toga-ai 1.0.470 → 1.0.472

package/knowledge/1.0/apps/tools/INDEX.md

@@ -3,12 +3,13 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [Tools (1.0 Internal-Tools App) Architecture](architecture.md) | **Tools** is a standalone 1.0 (`App_`) application that houses many small internal tools behind simple interfaces, gated by Client_True staff persona. | tools/index.php, tools/_/app/framework.php, tools/_/app/frameworkindex.php, tools/assets/img/favicon/favicon.ico, tools/assets/img/favicon/favicon-32x32.png, tools/assets/img/favicon/favicon-16x16.png, tools/assets/img/favicon/apple-touch-icon.png, tools/_/app/auth.php, tools/_/app/nav.php, tools/common/header.php, tools/common/footer.php, tools/mvc/get.php, tools/mvc/_TEMPLATE/get.php, tools/docs/ADDING_A_TOOL.md |
+| [ClickUp Sprint Dashboard (tools /clickup/react)](features/clickup-sprint-dashboard.md) | A native **ClickUp sprint dashboard** in the 1.0 `tools` app at route `/clickup/react`, built for a wall-mounted **TV display** ("TOGa IQ" internal sprint metri | tools/_/app/clickup/sprint.php, tools/v2/sprints/tile/index.php, tools/v2/sprints/current/index.php, tools/v2/sprints/status-breakdown/index.php, tools/v2/sprints/worktype-breakdown/index.php, tools/v2/sprints/points-by-dev/index.php, tools/v2/sprints/burndown/index.php, tools/assets/clickup/sprint-dashboard.html, tools/mvc/clickup/react/get.php, tools/mvc/login/get.php, tools/_/app/nav.php |
 | [CloudFront Client Setup](features/cloudfront-client-setup.md) | An SSO-gated admin tool at **`/devops/cloudfront-clients`** in the Tools 1.0 app that onboards a client onto **CloudFront + Route 53 across multiple AWS account | tools/_/app/devops/cloudfront.php, tools/mvc/devops/cloudfront-clients/get.php, tools/mvc/devops/cloudfront-clients/post.php, tools/assets/js/cloudfront-clients.js, tools/assets/css/cloudfront-clients.css, tools/_/app/nav.php, tools/_/app/frameworkindex.php, tools/config.production.ini |
 | [Design Demo Admin](features/design-demo-admin.md) | A self-serve admin UI at **`/design`** in the SSO-protected **Tools** app that lets the design team publish self-contained "Claude Design" HTML exports as **ver | tools/_/app/design/github.php, tools/mvc/design/get.php, tools/mvc/design/post.php, tools/assets/css/design.css, tools/assets/js/design.js, tools/_/app/frameworkindex.php, tools/_/app/nav.php, tools/composer.json |
 | [Tools — Developers Folder (UUID & Password Generators)](features/developer-tools.md) | The first two tools shipped in the Tools app, both under the **Developers** folder and gated to personas **Development Team** / **TOGa Technology**. | tools/mvc/developers/uuid/get.php, tools/mvc/developers/password/get.php |
 | [Tools MVC — Routing, CSRF & App_Database Access Patterns](features/mvc-data-access-patterns.md) | The load-bearing 1.0 (`App_`) framework conventions a developer needs when adding a page to the Tools app — URL routing, CSRF, and DB access through `App_Databa | tools/_/app/nav.php, tools/mvc/get.php |
 | [Tools Persona-Gated Navigation (App_Nav)](features/persona-gated-navigation.md) | `App_Nav` is the Tools app's two-level, **persona-gated** navigation. | tools/_/app/nav.php, tools/mvc/get.php |
 | [Tools SAML SSO Consumer & Persona-Gated Auth (App_Auth)](features/saml-sso-auth.md) | `App_Auth` is the Tools app's authentication layer: it consumes the SAML gateway `?saml=` handoff (see the 2.0 SAML downstream integration contract), establishe | tools/_/app/auth.php, tools/mvc/sso/initiate/get.php, tools/mvc/sso/get.php, tools/mvc/login/get.php, tools/mvc/login/post.php, tools/mvc/logout/get.php, tools/mvc/get.php, tools/config.production.ini, tools/config.local.ini |
-| [Talos Knowledge Base Admin UI (KB Documents + Vocabulary)](features/talos-kb-documents-admin.md) | A Tools (1.0) admin UI to browse/fix the Talos knowledge-base documents and manage the transcript-cleanup vocabulary — without a deploy. | tools/mvc/talos/kb-documents/get.php, tools/mvc/talos/kb-documents/post.php, tools/mvc/talos/knowledge-bases/get.php, tools/mvc/talos/knowledge-bases/post.php, tools/mvc/talos/vocabulary/get.php, tools/mvc/talos/vocabulary/post.php, tools/_/app/talos/s3.php, tools/_/app/talos/bedrock.php, tools/_/app/pg.php, tools/_/app/worker.php, tools/_/app/nav.php, tools/config.production.ini, tools/config.alpha.ini, tools/.platform/httpd/conf.d/timeouts.conf, tools/.platform/hooks/prebuild/01-install-php-pgsql.sh, tools/.platform/hooks/postdeploy/01-restart-php.sh |
+| [Talos Knowledge Base Admin UI (KB Documents + Vocabulary)](features/talos-kb-documents-admin.md) | > **PER-AI-MODEL, DATA-DRIVEN SCOPING (2026-07-29).** The KB-documents and Vocabulary admin > UIs were refactored from a single hard-coded **"development-team"* | tools/mvc/talos/kb-documents/get.php, tools/mvc/talos/kb-documents/post.php, tools/mvc/talos/knowledge-bases/get.php, tools/mvc/talos/knowledge-bases/post.php, tools/mvc/talos/vocabulary/get.php, tools/mvc/talos/vocabulary/post.php, tools/_/app/talos/s3.php, tools/_/app/talos/bedrock.php, tools/_/app/pg.php, tools/_/app/model/true/aimodels.php, tools/_/app/model/true/vectorindexes.php, tools/_/app/model/true/aimodels_vectorindexes.php, tools/_/app/worker.php, tools/_/app/nav.php, tools/config.production.ini, tools/config.alpha.ini, tools/.platform/httpd/conf.d/timeouts.conf, tools/.platform/hooks/prebuild/01-install-php-pgsql.sh, tools/.platform/hooks/postdeploy/01-restart-php.sh |
 | [Talos Pricing UI (Onboarding, Dashboard, Benchmarks, Cost Factors + Estimator)](features/talos-pricing-ui.md) | The 1.0 (tools app) face of the **Talos Pricing Platform** — a "Talos Pricing" nav folder with four pages plus a client-side estimate engine. | tools/_/app/nav.php, tools/_/app/talos/estimator.php, tools/mvc/talos/onboarding/get.php, tools/mvc/talos/onboarding/post.php, tools/mvc/talos/pricing/get.php, tools/mvc/talos/benchmarks/get.php, tools/mvc/talos/factors/get.php, tools/mvc/talos/factors/post.php, tools/assets/css/style.css |
 | [Deploying Tools to Elastic Beanstalk (PHP 8.5 / Amazon Linux 2023)](workflows/deploy-to-elastic-beanstalk-al2023.md) | How the **Tools** 1.0 app boots on Elastic Beanstalk running `PHP 8.5 on 64bit Amazon Linux 2023/4.13.1 (aarch64)`. | tools/.ebextensions/004_http_to_https.config, tools/.ebextensions/006_mount-s3fs.config, tools/.ebextensions/007_setup_export_cache_folders.config, tools/.ebextensions/008_setup_ldap.config, tools/.ebextensions/009_setup_phpini.config, tools/.ebextensions/020_setup_git_libraries.config, tools/.ebextensions/050_register_instance_to_shared_application_load_balancer.config, tools/ebs/git.json |

