toga-ai 1.0.641 → 1.0.643

package/knowledge/2.0/apps/ai-bdr/features/landing-chat-drawer.md

@@ -130,9 +130,10 @@ So the decision: build the shell now, swap it later.
 
 ## Styling
 
-The `.chatveil` / `.chatpanel` block is ported from the mockup's `styles.css`
-(1177–1220) into `security.css` and is **scoped under `.security-shell`** like every
-other landing rule. `z-index: 120`, width `min(400px, 92vw)`, reduced-motion respected.
+The `.chatveil` / `.chatpanel` block was ported from the security mockup's `styles.css`
+into `security.css` and is **scoped under `.security-shell`** like every other landing
+rule. (The source mockup folder was deleted from the repo on 2026-08-25; `security.css`
+is now the only copy of these styles.) `z-index: 120`, width `min(400px, 92vw)`, reduced-motion respected.
 `.chatmd-p` / `.chatmd-list` carry the reply rhythm. Escape and scrim click close the
 drawer; focus moves into the composer on open and is restored to the opener on close.
 

package/knowledge/2.0/apps/ai-bdr/features/security-landing-page.md

@@ -37,12 +37,14 @@ A single-page **cybersecurity services marketing landing page** at **`/landing`*
 and the 7-screen Agent Studio funnel is parked (see `web-funnel-app.md`). Its job is one
 conversion: *"Book your free risk assessment."*
 
-It is a **pixel-faithful port of a new designer mockup**, not new design work. Source
-mockup: `BDR/AI BDR - Security/` (a React 18 UMD + in-browser Babel prototype —
+It is a **pixel-faithful port of a designer mockup**, not new design work. The source
+mockup lived at `BDR/AI BDR - Security/` (a React 18 UMD + in-browser Babel prototype —
 `app.jsx`, `screens.jsx`, `components.jsx`, `styles.css`, plus a
-`ground-truth-tokens-and-stack.md` token spec). The landing is that mockup's
-**`Capabilities` screen**; because `src/flow/screens/Capabilities.tsx` already exists as a
-studio screen, it was ported under the name **`SecurityLanding`**.
+`ground-truth-tokens-and-stack.md` token spec) but **was deleted from the repo on
+2026-08-25 — the port is complete and the shipped code in `src/` is now the only
+reference.** The landing is that mockup's **`Capabilities` screen**; because
+`src/flow/screens/Capabilities.tsx` already exists as a studio screen, it was ported
+under the name **`SecurityLanding`**.
 
 **Status (updated 2026-08-24): one live backend, nothing else.** The page now carries a
 **Talos chat drawer wired to the real campaign-chat backend** — see
@@ -70,10 +72,9 @@ Section order inside the shell:
 3. **Footer** (`.lp-footer`) — logo mark, name, one line, copyright.
 
 **Zero binary assets.** Every visual is inline SVG or CSS (`LogoSymbol`,
-`AssistantMark`, the `Ico` registry, `Particles`, gradients). The mockup's `agents/` and
-`uploads/` folders are legacy leftovers and are **not referenced** — do not copy them into
-`public/`. This is the opposite of the studio flow, whose agent art is a real asset
-dependency.
+`AssistantMark`, the `Ico` registry, `Particles`, gradients). Nothing was copied into
+`public/` for this page. This is the opposite of the studio flow, whose agent art is a
+real asset dependency.
 
 ## All copy lives in `src/content/security.ts`
 
@@ -126,8 +127,9 @@ does not define or defines differently.
   was verified byte-identical**, so the 7 existing studio screens do not shift. Any future
   change here must keep that property.
 - **`LogoSymbol.tsx`** / **`AssistantMark.tsx`** — new inline-SVG marks.
-- **`eslint.config.mjs`** — `"AI BDR - Security/**"` added to `globalIgnores` alongside
-  `mockup/**`, so the mockup prototype is not linted.
+- **`eslint.config.mjs`** — a `"AI BDR - Security/**"` `globalIgnores` entry existed
+  while the mockup was in the repo; it was removed with the mockup on 2026-08-25 (the
+  studio flow's `mockup/**` entry remains).
 
