The Trilogy Times

## Summary

Adds a Due Diligence dashboard powered by an LOI-anchored cohort sourced from REBL3's Postgres backend (via the internal REBL3_SUPABASE_MCP server, refreshed every 15 min into a Convex table). Ships:

- DD list view with status-tinted workflow columns and a cut-site toggle.

- DD per-site detail page redesigned around two tabs (Workflow Status, Agents) and a wiki-style right rail (Maps / Site Details / Property Details).

- Portfolio Kanban Prospecting column enriched with REBL3-only sites (those not yet in Rhodes) so Ops can see early-stage candidates.

## Cohort definition

LOI-anchored: every REBL3 site that has entered the LOI workflow at any status (cut / submitted / claimed / done), excluding globally-excluded sites. ~179 rows steady-state.

FROM rebl3_status loi
JOIN rebl3_sites s USING (site_id)
LEFT JOIN rebl3_status st       ON st.site_id      = s.site_id AND st.system      = 'strategy'
LEFT JOIN rebl3_status leasing  ON leasing.site_id = s.site_id AND leasing.system = 'leasing'
LEFT JOIN rebl3_status dd       ON dd.site_id      = s.site_id AND dd.system      = 'due-diligence'
WHERE loi.system = 'loi'
AND COALESCE(s.excluded, FALSE) = FALSE
ORDER BY s.region, loi.updated_at DESC;

Strategy / leasing / DD are LEFT JOINs — they enrich each row but don't filter inclusion. Cut LOIs are intentionally cached so the DD page can opt into showing them via the Show cut sites checkbox; the Portfolio merge filters cut sites at render time on cut_by.

### How to broaden / narrow

Edit COHORT_SQL in [chat/convex/activeSitesCohort.ts](chat/convex/activeSitesCohort.ts):

| Alternative | ~Count | SQL change |

|---|---|---|

| Current (LOI any-status) | ~179 | WHERE loi.system = 'loi' |

| LOI completed only | ~61 | append AND loi.status = 'done' |

| LOI in flight or done | ~93 | append AND loi.status IN ('submitted','claimed','done') |

| Strategy-active | ~48 | flip anchor to rebl3_status st, WHERE st.system = 'strategy' AND st.status IN ('start','sign') |

| DD-anchored | ~82 | flip anchor to rebl3_status dd, WHERE dd.system = 'due-diligence' AND dd.status IN ('complete','data-gathering','follow-up') |

If new columns are needed, add them to the SELECT + the schema in [chat/convex/schema.ts](chat/convex/schema.ts) in lock-step.

## Refresh cadence + failure mode

- Every 15 minutes — Convex cron ([chat/convex/crons.ts](chat/convex/crons.ts)) runs the SQL via the MCP and upserts into activeSitesCohort.

- Worst-case staleness — 15 minutes. Dashboard reads from the table; no live REBL3 calls in the request path.

- MCP unreachable — cron logs and exits cleanly; last-good cohort persists; dashboard renders normally with stale data.

- Cold-start on deploy — sync-worker boot-time HTTP trigger ([sync/src/analytics-worker/cohort-trigger.ts](sync/src/analytics-worker/cohort-trigger.ts)) warms the cache before the first cron tick.

## DD list view

- Workflow column split into 4 sortable columns: Strategy, LOI, Lease, DD. Values render as moderate tone-tinted pills:

- done / complete → green

- cut / kill / killed / rejected → red

- claimed / submitted / start / sign / negotiating / collecting-feedback / data-gathering / follow-up → accent

- unknown → neutral

- "Show cut sites" checkbox in the filter bar; default unchecked; URL-backed via ?showCut=1 for shareability. Cut sites are cached but hidden by default at render time.

- Search input relocated from the cohort header into the filter bar, left of the State dropdown.

- Removed columns + filters: Score, Type, Listing.

## DD per-site detail page

Redesigned into a two-column wiki layout (max-w-7xl; ~340px right rail; collapses to single column on mobile).

Sticky header — site name + classification chip + region/state + In-Rhodes link.

Left/main column — URL-backed tabs (?tab=workflow|agents):

- Workflow Status tab (default) — 5 per-system cards in workflow order: Strategy → LOI → Leasing → Due Diligence → Parents. Each card surfaces Ops-actionable fields with structured bodies (no JSON dumps). Highlights:

- Color-coded status pills (success / in-progress / danger / muted) per known REBL3 status enum.

- LOI card: prominent Screening grade (GREEN/YELLOW/RED) + score; deal terms grid (landlord, broker, lease length, $/SF, annual cost, escalation, free rent, security deposit, break option); LOI document link.

- DD card: prominent GO / NO-GO badge; report link; side-by-side Fast Open + Max Cap scenarios (capacity / capex / projected open).

- Leasing: pipeline stage, claimed-at, "Needs Zeke confirmation" warning chip when set.

- Parents: deadline, vote tally (interested / not_here / unique), detail page link.

- Audit/housekeeping fields (slug_dup_*, imported_from, backfilled_at, mirrored_at, changes, synced_at, writeback_flagged, normalized_from) intentionally dropped.

- Agents tab — 11 cards in Operations priority order. Real estate has already approved the acquisition; Ops inherits the site, so the order favors physical/operational realities and RE-flagged concerns over acquisition economics:

1. Acquisition Summary — RE team's verdict + dimension scores. Prominent "RE flagged concerns" banner when cutBy non-empty.

2. Building — physical reality (condition, entrance, parking, size, positives + tradeoffs).

3. Outdoor Play — daily Ops concern: on-site space, closest/best park, top 6 nearby parks with walk times.

4. Vision Inspection — photo-analysis red flags + positive signals, outdoor play details.

5. Co-Tenancy — exclusive use, building type, dangerous-tenants count.

6. Zoning — operational permissions: K-12 by-right vs CUP, zoning code/city.

7. Neighborhood — name, character, crime/safety, family life.

8. Web Diligence — color-coded risk-level badge; facility type; primary occupant; signals.

9. Proximal Environment — businesses count, character, notable nearby.

10. Demographics & Schools — qualifying schools (10m), available children (10/20/30m).

11. Nearby Schools — existing component with Mapbox map widget.

12. Cost — collapsed by default; lease economics for budget reference only.

Right rail (340px):

- Collapsible Maps card — aerial + street images stacked vertically.

- Site Details card (existing pros/cons synthesis bullets).

- Property Details card (existing 6-stat grid).

## Portfolio Kanban — Prospecting REBL3 merge

Extends the Portfolio dashboard's Kanban to inject REBL3-only sites into the Prospecting column so Ops can see early-stage candidates that aren't yet in Rhodes.

- Parallel Convex query against activeSitesCohort on the Portfolio page; client-side merge with the Rhodes payload.

- Dedupe by slug — Rhodes wins; only REBL3 sites with no matching Rhodes slug appear.

- Cut sites filtered out of the synthetic cards (cut_by IS NOT NULL).

- Synthetic PortfolioSite rows: slug/name=address, phase: "prospecting", source: "rebl3" discriminator. Card UI shows a small REBL3 pill in place of the DRI bubble; clicking links to the DD detail page (Rhodes detail would 404).

- Kanban only — list view stays Rhodes-only. Other Diligence sub-buckets (Conducting Diligence / Acquiring Property) unchanged.

- Editing REBL3 cards is out of scope; deferred to a future PR (REBL3 → Rhodes ingest).

## What this PR is NOT

- Not a sync of REBL3's tables. We cache the result of one targeted SQL query (~179 rows). Aligns with the team-lead directive that REBL3 is an entry point being deprecated long-term.

- Not a runtime cohort-config knob. SQL is hardcoded; the table above is the documented broadening path.

