toga-ai 1.0.647 → 1.0.649

package/knowledge/2.0/apps/ai-bdr/features/landing-chat-drawer.md

@@ -139,11 +139,20 @@ drawer; focus moves into the composer on open and is restored to the opener on c
 
 ## Gotchas
 
-- **`api.togaiq.com` chat endpoints are origin/UA-gated.** `localhost:3000`,
-  `bdr.dev.sandbox.togatech.com`, and the eventual production domain **must be
-  allowlisted by the Talos backend owner**. Until they are, the drawer silently answers
-  from the scripted fallback and looks like it works. Check for suggestion chips before
-  concluding the backend is live.
+- **`api.togaiq.com` chat endpoints are origin/UA-gated — verified 2026-08-25 with
+  browser-shaped `curl` probes:** from origin `http://localhost:3000` the whole flow
+  works end-to-end (token minted, real Sonnet reply with `suggestions`/`cta`/
+  `cited_slides`), so **local dev gets live answers**. From origin
+  `https://bdr.dev.sandbox.togatech.com` the session mint returns **`403 Forbidden`**
+  — the sandbox origin is **not allowlisted**, so the deployed drawer silently answers
+  from the scripted fallback and looks like it works. The eventual production domain
+  will need the same. **Fix = the Talos backend owner adds the origin to the
+  talos-chat allowlist (aegra-api); no BDR change.** CORS is not the problem
+  (preflight returns `access-control-allow-origin: *` with `authorization,content-type`
+  allowed; one 502 on a preflight was transient). Diagnose from the browser console:
+  `talos-chat unavailable, using scripted fallback: session mint failed: 403` = origin
+  not allowlisted; `...: Failed to fetch` = a CORS/preflight failure. Check for
+  suggestion chips before concluding the backend is live.
 - **Do not "fix" the transcript by sending the visible message list.** The greeting and
   any merged/trimmed turns would break the strict alternating shape and return a 422.
 - **The chat is fully client-side**, which is why `/landing` still builds as a
@@ -163,6 +172,10 @@ drawer; focus moves into the composer on open and is restored to the opener on c
   the developer's branch/commit go-ahead.
 
 ## Change history
+- 2026-08-25 — Verified the origin gate with browser-shaped probes: `localhost:3000` is
+  allowed and returns live replies end-to-end; `bdr.dev.sandbox.togatech.com` gets 403 at
+  session mint (not allowlisted → deployed drawer runs on scripted fallback). Recorded the
+  console-message → cause mapping. (tcox)
 - 2026-08-24 — Initial doc. BUILT the `/landing` Talos chat drawer wired to the real
   campaign-chat backend: `ChatPanel.tsx` (right-anchored drawer ported from the security
   mockup), `lib/talosChat.ts` (fingerprint + 15-min session token + message-shape

package/knowledge/2.0/apps/ai-bdr/features/security-landing-page.md

@@ -136,9 +136,19 @@ does not define or defines differently.
 - **"Book your free risk assessment"** is a real `<a class="btn btn-toga btn-lg">` to
   `https://calendly.com/toga-technology/risk-assessment` (`target="_blank"`,
   `rel="noopener noreferrer"`), sourced from `security.ts` `primaryCtaHref`.
-  **CAVEAT: that URL is a placeholder carried over from the mockup** (the mockup's own
-  comment says "replace with the real TOGA Calendly link") and the slug's liveness has
-  **not** been verified. Confirm it before pointing traffic at the page.
+  **VERIFIED DEAD (2026-08-25): that URL 404s, and so does `calendly.com/toga-technology`
+  — TOGA has no Calendly presence at all.** It was a placeholder carried over from the
+  mockup. TOGA's real booking system is **Cal.com**, team slug `toga-technology`
+  (`https://cal.com/team/toga-technology`, the same team worker2's `BOOK_CALCOM_MEETING`
+  books into via `[calcom] team_slug`). As of 2026-08-25 the team exposes **exactly one
+  event type, `discovery-call`**, titled *"Healthcare AI Discovery Call"* — and both prod
+  AI-BDR campaigns (`Client_True.Campaigns.c_meetingType`) use it. **No cybersecurity /
+  risk-assessment event type exists anywhere.** Before pointing traffic at the page, the
+  Cal.com owner must create one (e.g. an "External Risk Assessment" event on the team →
+  `https://cal.com/team/toga-technology/<slug>`), then set `primaryCtaHref` in
+  `security.ts` AND pass the same URL as `cta_url` on the campaign ingest so the chat's
+  `book_call` CTA resolves (the live campaign's `cta` is currently `null`). Interim
+  option: point at `discovery-call`, accepting the "Healthcare AI" title mismatch.
 - **"Learn more"** and the header CTA (**"Ask Alex Anything"** — renamed 2026-08-24 from
   the mockup's "Ask Me Anything") both **open the Talos chat drawer** as of 2026-08-24.
   Neither is inert any more. The drawer, its backend adapter, and its offline fallback
@@ -169,8 +179,10 @@ ported. All of it is scoped under `.security-shell`.
 
 ## Known gaps / pending work
 
-- **Calendly URL unverified** (above) — still the top open item, and now also the
-  drawer's "Book a meeting" destination, so a bad slug breaks two paths.
+- **Booking link is DEAD** (above — Calendly 404s; TOGA uses Cal.com, and no security
+  event type exists yet). Top open item: it is both the page's primary CTA and the drawer's
+  "Book a meeting" destination, so today **neither conversion path works**. Needs a Cal.com
+  event type created by the Cal.com owner, then `primaryCtaHref` + campaign `cta_url` set.
 - **Chat drawer's origin allowlist is not done** — `api.togaiq.com` is origin/UA gated,
   so until localhost / sandbox / prod domains are allowlisted the drawer silently answers
   from its scripted fallback (see [landing-chat-drawer.md](landing-chat-drawer.md)).
@@ -211,6 +223,11 @@ ported. All of it is scoped under `.security-shell`.
   the page gains a form or reads a query param.
 
 ## Change history
+- 2026-08-25 — VERIFIED the primary-CTA booking link is dead: the mockup's Calendly URL and
+  the whole `calendly.com/toga-technology` org 404. TOGA books via Cal.com team
+  `toga-technology`, which has only the healthcare `discovery-call` event type (both prod
+  campaigns use it); no security event type exists. Recorded the fix path (create Cal.com
+  event → set `primaryCtaHref` + campaign `cta_url`). (tcox)
 - 2026-08-25 — The source mockup folder `BDR/AI BDR - Security/` was **deleted from the
   repo** (port complete; shipped code is the reference now). Its `eslint.config.mjs`
   `globalIgnores` entry was removed with it; the porting-related gotchas are retired.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.647",
+  "version": "1.0.649",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",