 ## CTA wiring (read this before assuming the page converts)
 
@@ -194,12 +196,12 @@ ported. All of it is scoped under `.security-shell`.
 - **`Particles` default behavior must stay byte-identical.** The new `palette`/`bold`/
   `radiate` props are additive on purpose; the 7 studio screens depend on the untouched
   default path.
-- **The new mockup's `styles.css` has the same literal-`\n` corruption class as the old
-  one** (2 lines, ~379 / ~460), a JS-string generation artifact that breaks real CSS
-  parsers. **Both are OUTSIDE the sections the landing uses**, so nothing needed fixing
-  this time — but anyone porting *further* sections of that mockup must check for and
-  re-apply the fix (same standing gotcha as `mockup/styles.css`, see
-  `web-funnel-app.md`).
+- **Nothing further can be ported from the security mockup — it was deleted from the
+  repo (2026-08-25).** The chat drawer (see `landing-chat-drawer.md`) was the last piece
+  ported before deletion. Historical note: that mockup's `styles.css` carried the same
+  literal-`\n` corruption class as `mockup/styles.css` (a JS-string generation artifact,
+  see `web-funnel-app.md`) — the standing gotcha still applies to the studio `mockup/`
+  folder, which remains in the repo.
 - **No `<head>` resource surprises this time**, but the standing rule from the first port
   still applies: a font named in ported CSS is not a loaded font. The landing rides
   `layout.tsx`'s existing Plus Jakarta Sans.
@@ -209,6 +211,10 @@ ported. All of it is scoped under `.security-shell`.
   the page gains a form or reads a query param.
 
 ## Change history
+- 2026-08-25 — The source mockup folder `BDR/AI BDR - Security/` was **deleted from the
+  repo** (port complete; shipped code is the reference now). Its `eslint.config.mjs`
+  `globalIgnores` entry was removed with it; the porting-related gotchas are retired.
+  (tcox)
 - 2026-08-24 — Closed both of the doc's open gaps. BUILT the **mobile pass** as original
   work (560px and 420px breakpoints under `.security-shell`; the `.lp-value-motes` inset
   was pulled in to kill horizontal scroll, and `.wordmark-tech` is hidden under 420px) —

