toga-ai 1.0.968 → 1.0.970

package/.claude/settings.json

@@ -18,6 +18,15 @@
             "timeout": 3000
           }
         ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/toga/session-files.js\"",
+            "timeout": 3000
+          }
+        ]
       }
     ],
     "PreToolUse": [
@@ -182,6 +191,16 @@
             "timeout": 3000
           }
         ]
+      },
+      {
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/toga/session-files.js\"",
+            "timeout": 3000
+          }
+        ]
       }
     ],
     "SessionStart": [

package/knowledge/1.0/apps/tools/architecture.md

@@ -6,7 +6,7 @@ project: Tools
 client: shared
 type: architecture
 status: active
-updated: 2026-09-23
+updated: 2026-10-07
 owners: [jcardinal, kyalamarthi, ajean, mhammontree]
 files:
   - tools/index.php
@@ -61,6 +61,16 @@ No per-host `stylePath` subfolder — one `assets/css/style.css`. Uses TOGA Tech
 
 **All colour comes from a semantic token layer, `assets/css/theme.css`**, registered **first** in `App_FrameworkIndex_Tools::__construct()` so every other sheet resolves through it. The app supports light / dark / auto; the resolved theme is stamped on `<html>` as `data-theme` by an inline pre-paint script and the user's choice lives in `localStorage` (`toga-tools-theme`) — **not** the DB. The left sidebar and public header stay dark in **both** themes, which is why `toga-brandmark-white.png` still works everywhere. Login shows `toga-horizontal-colored.png` in light and `toga-horizontal-white.png` in dark. See `features/theme-light-dark.md`.
 
+## UI standard (internal tools)
+
+Developer standard (jcardinal, 2026-09): the team works on wide screens, so tool pages use the space.
+
+- **Wide-screen first (~1600px+).** Split-pane / master-detail (list left, detail right), one-row toolbars, meta laid out in grids. Never a vertical stack of full-width cards (the first `/emails` page was rejected for this).
+- **Real gaps + padding between cards**, clear hierarchy, easy-to-reach actions. Opt out of the 960px cap with `.tool--wide` (see Gotchas).
+- **Visible progress for anything that takes more than a moment:** a loading state, a real progress bar (N of total, %), and a live count of the work consumed (API calls, rows, budget left). Prefer honest per-step progress over a bare spinner.
+- **Polished controls:** style buttons/inputs with the theme tokens (`assets/css/theme.css`), never default gray buttons.
+- Check it in the browser (light + dark) before showing it.
+
 ## Home route
 
 `/` (`mvc/get.php`) renders a persona-filtered dashboard of available tools (tiles grouped by folder) when logged in, via `App_Nav::visibleGroups()`. When **not** logged in, `/` immediately routes to `/login` (one-step SSO sign-in — no intermediate welcome card). A persona-less but authenticated user gets the dashboard's explicit empty-state (see `features/persona-gated-navigation.md`).
@@ -93,4 +103,5 @@ Create `mvc/<folder>/<tool>/get.php` (copy `mvc/_TEMPLATE/get.php`), add one ent
 - **Framework-level Sentry error reporting is an open gap.** Prod printed "Sentry is not installed" because `sentry/sentry` was missing from `composer.json` (added `^4.10`; sibling apps use `^4.10`/`^4.19`). But even with Sentry in `vendor/`, the 1.0 framework does **not** auto-require `vendor/autoload.php` (the `App_Talos_S3` pattern `require_once`s it explicitly), so framework-level Sentry reporting for Tools still does not load. Any code path that needs a composer package must `require_once` the autoloader itself.
 
 ## Change history
+- 2026-10-07 — Added "UI standard (internal tools)": wide-screen split-pane layout, real gaps, visible progress + live counts, themed controls. (jcardinal)
 - 2026-09-23 — Added gotchas from the /emails build: input :not chain, 960px cap/.tool--wide, red btn-secondary, Origin/Referer CSRF. (jcardinal)

