier table `_Model_Client_AclActionPermission`,
+   gated by each `SurfaceElement.aclActionId`. This is the "composition, not absorption" step in
+   `resolve()` step 4; it never causes the route-level 403.
+
+**Debugging a surfaces 403 EZ-1 (hard-won):** it is the route-level gate — a missing
+`Client_<tenant>.AclRecordScripts` grant resolved by **client role**. Do **not** chase
+`Core.AclRecordPermissions`, `appId` scoping, or `AclLogicGroups`/`AclRecordExpressions` — all were
+investigated and ruled out as red herrings: `appId = NULL` is the normal working pattern, and the
+Core record grants + their logic-group expressions all evaluate `all`/`"1"`. The gate is purely
+"does this client role have an `AclRecordScripts` row for this `recordScriptId`?"
+
 ## Gotchas
 
 - **A Core RecordScript needs `Client.AclRecordScripts` rows per role to be invokable — record-level
@@ -167,8 +197,33 @@ which surfaced latent resolution gaps in `_buildBundle`/`_resolveElement`:
   per-role `Client.AclRecordScripts` dispatch grant. Verified via toga-db — `meta` script id 25 was
   granted roles 1/3/4 but `meta-group` (id 27) had **none** until the grant ran. Any new surfaces
   scripted-API method repeats this: record READ never authorizes dispatch.
+- **The meta-group grant is seeded per-tenant, not globally — new tenants repeat the 403.** When
+  `meta-group` shipped, the `AclRecordScripts` grant was seeded **only** for `Client_Compass`
+  (recordScriptId → roles 1,3,4). `Client_Quad` and `Client_CompassCanada` had **no** grant for the
+  meta-group recordScriptId at all — their `meta` was granted to client role 1 (why `meta` worked but
+  `meta-group` 403'd for the same user/token). Same-user-different-script + same-script-different-tenant
+  is the fingerprint of this gap. Fix (2026-07-01): two `dbchanges2/Client_<tenant>/` migrations
+  granting meta-group to **client role 1** (parity with each tenant's existing `meta` grant),
+  id-agnostic (resolve `Core.RecordScripts` id by route/method/phpMethod, cross-DB read of `Core.*`
+  per the 2026-06-29c ACL pattern) and re-runnable via `NOT EXISTS`. Surface-layer DB changes ship to
+  the **beta** environment only. ⚠ **Root-cause not yet closed:** the meta-group grant should be
+  added to the `dbchanges2/Client/` **baseline (blank) seed** so newly-cut clients get it
+  automatically — otherwise the next migrated tenant hits the identical 403. Only Compass (already
+  correct), Quad, and CompassCanada are addressed. Also note **role breadth**: Compass exposes
+  surfaces to roles 1,3,4; Quad/CC got role 1 only (parity with their `meta`). If Quad/CC should
+  match Compass, a follow-up migration aligning both `meta` and `meta-group` to roles 1,3,4 is needed.
 
 ## Change history
+- 2026-07-01 — Documented the full route-level authorization mechanism (new section): the surfaces
+  script gate is `Client_<tenant>.AclRecordScripts` keyed on JWT `id.client.roles` (client roles,
+  not `core.roles`, not `Core.AclRecordPermissions`); element-drop is a separate
+  `_Model_Client_AclActionPermission`/`aclActionId` layer running inside `resolve()` after the route
+  gate; captured the red-herring list (`appId=NULL` is normal, Core grants all evaluate `all`/`"1"`).
+  Fixed the `meta-group` 403 EZ-1 for **Quad** and **Compass Canada** — the meta-group
+  `AclRecordScripts` grant had been seeded for Compass only; added two id-agnostic, NOT-EXISTS-guarded
+  `Client_<tenant>/` migrations granting meta-group to client role 1 (beta env only). Flagged the
+  open root-cause: add the grant to the `Client/` baseline seed, and decide role breadth (1 vs 1,3,4)
+  for Quad/CC. (apeterson)
 - 2026-06-30 — Added `metaGroup()` (`GET /v2/surfaces/meta-group?slugs=a,b,c`): batched composition
   over the existing per-slug `resolve()` cache, capped at `META_GROUP_MAX_SLUGS=25`, unknown slug →
   empty bundle (chosen over a `parentSurfaceId` GROUP row post-CTO-review). Fixed latent

