kunthawat/moreminimore-chat
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

[docs] record SM-07 remediation (2ef6fa5) and residual Hub gate closure (8101395)

Browse Source
This commit is contained in:
Kunthawat Greethong
2026-08-16 07:38:43 +07:00
parent 8101395608
commit f30edd7884
2 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
HANDOFF.md
View File

@@ -3,11 +3,12 @@
## Current state
Implementation is in progress in `/Users/kunthawat/Gitea/Chatwoot`; source changes are present and remain unpushed.
### Latest handoff — 2026-08-16 03:04 +0700
### Latest handoff — 2026-08-16 (updated)
- `19dc449` — SM-07 local-only observability: Sentry/APM packages and boot paths removed; exception tracking remains local-only; exact post-commit review for `372f316..19dc449` passed with empty blocking arrays.
- `2ef6fa5` — SM-07 remediation: surfaces a thread-safe in-process per-account `last_request_summary(account_id:)` sink so `FilteredCountInstrumentation`'s documented local observability signals are consumable instead of discarded (fixes the `deleg_96a5daef` blocker). No APM/New Relic / off-box egress; sink probe passed; independent exact committed-diff review `deleg_087e4a3f` pending.
- `364e72f` — SM-08 dashboard arbitrary-script injection removal: `DASHBOARD_SCRIPTS` reader/config/sink removed; exact post-commit review passed with empty blocking arrays; Vite production build exited 0.
- Code checkpoint remains `364e72f`; current repository `HEAD` includes this docs handoff commit `9a4e78a`. No push, deploy, HTTP request, DNS lookup, or credential use occurred.
- Residual Hub cleanup is implemented in the worktree but **not committed**: fixed Hub URL/push relay/Hub changelog are removed, Enterprise shared billing callers are preserved behind validated `CHATWOOT_BILLING_URL`, and privacy audit findings are zero. The residual Vite production build completed successfully (`4,736 modules transformed`, `✓ built in 3m 49s`, exit code 0); only Browserslist/chunk-size warnings remain. Commit is blocked because fresh delegated reviewers timed out/incomplete and therefore produced no valid approval verdict.
- `8101395` — residual Community Chatwoot Hub egress removal is **committed and independently approved** (`deleg_49d6ee2e`, `passed=true`, blocking arrays empty): Hub URL/push relay/sync/registration/event/changelog egress removed; `changelog.js` is a local empty-feed adapter exporting default `ChangelogApi` with no axios/fetch/network and its spec traps both; `billing_url` is HTTPS-only/host/no-userinfo and never Hub-falls-back; Enterprise `base_url` preserved with edition-safe spec; `privacy_audit` uses a narrow per-file/per-rule (`hub-url`) exception with deployment guard unchanged.
- Code checkpoints: `2ef6fa5` (SM-07 remediation) and `8101395` (residual Hub). Current repository `HEAD` is `8101395`. No push, deploy, HTTP request, DNS lookup, or credential use occurred.
### Verified checkpoints
- `8ebb320` — privacy/branding audit harness.