toga-ai 1.0.502 → 1.0.504

package/knowledge/1.0/apps/togadesk/INDEX.md

@@ -7,6 +7,7 @@
 | [Field-Service Dispatch (central / repair orders)](features/field-service-dispatch.md) | The **central** subsystem is TOGa Desk's field-service dispatch domain: repair-order lifecycle, technician scheduling, onsite vs depot service, parts, and shipm | desk/includes/controllers/actions/central/, desk/includes/classes/class.repair.php, desk/includes/classes/class.repairhistory.php, desk/_/browser/datatable/central.php, desk/template/pages/central.php, desk/template/pages/central/view.php, desk/template/modals/central/addTracking.php, library/app/model/togadesk/repairorder.php, library/app/model/togadesk/repairordertracking.php, library/app/api/carrier/ups.php |
 | [Managed Service Order Create Flow (New MSO modal → tickets/add)](features/managed-service-order-create.md) | The **Managed Service Order (MSO) create flow** is how a TOGa Desk user manually creates a managed service order: pick an End User (or a Client Location), choos | desk/includes/controllers/actions/tickets/add.php, desk/template/modals/tickets/addNew.php, desk/template/pages/managed.php, desk/template/pages/getinfo.php, desk/template/footer.php, library/app/model/togadesk/repairorder.php |
 | [Ticket Email Notifications (notifications table)](features/notifications.md) | Which TOGa Desk emails fire for a given client is driven **entirely by data**, not code: the `TOGaDeskSupport.notifications` table holds one row per `(clientid, | desk/includes/classes/class.notification.php, crons/tickets.php, crons/tickets_prod.php |
+| [Per-Client Hostname Restriction (getRestrictedClient)](features/per-client-host-restriction.md) | TOGa Desk supports **per-client branded URLs** (e.g. | desk/includes/functions.php, desk/template/header.php, _/browser/datatable/tickets, desk/includes/classes/class.ticket.php, ebs/setup_phpini.php, ebs/http_to_https.php, desk/template/modals/kb/viewDocument.php, desk/template/modals/files/aws-view.php, desk/template/modals/files/contract-view.php, template/pages/documents/view.php, template/pages/tasks/view.php |
 | [REST API (RPC-over-POST) & API-Key Auth](features/rest-api.md) | TOGa Desk exposes a programmatic API at `desk/api/`. | desk/api/index.php, desk/api/resources/tickets.php, desk/api/resources/assets.php, desk/api/resources/authenticate.php, desk/includes/classes/class.apikey.php, desk/includes/functions.php |
 | [SMB Contract Editing & the clientMspId Corruption Trap](features/smb-contract-editing.md) | The SMB contracts page (`/desk/?route=toga/smbcontracts&togaClientId=<id>`) edits `TOGA_*.SMBContracts` rows via a modal. | desk/template/modals/toga/smbcontracts/smbContract.php, desk/includes/controllers/modals/toga/smbcontracts/smbContract.php, desk/includes/controllers/actions/toga/smbcontracts/smbContract.php, desk/includes/controllers/actions/toga/smbcontracts/edit.php |
 | [Ticket Lifecycle (class.ticket.php)](features/ticket-lifecycle.md) | All TOGa Desk ticket creation and reply handling funnels through `Ticket` in `desk/includes/classes/class.ticket.php`. | desk/includes/classes/class.ticket.php, desk/includes/controllers/actions.php, desk/includes/controllers/actions/tickets/addReply.php, desk/api/resources/tickets.php, desk/api/resources/ticket_replies.php, crons/tickets.php, crons/pipe.php, desk/includes/controllers/actions/tickets/merge.php |

