toga-ai 1.0.635 → 1.0.637

package/knowledge/2.0/apps/ai-bdr/INDEX.md

@@ -6,8 +6,9 @@
 | [BDR Web Funnel — Full Implementation Plan](features/bdr-web-funnel-plan.md) | > **Execution status (2026-07-16):** PLAN **Phases 0–5 are BUILT and QA'd**, Phase 6 > was **mostly already built** (the `info` contract was implemented at comm | bdr/PLAN.md, bdr/mockup/app.jsx, bdr/mockup/screens.jsx, bdr/mockup/components.jsx |
 | [Call Orchestration — PHP Worker ↔ Vapi (the integration seam)](features/call-orchestration.md) | The **PHP worker** is the orchestrator; **Vapi** is the actor. | ai-bdr/docs/client-onboarding-sop.md, ai-bdr/docs/vapi-firstmessage-timing-fix.md, ai-bdr/docs/vapi-inbound-callback-assistant-request.md, ai-bdr/docs/vapi-voicemail-iphone-screening.md, ai-bdr/scripts/update_structured_output.py |
 | [Live Call Status — Vapi call API → funnel Success screen lifecycle](features/live-call-status.md) | The BDR funnel's Success screen shows the **real** state of the call it just requested — dialing / ringing / answered-and-talking / ended / not-answered — inste | bdr/src/server/vapiCall.ts, bdr/src/server/callStatus.ts, bdr/src/server/statusToken.ts, bdr/src/server/callbackService.ts, bdr/src/server/workerDialer.ts, bdr/src/lib/callStatus.ts, bdr/src/app/api/call-status/route.ts, bdr/src/app/api/call-now/route.ts, bdr/src/flow/useCallStatusViewModel.ts, bdr/src/flow/callStatusApi.ts, bdr/src/flow/screens/Success.tsx, bdr/src/content/schema.ts, bdr/src/content/default.ts, bdr/src/proxy.ts |
+| [Cybersecurity Landing Page (/landing — the site's current main page)](features/security-landing-page.md) | A single-page **cybersecurity services marketing landing page** at **`/landing`** in the `bdr` repo — and, as of 2026-08-24, **the site's main page**: `/` **307 | bdr/src/app/landing/page.tsx, bdr/src/app/security.css, bdr/src/flow/screens/SecurityLanding.tsx, bdr/src/content/security.ts, bdr/src/components/LogoSymbol.tsx, bdr/src/components/AssistantMark.tsx, bdr/src/components/Ico.tsx, bdr/src/components/Particles.tsx, bdr/next.config.ts, bdr/eslint.config.mjs |
 | [Vapi Integration — Assistants, Tools, Structured Output](features/vapi-integration.md) | Everything inside Vapi: the three assistants, the three shared tools, the shared structured-output schema, the Liquid-templated system prompt, and the Python sc | ai-bdr/vapi/templates/assistant.template.json, ai-bdr/vapi/templates/system-prompt.template.md, ai-bdr/prompts/archive/prompt-may-15.txt, ai-bdr/prompts/campaigns/healthcare-2026-03-18.md, ai-bdr/prompts/campaigns/healthcare-v2-2026-03-25.md, ai-bdr/prompts/templates/campaign-template.md, ai-bdr/scripts/update_assistant.py, ai-bdr/scripts/update_system_prompt.py, ai-bdr/scripts/update_structured_output.py, ai-bdr/scripts/update_call_summary_context.py, ai-bdr/scripts/fix_booking_guardrails.py, ai-bdr/scripts/get_assistant.py, ai-bdr/docs/vapi-firstmessage-timing-fix.md, ai-bdr/docs/vapi-voicemail-iphone-screening.md |
-| [Web Funnel — Built Next.js App (structure, stack, how to run)](features/web-funnel-app.md) | The **built** state of the BDR web funnel — the Next.js UI / lead-capture front door of the existing AI-BDR product (see `../architecture.md`). | bdr/PLAN.md, bdr/.gitignore, bdr/src/server/hubspot.ts, bdr/src/server/leadSink.ts, bdr/src/server/callbackService.ts, bdr/src/server/workerDialer.ts, bdr/src/server/mailer.ts, bdr/src/server/statusToken.ts, bdr/src/server/vapiCall.ts, bdr/src/server/callStatus.ts, bdr/src/lib/summaryText.ts, bdr/src/lib/emailFormat.ts, bdr/src/lib/callStatus.ts, bdr/src/app/api/share-summary/route.ts, bdr/src/app/api/call-status/route.ts, bdr/src/flow/shareSummaryApi.ts, bdr/src/flow/callStatusApi.ts, bdr/src/flow/useCallStatusViewModel.ts, bdr/src/flow/screens/Success.tsx, bdr/src/flow/screens/CallNow.tsx, bdr/src/flow/screens/Schedule.tsx, bdr/src/flow/screens/CallSummary.tsx, bdr/src/content/schema.ts, bdr/src/content/default.ts, bdr/test/togaEnrichment.test.ts, bdr/test/fastDial.test.ts, bdr/eslint.config.mjs, bdr/amplify.yml, bdr/src/app, bdr/src/app/layout.tsx, bdr/src/app/page.tsx, bdr/src/app/studio.css, bdr/src/lib/resolveCampaignId.ts, bdr/src/lib/scheduleSlots.ts, bdr/src/lib/formatPhone.ts, bdr/src/lib/analytics.ts, bdr/src/lib/rateLimit.ts, bdr/src/lib/clientIp.ts, bdr/src/proxy.ts, bdr/.env.example, bdr/src/components/GoogleAnalytics.tsx, bdr/src/components/RichText.tsx, bdr/src/content, bdr/src/components, bdr/src/flow, bdr/src/server, bdr/src/server/toga.ts, bdr/src/app/api, bdr/test, bdr/test/togaPrimaryPhone.test.ts, bdr/public, bdr/mockup/styles.css |
+| [Web Funnel — Built Next.js App (structure, stack, how to run)](features/web-funnel-app.md) | > **READ FIRST (2026-08-24) — the funnel is currently UNREACHABLE.** `/` now > **307-redirects to `/landing`**, the new cybersecurity landing page > ([security- | bdr/PLAN.md, bdr/next.config.ts, bdr/.gitignore, bdr/src/server/hubspot.ts, bdr/src/server/leadSink.ts, bdr/src/server/callbackService.ts, bdr/src/server/workerDialer.ts, bdr/src/server/mailer.ts, bdr/src/server/statusToken.ts, bdr/src/server/vapiCall.ts, bdr/src/server/callStatus.ts, bdr/src/lib/summaryText.ts, bdr/src/lib/emailFormat.ts, bdr/src/lib/callStatus.ts, bdr/src/app/api/share-summary/route.ts, bdr/src/app/api/call-status/route.ts, bdr/src/flow/shareSummaryApi.ts, bdr/src/flow/callStatusApi.ts, bdr/src/flow/useCallStatusViewModel.ts, bdr/src/flow/screens/Success.tsx, bdr/src/flow/screens/CallNow.tsx, bdr/src/flow/screens/Schedule.tsx, bdr/src/flow/screens/CallSummary.tsx, bdr/src/content/schema.ts, bdr/src/content/default.ts, bdr/test/togaEnrichment.test.ts, bdr/test/fastDial.test.ts, bdr/eslint.config.mjs, bdr/amplify.yml, bdr/src/app, bdr/src/app/layout.tsx, bdr/src/app/page.tsx, bdr/src/app/studio.css, bdr/src/lib/resolveCampaignId.ts, bdr/src/lib/scheduleSlots.ts, bdr/src/lib/formatPhone.ts, bdr/src/lib/analytics.ts, bdr/src/lib/rateLimit.ts, bdr/src/lib/clientIp.ts, bdr/src/proxy.ts, bdr/.env.example, bdr/src/components/GoogleAnalytics.tsx, bdr/src/components/RichText.tsx, bdr/src/content, bdr/src/components, bdr/src/flow, bdr/src/server, bdr/src/server/toga.ts, bdr/src/app/api, bdr/test, bdr/test/togaPrimaryPhone.test.ts, bdr/public, bdr/mockup/styles.css |
 | [Web Funnel — Next.js UI + Config-Driven Campaign Content](features/web-funnel-content-model.md) | > **Status note (RESOLVED 2026-07-16):** the content **contract** below (schema, > provider seam, adapters) is BUILT and QA'd (PLAN Phases 0–5). | bdr/src/content/schema.ts, bdr/src/content/provider.ts, bdr/src/content/useCampaign.ts, bdr/src/content/default.ts, bdr/src/lib/resolveCampaignId.ts, bdr/src/server/leadSink.ts, bdr/src/server/callbackService.ts, bdr/src/app/api/call-now/route.ts, bdr/src/app/api/call-later/route.ts, bdr/src/app/api/contact/route.ts |
 | [New-Campaign Onboarding (6-phase runbook)](workflows/new-campaign-onboarding.md) | The end-to-end procedure for launching a new outbound BDR campaign (industry, offer, target persona, geography). | ai-bdr/docs/client-onboarding-sop.md, ai-bdr/docs/calcom-new-campaign-event-guide.md, ai-bdr/prompts/templates/campaign-template.md, ai-bdr/scripts/update_assistant.py, ai-bdr/scripts/update_system_prompt.py |
 | [Safe AI-BDR Call-Loop Testing (isolated test-campaign runbook)](workflows/safe-call-loop-testing.md) | How to prove the AI-BDR **dialer → Vapi → end-of-call webhook** loop end-to-end **without dialing real prospects**. | dbchanges2/Client_True/2026-07-20a - AiBdrTcoxTestCampaign.sql, worker2/Worker/Ai/Bdr/Vapi.php, worker2/Worker/Ai/Bdr/ZoomInfo.php, worker2/Config/beta.ini |

