toga-ai 1.0.640 → 1.0.641

package/knowledge/2.0/apps/ai-bdr/INDEX.md

@@ -5,9 +5,10 @@
 | [AI-BDR Architecture](architecture.md) | **AI-BDR** is TOGA's outbound AI sales-development representative. | ai-bdr/README.md, ai-bdr/requirements.txt, ai-bdr/.env.example, ai-bdr/docs/client-onboarding-sop.md, ai-bdr/docs/vapi-firstmessage-timing-fix.md, ai-bdr/docs/vapi-inbound-callback-assistant-request.md, ai-bdr/docs/vapi-voicemail-iphone-screening.md, ai-bdr/vapi/templates/system-prompt.template.md, ai-bdr/vapi/templates/assistant.template.json, ai-bdr/prompts/archive/prompt-may-15.txt, ai-bdr/prompts/campaigns/healthcare-2026-03-18.md, ai-bdr/prompts/campaigns/healthcare-v2-2026-03-25.md, ai-bdr/scripts/update_assistant.py, ai-bdr/scripts/update_system_prompt.py, ai-bdr/scripts/update_structured_output.py, ai-bdr/scripts/update_call_summary_context.py, ai-bdr/scripts/fix_booking_guardrails.py, ai-bdr/scripts/get_assistant.py |
 | [BDR Web Funnel — Full Implementation Plan](features/bdr-web-funnel-plan.md) | > **Execution status (2026-07-16):** PLAN **Phases 0–5 are BUILT and QA'd**, Phase 6 > was **mostly already built** (the `info` contract was implemented at comm | bdr/PLAN.md, bdr/mockup/app.jsx, bdr/mockup/screens.jsx, bdr/mockup/components.jsx |
 | [Call Orchestration — PHP Worker ↔ Vapi (the integration seam)](features/call-orchestration.md) | The **PHP worker** is the orchestrator; **Vapi** is the actor. | ai-bdr/docs/client-onboarding-sop.md, ai-bdr/docs/vapi-firstmessage-timing-fix.md, ai-bdr/docs/vapi-inbound-callback-assistant-request.md, ai-bdr/docs/vapi-voicemail-iphone-screening.md, ai-bdr/scripts/update_structured_output.py |
-| [AI-BDR Campaign Chat — Backend Contract + Frontend Widget Handoff](features/campaign-chat-handoff.md) | The consolidated backend + frontend handoff for the **AI-BDR campaign chat** — a grounded AI-BDR chat widget for landing pages, powered by the Talos backend at | ai-bdr-campaign-handoff.md |
+| [AI-BDR Campaign Chat — Backend Contract + Frontend Widget Handoff](features/campaign-chat-handoff.md) | The consolidated backend + frontend handoff for the **AI-BDR campaign chat** — a grounded AI-BDR chat widget for landing pages, powered by the Talos backend at | ai-bdr-campaign-handoff.md, bdr/src/lib/talosChat.ts |
+| [Talos Chat Drawer on /landing (first campaign-chat consumer)](features/landing-chat-drawer.md) | The **right-anchored chat drawer on `/landing`**, wired to the **real** Talos campaign-chat backend at `https://api.togaiq.com`. | bdr/src/components/ChatPanel.tsx, bdr/src/components/ChatMarkdown.tsx, bdr/src/lib/talosChat.ts, bdr/src/content/security.ts, bdr/src/flow/screens/SecurityLanding.tsx, bdr/src/app/security.css, bdr/test/talosChat.test.ts, bdr/test/chatMarkdown.test.ts |
 | [Live Call Status — Vapi call API → funnel Success screen lifecycle](features/live-call-status.md) | The BDR funnel's Success screen shows the **real** state of the call it just requested — dialing / ringing / answered-and-talking / ended / not-answered — inste | bdr/src/server/vapiCall.ts, bdr/src/server/callStatus.ts, bdr/src/server/statusToken.ts, bdr/src/server/callbackService.ts, bdr/src/server/workerDialer.ts, bdr/src/lib/callStatus.ts, bdr/src/app/api/call-status/route.ts, bdr/src/app/api/call-now/route.ts, bdr/src/flow/useCallStatusViewModel.ts, bdr/src/flow/callStatusApi.ts, bdr/src/flow/screens/Success.tsx, bdr/src/content/schema.ts, bdr/src/content/default.ts, bdr/src/proxy.ts |
-| [Cybersecurity Landing Page (/landing — the site's current main page)](features/security-landing-page.md) | A single-page **cybersecurity services marketing landing page** at **`/landing`** in the `bdr` repo — and, as of 2026-08-24, **the site's main page**: `/` **307 | bdr/src/app/landing/page.tsx, bdr/src/app/security.css, bdr/src/flow/screens/SecurityLanding.tsx, bdr/src/content/security.ts, bdr/src/components/LogoSymbol.tsx, bdr/src/components/AssistantMark.tsx, bdr/src/components/Ico.tsx, bdr/src/components/Particles.tsx, bdr/next.config.ts, bdr/eslint.config.mjs |