package/knowledge/1.0/apps/togadesk/features/per-client-host-restriction.md

@@ -0,0 +1,107 @@
+---
+title: Per-Client Hostname Restriction (getRestrictedClient)
+framework: "1.0"
+repo: togadesk
+project: TOGa Desk
+client: shared
+type: feature
+status: active
+updated: 2026-08-04
+owners: ["mhammontree"]
+files:
+  - desk/includes/functions.php
+  - desk/template/header.php
+  - _/browser/datatable/tickets
+  - desk/includes/classes/class.ticket.php
+  - ebs/setup_phpini.php
+  - ebs/http_to_https.php
+  - desk/template/modals/kb/viewDocument.php
+  - desk/template/modals/files/aws-view.php
+  - desk/template/modals/files/contract-view.php
+  - template/pages/documents/view.php
+  - template/pages/tasks/view.php
+related:
+  - ../architecture.md
+  - ../../togaview/architecture.md
+---
+
+## Summary
+
+TOGa Desk supports **per-client branded URLs** (e.g. `rumcsi.togadesk.togatech.com`). The whole
+mechanism is host-based: `getRestrictedClient()` in `desk/includes/functions.php` (~L1513-1592)
+derives a single "restricted client" from the request hostname, and `restrictByClient()` (L1508)
+is the gate used throughout the UI. Adding a new per-client URL is therefore **one switch case
+plus a lot of non-application work** (cert, sessions, hardcoded legacy domains).
+
+This contradicts the impression that togadesk has no host-based logic — it does, and this is the
+only place a new subdomain gets registered.
+
+## How it works
+
+1. `getRestrictedClient()` lowercases `$_SERVER['HTTP_HOST']`, strips the port, and matches a long
+   **hardcoded switch of per-client subdomains**, returning a `CLIENT_*` constant or `null`.
+2. Client-ID constants are defined in the same file (~L1488-1506):
+   `CLIENT_AGILANT=2`, `CLIENT_OFFICEDEPOT=3`, `CLIENT_RUMCSI=146`, `CLIENT_IMHOUSTON=167`,
+   `CLIENT_FORDHAM=179`.
+3. `restrictByClient()` (L1508) wraps that result and gates:
+   - navigation/menus in `desk/template/header.php` (~L1638-1665), and
+   - the ticket datatables under `_/browser/datatable/tickets/*`.
+4. Post-login data filtering keys off the **session `clientid`**, not the host — the host
+   restriction is a UI/entry gate, not the record-level tenancy boundary.
+
+**TOGa View resolves its host separately.** `togaview/_/app/framework.php` has its own
+`switch($_SERVER['HTTP_HOST'])` that sets `$_SESSION['stylePath']` and selects the RUMCSI SAML
+branch; an unregistered hostname falls through to default branding and **skips SAML**. So a
+togadesk-side DNS record is safe on its own, but any new *togaview* hostname must be added there
+too. _(Carried from the togaview architecture doc — not re-verified in code on 2026-08-04.)_
+
+## Adding a new per-client TOGa Desk URL — checklist
+
+The app code is the easy part. What actually bites:
+
+- **Register the host** in the `getRestrictedClient()` switch (and add a `CLIENT_*` constant if the
+  client is new). Verified 2026-08-04: `rumcsi.togadesk.togatech.com` is **already a case**, so the
+  RUMCSI AWS DNS record needs no code change.
+- **TLS cert.** A 4-label host such as `rumcsi.togadesk.togatech.com` is **not** covered by a
+  `*.togatech.com` wildcard. You need `*.togadesk.togatech.com` or an exact SAN on the ALB
+  listener, plus a host-header rule.
+- **Sessions log everyone out on a domain change.** `ebs/setup_phpini.php` sets
+  `session.save_handler=rediscluster` but sets **no `session.cookie_domain`**, and there is no
+  `session_set_cookie_params()` anywhere — the cookie is host-scoped. Worse, `people.sessionid` is a
+  **single column**, so logging in on a second domain invalidates the session on the first.
+- **Smoke-test Office document previews.** `desk/template/modals/kb/viewDocument.php`,
+  `modals/files/aws-view.php`, `modals/files/contract-view.php`, `template/pages/documents/view.php`
+  and `template/pages/tasks/view.php` embed `https://{HTTP_HOST}/...` into third-party viewers
+  (`docs.google.com/gview`, `view.officeapps.live.com`) which fetch **server-side**. On a host with
+  an untrusted cert, Word/Excel/PPT previews fail **silently** while same-origin PDF iframes still
+  work — making this the best post-cutover check.
+- **Keep the old domain resolvable.** `class.ticket.php` L485-486 and L886-887 hardcode
+  `https://togadesk[-env].agilantsolutions.com/uploads/` when rewriting inline ticket images, so
+  outbound ticket emails keep serving images from the old domain. Other hardcoded legacy domains:
+  `csat.agilantsolutions.com`, `toga.agilantsolutions.com`,
+  `yourcloudhq.togaview.agilantsolutions.com`, and `toga_payment_easyurl` / `fullurl` in every
+  `config.*.ini`.
+
+## Gotchas / known issues
+
+- **Cross-tenant login hole (pre-existing, NOT fixed — deserves its own ticket).** The
+  password-login access condition in `desk/includes/functions.php` (~L627-631) is a chain of ORs,
+  and two clauses grant access **regardless of which client's subdomain is in use**:
+  `getRestrictedClient() != CLIENT_AGILANT && $restrictedClientId == CLIENT_IMHOUSTON` lets an IM
+  Houston user log in on the RUMCSI host, and
+  `getRestrictedClient() != CLIENT_FORDHAM && $restrictedClientId == CLIENT_FORDHAM` does the same
+  for Fordham. Post-login filtering keys off the session `clientid`, so it is not an immediate
+  record leak, but it **defeats the per-client URL restriction and contradicts the comment directly
+  above it** (L627-629). Recommended fix: replace with an explicit per-restricted-client allowlist
+  using guard clauses. Anyone touching login or adding a client URL must know this.
+- **`siteURL()` emits `http://` behind the ALB.** `desk/includes/functions.php` (~L22-31) only emits
+  `https` when `$_SERVER['HTTPS'] == 'on'`; behind the ALB only `X-Forwarded-Proto` is set (see
+  `ebs/http_to_https.php`). It currently has **no callers** in togadesk — a latent trap for any new
+  absolute-link code.
+- The host switch and the client-ID constants are hardcoded — there is no DB-driven mapping, so
+  every new branded URL is a code change.
+
+## Change history
+
+- 2026-08-04 — Documented from a read-only review (TRUE-80139) of the RUMCSI branded-URL cutover;
+  recorded the add-a-hostname checklist and the cross-tenant login hole. No code changed. (mhammontree)