package/knowledge/2.0/apps/ai-bdr/features/security-landing-page.md

@@ -0,0 +1,202 @@
+---
+title: Cybersecurity Landing Page (/landing — the site's current main page)
+framework: "2.0"
+repo: ai-bdr
+project: AI-BDR
+client: shared
+type: feature
+status: active
+updated: 2026-08-24
+owners: [tcox]
+files:
+  - bdr/src/app/landing/page.tsx
+  - bdr/src/app/security.css
+  - bdr/src/flow/screens/SecurityLanding.tsx
+  - bdr/src/content/security.ts
+  - bdr/src/components/LogoSymbol.tsx
+  - bdr/src/components/AssistantMark.tsx
+  - bdr/src/components/Ico.tsx
+  - bdr/src/components/Particles.tsx
+  - bdr/next.config.ts
+  - bdr/eslint.config.mjs
+related:
+  - web-funnel-app.md
+  - web-funnel-content-model.md
+  - ../architecture.md
+---
+
+## What this is
+
+A single-page **cybersecurity services marketing landing page** at **`/landing`** in the
+`bdr` repo — and, as of 2026-08-24, **the site's main page**: `/` **307-redirects** to it
+and the 7-screen Agent Studio funnel is parked (see `web-funnel-app.md`). Its job is one
+conversion: *"Book your free risk assessment."*
+
+It is a **pixel-faithful port of a new designer mockup**, not new design work. Source
+mockup: `BDR/AI BDR - Security/` (a React 18 UMD + in-browser Babel prototype —
+`app.jsx`, `screens.jsx`, `components.jsx`, `styles.css`, plus a
+`ground-truth-tokens-and-stack.md` token spec). The landing is that mockup's
+**`Capabilities` screen**; because `src/flow/screens/Capabilities.tsx` already exists as a
+studio screen, it was ported under the name **`SecurityLanding`**.
+
+**Status: UI only.** Nothing is wired to a backend — no lead capture, no Toga/HubSpot
+call, no analytics events of its own. Wiring is a later decision (see *CTA wiring* below).
+
+## Page structure
+
+`src/app/landing/page.tsx` is a thin **server component** carrying only `metadata`
+(title `TOGA Technology · Cybersecurity Services` + description) and the
+`import "../security.css"`. Everything visible lives in
+`src/flow/screens/SecurityLanding.tsx` (`"use client"`), which — unlike every studio
+screen — **carries its own page shell**: the noise layer, the mote field, the topbar
+lockup, and the header CTA. There is no shared layout wrapper for it.
+
+Section order inside the shell:
+
+1. **Hero** (`.lp-hero`) — eyebrow, headline whose closing clause is the TOGA gradient
+   span, the primary CTA (`#cta`), and a side column: the value tile
+   (`.lp-value`, list-price strike-through → free) framed by a peach-hued `Particles`
+   field, plus the offer reveal list (`.lp-offer` / `.lp-reveal`).
+2. **Why it matters** (`.lp-why-matters`) — intro line, then two icon-led cards
+   (`problem` / `impact`) and a four-tile stat row (`.lp-stats`).
+3. **Footer** (`.lp-footer`) — logo mark, name, one line, copyright.
+
+**Zero binary assets.** Every visual is inline SVG or CSS (`LogoSymbol`,
+`AssistantMark`, the `Ico` registry, `Particles`, gradients). The mockup's `agents/` and
+`uploads/` folders are legacy leftovers and are **not referenced** — do not copy them into
+`public/`. This is the opposite of the studio flow, whose agent art is a real asset
+dependency.
+
+## All copy lives in `src/content/security.ts`
+
+Every string on the page is in one typed const (`SecurityLandingContent`), so the view
+layer holds **no inline copy**. It deliberately follows the `CampaignBundle` conventions
+from `src/content/schema.ts` — serializable data only, **icons referenced by enum key**
+and hydrated through the `Ico` registry — so the shape can be **grafted into the bundle
+schema later** if the landing becomes campaign-driven. It is not part of the bundle today.
+
+- The primary CTA href is `content.hero.primaryCtaHref`.
+- Landing copy contains **no em dashes** — the repo's ESLint no-em-dash rule covers it
+  like any other in-repo string.
+
+## Design tokens are scoped to the landing, NOT global
+
+The mockup's tokens **diverge** from the live studio screens, so every override is
+declared on **`.security-shell`**, never `:root`. That scoping is the whole reason the
+parked studio flow keeps its existing look, and it is load-bearing — moving any of these
+to `:root` restyles the funnel.
+
+| Token | Studio (`:root`) | Landing (`.security-shell`) |
+|---|---|---|
+| `--accent` | `#4571DD` | `#80A4FF` (cobalt-300) |
+| `--radius` | `8px` | `4px` (crisp/architectural; `--r-sm` 2px, `--r-lg` 12px) |
+| `--r-pill` | (studio value) | `999px` — a true pill, used by the header CTA only |
+| `--muted` | (warmer) | `#94A3B8` (cooler grays; `--faint` `#6A72A6`) |
+| gradient | — | new `--grad-1..4` + `--toga-grad` |
+| `--on-peach` | — | `#1A0E07` (white fails contrast on peach) |
+
+Two consequences worth knowing before editing `security.css`:
+
+- **Accent-derived tokens must be recomputed under the shell.** `--accent-soft` / `-mid` /
+  `-glow` / `-ink` are `color-mix()` values; custom properties resolve where they are
+  *declared*, so studio.css's `:root` versions still carry the studio accent. They are
+  redeclared on `.security-shell`.
+- **Peach is a fixed brand hue, not the accent.** The mockup's peach values were promoted
+  to `--peach` / `--peach-hover` / `--peach-soft` so nothing hardcodes them, but they
+  **never** track `--accent` (the mockup's own CLAUDE.md rule is "never hardcode the
+  accent," which is why the promotion happened at all).
+
+`security.css` (215 lines) reuses studio.css's shared chrome (`.shell`, `.topbar`,
+`.screen`, `.wrap`, the `.btn` base, `.particles`, the `mote` / `syn-rotate` keyframes,
+`@property --syn-a`) and carries only the token overrides plus the selectors studio.css
+does not define or defines differently.
+
+## Shared components were extended, not forked
+
