toga-ai 1.0.653 → 1.0.655

package/knowledge/2.0/apps/_underscore/features/apirequest-json-content-type.md

@@ -6,8 +6,8 @@ project: _Underscore
 client: shared
 type: feature
 status: active
-updated: 2026-07-28
-owners: ["jcardinal"]
+updated: 2026-08-26
+owners: ["jcardinal", "ajean"]
 files:
   - _underscore/ApiRequest.php
 related:
@@ -74,7 +74,33 @@ case-insensitive scan of already-set headers, so a caller-supplied `Content-Type
   save) lives **inside `execute()`** and would affect every framework caller, so it is deferred
   pending architecture review. Do **not** work around it per-caller.
 
+- **Hand-rolled `Logs.Api` inserts must set `isAuthRequest`, `instanceId` and `hostname` — they are
+  NOT NULL with no defaults.** `_ApiRequest`'s own logging sets all three (`ApiRequest.php:260-264`),
+  so a helper that writes its own log row while only setting `direction`/`source`/`method`/`route`
+  throws `Column 'X' cannot be null` on **every** insert. Because such helpers are usually a
+  *wrapper* around the real call, the throw propagates out of the wrapped call and, under a
+  `catch(Throwable)`, turns the whole feature into a **silent no-op that still reports success**.
+  Two worker2 handlers shipped with exactly this bug and one went unnoticed for months — see
+  [netsuite-opportunity-sync](../../worker2/features/netsuite-opportunity-sync.md#gotchas--known-issues).
+  Prefer letting `_ApiRequest` log rather than writing `Logs.Api` by hand.
+- **⚠ Auto-logging persists the `Authorization` header in PLAINTEXT.** `ApiRequest.php:267` writes
+  the full request headers to `Logs.Api.requestHeaders`, so any component that sends a bearer
+  token/API key and does not `setLogging(false)` is depositing that credential into the logs DB on
+  every call. Known live instance: `_underscore/Component/Api/Clickup/Clickup.php` (which also
+  **hardcodes** its token in committed source — flagged for a rotate-and-move-to-config ticket; 11
+  worker2 files use it). When adding a new component, decide deliberately: log and accept the header
+  exposure, strip/redact the auth header before the call is logged, or `setLogging(false)`.
+- **`Logs.Api` is 1.4M+ rows and `source` is NOT indexed.** Any diagnostic query must be bounded by
+  `dtStamp` (indexed) or it times out — `WHERE source = '…'` alone will not return.
+
 ## Change history
+- 2026-08-26 — Documented the **manual-insert column contract** (`isAuthRequest`, `instanceId`,
+  `hostname` are NOT NULL with no defaults, and `_ApiRequest` sets them at `ApiRequest.php:260-264`),
+  after a hand-rolled `logged()` helper in two worker2 handlers threw on every insert and silently
+  no-op'd an entire feature behind a `catch(Throwable)`. Also recorded that auto-logging persists the
+  **`Authorization` header in plaintext** into `Logs.Api.requestHeaders` (`ApiRequest.php:267`) — the
+  reason `_Component_Api_Clickup`'s hardcoded token needs rotation — and that `Logs.Api.source` is
+  unindexed at 1.4M+ rows, so queries must be bounded by `dtStamp`. (ajean)
 - 2026-08-05 — Documented (no code change) that the `direction = 'OUT'` api-log row is
   **committed immediately** inside `execute()` (`transactionCommit(DB_CLIENT_LOGS)`), so it
   survives a later rollback and `Logs_<Client>.Api` is definitive evidence of whether an outbound

