toga-ai 1.0.526 → 1.0.528

package/knowledge/1.0/apps/library/features/error-capture-1-0.md

@@ -7,7 +7,7 @@ client: shared
 type: feature
 status: active
 updated: 2026-08-04
-owners: ["jcardinal"]
+owners: ["jcardinal", "mhammontree"]
 files:
   - library/app/error/capture.php
   - library/app/error.php
@@ -200,6 +200,18 @@ exists in `api2`/`worker2`. So 1.0 reads the AL1 container config at
   the class+entryPoint fallback changes hashes, so open issues re-fingerprint on first occurrence
   after deploy. Deliberate; merge old hashes onto the curated Issue with the Tools
   merge-fingerprint box.
+- **⚠ The legacy pre-Sentry handler dumps the entire config on any error it renders.**
+  `library/app/DELETE_DOA_PRE-SENTRY_error.php` is a dead-named but still-reachable handler whose
+  `htmlBacktrace()` does `print_r($entry['args'])` for **every** frame. On 2026-08-05 a real
+  error page on **https://towfoundation.togaview.com** rendered ~26 pages containing the whole
+  config array — production DB host/user/password, SES SMTP credentials, NetSuite credentials,
+  Payeezy API key/secret/merchant token, SSL Store token — plus ticket PII. The current
+  `library/app/error.php` is safe (it dumps only under `App_Registry::inDevMode()`), but **both**
+  handlers gate on `inDevMode()`, so the affected host was **evaluating as dev mode in
+  production**. Two actions: (1) verify `inDevMode()` per host in production before trusting any
+  error page not to leak, and (2) delete the legacy handler. Rotation of every exposed credential
+  **was escalated to Jeff on 2026-08-05; confirmation that it was completed is still owed** —
+  treat those credentials as compromised until confirmed. (No values are recorded here or anywhere in the KB.)
 - **Pre-existing committed secrets (location only — not fixed, out of scope).**
   `library/app/cloud.php` holds a hardcoded **AWS access key id and secret access key** as
   class constants/statics (~lines 23–24), used by `App_Cloud::$preCommands` for every 1.0 AWS CLI
@@ -208,6 +220,10 @@ exists in `api2`/`worker2`. So 1.0 reads the AL1 container config at
 
 ## Change history
 
+- 2026-08-05 — Recorded the legacy `DELETE_DOA_PRE-SENTRY_error.php` handler leaking the full
+  config array (prod DB / SES / NetSuite / Payeezy / SSL Store credentials + ticket PII) on a
+  live towfoundation.togaview.com error page, meaning that host evaluates as dev mode in
+  production; rotation escalated to Jeff, confirmation still owed. (mhammontree)
 - 2026-08-04 (latest, **uncommitted/undeployed** at time of writing) — **Mirrored 2.0's reversal:
   `$GLOBALS` is now captured** into a top-level `GLOBALS` group in `capture.php`
   (`buildGlobalsContext()`, `sanitizeForContext()`, `CONTEXT_GLOBALS_TO_EXCLUDE`,

package/knowledge/1.0/apps/togadesk/features/ticket-lifecycle.md

@@ -6,7 +6,7 @@ project: TOGa Desk
 client: shared
 type: feature
 status: active
-updated: 2026-07-09
+updated: 2026-08-05
 owners: ["mhammontree", "dfranks"]
 files:
   - desk/includes/classes/class.ticket.php
@@ -109,6 +109,17 @@ backfill (e.g. craftex:
 `UPDATE TOGaDeskSupport.tickets SET customerid = 932297 WHERE clientid = 169 AND customerid IS NULL;`).
 
 ## Gotchas / known issues
+- **`tickets.escalateToStartech` has NO migration anywhere — schema drift.** The column is
+  referenced by `App_Model_TogaDesk_Ticket` (`FIELDTYPE_INT`), `quickactions.php` (sets `1`) and
+  `manage.php` (checks `=== null`), and **exists in production**, but the `dbchanges` repo has no
+  migration for it; the only `escalateToStartech` SQL in any repo is the 2.0 sibling
+  `dbchanges2/Client_Pcmaticb2b/2026-06-22-pcmaticb2b-enhancements.sql`
+  (`c_escalateToStartech TINYINT(1) UNSIGNED NULL DEFAULT NULL`). A local dev DB missing the
+  column fails **every** ticket INSERT with MySQL error **1054**. Apply it locally; no migration
+  file is needed (prod already has it).
+  **Diagnosis technique worth reusing:** diff the model's `public $field` list against
+  `information_schema.COLUMNS` to find *every* gap at once — MySQL reports only the first unknown
+  column, so fixing them one error at a time is slow and misleading.
 - `'Resolved'` is STILL missing from the `addReply()` switch — a client reply to a Resolved
   ticket changes nothing. Known gap, awaiting product decision.
 - **There is NO 72-hour reopen window in code**, despite SME belief. `Closed` → `Reopened` is
@@ -135,6 +146,9 @@ backfill (e.g. craftex:
   via `emailToTicket()`.
 
 ## Change history
+- 2026-08-05 — recorded `tickets.escalateToStartech` schema drift (in prod, no `dbchanges`
+  migration; missing column fails every ticket INSERT with error 1054 locally) and the
+  model-fields-vs-`information_schema` diffing technique, from TRUE-80671 (mhammontree)
 - 2026-07-09 — mapped the four reply entry points (togaview portal bypasses `addReply()` so
   never transitions status); documented `emailToTicket()` adminid-overwrite reply
   misclassification, the `origin`-absence agent-reply signal, and togadesk↔togaview shared-DB