package/knowledge/2.0/apps/toga25-supply/features/client-configurable-fields.md

@@ -6,7 +6,7 @@ project: TOGa 2.5 Supply
 client: shared
 type: feature
 status: active
-updated: 2026-06-25
+updated: 2026-07-01
 owners: [apeterson]
 files:
   - toga25-supply/src/fieldsConfig/index.ts
@@ -64,6 +64,22 @@ and the `useClientFields()` hook.
   `yourKey: BY_CLIENT[clientSlug] ?? DEFAULT_*`. Avoids editing all ~13 role bundles.
   `DEFAULT_CLIENT_FIELDS` must also carry the new key (ultimate fallback).
 
+### De-roling a client×role bundle to client-only
+
+Some bundles were role-keyed (`{ADMIN, MANAGER}`) only for historical reasons — the roles held
+byte-identical config. Those are being flattened to **client-only** (part of the ongoing
+backend-driven / de-role goal). `orderViewFields` is now client-only: `COMPASS` and `COMPASSCANADA`
+read their flat client JSON via `mergeOrderView(<client>OrderViewFields)` in
+`src/fieldsConfig/index.ts` instead of reading `.ADMIN`/`.MANAGER` off the file, and
+`FIELDS/COMPASSCANADA/orderViewFields.json` was flattened from `{ADMIN, MANAGER}` to a flat object.
+
+When de-roling, watch the read path: `COMPASS`'s JSON was **already flat** but was still being read
+via `.ADMIN` → `undefined` → the client silently fell back to `DEFAULT` and lost its
+`salesOrderDetailsConfig` joins. This is the flat-bundle trap from the gotcha below — the fix is to
+read the bundle itself, not a role key. `approvalViewFields` and `salesOrdersPageFields` remain
+role-keyed (their ADMIN/MANAGER genuinely differ); fully de-roling those and removing `resolveRole`
+is a separate pending task.
+
 ### Hydration (non-serializable bits)
 
 Keep JSON **serializable** — strings, enums, arrays. No JSX, no functions, no Tailwind classes.
@@ -143,6 +159,12 @@ modal's chrome from the same per-client JSON, not from the component:
   `vendorItemRecordViewFields` are record-modal-layout examples living under `src/layout/.../viewModel/FIELDS/`.
 
 ## Change history
+- 2026-07-01 — De-roled `orderViewFields` from client×role to **client-only**: COMPASS/COMPASSCANADA
+  now read a flat client JSON via `mergeOrderView(...)` in `fieldsConfig/index.ts` (COMPASSCANADA's
+  JSON flattened from byte-identical `{ADMIN,MANAGER}`). Fixed a latent bug where COMPASS's
+  already-flat JSON was read via `.ADMIN` → `undefined` → silent fallback to DEFAULT (lost its
+  `salesOrderDetailsConfig` joins). `approvalViewFields`/`salesOrdersPageFields` stay role-keyed;
+  full de-role + `resolveRole` removal remains pending. Type-check clean. (apeterson)
 - 2026-06-25 — SalesOrder action buttons render by presentation intent: `kind` (icon/text/viewLog) picks the renderer, `variant` a closed color set, `valueKey` is pure click-dispatch; a `componentRegistry` keyed by `kind` hydrates dedicated components (e.g. ViewLogButton). Added the `recordActionFields`-shape gotcha (per-persona blocks + sibling `poNumber` sub-config; walk `actionOptions` only). (apeterson)
 - 2026-06-25 — Extended to record-modal layouts: per-mode `*ViewFields`/`*EditFields` JSON under `src/layout/.../viewModel/FIELDS/`, JSON-driven modal `header` (modalTag/labelTemplate/statusBadge) + `editItem` button gated via the Flag/Rule engine, and the flat-bundle defensive-default gotcha. (apeterson)
 - 2026-06-23 — Documented from the `add-client-fields` skill during initial knowledge seed. (apeterson)

