toga-ai 1.0.462 → 1.0.463

package/knowledge/2.0/apps/api2/INDEX.md

@@ -18,5 +18,5 @@
 | [TableView field/column metadata (TableViewFields, hidden projected columns)](features/tableview-field-metadata.md) | The columns of a 2.0 table view are defined by DB metadata, not code. | _underscore/Model/Client/TableView.php, api2/Component/Api/V2/V2.php, dbchanges2/Client/2026-07-20 - ItemsUuidForPurchaseOrderItemsTableView.sql |
 | [Tickets API (/v2/tickets)](features/tickets-api.md) | The generic ticket endpoint of the 2.0 REST API. | Component/Api/V2/V2.php |
 | [V2 API error/message codes (EV/EZ troubleshooting map)](features/v2-api-error-codes.md) | The V2 JSON engine (`Component/Api/V2/V2.php`) returns short **message codes** in the response `error` field, grouped by family: `EN-*` authentication, `EZ-*` a | api2/Component/Api/V2/V2.php, _underscore/Model/Client/TrackingNumber.php |
-| [AWS CodePipeline Deployment via CodeConnections (GitHub → Elastic Beanstalk)](workflows/codepipeline-codeconnections-deploy.md) | 2.0 apps (`api2`, `_underscore`) are deployed through **AWS CodePipeline**. |  |
+| [AWS CodePipeline Deployment via CodeConnections (GitHub → Elastic Beanstalk)](workflows/codepipeline-codeconnections-deploy.md) | 2.0 apps (`api2`, `_underscore`) are deployed through **AWS CodePipeline**. | api2/.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh, api2/ebs/register_instance_to_shared_application_load_balancer.php |
 | [New Environment Configuration & Provisioning (api2)](workflows/environment-configuration-and-provisioning.md) | What it takes for a 2.0 API environment (e.g. | api2/Config/<environment>.ini, api2/Controller/Index.php, dbchanges2/Core/2026-06-16a - DatabaseHosts for new QA QC stage demo environments.sql, dbchanges2/Logs/, _underscore/Route.php |

package/knowledge/2.0/apps/api2/architecture.md

@@ -163,6 +163,13 @@ region-aware DB host selection; CloudWatch agent ships the JSONL log file;
 `long_gateway_timeout.conf` sets `ProxyTimeout 1800`/`Timeout 1800` — **the fix for the
 "exactly 60 second" 504** (EB Apache→PHP-FPM defaults to 60s); `enforce_https.conf`.
 
+`.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh` +
+`ebs/register_instance_to_shared_application_load_balancer.php` register a **non-production**
+instance into the ALB target group whose name equals the EB environment name (production skipped;
+always exits 0). See
+[the worker2 reference implementation](../worker2/features/alb-target-group-auto-registration.md) —
+api2's copy is the **unhardened original** and must be brought up to it.
+
 ## CI — commit message policy
 
 `.github/workflows/true-devteam-requirements.yml` enforces **`TRUE-{ticket}: {Subject}`** —
@@ -180,6 +187,18 @@ build. These must be **rotated** (treat the committed tokens as compromised) and
 Parameter Store / EB env properties. **Flag this if you touch config or deploy.** (Location +
 remediation only — do not record the token value anywhere.)
 
+**Committed IAM access key (found 2026-07-28).** An IAM access key id + secret access key are
+hardcoded as PHP constants in `ebs/register_instance_to_shared_application_load_balancer.php`
+(**lines 29–30**) and are in **committed git history** (`git log -S`; commit subject
+*"Auto-registering to target groups"*) — exposed to every reader of the repo, every clone, and every
+EB bundle. **Remediation:** deactivate + delete the key in IAM, audit CloudTrail for its use, and
+replace the block with the instance-profile pattern worker2 now uses. **Rotation, not history
+rewrite, closes the exposure**; a history rewrite is a separate sign-off-required decision because
+the team git rule forbids force-pushing `_main` in application repos. The same file also passes the
+IMDSv2 token on the `curl` command line (visible in `ps`/`/proc/<pid>/cmdline`, 6h TTL) and falls
+back silently to IMDSv1 — fix both alongside the key. *(Location + remediation only; no key material
+is recorded anywhere.)*
+
 ## Known issues / accepted risks
 
