From c9c0a749c3ed539d6fa68d1c017a42ef049b9cb8 Mon Sep 17 00:00:00 2001 From: Kunthawat Greethong Date: Sun, 16 Aug 2026 03:36:08 +0700 Subject: [PATCH] [docs] record residual Vite build evidence --- HANDOFF.md | 2 +- engineering-log.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/HANDOFF.md b/HANDOFF.md index 2bf479532..e6cf0840c 100644 --- a/HANDOFF.md +++ b/HANDOFF.md @@ -7,7 +7,7 @@ Implementation is in progress in `/Users/kunthawat/Gitea/Chatwoot`; source chang - `19dc449` — SM-07 local-only observability: Sentry/APM packages and boot paths removed; exception tracking remains local-only; exact post-commit review for `372f316..19dc449` passed with empty blocking arrays. - `364e72f` — SM-08 dashboard arbitrary-script injection removal: `DASHBOARD_SCRIPTS` reader/config/sink removed; exact post-commit review passed with empty blocking arrays; Vite production build exited 0. - Code checkpoint remains `364e72f`; current repository `HEAD` includes this docs handoff commit `9a4e78a`. No push, deploy, HTTP request, DNS lookup, or credential use occurred. -- Residual Hub cleanup is implemented in the worktree but **not committed**: fixed Hub URL/push relay/Hub changelog are removed, Enterprise shared billing callers are preserved behind validated `CHATWOOT_BILLING_URL`, and privacy audit findings are zero. Commit is blocked because fresh delegated reviewers timed out/incomplete and therefore produced no valid approval verdict. +- Residual Hub cleanup is implemented in the worktree but **not committed**: fixed Hub URL/push relay/Hub changelog are removed, Enterprise shared billing callers are preserved behind validated `CHATWOOT_BILLING_URL`, and privacy audit findings are zero. The residual Vite production build completed successfully (`4,736 modules transformed`, `✓ built in 3m 49s`, exit code 0); only Browserslist/chunk-size warnings remain. Commit is blocked because fresh delegated reviewers timed out/incomplete and therefore produced no valid approval verdict. ### Verified checkpoints - `8ebb320` — privacy/branding audit harness. diff --git a/engineering-log.md b/engineering-log.md index 8eb0adf5a..2d94c1d0a 100644 --- a/engineering-log.md +++ b/engineering-log.md @@ -93,7 +93,7 @@ Application changes are tracked in the verified checkpoints and the uncheckpoint ### Residual Hub worktree gate - Remaining Community Hub URL/push/changelog code was removed in the worktree. The shared Enterprise billing callers were preserved: `ChatwootHub.billing_url` now accepts only explicit HTTPS `CHATWOOT_BILLING_URL`; both shared views suppress the link when unset or invalid. -- Deterministic evidence passed: changelog Vitest 1/1, ESLint, Ruby/Bash syntax, isolated billing validation harness (unset/HTTPS/http/malformed/userinfo), cwctl privacy test, privacy audit harness, default privacy audit `findings=0`, and added-line security scan. +- Deterministic evidence passed: changelog Vitest 1/1, ESLint, Ruby/Bash syntax, isolated billing validation harness (unset/HTTPS/http/malformed/userinfo), cwctl privacy test, privacy audit harness, default privacy audit `findings=0`, and added-line security scan. The residual Vite production build also completed successfully with `4,736 modules transformed`, `✓ built in 3m 49s`, exit code 0; only Browserslist/chunk-size warnings remain. - The residual diff is intentionally **not committed**. Fresh independent delegated reviewers timed out or returned incomplete/no payload; fail-closed policy treats this as no approval. The residual changes remain uncommitted in the worktree for the next bounded review attempt. ### Release and compatibility blockers