package/knowledge/2.0/apps/worker2/INDEX.md

@@ -21,8 +21,9 @@
 | [Startech Webhook Handler (worker2)](features/startech-webhook-handler.md) | Receives inbound webhook events from Startech (Easeedesk) and creates or updates the corresponding ticket in TOGA 2.0. | worker2/Worker/Startech.php |
 | [Talos (TOGa IQ) Meeting-Notes Integration & Token Auto-Refresh (consumer)](features/talos-meeting-notes-integration.md) | How a **dev tool / agent consumes Talos (TOGa IQ)** to query the team meeting-notes corpus programmatically. | .claude/skills/plan-ticket/scripts/talos.js |
 | [Talos Pricing Automation (worker2 Cron — AWS Actuals, Calibration, Monthly Report)](features/talos-pricing-automation.md) | The worker2 half of the **Talos Pricing Platform** (see the talos `pricing-cogs-model` and tools `talos-pricing-ui` docs for the other halves). | worker2/Worker/Talos/Pricing.php, worker2/Database/TalosPricingCrons.sql |
+| [Talos Transcript Ingestion Pipeline (worker2 → AWS Bedrock KBs)](features/talos-transcript-ingestion.md) | `_Worker_Team_Transcripts` (in addition to the upstream `Export` action — see [Teams Meeting Transcript Export](./teams-transcript-export.md)) now runs a fully | worker2/Worker/Team/Transcripts.php, worker2/bin/reprocess-transcripts.php, worker2/Config/production.ini, dbchanges2/Team/2026-06-30a, dbchanges2/Team/2026-06-30b, dbchanges2/Team/2026-06-30c, dbchanges2/Team/2026-06-30d, dbchanges2/Team/2026-06-30e, dbchanges2/Core/2026-06-30a |
 | [Team Sprint Management & Reporting](features/team-sprint-management.md) | `_Worker_Team_Sprint` (file `Worker/Team/Sprint.php`) is the engine behind TOGA's internal **development-sprint process and reporting**. | worker2/Worker/Team/Sprint.php |
-| [Teams Meeting Transcript Export](features/teams-transcript-export.md) | `_Worker_Team_Transcripts` (action `Team/Transcripts/Export`) polls Microsoft Graph for Teams meeting transcripts produced by a set of organizers, classifies ea | worker2/Worker/Team/Transcripts.php, worker2/Config/production.ini, worker2/Database/TeamsTranscriptExports.sql, dbchanges2/Core/2026-06-18a - Teams Transcript Export schedule.sql |
+| [Teams Meeting Transcript Export](features/teams-transcript-export.md) | `_Worker_Team_Transcripts` (action `Team/Transcripts/Export`) polls Microsoft Graph for Teams meeting transcripts produced by a set of organizers and archives t | worker2/Worker/Team/Transcripts.php, worker2/Config/production.ini, worker2/Database/TeamsTranscriptExports.sql, dbchanges2/Core/2026-06-18a - Teams Transcript Export schedule.sql |
 | [VAPI Webhook Handler (worker2 — AI-BDR end-of-call processing)](features/vapi-webhook-handler.md) | `_Worker_Vapi` ([worker2/Worker/Vapi.php](worker2/Worker/Vapi.php)) is the **PHP side of the AI-BDR call loop** — the webhook that receives VAPI's end-of-call r | worker2/Worker/Vapi.php, worker2/Worker/Ai/Bdr/Vapi.php |
 | [WJE Freshservice Sync (worker2)](features/wje-freshservice-sync.md) | WJE ("WJE IT", helpdesk `wje.freshservice.com`) is a **Freshservice**-based help-desk client whose tickets, contacts, assets, groups, categories, and canned res | worker2/Worker/Wje.php, _underscore/Component/Api/Wje/Wje.php, _underscore/Model/Wje/Ticket.php, _underscore/Model/Wje/TicketNote.php, _underscore/Model/Wje/Contact.php, _underscore/Model/Wje/Unit.php, _underscore/Model/Wje/TicketTeam.php, _underscore/Model/Wje/TicketCategory.php, _underscore/Model/Wje/AssetType.php, _underscore/Model/Wje/PredefinedReply.php, library/app/api/wje.php, worker/crons/toga2/wje/import_supporting_records.php, worker/crons/toga2/wje/sync_togasupply_wje.php, worker/crons/notifications/reports/wje/wje_common.php, library/app/systemmonitor/wje.php, dbchanges2/Client_Wje/2024-10-04 - WjeOnboarding.sql |
 | [Ticket → ClickUp Pseudocode Planning (Talos-grounded)](workflows/ticket-to-pseudocode-planning.md) | A repeatable procedure for turning a ClickUp ticket into a reviewed, formatted implementation plan posted back to the ticket's `📝 Pseudocode` custom field. | test/@dave/clickup_md2delta.js |