When REBL3 is deprecated, this dashboard goes away by deleting one cron entry, the activeSitesCohort table, the action file, the MCP-client file, the boot-trigger helper, and the route file.

## Backward compatibility

- Bookmarked URLs with ?mode=green|yellow|cut still parse — mode is accepted but no longer filters.

- The portfolio board's Diligence stage header navigates to this dashboard like Buildout/Operating already do (drops the "not available yet" tooltip).

## Notable file additions / deletions

- New: [chat/convex/lib/mcpSse.ts](chat/convex/lib/mcpSse.ts) — single-shot MCP-over-SSE client.

- New: [chat/convex/activeSitesCohort.ts](chat/convex/activeSitesCohort.ts) — refresh action, upsert mutation, dashboard query, boot-trigger HTTP action.

- New: [chat/convex/schema.ts](chat/convex/schema.ts) activeSitesCohort table.

- New: [chat/components/dashboards/due-diligence/workflow-status-panel.tsx](chat/components/dashboards/due-diligence/workflow-status-panel.tsx) — 5 per-system Workflow Status cards.

- New: [chat/components/dashboards/due-diligence/agents-panel.tsx](chat/components/dashboards/due-diligence/agents-panel.tsx) — 11 Ops-priority Agents cards.

- New: [sync/src/analytics-worker/cohort-trigger.ts](sync/src/analytics-worker/cohort-trigger.ts) — boot-time warm-up.

- Deleted: grouped-sub-agent-sections.tsx + test, rebl3-due-diligence-cache.ts, due-diligence-filter-spec.ts, due-diligence-mode-tabs.tsx (replaced or obsolete).

## Required env var

REBL3_SUPABASE_MCP must be set in the Convex environment (in .env.local and via npx convex env set --prod REBL3_SUPABASE_MCP "..." for prod). Without it the cron logs and exits cleanly; the dashboard renders an empty-state message.

Also: MAPBOX_ACCESS_TOKEN for the Maps card + Nearby Schools map.

## Verification

- [x] pnpm typecheck workspace-wide clean (chat + sync + infra + contracts).

- [x] pnpm test 3,825 / 3,825 pass.

- [x] pnpm exec biome check chat/ clean.

- [ ] Visit /dashboards?tab=due-diligence while signed in — confirm <1s load, ~93 rows visible (cut hidden by default), tone-tinted workflow pills per row.

- [ ] Toggle "Show cut sites" — confirm cut rows appear, URL gains ?showCut=1, link is shareable.

- [ ] Click a row — detail page loads with the Workflow Status tab default; switching to Agents preserves via ?tab=agents.

- [ ] Visit a site with rich agent data (e.g. 620-5th-ave-s-kirkland-wa) — confirm Acquisition Summary's dimension grid + Building / Vision / Outdoor Play render structured bodies, no JSON dumps.

- [ ] Visit Portfolio Kanban — confirm Prospecting column shows REBL3-only cards with a "REBL3" pill; clicking links to the DD detail page.

- [ ] Wait 16 minutes — confirm cron tick happened (fetchedAt advances on cohort rows).

## Why

Post-deploy testing flagged the Portfolio detail card showing empty Due Diligence for sites that hadn't been edited through Aerie's admin UI, even when REBL3 held the data. The card reads through /api/portfolio-sites/[slug]/fields → Rhodes, so anything not in Rhodes' cached dueDiligence field never surfaces.

## Root cause

PR #142 (DD writeback) moved REBL3→Rhodes mirroring out of the daily merger in sync/src/upstream/rhodes/sync.ts because the per-slug REBL3 enrichment was stalling the analytics-worker boot loop. Removing the merger also took out the setDueDiligence writeback it had been doing as a side-effect — leaving Rhodes' DD mirror frozen at whatever it was the moment that PR landed. Aerie-side saves still kept their own slug fresh, but no automation kept the rest of the inventory aligned with REBL3.

## Fix

Re-attach the Rhodes mirror inside the Convex cron _refreshAllDdCache, which doesn't share the analytics-worker stall constraint that drove the merger's removal:

- Cron iterates Rhodes' own inventory via /sync/aerie/listSites?view=identity (was: paginated schools table). Rhodes is the right iteration source — it's the actual write target, naturally bounded to the post-LOI working set, and sidesteps Aerie schools rows being missing for sites Rhodes added without a schools-sync trip.

- Per slug: REBL3 GET → cache write → Rhodes setDueDiligence POST. Empty REBL3 projections (404 → {}) skip the Rhodes POST so we don't clobber anything Rhodes legitimately holds for un-populated slugs.

- Failure isolation: a Rhodes write failure logs + counts but does not roll back the cache write. Next cron tick retries.

- Counters split out so a degraded run is visible: rhodesOk / rhodesFailed / rhodesSkipped plus an outcome breakdown (updated / no_change / not_found / other) that catches the silent-no-op case where Rhodes accepts the write but doesn't change anything.

- Synchronous REBL3→Rhodes is unchanged: _writeDdPipeline (admin + portfolio saves) still POSTs to Rhodes after every successful REBL3 PATCH.

Editor read paths in field-editor.tsx / save-routing.ts are unchanged — only the comments are updated to reflect the new state (schools.dueDiligence IS now kept aligned, but the editor still reads REBL3 live so a partial admin payload merged through strictReplaceRebl3Details can't drop content keys a stale cache hadn't observed yet).

## New diagnostic

debugDdRefreshForSlug action — surfaces every layer of the REBL3→Rhodes chain for one slug:

- schoolsRow, rebl3SitesRow, rebl3DdCacheRow from Aerie tables

- rebl3LiveProjection from a live REBL3 GET

- rhodesPayload from aerieToRhodesPayload(rebl3LiveProjection)

- cronWouldIterate — whether Rhodes' inventory currently includes the slug

- notes[] — human-readable diagnostics for missing rows / empty projections / clobber risk

- rhodesOutcome — only when dryRun: false (replays the cron's Rhodes write)

dryRun defaults to true. Gated on canManageSchoolFields to match the production write path — without that gate, any signed-in user could replay the Rhodes write for any slug.

## Verification

- pnpm exec vitest run convex/dueDiligence.test.ts → 40/40 green

- Adds 9 cron tests covering the new flow (Rhodes-driven iteration, REBL3-404 → skip Rhodes, Rhodes 500 doesn't roll back cache, payload shape pin, outcome split, unknown outcome → other, listSites HTTP failure aborts cleanly)

- Adds 2 gate tests for the diagnostic (anon → Unauthenticated; non-admin → canManageSchoolFields)

- Removed the new requirePermission line and re-ran: both gate tests fail. Confirmed the gate is exercised, not bypassed by a different error path.

- tsc --noEmit clean across chat/ and sync/

- biome check clean on the 6 touched files (3 pre-existing warnings live in untouched files)

## Files

- chat/convex/dueDiligence.ts — Rhodes-driven cron iteration, per-slug Rhodes mirror, counters, gated debugDdRefreshForSlug action

- chat/convex/dueDiligence.test.ts — cron tests rewritten/added; diagnostic gate tests added

- chat/convex/crons.ts — comment updated to mention the Rhodes mirror leg

- chat/components/admin/school-fields/field-editor.tsx + save-routing.ts — comment updates only (cache-alignment posture)

- sync/src/upstream/rhodes/sync.ts — comment updated to call out the dueDiligence exception (covers both writeDueDiligence admin and writePortfolioDueDiligence portfolio paths)

## Deploy notes

- Cron will start hitting Rhodes' setDueDiligence on next tick after deploy. Existing env vars (RHODES_CONVEX_SITE_URL, RHODES_API_KEY) are already in place — no env changes needed.