package/knowledge/INDEX.md

@@ -8,7 +8,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **worker** (Worker) — 18 doc(s) → [1.0/apps/worker/INDEX.md](1.0/apps/worker/INDEX.md)
 - **dbchanges** (Database Changes) _(framework core)_ — 1 doc(s) → [1.0/apps/dbchanges/INDEX.md](1.0/apps/dbchanges/INDEX.md)
 - **worker1.5** (Worker 1.5) — 0 doc(s) → [1.0/apps/worker1.5/INDEX.md](1.0/apps/worker1.5/INDEX.md)
-- **togadesk** (TOGa Desk) — 10 doc(s) → [1.0/apps/togadesk/INDEX.md](1.0/apps/togadesk/INDEX.md)
+- **togadesk** (TOGa Desk) — 11 doc(s) → [1.0/apps/togadesk/INDEX.md](1.0/apps/togadesk/INDEX.md)
 - **togaview** (TOGa View) — 6 doc(s) → [1.0/apps/togaview/INDEX.md](1.0/apps/togaview/INDEX.md)
 - **webhook** (Webhook) — 1 doc(s) → [1.0/apps/webhook/INDEX.md](1.0/apps/webhook/INDEX.md)
 - **walmarttechservices** (Walmart Tech Services) — 1 doc(s) → [1.0/apps/walmarttechservices/INDEX.md](1.0/apps/walmarttechservices/INDEX.md)
@@ -56,6 +56,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **Prudential Financial** (`prudential`) → [clients/prudential/INDEX.md](clients/prudential/INDEX.md)
 - **Quad Graphics** (`quad`) → [clients/quad/INDEX.md](clients/quad/INDEX.md)
 - **Rate** (`rate`) → [clients/rate/INDEX.md](clients/rate/INDEX.md)
+- **Richmond University Medical Center** (`rumcsi`) → [clients/rumcsi/INDEX.md](clients/rumcsi/INDEX.md)
 - **Tow Foundation** (`tow-foundation`) → [clients/tow-foundation/INDEX.md](clients/tow-foundation/INDEX.md)
 - **TOGA Technology** (`true`) → [clients/true/INDEX.md](clients/true/INDEX.md)
 - **Walmart Client Profile** (`walmart`) → [clients/walmart/INDEX.md](clients/walmart/INDEX.md)

package/knowledge/clients/rumcsi/INDEX.md

@@ -0,0 +1,5 @@
+# Client: Richmond University Medical Center `rumcsi`
+
+| Doc | Framework | Summary | Files |
+|-----|-----------|---------|-------|
+| [Richmond University Medical Center](profile.md) | 1.0 | Richmond University Medical Center (**RUMCSI**) is a framework **1.0** client served by **TOGa Desk** (staff/analyst side) and **TOGa View** (client portal). |  |