package/knowledge/2.0/apps/worker2/features/talos-transcript-ingestion.md

@@ -0,0 +1,158 @@
+---
+title: Talos Transcript Ingestion Pipeline (worker2 → AWS Bedrock KBs)
+framework: "2.0"
+repo: worker2
+project: Worker
+client: shared
+type: feature
+status: active
+updated: 2026-06-30
+owners: [jcardinal]
+files:
+  - worker2/Worker/Team/Transcripts.php
+  - worker2/bin/reprocess-transcripts.php
+  - worker2/Config/production.ini
+  - dbchanges2/Team/2026-06-30a
+  - dbchanges2/Team/2026-06-30b
+  - dbchanges2/Team/2026-06-30c
+  - dbchanges2/Team/2026-06-30d
+  - dbchanges2/Team/2026-06-30e
+  - dbchanges2/Core/2026-06-30a
+related:
+  - ./teams-transcript-export.md
+  - ./creating-worker-actions.md
+  - ../architecture.md
+  - ../../../1.0/apps/tools/features/talos-kb-documents-admin.md
+  - ../../../1.0/apps/test/features/talos-kb-pipeline.md
+---
+
+## Summary
+
+`_Worker_Team_Transcripts` (in addition to the upstream `Export` action —
+see [Teams Meeting Transcript Export](./teams-transcript-export.md)) now runs a fully
+automated, cron-driven pipeline that ingests raw Teams transcripts into the **Talos / TOGa IQ**
+AWS Bedrock knowledge bases. It replaces the old **manual** two-page web tooling
+(`test/team/talos/kb_processor.php` + `kb_processor.ini` — see
+[Talos Knowledge Base Pipeline](../../../1.0/apps/test/features/talos-kb-pipeline.md)); the
+cleanup/classify/approve/archive/sync logic is a port of that script, but driven by cron jobs
+and by **DB-editable** config instead of an `.ini`.
+
+Flow: raw VTT at `s3://toga-private/transcripts/{date}/…` → `Scan` enqueues one `Process` job
+per unprocessed key → `Process` AI-cleans + AI-classifies → approved `.txt` + Bedrock metadata
+sidecar written to `s3://togaiq/development-team/{kb_slug}/approved/` → raw archived → Bedrock
+`startIngestionJob` on that KB's data source.
+
+## Key files / entry points
+
+- `Worker/Team/Transcripts.php` — actions `Scan`, `Process(string $sourceKey)`,
+  `SyncKb(string $kbSlug)` (all alongside the existing `Export`).
+- `bin/reprocess-transcripts.php` — standalone CLI backlog reprocessor.
+- `Config/production.ini` `[talos]` section — S3/Bedrock targets (see Configuration).
+- DB config + ledger tables in the `Team.*` schema (see Data model), authored in dbchanges2
+  under `Team/2026-06-30a..e` + `Core/2026-06-30a`.
+
+## How it works
+
+### `Scan` (cron)
+Lists unprocessed raw transcripts under the `toga-private` `transcripts/` prefix (skips any
+`sourceKey` already in the `Team.TranscriptProcessing` ledger) and enqueues one `Process` job
+each via `_Worker::runTask('Team/Transcripts/Process', ['sourceKey' => …])`. Scheduled by a
+`Core.CronJobs` row (weekday business hours).
+
+### `Process(string $sourceKey)`
+Port of `kb_processor`, per transcript:
+1. Fetch the raw VTT from S3 (`toga-private`, **us-west-2**).
+2. Call the TOGa IQ AI endpoint `https://api.togaiq.com/api/ai/generate`, model
+   `bedrock/us.anthropic.claude-haiku-4-5-20251001-v1:0`, with an **extended** `output_schema`
+   returning **both** `knowledge_doc` **and** `kb_slug` — the AI picks the single best active KB
+   from the supplied list, or `general`. The system prompt is **assembled at runtime** from DB
+   tables: a template body with `{{APPLICATIONS}}`/`{{CLIENTS}}`/`{{PEOPLE}}`/`{{BUSINESS_TERMS}}`/`{{EXAMPLES}}`
+   placeholders filled from `Team.TranscriptPromptTerms`.
+3. Apply DB-driven text replacements from `Team.TranscriptReplacements` (`:c` case-sensitive,
+   `:w` whole-word, `:cw`) via `preg_replace_callback` **so replacement backrefs stay literal**.
+4. Build the approved name `"{YYYY-MM-DD} - {Title Case}.txt"`.
+5. Upload to `s3://togaiq/development-team/{kb_slug}/approved/` (**us-east-1**) plus a
+   `{name}.txt.metadata.json` Bedrock sidecar.
+6. Archive the raw VTT to `…/{kb_slug}/archive/{date}/`, then delete the source.
+7. AWS Bedrock `startIngestionJob` on that KB's data source (retry 5×30s on
+   `ConflictException` / throttling). **If `kb_slug === 'general'`, sync ALL active KBs.**
+
+Idempotency + status are tracked in `Team.TranscriptProcessing`
+(`pending/cleaned/uploaded/archived/synced/failed`).
+
+### `SyncKb(string $kbSlug)`
+On-demand single-KB re-sync (used by the Tools delete flow — see
+[Talos KB Documents Admin](../../../1.0/apps/tools/features/talos-kb-documents-admin.md)).
+
+### `bin/reprocess-transcripts.php` (CLI backlog reprocessor)
+Standalone CLI that bootstraps `_underscore`, lists existing raw transcripts under the