- First post-deploy run will surface drift via the new counters: expect non-zero rhodesOutcomes.updated on the first tick as Rhodes catches up to REBL3 truth, then no_change dominating from there.

## Demo

<img width="2199" height="1644" alt="image" src="https://github.com/user-attachments/assets/c3ece8ef-46c3-4a94-844b-9e4722945e33" />

## Summary

End-to-end Kubernetes support for SaaS Budgeting, mirroring the Docker pipeline. After merging main (which shipped KLAIR-2608, the v3 slots-keyed simulated-budget storage model, plus its own spec 13 tab-scoped-attach-button), the branch's k8s specs were renumbered 13–16 → 14–17 and spec 17 was rewritten on top of the new slots model.

- Spec 14 — feat(saas-budgeting): K8s ingestion pipeline + schema

- aws-saas-budget-scripts/pipeline/: introduce UnitTypeConfig-driven dispatch in drive_client.py (DOCKER_CONFIG + K8S_CONFIG). New pipeline/k8s_ingest.py mirrors docker_ingest.py; registered in main.py so --ingest k8s (or --ingest all) routes through it. INGEST_ORDER_FOR_ALL = ("mappings", "databases", "docker", "k8s").

- Schema: add NULL-able memory_limits_used_gbs DOUBLE PRECISION to core_finance.aws_spend_saas_budget_unit_consumption. Existing docker rows hold NULL there; new k8s rows hold NULL in memory_max_sum_gb_last_7_days (exactly one of the two metric columns is populated per row).

- New scripts/sql/alter_aws_spend_saas_budget_unit_consumption_add_k8s_metric.sql migration for the prod runbook (operator runs once before first k8s ingest).

- Two spec-12 followup fixes folded in: --min-year filter to skip the historical Drive backlog, and Drive duplicate (year, week) resolution by newer modifiedTime instead of hard-failing.

- Spec 15 — feat(saas-budgeting): unit_type-parameterized backend + Kubernetes Usage tab

- Backend: drop hardcoded UNIT_TYPE = "docker" constant; thread unit_type: Literal['docker','kubernetes'] (default docker for back-compat) through /quarters, /weeks, /table. Service projects the appropriate metric column via _MEMORY_COLUMN_BY_UNIT_TYPE. Cache keys partition by unit_type.

- Frontend: generalize useSaaSBudgetingTable and useSaaSBudgetingQuarters with optional unitType last arg. SaaSBudgetingTable becomes a unitType-driven dispatcher.

- New 4th tab Kubernetes Usage in SaaSBudgetingSection.tsx (order: AWS Spend → Adjustments → Docker Usage → Kubernetes Usage). Both panels stay mounted via hidden={...} so toggling tabs preserves card state.

- Spec 16 — feat(saas-budgeting): Kubernetes cost backend + Tax exclusion

- New /api/aws-spend/saas-budgeting/kubernetes-cost endpoint, symmetric to /docker-cost. Shared _get_cost_by_week_for_tag helper in cost_explorer_service.py consolidates Docker + K8s Cost Explorer fetches and excludes the Tax RECORD_TYPE so allocated totals match the rest of AWS Spend.

- K8s Usage tab gets the full Docker treatment: Pin (Attach) + DollarSign (Fetch Cost & Allocate). kubernetesCostAllocation.ts exposes extractBuClassKubernetesCosts; allocation math reuses the unit-type-agnostic helpers in dockerCostAllocation.ts (computeAllocation, decorateSectionsWithCostAllocation, decorateFlatRowsWithCostAllocation).

- New useSaaSBudgetingKubernetesCost hook (storage key aws-spend.saas-budgeting.kubernetes-cost.v1) parallels the Docker hook.

- Spec 17 — feat(saas-budgeting): attach Kubernetes to simulated budget (rewritten on top of v3 slots model)

- Extend SlotId union: 'awsSpend' | 'docker' | 'kubernetes' | 'adjustments'. K8s tab Attach writes a snapshot to budget.slots.kubernetes, no migration needed.

- simulatedBudgetMerge.ts: outer-join now spans four sources. BU ordering: AWS first-appearance → Docker-only → Kubernetes-only → adjustment-only. Per-cell Total = sum of non-null source values; all-null collapses to null.

- SimulatedBudgetCard.tsx: new Kubernetes $ column between Docker and Adjustments. SLOT_ORDER updated; staleness chip + per-source captions cover the new slot.

## Test plan

- [ ] Operator: apply aws-saas-budget-scripts/scripts/sql/alter_aws_spend_saas_budget_unit_consumption_add_k8s_metric.sql against staging Redshift (ADD COLUMN is metadata-only, no backfill required)

- [ ] Operator: dry-run the k8s ingest against staging — uv run python -m pipeline.main --ingest k8s --dry-run

- [ ] Hit /api/aws-spend/saas-budgeting/quarters?unit_type=kubernetes from a super-admin session and verify it returns k8s-only quarters

- [ ] Open the SaaS Budgeting page, click the Kubernetes Usage tab, confirm the empty-state when no k8s data is ingested for the applied quarter

- [ ] After ingesting at least one k8s week, confirm the Kubernetes Usage tab renders the table with the "Total Mem Limits (GB)" column header and both Pin (Attach) and DollarSign (Fetch Cost & Allocate) buttons present

- [ ] Click DollarSign → confirm /api/aws-spend/saas-budgeting/kubernetes-cost returns and the allocated cost decorations appear inline

- [ ] Click Pin on the K8s tab → confirm the Simulated Budget card now shows a Kubernetes $ column populated for the attached BU/class rows; staleness chip clears

- [ ] Confirm the Docker Usage tab still renders unchanged (Pin / Attach + Fetch Cost & Allocate buttons present, totals unaffected)

- [ ] pnpm lint:pr clean; pnpm tsc --noEmit clean; pnpm test green; pytest tests/saas_budgeting/ green; pytest aws-saas-budget-scripts/tests/ green

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Demo

<img width="2222" height="1636" alt="image" src="https://github.com/user-attachments/assets/abf0c7c3-d4b8-49b1-af05-5282169cdf2d" />

## Summary

Promotes Bedrock to a first-class spend source in the SaaS Budgeting view of the AWS Spend dashboard, parallel to AWS Spend and Docker Usage. Adds a dedicated Bedrock tab with full table parity to the AWS Spend tab and a Bedrock column on the Simulated Budget card. Continuation of the existing saas-budgeting feature (specs 14 + 15) alongside specs 04/05 (AWS Spend) and 07/08/09 (Docker).

Linear: [KLAIR-2609](https://linear.app/builder-team/issue/KLAIR-2609/saas-budgeting-dedicated-bedrock-tab-column-on-simulated-budget)

## Specs

1. [14-bedrock-only-backend-mode](features/aws-spend/saas-budgeting/specs/14-bedrock-only-backend-mode/spec.md) — Replaces the binary include_bedrock query param with a tri-state bedrock_mode: 'exclude' | 'include' | 'only' (default 'exclude') on GET /api/aws-spend/saas-budgeting/aws-net-amortized-table. New service branch uses SUM(c.cost_amount) FILTER (WHERE is_ai_service(...)) (the row-level analog of the existing cost - cost_excl_bedrock precedent). In 'only' mode, BU/Class rows whose every week is null/zero drop out so the Bedrock tab isn't cluttered with empty rows; the canonical week axis is preserved so the Bedrock tab stays axis-aligned with AWS Spend.