package/knowledge/1.0/apps/tools/features/central-ids.md

@@ -6,7 +6,7 @@ project: Tools
 client: shared
 type: feature
 status: active
-updated: 2026-09-25
+updated: 2026-10-08
 owners: [jcardinal]
 files:
   - tools/_/app/developers/centralids.php
@@ -28,7 +28,7 @@ Replaces tracking next central ids in the developer chat. Branches hold hardcode
 ## How it works
 - Storage: prod `Core.Parameters` (`id`, `uuid` char36 unique, `key` varchar64 unique, `value` varchar255), keys `NEXT_CORE_RECORDS_ID`, `NEXT_CORE_RECORD_FIELDS_ID`. Read via config `[database_toga2core]` (link `db_toga2core`; tools is prod-only).
 - Access: Developers folder, **Development Team** persona only — hardcoded `requireAuth` in `get.php` + `post.php`, narrowed in `nav.php`.
-- UI: one card per key showing stored value + table's current `MAX(id)`; number box + Save; "Take 1" saves shown value + 1.
+- UI: one card per key showing stored value + table's current `MAX(id)`; number box + Save; "Take 1" saves shown value + 1. "Copy for Claude" copies `Next Core.Records.id = N` / `Next Core.RecordFields.id = N` (labels from `KEYS`) from latest loaded/saved state; disabled until load; unset key → "not set"; `navigator.clipboard`, falls back to textarea + `execCommand('copy')` off secure context.
 - `App_Developers_CentralIds`: `all()`, `set($key, $newValue, $expected)`. `post.php` actions `load`, `set`.
 - Save rules: refused if value <= `MAX(id)` of the tracked table or > INT UNSIGNED max. Compare-and-set: `UPDATE ... WHERE value = expected`; missing row → `INSERT IGNORE` with `App_String::generateUuidV4()`. Loser of a race gets "someone changed this value". Table names only from hardcoded `KEYS` const. Each change `error_log`'d with user uuid.
 - First Save creates the Parameters row — no dbchanges2 file needed.

package/knowledge/2.0/apps/_underscore/INDEX.md

@@ -54,7 +54,7 @@
 | [Shipping Carriers & Carrier Account Numbers (records, matching, duplication, deletion)](features/shipping-carriers-and-accounts.md) | Per-client `ShippingCarriers` / `ShippingCarrierAccountNumbers` model, how the syncs match/create carrier rows, and the duplication + blank-carrier + pagination |
 | [_String helpers — ASCII-safe HTML entity encoding (and the parseBetween trap)](features/string-html-entity-helpers.md) | `_String` static string utilities: use `encodeToAsciiHtmlEntities` for any dynamic text going into a 2.0 email; open when escaping email text or parsing substri |
 | [Surface FIELD ↔ RecordField binding (maxLength / validationType / isWritable fold-in)](features/surface-field-recordfield-binding.md) | Resolver capability that folds `Core.RecordFields` input-contract metadata (maxLength/validationType/isWritable) onto a surface FIELD element; open when a 2.5 s |
-| [DEFERRED — re-key Client.SurfaceOverrides from numeric Core ids to uuids](features/surface-overrides-uuid-rekey.md) | Deferred: `Client.SurfaceOverrides.surfaceId`/`surfaceElementId` still point at Core rows by numeric id; open before a client's first override rows on an env wh |
+| [DECLINED 2026-10-08 — re-key Client.SurfaceOverrides from numeric Core ids to uuids](features/surface-overrides-uuid-rekey.md) | **Decision 2026-10-08 (jcardinal): keep numeric ids; no uuid re-key.** The plan below is not scheduled; see the Layer boundary in [surface-resolver](surface-res |
 | [Surface Resolver (_Model_Core_Surface::resolve — replaces Page::meta)](features/surface-resolver.md) | Runtime for the platform Surface UI layer (`_Model_Core_Surface::resolve`/`metaGroup`, replaces `Page::meta`); open for surface resolution, the override cascade |
 | [Table-View Hyperlink Columns (meta → ACL → computed URL → render)](features/tableview-hyperlink-columns.md) | How a 2.0 table-view column renders its value as a clickable link (`hyperlinkRecordFieldId` → ACL field-read → computed URL → render); open when a configured hy |
 | [TableView joins (TableViewJoins → SQL) — aliasing, chained multi-hop joins, ACL](features/tableview-joins.md) | How `TableViewJoins` rows become a view's join SQL — aliasing, chained multi-hop joins, ACL gating, and the three ways a view breaks; open before adding/rebasin |

package/knowledge/2.0/apps/_underscore/features/page-meta-context-field-settings.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-24
+updated: 2026-10-08
 owners: [tcox, bala, jcardinal, apeterson]
 files:
   - _underscore/Model/Core/Page.php
@@ -41,7 +41,7 @@ So a currency/dollar icon is a **type** problem (fix the field's `type` — Core
 
 **⚠ A CUSTOM record field's label row is UNREACHABLE from the grid header (legacy path only).** `Page.php` emits `ClientCustomRecordFieldSettings` in its own block (~L900–935) and keys it by a record route resolved through `$lookupRecordIdFromCustomRecordFieldId` → `$lookupRecordFromRecordId[...]->route`. For a column pointed at a `CustomRecordFields` row, that resolves to an **empty** record-route key — the row lands at `settings.fields[""][<field>][…]`, a bucket `convertColumnTitles` never reads. **A `ClientCustomRecordFieldSettings` `label-singular` row for a custom column is therefore dead metadata**, and no amount of adding/correcting those rows moves the header. (Measured 2026-08-26: two hours lost adding label rows that could never be read.)
 