package/knowledge/sessions/2026-08-25-bdr-landing-chat-tcox.md

@@ -0,0 +1,84 @@
+---
+type: session
+slug: bdr-landing-chat
+title: BDR /landing mobile pass + Talos chat drawer wired to real campaign-chat backend
+author: tcox
+repos: [bdr]
+framework: "2.0"
+client: shared
+status: active
+created: 2026-08-25
+updated: 2026-08-25
+---
+
+# Session: bdr-landing-chat
+**Date:** 2026-08-25
+**Project/Repo:** bdr (2.0)
+**Task:** On the BDR cybersecurity landing page (C:\WWW\BDR, route `/landing`): did the pending mobile CSS pass, then built the right-side Talos chat drawer (opened by the header "Ask Alex Anything" CTA and the hero "Learn more" button) wired to the REAL api.togaiq.com campaign-chat backend behind a blox-shaped adapter, captured everything to the KB, and retired the now-deleted `AI BDR - Security/` mockup from docs + eslint config. Nothing is committed in the BDR repo.
+
+---
+
+## What WORKED
+- **Mobile pass** appended to `src/app/security.css`: `@media(max-width:560px)` (hero title `clamp(29px,8.4vw,35px)`, hero CTAs stack full-width at 54px, `.lp-value` padding 20px, `.lp-value-motes` inset `-30px -10px` to stop the mote spill opening horizontal scroll at phone width, card/stat padding trims, section spacing) and `@media(max-width:420px)` (`.wordmark-tech` hidden, `.lp-stats` gap 12px). All scoped under `.security-shell`. Evidence: dev server compiled clean, `next build` clean, `/landing` still prerendered static.
+- **Chat drawer built and wired.** New `src/components/ChatPanel.tsx` (drawer shell ported from the mockup's `ChatPanel`), `src/lib/talosChat.ts` (adapter: 64-hex fingerprint in `localStorage["talos_fp"]`, 15-min session token from `POST /api/ai/talos-session` re-minted once on 401, `POST /api/ai/talos-chat` with `campaign_id 43fdf2b6-7a5d-4e85-be6b-911f42aa787f`, message-shape enforcement in `buildApiMessages()`, scripted fallback when unreachable), `src/components/ChatMarkdown.tsx` (safe bold+bullets renderer, text nodes only), `.chatveil/.chatpanel` CSS block in `security.css`, `talos` content group in `src/content/security.ts`, `chatOpen` state + `<ChatPanel>` mount in `src/flow/screens/SecurityLanding.tsx`. Evidence: `npx tsc --noEmit` clean, `npm run lint` clean (incl. no-em-dash rule), `npx vitest run` **367/367** (30 new tests in `test/talosChat.test.ts` + `test/chatMarkdown.test.ts`), `npx next build` clean, `curl` `/` -> 307 -> `/landing` -> 200.
+- **KB captured and pushed** (team repo `_main`): `campaign-chat-handoff.md` created (f27d7f5, API key VALUE deliberately omitted); `/capture` wrote `landing-chat-drawer.md` (new) + updated `security-landing-page.md`, `campaign-chat-handoff.md`, `toga-blox/features/talos-assistant.md` (bfd7ea8); mockup-deletion follow-up pushed (595620a).
+- **Dead eslint ignore removed**: `"AI BDR - Security/**"` dropped from `eslint.config.mjs` `globalIgnores` after the developer deleted that mockup folder; lint still clean (the 96 errors it used to hide are gone with the folder).
+- **Decision path confirmed with the developer via AskUserQuestion**: "Bridge now, blox later" + "Real backend now" (both recommended options accepted).
+
+## What did NOT work — DO NOT RETRY THESE
+- **Spawning the `context-primer` subagent at kickoff Step 4**: hard-blocked by the `kickoff-gate.js` hook (stage 2) with "prime it YOURSELF, IN THE MAIN SESSION — do NOT spawn a subagent". The kickoff skill text says to spawn it; the hook wins. Correct flow: Read the preflight `reads[]` docs directly in the main thread, then run `node "<TEAM_REPO>/knowledge.js" kickoff-primed` to release the gate.
+- **`git push origin _main` in the team knowledge repo without rebasing first**: rejected non-fast-forward TWICE this session (CI "chore: bump version" commits land constantly). Always `git pull --rebase origin _main` immediately before the push, as a separate command; a one-shot `push || (pull --rebase && push)` bash chain did not run the fallback as expected.
+- **Writing a long markdown file via a Bash single-quoted heredoc**: failed with "unexpected EOF while looking for matching `''" (the body's backticks/quotes tripped the shell). Use the Write tool for multi-line files.
+- **Glob on `c:\WWW` or the BDR repo root** (carried forward): ripgrep 20s timeout on the huge tree. Use Bash `ls`/`find` with explicit paths.
+- **Grep content-mode showing `\*` for CSS `/*` comment openers** (carried forward): display artifact, NOT the mockup's literal-`\n` corruption. Do not "fix" those lines.
+- **Consuming blox Talos directly ("force blox now")**: rejected before trying, for the record — blox Talos is unpublished to npm (supply uses a local symlink) and blox peers cap React at `^18` while BDR is React `19.2.4`; would also drag react-router-dom/FA-Pro registry auth into a zero-dep Next app. Do not attempt until blox publishes with React 19 peers.
+
+## Not tried yet (candidates for next session)
+- **Confirm the backend is actually reachable from a browser**: api.togaiq.com endpoints are origin/UA-gated; `localhost:3000`, `bdr.dev.sandbox.togatech.com`, and the prod domain must be allowlisted by the Talos backend owner. Live replies carry suggestion chips; scripted-fallback replies carry none — that is the tell.
+- Render the reply's `cta` button (`book_call`/`contact`/`learn_more`) and `cited_slides` thumbnails (needs `GET /api/ai/campaign/{id}`; presigned image URLs expire ~7 days, re-fetch on load/error). Both are typed in `TalosResponse` but unrendered.
+- Visual QA of the drawer at phone widths (`width:min(400px,92vw)`) — only desktop was smoke-tested via curl/build; no screenshot pass done.
+- Verify the Calendly slug `toga-technology/risk-assessment` is live (still a mockup placeholder).
+- Graft `src/content/security.ts` into the `CampaignBundle` schema when the landing becomes campaign-driven.
+- Contribute `talosChat.ts` (+ `ChatMarkdown.tsx`) upstream to blox for TRUE-80692's deferred "real onSend backend adapter" ticket — tell apeterson; make `baseUrl` a required option there (blox consumers are Vite, `process.env.NEXT_PUBLIC_TALOS_API_BASE` is a Next-ism).