+| [Cybersecurity Landing Page (/landing — the site's current main page)](features/security-landing-page.md) | A single-page **cybersecurity services marketing landing page** at **`/landing`** in the `bdr` repo — and, as of 2026-08-24, **the site's main page**: `/` **307 | bdr/src/app/landing/page.tsx, bdr/src/app/security.css, bdr/src/flow/screens/SecurityLanding.tsx, bdr/src/content/security.ts, bdr/src/components/LogoSymbol.tsx, bdr/src/components/AssistantMark.tsx, bdr/src/components/Ico.tsx, bdr/src/components/Particles.tsx, bdr/src/components/ChatPanel.tsx, bdr/src/components/ChatMarkdown.tsx, bdr/src/lib/talosChat.ts, bdr/next.config.ts, bdr/eslint.config.mjs |
 | [Vapi Integration — Assistants, Tools, Structured Output](features/vapi-integration.md) | Everything inside Vapi: the three assistants, the three shared tools, the shared structured-output schema, the Liquid-templated system prompt, and the Python sc | ai-bdr/vapi/templates/assistant.template.json, ai-bdr/vapi/templates/system-prompt.template.md, ai-bdr/prompts/archive/prompt-may-15.txt, ai-bdr/prompts/campaigns/healthcare-2026-03-18.md, ai-bdr/prompts/campaigns/healthcare-v2-2026-03-25.md, ai-bdr/prompts/templates/campaign-template.md, ai-bdr/scripts/update_assistant.py, ai-bdr/scripts/update_system_prompt.py, ai-bdr/scripts/update_structured_output.py, ai-bdr/scripts/update_call_summary_context.py, ai-bdr/scripts/fix_booking_guardrails.py, ai-bdr/scripts/get_assistant.py, ai-bdr/docs/vapi-firstmessage-timing-fix.md, ai-bdr/docs/vapi-voicemail-iphone-screening.md |
 | [Web Funnel — Built Next.js App (structure, stack, how to run)](features/web-funnel-app.md) | > **READ FIRST (2026-08-24) — the funnel is currently UNREACHABLE.** `/` now > **307-redirects to `/landing`**, the new cybersecurity landing page > ([security- | bdr/PLAN.md, bdr/next.config.ts, bdr/.gitignore, bdr/src/server/hubspot.ts, bdr/src/server/leadSink.ts, bdr/src/server/callbackService.ts, bdr/src/server/workerDialer.ts, bdr/src/server/mailer.ts, bdr/src/server/statusToken.ts, bdr/src/server/vapiCall.ts, bdr/src/server/callStatus.ts, bdr/src/lib/summaryText.ts, bdr/src/lib/emailFormat.ts, bdr/src/lib/callStatus.ts, bdr/src/app/api/share-summary/route.ts, bdr/src/app/api/call-status/route.ts, bdr/src/flow/shareSummaryApi.ts, bdr/src/flow/callStatusApi.ts, bdr/src/flow/useCallStatusViewModel.ts, bdr/src/flow/screens/Success.tsx, bdr/src/flow/screens/CallNow.tsx, bdr/src/flow/screens/Schedule.tsx, bdr/src/flow/screens/CallSummary.tsx, bdr/src/content/schema.ts, bdr/src/content/default.ts, bdr/test/togaEnrichment.test.ts, bdr/test/fastDial.test.ts, bdr/eslint.config.mjs, bdr/amplify.yml, bdr/src/app, bdr/src/app/layout.tsx, bdr/src/app/page.tsx, bdr/src/app/studio.css, bdr/src/lib/resolveCampaignId.ts, bdr/src/lib/scheduleSlots.ts, bdr/src/lib/formatPhone.ts, bdr/src/lib/analytics.ts, bdr/src/lib/rateLimit.ts, bdr/src/lib/clientIp.ts, bdr/src/proxy.ts, bdr/.env.example, bdr/src/components/GoogleAnalytics.tsx, bdr/src/components/RichText.tsx, bdr/src/content, bdr/src/components, bdr/src/flow, bdr/src/server, bdr/src/server/toga.ts, bdr/src/app/api, bdr/test, bdr/test/togaPrimaryPhone.test.ts, bdr/public, bdr/mockup/styles.css |
 | [Web Funnel — Next.js UI + Config-Driven Campaign Content](features/web-funnel-content-model.md) | > **Status note (RESOLVED 2026-07-16):** the content **contract** below (schema, > provider seam, adapters) is BUILT and QA'd (PLAN Phases 0–5). | bdr/src/content/schema.ts, bdr/src/content/provider.ts, bdr/src/content/useCampaign.ts, bdr/src/content/default.ts, bdr/src/lib/resolveCampaignId.ts, bdr/src/server/leadSink.ts, bdr/src/server/callbackService.ts, bdr/src/app/api/call-now/route.ts, bdr/src/app/api/call-later/route.ts, bdr/src/app/api/contact/route.ts |