package/knowledge/1.0/apps/tools/features/clickup-sprint-dashboard.md

@@ -0,0 +1,142 @@
+---
+title: ClickUp Sprint Dashboard (tools /clickup/react)
+framework: "1.0"
+repo: tools
+project: Tools
+client: shared
+type: feature
+status: active
+updated: 2026-07-29
+owners: [kyalamarthi]
+files:
+  - tools/_/app/clickup/sprint.php
+  - tools/v2/sprints/tile/index.php
+  - tools/v2/sprints/current/index.php
+  - tools/v2/sprints/status-breakdown/index.php
+  - tools/v2/sprints/worktype-breakdown/index.php
+  - tools/v2/sprints/points-by-dev/index.php
+  - tools/v2/sprints/burndown/index.php
+  - tools/assets/clickup/sprint-dashboard.html
+  - tools/mvc/clickup/react/get.php
+  - tools/mvc/login/get.php
+  - tools/_/app/nav.php
+related:
+  - ./persona-gated-navigation.md
+  - ./saml-sso-auth.md
+  - ./mvc-data-access-patterns.md
+  - ../architecture.md
+  - ../../../2.0/apps/worker2/features/team-sprint-management.md
+---
+
+## Summary
+
+A native **ClickUp sprint dashboard** in the 1.0 `tools` app at route `/clickup/react`,
+built for a wall-mounted **TV display** ("TOGa IQ" internal sprint metrics). It replaces a
+standalone Node/Express prototype from a prior session, folding the dashboard into `tools`
+so it runs on the existing App\_ framework + SSO with no separate service.
+
+It reads the **same Team DB** and reproduces the **same Power BI-parity metric definitions**
+already documented for worker2 — see
+[team-sprint-management](../../../2.0/apps/worker2/features/team-sprint-management.md). This
+doc does **not** duplicate those DAX→SQL definitions; it documents the tools-side delivery
+(data engine, routes, UI, embed, nav, TV decisions).
+
+## How it works
+
+### Data engine — `App_Clickup_Sprint` (`_/app/clickup/sprint.php`)
+
+Static methods, one per metric: `tile`, `status-breakdown`, `worktype-breakdown`,
+`points-by-dev`, `burndown`, `current`. Each queries the **Team DB** via the `db_team`
+connection (registry string `'db_team'`, from the `[database_team]` config section) using
+`App_Database::query($sql, 'db_team')`. Responses are wrapped in the **api2 `/v2` envelope**
+(`{success, data, errors}`) so the tool is a faithful stand-in for api2.
+
+**Auth is done by hand as JSON**, not the HTML auth card: `App_Auth::isLoggedIn()` +
+`App_Nav::personasForRoute('/clickup/react')` + `hasAnyPersona`; on failure it returns a
+JSON **401/403** so the fetch-based UI gets a clean error instead of an HTML login page.
+
+Two 1.0-framework gotchas this engine had to work around (both reusable beyond this
+feature — see [Gotchas](#gotchas)):
+
+1. **Query-logging preflight on a `Defaults`-less DB.** Call
+   `App_Registry::set('queryLogging', false)` before the first query on `db_team`, or
+   `App_Query`'s one-time preflight (`SELECT ... FROM Defaults WHERE setting='QUERY_LOGGING'`)
+   throws `#1146 Table 'Team.Defaults' doesn't exist` and every metric 500s.
+2. **`App_Database::buildArrayOfRows()` takes its result by reference.** Assign the query
+   result to a variable first; passing `App_Database::query(...)` inline is fatal under the
+   E_ALL handler.
+
+### Routes — `v2/sprints/{metric}/index.php`
+
+Thin route handlers mapping `/v2/sprints/*` to `App_Clickup_Sprint::serve($metric)`. One
+`index.php` per metric (`tile`, `current`, `status-breakdown`, `worktype-breakdown`,
+`points-by-dev`, `burndown`).
+
+### UI — `assets/clickup/sprint-dashboard.html`
+
+**React via CDN in a single HTML file** — React 18.3.1 + ReactDOM (production UMD) +
+Babel-standalone from CDN, JSX inside a `<script type="text/babel">`. **No build step, no
+npm, no bundler.** It fetches `/v2/sprints/*` **same-origin**, so the SSO session cookie
+authenticates the calls automatically. Do not mistake this for a bundled React app.
+
+### Embed page — `mvc/clickup/react/get.php`
+
+A PHP MVC view that `requireAuth`s, then embeds `sprint-dashboard.html` in an
+`<iframe allowfullscreen>` (cache-busted by `filemtime`). Heading "Clickup Dashboard",
+subtitle notes the data is "…refreshed every 5 min."
+
+### Nav — `_/app/nav.php`
+
+Registered under the **"Dashboard"** nav folder as
+`['label'=>'Clickup','route'=>'/clickup/react']`, persona-gated like every folder (see