package/knowledge/1.0/apps/togaview/INDEX.md

@@ -3,8 +3,9 @@
 | Doc | Summary | Files |
 |-----|---------|-------|
 | [TOGa View Architecture](architecture.md) | TOGa View is the client-facing support portal, served per client at `<client>.togaview.com`. | index.php, reset.php, _/app/framework.php, _/app/frameworkindex.php, _/browser/pagination.php, mvc/login/post.php, mvc/ticket/get.php |
-| [TOGa View Login Flows & Session Variables](features/login-flows.md) | `mvc/login/post.php` tries login flows in order; the first match wins. | mvc/login/post.php, _/app/framework.php |
+| [TOGa View Login Flows & Session Variables](features/login-flows.md) | `mvc/login/post.php` tries login flows in order; the first match wins. | mvc/login/post.php, _/app/framework.php, _/app/frameworkindex.php, mvc/msp_client_dashboard/post.php |
 | [MSP Dashboard & Ticket Visibility Rules](features/msp-dashboard.md) | Why tickets "disappear" in the TOGa View client portal: different pages scope tickets **differently**, and the MSP pages depend on `tickets.customerid` and `SMB | common/togaview/msp_dashboard.php, mvc/msp_client_dashboard, mvc/enterprise_dashboard, mvc/support/support.php |
 | [Retail Commerce Lifecycle (winback, purchase, claims, activation)](features/retail-commerce-lifecycle.md) | Beyond support, TOGa View hosts the **retail tech-support commerce flows**: subscription purchase/renewal (with payment), service activation, and insurance-styl | mvc/winback_landing/get.php, mvc/winback_payment/get.php, mvc/winback_payment/post.php, mvc/purchase/get.php, mvc/service_activation/get.php, mvc/claims/get.php, mvc/techsupport_app/get.php |
-| [Ticket Detail Page Security (common/togaview/ticket.php)](features/ticket-detail-page.md) | `common/togaview/ticket.php` is the ticket detail page for nearly ALL hosts — only towfoundation/newcenturyholdingsllc have their own variants; every other clie | common/togaview/ticket.php |
+| [Ticket Detail Page Security & Its Three Forks (common/*/ticket.php)](features/ticket-detail-page.md) | `common/togaview/ticket.php` is the ticket detail page for nearly ALL hosts — only towfoundation/newcenturyholdingsllc have their own variants; every other clie | common/togaview/ticket.php, common/towfoundation/ticket.php, common/newcenturyholdingsllc/ticket.php, mvc/ticket/get.php, mvc/ticket/post.php |
+| [Git & php -l Tooling Against the `_/` App Root (MSYS path mangling)](workflows/git-and-php-tooling-under-the-underscore-app-root.md) | In **Git Bash on Windows**, any command argument beginning with `_/` is rewritten by MSYS path conversion before the tool sees it. | _/app/framework.php, _/app/frameworkindex.php |
 | [Route 53 Hosted Zone Migration Between AWS Accounts](workflows/route53-cross-account-zone-migration.md) | How to move a domain's DNS records (a Route 53 hosted zone) from one AWS account to another. |  |

package/knowledge/1.0/apps/togaview/architecture.md

@@ -6,7 +6,7 @@ project: TOGa View
 client: shared
 type: architecture
 status: active
-updated: 2026-06-15
+updated: 2026-08-05
 owners: ["mhammontree", "jcardinal"]
 files:
   - index.php
@@ -46,7 +46,9 @@ generic `common/togaview/*.php` templates, while a handful have full per-client
   superglobals, starts the session (`HttpOnly`/`Secure`), inits Sentry, and registers the
   NetSuite toolkit + SAML.
 - **`frameworkindex.php`** is the page-shell renderer (CSS/JS registration, page title).
-  **`framework_DOA.php`** is a near-duplicate variant of `framework.php`.
+  A near-duplicate `framework_DOA.php` was **deleted 2026-08-05** (440 dead lines carrying the
+  same unguarded name-split bug as the live file); if one reappears, delete it rather than
+  maintaining it.
 
 ## Page routing (stylePath model)
 `index.php → App_Framework_TogaView::renderIndex()` (in `_/app/framework.php`):
@@ -67,6 +69,17 @@ generic `common/togaview/*.php` templates, while a handful have full per-client
 **Implication:** a change to `common/togaview/<page>.php` affects nearly every client at
 once; a per-client behavior change belongs in a host/stylePath variant or an inline branch.
 
+**Fork parity is a security requirement.** `common/{togaview,towfoundation,newcenturyholdingsllc}/ticket.php`
+are three near-duplicates; TRUE-78835's ownership checks and int-cast landed in only one, leaving
+two hosts with a live cross-tenant IDOR for two months (found and fixed in TRUE-80671). Any fix to
+a forked page must be applied to every fork, and any review of one must check the others.
+
+**Open question — is `newcenturyholdingsllc` a real tenant?** It exists only as a togaview host
+with its own `common/newcenturyholdingsllc/` page fork and a SAML branch that auto-creates
+`people` rows, but it has **no client profile** in the knowledge base and its tenant status is
+unconfirmed. The TRUE-80671 fixes shipped to its fork and are recorded on the shared togaview
+feature docs. Deliberately not onboarded — treat as an open question, not an oversight.
+
 ## MVC request lifecycle
 - `App_MVC::parseRoute()` (in `library`) turns the request URI into route parts and resolves
   `mvc/<route…>/<method>.php`, where `<method>` is `get` or `post` (from the HTTP verb,
@@ -95,7 +108,9 @@ divergent shapes (read `emailAddress` with `email` fallback).
 
 **SAML** (rumcsi, towfoundation, newcenturyholdingsllc) is handled in `framework.php`
 (`meta`/`acs`/`sls`); newcenturyholdingsllc and towfoundation **auto-create `people` rows** for
-unknown SAML users. rumcsi additionally accepts a legacy `?hash=<base64 email>` auto-login.
+unknown SAML users. rumcsi additionally accepts a legacy `?hash=<base64 email>` auto-login — **an unauthenticated
+account-takeover path that appears to be the client's actual production login**; do not remove it
+before completing the `acs` handler (see [login flows](features/login-flows.md)).
 
 ## Dashboards
 Five dashboards, one per audience/business model, each delegating to a client override or the
@@ -154,6 +169,12 @@ retail-commerce-lifecycle feature doc.
 - **Hardcoded Braintree credentials (including a private key) are committed under
   `mvc/winback_payment/`** — these should be rotated and moved to `config.<env>.ini`
   secret management. Flagged 2026-06-15; not yet remediated.
+- **Production can render dev-mode error pages.** A live towfoundation error page dumped the
+  entire config array (prod DB, SES, NetSuite, Payeezy, SSL Store credentials) because both error
+  handlers gate on `App_Registry::inDevMode()` and that host evaluated as dev in production.
+  Verify `inDevMode()` per host. Rotation of every exposed credential was escalated to Jeff on
+  2026-08-05; **confirmation that it was completed is still owed** — treat those credentials as
+  compromised until confirmed.
 - `ENVIRONMENT` defaults to `worker` when unset → wrong config file.
 