+`toga-private` `transcripts/` prefix, and runs each through `Process()`. Flags
+`--prefix` / `--limit` / `--dry-run`. Tolerates **both** the old `{slug}/{date}/` layout and the
+new `{date}/` layout. Requires the `ENVIRONMENT` env var, e.g.
+`ENVIRONMENT=production php bin/reprocess-transcripts.php --dry-run`.
+
+### Graph download hardening
+The Graph transcript download is hardened against SSRF / token leak: `https`-only, a
+`*.microsoft.com` host allowlist, and `FOLLOWLOCATION` off.
+
+## Data model (`Team.*` schema, DB alias core cluster)
+
+Authored in dbchanges2 (`Team/2026-06-30a..e`, `Core/2026-06-30a`, all dated 2026-06-30). All
+PKs `INT UNSIGNED` to match the existing Talos Team-table family.
+
+- **`Team.TranscriptReplacements`** — `pattern, replacement, isCaseSensitive, isWholeWord, isActive`.
+  Seeded ~109 rules from the old `.ini`.
+- **`Team.TranscriptPromptTerms`** — `category` ENUM (`application/client/person/businessTerm/example`),
+  `term, isActive, dtCreated, dtUpdated`. Seeded from the `.ini` CORRECTIONS lists. PEOPLE are
+  stored as full "First Last" names (only 2 confidently paired; the rest seeded as individual
+  tokens, intended to be reconciled via the Tools vocabulary UI).
+- **`Team.TranscriptPromptTemplate`** — `name, bodyText` (w/ placeholders), `instruction, model,
+  temperature, maxTokens, timeoutSeconds, isActive`. One active row seeded from the `.ini` system prompt.
+- **`Team.KnowledgeBases`** — `slug, name, isGeneral, bedrockKbId, isActive`. Seeded `general` +
+  `office-depot`. NOTE: the Tools browse UI derives the **live** KB list from S3 folders, not this table.
+- **`Team.TranscriptProcessing`** — `sourceKey UNIQUE(255), kbSlug, approvedKey, archiveKey,
+  status` ENUM (`pending/cleaned/uploaded/archived/synced/failed`), `aiModel, failureReason,
+  dtProcessed`. Pipeline ledger + idempotency.
+- **`Core.CronJobs`** INSERT for action `Team/Transcripts/Scan` (weekday business hours);
+  includes `dtCreated = NOW()` since the column has no default, and depends on the
+  `maxExecutionTime` column migration.
+
+## Configuration
+
+`worker2/Config/production.ini` `[talos]`: `s3_bucket=togaiq`, `s3_region=us-east-1`,
+`bedrock_region=us-east-1`, `kb_prefix=development-team-`, `s3_root_path=development-team/`.
+
+## Gotchas / known issues
+
+- **Cross-region S3.** The raw bucket `toga-private` is **us-west-2** while `togaiq` is
+  **us-east-1**. `Process()` uses two S3 clients; the archive step is a **cross-region copy**.
+- **`[talos]` keys were added to `production.ini` only** — the beta/development configs still
+  need them before the pipeline runs in those environments.
+- **`general` KB fans out.** A `Process()` classified as `general` (or a `general` sync) triggers
+  a sync of **all** active KBs, not one.
+- **Replacements must use `preg_replace_callback`** so replacement text with `$`/`\` backrefs is
+  treated literally (a plain `preg_replace` would interpret them).
+- **worker2 had no prior CLI precedent** — the backlog reprocessor bootstraps by
+  `chdir($projectRoot)` then `require vendor/autoload.php` + `_underscore.php`, and requires the
+  `ENVIRONMENT` env var.
+- **Deploy TODOs left in code:** verify the live Bedrock KB region and data-source name against
+  the actual account before first prod run.
+- **Pre-existing plaintext secrets** in `worker2/Config/production.ini` and the reference
+  `kb_processor.ini` (AWS / aegra) should be rotated — not introduced by this work; no new secret
+  literals were added to any new file or migration.
+
+## Change history
+
+- 2026-06-30 — Built the automated cron-driven ingestion pipeline (`Scan`/`Process`/`SyncKb`) +
+  the `bin/reprocess-transcripts.php` backlog CLI, porting the manual `kb_processor.php`. Added
+  the `Team.*` config/ledger schema (DB-editable replacements, prompt terms, prompt template, KB
+  list, processing ledger) and the `Scan` cron. Classification moved from title-based to AI (single
+  best KB, or `general`). Config vocabulary/replacements are now DB-driven and editable via the
+  Tools UI. (jcardinal)
+
+## Related docs
+
+- [Teams Meeting Transcript Export](./teams-transcript-export.md) — the upstream S3 producer.
+- [Talos KB Documents Admin](../../../1.0/apps/tools/features/talos-kb-documents-admin.md) — the Tools UI.
+- [Talos Knowledge Base Pipeline](../../../1.0/apps/test/features/talos-kb-pipeline.md) — the manual script this ports.
+- [Creating Worker Actions](./creating-worker-actions.md)