+[persona-gated-navigation](./persona-gated-navigation.md)). The old Power BI embed nav entry
+(`/clickup/dashboard`) was **removed** — the page file stays on disk, just unlinked — because
+the React dashboard supersedes it.
+
+## TV display decisions
+
+- **Soft 5-min auto-refresh.** The `useApi` hook re-fetches in place every 5 min via
+  `setInterval`; it does **not** `location.reload()`. On a full-screen TV a soft refresh
+  keeps the page full-screen and flash-free, whereas a full reload exits full screen every
+  cycle. (JS timers only throttle in hidden/background tabs; a foreground full-screen TV tab
+  is not throttled.)
+- **16:9 stage.** The iframe stage uses `aspect-ratio:16/9` with
+  `max-height: calc(100vh - 170px)` so it stays TV-shaped without forcing page scroll. Full
+  width comes from lifting the shell content cap for this page only —
+  `.app-content:has(.cur-dash){max-width:none}` (same pattern the design tool uses in
+  `assets/css/design.css`); the dashboard `.page` has no max-width so it fills the stage.
+
+## Local development
+
+- **Dev auth bypass.** `mvc/login/get.php` has a block that, when
+  `!empty($internal['dev_mode']) && !empty($internal['dev_autologin'])`, calls
+  `App_Auth::establishSession([...synthetic 'Local Dev' user...], ['Development Team','TOGa Technology'])`
+  and `App_MVC::routeTo('/clickup/dashboard')`, skipping the SSO form. The `dev_autologin`
+  flag lives **only** in the git-ignored `config.dev-local.ini` (next to `dev_mode`); prod
+  has `dev_mode=0` and no such flag, so the bypass is inert in every deployed env. The config
+  filename is chosen by `getenv('ENVIRONMENT')` → `config.<env>.ini`
+  (`App_Framework::initialize` / `App_Config::getConfigFilename`).
+- **Run on Windows** (the repo's `docs/LOCAL_DEV.md` is macOS-worded):
+  `cd tools && ENVIRONMENT=dev-local php -d "include_path=.;C:/www/library" -S localhost:8000 router.php`.
+  The `App_` framework + `_.php` bootstrap load from the separate `library` repo via
+  `include_path`; `router.php` reproduces the `.htaccess` rewrite for PHP's built-in server.
+
+> Credentials note: DB creds and the `dev_mode` / `dev_autologin` flags live in the
+> git-ignored `config.dev-local.ini` — never commit values.
+
+## Gotchas
+
+- **`queryLogging` preflight fails on any non-core DB without a `Defaults` table.** `App_Query`
+  (`library/app/query.php`) runs a one-time-per-request check on the **first** query of the
+  request against the active connection: `SELECT value FROM Defaults WHERE setting='QUERY_LOGGING'`.
+  If that first query runs on `db_team` (the Team schema has no `Defaults` table) it throws
+  `#1146 Table 'Team.Defaults' doesn't exist`. Set `App_Registry::set('queryLogging', false)`
+  before any query on a `Defaults`-less connection. General to any 1.0 App\_ code hitting the
+  Team DB or any other non-core schema.
+- **`App_Database::buildArrayOfRows()` result is by-reference.**
+  `buildArrayOfRows(App_Database::query($sql,$db), false)` raises "Only variables should be
+  passed by reference", which the E_ALL error handler promotes to a fatal 500. Assign first:
+  `$res = App_Database::query(...); buildArrayOfRows($res, false);`.
+
+## Change history
+- 2026-07-29 — Built `/clickup/react` as a native tools feature (data engine, `/v2/sprints/*` routes, CDN-React TV UI, iframe embed, "Dashboard/Clickup" nav); removed the old `/clickup/dashboard` Power BI nav entry; documented two reusable 1.0 gotchas (queryLogging preflight on Defaults-less DBs, buildArrayOfRows by-ref). (kyalamarthi)

package/knowledge/1.0/apps/tools/features/talos-kb-documents-admin.md

@@ -6,8 +6,8 @@ project: Tools
 client: shared
 type: feature
 status: active
-updated: 2026-07-28
-owners: [jcardinal]
+updated: 2026-07-29
+owners: [jcardinal, ajean]
 files:
   - tools/mvc/talos/kb-documents/get.php
   - tools/mvc/talos/kb-documents/post.php
@@ -18,6 +18,9 @@ files:
   - tools/_/app/talos/s3.php
   - tools/_/app/talos/bedrock.php
   - tools/_/app/pg.php
+  - tools/_/app/model/true/aimodels.php
+  - tools/_/app/model/true/vectorindexes.php
+  - tools/_/app/model/true/aimodels_vectorindexes.php
   - tools/_/app/worker.php
   - tools/_/app/nav.php
   - tools/config.production.ini
@@ -34,6 +37,17 @@ related:
 