 Open items a maintainer should know before changing this tier. None are "bugs to fix right now" —
@@ -213,6 +232,13 @@ they are the known sharp edges. Do not re-discover these from scratch.
 8. **JWT signing-secret rotation accepts current + previous.** During the overlap window a token
    signed with the retired secret still validates. Revocation is therefore not immediate —
    don't rely on rotation alone to lock out a compromised token.
+9. **Committed IAM access key in the ALB-registration script, not yet rotated (found 2026-07-28).**
+   `ebs/register_instance_to_shared_application_load_balancer.php` lines 29–30, present in committed
+   git history. Treat as compromised: deactivate + delete the key, audit CloudTrail, and move to the
+   EC2 instance profile as
+   [worker2 does](../worker2/features/alb-target-group-auto-registration.md). The same script's
+   IMDSv2 handling (token on the `curl` command line, silent IMDSv1 fallback) must be fixed with it.
+   See the Security note above.
 
 ## When making changes here
 
@@ -230,6 +256,7 @@ they are the known sharp edges. Do not re-discover these from scratch.
   or `execute()`.
 
 ## Change history
+- 2026-07-28 — Documented the previously unrecorded `060_register_instance_to_shared_application_load_balancer` postdeploy hook pair in the Deployment section (non-prod self-registration into the same-named ALB target group; production skipped), and recorded a **committed IAM access key** in `ebs/register_instance_to_shared_application_load_balancer.php` as a security note + Known issue #9 — location, line range, commit subject, and remediation only (rotate, audit CloudTrail, move to the instance profile; history rewrite is a separate sign-off). Flagged api2's copy as the unhardened original vs. the new worker2 reference implementation. (jcardinal)
 - 2026-07-28 — Added a consolidated **Known issues / accepted risks** section (8 items), absorbing the previously free-floating deferred raw-exception-disclosure follow-up as item 1, so the tier's sharp edges (unrotated committed secrets, pre-execute phase still outside the main guard, local Logs DB name mismatch, permissive CORS, unpinned `_underscore` build clone, untested `V2.php` monolith, JWT rotation overlap window) are in one place instead of scattered. Recorded that `DB_CACHE` is resolved by name (`Databases.name = 'Cache'`), never by a hardcoded id, which differs per Core instance. (jcardinal)
 - 2026-07-28 — Added gotcha: the request-logger's auto-generated `Api.transactionId` (millisecond timestamp `Y-m-d H:i:s.v`, UNIQUE) collides under concurrent same-millisecond nested writes → MySQL 1062 → HTTP 500; platform-wide, observed on the Compass/Veyer ASN feed (`sourceIp 34.232.23.158`). Distinct from the client-supplied `transactionId`/EV-5 uniqueness contract. Fix direction: uuid the logged id or retry-on-1062. (bala)
 - 2026-07-27 — Sharpened the committed-secret note: the plaintext GitHub PAT lives in the per-env **`.ebextensions/git.*.json`** files (used by the `prebuild/git.sh` clone hook to pull `_underscore`), must be rotated and moved to SSM / EB env properties (location + remediation only, no value). (mhammontree)

package/knowledge/2.0/apps/api2/workflows/codepipeline-codeconnections-deploy.md

@@ -6,9 +6,11 @@ project: API
 client: shared
 type: workflow
 status: active
-updated: 2026-07-27
+updated: 2026-07-28
 owners: ["jcardinal", "mhammontree"]
-files: []
+files:
+  - api2/.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh
+  - api2/ebs/register_instance_to_shared_application_load_balancer.php
 related: []
 ---
 
@@ -106,6 +108,15 @@ debugging the code. (Seen 2026-06-18 chasing a "missing FPDF / old code still ru
 beta that was really the LB still pointing at a terminated instance's replacement that was never
 registered.)
 