package/knowledge/2.0/apps/ai-bdr/features/campaign-chat-handoff.md

@@ -6,11 +6,13 @@ project: AI-BDR
 client: shared
 type: feature
 status: active
-updated: 2026-08-24
+updated: 2026-08-25
 owners: [tcox]
 files:
   - ai-bdr-campaign-handoff.md
+  - bdr/src/lib/talosChat.ts
 related:
+  - landing-chat-drawer.md
   - security-landing-page.md
   - web-funnel-app.md
   - ../architecture.md
@@ -34,11 +36,20 @@ architecture deep-dive in `docs/ai-bdr-campaign-chat-architecture.md`). This
 knowledge doc distills the contract and records the load-bearing decisions and
 gotchas — the source handoff carries the full copy-paste implementation code.
 
-**Direct relevance to BDR:** the cybersecurity landing page's inert
-**"Ask Me Anything"** header CTA (see [security-landing-page.md](security-landing-page.md) —
-the mockup's un-ported chat drawer) is exactly the kind of consumer this widget
-was specified for, and the first live campaign is **"External Pen Testing"** —
-the same offer the landing page sells.
+**The first consumer now exists.** As of 2026-08-24 the `bdr` cybersecurity landing page
+ships a chat drawer against this contract, grounded in the "External Pen Testing"
+campaign — the same offer the landing sells. It lives in `bdr/src/lib/talosChat.ts`
+(adapter) + `ChatPanel.tsx` / `ChatMarkdown.tsx`, and is documented in
+[landing-chat-drawer.md](landing-chat-drawer.md). Read that doc before building the
+**second** consumer; it is the worked example of this contract.
+
+**It was NOT built on assistant-ui.** The *Frontend build* section below still describes
+the handoff's original `@assistant-ui/react` + `useLocalRuntime` recipe, which remains a
+valid path. BDR deliberately went a different way: a hand-rolled drawer plus a
+**blox-shaped adapter** (`onSend(text) => Promise<TalosResponse>`, matching
+`@agilant/toga-blox`'s `TalosAdapter` seam), so the shell can later be swapped for blox's
+shared `TalosPanel` without rewriting the backend layer. Treat assistant-ui as one
+option, not the house standard.
 
 ## Design decision (settled — do not re-litigate)
 
@@ -158,6 +169,14 @@ from `data`.
 
 ## Gotchas
 
+- **Every consumer domain must be allowlisted by the Talos backend owner** — the
+  origin/UA gate on `talos-session` / `talos-chat` / `campaign` is per-origin, so
+  `localhost:3000`, each sandbox host (e.g. `bdr.dev.sandbox.togatech.com`), and the
+  production domain each need adding **before** the widget can answer live. Budget this
+  as a real dependency on someone else, not a config flag you own. A well-built consumer
+  degrades silently here (BDR's does), which makes "it works on my machine"
+  indistinguishable from "the backend refused us" unless you check for a live-only
+  signal such as backend-chosen `suggestions`.
 - **Presigned deck-image URLs EXPIRE (~7 days).** `image_url` is a presigned S3
   URL because `CAMPAIGN_ASSET_CDN_BASE_URL` is currently unset — do not cache
   long-term; re-fetch the campaign read on page load / image error. Once the
@@ -181,6 +200,13 @@ from `data`.
   internal-only** now that campaign traffic rides the same path.
 