 ## Summary
 
+> **PER-AI-MODEL, DATA-DRIVEN SCOPING (2026-07-29).** The KB-documents and Vocabulary admin
+> UIs were refactored from a single hard-coded **"development-team"** knowledge base to
+> **per-AI-model** scoping — the Tools-side counterpart of the worker2 DB-driven routing (see
+> [worker2 routing](../../../2.0/apps/worker2/features/talos-transcript-ingestion.md#db-driven-ai-model-routing-2026-07-29)).
+> KB Documents is now an **AiModel → VectorIndex → documents** cascade; Vocabulary is scoped by
+> an AiModel picker; both **FAIL CLOSED** (throw, never the dev-team bucket, when a target is
+> missing) and are tenant-guarded per model. New 1.0 models `App_Model_True_Aimodels`,
+> `App_Model_True_Vectorindexes`, `App_Model_True_Aimodels_Vectorindexes` (`db_true`). PR tools
+> #5 — code-complete/reviewed; see the **unverified Postgres slug assumption** in Gotchas before
+> merge.
+
 A Tools (1.0) admin UI to browse/fix the Talos knowledge-base documents and manage the
 transcript-cleanup vocabulary — without a deploy. It is the human front-end to the worker2
 [Talos Transcript Ingestion](../../../2.0/apps/worker2/features/talos-transcript-ingestion.md)
@@ -206,6 +220,33 @@ orphaned KB).
   though the *identical call without tags* would have succeeded. Confirm this grant with devops
   **before the next real KB creation** (see the orphaned-vector-bucket gotcha).
 
+## Per-AI-model scoping (2026-07-29)
+
+Refactor from a single hard-coded `development-team` KB to per-AI-model, data-driven scoping.
+
+- **KB Documents cascade.** `AiModel → VectorIndex → documents`, DB-driven (replaces the old
+  S3-folder-enumeration KB list). Every document action is **tenant-guarded**: requires an
+  `aiModelId`, loads only `c_isActive = 1` VectorIndexes, and **rejects** unless the index is
+  bridged to that model via `AiModels_VectorIndexes`. The **move** action additionally refuses
+  cross-model / cross-bucket / cross-region / same-location moves.
+- **Per-index S3 context.** `App_Talos_S3` gained a **request-scoped active context** —
+  `useIndex()` / `reset()` / `client(?index)` — so bucket/region/prefix come from the selected
+  VectorIndex's `c_s3Bucket` / `c_s3Region` / `c_s3Prefix`. **FAILS CLOSED**: throws if any is
+  blank — it never falls back to the dev-team bucket.
+- **Vocabulary scoping.** An AiModel picker; **all reads AND the reconcile writes**
+  (insert/update/delete) are scoped by `c_trueAiModelId`, so a save for one model can never touch
+  another model's rows. **Concurrency-hardened:** `FOR UPDATE` on the existing-row/ownership
+  reads, plus a **content-aware revision token** — SHA-256 over each row's id + content,
+  byte-identical in `get.php` and `post.php` — that rejects a **stale full-set submission before
+  any write** when another admin added, removed, OR edited a row (prevents phantom-delete and
+  lost-update).
+- **Create/provision flow.** New `VectorIndexes` rows populate `c_s3*` + `c_isActive` and an
+  `AiModels_VectorIndexes` bridge row for the chosen model. The previously hard-coded single
+  Postgres assistant id was replaced with a **per-AiModel lookup BY SLUG** (`App_Pg` gained a
+  read `query()` method — it was write-only). See the unverified slug assumption in Gotchas.
+- **New models** (`db_true`): `App_Model_True_Aimodels`, `App_Model_True_Vectorindexes`,
+  `App_Model_True_Aimodels_Vectorindexes`.
+
 ## Helpers
 
 - **`App_Talos_S3`** (`_/app/talos/s3.php`) — S3 client; list KB slugs; list/count approved
@@ -225,6 +266,8 @@ orphaned KB).
   section** (shared with the MySQL DBs) — **no new secret introduced**. `execute()` uses real
   PDO prepared statements (bound params). If the `pdo_pgsql` extension is missing it returns
   `ok=false` with a generic message (detail goes only to `error_log`, never to the client).
+  **As of 2026-07-29 it also has a read `query()` method** (it was write-only) — used by the
+  create flow to look up the per-AiModel Postgres assistant id by slug.
 - **`App_Worker::enqueue()`** (`_/app/worker.php`) — inserts a `Core.WorkerJobs` row and sends
   the `{"workerJobId": id}` SQS message, so a 1.0 app can enqueue worker2 jobs. Requires the
   `[worker]` (`queue_url`/`queue_region`) and `[aws]` (main-account key for SQS `SendMessage`)
@@ -315,12 +358,46 @@ orphaned KB).
   nullable)`, sectionSlug, chunkSlug, description` — create sets `docSlug=sectionSlug=chunkSlug=
   bedrockKbId`.
 - **Verified working end-to-end in production (2026-07-16)** with the VECTOR + S3 Vectors design.
+- **UNVERIFIED ASSUMPTION (must confirm before tools #5 merges): `Client_True.AiModels.slug`
+  == the Postgres `assistants` slug.** The per-AiModel assistant lookup assumes the Postgres
+  table is `public.assistants(id, slug)` and that its `slug` matches the MySQL
+  `Client_True.AiModels.slug`. This is flagged in the code + PR and **must be confirmed against
+  live Postgres** before merge — otherwise create will map to the wrong / no assistant.
+- **Tenant isolation is enforced in the app layer, not the DB.** KB-document actions require an
+  `aiModelId`, load only `c_isActive=1` indexes, and reject any index not bridged to the model;
+  Vocabulary reads+writes are scoped by `c_trueAiModelId`. Do not add a code path that skips
+  these guards — there is no DB-level FK/row-security backstop.
+- **Vocabulary saves are guarded by a content-aware SHA-256 revision token** that must stay
+  **byte-identical** between `get.php` and `post.php`. If you change how the token is computed in
+  one, change the other in lockstep — a mismatch makes every save fail as "stale".
+- **Deploy order (hard dependency): dbchanges2 #442 (schema + backfill) MUST apply first.**
+  tools #5 depends on the `c_` columns but not on worker2 #129 (deploy worker2 first as the live
+  pipeline, then tools).
+- **The per-AI-model refactor (tools #5) is not yet run end-to-end in production.** It is
+  code-complete, `php -l` clean, and reviewed, but the per-model scoping / create flow has not
+  been exercised in prod pending merge and the unverified Postgres slug assumption above. (The
+  earlier VECTOR + S3 Vectors KB-create design *was* verified in prod on 2026-07-16.)
 - No new secret literals introduced; credentials live in the config sections above (documented by
   section/account, never by value). AWS account id `654654170868`, bucket `togaiq`, and the KB
   execution-role ARN are non-secret resource identifiers.
 