2. [15-bedrock-tab-and-simulated-budget-column](features/aws-spend/saas-budgeting/specs/15-bedrock-tab-and-simulated-budget-column/spec.md) — Parameterizes AWSSpendCard and useSaaSBudgetingAWSSpend(quarter, bedrockMode) so AWS Spend and Bedrock tabs share one component / one hook (chosen over clone-and-rename). Adds a Bedrock tab between AWS Spend and Adjustments with full UnifiedTable parity (BU → Class → Account hierarchy, per-week columns, Total + Quarterly Projection, WeekChipFilter default-last-4, CSV export bedrock-net-amortized-{quarter}, all loader/error/empty states with Bedrock-flavoured copy). Bedrock variant omits the optional unmapped prop — no Unmapped Bedrock Accounts band per the spec. Adds a Bedrock column to SimulatedBudgetCard between AWS Spend and Docker $; final order: BU/Class | AWS Spend | Bedrock | Docker $ | Adjustments | Total. Extends simulatedBudgetMerge to outer-join 4 sources and adds an anyWeekKeyMismatch tri-source check for the week-mismatch chip. useSimulatedBudget storage bumps from v3 → v4 with a new bedrock slot; pre-v4 entries are ignored (no migration — internal tool).

## Implementation summary

Backend (klair-api):

- services/saas_budgeting_aws_spend_service.py — new _cost_expr_and_filter helper; get_aws_net_amortized_table and _fetch_quarter_cost_weeks thread bedrock_mode through; row-drop in 'only' mode

- routers/saas_budgeting_router.py — query param swap; Bedrock-specific empty-state message

Frontend (klair-client):

- services/awsSpendApi.ts — getSaaSBudgetingAWSSpendTable swaps includeBedrock for bedrockMode; getSaaSBudgetingAWSUnmapped unchanged

- screens/AWSSpend/hooks/useSaaSBudgetingAWSSpend.ts — new optional bedrockMode arg; default 'exclude'

- screens/AWSSpend/components/SaaSBudgeting/AWSSpendCard.tsx — props lifted; unmapped prop now optional; variant strings (cardTitle, csvFileNamePrefix, emptyStateCopy)

- screens/AWSSpend/components/SaaSBudgeting/SaaSBudgetingSection.tsx — Bedrock tab + handler; two <AWSSpendCard> instances

- screens/AWSSpend/components/SaaSBudgeting/SimulatedBudgetCard.tsx — Bedrock column + caption

- screens/AWSSpend/components/SaaSBudgeting/simulatedBudgetMerge.ts — tri-source outer-join + anyWeekKeyMismatch

- screens/AWSSpend/components/SaaSBudgeting/useSimulatedBudget.ts — v4 storage + bedrock slot

## Out of scope (deferred)

- Re-classifying isBedrockAdjustment adjustment rows into the Bedrock column

- Toolbar toggle on the AWS Spend tab to flip Bedrock inclusion at runtime

- Changing how Bedrock cost is computed upstream

- Unmapped Bedrock Accounts sub-band

- Migrating pre-v4 simulated-budget snapshots (intentional hard cut)

## Test coverage

- Backend: 42 / 42 passing in tests/services/test_saas_budgeting_aws_spend_service.py + tests/routers/test_saas_budgeting_aws_spend_router.py. Includes new TestGetAWSNetAmortizedTableBedrockOnly class with 6 service tests (mode branches, row-drop edge cases, axis preservation, conservation invariant only + exclude = include) and 5 new router tests (tri-state forwarding, 422 on invalid mode, Bedrock-specific empty message).

- Frontend: 137 / 137 passing across SaaS Budgeting test files. Includes 10 new tests: 3 for buildGroups tri-source outer-join and 7 for anyWeekKeyMismatch (covering all pair permutations and absent-source cases). Existing tests updated for bedrockMode + v4 storage migration.

## Self-review

No issues found. Backend: SQL semantics correct (FILTER clause matches the cost - cost_excl_bedrock precedent), row-drop predicate handles all-None / all-zero / mixed edge cases, axis preserved in 'only' mode. Frontend: tab order correct (Bedrock between AWS Spend and Adjustments), column order correct, Bedrock variant correctly omits unmapped band, v3→v4 hard cut never reads stale keys, anyWeekKeyMismatch correctly returns false for 0/1 sources.

## Test plan

- [ ] Open SaaS Budgeting tab on AWS Spend dashboard, switch to Bedrock tab — verify table renders with Bedrock (Net Amortized) title, BU → Class → Account hierarchy, W{n} columns, Total ($) and Quarterly Projection ($) columns

- [ ] Click "Attach to Simulated Budget" on Bedrock tab — verify toast Attached N BU/Class rows to simulated budget (Bedrock)

- [ ] Verify Simulated Budget card renders Bedrock column between AWS Spend and Docker $

- [ ] Switch back to AWS Spend tab — verify it still excludes Bedrock (no regression)

- [ ] Verify CSV export from Bedrock tab uses filename bedrock-net-amortized-{quarter}

- [ ] Pre-v4 localStorage entries should be silently ignored (no crash, no migration prompt)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

The QTD report's variance-coloring AND-gate (|var| ≥ \$25K AND |pct − 100| ≥ 5pp) under-flags Net Profit / EBITDA on high-margin BUs. A material dollar miss reads as a small percentage gap against a large bottom-line baseline, so the row stays uncolored even when the parents (Total Revenue, Gross Profit) are red — exactly the visual contradiction the executive-scannability framing was meant to prevent.

This change adds a bottom_line flag to _color_for_line and _plan_status that drops the pp leg for NP / EBITDA / combined NP-EBITDA rows and the QTD Net Profit KPI tile only, keeping the \$25K dollar gate so trivial-noise suppression continues everywhere else.

## Audit across all 20 distributed Q2 FY2026 reports

| Unit | Row | Variance | pp gap | Before | After |

|---|---|---|---|---|---|

| GFI | NP | −\$57,712 | 2.72pp | black | red |

| GFI | EBITDA | −\$86,498 | 4.08pp | black | red |

| JigTree | NP | +\$86,656 | 1.71pp | black | green |

| JigTree | EBITDA | +\$82,287 | 1.62pp | black | green |

The other 18 reports render identically — every other NP/EBITDA cell either already cleared the AND-gate (still colored) or has variance \<\$25K (still correctly suppressed). Line items, section totals (Total Revenue / Total COGS / Gross Profit / Total Expenses), margins, KPI band Revenue tile, vendor / customer tables, action items, and LLM commentary are all unchanged.

## Why an OR-gate didn't work

A pure OR-gate (color when |\$| ≥ \$25K OR |pp| ≥ 5pp) re-introduces noise on CFs with budget ≤ 0 — the pp branch trivially passes (_color_for_line skips it for non-positive budgets), so a \$2K NP variance on COO Service or a \$692 variance on New Renewals would paint colored. Dropping the pp leg only for explicitly-flagged bottom-line rows is the surgical fix.

## Visual verification

Fix-preview docs (skipped the ledger to keep the production UI clean):

- GFI — https://docs.google.com/document/d/1QmgHV5AiMJZ2IJvxoSl6hSe6Yqq9-m_6T4dXN7gAwKI/edit

- JigTree — https://docs.google.com/document/d/1wYlVttpJ756da27nnq9zKbqNPyqa8c8cCFt2fYEztyE/edit

Compare against the originals listed in bva-emails-list.csv — only the four NP/EBITDA cells and the QTD Net Profit KPI tile change colors; everything else matches at the rendering level.

## Test plan

pytest tests/monthly_qtd_report/test_doc_builder_format.py — 55 passed (38 pre-existing + 17 new for bottom_line):

Unit tests on _color_for_line (5): GFI shape colors red, JigTree shape colors green, dollar-gate floor still wins (sub-\$25K stays uncolored), default unchanged for non-bottom-line rows, internal-suppression precedence holds.