 ## Change history
+- 2026-08-24 — First consumer built and shipped into the `bdr` working tree: the
+  `/landing` chat drawer ([landing-chat-drawer.md](landing-chat-drawer.md)), grounded in
+  the "External Pen Testing" campaign. Recorded that it deliberately did **not** use the
+  handoff's assistant-ui recipe, using a blox-`TalosAdapter`-shaped seam instead so the
+  shell can be swapped for blox's shared `TalosPanel` later. Added the per-origin
+  allowlist gotcha — every consumer domain needs the Talos backend owner to allowlist it,
+  and a graceful consumer hides that failure. (tcox)
 - 2026-08-24 — Initial doc: captured the consolidated AI-BDR campaign chat
   handoff (backend contract at api.togaiq.com + frontend widget spec on
   assistant-ui). Markdown + structured-data format settled over XML tags;

package/knowledge/2.0/apps/ai-bdr/features/landing-chat-drawer.md

@@ -0,0 +1,176 @@
+---
+title: Talos Chat Drawer on /landing (first campaign-chat consumer)
+framework: "2.0"
+repo: ai-bdr
+project: AI-BDR
+client: shared
+type: feature
+status: active
+updated: 2026-08-25
+owners: [tcox]
+files:
+  - bdr/src/components/ChatPanel.tsx
+  - bdr/src/components/ChatMarkdown.tsx
+  - bdr/src/lib/talosChat.ts
+  - bdr/src/content/security.ts
+  - bdr/src/flow/screens/SecurityLanding.tsx
+  - bdr/src/app/security.css
+  - bdr/test/talosChat.test.ts
+  - bdr/test/chatMarkdown.test.ts
+related:
+  - security-landing-page.md
+  - campaign-chat-handoff.md
+  - web-funnel-app.md
+  - ../../toga-blox/features/talos-assistant.md
+---
+
+## What this is
+
+The **right-anchored chat drawer on `/landing`**, wired to the **real** Talos
+campaign-chat backend at `https://api.togaiq.com`. It is the **first live consumer**
+of the contract in [campaign-chat-handoff.md](campaign-chat-handoff.md), grounded in
+campaign `43fdf2b6-7a5d-4e85-be6b-911f42aa787f` ("External Pen Testing") — the same
+offer the landing page sells.
+
+It opens from **both** entry points that were previously inert: the header CTA
+("Ask Alex Anything") and the hero "Learn more" button.
+
+Three pieces, deliberately separated:
+
+| File | Role | Disposable? |
+|---|---|---|
+| `components/ChatPanel.tsx` | Drawer **shell** (scrim, header, message list, chips, composer) | **Yes** — planned replacement by blox `TalosPanel` |
+| `lib/talosChat.ts` | Backend **adapter** (session, message shaping, fallback) | No — the durable piece |
+| `components/ChatMarkdown.tsx` | Safe markdown **renderer** for the reply | No — portable as-is |
+
+## How it works
+
+1. **Fingerprint.** `getFingerprint()` returns a per-browser 64-lowercase-hex id
+   persisted in `localStorage` under `talos_fp` (32 random bytes), with an in-memory
+   fallback when storage is unavailable.
+2. **Session token.** `POST /api/ai/talos-session` mints a ~15-min JWT bound to that
+   fingerprint. It is cached in the adapter and re-minted **exactly once** on a 401;
+   a second 401 falls through to the scripted fallback rather than looping.
+3. **Turn.** Non-streaming `POST /api/ai/talos-chat` with `Bearer <token>`,
+   `campaign_id`, and the shaped `messages` array.
+4. **Render.** `message` goes through `ChatMarkdown`; `suggestions` become quick-reply
+   chips whose text is sent as the next user message.
+
+**Message-shape enforcement lives in `buildApiMessages()`**, not in the UI. The backend
+requires alternating `user`/`assistant`, starting **and** ending with `user`, max 30 —
+so the builder drops the canned greeting, merges consecutive same-role turns, and
+trims from the front to the cap while preserving alternation. The visible transcript
+and the wire transcript are deliberately not the same list.
+
+**Adapter seam:** `createTalosChatAdapter(options)` returns a `TalosAdapter` whose only
+method is `onSend(text) => Promise<TalosResponse>` — intentionally the same shape as
+blox's `TalosAdapter` (see *Bridge to blox* below).
+
+Base URL resolution: `options.baseUrl ?? process.env.NEXT_PUBLIC_TALOS_API_BASE ??
+"https://api.togaiq.com"`.
+
+## Offline fallback (the drawer never dead-ends)
+
+When the backend is unreachable — offline, **origin not allowlisted**, 5xx, timeout —
+the adapter answers from the mockup's scripted `askAlex` answers, which now live as
+**data** in `src/content/security.ts` under the `talos.fallback` group (not hardcoded
+in the adapter).
+
+- Fallback replies are flagged `offline: true` and carry **no** suggestion chips.
+- **That is how you tell live from fallback in the UI:** live replies carry
+  backend-chosen chips; fallback replies have none.
+- Alternation is preserved across a fallback turn, so a later live turn is still a
+  valid request (covered by a test).
+
+## Safety
+
+- `ChatMarkdown` supports only paragraphs, `- ` bullets, and `**bold**`. It emits
+  **only** text nodes plus `p` / `ul` / `li` / `strong`. **No HTML parsing, no links,
+  no `dangerouslySetInnerHTML`** — html-looking content stays literal text (tested).
+  An unclosed `**` stays literal.
+- Only rendered fields (`message`, `suggestions`, `cta`, `cited_slides`) are mapped
+  into the response type by `toTalosResponse()`. The backend's **silent