 ## Change history
 
+- 2026-07-29 — **Refactored KB Documents + Vocabulary to per-AI-model, data-driven scoping**
+  (from the single hard-coded `development-team` KB). KB Documents is now an
+  `AiModel → VectorIndex → documents` cascade; every document action is tenant-guarded
+  (requires `aiModelId`, only `c_isActive=1` indexes, rejects unbridged; move refuses
+  cross-model/bucket/region/same-location). `App_Talos_S3` gained a request-scoped active
+  context (`useIndex()`/`reset()`/`client(?index)`) driving bucket/region/prefix from the
+  index's `c_s3*` — **fails closed** (throws) if blank, never the dev-team bucket. Vocabulary
+  gained an AiModel picker; reads + reconcile writes scoped by `c_trueAiModelId`;
+  concurrency-hardened with `FOR UPDATE` + a content-aware SHA-256 revision token (byte-identical
+  in get/post) that rejects a stale full-set submission. Create flow populates `c_s3*` +
+  `c_isActive` + an `AiModels_VectorIndexes` bridge row, and replaced the hard-coded Postgres
+  assistant id with a per-AiModel lookup by slug (`App_Pg` gained a read `query()`). New models
+  `App_Model_True_{Aimodels,Vectorindexes,Aimodels_Vectorindexes}` (`db_true`). **Unverified:**
+  `Client_True.AiModels.slug` == Postgres `assistants` slug — confirm before merge. **Deploy
+  after dbchanges2 #442.** PR tools #5. (ajean)
 - 2026-07-28 — **Every new Bedrock KB is now tagged** `tenant=True` + `model_role=knowledge_base`
   via the new `App_Talos_Bedrock::KB_TAGS` constant, passed as the `tags` parameter of
   `CreateKnowledgeBase` (required for togaiq cost allocation / model-inventory reporting; values

package/knowledge/2.0/apps/worker2/INDEX.md

@@ -29,7 +29,7 @@
 | [Startech Webhook Handler (worker2)](features/startech-webhook-handler.md) | Receives inbound webhook events from Startech (Easeedesk) and creates or updates the corresponding ticket in TOGA 2.0. | worker2/Worker/Startech.php |
 | [Talos (TOGa IQ) Meeting-Notes Integration & Token Auto-Refresh (consumer)](features/talos-meeting-notes-integration.md) | How a **dev tool / agent consumes Talos (TOGa IQ)** to query the team meeting-notes corpus programmatically. | .claude/skills/plan-ticket/scripts/talos.js |
 | [Talos Pricing Automation (worker2 Cron — AWS Actuals, Calibration, Monthly Report)](features/talos-pricing-automation.md) | The worker2 half of the **Talos Pricing Platform** (see the talos `pricing-cogs-model` and tools `talos-pricing-ui` docs for the other halves). | worker2/Worker/Talos/Pricing.php, worker2/Database/TalosPricingCrons.sql |
-| [Talos Transcript Ingestion Pipeline (worker2 → AWS Bedrock KBs)](features/talos-transcript-ingestion.md) | `_Worker_Team_Transcripts` runs a fully automated, cron-driven pipeline that ingests raw Teams transcripts into the **Talos / TOGa IQ** AWS Bedrock knowledge ba | worker2/Worker/Team/Transcripts.php, worker2/bin/sync-knowledge-bases.php, worker2/Config/production.ini, worker2/Database/TeamsTranscriptExports.sql, dbchanges2/Team/2026-06-30a, dbchanges2/Team/2026-06-30b, dbchanges2/Team/2026-06-30c, dbchanges2/Team/2026-06-30d, dbchanges2/Team/2026-06-30e, dbchanges2/Core/2026-06-30a, dbchanges2/Core/2026-07-02a, dbchanges2/Team/2026-07-02a, dbchanges2/Team/2026-07-08a, dbchanges2/Team/2026-07-09a, dbchanges2/Team/2026-07-10a, dbchanges2/Team/2026-07-28a - TranscriptProcessingRetryAttempts.sql, dbchanges2/Team/2026-07-28b - TranscriptPromptTemplateConverseModel.sql, dbchanges2/Core/2026-07-28a - TeamsTranscriptRetryCron.sql |
+| [Talos Transcript Ingestion Pipeline (worker2 → AWS Bedrock KBs)](features/talos-transcript-ingestion.md) | > **DB-DRIVEN AI-MODEL ROUTING (2026-07-29).** Which knowledge base a transcript is cleaned > into is now decided by the **meeting organizer's "home" AI model** | worker2/Worker/Team/Transcripts.php, worker2/bin/sync-knowledge-bases.php, worker2/Config/production.ini, worker2/Database/TeamsTranscriptExports.sql, dbchanges2/Client_True/2026-07-27a - TranscriptAiModelRoutingColumns.sql, dbchanges2/Client_True/2026-07-27b - TranscriptAiModelRoutingData.sql, dbchanges2/Team/2026-07-27a - TranscriptVocabularyAiModelScope.sql, dbchanges2/Team/2026-06-30a, dbchanges2/Team/2026-06-30b, dbchanges2/Team/2026-06-30c, dbchanges2/Team/2026-06-30d, dbchanges2/Team/2026-06-30e, dbchanges2/Core/2026-06-30a, dbchanges2/Core/2026-07-02a, dbchanges2/Team/2026-07-02a, dbchanges2/Team/2026-07-08a, dbchanges2/Team/2026-07-09a, dbchanges2/Team/2026-07-10a, dbchanges2/Team/2026-07-28a - TranscriptProcessingRetryAttempts.sql, dbchanges2/Team/2026-07-28b - TranscriptPromptTemplateConverseModel.sql, dbchanges2/Core/2026-07-28a - TeamsTranscriptRetryCron.sql |
 | [Team Sprint Management & Reporting](features/team-sprint-management.md) | `_Worker_Team_Sprint` (file `Worker/Team/Sprint.php`) is the engine behind TOGA's internal **development-sprint process and reporting**. | worker2/Worker/Team/Sprint.php, _underscore/Model/Team/Sprint.php, dbchanges2/Core/CronJobs (SprintLockScheduled seed) |
 | [Teams Meeting Transcript Export](features/teams-transcript-export.md) | > **SUPERSEDED (2026-07-09) — the S3-staging model below is history.** `Export` is now a thin > **GRAPH-DIRECT** cron poller: it no longer archives raw VTT to ` | worker2/Worker/Team/Transcripts.php, worker2/Config/production.ini, worker2/Database/TeamsTranscriptExports.sql, dbchanges2/Core/2026-06-18a - Teams Transcript Export schedule.sql |
 | [VAPI Webhook Handler (worker2 — AI-BDR end-of-call processing)](features/vapi-webhook-handler.md) | `_Worker_Vapi` ([worker2/Worker/Vapi.php](worker2/Worker/Vapi.php)) is the **PHP side of the AI-BDR call loop** — the webhook that receives VAPI's end-of-call r | worker2/Worker/Vapi.php, worker2/Worker/Ai/Bdr/Vapi.php |

