toga-ai 1.0.907 → 1.0.908

package/knowledge/2.0/apps/_underscore/features/error-reporting-issue-event.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
+updated: 2026-09-28
 owners: ["dfranks", "jcardinal", "mhammontree", "ajean", "bala", "apeterson"]
 files:
   - _underscore/Error.php
@@ -687,6 +687,10 @@ read you feed it — `_Error` promotes a *"read property on int"* warning into a
 
 ## Gotchas
 
+- **`Logs.Issue` starts 2026-08-03 on prod — there are no rows before it.** The table went live with
+  that migration, so **any 500 older than 2026-08-03 has no Issue row at all**: looking its
+  `error.id` up returns nothing, and the `Logs.Api` row is the only record you get. An empty result
+  for an old error is the expected state, not a capture failure.
 - **⚠ A missing `Logs.Issue` column silently disables ALL error capture on that environment** —
   see the open defect above. Symptom: `identifiers.captureFailure` in the API response and nothing
   anywhere else.

package/knowledge/2.0/apps/_underscore/features/order-for-delegation.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-22
+updated: 2026-09-28
 owners: [bala, tcox]
 files:
   - _underscore/Model/Client/Users/DelegatorUser.php
@@ -122,6 +122,19 @@ paging. Two hard rules in
 - **api2 does log 4xx rows** (59 × 403 on client-sandbox in the last 30 days), so a missing 403 in
   `Logs_<Client>.Api` means the call never happened or hit another environment — check the host
   before blaming the log.
+- **⚠ `POST /v2/auth/delegator` 500s on a PUBLIC (logged-out) token — known, deliberately not
+  fixed.** `V2.php` L896 checks `property_exists($this->jwtPayload->id, 'delegator')`; when the
+  claim is absent the `else` reads `$this->jwtPayload->id->client->user->uuid` at **L903** with no
+  check that `user` exists. A public token's `id.client` is `{uuid, slug, roles, api}` and carries
+  **no `user` key**, so PHP raises *"Undefined property: stdClass::$user"* and the caller gets a
+  **500 `EO-1`** instead of a clean **401 `EN-3`**. The same file already guards this exact shape
+  ~50 lines lower (L952, the expired-token `elseif`: `property_exists($this->jwtPayload->id->client,
+  'user')`) — L903 is the one place that does not. Reachable **with no login**. Evidence:
+  `Logs.Issue` reference **T2**, 6 occurrences in 11 s on 2026-09-04 and none since; the failing
+  token decoded out of `Logs.Api.requestHeaders` was slug `Compass_Usa`, roles `[1,3]`, `api`
+  present, no `user`. **Decision (2026-09-28, bala): leave it.** Dormant and low impact; add the
+  one-line guard returning `DEFINED_MESSAGE_ERROR_INVALID_ACCESS_TOKEN` next time someone is in
+  that block — do not open a ticket for it.
 - **Role 3 (API) cannot reach this record.** Its grant for record 362 was written into `Core`, but
   `aclDatabase = CLIENT` means Core rows are never consulted — so no integration can read or write
   `user-delegator-users` through api2 until the grant is mirrored into each `Client_*` DB.
@@ -154,6 +167,8 @@ paging. Two hard rules in
 
 ## Change history
 
+- 2026-09-28 — Recorded the `/auth/delegator` public-token 500 at `V2.php` L903 (no `user` guard,
+  `Logs.Issue` T2) and the decision to leave it unfixed. (bala)
 - 2026-09-22 — Front end now switches the token, so the gate is live: recorded that
   `originalUserId` is still NULL on client-sandbox during a real Order For session, that the gate
   also returns 403 EZ-1 for admin View As of anyone off the list, and that api2 does log 4xx rows.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.907",
+  "version": "1.0.908",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",