+  lead/qualification fields are never read** — deliberate, per the handoff.
+
+## Deliberate deviations from the mockup drawer
+
+- **"Call me now" is NOT rendered.** Its destination is the parked studio call screen,
+  unreachable from this page. The standing drawer action is **"Book a meeting"** →
+  the same Calendly href as the page's primary CTA.
+- **`cta` and `cited_slides` are captured and typed but not rendered yet.** Both are
+  clean follow-ups; `cited_slides` additionally needs `GET /api/ai/campaign/{id}` plus
+  presigned-URL freshness handling (those URLs expire ~7 days — see the handoff).
+
+## Bridge to blox (TRUE-80692 — "bridge now, blox later")
+
+blox ships a shared Talos component
+([talos-assistant.md](../../toga-blox/features/talos-assistant.md), apeterson,
+2026-08-20). BDR does **not** use it yet, for two blox-side reasons, both unscheduled:
+
+- blox is **not published to npm** for this component (toga25-supply consumes it via a
+  local symlink; BDR cannot symlink a Next app dependency the same way), and
+- blox **peers cap React at ^18**, while BDR is on **React 19.2.4**.
+
+So the decision: build the shell now, swap it later.
+
+- `ChatPanel.tsx` is **deliberately disposable** — expect it to be deleted and replaced
+  by blox `TalosPanel`.
+- `talosChat.ts` **deliberately mirrors blox's `TalosAdapter` seam**
+  (`onSend(text) => Promise<TalosResponse>`), so the swap is a **re-wire, not a rebuild**.
+- `talosChat.ts` is the candidate implementation for blox's deferred *"real `onSend`
+  backend adapter"* ticket — contribute it upstream when that ticket is picked up
+  (mention to apeterson). The one env-ism to fix on the way: the
+  `process.env.NEXT_PUBLIC_TALOS_API_BASE` default is Next-specific; blox consumers are
+  Vite, so it becomes a **required `baseUrl` option**.
+- `ChatMarkdown.tsx` is portable as-is; it would need `className` → `--talos-*`
+  tokenization.
+- **Design caveat:** blox `TalosPanel`'s spacing/density is not yet tokenized (its
+  documented theming ceiling), so even fully themed it will **not** match the security
+  mockup drawer pixel-for-pixel. Accept that at swap time or fund the spacing-token pass.
+
+## Styling
+
+The `.chatveil` / `.chatpanel` block is ported from the mockup's `styles.css`
+(1177–1220) into `security.css` and is **scoped under `.security-shell`** like every
+other landing rule. `z-index: 120`, width `min(400px, 92vw)`, reduced-motion respected.
+`.chatmd-p` / `.chatmd-list` carry the reply rhythm. Escape and scrim click close the
+drawer; focus moves into the composer on open and is restored to the opener on close.
+
+## Gotchas
+
+- **`api.togaiq.com` chat endpoints are origin/UA-gated.** `localhost:3000`,
+  `bdr.dev.sandbox.togatech.com`, and the eventual production domain **must be
+  allowlisted by the Talos backend owner**. Until they are, the drawer silently answers
+  from the scripted fallback and looks like it works. Check for suggestion chips before
+  concluding the backend is live.
+- **Do not "fix" the transcript by sending the visible message list.** The greeting and
+  any merged/trimmed turns would break the strict alternating shape and return a 422.
+- **The chat is fully client-side**, which is why `/landing` still builds as a
+  **prerendered static** route. Adding a server call here changes that.
+- **`/landing` is not rate-limited** (`src/proxy.ts` matches only `/` and the five API
+  routes). The drawer talks to a third-party origin, not a BDR API route, so the
+  limiter still does not apply — but the abuse surface now exists on the page.
+
+## How to work on it
+
+- 30 new Vitest tests across `test/talosChat.test.ts` and `test/chatMarkdown.test.ts`
+  (message-shape rules including the 30-cap alternation, 401 re-mint-once, fallback on
+  network error and on 5xx, alternation preserved across a fallback turn, adapter
+  reset, markdown safety). Suite **367/367 green**; `tsc`, `eslint` (incl. the
+  no-em-dash rule), and `next build` all clean as of 2026-08-24.
+- **Nothing is committed** — the drawer lives in the `bdr` working tree only, awaiting
+  the developer's branch/commit go-ahead.
+
+## Change history
+- 2026-08-24 — Initial doc. BUILT the `/landing` Talos chat drawer wired to the real
+  campaign-chat backend: `ChatPanel.tsx` (right-anchored drawer ported from the security
+  mockup), `lib/talosChat.ts` (fingerprint + 15-min session token + message-shape
+  enforcement + scripted offline fallback), `ChatMarkdown.tsx` (link-free, HTML-free
+  markdown subset), the `.chatveil`/`.chatpanel` CSS block, and the `talos` content group.
+  Both previously-inert entry points (header CTA "Ask Alex Anything", hero "Learn more")
+  now open it. DECIDED "bridge now, blox later" for TRUE-80692 — blox is unpublished and
+  React-18-capped, so the shell is disposable while the adapter mirrors blox's
+  `TalosAdapter` seam for a later re-wire. DECIDED not to render the mockup's "Call me
+  now" (parked studio destination) and to defer `cta`/`cited_slides` rendering. Recorded
+  the origin/UA allowlist dependency as the reason the drawer may silently answer from
+  fallback. 30 new tests, 367/367 green. Uncommitted at capture. (tcox)