package/knowledge/2.0/apps/worker2/features/talos-transcript-ingestion.md

@@ -6,13 +6,16 @@ project: Worker
 client: shared
 type: feature
 status: active
-updated: 2026-07-28
-owners: [jcardinal]
+updated: 2026-07-29
+owners: [jcardinal, ajean]
 files:
   - worker2/Worker/Team/Transcripts.php
   - worker2/bin/sync-knowledge-bases.php
   - worker2/Config/production.ini
   - worker2/Database/TeamsTranscriptExports.sql
+  - dbchanges2/Client_True/2026-07-27a - TranscriptAiModelRoutingColumns.sql
+  - dbchanges2/Client_True/2026-07-27b - TranscriptAiModelRoutingData.sql
+  - dbchanges2/Team/2026-07-27a - TranscriptVocabularyAiModelScope.sql
   - dbchanges2/Team/2026-06-30a
   - dbchanges2/Team/2026-06-30b
   - dbchanges2/Team/2026-06-30c
@@ -40,6 +43,20 @@ related:
 
 ## Summary
 
+> **DB-DRIVEN AI-MODEL ROUTING (2026-07-29).** Which knowledge base a transcript is cleaned
+> into is now decided by the **meeting organizer's "home" AI model**, read from the DB — not by
+> config. The old `[teams]` organizer id/email lists in `Config/production.ini` are **removed**;
+> `Export` polls `Client_True.Users WHERE c_transcriptAiModelId IS NOT NULL AND isActive = 1`
+> and threads an `aiModelId` into each `Process` job. `Process` resolves the model, loads only
+> that model's **ACTIVE `Client_True.VectorIndexes`** (via the `AiModels_VectorIndexes` bridge),
+> classifies among **only those** indexes, and uploads to that index's own
+> `c_s3Bucket`/`c_s3Region`/`c_s3Prefix` — **no longer the single hard-coded
+> `togaiq/development-team/` target**. The pipeline **FAILS CLOSED**: a user/organizer with no
+> home model is never routed to a default KB. This resolves the "two competing registries" open
+> point noted below — `Client_True.VectorIndexes` is now authoritative for routing. See
+> [DB-driven AI-model routing](#db-driven-ai-model-routing-2026-07-29). PRs worker2 #129 /
+> dbchanges2 #442.
+
 `_Worker_Team_Transcripts` runs a fully automated, cron-driven pipeline that ingests raw
 Teams transcripts into the **Talos / TOGa IQ** AWS Bedrock knowledge bases and emails a
 recap to the meeting organizer. **As of 2026-07-09 the pipeline is GRAPH-DIRECT**: there is
@@ -161,7 +178,7 @@ UNIQUE index.
 AI endpoint in the same minute, and kept inside Export's business-hours window because a re-drive
 emails a recap to the meeting organizer.
 
-### `Process(int $transcriptId, string $graphUserId, string $meetingId, string $organizerEmail, string $subject, string $meetingStartIso, array $cc = [], array $bcc = [])`
+### `Process(int $transcriptId, string $graphUserId, string $meetingId, string $organizerEmail, string $subject, string $meetingStartIso, array $cc = [], array $bcc = [], int $aiModelId = 0)`
 1. Download the VTT **straight from Graph** (no S3 round trip).
 2. `stripAndGroupVtt()` — strips WebVTT timestamps and **merges consecutive same-speaker cues
    into one block** (~40% token reduction before the AI call).
@@ -216,6 +233,34 @@ Three deliberate deviations from the usual worker2 `_ApiRequest` idiom — do no
 Timeouts/attempts are class constants: `AI_DEFAULT_TIMEOUT = 600`, `AI_CONNECT_TIMEOUT = 20`,
 `AI_MAX_ATTEMPTS = 2`, `AI_BASE_DELAY_MS`.
 