+- **Commit**: everything is working-tree only. Branch creation needs tcox's go-ahead (team rule). `git status` shows the deleted mockup files as `AD` (staged-added, then deleted) — `git add -A` resolves that.
+- Backend owner should rotate the exposed `campaign:manage` key (key_id `2c2a4389-272f-4f05-b36f-f9b6f3de033f`) before go-live — value lives in the secret manager / source handoff, never in the KB.
+- KB hygiene (unrelated to BDR): 20+ knowledge docs end with stray `</content>` / `</invoke>` lines (`grep -rln "^</invoke>$" knowledge/`); `validate` does not catch it. Needs a dedicated cleanup pass.
+
+## Current file state
+| File | Status | Notes |
+|------|--------|-------|
+| src/app/security.css | modified | + mobile pass (560px/420px blocks) + `.chatveil/.chatpanel` drawer block + `.chatmd-*` rules, all under `.security-shell` |
+| src/components/ChatPanel.tsx | created | Right-side drawer shell; Escape/scrim close, focus in/restore; one standing action "Book a meeting" -> Calendly; deliberately disposable (blox TalosPanel later) |
+| src/lib/talosChat.ts | created | `createTalosChatAdapter()` -> `TalosAdapter { onSend(text), reset() }`; fingerprint, token mint/re-mint-once, `buildApiMessages()`, `toTalosResponse()`, `scriptedReply()` fallback; `fetchImpl` test seam |
+| src/components/ChatMarkdown.tsx | created | `toBlocks()` + `renderBoldSpans()`; p/ul/li/strong only, no HTML/links |
+| src/content/security.ts | modified | + `talos` group (title, greeting, chips, placeholder, bookCta, disclaimer, campaignId, fallback entries); dev re-indented to tabs and renamed header CTA to "Ask Alex Anything" |
+| src/flow/screens/SecurityLanding.tsx | modified | `chatOpen` state; header CTA + "Learn more" `onClick` open drawer; `<ChatPanel>` mounted inside `.security-shell`; header comment updated |
+| eslint.config.mjs | modified | removed dead `"AI BDR - Security/**"` ignore (`mockup/**` kept) |
+| test/talosChat.test.ts | created | 23 tests: fingerprint, message shaping (incl. 30-cap alternation), scripted matcher, response filtering, adapter mint/cache/401-re-mint/fallback/reset |
+| test/chatMarkdown.test.ts | created | 7 tests: blocks, CRLF, bullets, html-looking text stays literal, bold spans, unclosed `**` |
+| AI BDR - Security/ (folder) | deleted by dev | mockup prototype removed from repo after port completed; shows as `AD` in git status |
+| mockup/ (studio flow prototype) | untouched | still in repo |
+| src/proxy.ts | untouched | matcher still only `/` + 5 API routes; drawer talks to a third-party origin, limiter not applicable |
+
+All changes are **uncommitted, working tree only** — awaiting tcox's branch/commit go-ahead.
+
+## Decisions made
+- **"Bridge now, blox later" (TRUE-80692)** — build the drawer shell now with the adapter deliberately mirroring blox's `TalosAdapter` seam (`onSend(text) => Promise<TalosResponse>`), so the later swap to blox `TalosPanel` is a re-wire. Rejected: waiting for blox (CTAs would stay inert indefinitely); forcing blox in (unpublished + React 18 peer cap + heavy peer deps).
+- **Wire the real backend now, scripted answers as fallback only** — the campaign-chat contract was already in the KB; the mockup's `askAlex` matcher became data in `security.ts` `talos.fallback`. Rejected: shipping stub-only.
+- **Hand-rolled `ChatMarkdown` instead of `@assistant-ui/react-markdown` / react-markdown** — zero new deps, emits text nodes only, trivially satisfies the handoff's no-HTML/no-unsafe-link rule. Markdown fails soft so unsupported constructs render as text.
+- **"Call me now" NOT rendered in the drawer** — its mockup destination is the parked studio call screen. Standing action is "Book a meeting" -> the page's Calendly href. `cta`/`cited_slides` deferred.
+- **Never read the backend's silent lead/qualification fields** — only `message/suggestions/cta/cited_slides` cross into `TalosResponse` (per the handoff; no CRM sink exists yet).
+- **`campaignId` lives in content (`security.ts`), base URL has an env override** (`NEXT_PUBLIC_TALOS_API_BASE`, default `https://api.togaiq.com`). Campaign id is not a secret; per-landing-page config belongs with the page's content.
+- **Browser-direct calls to api.togaiq.com, not a Next route proxy** — the session token is bound to client IP + UA; proxying server-side would break that binding. The flow is keyless by design so no secret crosses to the client.
+- **API key VALUE kept out of the KB** — the source handoff embeds the `campaign:manage` key in plaintext; the knowledge repo is on GitHub and team rules forbid committing secrets. Recorded key_id + location + rotate-before-go-live only.
+- **KB filing stays under `2.0/apps/ai-bdr/`** — no `2.0/apps/bdr/` tree; that split remains a deliberate future elevated decision.
+- **Mockup deletion (dev's call) reflected in docs, not erased** — provenance kept as history; live-path references, the porting gotchas, and the eslint ignore retired.
+
+## Blockers
+None hard. Pending external inputs: (1) Talos backend owner to allowlist BDR origins on api.togaiq.com (until then the drawer silently uses scripted fallback); (2) design decisions on rendering `cta`/`cited_slides` and on the Calendly link; (3) tcox's go-ahead to branch/commit.
+
+## Exact next step
+> In `C:\WWW\BDR` run `npm run dev`, open http://localhost:3000/landing, click "Ask Alex Anything", and send "What does the free assessment scan?". If the reply shows suggestion chips, the backend is live from localhost; if it shows none (scripted fallback), message the Talos backend owner to allowlist `localhost:3000` and `bdr.dev.sandbox.togatech.com` on api.togaiq.com. Then get tcox's branch go-ahead and commit the working tree (`git add -A` also resolves the `AD` mockup deletions).
+
+---
+_Saved by /session-save on 2026-08-25_

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.641",
+  "version": "1.0.643",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",