package/knowledge/2.0/apps/ai-bdr/features/security-landing-page.md

@@ -6,7 +6,7 @@ project: AI-BDR
 client: shared
 type: feature
 status: active
-updated: 2026-08-24
+updated: 2026-08-25
 owners: [tcox]
 files:
   - bdr/src/app/landing/page.tsx
@@ -17,9 +17,14 @@ files:
   - bdr/src/components/AssistantMark.tsx
   - bdr/src/components/Ico.tsx
   - bdr/src/components/Particles.tsx
+  - bdr/src/components/ChatPanel.tsx
+  - bdr/src/components/ChatMarkdown.tsx
+  - bdr/src/lib/talosChat.ts
   - bdr/next.config.ts
   - bdr/eslint.config.mjs
 related:
+  - landing-chat-drawer.md
+  - campaign-chat-handoff.md
   - web-funnel-app.md
   - web-funnel-content-model.md
   - ../architecture.md
@@ -39,8 +44,11 @@ mockup: `BDR/AI BDR - Security/` (a React 18 UMD + in-browser Babel prototype
 **`Capabilities` screen**; because `src/flow/screens/Capabilities.tsx` already exists as a
 studio screen, it was ported under the name **`SecurityLanding`**.
 
-**Status: UI only.** Nothing is wired to a backend — no lead capture, no Toga/HubSpot
-call, no analytics events of its own. Wiring is a later decision (see *CTA wiring* below).
+**Status (updated 2026-08-24): one live backend, nothing else.** The page now carries a
+**Talos chat drawer wired to the real campaign-chat backend** — see
+[landing-chat-drawer.md](landing-chat-drawer.md), which owns that subject. Everything
+else is still UI only: no form, no lead capture, no Toga/HubSpot call, no analytics
+events of its own.
 
