kunthawat/moreminimore-chat
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

[docs] record SM-07/08 closure and release blockers

Browse Source
This commit is contained in:
Kunthawat Greethong
2026-08-16 03:27:19 +07:00
parent 364e72f3dd
commit 9a4e78a132
2 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
HANDOFF.md
View File

@@ -3,6 +3,12 @@
## Current state
Implementation is in progress in `/Users/kunthawat/Gitea/Chatwoot`; source changes are present and remain unpushed.
### Latest handoff — 2026-08-16 03:04 +0700
- `19dc449` — SM-07 local-only observability: Sentry/APM packages and boot paths removed; exception tracking remains local-only; exact post-commit review for `372f316..19dc449` passed with empty blocking arrays.
- `364e72f` — SM-08 dashboard arbitrary-script injection removal: `DASHBOARD_SCRIPTS` reader/config/sink removed; exact post-commit review passed with empty blocking arrays; Vite production build exited 0.
- Current `HEAD` is `364e72f`; no push, deploy, HTTP request, DNS lookup, or credential use occurred.
- Residual Hub cleanup is implemented in the worktree but **not committed**: fixed Hub URL/push relay/Hub changelog are removed, Enterprise shared billing callers are preserved behind validated `CHATWOOT_BILLING_URL`, and privacy audit findings are zero. Commit is blocked because fresh delegated reviewers timed out/incomplete and therefore produced no valid approval verdict.
### Verified checkpoints
- `8ebb320` — privacy/branding audit harness.
- `832a7fd` — Hub sync/registration/telemetry removal.

16
engineering-log.md
View File

@@ -84,3 +84,19 @@ Application changes are tracked in the verified checkpoints and the uncheckpoint
### Next action
- Start SM-07 as a separate isolated task/checkpoint. Do not mix its unstaged files with the verified SM-06 commits.
## 2026-08-16 — SM-07/SM-08 closure and residual Hub gate
### Verified implementation checkpoints
- SM-07 committed at `19dc449`; exact post-commit review of `372f316..19dc449` returned a complete pass with `security_concerns=[]` and `logic_errors=[]`. Focused frontend tests passed 6/6, ESLint passed, Ruby syntax passed, and the offline frozen-lockfile install passed. Rails RSpec/RuboCop remain blocked by Ruby 2.6.10 and missing Bundler 2.5.16.
- SM-08 dashboard/script removal committed at `364e72f`; exact post-commit review returned a complete pass with empty blocking arrays. `DASHBOARD_SCRIPTS` reader, catalog entry, and HTML sink are absent. Vite production build completed with exit code 0. The full Vitest baseline remains 407 passed/15 failed in pre-existing date/time and report-snapshot failures.
### Residual Hub worktree gate
- Remaining Community Hub URL/push/changelog code was removed in the worktree. The shared Enterprise billing callers were preserved: `ChatwootHub.billing_url` now accepts only explicit HTTPS `CHATWOOT_BILLING_URL`; both shared views suppress the link when unset or invalid.
- Deterministic evidence passed: changelog Vitest 1/1, ESLint, Ruby/Bash syntax, isolated billing validation harness (unset/HTTPS/http/malformed/userinfo), cwctl privacy test, privacy audit harness, default privacy audit `findings=0`, and added-line security scan.
- The residual diff is intentionally **not committed**. Fresh independent delegated reviewers timed out or returned incomplete/no payload; fail-closed policy treats this as no approval. The residual changes remain uncommitted in the worktree for the next bounded review attempt.
### Release and compatibility blockers
- SM-09/10 cannot change branding defaults/assets/metadata until approved product name, domains, logos/icons, sender, legal URLs and primary color are supplied. Current visible-branding report remains 2,878 findings; it is report-only, not a privacy-rule pass.
- Enterprise `WebsiteBrandingService` remains proprietary and currently fails with `NameError: uninitialized constant WebsiteBrandingService`; no dummy service or remote enrichment was added.
- SM-11/12 static inventory: repository is shallow (`git rev-parse --is-shallow-repository=true`); Docker, Syft, Trivy, Cosign and Gitleaks are unavailable; Dockerfile base images are mutable tags. Full-history fetch, isolated HTTP/DNS capture, production-like DB rehearsal, image digest and SBOM gates remain blocked. No network action was performed.