# Module: confmgmt (`b2g_confmgmt/`)
Purpose: company configuration/onboarding engine — config categories & questions/answers, configured services, ESG (CRIF) scoring and GHG baseline/target-setting snapshots, AI score suggestions. Owner: Sanjay.
Entry points: `modules/conf/controllers/ConfenggController.php` (~4.2k lines, almost all routes); `modules/conf/controllers/ConfInternalController.php` (server-to-server); `modules/div/controllers/DivisionController.php`; `controllers/BaseApiController.php`. Kong: `/configmg/web`.
Data: `bgi_b2g_reg_*` — key tables: `membercompanymst_tbl`, `memcompsectordtls_tbl`, `memcompconfigcatdtls_tbl`, `memcompquestiondtls_tbl`, `memcompanswerdtls_tbl`, `memcompcnfgsrvcdtls_tbl`, `memcompcrifsourcescoredtls_tbl`, `memcompghgbaselinedtls_tbl` (most with `*hsty_tbl` history twins).
Calls: micro (`MICRO_BASE_URL` → `microServiceUrl`, e.g. `master/master/get-config-reference-data`), digitall (`DIGITALL_BASE_URL`), cengex (`CENGEX_BASE_URL` → `cengexmsturl`), filemst (`FILEMST_*`), external AI suggestions API (`AI_SUGGESTIONS_URL`).
Env selection: `APP_ENV` first, else `HTTP_HOST` (demo/prod domains, else local) — see `config/web.php`. Only `params/db-{local,demo,prod}.php` exist (no dev).
Invariants:
- `jwtSecret` must match siblings; `ConfenggController` relies on the JWT to populate the company pk — don't add public `except` routes casually.
- `ConfInternalController` is called by digitall's `extapi` (`ConfmgmtApiClient`) with `X-Sync-Secret` (`confmgmtSyncSecret`) — keep the secret in sync across both services; it resolves identifiers only, never serves ESG/GHG figures.
- `user.enableSession=false` must stay (slow CRIF/AI proxy calls otherwise block all of a browser's requests).
Gotchas:
- `memcompcrifsourcescoredtls_tbl`/`memcompsourceghgdtls_tbl` are stale snapshots refreshed only when the Targets Setting UI is opened; live figures live in digitall's DB.
- `ConfenggController.php` is on the curl-timeout baseline; the AI call uses a 60s timeout (> 15s Service Connect).
- Without the `*_BASE_URL` env vars, URLs default to `http://$HTTP_HOST/b2g/...` (XAMPP layout), which is wrong behind Kong.
- `DivisionController` defines no authenticator (verify whether intentionally public).
- Log mirroring is still `FileTarget` → `/proc/self/fd/2`; confirm StderrLogTarget fix status (verify). `vendor/` not committed.
Prod debugging: CloudWatch `/ecs/b2g-prod/confmgmt` (demo: `/ecs/b2g-demo/confmgmt`); health `GET /healthz` on :80; ECS service `confmgmt`, task family `b2g-confmgmt` / `b2g-demo-confmgmt`. Runbooks: `docs/runbooks/`.