+- **`Ico.tsx`** — added `eyeoff` and `alert` to the icon registry (additive).
+- **`Particles.tsx`** — added `palette` / `bold` / `radiate` props. The **default branch
+  was verified byte-identical**, so the 7 existing studio screens do not shift. Any future
+  change here must keep that property.
+- **`LogoSymbol.tsx`** / **`AssistantMark.tsx`** — new inline-SVG marks.
+- **`eslint.config.mjs`** — `"AI BDR - Security/**"` added to `globalIgnores` alongside
+  `mockup/**`, so the mockup prototype is not linted.
+
+## CTA wiring (read this before assuming the page converts)
+
+- **"Book your free risk assessment"** is a real `<a class="btn btn-toga btn-lg">` to
+  `https://calendly.com/toga-technology/risk-assessment` (`target="_blank"`,
+  `rel="noopener noreferrer"`), sourced from `security.ts` `primaryCtaHref`.
+  **CAVEAT: that URL is a placeholder carried over from the mockup** (the mockup's own
+  comment says "replace with the real TOGA Calendly link") and the slug's liveness has
+  **not** been verified. Confirm it before pointing traffic at the page.
+- **"Learn more"** and the header CTA **"Ask Me Anything"** render **inert**. In the
+  mockup, "Ask Me Anything" opened a chat drawer; **the drawer was not ported.**
+
+## How to work on it
+
+- `npx tsc --noEmit`, `npm run lint`, `npm run build` — all clean as of 2026-08-24;
+  `/landing` builds as a **prerendered static** route. Local prod smoke test:
+  `GET /` → `307` with `Location: /landing`, `GET /landing` → `200`.
+- **Nothing is committed** — as of capture the whole landing lives in the `bdr` working
+  tree only. It is not shipped or deployed.
+
+## Known gaps / pending work
+
+- **Mobile pass is pending.** The mockup has almost no landing-specific mobile CSS: only a
+  900px hero-stack and a 760px stats/matters breakpoint. Its big "mobile pass" block
+  contains **zero `.lp-*` rules**, so there is no design to port — the responsive
+  treatment below ~760px is an open design question, not a porting oversight.
+- **Chat drawer not ported** (the header CTA's mockup behavior).
+- **Calendly URL unverified** (above).
+- No form, no lead capture, no landing-specific analytics.
+
+## Gotchas
+
+- **`.security-shell` scoping is load-bearing.** The mockup's tokens conflict with the
+  studio flow's (different accent, different radii, cooler grays). Promote any of them to
+  `:root` and you restyle the parked funnel. Add new landing rules **under the shell
+  selector**, always.
+- **Name collisions with studio screens.** The mockup screen is called `Capabilities` but
+  `Capabilities.tsx` is a *studio* screen — hence `SecurityLanding.tsx`. Likewise
+  `src/flow/screens/Landing.tsx` is a **studio** screen and has nothing to do with the
+  `/landing` route. Check which is meant before editing either.
+- **`.btn` does not reset anchor styling.** Every studio `.btn` is a `<button>`, so
+  studio.css never needed `text-decoration:none`. The landing's primary CTA is an `<a>`,
+  which arrives underlined — a scoped `.security-shell a.btn{text-decoration:none}` rule
+  fixes it. Any future anchor-as-button elsewhere hits the same trap.
+- **`Particles` default behavior must stay byte-identical.** The new `palette`/`bold`/
+  `radiate` props are additive on purpose; the 7 studio screens depend on the untouched
+  default path.
+- **The new mockup's `styles.css` has the same literal-`\n` corruption class as the old
+  one** (2 lines, ~379 / ~460), a JS-string generation artifact that breaks real CSS
+  parsers. **Both are OUTSIDE the sections the landing uses**, so nothing needed fixing
+  this time — but anyone porting *further* sections of that mockup must check for and
+  re-apply the fix (same standing gotcha as `mockup/styles.css`, see
+  `web-funnel-app.md`).
+- **No `<head>` resource surprises this time**, but the standing rule from the first port
+  still applies: a font named in ported CSS is not a loaded font. The landing rides
+  `layout.tsx`'s existing Plus Jakarta Sans.
+- **`/landing` is not rate-limited.** `src/proxy.ts`'s matcher covers only `/` and the
+  five API routes, so the landing bypasses the limiter entirely. That is correct today
+  (the page is static and reads no contact data), but it stops being correct the moment
+  the page gains a form or reads a query param.
+
+## Change history
+- 2026-08-24 — Initial doc. BUILT the cybersecurity landing page at `/landing`, ported
+  pixel-faithfully from the new `BDR/AI BDR - Security/` mockup (its `Capabilities` screen,
+  renamed `SecurityLanding` to avoid the studio-screen collision) and made it the site's
+  main page via a temporary `/` → `/landing` 307 (see `web-funnel-app.md`). New:
+  `src/app/landing/page.tsx` (server shell + metadata), `src/flow/screens/SecurityLanding.tsx`
+  (client, carries its own page shell), `src/app/security.css`, `src/content/security.ts`
+  (all copy, `CampaignBundle`-shaped for a later graft), `LogoSymbol.tsx`,
+  `AssistantMark.tsx`. Extended `Ico.tsx` (`eyeoff`, `alert`) and `Particles.tsx`
+  (`palette`/`bold`/`radiate`, default branch verified byte-identical). DECIDED the new
+  design tokens are scoped to `.security-shell`, **not** `:root`, so the parked studio flow
+  keeps its look; peach promoted to `--peach*` tokens as a fixed brand hue that never
+  tracks `--accent`. Zero binary assets needed. Recorded that the primary CTA's Calendly
+  URL is an unverified mockup placeholder, that "Learn more" / "Ask Me Anything" are inert
+  (chat drawer not ported), and that the mobile pass is pending because the mockup has no
+  landing-specific mobile CSS. tsc + lint + build clean, `/landing` prerendered static,
+  `GET /` → 307 verified. All work uncommitted in the working tree at capture. (tcox)
+</content>
+</invoke>