+### DB-driven AI-model routing (2026-07-29)
+Replaces the old config-driven `[teams]` organizer lists **and** the single hard-coded
+`development-team` KB target. **Source of truth = the DB** (`Client_True`), not
+`Config/production.ini`.
+
+- **Organizer source (`Export`).** `Export` polls
+  `Client_True.Users WHERE c_transcriptAiModelId IS NOT NULL AND isActive = 1` — a user with a
+  non-NULL `c_transcriptAiModelId` **is** a transcript organizer. Each user's `aiModelId` is
+  threaded into that organizer's `Process` jobs. The `[teams]` organizer id/email lists were
+  **removed** from `production.ini`.
+- **Model resolution (`Process`).** Uses the passed `aiModelId`; if `0` (e.g. a `Retry()`
+  re-drive that only carries `organizerEmail`), it **falls back** to resolving the organizer's
+  `Client_True.Users.c_transcriptAiModelId` by email (`Users.email` == the organizer UPN — there
+  is no Entra object-id column, join is by email/UPN). **FAILS CLOSED**: if no model resolves,
+  the transcript is **not** routed to any default/`general` KB — it is rejected, never
+  mis-filed.
+- **Index selection.** Loads the model's **ACTIVE** `Client_True.VectorIndexes`
+  (`c_isActive = 1`) via the `AiModels_VectorIndexes` bridge table, and classifies the transcript
+  among **only those** indexes. **One active index → route directly, no AI classify call.**
+- **Upload target is per-index.** The approved doc uploads to the selected VectorIndex's own
+  `c_s3Bucket` / `c_s3Region` / `c_s3Prefix` (not the single `togaiq/development-team/` target),
+  then Bedrock ingests by the index's `docSlug`. **`VectorIndexes.docSlug` (== `sectionSlug` ==
+  `chunkSlug`) IS the Bedrock knowledge-base id** — there is no separate bedrock-id column.
+- **Composes with the upstream `Retry()` re-drive.** The merged `_production` `Retry()`
+  subsystem re-enqueues `Process` without an `aiModelId` but passes `organizerEmail`, so the
+  email fallback above resolves the model. Verified the routing logic composes with `Retry()`,
+  the `_ApiRequest` Talos transport switch, and the `Logs_True` DB alias registration.
+
 ### Organizer email resolution
 - `resolveOrganizerEmail()` calls Graph `/users/{id}?$select=mail,userPrincipalName` — but
   this needs the **`User.Read.All`** app permission, which the app registration **lacks**.
@@ -242,6 +287,22 @@ spacing (Bedrock allows only one in-flight ingestion per KB, so parallel syncs r
 - **`Team.TranscriptPromptTemplate`** — `name, bodyText, instruction, model, temperature, …`.
 - **`Team.KnowledgeBases`** — `slug, name, isGeneral, bedrockKbId, isActive`; auto-kept-current
   from Bedrock by the daily `SyncKnowledgeBases`.
+
+**Routing model (`Client_True.*` schema, Client cluster — dbchanges2 `Client_True/2026-07-27a`+`b`):**
+- **`Client_True.Users.c_transcriptAiModelId`** — soft ref → `Client_True.AiModels.id`; NULL means
+  the user is not a transcript organizer. This is the organizer source list (replaces `[teams]`).
+- **`Client_True.VectorIndexes.c_s3Bucket` / `c_s3Region` / `c_s3Prefix` / `c_isActive`** — the
+  S3 upload target and active flag for each Bedrock KB. Upload routes to these per-index values.
+- **`AiModels_VectorIndexes`** — bridge mapping a model to its knowledge bases (active ones drive
+  index selection in `Process`).
+- **`Team.TranscriptPromptTerms` / `TranscriptReplacements` / `TranscriptPromptTemplate`** gained
+  **`c_trueAiModelId`** (soft ref → `Client_True.AiModels.id`, dbchanges2 `Team/2026-07-27a`) so
+  the transcript-cleanup vocabulary is scoped per AI model.
+- The `2026-07-27b` data backfill maps existing dev emails → dev-core model, `ecastellucci` →
+  operations model, and each VectorIndex's S3 target.
+- **These `c_`-prefixed columns needed ZERO `_underscore`/model-layer changes** — see the
+  framework note under Gotchas.
+
 **The two tables are BOTH live and NOT redundant** — different owners, different jobs:
 
 - **`Team.TranscriptExports`** — **discovery/observation ledger** owned by `Export()`: drives
@@ -360,8 +421,10 @@ part of the ingestion loop** (raw reads removed). Credential values live only in
   silently no-ops — the worker still returns HTTP-200, so the UI falsely reports "sync
   initiated". **Fix:** run `Team/Transcripts/SyncKnowledgeBases` (or
   `bin/sync-knowledge-bases.php`) to discover `development-team-*` KBs from Bedrock and upsert
-  them into `Team.KnowledgeBases`. **Open architectural point:** two competing registries —
-  `Team.KnowledgeBases` (worker2) vs `Client_True.VectorIndexes` (Tools UI).
+  them into `Team.KnowledgeBases`. **Resolved (2026-07-29):** the routing rewrite makes
+  `Client_True.VectorIndexes` (with its `c_s3*` + `AiModels_VectorIndexes` bridge) the
+  **authoritative** routing registry the pipeline reads; `Team.KnowledgeBases` remains only the
+  worker2 KB-registry mirror. Prefer `Client_True.VectorIndexes` for routing decisions.
 - **`initialize()` MUST register the Logs DB under `DB_CLIENT_LOGS` or the Talos api-logging is
   a silent no-op.** `_ApiRequest`'s logging branch writes via `_Model_Client_Logs_Api`, whose
   `DATABASE` const is `_underscore::DB_CLIENT_LOGS`. `Transcripts::initialize()` previously
@@ -380,12 +443,32 @@ part of the ingestion loop** (raw reads removed). Credential values live only in
   belongs **inside `_ApiRequest::execute()`** (reconnect/re-register before the post-call save)
   and affects every framework caller, so it is deferred pending architecture review. Do **not**
   work around it in `Transcripts.php`.
+- **`c_`-prefixed columns are FRAMEWORK-DYNAMIC in 2.0 — no model-class change needed.** The new
+  `c_transcriptAiModelId` / `c_s3*` / `c_trueAiModelId` columns are read off raw `_Query` rows and
+  written/filtered as `_Model` array keys **without** being declared in the model class and with
+  **no** `Core.RecordFields` / ACL entries (matches the existing `c_clickupUserIdentifier`
+  precedent). Consequence: the `_underscore`/model layer required **zero** changes for these
+  columns (Phase 2 verified NO-OP). See the framework standard
+  [`c_`-prefixed custom columns](../../standards/framework-rules.md).
 - **Cross-ACCOUNT S3.** `togaiq` (us-east-1) approved/archive writes use the `[talos]` key;
   `CopyObject` across accounts is impossible, so archive is get(in-memory)+put. (The old
   toga-private cross-account read is no longer in the loop.)
 