package/knowledge/2.0/apps/ai-bdr/INDEX.md

@@ -6,9 +6,10 @@
 | [BDR Web Funnel — Full Implementation Plan](features/bdr-web-funnel-plan.md) | > **Execution status (2026-07-16):** PLAN **Phases 0–5 are BUILT and QA'd**, Phase 6 > was **mostly already built** (the `info` contract was implemented at comm | bdr/PLAN.md, bdr/mockup/app.jsx, bdr/mockup/screens.jsx, bdr/mockup/components.jsx |
 | [Call Orchestration — PHP Worker ↔ Vapi (the integration seam)](features/call-orchestration.md) | The **PHP worker** is the orchestrator; **Vapi** is the actor. | ai-bdr/docs/client-onboarding-sop.md, ai-bdr/docs/vapi-firstmessage-timing-fix.md, ai-bdr/docs/vapi-inbound-callback-assistant-request.md, ai-bdr/docs/vapi-voicemail-iphone-screening.md, ai-bdr/scripts/update_structured_output.py |
 | [AI-BDR Campaign Chat — Backend Contract + Frontend Widget Handoff](features/campaign-chat-handoff.md) | The consolidated backend + frontend handoff for the **AI-BDR campaign chat** — a grounded AI-BDR chat widget for landing pages, powered by the Talos backend at | ai-bdr-campaign-handoff.md, bdr/src/lib/talosChat.ts |
+| [Landing "Call me now" Flow (/landing) — screens + the dormant real callback route](features/landing-call-flow.md) | The **"Call me now" path on `/landing`**: a two-screen flow (call form → calling/recap) plus a **real, wired, but deliberately dormant** backend route (`POST /a | bdr/src/flow/screens/SecurityCallNow.tsx, bdr/src/flow/screens/SecurityCalling.tsx, bdr/src/lib/securityCallFlow.ts, bdr/src/lib/leadName.ts, bdr/src/app/api/landing-call/route.ts, bdr/src/flow/landingCallApi.ts, bdr/src/flow/screens/SecurityLanding.tsx, bdr/src/components/ChatPanel.tsx, bdr/src/content/security.ts, bdr/src/app/security.css, bdr/src/proxy.ts, bdr/.env.example, bdr/test/securityCallFlow.test.ts, bdr/test/landingCallRoute.test.ts |
 | [Talos Chat Drawer on /landing (first campaign-chat consumer)](features/landing-chat-drawer.md) | The **right-anchored chat drawer on `/landing`**, wired to the **real** Talos campaign-chat backend at `https://api.togaiq.com`. | bdr/src/components/ChatPanel.tsx, bdr/src/components/ChatMarkdown.tsx, bdr/src/lib/talosChat.ts, bdr/src/content/security.ts, bdr/src/flow/screens/SecurityLanding.tsx, bdr/src/app/security.css, bdr/test/talosChat.test.ts, bdr/test/chatMarkdown.test.ts |
 | [Live Call Status — Vapi call API → funnel Success screen lifecycle](features/live-call-status.md) | The BDR funnel's Success screen shows the **real** state of the call it just requested — dialing / ringing / answered-and-talking / ended / not-answered — inste | bdr/src/server/vapiCall.ts, bdr/src/server/callStatus.ts, bdr/src/server/statusToken.ts, bdr/src/server/callbackService.ts, bdr/src/server/workerDialer.ts, bdr/src/lib/callStatus.ts, bdr/src/app/api/call-status/route.ts, bdr/src/app/api/call-now/route.ts, bdr/src/flow/useCallStatusViewModel.ts, bdr/src/flow/callStatusApi.ts, bdr/src/flow/screens/Success.tsx, bdr/src/content/schema.ts, bdr/src/content/default.ts, bdr/src/proxy.ts |
-| [Cybersecurity Landing Page (/landing — the site's current main page)](features/security-landing-page.md) | A single-page **cybersecurity services marketing landing page** at **`/landing`** in the `bdr` repo — and, as of 2026-08-24, **the site's main page**: `/` **307 | bdr/src/app/landing/page.tsx, bdr/src/app/security.css, bdr/src/flow/screens/SecurityLanding.tsx, bdr/src/content/security.ts, bdr/src/components/LogoSymbol.tsx, bdr/src/components/AssistantMark.tsx, bdr/src/components/Ico.tsx, bdr/src/components/Particles.tsx, bdr/src/components/ChatPanel.tsx, bdr/src/components/ChatMarkdown.tsx, bdr/src/lib/talosChat.ts, bdr/next.config.ts, bdr/eslint.config.mjs |