package/knowledge/2.0/apps/ai-bdr/features/web-funnel-app.md

@@ -6,10 +6,11 @@ project: AI-BDR
 client: shared
 type: feature
 status: active
-updated: 2026-07-29
+updated: 2026-08-24
 owners: [tcox]
 files:
   - bdr/PLAN.md
+  - bdr/next.config.ts
   - bdr/.gitignore
   - bdr/src/server/hubspot.ts
   - bdr/src/server/leadSink.ts
@@ -65,6 +66,7 @@ related:
   - web-funnel-content-model.md
   - bdr-web-funnel-plan.md
   - live-call-status.md
+  - security-landing-page.md
   - ../architecture.md
   - ../workflows/safe-call-loop-testing.md
   - ../../worker2/features/vapi-webhook-handler.md
@@ -76,6 +78,13 @@ related:
 
 ## What this is
 
+> **READ FIRST (2026-08-24) — the funnel is currently UNREACHABLE.** `/` now
+> **307-redirects to `/landing`**, the new cybersecurity landing page
+> ([security-landing-page.md](security-landing-page.md)). Everything documented below is
+> still in the repo and still correct, but **nothing in it is reachable in a browser**
+> until the redirect is removed. See "The Agent Studio flow is parked behind a redirect"
+> below before debugging "the funnel doesn't load."
+
 The **built** state of the BDR web funnel — the Next.js UI / lead-capture front
 door of the existing AI-BDR product (see `../architecture.md`). The forward-looking
 plan lives in `bdr-web-funnel-plan.md`; the config-driven content contract lives in
@@ -558,8 +567,30 @@ up — confirm the real owner before assuming.)
   follow-ups (lock the Amplify origin to CloudFront; verify `CloudFront-Viewer-Address` inject+strip
   before trusting it).
 