package/knowledge/2.0/apps/worker2/features/teams-transcript-export.md

@@ -6,8 +6,8 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-06-18
-owners: ["ajean"]
+updated: 2026-06-30
+owners: ["ajean", "jcardinal"]
 files:
   - worker2/Worker/Team/Transcripts.php
   - worker2/Config/production.ini
@@ -16,13 +16,18 @@ files:
 related:
   - ../architecture.md
   - ./creating-worker-actions.md
+  - ./talos-transcript-ingestion.md
 ---
 
 ## Summary
 
 `_Worker_Team_Transcripts` (action `Team/Transcripts/Export`) polls Microsoft Graph for
-Teams meeting transcripts produced by a set of organizers, classifies each meeting by
-client (from the meeting title), and archives the raw WebVTT to S3. Scheduled via a single
+Teams meeting transcripts produced by a set of organizers and archives the raw WebVTT to S3.
+As of 2026-06-30 it **no longer classifies by client**: raw transcripts land **flat** at
+`s3://toga-private/transcripts/{YYYY-MM-DD}/{HHMM}_{title-slug}_{shortId}.vtt` (no client
+folder). Classification now happens later, by AI, in the downstream ingestion pipeline — see
+[Talos Transcript Ingestion](./talos-transcript-ingestion.md), which is the consumer of this
+S3 output. Scheduled via a single
 `Core.CronJobs` row firing weekdays at 9:30 / 11:30 / 13:30 / 14:30 / 15:30 / 16:30 / 17:30
 Central (`30 9,11,13,14,15,16,17 * * 1-5`).
 