 ## Related docs

package/knowledge/1.0/apps/togaview/features/login-flows.md

@@ -6,11 +6,13 @@ project: TOGa View
 client: shared
 type: feature
 status: active
-updated: 2026-06-12
+updated: 2026-08-05
 owners: ["mhammontree"]
 files:
   - mvc/login/post.php
   - _/app/framework.php
+  - _/app/frameworkindex.php
+  - mvc/msp_client_dashboard/post.php
 related:
   - 1.0/apps/togaview/features/msp-dashboard.md
   - 1.0/apps/togaview/features/ticket-detail-page.md
@@ -51,13 +53,64 @@ end-user flows.
 - staplesprotection: inline branch, end-user style, divergent session keys (see table).
 - rumcsi / newcenturyholdingsllc: SAML handled in `_/app/framework.php`, not login/post.php.
 
+## Session-name building — never index `[1]` unguarded
+Several flows built `$_SESSION['clientName'] = $user_name[0] . ' ' . $user_name[1]` from
+`explode(' ', $name)`. A **mononym or shared mailbox** (`operations@`, `kindred@`) — or a name
+stored with a leading space — makes `[1]` undefined, and `App_Error::handleError()` promotes
+every notice to an `ErrorException` and `exit()`s. The result was **total lockout**: those users
+simply could not log in, with no page error anyone would report — a silent outage class. Fixed at
+4 sites (`mvc/login/post.php` towfoundation/newcenturyholdingsllc/rumcsi blocks, plus the rumcsi
+bootstrap in `_/app/framework.php`) to `trim($user_name[0] . ' ' . ($user_name[1] ?? ''))`.
+
+## `sqlProtect(sqlEscape())` removed from the login path
+`mvc/login/post.php`, `mvc/msp_client_dashboard/post.php`, `_/app/framework.php` and
+`_/app/frameworkindex.php` wrapped already-escaped emails in `App_Database::sqlProtect()`, which
+**strips** `% \ / * " ' ` and ` or` — so `o'brien@x.com` became `obrien@x.com` and the login
+lookup silently found nothing. Removed, and `email LIKE '…'` changed to `=` in the same change
+(see the coupling note in the
+[ticket detail page doc](ticket-detail-page.md#no-sqlprotect-on-escaped-values-email-lookups-use--not-like)).
+
 ## Gotchas / known issues
+
+### OPEN SECURITY ITEM — rumcsi `?hash=` unauthenticated account takeover (deliberately left in place)
+`_/app/framework.php` authenticates a rumcsi user on nothing but
+`base64_decode(urldecode($_GET['hash']))` matching an active `people` row for the rumcsi
+clientid — **no password, signature, nonce, or expiry** — then populates ~18 session keys and
+redirects to `/enterprise_dashboard`. Anyone who can guess a RUMC user's email can log in as
+them.
+
+It was removed during TRUE-80671 and then **deliberately reverted**, because it may BE the
+production login mechanism: the rumcsi SAML `acs` handler does `App_MVC::routeTo('/')` on success
+and **never populates `$_SESSION`** (unchanged since commit 9e7d306, "phase one … make sure
+redirect works"); repo-wide only two places ever build a rumcsi session — this hash block and
+`mvc/login/post.php:462`, and the latter is unreachable because the SAML gate redirects to the
+IdP before a password POST can be processed; and RUMC login is confirmed **working in
+production**. Nothing in togaview/togadesk/library generates such a link, so links are presumably
+generated outside our codebase.
+
+- **Next step:** obtain the post-SSO redirect URL from Jonathan to confirm whether it carries
+  `hash=`.
+- **Proper fix:** complete the rumcsi `acs` handler (mirror newcenturyholdingsllc:
+  `$auth->getNameId()` → `people` lookup → session build) — **not** restoring the bypass.
+- Note the surviving SAML branch is gated on `!inTestMode()`, so **test mode leaves rumcsi with
+  no login path at all**.
+
+### Other
+- **`people.password` is a bare SHA-1** (`mvc/login/post.php:21/96/471`) and the hash is also
+  carried in `$_SESSION['Contact']['password']`. Known and accepted for now — togaview is
+  migrating to 2.0, so no remediation is planned here; do not "fix" it as a side effect of
+  another ticket.
 - Code consuming the session must read `emailAddress` with an `email` fallback (and tolerate
   missing `togadeskClientId`) or it rejects all staplesprotection users — this broke the
   ticket.php ownership check until the fallback was added (June 2026).
 - The flows are order-dependent: a contact matching an earlier flow never reaches later ones.
 
 ## Change history
+- 2026-08-05 (TRUE-80671, uncommitted) — Fixed the unguarded `$user_name[1]` session-name build
+  that **locked mononym / shared-mailbox users out entirely** (4 sites); removed
+  `sqlProtect(sqlEscape())` and switched email lookups to `=`; recorded the rumcsi `?hash=`
+  auto-login as an open takeover risk that was intentionally left in place pending confirmation
+  of the real SSO redirect. (mhammontree)
 - 2026-06-12 — documented from craftex MSP portal debugging session (mhammontree)
 
 ## Related docs

package/knowledge/1.0/apps/togaview/features/ticket-detail-page.md

@@ -1,15 +1,19 @@
 ---
-title: Ticket Detail Page Security (common/togaview/ticket.php)
+title: Ticket Detail Page Security & Its Three Forks (common/*/ticket.php)
 framework: "1.0"
 repo: togaview
 project: TOGa View
 client: shared
 type: feature
 status: active
-updated: 2026-06-12
+updated: 2026-08-05
 owners: ["mhammontree"]
 files:
   - common/togaview/ticket.php
+  - common/towfoundation/ticket.php
+  - common/newcenturyholdingsllc/ticket.php
+  - mvc/ticket/get.php
+  - mvc/ticket/post.php
 related:
   - 1.0/apps/togaview/features/login-flows.md
   - 1.0/apps/togaview/features/msp-dashboard.md
@@ -21,6 +25,24 @@ towfoundation/newcenturyholdingsllc have their own variants; every other client'
 back to it. Hardened June 2026 against IDOR (ticket view + file attachment download) and a
 "Deactivated Seat" false positive that blocked MSP admins.
 