+## The Agent Studio flow is parked behind a redirect (2026-08-24)
+
+`next.config.ts` gained a `redirects()` entry: **`/` → `/landing`, `permanent: false`**.
+The `307` is temporary **on purpose** — the design decision is not settled, and a `308`
+would be cached by browsers and crawlers and become painful to undo.
+
+- **Nothing was deleted.** All 7 screens, `useAgentFlow`, every `/api/*` route handler, and
+  the lead priming in `page.tsx` remain in the repo, untouched and passing tests. Design may
+  reuse parts of the flow — **do not delete any of it.**
+- **`page.tsx` still exists and still primes leads** — it is simply never reached, so the
+  page-prime HubSpot fetch and Toga upsert **never fire** while the redirect stands.
+- **CONSEQUENCE for CRM links.** A campaign link of the form
+  `/?hsContactId=…&hsCampaignId=…` now lands on the **static** landing page: no phone
+  prefill, no contact lookup, **no page-prime Toga upsert, no campaign attribution**.
+  Anyone re-enabling campaign traffic must remove or rework the redirect first. (This also
+  means the whole `?hsContactId=` enumeration surface is dormant, not fixed.)
+- **`src/proxy.ts` needed no change.** Its matcher is an exact-path allowlist covering only
+  `/` and the five API routes, so `/landing` is neither rate-limited nor rewritten. That is
+  fine for a static page — revisit if the landing ever reads a query param or gains a form.
+
 ## What is parked / not built
 
+- **The entire Agent Studio flow (2026-08-24)** — in-repo but unreachable behind the
+  `/` → `/landing` redirect; see the section above.
 - **Creator screen + `TweaksPanel` — deliberately NOT ported** (parked per plan
   §9.3 / §9.7).
 - **Content is in-repo, not HubSpot (§9.10 RESOLVED by dissolution, 2026-07-16).** The
@@ -585,6 +616,10 @@ up — confirm the real owner before assuming.)
 
 ## Gotchas
 
+- **"The funnel is gone / a CRM link doesn't prefill" — check the redirect FIRST.** Since
+  2026-08-24 `/` 307s to `/landing`, so every symptom that used to mean "missing env" or
+  "rate-limit soft-degrade" can now simply mean the request never reached `page.tsx`. Probe
+  with `curl -I` on `/`: a `307` to `/landing` is the current expected behavior, not a bug.
 - **HIGH (security + availability) — rotating the platform credentials takes BDR dark unless
   BDR's env is updated in the SAME change.** BDR consumes two credentials that are **committed
   literals** elsewhere in the platform: the SES SMTP settings in `_underscore/Email.php` and the
@@ -716,6 +751,20 @@ up — confirm the real owner before assuming.)
   harness; pull it with `npx toga-ai`.
 
 ## Change history
+- 2026-08-24 — **DECIDED: `/` 307-redirects to `/landing` and the whole Agent Studio flow is
+  parked.** `next.config.ts` gained `redirects()` with `permanent: false` (deliberately
+  temporary so browsers/crawlers do not cache it while design settles). The new
+  cybersecurity landing page is now the site's main page —
+  [security-landing-page.md](security-landing-page.md). Nothing was deleted: the 7 screens,
+  `useAgentFlow`, the `/api/*` handlers and `page.tsx` lead priming all remain in the repo
+  and untouched, just unreachable, and design may reuse parts of them. DISCOVERED the two
+  consequences: (1) CRM links `/?hsContactId=…` now land on the static landing, so there is
+  **no prefill, no contact lookup, and no page-prime Toga upsert or campaign attribution**
+  while the flow is parked — revisit before campaign traffic resumes; (2) `src/proxy.ts`
+  needed **no change** (its exact-path matcher covers only `/` and the five API routes), so
+  `/landing` is neither rate-limited nor rewritten. Added the triage gotcha that "the funnel
+  is gone / a link doesn't prefill" now most often means the redirect, not missing env. All
+  work uncommitted in the working tree at capture. (tcox)
 - 2026-07-29 — Four behavior changes plus a security model. (1) **Anonymous phone entry** — the
   `hasLead` submit-block and the `phone.missingContactNotice` copy key were **removed entirely**,
   reversing the 2026-07-16 "Missing contact reference" behavior; the backend is deliberately