 ## Change history
 
+- 2026-07-29 — **DB-driven per-user AI-model routing.** `Export` now polls
+  `Client_True.Users WHERE c_transcriptAiModelId IS NOT NULL AND isActive=1` (the `[teams]`
+  organizer id/email lists were removed) and threads `aiModelId` into each `Process` job;
+  `Process(…, int $aiModelId=0)` resolves the model (email fallback via
+  `Users.c_transcriptAiModelId`, **fails closed** — no default KB), loads only that model's
+  ACTIVE `Client_True.VectorIndexes` via the `AiModels_VectorIndexes` bridge, classifies among
+  only those (1 index → direct, no classify), and uploads to the index's own
+  `c_s3Bucket`/`c_s3Region`/`c_s3Prefix` — replacing the single `togaiq/development-team/`
+  target. `docSlug` is the Bedrock KB id. Composes with the upstream `_production` merge
+  (`Retry()` re-drive, `_ApiRequest` Talos transport, `Logs_True` alias). `c_` columns are
+  framework-dynamic → zero `_underscore`/model changes. **Deploy order: dbchanges2 #442 (schema
+  + backfill) MUST apply before worker2 #129.** dbchanges2: `Client_True/2026-07-27a`+`b`,
+  `Team/2026-07-27a`. PR worker2 #129. (ajean)
 - 2026-07-28 — **Added `Team/Transcripts/Retry`, a bounded automatic re-drive of failed
   transcripts, and fixed the five-day 500 outage.** Discovered a failed `Process()` was
   *permanently* terminal (HTTP-200 workers + the `dtEnqueued` one-way latch + nothing re-reading

package/knowledge/2.0/standards/framework-rules.md

@@ -5,8 +5,8 @@ project: _Underscore
 client: shared
 type: standard
 status: active
-updated: 2026-07-28
-owners: [jcardinal]
+updated: 2026-07-29
+owners: [jcardinal, ajean]
 files: []
 related:
   - ../apps/_underscore/architecture.md
@@ -163,5 +163,26 @@ returns nothing (or returns only when it succeeds) leaves a blind spot in the au
 only for genuinely retriable conditions, where the queue's retry is the intended behaviour; a
 handled non-retriable failure should return a result describing what happened rather than throwing.
 
+## `c_`-prefixed custom columns are framework-dynamic
+
+Columns prefixed `c_` are **custom/dynamic** columns that the `_underscore` model layer handles
+**without any model-class declaration**:
+
+- They are read straight off raw `_Query` result rows and written/filtered as `_Model` array
+  keys **without** being declared as properties on the `_Model_*` subclass.
+- They require **no `Core.RecordFields` entry and no ACL entry**.
+- Precedent: `c_clickupUserIdentifier`; the 2026-07 transcript-routing columns
+  (`Client_True.Users.c_transcriptAiModelId`, `Client_True.VectorIndexes.c_s3Bucket/c_s3Region/
+  c_s3Prefix/c_isActive`, and `Team.Transcript*.c_trueAiModelId`) follow the same pattern.
+
+**Consequence:** adding a `c_` column is a **schema-only** change (a `dbchanges2` migration) —
+the model/`_underscore` layer needs **zero** code changes to read, write, or filter on it. Do
+not add `RecordFields`/ACL rows or model-class properties for a `c_` column; that is redundant
+and not how the convention works. Use a non-`c_` column when you *do* want the full declared,
+ACL-governed field treatment.
+
 ## Change history
+- 2026-07-29 — Documented the `c_`-prefixed framework-dynamic column convention (schema-only,
+  no model-class/RecordFields/ACL declaration), generalized from the transcript AI-model routing
+  work. (ajean)
 - 2026-07-28 — Corrected the **Worker contract** and **Worker dispatch** sections to match the actual codebase: worker actions are `abstract class _Worker_<Name>` with `public static` entry methods dispatched via `_Worker::runTask(string $action, array|object $parameters)` on the `Category/Sub/File/MethodName` path, with parameters spread as **named arguments** (`$className::$functionName(...$parameters)`, worker2 `Controller/Index.php:325,567`; `_underscore/Worker.php:8`). This replaces the previous `extends _Worker` / `run()` / `_Queue::dispatch()` guidance — no worker in worker2 follows it, `_Queue::dispatch()` does not exist in the codebase, and following the old text would produce a worker that never dispatches. (jcardinal)

package/knowledge/INDEX.md

@@ -13,7 +13,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **walmarttechservices** (Walmart Tech Services) — 1 doc(s) → [1.0/apps/walmarttechservices/INDEX.md](1.0/apps/walmarttechservices/INDEX.md)
 - **test** (Test) — 13 doc(s) → [1.0/apps/test/INDEX.md](1.0/apps/test/INDEX.md)
 - **toga** (TOGa) — 2 doc(s) → [1.0/apps/toga/INDEX.md](1.0/apps/toga/INDEX.md)
-- **tools** (Tools) — 10 doc(s) → [1.0/apps/tools/INDEX.md](1.0/apps/tools/INDEX.md)
+- **tools** (Tools) — 11 doc(s) → [1.0/apps/tools/INDEX.md](1.0/apps/tools/INDEX.md)
 
 ## 2.0 framework
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.470",
+  "version": "1.0.472",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",