+| [Cybersecurity Landing Page (/landing — the site's current main page)](features/security-landing-page.md) | A single-page **cybersecurity services marketing landing page** at **`/landing`** in the `bdr` repo — and, as of 2026-08-24, **the site's main page**: `/` **307 | bdr/src/app/landing/page.tsx, bdr/src/app/security.css, bdr/src/flow/screens/SecurityLanding.tsx, bdr/src/flow/screens/SecurityCallNow.tsx, bdr/src/flow/screens/SecurityCalling.tsx, bdr/src/lib/securityCallFlow.ts, bdr/src/content/security.ts, bdr/src/components/LogoSymbol.tsx, bdr/src/components/AssistantMark.tsx, bdr/src/components/Ico.tsx, bdr/src/components/Particles.tsx, bdr/src/components/ChatPanel.tsx, bdr/src/components/ChatMarkdown.tsx, bdr/src/lib/talosChat.ts, bdr/next.config.ts, bdr/eslint.config.mjs |
 | [Vapi Integration — Assistants, Tools, Structured Output](features/vapi-integration.md) | Everything inside Vapi: the three assistants, the three shared tools, the shared structured-output schema, the Liquid-templated system prompt, and the Python sc | ai-bdr/vapi/templates/assistant.template.json, ai-bdr/vapi/templates/system-prompt.template.md, ai-bdr/prompts/archive/prompt-may-15.txt, ai-bdr/prompts/campaigns/healthcare-2026-03-18.md, ai-bdr/prompts/campaigns/healthcare-v2-2026-03-25.md, ai-bdr/prompts/templates/campaign-template.md, ai-bdr/scripts/update_assistant.py, ai-bdr/scripts/update_system_prompt.py, ai-bdr/scripts/update_structured_output.py, ai-bdr/scripts/update_call_summary_context.py, ai-bdr/scripts/fix_booking_guardrails.py, ai-bdr/scripts/get_assistant.py, ai-bdr/docs/vapi-firstmessage-timing-fix.md, ai-bdr/docs/vapi-voicemail-iphone-screening.md |
 | [Web Funnel — Built Next.js App (structure, stack, how to run)](features/web-funnel-app.md) | > **READ FIRST (2026-08-24) — the funnel is currently UNREACHABLE.** `/` now > **307-redirects to `/landing`**, the new cybersecurity landing page > ([security- | bdr/PLAN.md, bdr/next.config.ts, bdr/.gitignore, bdr/src/server/hubspot.ts, bdr/src/server/leadSink.ts, bdr/src/server/callbackService.ts, bdr/src/server/workerDialer.ts, bdr/src/server/mailer.ts, bdr/src/server/statusToken.ts, bdr/src/server/vapiCall.ts, bdr/src/server/callStatus.ts, bdr/src/lib/summaryText.ts, bdr/src/lib/emailFormat.ts, bdr/src/lib/callStatus.ts, bdr/src/app/api/share-summary/route.ts, bdr/src/app/api/call-status/route.ts, bdr/src/flow/shareSummaryApi.ts, bdr/src/flow/callStatusApi.ts, bdr/src/flow/useCallStatusViewModel.ts, bdr/src/flow/screens/Success.tsx, bdr/src/flow/screens/CallNow.tsx, bdr/src/flow/screens/Schedule.tsx, bdr/src/flow/screens/CallSummary.tsx, bdr/src/content/schema.ts, bdr/src/content/default.ts, bdr/test/togaEnrichment.test.ts, bdr/test/fastDial.test.ts, bdr/eslint.config.mjs, bdr/amplify.yml, bdr/src/app, bdr/src/app/layout.tsx, bdr/src/app/page.tsx, bdr/src/app/studio.css, bdr/src/lib/resolveCampaignId.ts, bdr/src/lib/scheduleSlots.ts, bdr/src/lib/formatPhone.ts, bdr/src/lib/analytics.ts, bdr/src/lib/rateLimit.ts, bdr/src/lib/clientIp.ts, bdr/src/proxy.ts, bdr/.env.example, bdr/src/components/GoogleAnalytics.tsx, bdr/src/components/RichText.tsx, bdr/src/content, bdr/src/components, bdr/src/flow, bdr/src/server, bdr/src/server/toga.ts, bdr/src/app/api, bdr/test, bdr/test/togaPrimaryPhone.test.ts, bdr/public, bdr/mockup/styles.css |
 | [Web Funnel — Next.js UI + Config-Driven Campaign Content](features/web-funnel-content-model.md) | > **Status note (RESOLVED 2026-07-16):** the content **contract** below (schema, > provider seam, adapters) is BUILT and QA'd (PLAN Phases 0–5). | bdr/src/content/schema.ts, bdr/src/content/provider.ts, bdr/src/content/useCampaign.ts, bdr/src/content/default.ts, bdr/src/lib/resolveCampaignId.ts, bdr/src/server/leadSink.ts, bdr/src/server/callbackService.ts, bdr/src/app/api/call-now/route.ts, bdr/src/app/api/call-later/route.ts, bdr/src/app/api/contact/route.ts |