-> **⚠ SCOPE — this "dead metadata" is the legacy `Page.php` / `toga2-supply` path ONLY. On the `toga25-supply` table path it WORKS.** `toga25-supply` reads its grid headers from `/table-views/meta` (`_Model_Client_TableView::meta()`), which fetches `ClientCustomRecordFieldSettings` directly — so a **base** custom-field column (both context columns NULL) IS labeled by a `ClientCustomRecordFieldSettings` row with `settingId = 5` (`Core.Settings.slug = 'label-singular'`), `isOverridable = 1`. Verified live 2026-09-10: exactly how `Client_Elite` labels its custom unit columns (`c_grade` → "Grade", `c_chargingBrick` → "Charging Brick", …), and how NYCHH's `_transferLocation` column on `units-for-items-for-purchase-orders` gets its "Location" header (`Client_Nychh/2026-09-10c - TransferLocationColumnLabel.sql`). Do **not** move a custom field to a Core `RecordField` just to get a header on a `toga25-supply` grid — the client custom-field settings row is enough. The dead-metadata trap above still holds for the old `Page.php` consumers.
+> **⚠ CORRECTION (2026-10-08): `/table-views/meta` does NOT carry labels.** `_Model_Client_TableView::meta()` reads the settings tables only to decide the context columns (`settings.contextTable` / `contextField`); it returns no label values. Grid header text comes from `/pages/meta` `settings.fields[<record route>][<field>]['label-singular']`. An earlier version of this note said `table-views/meta` fetches `ClientCustomRecordFieldSettings` and labels base custom-field columns directly. That is wrong. The Elite / NYCHH custom-column headers (2026-09-10 seeds, e.g. `Client_Nychh/2026-09-10c - TransferLocationColumnLabel.sql`) were seen live, but the label path that served them is not proven; re-check against `Page::meta` before relying on a client custom-field settings row for a header. Boundary for new apps: see "Layer boundary (2026-10-08)" in [surface-resolver](surface-resolver.md).
 
 Where the label must come from instead, for such a column:
 - **`Core.DefaultRecordFieldSettings`** on the underlying **Core** `RecordField`, or
@@ -103,3 +103,4 @@ Pages --< PageRecords >-- Records --< RecordFields
 
 ## Change history
 - 2026-09-24 — Documented the Core-only label chain (`Pages`→`PageRecords`→`RecordFields`→`DefaultRecordFieldSettings` `label-singular`, setting id 5) and that `Sections` are a separate path listing pages never have. (apeterson)
+- 2026-10-08 — Corrected: `/table-views/meta` returns no labels (header text = `/pages/meta` `settings.fields`). Frozen for old apps per the Layer boundary in surface-resolver (jcardinal)

package/knowledge/2.0/apps/_underscore/features/surface-overrides-uuid-rekey.md

@@ -1,12 +1,12 @@
 ---
-title: "DEFERRED — re-key Client.SurfaceOverrides from numeric Core ids to uuids"
+title: "DECLINED 2026-10-08 — re-key Client.SurfaceOverrides from numeric Core ids to uuids"
 framework: "2.0"
 repo: _underscore
 project: _Underscore
 client: shared
 type: feature
-status: deferred
-updated: 2026-09-29
+status: deprecated
+updated: 2026-10-08
 owners: [jcardinal]
 files:
   - _underscore/Model/Core/Surface.php
@@ -16,7 +16,7 @@ related:
   - surface-resolver.md
 ---
 
-Deferred: `Client.SurfaceOverrides.surfaceId`/`surfaceElementId` still point at Core rows by numeric id; open before a client's first override rows on an env whose Core can be rebuilt.
+**Decision 2026-10-08 (jcardinal): keep numeric ids; no uuid re-key.** The plan below is not scheduled; see the Layer boundary in [surface-resolver](surface-resolver.md). Was: `Client.SurfaceOverrides.surfaceId`/`surfaceElementId` still point at Core rows by numeric id; open before a client's first override rows on an env whose Core can be rebuilt.
 
 ## Summary
 
@@ -35,3 +35,4 @@ Planned fix (do before first client use on such an env):
 
 ## Change history
 - 2026-09-29 — Recorded as deferred after the nav-gate uuid fix exposed the same numeric-id risk (jcardinal)
+- 2026-10-08 — Declined: keep numeric ids, no uuid re-key (jcardinal)