Unit tests on _plan_status (2): GFI NP KPI tile colors red under bottom_line=True; sub-\$25K dollar gap still suppressed.

Paired KPI ↔ row consistency invariant (5 parametrized cases): for every (budget, actual) shape — GFI EBITDA, JigTree NP, IgniteTech NP, sub-materiality, exactly \$25K — _color_for_line(bottom_line=True) and _plan_status(bottom_line=True) must return matching verdicts. Locks the past < vs <= divergence-bug class (cited in the diff comment at doc_builder.py:496-499) against recurrence.

5pp boundary cases (3 parametrized): at pp = 4.999, 5.0, 5.001 with \$2M baseline. Forces "pp gate REMOVED" semantics — a regression that kept the pp leg but flipped the comparator from < to >= would pass the existing GFI/JigTree shape tests (4.08pp / 1.71pp) but fail at 5.001pp.

End-to-end through _build_pnl_rows_and_data (2):

- 4pp / −\$40K shape → bottom-line row colors red, Total Revenue / Gross Profit / Recurring Revenue line item stay uncolored. Verifies bottom_line=True is threaded only through the NP/EBITDA call sites of _total_keys and that the closure chain (_total_keys → _line_keys → _apply_color → _color_for_line) correctly forwards the keyword.

- 20pp / −\$200K shape → all relevant rows color red. Regression guard against a buggy pass-through that swallows the keyword for material variance.

Other gates run: ruff format, ruff check, full tests/monthly_qtd_report/ (326 passed).

## Summary

- Wire missing env vars in pipeline.json (S3_DUMP_PATH, S3_TEMP_PATH, IAM_ROLE) so override_all_assets=true can actually load CSVs from S3. Values taken from the still-deployed Klair Lambda PassiveInvestmentsCron.

- Move ALPHA_VANTAGE_API_KEY to AWS Secrets Manager (surtr/kubera-config) — fetched lazily and cached per invocation via a small helper. The IAM grant was already in pipeline.json. Overview-only invocations never touch Secrets Manager.

- Replace TRUNCATE with DELETE FROM and wrap initial_data_load in with redshift.transaction():. TRUNCATE implicitly commits in Redshift (per AWS docs) — the failure that emptied 4 prod tables today wouldn't have rolled back even with a transaction wrapper. DELETE is rollback-safe.

- Add explicit column lists on the trades and debt COPYs to skip the IDENTITY column 1 (trade_id / debt_id). The CSVs don't include identity values, so the previous COPY tried to load a date into a bigint and failed with Invalid digit, Type: Long. Klair has the same latent bug (Step 1 never runs there either).

- Fix the freshness guard added in #38 — its WHERE holding_date = CURRENT_DATE OR holding_date = MAX(...) clause counted MAX-date rows too, so today_rows was zero only when the table was completely empty. Replaced with a CASE-aggregate over the whole table plus a SUM(holding_value) > 0 check so stale-but-non-empty *and* zero-valued tables also fail loudly.

- Add s3:PutObject / s3:DeleteObject on the temp prefix for Step 4's upload_df_to_redshift_via_s3 helper.

## Why now

Triggered an on-demand override_all_assets=true run today (2026-05-05) to verify the OVERVIEW_ONLY "Portfolio Value: \$0" silent failure. Lambda async-retried 3x, each time truncating 4 underlying tables and failing at the COPY (env vars unset → bogus path / empty IAM_ROLE). Recovered from a 3-min-pre-damage Redshift automated snapshot via restore-table-from-cluster-snapshot + DROP/RENAME.

## Test plan

- [x] Local Phase 1 (happy path) — created _localtest shadow tables via CTAS from the recovered originals; ran the fixed DELETE + COPY-with-column-lists pattern through the actual RedshiftHandler.transaction() (IAM auth, same path as Lambda). Transaction committed; loaded 102 trades / 253 stock_price / 42 debt rows. hot stayed at 0 as expected.

- [x] Local Phase 2 (rollback) — a real COPY failure (the column-mismatch error before adding column lists) propagated cleanly out of the with block. All four shadow tables retained sentinel counts (119/17418/43/69708). Rollback verified.

- [x] Secrets Manager helper smoke-tested — fetches the right key, caches on second call.

- [ ] After merge, take a manual Redshift snapshot of redshift-cluster-1 as insurance.

- [ ] Trigger pipeline-kubera-passive-investments-prod with params.override_all_assets=true (use RequestResponse invocation type to avoid AWS auto-retries on failure). Expect Steps 1–4 to populate trades / stock_price / debt / hot, then Step 5 to refresh the 5 cache tables with non-zero portfolio metrics.

- [ ] Verify holding_over_time.MAX(holding_date) = CURRENT_DATE post-run; future overview-only runs should pass the freshness guard.

## Scope notes

- Klair's klair-udm/kubera/run_investment_pipeline.py has the same TRUNCATE-not-rollback-safe and CSV-column-mismatch bugs but is being deprecated, so leaving it as-is.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Demo

<img width="2199" height="1644" alt="image" src="https://github.com/user-attachments/assets/c3ece8ef-46c3-4a94-844b-9e4722945e33" />

## Summary

End-to-end Kubernetes support for SaaS Budgeting, mirroring the Docker pipeline. After merging main (which shipped KLAIR-2608, the v3 slots-keyed simulated-budget storage model, plus its own spec 13 tab-scoped-attach-button), the branch's k8s specs were renumbered 13–16 → 14–17 and spec 17 was rewritten on top of the new slots model.

- Spec 14 — feat(saas-budgeting): K8s ingestion pipeline + schema

- aws-saas-budget-scripts/pipeline/: introduce UnitTypeConfig-driven dispatch in drive_client.py (DOCKER_CONFIG + K8S_CONFIG). New pipeline/k8s_ingest.py mirrors docker_ingest.py; registered in main.py so --ingest k8s (or --ingest all) routes through it. INGEST_ORDER_FOR_ALL = ("mappings", "databases", "docker", "k8s").

- Schema: add NULL-able memory_limits_used_gbs DOUBLE PRECISION to core_finance.aws_spend_saas_budget_unit_consumption. Existing docker rows hold NULL there; new k8s rows hold NULL in memory_max_sum_gb_last_7_days (exactly one of the two metric columns is populated per row).

- New scripts/sql/alter_aws_spend_saas_budget_unit_consumption_add_k8s_metric.sql migration for the prod runbook (operator runs once before first k8s ingest).

- Two spec-12 followup fixes folded in: --min-year filter to skip the historical Drive backlog, and Drive duplicate (year, week) resolution by newer modifiedTime instead of hard-failing.

- Spec 15 — feat(saas-budgeting): unit_type-parameterized backend + Kubernetes Usage tab

- Backend: drop hardcoded UNIT_TYPE = "docker" constant; thread unit_type: Literal['docker','kubernetes'] (default docker for back-compat) through /quarters, /weeks, /table. Service projects the appropriate metric column via _MEMORY_COLUMN_BY_UNIT_TYPE. Cache keys partition by unit_type.

- Frontend: generalize useSaaSBudgetingTable and useSaaSBudgetingQuarters with optional unitType last arg. SaaSBudgetingTable becomes a unitType-driven dispatcher.

- New 4th tab Kubernetes Usage in SaaSBudgetingSection.tsx (order: AWS Spend → Adjustments → Docker Usage → Kubernetes Usage). Both panels stay mounted via hidden={...} so toggling tabs preserves card state.