+⚠ **THREE near-duplicate forks exist, and a fix applied to one is NOT applied to the others.**
+`mvc/ticket/get.php` selects: host in
+`App_Framework_TogaView::HOSTS_USING_TOGA_TECH_STYLE` (= `['towfoundation',
+'newcenturyholdingsllc']`) → `common/<host>/ticket.php`; otherwise `common/togaview/ticket.php`.
+**Every security or bug fix here must be applied to all three forks.** TRUE-80671 found
+**three separate hardenings** (ticket-view ownership, attachment-download ownership, the
+`ticketId` int-cast) that had only ever landed in `common/togaview/ticket.php` — commit
+9052672/8cfc80e of TRUE-78835 patched one of three files, leaving towfoundation and
+newcenturyholdingsllc fully exploitable for two months. Treat fork parity as a checklist item,
+not a nicety.
+
+**Open question — `newcenturyholdingsllc` has a fork but no client profile.** It exists only as a
+togaview host with its own `common/newcenturyholdingsllc/` pages and a SAML branch that
+auto-creates `people` rows; whether it is a real tenant is **unconfirmed**, so it was deliberately
+not onboarded as a client (2026-08-05). Its TRUE-80671 fixes are recorded here on the shared docs.
+If you learn its formal name and TOGa Desk `clients.id`, onboard it — this is an open question,
+not an oversight.
+
 ## How it works
 
 ### Ownership check (IDOR fix)
@@ -44,8 +66,52 @@ requester email isn't a provisioned SMB seat user (the SMBContractItems JOIN ret
 which is NORMAL for email-intake tickets, so it must never apply to MSP/CUSTOMER viewers.
 
 ### Input handling
-`$_GET['ticketId']` is int-cast once at the top — it is interpolated into several queries in
-this file (was a live SQL injection before June 2026).
+`$_GET['ticketId']` is int-cast once at the top of **each** fork — it is interpolated into
+several queries (was a live SQL injection in `common/togaview/` before June 2026 and in
+`common/towfoundation/` until 2026-08-05).
+
+**Why an uncast id is genuinely injectable:** `App_Model` interpolates the primary key **raw**
+into its SELECT (`library/app/model.php:218` and `:294`; the `(int)` at `:404` covers only the
+save path). So `new App_Model_TogaDesk_Ticket($_GET['ticketId'])` or
+`new App_Model_TogaDesk_File($_GET['fileId'])` with an uncast value is an injection point —
+constructing a model is not a safe boundary.
+
+### Requester-name splitting (must be guarded)
+Each fork renders the requester's first/last name via `explode(' ', $name)`. A **mononym or
+shared mailbox** (`operations@`, `kindred@`) — or a name stored with a **leading space** —
+yields a 1-element array, and reading `[1]` raises `Undefined offset: 1`. Because
+`App_Error::handleError()` promotes **every** notice to an `ErrorException` and `exit()`s, that
+notice is a hard 500, not cosmetic. Guard with
+`if (!empty($ticketUserInformation) && isset($ticketUserInformation['name']))` and use
+`$parts[1] ?? ''`.
+
+⚠ **Do not assign firstName/lastName unconditionally to "simplify" the guard.** Doing so makes
+an empty no-match result **non-empty**, which silently bypasses the `empty($ticketUserInformation)`
+deactivated-seat fallback further down the same file. `App_Database::fetchRow()` returns `[]`
+(not `false`) on no match, so emptiness *is* the no-match signal.
+
+### Custom fields are keyed off the ticket's own client
+The towfoundation fork was a copy-paste of the rumcsi branch and queried
+`tickets_customfields WHERE clientid = (SELECT id FROM clients WHERE name = "Richmond
+University Medical Center")` — serving TOW Foundation **RUMC's** field definitions
+(cross-tenant leak). It now uses `(int) $ticketDetails->clientid`
+(`App_Model_TogaDesk_Ticket::$clientid` is `FIELDTYPE_INT`) with no hardcoded client name.
+Never resolve a tenant by literal client *name* in these files.
+
+### No `sqlProtect()` on escaped values; email lookups use `=`, not `LIKE`
+`App_Database::sqlProtect(App_Database::sqlEscape($x))` was removed at **39 sites across 7
+files**. `sqlProtect()` is `str_ireplace(['%','\\','/','*',' or','"',"'"], '', $input)` — it
+**deletes** those characters, stripping the backslashes `sqlEscape()` just added, so
+`o'brien@x.com` silently becomes `obrien@x.com` and the lookup finds nothing. It also mangles
+ordinary strings ("Victor Ortiz" → "Victt Ortiz", because ` or` is stripped case-insensitively).
+It adds **no** injection protection — the escape already made the value safe.
+
+**The `LIKE` → `=` change must ship with the removal.** `sqlProtect` stripping `%` was the only
+thing preventing a `%` in an address from acting as a LIKE wildcard; removing it while keeping
+`LIKE` would introduce over-matching. Verified behaviorally identical against the real schema:
+`people.email` / `contacts.email` are `utf8mb3_general_ci`, `Customers.email` and per-client
+`Contacts.emailAddress` are `latin1_swedish_ci` — all case-insensitive VARCHARs, `people.email`
+is BTREE-indexed, and no site relied on wildcards.
 
 ## Data model
 `TOGaDeskSupport.tickets`, `tickets_replies`, `files`; TOGA-side `SMBContractItems` →
@@ -58,14 +124,56 @@ this file (was a live SQL injection before June 2026).
   `emailAddress`/`togadeskClientId`) — the ownership check's email fallback exists for them.
 