package/knowledge/2.0/apps/_underscore/features/surface-resolver.md

@@ -6,7 +6,7 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-09-16
+updated: 2026-10-08
 owners: [jcardinal, apeterson, bala]
 files:
   - _underscore/Model/Client/Language.php
@@ -313,6 +313,20 @@ Same discipline as the reserved-id blocks: **read the id out of the target envir
 - **The meta-group dispatch grant is per-client-DB too.** A 403 EZ-1 on `meta-group` on dev-sandbox was the same mechanism as the original `meta` 403: the `meta-group` RecordScript needs its own per-role `Client.AclRecordScripts` dispatch grant. Verified via toga-db — `meta` script id 25 was granted roles 1/3/4 but `meta-group` (id 27) had **none** until the grant ran. Any new surfaces scripted-API method repeats this: record READ never authorizes dispatch.
 - **The meta-group grant is seeded per-tenant, not globally — new tenants repeat the 403.** When `meta-group` shipped, the `AclRecordScripts` grant was seeded **only** for `Client_Compass` (recordScriptId → roles 1,3,4). `Client_Quad` and `Client_CompassCanada` had **no** grant for the meta-group recordScriptId at all — their `meta` was granted to client role 1 (why `meta` worked but `meta-group` 403'd for the same user/token). Same-user-different-script + same-script-different-tenant is the fingerprint of this gap. Fix (2026-07-01): two `dbchanges2/Client_<tenant>/` migrations granting meta-group to **client role 1** (parity with each tenant's existing `meta` grant), id-agnostic (resolve `Core.RecordScripts` id by route/method/phpMethod, cross-DB read of `Core.*` per the 2026-06-29c ACL pattern) and re-runnable via `NOT EXISTS`. Surface-layer DB changes ship to the **beta** environment only. ⚠ **Root-cause not yet closed:** the meta-group grant should be added to the `dbchanges2/Client/` **baseline (blank) seed** so newly-cut clients get it automatically — otherwise the next migrated tenant hits the identical 403. Only Compass (already correct), Quad, and CompassCanada are addressed. Also note **role breadth**: Compass exposes surfaces to roles 1,3,4; Quad/CC got role 1 only (parity with their `meta`). If Quad/CC should match Compass, a follow-up migration aligning both `meta` and `meta-group` to roles 1,3,4 is needed.
 
+## Layer boundary (2026-10-08)
+
+Developer decision (jcardinal, 2026-10-08), platform apps (Desk, IQ, template). Which layer owns what:
+
+1. **Surface owns what users SEE.** `Core.Surfaces` / `SurfaceElements` / `Messages` + Client `MessageTranslations` + Client `SurfaceOverrides`: copy, labels, order, visibility, required, icons, colours. Client changes = `SurfaceOverrides` (client / persona / role); translations = `MessageTranslations`.
+2. **`*Settings` keeps ONLY preferences:** `language`, `date-format`, `time-format`, `time-zone`, `currency`, `persona`. One shared preferences resolver (to move from api2 `V2::resolveSettingValue` into `_underscore`), honouring `isOverridable`. UI keys are FROZEN, new apps never read them: `label`, `label-singular`, `icon`, `tooltip`, `placeholder`, `sort-order`, `is-required`, `default-value`, `min-required-siblings`, `max-required-siblings`.
+3. **Record + field names move to `Core.Messages`** (translatable) via message-id link columns on `Core.Records` / `Core.RecordFields`, first seeded from `DefaultRecordSettings` / `DefaultRecordFieldSettings` labels; until seeded, fall back to the settings label.
+4. **No per-user text overrides.** User choices = preferences, saved views, column order. Add a Surface lock only when a real need appears.
+5. **`SurfaceOverrides` keep numeric Core ids** in client DBs (no uuid re-key) - see [surface-overrides-uuid-rekey](surface-overrides-uuid-rekey.md).
+6. **Permissions** (record CRUD + field writable) get their own once-per-session call for new apps instead of `GET /pages/meta`. Shape TBD; table-based preferred; a scripted API needs the developer's OK.
+7. **Old apps** (`toga2-supply`, `toga2-commerce`) keep `GET /pages/meta` frozen: bug + security fixes only. `toga25-supply` (uses both) moves with the platform apps.
+
+Precedence is per layer and never mixed on one value: Surface = base < client < persona < role (language = filter); Settings = Default < Client < Persona < User (< Language where the reader applies it). Rejected: settings absorbs Surface; keep both + a rule. Detail: Desk ADR 0140 (Settings holds preferences only).
+
 ## Related
 
 - [surface-layer-schema](../../dbchanges2/features/surface-layer-schema.md)
@@ -322,3 +336,6 @@ Same discipline as the reserved-id blocks: **read the id out of the target envir
 - [sales-order-status-filter-surface](sales-order-status-filter-surface.md)
 - [surface-field-recordfield-binding](surface-field-recordfield-binding.md)
 - [side-navigation-and-default-route](../../toga25-supply/features/side-navigation-and-default-route.md)
+
+## Change history
+- 2026-10-08 — Added "Layer boundary": Surface owns what users see, `*Settings` = preferences only (jcardinal decision; see Desk ADR 0140) (jcardinal)

package/knowledge/2.0/apps/saml/features/acs-assertion-trust-gaps.md

@@ -6,12 +6,14 @@ project: SAML SSO Gateway
 client: shared
 type: feature
 status: active
-updated: 2026-10-02
+updated: 2026-10-07
 owners: ["rgirish", "mhammontree"]
 files:
   - saml/Controller/Index.php
   - _underscore/String.php
   - _underscore/Model/True/ClientAuthentication.php
+  - _underscore/Model/Compass/ClientAuthentication.php
+  - _underscore/Model/Core/ClientAuthentication.php
 related:
   - ../architecture.md
   - ./gateway-environments-and-redirect-safety.md
@@ -78,6 +80,40 @@ the window. App-side fix: a used-payload table. Gateway-side fix: nonce + iat +
 payload. Changing `encryptWithKey()` affects every caller — it is also
 the `?saml=` handoff and the api2 encrypted-user-uuid auth, so this is not a local change.
 