package/knowledge/2.0/apps/ai-bdr/features/landing-call-flow.md

@@ -0,0 +1,226 @@
+---
+title: Landing "Call me now" Flow (/landing) — screens + the dormant real callback route
+framework: "2.0"
+repo: ai-bdr
+project: AI-BDR
+client: shared
+type: feature
+status: active
+updated: 2026-08-26
+owners: [tcox]
+files:
+  - bdr/src/flow/screens/SecurityCallNow.tsx
+  - bdr/src/flow/screens/SecurityCalling.tsx
+  - bdr/src/lib/securityCallFlow.ts
+  - bdr/src/lib/leadName.ts
+  - bdr/src/app/api/landing-call/route.ts
+  - bdr/src/flow/landingCallApi.ts
+  - bdr/src/flow/screens/SecurityLanding.tsx
+  - bdr/src/components/ChatPanel.tsx
+  - bdr/src/content/security.ts
+  - bdr/src/app/security.css
+  - bdr/src/proxy.ts
+  - bdr/.env.example
+  - bdr/test/securityCallFlow.test.ts
+  - bdr/test/landingCallRoute.test.ts
+related:
+  - security-landing-page.md
+  - landing-chat-drawer.md
+  - live-call-status.md
+  - call-orchestration.md
+  - web-funnel-app.md
+---
+
+## What this is
+
+The **"Call me now" path on `/landing`**: a two-screen flow (call form → calling/recap)
+plus a **real, wired, but deliberately dormant** backend route
+(`POST /api/landing-call`) that requests an actual Vapi callback for an **anonymous**
+visitor.
+
+It was built 2026-08-26 on the design lead's UI review of the landing page: *"mock is
+right; missing a Call me now button + flow; book a meeting slightly large; check with
+Alex re shared component."*
+
+**Read this first:** the route is **off by default**. It requires
+`TOGA_SECURITY_CAMPAIGN_UUID`, and **no cybersecurity campaign exists in Toga yet**, so
+in every environment today the flow runs its **simulation**. That is the intended end
+state for now — *"wired up and ready for the campaign"* — not an unfinished build.
+
+## The two campaigns are NOT the same thing (read before wiring anything)
+
+AI-BDR has **two independent campaign systems** with unrelated ids. Confusing them is the
+easiest mistake to make on this page, because both serve the same cybersecurity offer.
+
+| | **Talos chat campaign** | **Toga dialer campaign** |
+|---|---|---|
+| Lives in | `api.togaiq.com` → `campaign_registry` | Toga platform → `Client_True.Campaigns` |
+| Used by | the chat drawer ([landing-chat-drawer.md](landing-chat-drawer.md)) | the callback/dialer path (this doc) |
+| Security id | `43fdf2b6-7a5d-4e85-be6b-911f42aa787f` ("External Pen Testing") | **none exists** |
+| Env var | `NEXT_PUBLIC_TALOS_API_BASE` (base URL only) | `TOGA_SECURITY_CAMPAIGN_UUID` |
+
+**`43fdf2b6-7a5d-4e85-be6b-911f42aa787f` cannot be used for
+`TOGA_SECURITY_CAMPAIGN_UUID`.** It is a Talos chat-grounding campaign, not a dialer
+campaign, and Toga has never heard of it.
+
+`Client_True.Campaigns` in **prod** holds exactly two rows (verified 2026-08-26), both
+**healthcare**, both `c_meetingType = discovery-call`:
+
+- `15d0c02f-501e-e081-2ead-61b78c854223` — "26.05 - AI BDR - Ryan Nitti"
+- `d8f7abe6-8f06-0218-03d1-50db575` — "26.04 - AI BDR TEST CAMPAIGN"
+
+So there is **no cybersecurity dialer campaign and no cybersecurity Vapi assistant**.
+That is the single blocker for real calls from `/landing`, and it is owned **outside the
+`bdr` repo** (Toga platform + Vapi config).
+
+## Screen flow
+
+`SecurityLanding.tsx` gained a page-level `screen` state — `landing | call | calling` —
+swapped with `SwapFade` using the **mock's app-shell timings** (`outMs 240`, `inMs 460`,
+`rise 12`, `drop 18`). `backToOverview` resets the recap rotation and scrolls to top.
+
+1. **`SecurityCallNow.tsx`** (new) — the mock's security *CallNow* screen: trust column,
+   **business email** field with a live hint (*"we'll assess the domain **acme.com**"*,
+   derived by `emailDomain`), and a masked phone field. Submit is enabled only when
+   `isValidEmail` **and** `isViablePhone` (`isCallFormComplete`).
+2. **`SecurityCalling.tsx`** (new) — the mock's *Success* screen in calling mode:
+   `dialing` → **Connected** with an `mm:ss` timer → **End call** → **Call ended** with a
+   recap, **Copy**, and three exits: *Call me again* / *Book a meeting* (booking link) /