 ## Gotchas / known issues
-- Pre-existing warts (untouched): unescaped `$emailAddress` in the walmart branch query;
-  unguarded `explode(' ', name)` in rumcsi/towfoundation branches.
+
+### OPEN — the ownership check is defeated for retail by a shared client id
+Both RetailServices logins hardcode `$_SESSION['togadeskClientId'] = 11`
+(`mvc/login/post.php:536` and `:560`) and **every** retail ticket is created with that value
+(`mvc/ticket/post.php:220,285`). So the ownership check's client-match arm evaluates `11 == 11`
+for every retail session and **never reaches the email arm**: any retail customer can read any
+other retail customer's ticket and attachments by iterating `ticketId`/`fileId`. Retail routes
+to `common/togaview/ticket.php` (there is no `common/walmart*/ticket.php`).
+**Suggested fix:** treat id 11 as a shared bucket — require the email arm when
+`togadeskClientId == 11` — and replace the magic `11` with a named constant. Not fixed in
+TRUE-80671 by explicit developer decision (one login issue at a time; togaview is migrating to
+2.0).
+
+### OPEN — portal-uploaded attachments can never be downloaded
+Upload writes to **S3** (`App_Cloud::copyFileToS3($tempPath, 'asifiles',
+'/togadesk-<env>/uploads/<name>')`, `mvc/ticket/post.php:160`; `files.file` stores only the bare
+filename), but the download handler reads the **local filesystem** at
+`$_SERVER['DOCUMENT_ROOT'] . $config['internal']['kb_documents_path'] . '/' . $file->file` — the
+**knowledge-base** document path, evidently copy-pasted from a KB handler and never adapted for
+S3. Fails **silently**: `file_exists()` fails → `routeTo(...&invalidFile=true)` → "Invalid File"
+toaster, not an error, which is why it went unnoticed. Same in all three forks.
+`App_Cloud::getFileFromS3()` (`library/app/cloud.php:540`) exists and is unused here. Verify
+against production (prod `DOCUMENT_ROOT/uploads` may be S3-synced) before sizing.
+
+### Per-developer config must carry the `kb_*` keys
+Attachment download reads `$config['internal']['kb_documents_path']`. A dev config missing the
+five `kb_*` keys (`kb_documents_path`, `kb_articles_path`, `kb_faqs_path`, `kb_tasks_path`,
+`kb_general_path`) — which prod/alpha/beta/stage and most dev configs carry — raises
+"Undefined index", **fatal** under `App_Error`. The active config is chosen by
+`getenv('ENVIRONMENT')`, set via Apache `SetEnv ENVIRONMENT` in `httpd.conf`. Copy the `kb_*`
+block when creating a new `config.dev-*.ini`.
+
+### Other
+- Pre-existing wart (untouched): unescaped `$emailAddress` in the walmart branch query.
 - Pending as of 2026-06-12: MSP/CUSTOMER bypass for the ownership check (MSP session's
   `togadeskClientId` is the MSP's own client id — matches their customers' tickets since those
-  carry the MSP's clientid, but verify when an MSP views a ticket whose clientid differs);
-  togaview changes were uncommitted at session end.
+  carry the MSP's clientid, but verify when an MSP views a ticket whose clientid differs).
+- TRUE-80671 changes were **working-tree only** (branch `TRUE-80671`, nothing committed) at
+  session end.
 
 ## Change history
+- 2026-08-05 (TRUE-80671, uncommitted) — **Ported both TRUE-78835 ownership checks (ticket view
+  + attachment download) into the towfoundation and newcenturyholdingsllc forks**, which had
+  neither — a live cross-tenant IDOR on both hosts; verified both directions live. Guarded the
+  requester name-split in all three forks (`Undefined offset: 1` → hard 500 for mononyms/shared
+  mailboxes); fixed the towfoundation fork serving **RUMC's** custom-field definitions
+  (hardcoded client name → `(int) $ticketDetails->clientid`); added the missing `(int)` cast on
+  `$_GET['ticketId']` in the towfoundation fork; removed
+  `sqlProtect(sqlEscape())` and switched email lookups to `=`. Recorded the retail shared-clientId
+  IDOR and the S3-vs-local attachment-download bug as open items. (mhammontree)
 - 2026-06-12 — file-attachment IDOR fix (ownership check now covers fileId branch);
   email-key fallback for staplesprotection (mhammontree)
 - 2026-06 — ownership check added (ticket view), deactivated-seat gate restricted to

package/knowledge/1.0/apps/togaview/workflows/git-and-php-tooling-under-the-underscore-app-root.md

@@ -0,0 +1,58 @@
+---
+title: Git & php -l Tooling Against the `_/` App Root (MSYS path mangling)
+framework: "1.0"
+repo: togaview
+project: TOGa View
+client: shared
+type: workflow
+status: active
+updated: 2026-08-05
+owners: ["mhammontree"]
+files:
+  - _/app/framework.php
+  - _/app/frameworkindex.php
+related:
+  - 1.0/apps/togaview/architecture.md
+---
+
+## Summary
+In **Git Bash on Windows**, any command argument beginning with `_/` is rewritten by MSYS
+path conversion before the tool sees it. So `git diff HEAD -- _/app/framework.php` returns an
+**empty diff** on a file you definitely changed, and `php -l _/app/framework.php` misfires the
+same way. **Quoting does not help** — MSYS converts quoted arguments too.
+
+This is not an edge case in togaview: the app root **is** `_/` (`App_Framework` resolves
+`__APPROOT__` by walking up to a folder named `_`), so every framework file in the repo hits it.
+In TRUE-80671 it caused **two separate subagent reviews to report a changed file as unchanged**,
+which nearly sent a security fix out unreviewed.
+
+## How it works — the safe forms
+
+Use any one of these (all verified):
+
+```bash
+MSYS_NO_PATHCONV=1 git diff HEAD -- "_/app/framework.php"   # disable conversion
+git diff HEAD -- "./_/app/framework.php"                    # leading ./ defeats it
+git diff HEAD -- "*app/framework.php"                       # glob pathspec
+```
+
+The same applies to `php -l` and to anything else taking a `_/`-prefixed path.
+
+## Rules
+
+1. **Any review instruction, script, or agent prompt that names a path under `_/` must use one
+   of the safe forms above.** Prefer `MSYS_NO_PATHCONV=1`, which fixes the whole command.
+2. **An empty diff on a file you know you changed is this bug**, not evidence of no change.
+   Confirm with `git status --porcelain` or a bare `git diff HEAD` (no pathspec) before
+   concluding anything.
+3. Reviewing "no changes found" is a **failed review**, not a passing one — re-run it.
+
+## Gotchas / known issues
+- PowerShell and cmd are unaffected; the bug appears only under Git Bash/MSYS, so a teammate on
+  a different shell may not reproduce it.
+- A bare `git diff HEAD` with **no** pathspec is always safe — path conversion only touches
+  arguments, and reviewing the whole diff avoids the trap entirely.
+
+## Change history
+- 2026-08-05 — Documented after two TRUE-80671 subagent reviews silently reported changed
+  `_/app/framework.php` as unchanged. (mhammontree)