+## Planned fix (deferred 2026-09-25)
+
+Proposed, **not approved and not built** — deferred by the developer (jcardinal) as too large for
+that moment. Needs a `cto` pass (schema) and a `cso` review before any code.
+
+**Rollout — per client, LOG_ONLY then ENFORCE:**
+
+1. Add to `Core.ClientAuthentications_Sso`: `idpEntityIdentifier`, `idpSigningCertificate`,
+   `signatureMode` ENUM(`LOG_ONLY`, `ENFORCE`).
+2. Ship every SSO client in `LOG_ONLY` (verify the IdP signature, log the result, still allow).
+3. Flip a client to `ENFORCE` after one real login passes verification. No cert on file = refuse.
+
+**Turn on for everyone at once (no per-client stage):** reject unsigned assertions; check the
+assertion time window; Audience = our `/meta`; Destination = our `/acs`; RelayState expiry; bind
+RelayState's `domainUuid` to the SSO client (today `_underscore/Model/Core/ClientAuthentication.php`
+accepts any `domainUuid`).
+
+**Remove now-known unsafe code in the same change:**
+
+- **Compass backdoor:** `_underscore/Model/Compass/ClientAuthentication.php` (~lines 17-20) maps any
+  `@togatech.com` NameID straight to one fixed internal user. Combined with Gap 1, any trusted IdP can
+  sign in as that user. Remove it.
+- A comment near line ~235 of `saml/Controller/Index.php` holds a **real customer SAMLResponse**
+  (personal data). Delete it; never copy its content anywhere.
+
+**Inputs still needed (IdP metadata / signing certs):** Compass (Shibboleth IdP — the old commented
+code carries a cert valid to 2031), Rate (Okta metadata URLs — today stored in `entityIdentifier`),
+True + Compass Sandbox Client (Microsoft Entra — app metadata URL needed from the developer).
+`entityIdentifier` is used two ways today (our SP id for Compass/True, the IdP metadata URL for Rate)
+— settle that before adding the new columns.
+
+Prod SSO clients in scope (`Core.ClientAuthentications`, type SSO): Compass Group (Production,
+Sandbox Client), CompassCanada, Rate (Production, Beta), True.
+
 ## Gotchas
 
 - **Do not describe the gateway as "authenticating" anyone to a client or an auditor.** Until Gap 1
@@ -89,5 +125,6 @@ the `?saml=` handoff and the api2 encrypted-user-uuid auth, so this is not a loc
   citing this doc as sign-off.
 
 ## Change history
+- 2026-10-07 — Added "Planned fix (deferred 2026-09-25)": per-client LOG_ONLY → ENFORCE signature rollout, IdP metadata still needed, Compass `@togatech.com` backdoor + stored SAMLResponse comment to remove (jcardinal)
 - 2026-10-02 — Added Tools + TOGa Desk as affected consumers; recorded handoff replay (Gap 3) (mhammontree)
 - 2026-09-25 — Created; recorded that `/acs` verifies no IdP signature and no Audience/Destination/InResponseTo/NotBefore/NotOnOrAfter, and that RelayState uses unauthenticated AES-256-CBC with an attacker-supplied IV (rgirish)

package/knowledge/2.0/apps/toga2-commerce/features/view-as-session-tokens.md

@@ -6,7 +6,7 @@ project: TOGa Commerce
 client: shared
 type: feature
 status: active
-updated: 2026-10-05
+updated: 2026-10-07
 owners: [tcox, bala, apeterson]
 files:
   - src/api/sessionTokens.ts
@@ -96,11 +96,13 @@ Seeds a long-lived `ADMIN_ACCESS_JWT`; stubs `/auth/delegator` → `mock-delegat
 
 - On a 401 logout the in-memory zustand stores are not reset, so a store write in the ≤1.5s before the redirect can write `zu-cart` / `order-for-zu` back. Low risk: login runs `resetClientState` (cso NIT, 2026-09-30).
 - `SENTRY_AUTH_TOKEN` is committed in 25 tracked `.env*` files — treat it as compromised and rotate it. (Never store the value in this KB.)
+- **`GET /users/encryptedUser` permission gap (found 2026-09-25, deferred).** The RecordScript (`Core.RecordScripts` id 16; `_underscore/Model/Client/User.php` ~line 353, `@TODO` with no check) was granted in prod to ordinary roles across many clients (e.g. Compass Base + Manager), likely from `dbchanges2/Core/HISTORIC/2025/2025-01-13 - 55324 - GetEncryptedUser.sql`. Fix = a real permission check in code, not only pulling grants. The `canUserOrderForOtherUser` gate (Gotchas) covers it on beta / client-sandbox — confirm it is live in prod before closing this item.
 - ~~Confirm api2 authorizes `/auth/delegator` **server-side**~~ — **answered 2026-09-21:** it now re-checks `_Model_Client_User::canUserOrderForOtherUser` at mint time (and `/auth/refresh` re-checks it), so a captured encrypted pair cannot be replayed. See [order-for delegation](../../_underscore/features/order-for-delegation.md).
 - ~~The parked-token slot is shared with "Order For" — decide precedence~~ — **settled 2026-09-22:** one slot, no nesting; the mode is told apart by the Order For marker, not the slot.
 