+**Automated for non-production tiers that carry the `060` hook.** `api2` and (as of 2026-07-28)
+`worker2` ship a postdeploy hook pair that makes a **non-production** instance register *itself*
+into the target group whose name equals the EB environment name — so on those tiers the manual
+step above is only needed if the hook is absent, misnamed, or silently failed (it always exits 0).
+Production is deliberately skipped and still registers by the existing process. See
+[deploy-time auto-registration to the shared ALB target group](../../worker2/features/alb-target-group-auto-registration.md),
+which is also the reference implementation — **api2's copy has known security defects**, including
+a committed IAM access key.
+
 ### On-instance composer install (when a dep is missing post-deploy)
 If a Composer dep is missing on the running instance (e.g. `Class "FPDF" not found` because
 `composer.lock` wasn't committed), you can install it on the box over SSH/PuTTY — but
@@ -128,6 +139,7 @@ aws codeconnections get-connection --connection-arn "<CONN_ARN>" --region "$REGI
 ```
 
 ## Change history
+- 2026-07-28 — Manual LB re-registration is now automated on **non-production** tiers carrying the `.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh` hook pair (api2 already had it; ported to worker2 this session). Linked the new worker2 feature doc as the reference implementation and flagged that api2's copy has known security defects. (jcardinal)
 - 2026-07-27 — Noted that not every EB env pulls `_underscore` from its `_<env>` branch: **`API-Sandbox-Dev`** re-clones `_underscore` from the branch in `.ebextensions/git.sandbox-dev.json` (**`_sandbox-dev`**), overwriting the pipeline copy — so a `_beta` merge doesn't reach it. Added the `Logs_<Client>.Api` server-side request-log note as the reliable way to debug a beta env without Sentry (TRUE-79533). (mhammontree)
 - 2026-07-14 — Documented the branch model: app repos (`_underscore`/`api2`/`toga2-supply`) deploy from long-lived `_beta`/`_production` branches (not `_main`); api2 pulls `_underscore`'s `_<env>` branch at EB build; `dbchanges2` has only `_main` and its migrations are applied per-env by the team process (not by a code deploy). (mhammontree)
 - 2026-06-18 — Added two EB-instance gotchas surfaced during the TOGa Supply beta/prod label deploys: (1) terminated instances must be **manually re-registered** as LB targets (we don't pay for auto-registration) — until then the new code never serves traffic and looks like deploy-lag; (2) on-instance `composer require` stopgap syntax (no space after the colon, fix root cause by committing `composer.lock`). (mhammontree)

package/knowledge/2.0/apps/worker2/INDEX.md

@@ -3,6 +3,7 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [Worker (worker2) Architecture](architecture.md) | Worker (repo `worker2`) is an AWS Elastic Beanstalk **Worker Tier** application that processes background jobs. | worker2/Controller/Index.php, worker2/Worker/, worker2/LambdaFunctions/, _underscore/Worker.php |
+| [Deploy-Time Auto-Registration to the Shared ALB Target Group (non-production)](features/alb-target-group-auto-registration.md) | TOGA does **not** pay for EB-managed load-balancer registration, so an EB instance is normally **not** added to its environment's ALB target group — a fresh or | worker2/.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh, worker2/ebs/register_instance_to_shared_application_load_balancer.php, worker2/.platform/hooks/prebuild/_shared/040-write-instance-id.sh, worker2/.platform/hooks/prebuild/_shared/041-write-region.sh, worker2/.platform/hooks/postdeploy/015_install_composer.sh, api2/.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh, api2/ebs/register_instance_to_shared_application_load_balancer.php |
 | [Automated PR Merger — Concurrent Force-Push Clobber Race](features/automated-pr-merger-force-push-race.md) | The automated PR merger `_Worker_Team_GitHub::Merge` (`worker2` `Worker/Team/Github.php`) merges approved PRs to `_production` by **force-pushing from a clone t | Worker/Team/Github.php |
 | [ClickUp Connectivity Watchdog](features/clickup-connectivity-watchdog.md) | A cron watchdog that emails when the ClickUp integration looks disconnected during business hours. | worker2/Worker/Clickup/Health.php, worker2/Database/ClickupHealthWatchdog.sql |