 ## Page structure
 
@@ -129,8 +137,25 @@ does not define or defines differently.
   **CAVEAT: that URL is a placeholder carried over from the mockup** (the mockup's own
   comment says "replace with the real TOGA Calendly link") and the slug's liveness has
   **not** been verified. Confirm it before pointing traffic at the page.
-- **"Learn more"** and the header CTA **"Ask Me Anything"** render **inert**. In the
-  mockup, "Ask Me Anything" opened a chat drawer; **the drawer was not ported.**
+- **"Learn more"** and the header CTA (**"Ask Alex Anything"** — renamed 2026-08-24 from
+  the mockup's "Ask Me Anything") both **open the Talos chat drawer** as of 2026-08-24.
+  Neither is inert any more. The drawer, its backend adapter, and its offline fallback
+  are documented in [landing-chat-drawer.md](landing-chat-drawer.md).
+
+## Responsive / mobile pass (original work, not ported)
+
+The mockup ships **no** landing-specific mobile CSS below its 900px hero-stack and 760px
+stats/matters breakpoints, so the phone treatment below ~760px was **designed here**, not
+ported. All of it is scoped under `.security-shell`.
+
+- **`@media (max-width: 560px)`** — hero title re-clamped to `clamp(29px, 8.4vw, 35px)`;
+  the two hero CTAs stack **full-width** at `height: 54px`; value-tile padding `20px`;
+  matters-card / stat padding trimmed; stat figure `23px`; section spacing tightened.
+  **`.lp-value-motes` inset pulled in from `-42px/-34px` to `-30px/-10px`** — at
+  full-width the mote spill poked past the viewport edge and opened **horizontal
+  scroll** on phones. Do not widen it back without re-checking on a real device.
+- **`@media (max-width: 420px)`** — **`.wordmark-tech` is hidden** (the letterspaced
+  "TECHNOLOGY" suffix and the header pill cannot share a ~360px topbar); stats gap `12px`.
 
 ## How to work on it
 
@@ -142,13 +167,15 @@ does not define or defines differently.
 
 ## Known gaps / pending work
 
-- **Mobile pass is pending.** The mockup has almost no landing-specific mobile CSS: only a
-  900px hero-stack and a 760px stats/matters breakpoint. Its big "mobile pass" block
-  contains **zero `.lp-*` rules**, so there is no design to port — the responsive
-  treatment below ~760px is an open design question, not a porting oversight.
-- **Chat drawer not ported** (the header CTA's mockup behavior).
-- **Calendly URL unverified** (above).
+- **Calendly URL unverified** (above) — still the top open item, and now also the
+  drawer's "Book a meeting" destination, so a bad slug breaks two paths.
+- **Chat drawer's origin allowlist is not done** — `api.togaiq.com` is origin/UA gated,
+  so until localhost / sandbox / prod domains are allowlisted the drawer silently answers
+  from its scripted fallback (see [landing-chat-drawer.md](landing-chat-drawer.md)).
 - No form, no lead capture, no landing-specific analytics.
+- ~~Mobile pass pending~~ — **done 2026-08-24** (see *Responsive / mobile pass* above).
+- ~~Chat drawer not ported~~ — **done 2026-08-24**, and wired to the real backend rather
+  than re-creating the mockup's scripted-only behavior.
 
 ## Gotchas
 
@@ -182,6 +209,14 @@ does not define or defines differently.
   the page gains a form or reads a query param.
 
 ## Change history
+- 2026-08-24 — Closed both of the doc's open gaps. BUILT the **mobile pass** as original
+  work (560px and 420px breakpoints under `.security-shell`; the `.lp-value-motes` inset
+  was pulled in to kill horizontal scroll, and `.wordmark-tech` is hidden under 420px) —
+  the mockup had no landing-specific mobile CSS to port. BUILT the **Talos chat drawer**,
+  wired to the real campaign-chat backend, opened by both previously-inert entry points
+  (header CTA, now "Ask Alex Anything", and hero "Learn more"); the drawer is its own
+  subject in [landing-chat-drawer.md](landing-chat-drawer.md). Page remains prerendered
+  static (chat is fully client-side); still no form, lead capture, or analytics. (tcox)
 - 2026-08-24 — Initial doc. BUILT the cybersecurity landing page at `/landing`, ported
   pixel-faithfully from the new `BDR/AI BDR - Security/` mockup (its `Capabilities` screen,
   renamed `SecurityLanding` to avoid the studio-screen collision) and made it the site's
@@ -198,5 +233,3 @@ does not define or defines differently.
   (chat drawer not ported), and that the mobile pass is pending because the mockup has no
   landing-specific mobile CSS. tsc + lint + build clean, `/landing` prerendered static,
   `GET /` → 307 verified. All work uncommitted in the working tree at capture. (tcox)
-</content>
-</invoke>

package/knowledge/2.0/apps/toga-blox/features/talos-assistant.md

@@ -6,8 +6,8 @@ project: TOGa Blox
 client: shared
 type: feature
 status: active
-updated: 2026-08-20
-owners: [apeterson]
+updated: 2026-08-25
+owners: [apeterson, tcox]
 files:
   - toga-blox/src/components/Talos/TalosLauncher.tsx
   - toga-blox/src/components/Talos/TalosPanel.tsx
@@ -23,6 +23,7 @@ related:
   - ../architecture.md
   - ../workflows/dynamic-publish-pipeline.md
   - ../../toga25-supply/features/talos-integration.md
+  - ../../ai-bdr/features/landing-chat-drawer.md
 ---
 