 ## Change history
 
+- 2026-10-07 — Open item: `/users/encryptedUser` permission gap found 2026-09-25 (prod grants to ordinary roles); confirm the delegation gate is live in prod. (jcardinal)
 - 2026-09-30 — Order For merged onto the TRUE-81991 session layer on `_sandbox-client`: parked pair cleared via `AUTH_STORAGE_KEYS`; return and switch use `clearPersistedQueryCache`; a refresh that lost the identity race now returns the current token instead of `null` (stopped a false logout on return); View As `onError` restores the admin's language and logs out if the parked pair is gone. (tcox)
 - 2026-09-22 — Refresh identity binding upgraded to an epoch bumped on the view-as swap; `Bearer undefined` swap bug fixed. TRUE-81991 (`e546db3d`). (apeterson)
 - 2026-09-22 — Return moved to the shared `useReturnToOriginalUser` hook (state cleared before any await); mode now tested with `useIsViewAsActive` because Order For parks the same user; View As start calls `endDelegation()` and its cart-clear effect is gated; recorded the 403 EZ-1 when the target is not on the delegation list. (tcox)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.968",
+  "version": "1.0.970",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",

package/rules/common/git-workflow.md

@@ -113,20 +113,24 @@ Keep the description short (3–5 words). Use hyphens, not underscores.
 
 ## Commit messages
 
-Format: `type: short description`
+Format: `<TICKET>: <Subject>` — the same in every repo. It matches api2's CI check.
 
-Types: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`
+- `TRUE-79868: Use client default tax code when invoice tax code is blank`
+- `TRUE-80112: Add retry limit to NetSuite item sync`
 
-- `feat: add batch order processing worker`
-- `fix: null check on customer email before dispatch`
-- `refactor: extract order validation to dedicated class`
-- `docs: document recursive item fulfillment feature`
-- `test: add regression test for empty batch edge case`
-- `chore: update composer dependencies`
+Rules:
 
-The description is lowercase, present tense, under 72 characters. No period at the end.
+1. **Ticket prefix from the branch name.** ClickUp names the branch (e.g. `TRUE-79868`); the
+   ticket id matches `^[A-Z]+-\d+`. If the branch has no ticket id, ask the developer.
+2. **Subject starts with a capital letter.**
+3. **Imperative mood** — "Use", "Add", "Fix". Not past tense ("Used", "Added", "Fixed", "Updated").
+4. **80 characters max** for the whole subject line.
+5. **No period at the end.**
+6. **Not a single word** — the subject says what the commit does.
 
-If a commit is substantial, add a blank line after the subject and a body paragraph explaining the why.
+If a commit is substantial, add a blank line after the subject and a body explaining the why.
+
+Claude's work is committed with `/commit`, which commits only the files this session changed and writes the session notes into the message body (`Claude-Notes: v1`). Changes made by hand outside Claude may be committed the normal way.
 