 | [ClickUp Design Sprint Automation (Final Design Outcome)](features/clickup-design-sprint-automation.md) | `_Worker_Clickup_Design` is meant to drive the design-sprint workflow in ClickUp via the API, replacing a set of native ClickUp automations. | worker2/Worker/Clickup/Design.php, worker2/Worker/Clickup.php, worker2/Controller/ClickupDesignTest.php, _underscore/Component/Api/Clickup/Clickup.php |

package/knowledge/2.0/apps/worker2/architecture.md

@@ -15,6 +15,7 @@ files:
   - _underscore/Worker.php
 related:
   - ./features/creating-worker-actions.md
+  - ./features/alb-target-group-auto-registration.md
   - ../_underscore/features/async-query-execution.md
 ---
 
@@ -31,6 +32,18 @@ processes background jobs. It's a `_underscore` 2.0 app (`index.php` is just
 **MySQL is the source of truth; SQS is delivery only.** All job state lives in
 `Core.WorkerJobs`. Every worker invocation reads from that table and writes its result back.
 
+**Production vs. non-production inbound differ.** The SQS/Lambda job pipeline above describes
+**production**. **Non-production worker2 environments do not incorporate SQS at all** — they exist
+for **manual invocation over HTTP** (hence `index.php` dispatch and `.platform/httpd/conf.d/`, and
+no `cron.yaml`). That is precisely why non-prod instances must be reachable through the shared ALB;
+see [deploy-time auto-registration to the shared ALB target group](./features/alb-target-group-auto-registration.md).
+SQS may be added to non-prod later, but is not planned. **Do not assume a non-prod worker2 job ever
+passes through SQS** — a queue-based reproduction of a prod issue will not work there.
+
+**Associated open risk:** because non-prod is HTTP-invoked and now ALB-reachable, the shared-ALB
+listener rules and security groups must restrict non-prod to internal/VPN sources, and the
+HTTP-triggered job endpoints must enforce auth.
+
 ## AWS infrastructure
 
 | Component | Notes |
@@ -260,6 +273,11 @@ the MySQL-first design was departed from **on purpose** here.
 
 ## Change history
 
+- 2026-07-28 — Corrected the inbound model: **non-production** worker2 environments are not
+  SQS-driven at all; they are manually invoked over HTTP (no `cron.yaml`; `index.php` +
+  `.platform/httpd/conf.d/`), which is why they must be reachable through the shared ALB.
+  Production remains SQS-driven. Recorded the resulting non-prod exposure risk (listener/SG
+  restriction + endpoint auth). (jcardinal)
 - 2026-07-28 — Added **Cron actions must return a result on BOTH paths**: a new cron action is
   expected to return a structured result for a success as well as a failure, because both are
   recorded against the job and the successful results are what auditing reads (a completed run that

package/knowledge/2.0/apps/worker2/features/alb-target-group-auto-registration.md

@@ -0,0 +1,162 @@
+---
+title: Deploy-Time Auto-Registration to the Shared ALB Target Group (non-production)
+framework: "2.0"
+repo: worker2
+project: Worker
+client: shared
+type: feature
+status: active
+updated: 2026-07-28
+owners: [jcardinal]
+files:
+  - worker2/.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh
+  - worker2/ebs/register_instance_to_shared_application_load_balancer.php
+  - worker2/.platform/hooks/prebuild/_shared/040-write-instance-id.sh
+  - worker2/.platform/hooks/prebuild/_shared/041-write-region.sh
+  - worker2/.platform/hooks/postdeploy/015_install_composer.sh
+  - api2/.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh
+  - api2/ebs/register_instance_to_shared_application_load_balancer.php
+related:
+  - ../architecture.md
+  - ../../api2/workflows/codepipeline-codeconnections-deploy.md
+  - ../../api2/architecture.md
+---
+
+## Summary
+
+TOGA does **not** pay for EB-managed load-balancer registration, so an EB instance is normally
+**not** added to its environment's ALB target group — a fresh or replacement instance serves no
+traffic until someone registers it by hand (see the manual-registration gotcha in the
+[api2 deploy workflow](../../api2/workflows/codepipeline-codeconnections-deploy.md)). This hook
+pair automates that step for **non-production** environments: on every deploy the instance
+registers **itself** into the target group whose **name exactly equals the EB environment name**.
+