package/knowledge/clients/rumcsi/profile.md

@@ -0,0 +1,44 @@
+---
+title: "Richmond University Medical Center"
+framework: "1.0"
+apps:
+  - togadesk
+  - togaview
+  - library
+project: TOGa Desk
+client: rumcsi
+type: profile
+status: active
+updated: 2026-08-04
+owners: ["mhammontree"]
+files: []
+related:
+  - ../../1.0/apps/togadesk/features/per-client-host-restriction.md
+  - ../../1.0/apps/togadesk/architecture.md
+  - ../../1.0/apps/togaview/architecture.md
+---
+
+## Summary
+
+Richmond University Medical Center (**RUMCSI**) is a framework **1.0** client served by
+**TOGa Desk** (staff/analyst side) and **TOGa View** (client portal). Its TOGa Desk
+`clients.clientId` is **146**, exposed in code as the constant `CLIENT_RUMCSI` in
+`desk/includes/functions.php`.
+
+## Platform footprint
+
+- **Branded per-client URL.** RUMCSI is one of the clients gated by TOGa Desk's host-based
+  restriction: `rumcsi.togadesk.togatech.com` is already a case in `getRestrictedClient()`, which
+  returns `CLIENT_RUMCSI` and drives `restrictByClient()` nav/menu and ticket-datatable scoping.
+  See [Per-client hostname restriction](../../1.0/apps/togadesk/features/per-client-host-restriction.md)
+  for the full add-a-hostname checklist (cert scope, host-scoped sessions, hardcoded legacy domains).
+- **TOGa View SAML.** `togaview/_/app/framework.php` has a RUMCSI-specific host branch that selects
+  branding (`$_SESSION['stylePath']`) and the SAML login path — an unregistered togaview hostname
+  falls through to default branding and skips SAML.
+- **Hardcoded client-ID branching.** RUMCSI appears in TOGa Desk's hardcoded client-ID branching
+  (`central` dispatch, `tickets/add`) — verify the RUMCSI arm before changing shared logic.
+
+## Change history
+
+- 2026-08-04 — Client profile created during the TRUE-80139 read-only review of the RUMCSI branded
+  TOGa Desk URL. (mhammontree)

package/knowledge/sessions/2026-08-04-true-80139-togadesk-rumcsi-url-review-mhammontree.md