@@ -69,11 +74,15 @@ date. `createdDateTime` is stamped minutes after the actual occurrence, so it da
 correctly. `getMeeting()` is therefore used only for the subject. `dtExported` uses
 `UTC_TIMESTAMP()` (not `NOW()`) so all three timestamps are UTC.
 
-**Classification:** case-insensitive substring match of the meeting title against active
-`Core.Clients` names + `[teamsClientAliases]`, longest needle wins, min length 3. No match → `general`.
+**Classification: REMOVED (2026-06-30).** The old title-based classification (substring match
+against `Core.Clients` + `[teamsClientAliases]`) was inaccurate and has been deleted
+(`classify()`, `buildClientIndex()`, `loadClientNames()`, `loadClientAliases()`, along with the
+old `Backfill()`/`moveObject()`). Classification is now done by the AI in the downstream
+ingestion `Process()` step, which picks the single best knowledge base (or `general`).
 
-**S3 layout:** `s3://{[teams] s3_bucket}/{s3_prefix}{client-or-general}/{YYYY-MM-DD}/{HHMM}_{title-slug}_{shortId}.vtt`
-(date/time in Central). Currently `toga-private/transcripts/…`.
+**S3 layout (current):** `s3://toga-private/transcripts/{YYYY-MM-DD}/{HHMM}_{title-slug}_{shortId}.vtt`
+— **flat, no client/general folder** (date/time in Central). The old
+`…/{client-or-general}/{date}/…` layout is history; the downstream reprocessor CLI tolerates both.
 
 ## Data model
 
@@ -162,6 +171,12 @@ Policy gap; a `400` only on a UPN means the id was never resolved to a GUID. (A
 
 ## Change history
 
+- 2026-06-30 — **Removed title-based client classification and the client-folder S3 layout.**
+  Raw transcripts now land flat at `transcripts/{date}/…` with no client subfolder; deleted
+  `classify()`/`buildClientIndex()`/`loadClientNames()`/`loadClientAliases()` and the old
+  `Backfill()`/`moveObject()`. Classification moved downstream to the AI in the new
+  [Talos Transcript Ingestion](./talos-transcript-ingestion.md) pipeline, which is now the
+  consumer of this S3 output. (jcardinal)
 - 2026-06-18 — Fixed recurring-meeting date misfiling: archive date + `dtMeeting` now come from
   the transcript `createdDateTime`, not the series-anchor `meeting->startDateTime` (worker2 PR
   #82, merged + deployed). Added `Backfill()` and ran it in prod (61/66 objects re-filed, 0

package/knowledge/INDEX.md

@@ -12,12 +12,12 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **walmarttechservices** (Walmart Tech Services) — 1 doc(s) → [1.0/apps/walmarttechservices/INDEX.md](1.0/apps/walmarttechservices/INDEX.md)
 - **test** (Test) — 12 doc(s) → [1.0/apps/test/INDEX.md](1.0/apps/test/INDEX.md)
 - **toga** (TOGa) — 2 doc(s) → [1.0/apps/toga/INDEX.md](1.0/apps/toga/INDEX.md)
-- **tools** (Tools) — 7 doc(s) → [1.0/apps/tools/INDEX.md](1.0/apps/tools/INDEX.md)
+- **tools** (Tools) — 8 doc(s) → [1.0/apps/tools/INDEX.md](1.0/apps/tools/INDEX.md)
 