package/knowledge/1.0/standards/backend-php.md

@@ -5,7 +5,7 @@ project: Library
 client: shared
 type: standard
 status: active
-updated: 2026-08-04
+updated: 2026-08-05
 owners: [jcardinal, rgirish, mhammontree]
 files: []
 related:
@@ -192,7 +192,10 @@ In code you rarely write raw column types — an `App_Model` declares each colum
 * Never interpolate raw user input into a query string. In order of preference:
   1. **Use the `App_Model` layer** — it builds and escapes queries for you.
   2. **When writing SQL by hand, escape every interpolated value with `App_Database::sqlEscape()`** before placing it in the query string. In `browser/` action files the helper `getVarEscaped('field')` wraps `sqlEscape()` for request values.
-* `App_Database::sqlEscape()` escapes a value for safe interpolation (and handles arrays/objects recursively). `App_Database::sqlProtect()` is a **stricter, lossy filter** that *strips* `% \ / * " '` and the literal ` or` — use it only to sanitize free-form search input, never for values you intend to store intact.
+* `App_Database::sqlEscape()` escapes a value for safe interpolation (and handles arrays/objects recursively). **`sqlEscape()` alone is the injection control — nothing needs to be added to it.**
+* **NEVER wrap an escaped value in `sqlProtect()`.** `App_Database::sqlProtect()` is `str_ireplace(['%','\\','/','*',' or','"',"'"], '', $input)` — it **deletes** those characters, including the backslashes `sqlEscape()` just added. `sqlProtect(sqlEscape($email))` turns `o'brien@x.com` into `obrien@x.com`, so the lookup silently finds nothing; it also mangles ordinary strings ("Victor Ortiz" → "Victt Ortiz", since ` or` is stripped case-insensitively). It is **data corruption, not defense in depth**. 39 such sites across 7 togaview files were removed in TRUE-80671.
+* **If you remove `sqlProtect()` from a `LIKE` comparison, change `LIKE` to `=` in the same commit.** `sqlProtect` stripping `%` was the only thing stopping a `%` in user data from acting as a wildcard; removing it while keeping `LIKE` introduces over-matching. (Safe for email columns, which are case-insensitive VARCHARs — verify collation before generalizing.)
+* `sqlProtect()`'s only legitimate use is sanitizing free-form **search** input, never a value you intend to match or store intact.
 * Legacy uses **mysqli** (via `App_Database`), not PDO/prepared statements; escaping discipline at the call site is the control.
 
 ```php
@@ -347,7 +350,7 @@ class App_Model_Client extends App_Model {
 * **Read results:** `fetchRow(&$res)`, `fetchOne(&$res, $rowIndex, $colIndexOrField)`, `numRows(&$res)`.
 * **Writes:** `affectedRows($link)`, `getInsertId($link)`.
 * **Cached lookups:** `lookupField($table, $aryLookup, $returnField, $link, $throwIfNotFound)`, `lookupRecord($table, $idValue, $link)`.
-* **Escaping:** `sqlEscape()` (safe interpolation) and `sqlProtect()` (strict, lossy filter) — see SQL Injection Prevention.
+* **Escaping:** `sqlEscape()` (the injection control — safe interpolation) and `sqlProtect()` (**lossy character-stripping filter; never wrap an escaped value in it**) — see SQL Injection Prevention.
 
 ## browser/ — Server-Rendered UI
 

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -15,7 +15,7 @@
 | [_Cloud S3 helpers (copy / get / delete / list)](features/cloud-s3-helpers.md) | `_Cloud` centralizes AWS SDK S3 usage for the 2.0 stack so the `S3Client` never leaks into workers or app code. | _underscore/Cloud.php |
 | [_Component_*/_Model_* project-namespace registration (autoloader) & backslash-qualify traps](features/component-model-namespace-registration.md) | Every **project-local** `_Component_*` and `_Model_*` class in a 2.0 app **must declare the project namespace** at the top of the file: ```php namespace <NAMESP | _underscore/Loader.php, worker2/_.php, api2/_.php, worker2/Component/Forecast/Db/Db.php, worker2/Component/Forecast/SaleImport/SaleImport.php, api2/Component/Api/Netsuite/Netsuite.php, _underscore/Component/Api/Paypal/Paypal.php |
 | [Re-pointing a DB alias mid-request (_Database::register park/restore)](features/database-alias-repointing.md) | `_Database` keys **all live per-database runtime state by the connection ALIAS** (`Client` / `_underscore::DB_CLIENT`, `ClientLogs`, `Archive`), **not** by the | _underscore/Database.php, _underscore/Query.php, api2/Component/Api/V2/V2.php, api2/Component/Api/CrossClient/CrossClient.php |
-| [2.0 Email Send Pipeline (queue + Send worker)](features/email-send-pipeline.md) | In 2.0, `_Email::send()` **does not transmit** — it queues the message. | _underscore/Email.php, worker2/Worker/Infrastructure/Email/Send.php |
+| [2.0 Email Send Pipeline (queue + Send worker)](features/email-send-pipeline.md) | In 2.0, `_Email::send()` **does not transmit** — it queues the message. | _underscore/Email.php, _underscore/String.php, worker2/Worker/Infrastructure/Email/Send.php |
 | [Client Email Template Sending](features/email-template-sending.md) | `_Model_Client_EmailTemplate` sends a stored, client-defined email template by UUID. | _underscore/Model/Client/EmailTemplate.php, _underscore/Model/Client/EmailTemplateOutgoingEmailAddress.php, _underscore/Email.php |