 ## What never goes in commits
 

package/scripts/ci/pr-risk.js

@@ -0,0 +1,262 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * pr-risk.js — deterministic PR risk score for the TOGA PR summary reviewer.
+ *
+ * The model must NOT pick the risk level. This script does, from git facts only.
+ *
+ * Usage:
+ *   node pr-risk.js --base <sha> --head <sha> --repo <owner/name> [--out risk.json]
+ *
+ * Output JSON:
+ *   { level, reasons[], stats{...}, readFirstCandidates[], manualCommitList[] }
+ *
+ * No dependencies. Read-only git commands only.
+ */
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+
+// ---- Thresholds -------------------------------------------------------------
+const HIGH_LINES_THRESHOLD = 800;
+const MEDIUM_LINES_THRESHOLD = 300;
+const MEDIUM_FILES_THRESHOLD = 15;
+const READ_FIRST_LIMIT = 8;
+const GIT_MAX_BUFFER = 256 * 1024 * 1024;
+
+// ---- Repo / path rules ------------------------------------------------------
+const DB_REPOS = ['dbchanges2', 'dbchanges'];
+const CORE_REPOS = ['_underscore', 'library'];
+// Whole words only (after splitting camelCase and non-letters), so "author" does not match.
+const SENSITIVE_WORDS = new Set([
+    'acl', 'acls', 'auth', 'authn', 'authz', 'authentication', 'authorization', 'authorize',
+    'login', 'logout', 'token', 'tokens', 'saml', 'permission', 'permissions', 'oauth', 'sso',
+    'password', 'credential', 'credentials',
+]);
+const SHA_RE = /^[0-9a-f]{7,40}$/i;
+const SQL_FILE_RE = /\.sql$/i;
+const TEST_PATH_RE = /(^|\/)(test|tests|__tests__|spec)(\/|$)|\.(test|spec)\.[^/]+$/i;
+const LOCKFILE_RE = /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|composer\.lock|bun\.lockb)$/i;
+const GENERATED_RE = /(^|\/)(dist|build)\/|\.min\.[^/]+$|\.map$|(^|\/)INVENTORY\.md$/i;
+const PACKAGE_MANIFEST_RE = /(^|\/)(package\.json|composer\.json)$/i;
+const CORE_DB_REF_RE = /\b(Core|Forecast|Team)`?\.`?\w/;
+const CLIENT_DB_REF_RE = /\bClient_\w/;
+const NOTES_TRAILER_RE = /^Claude-Notes:\s*v1\s*$/m;
+
+function parseArgs(argv) {
+    const args = {};
+    for (let i = 0; i < argv.length; i++) {
+        const key = argv[i];
+        if (!key.startsWith('--')) continue;
+        const name = key.slice(2);
+        const next = argv[i + 1];
+        if (next === undefined || next.startsWith('--')) {
+            args[name] = true;
+            continue;
+        }
+        args[name] = next;
+        i++;
+    }
+    return args;
+}
+
+function git(args) {
+    // core.quotePath=false: non-ASCII paths come back as-is, not octal-quoted.
+    return execFileSync('git', ['-c', 'core.quotePath=false'].concat(args), {
+        encoding: 'utf8',
+        maxBuffer: GIT_MAX_BUFFER,
+    });
+}
+
+/** Split a path into lowercase words: camelCase, digits and any non-letter are breaks. */
+function pathWords(path) {
+    return path
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+        .split(/[^A-Za-z]+/)
+        .filter(Boolean)
+        .map((w) => w.toLowerCase());
+}
+
+function isSensitivePath(path) {
+    return pathWords(path).some((w) => SENSITIVE_WORDS.has(w));
+}
+
+function isTest(path) {
+    return TEST_PATH_RE.test(path);
+}
+
+function isGenerated(path) {
+    return LOCKFILE_RE.test(path) || GENERATED_RE.test(path);
+}
+
+/** Resolve rename notation like "dir/{old => new}/file" or "old => new" to the new path. */
+function resolveRenamePath(raw) {
+    if (!raw.includes('=>')) return raw;
+    const braced = raw.match(/^(.*)\{(.*) => (.*)\}(.*)$/);
+    if (braced) return (braced[1] + braced[3] + braced[4]).replace(/\/\//g, '/');
+    return raw.split(' => ').pop();
+}
+
+/** Per-file line counts. ignoreWhitespace=true uses -w, so CRLF/LF or re-indent churn is not counted. */
+function readFileStats(range, ignoreWhitespace) {
+    const flags = ignoreWhitespace ? ['--numstat', '-M', '-w'] : ['--numstat', '-M'];
+    const out = git(['diff'].concat(flags, [range]));
+    const files = [];
+    for (const line of out.split('\n')) {
+        if (!line.trim()) continue;
+        const [added, deleted, ...rest] = line.split('\t');
+        const path = resolveRenamePath(rest.join('\t'));
+        const isBinary = added === '-' || deleted === '-';
+        const lines = isBinary ? 0 : Number(added) + Number(deleted);
+        files.push({ path, lines });
+    }
+    return files;
+}
+
+function readDeletedPaths(range) {
+    const out = git(['diff', '--name-only', '--diff-filter=D', range]);
+    return out.split('\n').filter(Boolean);
+}
+
+function readAddedLines(range) {
+    const out = git(['diff', '-U0', '-w', '--no-color', range]);
+    return out
+        .split('\n')
+        .filter((line) => line.startsWith('+') && !line.startsWith('+++'))
+        .map((line) => line.slice(1));
+}
+
+function readCommits(base, head) {
+    const out = git(['log', '--no-merges', '--format=%H%x00%B%x1e', `${base}..${head}`]);
+    return out
+        .split('\x1e')
+        .map((chunk) => chunk.replace(/^\s+/, ''))
+        .filter(Boolean)