- Spec 16 — feat(saas-budgeting): Kubernetes cost backend + Tax exclusion

- New /api/aws-spend/saas-budgeting/kubernetes-cost endpoint, symmetric to /docker-cost. Shared _get_cost_by_week_for_tag helper in cost_explorer_service.py consolidates Docker + K8s Cost Explorer fetches and excludes the Tax RECORD_TYPE so allocated totals match the rest of AWS Spend.

- K8s Usage tab gets the full Docker treatment: Pin (Attach) + DollarSign (Fetch Cost & Allocate). kubernetesCostAllocation.ts exposes extractBuClassKubernetesCosts; allocation math reuses the unit-type-agnostic helpers in dockerCostAllocation.ts (computeAllocation, decorateSectionsWithCostAllocation, decorateFlatRowsWithCostAllocation).

- New useSaaSBudgetingKubernetesCost hook (storage key aws-spend.saas-budgeting.kubernetes-cost.v1) parallels the Docker hook.

- Spec 17 — feat(saas-budgeting): attach Kubernetes to simulated budget (rewritten on top of v3 slots model)

- Extend SlotId union: 'awsSpend' | 'docker' | 'kubernetes' | 'adjustments'. K8s tab Attach writes a snapshot to budget.slots.kubernetes, no migration needed.

- simulatedBudgetMerge.ts: outer-join now spans four sources. BU ordering: AWS first-appearance → Docker-only → Kubernetes-only → adjustment-only. Per-cell Total = sum of non-null source values; all-null collapses to null.

- SimulatedBudgetCard.tsx: new Kubernetes $ column between Docker and Adjustments. SLOT_ORDER updated; staleness chip + per-source captions cover the new slot.

## Test plan

- [ ] Operator: apply aws-saas-budget-scripts/scripts/sql/alter_aws_spend_saas_budget_unit_consumption_add_k8s_metric.sql against staging Redshift (ADD COLUMN is metadata-only, no backfill required)

- [ ] Operator: dry-run the k8s ingest against staging — uv run python -m pipeline.main --ingest k8s --dry-run

- [ ] Hit /api/aws-spend/saas-budgeting/quarters?unit_type=kubernetes from a super-admin session and verify it returns k8s-only quarters

- [ ] Open the SaaS Budgeting page, click the Kubernetes Usage tab, confirm the empty-state when no k8s data is ingested for the applied quarter

- [ ] After ingesting at least one k8s week, confirm the Kubernetes Usage tab renders the table with the "Total Mem Limits (GB)" column header and both Pin (Attach) and DollarSign (Fetch Cost & Allocate) buttons present

- [ ] Click DollarSign → confirm /api/aws-spend/saas-budgeting/kubernetes-cost returns and the allocated cost decorations appear inline

- [ ] Click Pin on the K8s tab → confirm the Simulated Budget card now shows a Kubernetes $ column populated for the attached BU/class rows; staleness chip clears

- [ ] Confirm the Docker Usage tab still renders unchanged (Pin / Attach + Fetch Cost & Allocate buttons present, totals unaffected)

- [ ] pnpm lint:pr clean; pnpm tsc --noEmit clean; pnpm test green; pytest tests/saas_budgeting/ green; pytest aws-saas-budget-scripts/tests/ green

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Demo

<img width="2222" height="1636" alt="image" src="https://github.com/user-attachments/assets/abf0c7c3-d4b8-49b1-af05-5282169cdf2d" />

## Summary

Promotes Bedrock to a first-class spend source in the SaaS Budgeting view of the AWS Spend dashboard, parallel to AWS Spend and Docker Usage. Adds a dedicated Bedrock tab with full table parity to the AWS Spend tab and a Bedrock column on the Simulated Budget card. Continuation of the existing saas-budgeting feature (specs 14 + 15) alongside specs 04/05 (AWS Spend) and 07/08/09 (Docker).

Linear: [KLAIR-2609](https://linear.app/builder-team/issue/KLAIR-2609/saas-budgeting-dedicated-bedrock-tab-column-on-simulated-budget)

## Specs

1. [14-bedrock-only-backend-mode](features/aws-spend/saas-budgeting/specs/14-bedrock-only-backend-mode/spec.md) — Replaces the binary include_bedrock query param with a tri-state bedrock_mode: 'exclude' | 'include' | 'only' (default 'exclude') on GET /api/aws-spend/saas-budgeting/aws-net-amortized-table. New service branch uses SUM(c.cost_amount) FILTER (WHERE is_ai_service(...)) (the row-level analog of the existing cost - cost_excl_bedrock precedent). In 'only' mode, BU/Class rows whose every week is null/zero drop out so the Bedrock tab isn't cluttered with empty rows; the canonical week axis is preserved so the Bedrock tab stays axis-aligned with AWS Spend.

2. [15-bedrock-tab-and-simulated-budget-column](features/aws-spend/saas-budgeting/specs/15-bedrock-tab-and-simulated-budget-column/spec.md) — Parameterizes AWSSpendCard and useSaaSBudgetingAWSSpend(quarter, bedrockMode) so AWS Spend and Bedrock tabs share one component / one hook (chosen over clone-and-rename). Adds a Bedrock tab between AWS Spend and Adjustments with full UnifiedTable parity (BU → Class → Account hierarchy, per-week columns, Total + Quarterly Projection, WeekChipFilter default-last-4, CSV export bedrock-net-amortized-{quarter}, all loader/error/empty states with Bedrock-flavoured copy). Bedrock variant omits the optional unmapped prop — no Unmapped Bedrock Accounts band per the spec. Adds a Bedrock column to SimulatedBudgetCard between AWS Spend and Docker $; final order: BU/Class | AWS Spend | Bedrock | Docker $ | Adjustments | Total. Extends simulatedBudgetMerge to outer-join 4 sources and adds an anyWeekKeyMismatch tri-source check for the week-mismatch chip. useSimulatedBudget storage bumps from v3 → v4 with a new bedrock slot; pre-v4 entries are ignored (no migration — internal tool).

## Implementation summary

Backend (klair-api):

- services/saas_budgeting_aws_spend_service.py — new _cost_expr_and_filter helper; get_aws_net_amortized_table and _fetch_quarter_cost_weeks thread bedrock_mode through; row-drop in 'only' mode

- routers/saas_budgeting_router.py — query param swap; Bedrock-specific empty-state message

Frontend (klair-client):

- services/awsSpendApi.ts — getSaaSBudgetingAWSSpendTable swaps includeBedrock for bedrockMode; getSaaSBudgetingAWSUnmapped unchanged

- screens/AWSSpend/hooks/useSaaSBudgetingAWSSpend.ts — new optional bedrockMode arg; default 'exclude'

- screens/AWSSpend/components/SaaSBudgeting/AWSSpendCard.tsx — props lifted; unmapped prop now optional; variant strings (cardTitle, csvFileNamePrefix, emptyStateCopy)

- screens/AWSSpend/components/SaaSBudgeting/SaaSBudgetingSection.tsx — Bedrock tab + handler; two <AWSSpendCard> instances

- screens/AWSSpend/components/SaaSBudgeting/SimulatedBudgetCard.tsx — Bedrock column + caption

- screens/AWSSpend/components/SaaSBudgeting/simulatedBudgetMerge.ts — tri-source outer-join + anyWeekKeyMismatch

- screens/AWSSpend/components/SaaSBudgeting/useSimulatedBudget.ts — v4 storage + bedrock slot

## Out of scope (deferred)

- Re-classifying isBedrockAdjustment adjustment rows into the Bedrock column

- Toolbar toggle on the AWS Spend tab to flip Bedrock inclusion at runtime

- Changing how Bedrock cost is computed upstream

- Unmapped Bedrock Accounts sub-band

- Migrating pre-v4 simulated-budget snapshots (intentional hard cut)

## Test coverage

- Backend: 42 / 42 passing in tests/services/test_saas_budgeting_aws_spend_service.py + tests/routers/test_saas_budgeting_aws_spend_router.py. Includes new TestGetAWSNetAmortizedTableBedrockOnly class with 6 service tests (mode branches, row-drop edge cases, axis preservation, conservation invariant only + exclude = include) and 5 new router tests (tri-state forwarding, 422 on invalid mode, Bedrock-specific empty message).