 | [Error Reporting — Issue/Event Capture, Fingerprinting & Aggregation](features/error-reporting-issue-event.md) | Platform-wide error reporting for TOGA 2.0, built on an **Issue / Event** aggregation model in the **shared Core Logs DB**. | _underscore/Error.php, _underscore/Database.php, _underscore/Exception/Business.php, api2/Controller/Index.php, worker2/Controller/Index.php, _underscore/Model/Core/Logs/Issue.php, _underscore/Model/Core/Logs/Event.php, _underscore/Model/Core/Logs/IssueFingerprint.php, _underscore/Model/Core/Logs/IssueClickupTask.php, _underscore/Model/Core/Logs/IssueEmailAddress.php, _underscore/Model/Core/Logs/IssueAreaOwner.php, dbchanges2/Logs/2026-07-30a - Error reporting Issues and Events.sql, dbchanges2/Logs/2026-08-01a - Rename tables to singular.sql, dbchanges2/Logs_Client/2026-08-01a - Drop Error table.sql, dbchanges2/Core/2026-07-30a - Error escalation cron job.sql |
 | [Record-Changed Event Publishing (_Event::publish to SQS)](features/event-publish-sqs.md) | `_Event::publish()` (in `_underscore/Event.php`) is the PHP side of the real-time event pipeline. | _underscore/Event.php |
@@ -29,8 +29,10 @@
 | [Per-Client Database Connections & the Local Logs Trap](features/per-client-database-connections.md) | When `_underscore` serves a request for a client it opens **three distinct per-client database connections**, not one. | _underscore/Database.php, _underscore/Query.php, _underscore/ApiRequest.php, _underscore/Model/Client/Logs/Api.php, api2/Controller/Index.php |
 | [Persona Name Translation (PersonaTranslations sidecar)](features/persona-name-translation.md) | Serves Persona **names** in multiple languages by adding a per-language **sidecar** table `PersonaTranslations`, reusing the platform's existing metadata-driven | _underscore/Model/Client/PersonaTranslation.php, dbchanges2/Client/2026-07-22b - PersonaTranslations.sql, dbchanges2/Core/2026-07-22a - PersonaTranslationsRecord.sql, dbchanges2/Client/2026-07-22c - PersonaTranslationsAcl.sql, dbchanges2/Client_CompassCanada/2026-07-22 - PersonaTranslationsFrench.sql, toga2-commerce/src/pages/Account/view/MySettingsView.tsx |
 | [Recursive Item Fulfillments (upstream mirroring)](features/recursive-item-fulfillments.md) | In a multi-tier supply chain a sales order (SO) spawns a purchase order (PO) that becomes another SO downstream, and so on. | _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Client/ItemFulfillmentItem.php, _underscore/Model/Client/ItemFulfillmentItemUnit.php, _underscore/Model/Client/ItemFulfillmentPackage.php, _underscore/Model/Compass/AdvanceShippingNotice.php, dbchanges2/Core/2026-02-13 - 75601 - RecursiveItemFulfillmentCreation.sql, dbchanges2/Core/2026-06-04 - RecursiveItemFulfillmentPut.sql, dbchanges2/Client_Compass/2026-07-02a - FixSA133377TrackingSerialAndDuplicateIF.sql |
+| [_String helpers — ASCII-safe HTML entity encoding (and the parseBetween trap)](features/string-html-entity-helpers.md) | `_String` is the 2.0 framework's static string utility class. | _underscore/String.php |
 | [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | The runtime for the platform-wide **Surface** UI presentation layer: 9 `_underscore` models plus a cached resolver, `_Model_Core_Surface::resolve(&$api, string | _underscore/Model/Core/Surface.php, _underscore/Model/Client/AclRecordScript.php, _underscore/Model/Core/RecordScript.php, dbchanges2/Core/2026-06-30a - SurfaceMetaGroupAndSalesOrderSections.sql, dbchanges2/Client/2026-06-30a - SurfaceMetaGroupAcl.sql, dbchanges2/Client_Quad/2026-07-01a - GrantSurfacesMetaGroupScriptAcl.sql, dbchanges2/Client_CompassCanada/2026-07-01a - GrantSurfacesMetaGroupScriptAcl.sql, dbchanges2/Core/2026-06-29b - SurfaceMetaPublicReadAcl.sql, dbchanges2/Client/2026-06-29c - SurfaceRecordScriptAcl.sql, dbchanges2/Core/2026-06-29c - SurfaceDebugPhpMethodFix.sql, dbchanges2/Client_Compass/2026-07-15f - SalesOrderRecordActionsRemoveDeadConfigRuleOverrides.sql, dbchanges2/Core/2026-07-17h - Update - ClearApprovalsFilterButtonConfig.sql, dbchanges2/Client_Compass/2026-07-17a - SalesOrderApprovalActionsOverride.sql, dbchanges2/Client_Compass/2026-07-17b - SalesOrderApprovalsFilterButtonOverride.sql, dbchanges2/Client_CompassCanada/2026-07-17a - SalesOrderApprovalActionsOverride.sql, dbchanges2/Client_CompassCanada/2026-07-17b - SalesOrderApprovalsFilterButtonOverride.sql, dbchanges2/Client_Quad/2026-07-17a - SalesOrderApprovalActionsOverride.sql, dbchanges2/Client_Quad/2026-07-17b - SalesOrderApprovalsFilterButtonOverride.sql, _underscore/Model/Core/SurfaceElement.php, _underscore/Model/Core/Action.php, _underscore/Model/Core/Vocabulary.php, _underscore/Model/Core/VocabularyTerm.php, _underscore/Model/Core/Message.php, _underscore/Model/Client/SurfaceOverride.php, _underscore/Model/Client/MessageTranslation.php, _underscore/Model/Client/ThemeToken.php, _underscore/Model/Core/Page.php, api2/Component/Api/V2/V2.php |
 | [Table-View Hyperlink Columns (meta → ACL → computed URL → render)](features/tableview-hyperlink-columns.md) | Any 2.0 table-view column can render its value as a clickable link instead of plain text. | _underscore/Model/Client/TableView.php, _underscore/Model/Client/TrackingNumber.php, api2/Component/Api/V2/V2.php, toga2-supply/src/api/toga.ts, toga2-supply/src/components/ui/Tables/PrimaryTable/helperFunctions/formatTableData.tsx, toga2-supply/src/components/ui/Tables/PrimaryTable/helperFunctions/convertData.tsx, toga2-supply/src/components/ui/Tables/hooks/useDataTableState.tsx, dbchanges2/Client/2026-07-20 - TrackingNumberHyperlinkAndFieldPermission.sql |
+| [TogaIQ Gateway Client (_Component_Api_Togaiq) — AI generate/translate from 2.0](features/togaiq-gateway-client.md) | `_Component_Api_Togaiq` is the 2.0 framework's client for the **TogaIQ** (Talos) AI gateway. | _underscore/Component/Api/Togaiq/Togaiq.php, _underscore/ApiRequest.php |