 ## 2.0 framework
 
 - **_underscore** (_Underscore) _(framework core)_ — 21 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
-- **worker2** (Worker) — 24 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
+- **worker2** (Worker) — 25 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
 - **api2** (API) — 7 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
 - **dbchanges2** (Database Changes) _(framework core)_ — 3 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)
 - **toga2-supply** (TOGa Supply) — 3 doc(s) → [2.0/apps/toga2-supply/INDEX.md](2.0/apps/toga2-supply/INDEX.md)

package/knowledge/clients/compass-canada/profile.md

@@ -15,12 +15,13 @@ client: compass-canada
 type: profile
 status: active
 updated: 2026-06-30
-owners: [jcardinal, bala, tcox]
+owners: [jcardinal, bala, tcox, apeterson]
 files: []
 related:
   - ../compass-usa/profile.md
   - ../../2.0/apps/toga2-commerce/features/expedited-shipping-gating.md
   - ../../2.0/apps/_underscore/features/item-fulfillment-stage-lifecycle-and-order-status.md
+  - ../../2.0/apps/_underscore/features/surface-resolver.md
 ---
 
 ## Summary
@@ -50,6 +51,12 @@ to but distinct from Compass USA. Like Compass USA it spans the **2.0** commerce
   see [Config-Driven Expedited Shipping Gating](../../2.0/apps/toga2-commerce/features/expedited-shipping-gating.md).
 
 ## Notes
+- **Surface layer (beta):** like Quad, `Client_CompassCanada` had **no** `AclRecordScripts` dispatch
+  grant for the surfaces `meta-group` script (only `meta`, to client role 1) → `GET /v2/surfaces/meta-group`
+  403'd EZ-1 while `meta` worked. Fixed 2026-07-01 via
+  `dbchanges2/Client_CompassCanada/2026-07-01a - GrantSurfacesMetaGroupScriptAcl.sql` (meta-group →
+  client role 1, id-agnostic + NOT-EXISTS-guarded, beta only). Exposes surfaces to role 1 only, vs
+  Compass USA's 1/3/4. See [Surface Resolver](../../2.0/apps/_underscore/features/surface-resolver.md).
 - Customer language preference: `UserGlobalSettings.settingId = 2` (`en` / `fr-CA`); customer-
   facing emails are sent in EN or FR accordingly.
 - Assortment (product-grouping) names are served in fr-CA via the `AssortmentTranslations` sidecar

package/knowledge/clients/quad/profile.md

@@ -14,11 +14,12 @@ client: quad
 type: profile
 status: active
 updated: 2026-06-30
-owners: ["jcardinal", "bala"]
+owners: ["jcardinal", "bala", "apeterson"]
 files: []
 related:
   - ../../2.0/apps/_underscore/features/tracking-number-bridges.md
   - ../../2.0/apps/_underscore/features/item-fulfillment-stage-lifecycle-and-order-status.md
+  - ../../2.0/apps/_underscore/features/surface-resolver.md
 ---
 
 ## Summary
@@ -48,6 +49,13 @@ Client-specific DB change-sets live in `dbchanges2/Client_Quad/`.
   (`_underscore/Model/Quad/SalesOrder.php`): non-SA orders use the inline machine, `SA%` orders
   delegate to the base `_Model_Client_SalesOrder`. Contrast Compass, which is shipped-only. See
   [IF stage lifecycle & order status](../../2.0/apps/_underscore/features/item-fulfillment-stage-lifecycle-and-order-status.md).
+- **Surface layer (beta):** the surfaces `meta-group` script had **no** `AclRecordScripts` dispatch
+  grant for `Client_Quad` (only `meta` was granted, to client role 1), so `GET /v2/surfaces/meta-group`
+  403'd (EZ-1) while `meta` worked. Fixed 2026-07-01 via
+  `dbchanges2/Client_Quad/2026-07-01a - GrantSurfacesMetaGroupScriptAcl.sql` (grants meta-group to
+  client role 1, id-agnostic + NOT-EXISTS-guarded, beta only). Quad exposes surfaces to role 1 only,
+  vs Compass's 1/3/4 — revisit if broader roles are needed. See
+  [Surface Resolver](../../2.0/apps/_underscore/features/surface-resolver.md).
 - Tracking data: record 318 (item-level) is currently empty for this client; their tracking
   populates the IF/shipment level (record 317, ~98% coverage) and unit level (record 319). The
   rebuilt views use 318 (per the Compass pattern) and will show tracking once item-level

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.259",
+  "version": "1.0.261",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",