+   *Back to overview*.
+3. **`lib/securityCallFlow.ts`** (new) — the pure helpers, all unit-tested:
+   `fillTokens`, `emailDomain`, `isCallFormComplete`, `formatCallTimer`, and the
+   recap-summary rotation (short / medium / large by visit count).
+
+Entry points: the drawer's new **"Call me now"** button (see
+[landing-chat-drawer.md](landing-chat-drawer.md)) via `ChatPanel`'s new `onCall` prop.
+All copy lives in `src/content/security.ts` under the new `callNow` and `calling` groups
+plus `talos.callCta`.
+
+### Why new screens instead of reusing the studio ones
+
+`src/flow/screens/CallNow.tsx` and `Success.tsx` (the parked studio funnel) read the
+studio **`CampaignBundle` + lead contexts**, which `/landing` does not provide, and the
+studio `CallNow` has **no email field** at all (the studio funnel primes identity from
+`?hsContactId`). Reuse would have meant threading bundle/lead plumbing into a static
+marketing page.
+
+### Deliberate deviations from the mock
+
+- **No `AmbientQuestions`** — that component is bundle-driven.
+- Recap has **Copy** but **no Share sheet**.
+- The mock's *"Schedule a call"* became **"Book a meeting"** (booking link), because
+  `/landing` has no schedule screen.
+- Footnote **Privacy / Terms are live `togatech.com` links** (funnel precedent), not the
+  mock's inert `#` hashes.
+
+## The real path — `POST /api/landing-call` (wired, dormant)
+
+Built as a **separate route from `/api/call-now`** because the landing visitor is
+**anonymous**: there is no `?hsContactId` priming on `/landing`, so there is no HubSpot
+contact and no lead ref to work from — only the email and phone the visitor just typed.
+
+Request `{ email, phoneNumber }`. Order of operations:
+
+1. **Validate** — `isValidEmail` + `MAX_EMAIL_LENGTH`, `isValidUSPhone`.
+2. **Config gate** — require `TOGA_SECURITY_CAMPAIGN_UUID` (must be a Toga uuid) or
+   return a **503 envelope** *"Live callback is not configured"* **before any upstream
+   call**. This is what keeps the route inert without a feature flag.
+3. **Lead** — `togaLeadSink.upsertLead`, with `firstName`/`lastName` derived from the
+   email local part by the new `src/lib/leadName.ts` (`nameFromEmail`):
+   `jane.doe@…` → `Jane` `Doe`; `jdoe@…` → `Jdoe` + an **empty** lastName. Links the
+   campaign.
+4. **Dial** — `togaCallbackService.requestCall(uuid, { type: "now" }, phone)` — the
+   **same code path as `/api/call-now`** (contact write + worker fast dial; see
+   [live-call-status.md](live-call-status.md)).
+5. **Tokens** — mints the same purpose-scoped status/share tokens as the studio flow.
+
+`src/flow/landingCallApi.ts` (`submitLandingCall`) is the client seam and returns
+`{ live, statusHandle }`. **Any** non-success — 503, 400, 500, network — resolves to
+`live: false` and the screen runs the **simulation**. `SecurityCallNow`'s submit posts
+the request but **never blocks the screen advance**.
+
+### Live vs. simulation in `SecurityCalling`
+
+Mirrors the studio `Success.tsx` split, using the existing
+`useCallStatusViewModel` (see [live-call-status.md](live-call-status.md)):
+
+| | Simulation (today) | Live (once configured) |
+|---|---|---|
+| Phases | scripted dialing → connected → ended | real Vapi states: dialing → on call (real elapsed) → ended / *"We could not reach you"* |
+| Recap | static, rotating short/medium/large | the **real Vapi recap** replaces it |
+| "End call" button | shown | **hidden** — a browser cannot hang up a phone call |
+| Status unavailable | n/a | **holds at dialing** with a note; never fakes progress |
+
+Rate limiting: `/api/landing-call` was added to `src/proxy.ts`'s **call-limiter branch and
+matcher**, sharing the `/api/call-now` bucket.
+
+## Turning it on later (config only — no code change)
+
+1. Create the **cybersecurity campaign + Vapi assistant** in Toga — runbook:
+   `ai-bdr/docs/client-onboarding-sop.md` (see [call-orchestration.md](call-orchestration.md)).
+2. Set `TOGA_SECURITY_CAMPAIGN_UUID` in `.env.local` and in the **Amplify console** (it is
+   already covered by the build-time `env | grep` recipe in `amplify.yml` that materializes