+Originally built in `api2`; ported to `worker2` on 2026-07-28 with three security hardenings
+(instance-profile credentials, native-PHP IMDSv2, fail-closed token handling). **`worker2` is now
+the reference implementation — `api2`'s copy has known defects, see below.**
+
+Non-prod `worker2` environments need this because they are reached **over HTTP for manual job
+invocation**, not through SQS.
+
+## How it works
+
+1. **`.platform/hooks/postdeploy/060_register_instance_to_shared_application_load_balancer.sh`**
+   - Reads `get-config environment -k ENVIRONMENT`; if it is `production`, **skips** entirely.
+     Production instances are registered by the existing production process, not by this hook.
+   - Otherwise invokes `ebs/register_instance_to_shared_application_load_balancer.php`.
+   - **Always `exit 0`.** A registration failure must never brick a deploy.
+2. **`ebs/register_instance_to_shared_application_load_balancer.php`**
+   - Reads the instance id and region from
+     `/var/app/current/storage/instance-id.txt` and `storage/region.txt` (written earlier by the
+     `_shared/040-write-instance-id.sh` / `041-write-region.sh` prebuild hooks), falling back to a
+     direct **IMDSv2** lookup.
+   - Reads the EB environment name via `get-config container -k environment_name`.
+   - Uses the AWS SDK (`aws/aws-sdk-php`) ELBv2 client to `DescribeTargetGroups` and selects the
+     target group whose **`TargetGroupName` is an exact string match** for the environment name —
+     this naming equality *is* the wiring convention; there is no tag or config lookup.
+   - Calls `RegisterTargets` with this instance id.
+
+### Hook ordering is load-bearing — why `060`
+
+`060` sorts **after** everything it depends on:
+
+| Hook | Provides |
+|---|---|
+| `prebuild/_shared/040-write-instance-id.sh` | `storage/instance-id.txt` |
+| `prebuild/_shared/041-write-region.sh` | `storage/region.txt` |
+| `postdeploy/015_install_composer.sh` | `vendor/` (the AWS SDK) |
+
+Renumber it below `015` and the SDK autoloader does not exist yet.
+
+### Porting prerequisites (all already satisfied in worker2)
+
+The port needed **no adaptation** because `worker2` already had: `aws/aws-sdk-php` in
+`composer.json`; **byte-identical** `_shared/040-write-instance-id.sh` and `041-write-region.sh`;
+an identical `015_install_composer.sh`; and the same `get-config environment -k ENVIRONMENT`
+convention already used by `.ebextensions/git.php`. Check these four before porting the pair to
+any other 2.0 tier.
+
+## Credentials — instance profile only (decision, 2026-07-28)
+
+**Deploy-time AWS credentials come from the EC2 instance profile. Never from source, never from
+EB environment properties.** The `worker2` version passes **no `credentials`** to the SDK client
+so the default provider chain resolves the instance profile.
+
+**Why EB environment properties were rejected as a fallback:** they are not a secret store. They
+are returned by `elasticbeanstalk:DescribeConfigurationSettings`, displayed in plaintext in the EB
+console and `eb config`, and exported into the process environment — so any `var_dump($_ENV)`,
+`phpinfo()`, or debug handler leaks them. If a static key is ever genuinely unavoidable, fetch it
+at runtime from **SSM Parameter Store SecureString** or Secrets Manager.
+
+### Required IAM on the EB EC2 instance profile — exactly two actions
+
+- **`elasticloadbalancing:DescribeTargetGroups`** — `Resource: "*"` is unavoidable (ELBv2
+  `Describe*` has no resource-level permissions). Constrain it with a condition on
+  `aws:RequestedRegion`.
+- **`elasticloadbalancing:RegisterTargets`** — scope to the **non-production target-group ARN
+  pattern**.
+
+> **Do not use `targetgroup/*/*`.** On a *shared* ALB that lets any instance carrying this profile
+> insert any instance into any target group — a traffic-hijack primitive.
+
+Do **not** grant `DeregisterTargets`, any `Modify*`, or `elasticloadbalancing:*`.
+
+## IMDSv2 must not be fetched by shelling out to `curl`
+
+Passing the IMDSv2 session token as a **`curl` command-line argument** exposes it in
+`/proc/<pid>/cmdline` and in `ps` output to every other process on the instance. The `worker2`
+implementation instead:
+
+- uses a **native PHP stream context** (`stream_context_create` + `file_get_contents`) so the
+  token never enters `argv`;