- Frontend: 137 / 137 passing across SaaS Budgeting test files. Includes 10 new tests: 3 for buildGroups tri-source outer-join and 7 for anyWeekKeyMismatch (covering all pair permutations and absent-source cases). Existing tests updated for bedrockMode + v4 storage migration.

## Self-review

No issues found. Backend: SQL semantics correct (FILTER clause matches the cost - cost_excl_bedrock precedent), row-drop predicate handles all-None / all-zero / mixed edge cases, axis preserved in 'only' mode. Frontend: tab order correct (Bedrock between AWS Spend and Adjustments), column order correct, Bedrock variant correctly omits unmapped band, v3→v4 hard cut never reads stale keys, anyWeekKeyMismatch correctly returns false for 0/1 sources.

## Test plan

- [ ] Open SaaS Budgeting tab on AWS Spend dashboard, switch to Bedrock tab — verify table renders with Bedrock (Net Amortized) title, BU → Class → Account hierarchy, W{n} columns, Total ($) and Quarterly Projection ($) columns

- [ ] Click "Attach to Simulated Budget" on Bedrock tab — verify toast Attached N BU/Class rows to simulated budget (Bedrock)

- [ ] Verify Simulated Budget card renders Bedrock column between AWS Spend and Docker $

- [ ] Switch back to AWS Spend tab — verify it still excludes Bedrock (no regression)

- [ ] Verify CSV export from Bedrock tab uses filename bedrock-net-amortized-{quarter}

- [ ] Pre-v4 localStorage entries should be silently ignored (no crash, no migration prompt)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary

Per Raviraja's review of the 2026-04 QTD batch, case-only spelling drift between Budget (Abacum free text) and Actual (NetSuite) sides was producing phantom budget-only / actual-only sister rows in the QTD variance tables. The most visible case: the SaaS Q2 Perplexity entry — $1,360 budget on Perplexity Ai never joined the $76,737 actual on Perplexity AI, so the report appeared to show a missing budget.

This PR groups + FULL OUTER JOINs both vendor- and customer-side variance queries on LOWER(TRIM(vendor)) instead of raw vendor. MAX(vendor) inside each CTE picks a deterministic display name.

Approved by Raviraja Rao on the 2026-04-30 SaaS sample report.

## Files changed

- klair-api/services/monthly_qtd_report/data.py — both _VARIANCE_DRIVERS_QUERY (NHC COGS/OPEX vendors) and _REVENUE_CUSTOMER_VARIANCE_QUERY (Recurring/Non-Recurring Revenue customers) updated. Phantom-sister-row logic in the coverage_kind CASE and the FULL OUTER JOIN switched from raw vendor to the case-folded vendor_key / customer_key.

- klair-api/tests/monthly_qtd_report/test_data.py — two regression tests lock the SQL contract: case-folded GROUP BY, case-folded FULL OUTER JOIN, and case-folded coverage_kind NULL checks for both vendor and customer queries.

## Verification

- pytest tests/monthly_qtd_report/ — 311 passed, 0 failed.

- ruff format + ruff check — clean.

- pyright services/monthly_qtd_report/data.py — clean.

- Live Redshift sanity check (SaaS / April 2026): Perplexity Ai Budget=$1,360 and Perplexity AI Actual=$76,737 now report as a single coverage_kind='both' row instead of two phantom sister rows. The Q2 Luxembourg case-twin pair (Amazon Web Services EMEA SARL (Luxembourg) vs Amazon Web Services Emea Sarl (Luxembourg)) also merges correctly on the budget side.

- Sample regenerated SaaS report: https://docs.google.com/document/d/1MK4sN166U7Q2ZTECWMIVNKQ3RAlxgJ3yu2Bup6wxvjQ/edit — Perplexity now appears as one merged variance line, and the LLM commentary surfaces the AWS / AWS-Luxembourg net interplay.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Linear: [KLAIR-2610](https://linear.app/builder-team/issue/KLAIR-2610)

## Summary

The login screen lost its "Create Account" button in commit 446d5498b (April 2026 design-system migration PR #2455). The SignUpModal component, its API service, types, hook, and backend routes (/admin/submit-access-request, /admin/public/teams) were all left intact — only the trigger button and modal mount were removed. New users land on the auth screen with no in-product way to request access.

This PR restores the flow:

- withAuth.tsx — re-mounts <SignUpModal> and adds a "Request Access" secondary CTA with a "New to Klair?" divider beneath the Sign In button. The modal's onSignInRequested (the "already registered → Go to Sign In" recovery path) is wired to Clerk's openSignIn() so it actually launches the sign-in modal.

- SignUpModal.tsx — restyled to use klair-* design tokens (replacing hardcoded slate/blue/indigo classes from before the redesign). The submit button now uses the same flat --klair-accent styling as Sign In, validation states use --klair-positive / --klair-negative, and surfaces use --klair-bg-card / --klair-bg-surface1 so it looks right in both light and dark themes. Also added role="dialog" / aria-modal / aria-labelledby and replaced deprecated onKeyPress with onKeyDown.

- Tests — new SignUpModal.spec.tsx (8 cases) covering render gating, validation, submit happy/error paths, "Go to Sign In" recovery, and close behavior. withAuth.spec.tsx and the global Vitest mock setup get useClerk.openSignIn added.

## Verification

- pnpm tsc --noEmit clean

- eslint --max-warnings 0 clean on all 5 changed files

- Vitest: 5/5 withAuth + 8/8 SignUpModal pass

- Manual browser smoke test:

- Auth screen renders Sign In + Request Access in light + dark mode

- Modal opens, fetches teams, validation works (red on invalid blur, green on valid)

- Submitted a real access request manually — flow works end-to-end through the live backend

## Screenshots

<img width="1039" height="840" alt="image" src="https://github.com/user-attachments/assets/43bb7027-6a4a-4308-ac2f-1a338307051f" />

<img width="854" height="814" alt="image" src="https://github.com/user-attachments/assets/84aab76d-9348-41f5-986a-e380207c625c" />

## Test plan

- [ ] Verify Sign In is the visual primary CTA and Request Access reads as secondary

- [ ] Open modal, submit invalid email, confirm error styling uses klair tokens (not slate/red Tailwind)

- [ ] Submit a valid request, confirm success state renders with the request details panel

- [ ] Trigger an "already registered" response, click "Go to Sign In", confirm Clerk sign-in modal opens

- [ ] Toggle dark mode, confirm modal + buttons remain readable

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Screenshots

<img width="1209" height="774" alt="image" src="https://github.com/user-attachments/assets/4af3c737-5644-4a45-a7e0-90e6e73159b0" />

<img width="1025" height="660" alt="image" src="https://github.com/user-attachments/assets/2505a32d-a781-4338-bb61-e676418dedb5" />

## Summary

- Automates the manual sheet-tab verification pass that was blocking C1.3 - C1.5 with a repeatable c1_discover_tabs.py script (the May 5 re-run caught a factual error in the original C1.1 audit, so this isn't paranoia).

- Ships the two real net-new GSheets parsers the discovery identified: get_top_level_view_bu_plans_table (rollup-only) and get_benchmark_by_product_table (BU-only). C1.5 (Benchmark Slide / Benchmark workings) is now superseded — see audit §6c.