+   `TOGA_*` into `.env.production` — see [web-funnel-app.md](web-funnel-app.md)).
+3. Redeploy (console vars only reach a build that starts **after** they are saved).
+
+**Rejected alternatives (do not redo them):**
+
+- *Remove the route until the campaign exists* — it would simply be rebuilt later; the
+  env gate already makes it inert.
+- *Point it at a healthcare campaign to test with a real phone* — **do not**. The
+  assistant would pitch the wrong offer to a real person.
+
+## Open items before the first live run
+
+- **An empty `lastName` on an email-only lead is UNVERIFIED against Toga.** `jdoe@…`
+  produces `Jdoe` + `""`; nobody has confirmed Toga accepts that on `upsertLead`.
+- **The deployed environment needs `TOGA_VAPI_TOKEN`** for live status to render. Without
+  it the call still happens, but the screen **holds at dialing with the unavailable note**
+  — by design, not a bug.
+- The recap's "Book a meeting" inherits the landing page's booking-link problem (see
+  [security-landing-page.md](security-landing-page.md)).
+
+## Gotchas
+
+- **Two campaign systems, same product.** See the table above. A Talos `campaign_id` in
+  `TOGA_SECURITY_CAMPAIGN_UUID` fails the uuid/Toga check and the route 503s — which
+  looks exactly like "not configured," so check *which* id you pasted before debugging.
+- **The 503 is a designed state, not an error to fix.** A dormant route returning
+  *"Live callback is not configured"* is the expected production behavior today.
+- **Never let the network decide the UX.** `submitLandingCall` is fire-and-continue: the
+  screen advances regardless, and only the *content* (real vs. simulated) depends on the
+  response.
+- **No "End call" on the live path.** If you see one during a live call, the live/sim
+  branch is wrong — the browser has no way to hang up a Vapi phone call.
+- **An anchor styled as `.btn` renders smaller than a real `<button>` sibling** unless
+  `font-size` is pinned — see the drawer doc's gotcha; the same trap produced the
+  oversized "Book a meeting" button this session.
+
+## How to work on it
+
+- 18 new Vitest tests: `test/securityCallFlow.test.ts` (9) and
+  `test/landingCallRoute.test.ts` (9).
+- Verified 2026-08-26: `tsc` clean, `eslint` clean, **vitest 385/385**, `next build`
+  clean — the route builds as `ƒ /api/landing-call` and **`/landing` stays prerendered
+  static** (the call screens are client-side; the POST only happens on submit).
+- **Nothing is committed** — all of it lives in the `bdr` working tree; the developer
+  merges and commits.
+
+## Change history
+- 2026-08-26 — Initial doc. BUILT the `/landing` "Call me now" flow: `ChatPanel` gained an
+  `onCall` prop and a "Call me now" action above "Book a meeting"; new `SecurityCallNow` /
+  `SecurityCalling` screens driven by a page-level `landing|call|calling` state in
+  `SecurityLanding` (SwapFade on the mock's app-shell timings), new pure helpers in
+  `lib/securityCallFlow.ts`, and new `callNow`/`calling` content groups. BUILT the REAL
+  callback path — `POST /api/landing-call` for ANONYMOUS visitors (validate → require
+  `TOGA_SECURITY_CAMPAIGN_UUID` else 503 before any upstream call → `upsertLead` with a
+  name derived from the email local part via new `lib/leadName.ts` → `requestCall` on the
+  same path as `/api/call-now` → purpose-scoped status/share tokens), the
+  `submitLandingCall` client seam, the live/sim split in `SecurityCalling`, and the
+  `/api/call-now` rate-limit bucket. DECIDED to keep it **dormant** until the campaign
+  exists (enabling is config only); rejected deleting the route and rejected testing
+  against a healthcare campaign. DISCOVERED the Talos chat campaign id is NOT a Toga
+  dialer campaign and that prod has only two healthcare dialer campaigns — no
+  cybersecurity campaign or Vapi assistant exists, which is the real blocker. Open:
+  empty-`lastName` acceptance and `TOGA_VAPI_TOKEN` in the deployed env. tsc/eslint clean,
+  385/385 tests, `/landing` still prerendered static. Uncommitted at capture. (tcox)

