From 9a4e78a13203f3849350e19b2df42afc3aa983c3 Mon Sep 17 00:00:00 2001 From: Kunthawat Greethong Date: Sun, 16 Aug 2026 03:27:19 +0700 Subject: [PATCH] [docs] record SM-07/08 closure and release blockers --- HANDOFF.md | 6 ++++++ engineering-log.md | 16 ++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/HANDOFF.md b/HANDOFF.md index b626874bc..f8e39b4e3 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -3,6 +3,12 @@ ## Current state Implementation is in progress in `/Users/kunthawat/Gitea/Chatwoot`; source changes are present and remain unpushed. +### Latest handoff — 2026-08-16 03:04 +0700 +- `19dc449` — SM-07 local-only observability: Sentry/APM packages and boot paths removed; exception tracking remains local-only; exact post-commit review for `372f316..19dc449` passed with empty blocking arrays. +- `364e72f` — SM-08 dashboard arbitrary-script injection removal: `DASHBOARD_SCRIPTS` reader/config/sink removed; exact post-commit review passed with empty blocking arrays; Vite production build exited 0. +- Current `HEAD` is `364e72f`; no push, deploy, HTTP request, DNS lookup, or credential use occurred. +- Residual Hub cleanup is implemented in the worktree but **not committed**: fixed Hub URL/push relay/Hub changelog are removed, Enterprise shared billing callers are preserved behind validated `CHATWOOT_BILLING_URL`, and privacy audit findings are zero. Commit is blocked because fresh delegated reviewers timed out/incomplete and therefore produced no valid approval verdict. + ### Verified checkpoints - `8ebb320` — privacy/branding audit harness. - `832a7fd` — Hub sync/registration/telemetry removal. diff --git a/engineering-log.md b/engineering-log.md index a01fbc886..8eb0adf5a 100644 --- a/engineering-log.md +++ b/engineering-log.md @@ -84,3 +84,19 @@ Application changes are tracked in the verified checkpoints and the uncheckpoint ### Next action - Start SM-07 as a separate isolated task/checkpoint. Do not mix its unstaged files with the verified SM-06 commits. + +## 2026-08-16 — SM-07/SM-08 closure and residual Hub gate + +### Verified implementation checkpoints +- SM-07 committed at `19dc449`; exact post-commit review of `372f316..19dc449` returned a complete pass with `security_concerns=[]` and `logic_errors=[]`. Focused frontend tests passed 6/6, ESLint passed, Ruby syntax passed, and the offline frozen-lockfile install passed. Rails RSpec/RuboCop remain blocked by Ruby 2.6.10 and missing Bundler 2.5.16. +- SM-08 dashboard/script removal committed at `364e72f`; exact post-commit review returned a complete pass with empty blocking arrays. `DASHBOARD_SCRIPTS` reader, catalog entry, and HTML sink are absent. Vite production build completed with exit code 0. The full Vitest baseline remains 407 passed/15 failed in pre-existing date/time and report-snapshot failures. + +### Residual Hub worktree gate +- Remaining Community Hub URL/push/changelog code was removed in the worktree. The shared Enterprise billing callers were preserved: `ChatwootHub.billing_url` now accepts only explicit HTTPS `CHATWOOT_BILLING_URL`; both shared views suppress the link when unset or invalid. +- Deterministic evidence passed: changelog Vitest 1/1, ESLint, Ruby/Bash syntax, isolated billing validation harness (unset/HTTPS/http/malformed/userinfo), cwctl privacy test, privacy audit harness, default privacy audit `findings=0`, and added-line security scan. +- The residual diff is intentionally **not committed**. Fresh independent delegated reviewers timed out or returned incomplete/no payload; fail-closed policy treats this as no approval. The residual changes remain uncommitted in the worktree for the next bounded review attempt. + +### Release and compatibility blockers +- SM-09/10 cannot change branding defaults/assets/metadata until approved product name, domains, logos/icons, sender, legal URLs and primary color are supplied. Current visible-branding report remains 2,878 findings; it is report-only, not a privacy-rule pass. +- Enterprise `WebsiteBrandingService` remains proprietary and currently fails with `NameError: uninitialized constant WebsiteBrandingService`; no dummy service or remote enrichment was added. +- SM-11/12 static inventory: repository is shallow (`git rev-parse --is-shallow-repository=true`); Docker, Syft, Trivy, Cosign and Gitleaks are unavailable; Dockerfile base images are mutable tags. Full-history fetch, isolated HTTP/DNS capture, production-like DB rehearsal, image digest and SBOM gates remain blocked. No network action was performed.