- Together unblocks 11 downstream review checks: C2.7 + C2.8 (BU-vs-Hybrid divergence + FY trajectory), and the 9 per-product benchmark checks C3.1 - C3.9.

## Why it's needed

Phase C (Memorial Day Review Agent MVP) is gated on these parsers — without them, 11 of the 17 outstanding review checks have no data source. The original audit superseded C1.2 ("Margin Target tab") on the assumption it wasn't a real tab, and gated C1.3 - C1.5 on a manual click-through verification pass that nobody had done. The May 5 automated discovery (commit 1) showed:

1. The audit's assumption about Margin Target was wrong — it does exist as a tab. Net effect on this PR is small (existing P&L row extraction still satisfies current C2.x needs), but documents this as audit §6c so a future per-class margin check can use the right source.

2. Top Level View - BU Plans exists only on rollup BUs (Skyvera in our sample). IgniteTech / GFI Group / Crossover do not have the tab. C2.7 + C2.8 must therefore gate on is_rollup_bu at the orchestrator layer — flagged in the backlog row updates.

3. Benchmark Slide / Benchmark workings are derivatives of Benchmark by Product ($ rollup + underlying allocation calc). Not needed for the % comparison checks in C3.x. C1.5 is now marked superseded.

The Top Level View - BU Plans tab also has an unusual column layout — col A is the label / section title, not a one-cell filler like every other tab in the sheet. The first live smoke run caught the mistake (parser returned None on Skyvera) before any check code consumed the parser, which is exactly what this verification harness is for.

## Changes

Commit 1 — klair-api/scripts/c1_discover_tabs.py (C1.1)

- Repeatable tab-discovery script using the same _get_dynamic_sheet_url + gspread client the wizard uses.

- Defaults to Skyvera / IgniteTech / GFI Group / Crossover Q2'26.

- 1.0s default --preview-sleep keeps a 4-target run under the 60-reads/min/user Sheets quota (a 0s run hit a 429 on GFI mid-loop).

Commit 2 — parsers + 31 new tests (C1.3 + C1.4)

- services/budget_sheets_service.py:

- _find_benchmark_by_product_table + get_benchmark_by_product_table (CF-gated, returns section-tagged rows so callers can disambiguate Engineering/Product across central / edge / total sections).

- _find_top_level_view_bu_plans_table + get_top_level_view_bu_plans_table (CF-gated; non-rollup BUs return None via WorksheetNotFound rather than raising).

- Shared _looks_like_quarter_row helper to defend against false-positive group-header detection.

- tests/board_doc/test_benchmark_by_product.py — 16 tests parametrized across Skyvera (23-col rollup), IgniteTech (57-col wide), GFI Group (13-col narrow) shapes, plus header / padding / truncation / CF gate / rate-limit-propagation cases.

- tests/board_doc/test_top_level_view_bu_plans.py — 15 tests covering multi-block parsing, section-title disambiguation (with and without trailing colon), false-positive defenses, and missing-tab graceful degradation for non-rollup BUs.

Commit 3 — klair-api/scripts/c1_smoke_parsers.py (C1.6)

- Cross-BU live verification harness for both new parsers.

- Latest run: 0 mismatches across all 4 (BU × parser) combinations.

Backlog (local / .cursor, untracked):

- BACKLOG-budget-bot-4.md — C1.1 marked DONE with verification appendix; C1.2 stays SUPERSEDED with audit-correction note; C1.3 / C1.4 / C1.6 marked TODO → ready-to-ship; C1.5 marked SUPERSEDED. C2.7 / C2.8 rows updated with the rollup-only constraint + dependency on C1.3.

- research/budget-bot-c1-audit.md — added §5 status update (manual pass replaced) and §6 with the verified tab matrix, structures, audit corrections, and revised attack order.

## Breaking changes

None. Both new methods are additive and CF-gated; no existing callers reference them yet.

## Cross-BU validation (all 8 real BUs + 13 CFs)

Expanded the C1.6 smoke from the initial 4-BU sample to every real BU + every CF in the enum. 0 mismatches across 21 entities. Three real cross-BU drifts surfaced — all absorbed by the parsers; smoke output flags them so the reviewer sees what's being papered over:

1. Totogi has the Top Level View - BU Plans tab too (single-section, partial). Originally framed as "Skyvera-only" / "rollup-only"; that was wrong on a 4-BU sample. Parser docstring + audit + C2.7/C2.8 backlog rows now describe the variable-presence pattern (gate on result is not None, not on a hardcoded rollup list).

2. GFI's total section uses Engineering (not Engineering/Product). Smoke anchor extractor accepts a list of label variants and surfaces the matched one (Engineering/Product → Engineering) so the reviewer sees the variance.

3. Totogi's TLV header carries stale year labels — Current BU Plan - 2026 Q2'25 for what should be Q2'26. Smoke does a quarter-number-only fallback match and prints a "matched stale year label" note rather than silently treating the wrong column as the right one.

Plus minor observations: 12/13 CFs short-circuit via the CF gate; Central PS has no DDB row for Q2'26 (skipped); Cloudfix + Totogi Margin rows are #DIV/0! — both sheets are mid-draft for Q2'26 (parser preserves cell text verbatim). Contently / Canopy alias resolution works end-to-end.

## Test plan

- [x] uv run pytest tests/board_doc/test_benchmark_by_product.py -q — 16/16 passing.

- [x] uv run pytest tests/board_doc/test_top_level_view_bu_plans.py -q — 15/15 passing.

- [x] uv run pytest tests/board_doc/ -q — 1050/1050 passing locally (no regressions in adjacent suites).

- [x] uv run ruff check + uv run ruff format --check — clean on changed files.

- [x] Live smoke uv run python scripts/c1_smoke_parsers.py --year 2026 --quarter 2 --show-anchors — 0 mismatches across all 8 real BUs + 13 CFs (~50s runtime with 1.5s sleeps).

- [x] Live discovery uv run python scripts/c1_discover_tabs.py --year 2026 --quarter 2 --preview-sleep 1.2 — completes cleanly under quota, all 4 targets.

- [x] Spot-checked Skyvera anchor cells against the live sheet:

- Benchmark by Product: summary/Margin Target 75/75, summary/Margin 75/60, total/Engineering/Product 9.5/9.

- Top Level View - BU Plans: Skyvera Overall Q2'26 → TR 13.2 / EBITDA 8.0 / Net Margin 60% / Margin Target 63%.

- [x] Reviewer to spot-check the Skyvera anchors above against the live sheet to confirm the section/label mapping (sheet URL is logged in the smoke output).

## Follow-ups

- C2.7 + C2.8 implementation needs an orchestrator gate on get_top_level_view_bu_plans_table(...) is not None (plus probably a section-count threshold to skip thin Totogi-style blocks). Documented in the C2.7 / C2.8 backlog rows.

- The WorksheetNotFound "consecutive failures" alert path fires noisily when the smoke iterates non-rollup BUs (expected — the tab is missing for 6 of 8 BUs). Consider exempting not_found from the consecutive-failure counter so a routine cross-BU sweep doesn't trigger CRITICAL alerts. Out of scope here; small follow-up.

- C1.7 (column-inversion claim on the global preprocessed sheet) — not touched; this PR did not include the preprocessed sheet in discovery. Re-run discovery with --include-preprocessed if that becomes the priority. Discovery here did not surface contradicting evidence.

- If a future check needs per-class margin detail (Vertical / BU / Class quarterly target $), the standalone Margin Target tab is the right source — file as a fresh parser ticket then. Documented in audit §6c.