+        .map((chunk) => {
+            const [sha, body = ''] = chunk.split('\x00');
+            const subject = body.split('\n')[0].trim();
+            return { sha: sha.trim(), subject, hasNotes: NOTES_TRAILER_RE.test(body) };
+        });
+}
+
+function computeRisk({ repoName, files, rawLines, deletedPaths, addedLines, commits }) {
+    const high = [];
+    const medium = [];
+
+    const countedFiles = files.filter((f) => !isTest(f.path) && !isGenerated(f.path));
+    const linesChanged = files.reduce((sum, f) => sum + f.lines, 0);
+    const linesCounted = countedFiles.reduce((sum, f) => sum + f.lines, 0);
+    const notesCommits = commits.filter((c) => c.hasNotes);
+    const manualCommits = commits.filter((c) => !c.hasNotes);
+
+    if (DB_REPOS.includes(repoName) || files.some((f) => SQL_FILE_RE.test(f.path))) {
+        high.push('database change');
+    }
+    if (CORE_REPOS.includes(repoName)) {
+        high.push('edit to shared core — affects every app');
+    }
+    if (files.some((f) => isSensitivePath(f.path))) {
+        high.push('touches login or permissions');
+    }
+    const deletedTests = deletedPaths.filter(isTest);
+    if (deletedTests.length > 0) {
+        high.push(`${deletedTests.length} test file(s) deleted`);
+    }
+    if (addedLines.some((l) => CORE_DB_REF_RE.test(l) && CLIENT_DB_REF_RE.test(l))) {
+        high.push('a query may mix Core and a Client database — they are on different servers in production');
+    }
+    if (linesCounted > HIGH_LINES_THRESHOLD) {
+        high.push(`large change: ${linesCounted} lines (not counting tests and generated files)`);
+    }
+
+    if (linesCounted > MEDIUM_LINES_THRESHOLD && linesCounted <= HIGH_LINES_THRESHOLD) {
+        medium.push(`medium-size change: ${linesCounted} lines (not counting tests and generated files)`);
+    }
+    if (files.some((f) => PACKAGE_MANIFEST_RE.test(f.path) || LOCKFILE_RE.test(f.path))) {
+        medium.push('new or changed package');
+    }
+    if (manualCommits.length > 0) {
+        const noun = manualCommits.length === 1 ? 'commit has' : 'commits have';
+        medium.push(`${manualCommits.length} ${noun} no session notes`);
+    }
+    if (files.length > MEDIUM_FILES_THRESHOLD) {
+        medium.push(`${files.length} files changed`);
+    }
+    const whitespaceOnly = rawLines - linesChanged;
+    if (whitespaceOnly > MEDIUM_LINES_THRESHOLD) {
+        medium.push(`${whitespaceOnly} lines are whitespace or line-ending only (ignored)`);
+    }
+
+    let level = 'LOW';
+    let reasons = [commits.length > 0
+        ? 'small change with session notes on every commit'
+        : 'small change (no commits found in the range)'];
+    if (high.length > 0) {
+        level = 'HIGH';
+        reasons = high.concat(medium);
+    } else if (medium.length > 0) {
+        level = 'MEDIUM';
+        reasons = medium;
+    }
+
+    const readFirstCandidates = countedFiles
+        .slice()
+        .sort((a, b) => b.lines - a.lines || a.path.localeCompare(b.path))
+        .slice(0, READ_FIRST_LIMIT)
+        .map((f) => ({ path: f.path, linesChanged: f.lines }));
+
+    return {
+        level,
+        reasons,
+        stats: {
+            filesChanged: files.length,
+            linesChanged,
+            rawLines,
+            linesChangedExcludingTestsAndGenerated: linesCounted,
+            commits: commits.length,
+            commitsWithNotes: notesCommits.length,
+            manualCommits: manualCommits.length,
+        },
+        readFirstCandidates,
+        manualCommitList: manualCommits.map((c) => ({ sha: c.sha.slice(0, 7), subject: c.subject })),
+    };
+}
+
+function main() {
+    const args = parseArgs(process.argv.slice(2));
+    if (!args.base || !args.head || !args.repo || args.base === true || args.head === true) {
+        process.stderr.write('Usage: node pr-risk.js --base <sha> --head <sha> --repo <owner/name> [--out risk.json]\n');
+        process.exit(2);
+    }
+    if (!SHA_RE.test(String(args.base)) || !SHA_RE.test(String(args.head))) {
+        process.stderr.write('pr-risk.js: --base and --head must be commit shas (7-40 hex characters)\n');
+        process.exit(2);
+    }
+    const repoName = String(args.repo).split('/').pop();
+    const range = `${args.base}...${args.head}`;
+
+    const result = computeRisk({
+        repoName,
+        files: readFileStats(range, true),
+        rawLines: readFileStats(range, false).reduce((sum, f) => sum + f.lines, 0),
+        deletedPaths: readDeletedPaths(range),
+        addedLines: readAddedLines(range),
+        commits: readCommits(args.base, args.head),
+    });
+    result.repo = String(args.repo);
+
+    const json = JSON.stringify(result, null, 2) + '\n';
+    if (args.out && args.out !== true) {
+        fs.writeFileSync(args.out, json);
+    }
+    process.stdout.write(json);
+}
+
+try {
+    main();
+} catch (err) {
+    process.stderr.write(`pr-risk.js failed: ${err.message}\n`);
+    process.exit(1);
+}