@@ -0,0 +1,64 @@
+---
+type: session
+slug: true-80139-togadesk-rumcsi-url-review
+title: TRUE-80139 — impact review of new RUMCSI togadesk hostname
+author: mhammontree
+repos: [togadesk, togaview, library]
+framework: "1.0"
+client: rumcsi
+status: active
+created: 2026-08-04
+updated: 2026-08-04
+---
+
+# Session: true-80139-togadesk-rumcsi-url-review
+**Date:** 2026-08-04
+**Project/Repo:** togadesk (1.0)
+**Task:** TRUE-80139 — a new AWS DNS record was created so `https://rumcsi.togadesk.togatech.com` resolves; review the TOGa Desk 1.0 code to determine whether the new hostname breaks or degrades the RUMCSI (Richmond University Medical Center, clientId 146) experience. Read-only review — no code was changed.
+
+---
+
+## What WORKED
+- **Confirmed the new hostname needs no code change.** `getRestrictedClient()` in `togadesk/desk/includes/functions.php` (~L1513-1592) lowercases `HTTP_HOST`, strips the port (L1516), and matches a hardcoded switch of per-client subdomains. `rumcsi.togadesk.togatech.com` is **already** a case at L1538 returning `CLIENT_RUMCSI` (=146, L1498). Evidence: read the switch directly; the `.togatech.com` variants for all 7 envs are present alongside the legacy `.agilantsolutions.com` ones.
+- **Traced what the restriction actually gates.** `restrictByClient()` (L1508) drives nav/menu visibility in `togadesk/desk/template/header.php` (~L1638-1665: policies, issues) and the ticket datatables in `togadesk/_/browser/datatable/tickets/{all,active,highpriority,awaitingreply}.php` (each at ~L36 and ~L240). Record-level tenancy comes from the session `clientid`, not the host — confirmed via `_/app/ajax.php` and `desk/includes/controllers/modals.php` which branch on `$liu['clientid'] == CLIENT_RUMCSI`.
+- **Confirmed the HTTPS redirect is host-preserving.** `togadesk/ebs/http_to_https.php` writes `RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}` keyed off `X-Forwarded-Proto` — no hardcoded domain, so it follows the new host.
+- **Confirmed no SAML/SSO redirect-URI exposure in togadesk.** Grepped all `config.*.ini` for `saml|acs|entityid|sso` — zero hits. TOGa Desk's AD login is direct LDAP bind (`.ebextensions/008_setup_ldap.config`), which has no per-host callback URL to re-register. (The SAML concern is a *togaview* concern, not togadesk.)
+- **Confirmed no host allowlist at the web-server layer.** `ebs/apache_settings.php` only tunes prefork/MaxRequestWorkers; root `.htaccess` is empty. Nothing rejects an unrecognized `Host` header.
+- **Capture published.** `knowledge/1.0/apps/togadesk/features/per-client-host-restriction.md` and `knowledge/clients/rumcsi/profile.md` created and pushed to `_main` (validate OK, 30 repos; index rebuilt, 312 docs; mirrored to `C:\WWW\.claude\knowledge`).
+
+## What did NOT work — DO NOT RETRY THESE
+- **Do NOT trust the `context-primer` briefing on this topic — it was wrong.** The primer asserted "TogaDesk (`desk/`) is staff-only — it resolves the logged-in user via session, not via subdomain/hostname… there isn't any host-based branching in TogaDesk architecture doc," and concluded a new hostname "doesn't map into TogaDesk's client-selection logic at all." That is false: `getRestrictedClient()` is exactly that logic. The primer was faithfully reporting `knowledge/1.0/apps/togadesk/architecture.md`, which **still** describes the request pipeline as having no host-based logic. Root cause is the stale architecture doc, not the agent. Read `desk/includes/functions.php` L1508-1592 as ground truth.
+- **Searching `config.*.ini` for the session cookie domain found nothing** — not a failed approach so much as a null result worth not repeating: there is no `session.cookie_domain` and no `session_set_cookie_params()` anywhere in the repo. `ebs/setup_phpini.php` sets only `session.save_handler=rediscluster`, `session.save_path` (the `asi-session-cache` cluster endpoint), and `session.gc_maxlifetime=345600`. Cookie scoping is therefore PHP's host-only default, by omission.
+
+## Not tried yet (candidates for next session)
+- **Verify the TLS cert and ALB listener rule** for the 4-label host `rumcsi.togadesk.togatech.com`. A `*.togatech.com` wildcard does **not** cover it — it needs `*.togadesk.togatech.com` or that exact SAN, plus a host-header rule routing to the togadesk environment. Not verifiable from this repo; `ebs/register_instance_to_shared_application_load_balancer.php` contains no host/rule logic (grepped: zero matches for host|rule|rumcsi|togadesk).
+- **Post-cutover smoke test of Office document previews.** `desk/template/modals/kb/viewDocument.php` (~L28) and `desk/template/modals/files/aws-view.php` (~L21), plus `desk/template/modals/files/contract-view.php`, `template/pages/documents/view.php` (~L38), `template/pages/tasks/view.php` (~L48) embed `https://{HTTP_HOST}/...` into `docs.google.com/gview` and `view.officeapps.live.com`, which fetch **server-side**. An untrusted cert breaks Word/Excel/PPT previews silently while same-origin PDF iframes keep working. Test one Office doc on the new host.
+- **Fix the cross-tenant login hole** at `desk/includes/functions.php` ~L627-631 — needs its own ticket (see Decisions).
+- **Apply the 4 held edits to `knowledge/1.0/apps/togadesk/architecture.md`** — drafted by the capture agent, unapplied, still accurate. Needs `jcardinal`'s sign-off (co-owner).
+- **Check whether RUMCSI end users were also given a togaview hostname.** `togaview/_/app/framework.php` has its own `switch ($_SERVER['HTTP_HOST'])` setting `$_SESSION['stylePath']` and the rumcsi SAML branch; an unregistered host falls through to default branding and skips SAML. Not read this session — sourced from the togaview architecture doc, so treat as unverified.