package/knowledge/2.0/apps/ai-bdr/features/landing-chat-drawer.md

@@ -6,7 +6,7 @@ project: AI-BDR
 client: shared
 type: feature
 status: active
-updated: 2026-08-25
+updated: 2026-08-26
 owners: [tcox]
 files:
   - bdr/src/components/ChatPanel.tsx
@@ -19,6 +19,7 @@ files:
   - bdr/test/chatMarkdown.test.ts
 related:
   - security-landing-page.md
+  - landing-call-flow.md
   - campaign-chat-handoff.md
   - web-funnel-app.md
   - ../../toga-blox/features/talos-assistant.md
@@ -92,11 +93,22 @@ in the adapter).
   into the response type by `toTalosResponse()`. The backend's **silent
   lead/qualification fields are never read** — deliberate, per the handoff.
 
+## Drawer actions (both render as of 2026-08-26)
+
+The drawer's action row under the message list now carries **two** buttons, in the
+mockup's order:
+
+1. **"Call me now"** — new 2026-08-26, driven by `ChatPanel`'s new **`onCall` prop**. It
+   swaps `/landing` to the call screens; the flow, its dormant real backend, and the
+   Talos-chat-vs-Toga-dialer campaign distinction live in
+   [landing-call-flow.md](landing-call-flow.md). **(This corrects the previous "Call me
+   now is NOT rendered" note** — that was true only while the sole destination was the
+   parked studio call screen. Purpose-built landing screens replaced that dead end.)
+2. **"Book a meeting"** — an `<a>` to the same booking href as the page's primary CTA
+   (still the dead Calendly link; see [security-landing-page.md](security-landing-page.md)).
+
 ## Deliberate deviations from the mockup drawer
 
-- **"Call me now" is NOT rendered.** Its destination is the parked studio call screen,
-  unreachable from this page. The standing drawer action is **"Book a meeting"** →
-  the same Calendly href as the page's primary CTA.
 - **`cta` and `cited_slides` are captured and typed but not rendered yet.** Both are
   clean follow-ups; `cited_slides` additionally needs `GET /api/ai/campaign/{id}` plus
   presigned-URL freshness handling (those URLs expire ~7 days — see the handoff).
@@ -128,15 +140,36 @@ So the decision: build the shell now, swap it later.
   documented theming ceiling), so even fully themed it will **not** match the security
   mockup drawer pixel-for-pixel. Accept that at swap time or fund the spacing-token pass.
 
+**Status 2026-08-26 — decision re-affirmed: keep the disposable bridge shell.** A note to
+**apeterson** is **drafted but not yet sent** (the developer will send it). What it has to
+cover, so the alignment conversation starts from facts:
+
+- our adapter **already matches his `TalosAdapter` seam** and is **wired live**;
+- the two blockers are still blox-side and unscheduled — **unpublished to npm**, and
+  **React `^18` peers vs. BDR's React 19**;
+- the **design divergence** the security mock introduces versus blox `TalosPanel`: the
+  **"Call me now" / "Book a meeting" action buttons under the message list**, and the
+  cobalt **`.security-shell` theme**. Those must be reconciled as **blox props/theme vs.
+  app-side composition** before a swap is possible — that decision is the real gate now,
+  not just publishing.
+
 ## Styling
 
 The `.chatveil` / `.chatpanel` block was ported from the security mockup's `styles.css`
 into `security.css` and is **scoped under `.security-shell`** like every other landing
-rule. (The source mockup folder was deleted from the repo on 2026-08-25; `security.css`
-is now the only copy of these styles.) `z-index: 120`, width `min(400px, 92vw)`, reduced-motion respected.
+rule. (**Correction to an earlier note:** the mockup folder was deleted 2026-08-25 but
+**re-added 2026-08-26**, so `security.css` is *not* the only copy — the mockup is back in
+the repo as the design reference. `security.css` remains the only *shipped* copy.)
+`z-index: 120`, width `min(400px, 92vw)`, reduced-motion respected.
 `.chatmd-p` / `.chatmd-list` carry the reply rhythm. Escape and scrim click close the
 drawer; focus moves into the composer on open and is restored to the opener on close.
 
+**Action-row sizing (fixed 2026-08-26).** "Book a meeting" rendered visibly larger than the
+mockup's. Root cause: the mockup's chat actions are `<button>`s, which browsers draw at the
+~13.3px default button font because `.btn` never sets `font: inherit`; ours is an `<a>`
+inheriting the panel's body size. Both are now pinned:
+`.security-shell .chatactions .btn{font-size:13.5px;padding:0 16px;min-height:44px}`.
+
 ## Gotchas
 
 - **`api.togaiq.com` chat endpoints are origin/UA-gated — verified 2026-08-25 with
@@ -157,21 +190,38 @@ drawer; focus moves into the composer on open and is restored to the opener on c
   any merged/trimmed turns would break the strict alternating shape and return a 422.
 - **The chat is fully client-side**, which is why `/landing` still builds as a
   **prerendered static** route. Adding a server call here changes that.
-- **`/landing` is not rate-limited** (`src/proxy.ts` matches only `/` and the five API
-  routes). The drawer talks to a third-party origin, not a BDR API route, so the
-  limiter still does not apply — but the abuse surface now exists on the page.
+- **`/landing` is not rate-limited** (`src/proxy.ts` matches `/` and the API routes, not
+  the page). The drawer talks to a third-party origin, not a BDR API route, so the limiter
+  still does not apply to *chat* — but the abuse surface exists on the page. The drawer's
+  new "Call me now" action does hit a BDR route, and that one **is** limited
+  (`/api/landing-call`, on the `/api/call-now` bucket).
 