package/knowledge/INDEX.md

@@ -28,7 +28,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **toga2-hub** (TOGa Hub) — 2 doc(s) → [2.0/apps/toga2-hub/INDEX.md](2.0/apps/toga2-hub/INDEX.md)
 - **talos** (TOGa IQ) — 7 doc(s) → [2.0/apps/talos/INDEX.md](2.0/apps/talos/INDEX.md)
 - **voice-to-voice** (TOGa Voice) — 4 doc(s) → [2.0/apps/voice-to-voice/INDEX.md](2.0/apps/voice-to-voice/INDEX.md)
-- **ai-bdr** (AI-BDR) — 9 doc(s) → [2.0/apps/ai-bdr/INDEX.md](2.0/apps/ai-bdr/INDEX.md)
+- **ai-bdr** (AI-BDR) — 10 doc(s) → [2.0/apps/ai-bdr/INDEX.md](2.0/apps/ai-bdr/INDEX.md)
 - **toga2-commerce** (TOGa Commerce) — 19 doc(s) → [2.0/apps/toga2-commerce/INDEX.md](2.0/apps/toga2-commerce/INDEX.md)
 - **toga25-supply** (TOGa 2.5 Supply) — 12 doc(s) → [2.0/apps/toga25-supply/INDEX.md](2.0/apps/toga25-supply/INDEX.md)
 - **toga-blox** (TOGa Blox) — 10 doc(s) → [2.0/apps/toga-blox/INDEX.md](2.0/apps/toga-blox/INDEX.md)