+- sets the token TTL to **60s instead of 21600s (6h)** — this is a one-shot, sub-second fetch;
+- **fails closed**: if no token can be obtained it aborts, rather than falling back to an
+  unauthenticated IMDSv1 request (a silent downgrade on any instance with `HttpTokens=optional`).
+
+## Gotchas
+
+- **Production is skipped by design.** Adding a prod environment to this hook is a separate
+  decision, not a config tweak.
+- **Naming equality is the contract.** If the target group is not named *exactly* the EB
+  environment name, the hook silently registers nothing (and still exits 0). Check the target
+  group name first when a non-prod env is unreachable after a deploy.
+- **Exit 0 hides failures.** Registration problems will not show in deploy status — read
+  `/var/log/eb-hooks.log` on the instance.
+- **The hook turns on reachability; it does not secure it.** The target group and listener already
+  exist by convention, but because this hook is what actually puts non-prod instances behind the
+  shared ALB, the **listener rules and security groups must restrict non-prod to internal/VPN
+  sources**, and the HTTP-triggered job endpoints must enforce authentication. Open risk, tracked
+  here deliberately.
+
+## api2 divergence — three defects to fix (do not copy the api2 original)
+
+`api2` carries the same hook pair under the same two filenames. Its version predates the
+hardening above and has:
+
+1. **Committed IAM access key — security incident (2026-07-28).** An IAM access key id and secret
+   access key are hardcoded as PHP constants in
+   `api2/ebs/register_instance_to_shared_application_load_balancer.php` (**lines 29–30**) and are
+   present in **committed git history** (found with `git log -S`; commit subject *"Auto-registering
+   to target groups"*). They are exposed to anyone with read access to `api2`, to every clone, and
+   to every EB application bundle built from the repo.
+   **Remediation:** (a) deactivate then delete the key in IAM — rotation, not history rewrite, is
+   what closes the exposure; (b) audit CloudTrail for its use; (c) replace the credential block
+   with the instance-profile pattern above. **Rewriting git history is a separate, sign-off-required
+   decision** — the team git rule forbids force-pushing `_main` in application repos.
+   *(Location + remediation only. Never record the key id, the secret, or any fragment.)*
+2. **IMDSv2 token passed on the `curl` command line** — visible in `ps` / `/proc/<pid>/cmdline`,
+   with a 6-hour TTL.
+3. **Silent IMDSv1 fallback** when no token is obtained — downgrades below the IMDSv2 posture.
+
+This hook pair is also **not yet described in the api2 architecture doc's Deployment section**,
+which lists the other hooks but not `060` — pending an elevated-doc update.
+
+## Change history
+
+- 2026-07-28 — Ported the hook pair from `api2` into `worker2` (new files `060_…​.sh` +
+  `ebs/register_instance_to_shared_application_load_balancer.php`) so non-production worker2
+  environments are reachable through the shared ALB for manual HTTP invocation. Hardened vs. the
+  api2 original: instance-profile credentials only (EB env properties explicitly rejected), native
+  PHP stream-context IMDSv2 with a 60s TTL and fail-closed behaviour, and a two-action least-privilege
+  IAM policy. Recorded the api2 committed-IAM-key incident (location + remediation only) and the
+  non-prod ALB exposure risk. (jcardinal)

package/knowledge/INDEX.md

@@ -18,7 +18,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 ## 2.0 framework
 
 - **_underscore** (_Underscore) _(framework core)_ — 40 doc(s) → [2.0/apps/_underscore/INDEX.md](2.0/apps/_underscore/INDEX.md)
-- **worker2** (Worker) — 33 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
+- **worker2** (Worker) — 34 doc(s) → [2.0/apps/worker2/INDEX.md](2.0/apps/worker2/INDEX.md)
 - **api2** (API) — 18 doc(s) → [2.0/apps/api2/INDEX.md](2.0/apps/api2/INDEX.md)
 - **dbchanges2** (Database Changes) _(framework core)_ — 3 doc(s) → [2.0/apps/dbchanges2/INDEX.md](2.0/apps/dbchanges2/INDEX.md)
 - **toga2-supply** (TOGa Supply) — 3 doc(s) → [2.0/apps/toga2-supply/INDEX.md](2.0/apps/toga2-supply/INDEX.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.462",
+  "version": "1.0.463",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",