 ## How to work on it
 
 - 30 new Vitest tests across `test/talosChat.test.ts` and `test/chatMarkdown.test.ts`
   (message-shape rules including the 30-cap alternation, 401 re-mint-once, fallback on
   network error and on 5xx, alternation preserved across a fallback turn, adapter
-  reset, markdown safety). Suite **367/367 green**; `tsc`, `eslint` (incl. the
-  no-em-dash rule), and `next build` all clean as of 2026-08-24.
-- **Nothing is committed** — the drawer lives in the `bdr` working tree only, awaiting
-  the developer's branch/commit go-ahead.
+  reset, markdown safety). Suite **385/385 green** as of 2026-08-26 (was 367 before the
+  call-flow tests); `tsc`, `eslint` (incl. the no-em-dash rule), and `next build` all clean.
+- **Shipped state:** the drawer landed on `_dev-sandbox` via **TRUE-80965**, merged by the
+  developer 2026-08-25. **TRUE-80966** ("Connect Talos UI to Backend Services") is
+  engineering-complete — chat is live from allowlisted origins — but **acceptance is
+  pending** on three items: the sandbox **origin allowlist**, rendering of **`cta` /
+  `cited_slides`**, and the **absent CRM lead sink**. The 2026-08-26 action-row changes are
+  uncommitted working tree.
 
 ## Change history
+- 2026-08-26 — The drawer now renders **both** mockup actions: a new **"Call me now"**
+  button (via `ChatPanel`'s new `onCall` prop) above "Book a meeting" — **reversing** the
+  2026-08-24 decision not to render it, which only held while the destination was the
+  parked studio call screen (see [landing-call-flow.md](landing-call-flow.md) for the new
+  screens). FIXED "Book a meeting" rendering too large (`<a>` inherits body size, sibling
+  `<button>`s use the ~13.3px browser default; both pinned in `.chatactions .btn`).
+  CORRECTED the styling note — the security mockup was re-added to the repo on 2026-08-26,
+  so `security.css` is only the *shipped* copy, not the *only* copy. Re-affirmed the
+  TRUE-80692 "keep the disposable bridge shell" decision and recorded the drafted (not yet
+  sent) note to apeterson, including the new design divergence — action buttons + cobalt
+  theme — that must be reconciled as blox props/theme vs. app-side. (tcox)
 - 2026-08-25 — Verified the origin gate with browser-shaped probes: `localhost:3000` is
   allowed and returns live replies end-to-end; `bdr.dev.sandbox.togatech.com` gets 403 at
   session mint (not allowlisted → deployed drawer runs on scripted fallback). Recorded the

package/knowledge/2.0/apps/ai-bdr/features/live-call-status.md

@@ -6,7 +6,7 @@ project: AI-BDR
 client: shared
 type: feature
 status: active
-updated: 2026-07-29
+updated: 2026-08-26
 owners: [tcox]
 files:
   - bdr/src/server/vapiCall.ts
@@ -24,6 +24,7 @@ files:
   - bdr/src/content/default.ts
   - bdr/src/proxy.ts
 related:
+  - landing-call-flow.md
   - web-funnel-app.md
   - vapi-integration.md
   - call-orchestration.md
@@ -144,6 +145,13 @@ rules that are specific to this feature:
   looks fake in this environment" is an **env** symptom, not a code bug.
 
 ## Change history
+- 2026-08-26 — **Second consumer:** `/landing`'s new `SecurityCalling` screen reuses this
+  pipeline unchanged (`useCallStatusViewModel` + `/api/call-status` + the same
+  purpose-scoped status token), fed by the new `POST /api/landing-call` for anonymous
+  visitors. Two behavior notes specific to it: it shows **no "End call" button on the live
+  path**, and an **unavailable** status **holds at dialing** rather than faking progress.
+  The route is env-gated and currently dormant — see
+  [landing-call-flow.md](landing-call-flow.md). No change to this feature's own code. (tcox)
 - 2026-07-29 — Created. BUILT the live call-status pipeline: `src/server/vapiCall.ts` reads
   `GET https://api.vapi.ai/call/{id}` with the worker's Vapi bearer credential and drives a real
   dialing / active / ended / not-answered lifecycle on the Success screen (replacing the ~5s