toga-ai 1.0.648 → 1.0.649

package/knowledge/2.0/apps/ai-bdr/features/security-landing-page.md

@@ -136,9 +136,19 @@ does not define or defines differently.
 - **"Book your free risk assessment"** is a real `<a class="btn btn-toga btn-lg">` to
   `https://calendly.com/toga-technology/risk-assessment` (`target="_blank"`,
   `rel="noopener noreferrer"`), sourced from `security.ts` `primaryCtaHref`.
-  **CAVEAT: that URL is a placeholder carried over from the mockup** (the mockup's own
-  comment says "replace with the real TOGA Calendly link") and the slug's liveness has
-  **not** been verified. Confirm it before pointing traffic at the page.
+  **VERIFIED DEAD (2026-08-25): that URL 404s, and so does `calendly.com/toga-technology`
+  — TOGA has no Calendly presence at all.** It was a placeholder carried over from the
+  mockup. TOGA's real booking system is **Cal.com**, team slug `toga-technology`
+  (`https://cal.com/team/toga-technology`, the same team worker2's `BOOK_CALCOM_MEETING`
+  books into via `[calcom] team_slug`). As of 2026-08-25 the team exposes **exactly one
+  event type, `discovery-call`**, titled *"Healthcare AI Discovery Call"* — and both prod
+  AI-BDR campaigns (`Client_True.Campaigns.c_meetingType`) use it. **No cybersecurity /
+  risk-assessment event type exists anywhere.** Before pointing traffic at the page, the
+  Cal.com owner must create one (e.g. an "External Risk Assessment" event on the team →
+  `https://cal.com/team/toga-technology/<slug>`), then set `primaryCtaHref` in
+  `security.ts` AND pass the same URL as `cta_url` on the campaign ingest so the chat's
+  `book_call` CTA resolves (the live campaign's `cta` is currently `null`). Interim
+  option: point at `discovery-call`, accepting the "Healthcare AI" title mismatch.
 - **"Learn more"** and the header CTA (**"Ask Alex Anything"** — renamed 2026-08-24 from
   the mockup's "Ask Me Anything") both **open the Talos chat drawer** as of 2026-08-24.
   Neither is inert any more. The drawer, its backend adapter, and its offline fallback
@@ -169,8 +179,10 @@ ported. All of it is scoped under `.security-shell`.
 
 ## Known gaps / pending work
 
-- **Calendly URL unverified** (above) — still the top open item, and now also the
-  drawer's "Book a meeting" destination, so a bad slug breaks two paths.
+- **Booking link is DEAD** (above — Calendly 404s; TOGA uses Cal.com, and no security
+  event type exists yet). Top open item: it is both the page's primary CTA and the drawer's
+  "Book a meeting" destination, so today **neither conversion path works**. Needs a Cal.com
+  event type created by the Cal.com owner, then `primaryCtaHref` + campaign `cta_url` set.
 - **Chat drawer's origin allowlist is not done** — `api.togaiq.com` is origin/UA gated,
   so until localhost / sandbox / prod domains are allowlisted the drawer silently answers
   from its scripted fallback (see [landing-chat-drawer.md](landing-chat-drawer.md)).
@@ -211,6 +223,11 @@ ported. All of it is scoped under `.security-shell`.
   the page gains a form or reads a query param.
 
 ## Change history
+- 2026-08-25 — VERIFIED the primary-CTA booking link is dead: the mockup's Calendly URL and
+  the whole `calendly.com/toga-technology` org 404. TOGA books via Cal.com team
+  `toga-technology`, which has only the healthcare `discovery-call` event type (both prod
+  campaigns use it); no security event type exists. Recorded the fix path (create Cal.com
+  event → set `primaryCtaHref` + campaign `cta_url`). (tcox)
 - 2026-08-25 — The source mockup folder `BDR/AI BDR - Security/` was **deleted from the
   repo** (port complete; shipped code is the reference now). Its `eslint.config.mjs`
   `globalIgnores` entry was removed with it; the porting-related gotchas are retired.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.648",
+  "version": "1.0.649",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",