 ## Summary
@@ -77,10 +78,25 @@ Open questions were handed to the UX/UI team.
 ## Gotchas
 
 - The real chat backend is a later ticket — `onSend` is stubbed; do not assume live responses.
+  **A working candidate implementation already exists outside blox:** `bdr/src/lib/talosChat.ts`
+  was written against the same `onSend(text) => Promise<TalosResponse>` seam and talks to the
+  live Talos campaign-chat backend (session token, fingerprint, strict message shaping, offline
+  fallback) — see
+  [AI-BDR landing chat drawer](../../ai-bdr/features/landing-chat-drawer.md). Consider
+  upstreaming it when the adapter ticket is picked up; the only env-ism to change is its
+  Next-specific `process.env.NEXT_PUBLIC_TALOS_API_BASE` default, which becomes a required
+  `baseUrl` option for Vite consumers.
+- **BDR cannot consume blox Talos today** — blox is unpublished for this component and its peers
+  cap React at `^18`, while `bdr` is on React 19.2.4. That is why BDR hand-rolled a disposable
+  panel shell instead of waiting; both blockers are blox-side and unscheduled.
 - blox `dist` is gitignored (shipped via publish, not the branch). Other consumers only get
   Talos after blox is **published** per the `_sandbox-dev` dist-tag workflow — see
   [Dynamic npm Publish Pipeline](../workflows/dynamic-publish-pipeline.md). toga25-supply
   currently consumes it via a local symlink.
 
 ## Change history
+- 2026-08-24 — Cross-reference only (no blox code change): recorded that `bdr` built a live
+  backend adapter against this component's `onSend` seam (`bdr/src/lib/talosChat.ts`) as a
+  candidate for the deferred real-backend ticket, and that BDR cannot consume blox Talos yet
+  (unpublished + React `^18` peer cap vs BDR's React 19). (tcox)
 - 2026-08-20 — Built Talos shared AI-assistant component (launcher + docked/expanded chat panel): pure-UI + injected `TalosAdapter`, controlled open/expanded/width, fully `--talos-*` tokenized styling with typed `TalosTheme` overrides, stub adapter. Two adversarial review passes hardened it (removed a `window.dispatchEvent("resize")` side channel and a hardcoded initials literal; moved resize into an effect with cleanup + rAF throttle + keyboard `role="separator"`; SSR-safe portal guard; memoized message/handlers; restored the attach button + 11px card radius). Documented the spacing/density theming ceiling as future work (apeterson).

package/knowledge/INDEX.md

@@ -28,7 +28,7 @@ _Auto-generated by `knowledge.js index`. Do not hand-edit._
 - **toga2-hub** (TOGa Hub) — 2 doc(s) → [2.0/apps/toga2-hub/INDEX.md](2.0/apps/toga2-hub/INDEX.md)
 - **talos** (TOGa IQ) — 7 doc(s) → [2.0/apps/talos/INDEX.md](2.0/apps/talos/INDEX.md)
 - **voice-to-voice** (TOGa Voice) — 4 doc(s) → [2.0/apps/voice-to-voice/INDEX.md](2.0/apps/voice-to-voice/INDEX.md)
-- **ai-bdr** (AI-BDR) — 11 doc(s) → [2.0/apps/ai-bdr/INDEX.md](2.0/apps/ai-bdr/INDEX.md)
+- **ai-bdr** (AI-BDR) — 12 doc(s) → [2.0/apps/ai-bdr/INDEX.md](2.0/apps/ai-bdr/INDEX.md)
 - **toga2-commerce** (TOGa Commerce) — 19 doc(s) → [2.0/apps/toga2-commerce/INDEX.md](2.0/apps/toga2-commerce/INDEX.md)
 - **toga25-supply** (TOGa 2.5 Supply) — 12 doc(s) → [2.0/apps/toga25-supply/INDEX.md](2.0/apps/toga25-supply/INDEX.md)
 - **toga-blox** (TOGa Blox) — 10 doc(s) → [2.0/apps/toga-blox/INDEX.md](2.0/apps/toga-blox/INDEX.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.640",
+  "version": "1.0.641",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",