package/knowledge/sessions/2026-08-24-bdr-landing-update-tcox.md

@@ -0,0 +1,76 @@
+---
+type: session
+slug: bdr-landing-update
+title: BDR security landing page built at /landing
+author: tcox
+repos: [bdr]
+framework: "2.0"
+client: shared
+status: active
+created: 2026-08-24
+updated: 2026-08-24
+---
+
+# Session: bdr-landing-update
+**Date:** 2026-08-24
+**Project/Repo:** bdr (2.0)
+**Task:** Built the new cybersecurity-services landing page UI for the BDR web funnel (C:\WWW\BDR) from the designer mockup in `BDR/AI BDR - Security/`, served at `/landing` as the site's new main page ("/" redirects to it); Agent Studio flow parked; only the Book CTA is wired (Calendly), everything else inert pending design.
+
+---
+
+## What WORKED
+- Two-agent porting flow: an Explore agent mapped the mockup (screens, tokens, assets, line ranges) in its own context, then a general-purpose implementer wrote all files. Evidence: `npx tsc --noEmit` clean, `npm run lint` clean (including the em-dash ban), `npm run build` clean with `/landing` prerendered static.
+- Token scoping: all new design tokens (accent `#80A4FF`, `--radius:4px`, `--r-pill:999px`, cooler grays, `--grad-1..4`, `--peach` family) declared on `.security-shell` in `src/app/security.css`, NOT `:root`. The 7 existing studio screens are unaffected; `src/components/Particles.tsx` default branch verified line-by-line byte-identical after adding `palette`/`bold`/`radiate` props.
+- Root redirect via `next.config.ts` `redirects()`: `/` → `/landing`, `permanent:false`. Smoke-tested on a temp prod server (port 3111): `GET /` → 307 with `Location: /landing`; `GET /landing` → 200.
+- The landing needs ZERO binary assets — everything is inline SVG (`LogoSymbol`, `AssistantMark`, `Ico` icons) + CSS. Nothing copied to `public/`.
+- Adding `"AI BDR - Security/**"` to `globalIgnores` in `eslint.config.mjs` (next to the existing `mockup/**`) cleared all 96 lint errors in one move.
+- Book CTA as a real `<a class="btn btn-toga btn-lg">` to the Calendly URL (new tab, `rel="noopener noreferrer"`), with one scoped rule `.security-shell a.btn{text-decoration:none}` because studio's `.btn` never resets anchor defaults (all other .btn elements are `<button>`s).
+- `/capture` already ran: knowledge docs `2.0/apps/ai-bdr/features/security-landing-page.md` (new) and `web-funnel-app.md` (parked-flow banner) pushed as `ef0f2e6`.
+
+## What did NOT work — DO NOT RETRY THESE
+- **Glob on `c:\WWW` or even on the BDR repo root times out** (ripgrep 20s timeout, huge tree/node_modules). Use Bash `ls` / `find` with explicit paths for directory listings there instead of Glob with broad patterns.
+- **First Explore (mapping) agent died mid-run**: "API Error: Connection lost mid-response", returned near-zero partial output. A plain re-spawn with the identical prompt succeeded — retry, don't redesign the prompt.
+- **First `npm run lint` reported 96 problems** — every one was inside the un-ignored mockup folder `AI BDR - Security/` (tweaks-panel.jsx etc.), zero in shipped code. Don't chase those errors; the ignore entry is the fix (already in place).
+- **False corruption signal from Grep output**: Grep content mode displayed CSS comment openers as `\*` (e.g. security.css lines 135/139, studio.css 312/768/827), which looks exactly like the mockup's known literal-`\n`/`\"` corruption class. `od -c` proved the actual bytes are a normal `/*`. It's a display artifact of the search tool — do NOT "fix" these lines.
+
+## Not tried yet (candidates for next session)
+- **Mobile pass for the landing**: the mockup has no landing-specific mobile CSS (only the 900px hero-stack and 760px stats/matters breakpoints; its big mobile block has zero `.lp-*` rules). `.lp-value` and small-viewport typography need a deliberate pass in `src/app/security.css`.
+- Porting the mockup's chat drawer (`ChatPanel`) — needed only if design decides "Ask Me Anything"/"Learn more" should open it.
+- Verifying the Calendly slug `toga-technology/risk-assessment` is live (mockup comment calls it a placeholder). Outbound request — was not run.
+- Grafting the copy module `src/content/security.ts` into the `CampaignBundle` schema (`src/content/schema.ts`) once the page becomes campaign-driven.
+- Git: nothing committed. Branch creation needs tcox's go-ahead (team rule: ask first; ticket work uses bare ticket-ID branch names).
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| src/app/landing/page.tsx | created | Server component + metadata; folder renamed from security/; imports ../security.css |
+| src/flow/screens/SecurityLanding.tsx | created | "use client" landing screen with own shell/header/footer; Book = anchor to Calendly; other CTAs inert |
+| src/app/security.css | created | All styles scoped under .security-shell (tokens, btn-toga, lp-* block, 3 media queries, a.btn underline reset) |
+| src/content/security.ts | created | Typed copy module incl. primaryCtaHref (Calendly URL) |
+| src/components/LogoSymbol.tsx | created | Inline TOGA mark SVG, currentColor |
+| src/components/AssistantMark.tsx | created | Talos glyph SVG, per-instance gradient id via useId |
+| src/components/Ico.tsx | modified | Added eyeoff + alert icons (verbatim from mockup) |
+| src/components/Particles.tsx | modified | Added palette/bold/radiate props; default branch byte-identical |
+| eslint.config.mjs | modified | globalIgnores += "AI BDR - Security/**" |
+| next.config.ts | modified | redirects(): / -> /landing, permanent:false (307) |
+| src/proxy.ts | untouched | Verified: matcher covers only / and 5 API routes; /landing unaffected |
+
+All changes are **uncommitted, working tree only** — intentional, awaiting review.
+
+## Decisions made
+- **Route is `/landing`, root 307-redirects to it** (developer + design). Rationale: landing is the main page but the studio flow code must survive untouched for possible reuse; a temporary 307 avoids permanent browser/crawler caching while design settles. Rejected: replacing `src/app/page.tsx` (would gut the flow entry + lead priming); `permanent:true` (308).
+- **New tokens scoped to `.security-shell`, not global** (developer choice via AskUserQuestion). Rejected: re-tokening the whole app, which would visibly re-skin all 7 shipped studio screens (`--r-pill` 8px→999px alone changes every button).
+- **All CTAs unwired except Book → Calendly placeholder** (design-team direction relayed by developer; earlier Book→"/" wiring was removed when design parked the flow).
+- **Peach promoted to `--peach`/`--peach-hover`/`--peach-soft`** rather than hardcoded hexes; peach is a fixed brand hue, not the accent (mockup CLAUDE.md rule: never hardcode accent colors).
+- **Component named `SecurityLanding`** — the mockup calls the screen `Capabilities`, which collides with the existing studio `Capabilities.tsx`. Internal names keep "security" (describes content); only the route says "landing".
+- **Copy lives in `src/content/security.ts`**, not inline JSX and not yet in CampaignBundle — UI-first, graftable later.
+- **KB placement**: landing doc filed under `2.0/apps/ai-bdr/` following precedent; splitting a `2.0/apps/bdr/` tree is a deliberate future (elevated) decision.
+
+## Blockers
+None hard. Pending external inputs: design decisions on "Learn more" / "Ask Me Anything" destinations (chat drawer?), confirmation of the real Calendly link, and the go-ahead to commit/branch.
+
+## Exact next step
+> Run `npm run dev` in `C:\WWW\BDR`, open `http://localhost:3000/` (should 307 to `/landing`), and visually review the page at desktop and narrow widths — then do the mobile CSS pass for the `.lp-*` block in `src/app/security.css` (the mockup ships none).
+
+---
+_Saved by /session-save on 2026-08-24_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.635",
+  "version": "1.0.637",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",