 | [Tracking-Number Bridge Migration (ASN / Item Fulfillment / Item Receipt)](features/tracking-number-bridges.md) | Shipment tracking numbers used to live as **scalar FK columns** (`trackingNumberId`, `returnTrackingNumberId`) directly on the lowest-level "unit"/"item" tables | api2/Component/Api/V2/V2.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnit.php, _underscore/Model/Client/AdvanceShippingNoticeItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillmentItemUnits/TrackingNumber.php, _underscore/Model/Client/ItemFulfillment.php, _underscore/Model/Prudential/AdvanceShippingNotice.php, _underscore/Model/Compass/AdvanceShippingNotice.php, _underscore/Trait/Netsuite/ItemFulfillment.php, api2/Component/Api/Cxml/Cxml.php, dbchanges2/Client/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Core/2026-06-10 - TrackingNumberBridges.sql, dbchanges2/Client_Prudential/2026-06-15 - ItemFulfillmentTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Quad/2026-06-18a - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19b - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Growrk/2026-07-13a - ItemFulfillmentItemReceiptTrackingNumberAclLogicGroups.sql, dbchanges2/Client_Nychh/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql, dbchanges2/Client_Quad/2026-06-19a - FixItemFulfillmentTableViewTrackingAndRoot.sql |
 | [Units for Items for Purchase Orders — Data Structure](features/units-for-items-for-purchase-orders.md) | Describes how unit (serialized inventory) data is linked to sales-order and purchase-order line items behind the `units-for-items-for-purchase-orders` TableView |  |
 | [USPS DPV Deliverability Verdict (is this address actually insurable/shippable?)](features/usps-dpv-deliverability.md) | **USPS returning HTTP 200 with a populated address is NOT evidence that the address is deliverable.** The authoritative signal is USPS's **DPV (Delivery Point V | _underscore/Component/Library/Carriers/Usps/Usps.php, _underscore/Model/Client/Address.php, _underscore/Model/Rate/Entitlement.php |

package/knowledge/2.0/apps/_underscore/features/apirequest-json-content-type.md

@@ -14,6 +14,7 @@ related:
   - ../../worker2/features/oneuptime-worker2-monitoring.md
   - ../../worker2/features/creating-worker-actions.md
   - ../../worker2/features/talos-transcript-ingestion.md
+  - togaiq-gateway-client.md
 ---
 
 ## Summary
@@ -49,11 +50,21 @@ case-insensitive scan of already-set headers, so a caller-supplied `Content-Type
   per attempt — that also gives you one api-log row per attempt.
 - **Transport failures surface as a thrown Exception** from `execute()` (the equivalent of
   `curl_error()`), not a return value. Catch it if your method has an error-return contract.
+- **The outbound log row is COMMITTED immediately — use it as proof a call happened.** When
+  logging is on (the default), `execute()` writes a `_Model_Client_Logs_Api` row with
+  `direction = 'OUT'` and calls `transactionCommit(DB_CLIENT_LOGS)` (`ApiRequest.php` ~lines
+  253–270), so the row **survives even if the surrounding request later rolls back**. That makes
+  `SELECT … FROM Logs_<Client>.Api WHERE direction = 'OUT'` definitive evidence of whether an
+  outbound call was ever *attempted* — the first thing to check when an integration "returns
+  nothing" (no row = the code never ran / was never deployed; a row with a null `responseCode` =
+  the two-phase logging issue below).
 - **Api logging depends on `DB_CLIENT_LOGS` being registered.** The logging branch writes via
   `_Model_Client_Logs_Api`, whose `DATABASE` const is `_underscore::DB_CLIENT_LOGS`. In a context
   that hasn't registered it (most workers, CLI harnesses) logging is a **silent no-op** — or
-  throws `Unknown database 'ClientLogs'`. Either register the logs DB under that alias or pass
-  `setLogging(false)` deliberately. See
+  throws `Unknown database 'ClientLogs'`. In a bare CLI script that never called
+  `_Database::registerClientDatabases()`, that throw comes out of `execute()` itself and **looks
+  like a broken integration** when the API call is fine. Either register the logs DB under that
+  alias or pass `setLogging(false)` deliberately. See
   [Creating Worker Actions](../../worker2/features/creating-worker-actions.md#gotchas).
 - **OPEN / not fixed: logging happens in two halves around the HTTP call.** `execute()` inserts
   the request row and **commits before** the call, then `save()`s the response fields **after**.
@@ -64,6 +75,13 @@ case-insensitive scan of already-set headers, so a caller-supplied `Content-Type
   pending architecture review. Do **not** work around it per-caller.
 
 ## Change history
+- 2026-08-05 — Documented (no code change) that the `direction = 'OUT'` api-log row is
+  **committed immediately** inside `execute()` (`transactionCommit(DB_CLIENT_LOGS)`), so it
+  survives a later rollback and `Logs_<Client>.Api` is definitive evidence of whether an outbound
+  call was attempted — the first diagnostic for a silent integration. Also noted that in a bare CLI
+  script without `_Database::registerClientDatabases()`, the logging branch throws
+  `Unknown database 'ClientLogs'` out of `execute()` and masquerades as a broken integration.
+  Surfaced building `_Component_Api_Togaiq`. (bala)
 - 2026-07-28 — Broadened from the Content-Type fix to the general `_ApiRequest` contract:
   documented the non-assoc `json_decode` response (returns `stdClass`), the `ENCODE__JSON`
   re-encode losing `JSON_UNESCAPED_*`, `setAutoRetry()`'s flat-delay/retry-all behavior,