+- **Decide the fate of the legacy `agilantsolutions.com` domain.** `desk/includes/classes/class.ticket.php` L485-486 and L886-887 hardcode `https://togadesk[-env].agilantsolutions.com/uploads/` when rewriting inline ticket images, so outbound ticket emails keep serving images from the old domain regardless of which host the staff member used. Other hardcoded old-domain links: `csat.agilantsolutions.com` (`class.ticket.php` L902, `class.repair.php` L605), `toga.agilantsolutions.com` (`desk/template/pages/tickets/manage.php` L1203, `toga/smbcontracts/manage.php` L106), `yourcloudhq.togaview.agilantsolutions.com` (`toga/smbcontracts/resendemail.php` L36, `resendToAllEmail.php` L38), and `toga_payment_easyurl`/`toga_payment_fullurl` in every `config.*.ini`.
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| `togadesk/**` | unchanged | Read-only review. No source file was created, modified, or deleted this session. |
+| `knowledge/1.0/apps/togadesk/features/per-client-host-restriction.md` | created + pushed | Owns all findings: host resolution, add-a-hostname checklist, `siteURL()` trap, cross-tenant login hole, togaview switch (flagged unverified). |
+| `knowledge/clients/rumcsi/profile.md` | created + pushed | New client onboarding — "Richmond University Medical Center", clientId 146 / `CLIENT_RUMCSI`, `apps: [togadesk, togaview, library]`. |
+| `knowledge/1.0/apps/togadesk/architecture.md` | **NOT modified — 4 edits held** | Elevated, co-owned by `jcardinal`. Held edits: bump `updated` to 2026-08-04; add `desk/includes/functions.php`, `desk/template/header.php`, `ebs/setup_phpini.php` to `files:` and the new feature doc to `related:`; add a host-based-restriction bullet under "Entry points & request pipeline"; add two Gotchas bullets (cross-tenant login hole, host-scoped sessions). Doc currently still claims the pipeline has no host-based logic — **incorrect**. |
+| `.claude/toga-ai.version` | updated | Harness auto-updated v1.0.500 → v1.0.502 during `/kickoff` Step 0. |
+
+## Decisions made
+- **Closed TRUE-80139 as no-code-change-required.** Rationale: the hostname is already registered in `getRestrictedClient()`, and Jonathan confirmed the site works with no issues observed. Rejected alternative: adding the host to the switch — unnecessary, it is already there at L1538.
+- **The cross-tenant login hole gets its own ticket, not a fix inside TRUE-80139.** At `desk/includes/functions.php` ~L627-631 the access condition is a chain of ORs; two clauses grant access regardless of which client's subdomain is in use — `(getRestrictedClient() != CLIENT_AGILANT && $restrictedClientId == CLIENT_IMHOUSTON)` lets an IM Houston user (167) log in on the RUMCSI host, and `(getRestrictedClient() != CLIENT_FORDHAM && $restrictedClientId == CLIENT_FORDHAM)` lets a Fordham user (179) do the same. Post-login filtering keys off the session `clientid`, so it is not an immediate record leak, but it defeats the per-client URL restriction and contradicts the comment directly above it at L627-629. Rationale for separating: pre-existing, not a regression from the DNS change, and the fix (an explicit per-restricted-client allowlist with guard clauses) is a behavior change needing its own testing. Rejected alternative: fixing it inline — would have expanded a read-only review into an auth change on a live client host.
+- **Published the two RUMCSI docs but held the `architecture.md` edits.** Rationale: the developer approved "the docs for RUMCSI"; `architecture.md` is co-owned by `jcardinal` and the edits are cross-references, so nothing substantive is lost by holding them — every finding lives in the feature doc. Rejected alternative: pushing all three — would have edited a senior-owned doc on an ambiguous approval.
+- **Treated "users will be logged out" as expected, not a defect.** Sessions are host-scoped by cookie default and `people.sessionid` is a single column updated on login (`functions.php` L635), so a domain switch forces re-login and a second-domain login invalidates the first session. Rationale: correct multi-tenant behavior; scoping the cookie to `.togatech.com` would share sessions across every client subdomain, which is worse.
+
+## Blockers
+- **`architecture.md` correction is blocked on `jcardinal`** (co-owner of an elevated doc). Until applied, the doc actively misleads: it says the TOGa Desk request pipeline has no host-based logic, which is what sent the `context-primer` down the wrong path this session.
+- **Cert/ALB verification is blocked on AWS access** — not answerable from the togadesk repo. Jonathan's confirmation that the site works is strong evidence the cert and listener rule are already correct, but the Office-preview path (third-party server-side fetch) has not been exercised.
+
+## Exact next step
+> Open a new ticket for the cross-tenant login hole at `togadesk/desk/includes/functions.php` L631, quoting the two offending OR clauses (`$restrictedClientId == CLIENT_IMHOUSTON` and `$restrictedClientId == CLIENT_FORDHAM`), and propose replacing the whole condition with an explicit per-restricted-client allowlist using guard clauses. Then ping `jcardinal` to approve the 4 held edits to `knowledge/1.0/apps/togadesk/architecture.md` (drafted in this session's capture — re-run `/capture` in `apply-approved` mode once he signs off).
+
+---
+_Saved by /session-save on 2026-08-04_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.502",
+  "version": "1.0.504",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",