# HANDOFF

## Current state
Implementation is in progress in `/Users/kunthawat/Gitea/Chatwoot`; source changes are present and remain unpushed.

### Latest handoff — 2026-08-16 (updated)
- `19dc449` — SM-07 local-only observability: Sentry/APM packages and boot paths removed; exception tracking remains local-only; exact post-commit review for `372f316..19dc449` passed with empty blocking arrays.
- `2ef6fa5` — SM-07 remediation: surfaces a thread-safe in-process per-account `last_request_summary(account_id:)` sink so `FilteredCountInstrumentation`'s documented local observability signals are consumable instead of discarded (fixes the `deleg_96a5daef` blocker). No APM/New Relic / off-box egress; sink probe passed; independent exact committed-diff review `deleg_087e4a3f` pending.
- `364e72f` — SM-08 dashboard arbitrary-script injection removal: `DASHBOARD_SCRIPTS` reader/config/sink removed; exact post-commit review passed with empty blocking arrays; Vite production build exited 0.
- `8101395` — residual Community Chatwoot Hub egress removal is **committed and independently approved** (`deleg_49d6ee2e`, `passed=true`, blocking arrays empty): Hub URL/push relay/sync/registration/event/changelog egress removed; `changelog.js` is a local empty-feed adapter exporting default `ChangelogApi` with no axios/fetch/network and its spec traps both; `billing_url` is HTTPS-only/host/no-userinfo and never Hub-falls-back; Enterprise `base_url` preserved with edition-safe spec; `privacy_audit` uses a narrow per-file/per-rule (`hub-url`) exception with deployment guard unchanged.
- Code checkpoints: `2ef6fa5` (SM-07 remediation) and `8101395` (residual Hub). Current repository `HEAD` is `8101395`. No push, deploy, HTTP request, DNS lookup, or credential use occurred.

### Verified checkpoints
- `8ebb320` — privacy/branding audit harness.
- `832a7fd` — Hub sync/registration/telemetry removal.
- `1a3697f` — restored only the compatibility APIs required by direct push/billing callers.
- `8b1a033` — removed the Chatwoot Hub push relay; exact post-commit independent review passed.
- `3458272` — removed cwctl telemetry from the installer; exact post-commit independent review passed.
- `d9bf4c4` — removed community signup/onboarding website-branding enrichment; split exact post-commit reviews `deleg_5e2578c5` (backend) and `deleg_ee3e217f` (frontend) passed with empty blocking arrays.
- `ced77af` — SM-06 Product Analytics removal and dashboard config allowlist remediation; pre-commit review `deleg_f9644984` and exact post-commit review `deleg_9b0a2f63` passed with empty security/logic arrays.

### Current work / uncheckpointed work
- SM-05 community signup enrichment removal is checkpointed at `d9bf4c4`; pre-commit review, commit hooks, and split exact post-commit reviews passed. The enterprise service/spec remain unchanged and fail with `NameError: uninitialized constant WebsiteBrandingService`. This remains an explicit architecture/legal blocker; do not add a dummy service or restore remote enrichment.
- SM-06 is verified at `ced77af`. Its follow-up fix applies `.slice(*GLOBAL_CONFIG_KEYS)` before merging `app_config`, preventing stale/unrequested values such as `CLOUD_ANALYTICS_TOKEN` from reaching serialized `window.globalConfig`. SM-07 local-only observability and the remaining SM-08 dashboard/config script-injection work are still uncheckpointed. The community Help Center SM-08 correction is committed as `5619cc3`: remove GTM remote-container execution, reject/remove legacy GTM config, and retain only fixed allow-listed provider snippets for explicit admin configuration. Exact post-commit review `deleg_dd3db5b7` passed with empty blocking arrays. Enterprise marketing conversion tracking remains outside this community scope pending legal/compatibility review.

### Evidence and blockers
- SM-03 exact post-commit review passed for `1a3697f..8b1a033`; reviewer suggestions are to add explicit missing/blank/partial Firebase negative coverage and clarify legacy FCM configuration names in `.env.example`.
- SM-04 exact post-commit review passed for `1a3697f..3458272`; Bash 3.2 compatibility and fail-closed privacy-test behavior were verified.
- SM-05 exact committed range `3458272..d9bf4c4` passed split independent reviews: backend `deleg_5e2578c5` and frontend `deleg_ee3e217f`; both returned complete five-key verdicts with empty security and logic arrays. Frontend targeted run passed 9 suites/8 tests. Backend RSpec rerun is environment-blocked because Ruby 3.4.4 is required but only 3.4.10 is installed and the bundle has no usable `rspec` executable.
- SM-06 exact committed range `a96b977..ced77af` changed one controller line and passed fresh pre-commit/post-commit independent review. Raw merge leaked a stubbed analytics token; the allowlist slice now removes unrequested keys before layout serialization. Committed Ruby syntax, diff check, and security scan passed. Rails RSpec/RuboCop remain blocked because the active Ruby is 2.6.10 and Bundler 2.5.16 is unavailable.
- SM-08 exact post-commit review `deleg_dd3db5b7` passed for `d9bf4c4..5619cc3`; 57 portal model/controller examples, GTM regression 3/3, Ruby/ERB syntax, RuboCop, ESLint/Prettier, Vite build and privacy-audit harness passed. Full Vitest with `TZ=UTC` passes 414 files / 4176 tests, 0 failed.
- No push or deploy has occurred.
- Approved product name, domains, logos/icons and sender/legal values are still missing; stop before SM-09/10.
- Full Rails/frontend suites, production-like DB checks, HTTP/DNS egress capture, `git fetch --unshallow`, and upstream merge rehearsal remain outstanding. The full Vitest frontend baseline is clean under `TZ=UTC`: 414 files / 4176 tests passed, 0 failed (the earlier "407/15 failed" record was a non-UTC run artifact; timezone-sensitive tests all pass under UTC).
- Temporary test services/configuration stay under `/tmp`; never commit them or secrets.

### Repository baseline
- Path: `/Users/kunthawat/Gitea/Chatwoot`
- Origin: `https://github.com/chatwoot/chatwoot.git`
- Branch: `develop`
- Initial baseline commit: `9a73c1473ffa0ae6a9c7725046b8ca17922dcc83`
- Latest checkpoint: `ced77af` (SM-06 Product Analytics plus dashboard config allowlist remediation; exact post-commit review `deleg_9b0a2f63` passed). SM-08 Help Center remains separately verified at `5619cc3`.
- Clone is shallow; fetch full upstream history before merge/rebase rehearsal.

### Primary deliverable
- `.hermes/plans/2026-08-15_092534-chatwoot-private-rebrand.md`
- Small-model execution index: `.hermes/plans/chatwoot-private/README.md`
- The execution package contains `00-execution-contract.md` plus runbooks `01`–`12` with 58 unique `SM-*` tasks. Send only one task at a time and review its exact diff/test evidence before advancing.

### Most important finding
`DISABLE_TELEMETRY=true` is not a complete opt-out. `lib/chatwoot_hub.rb` still posts `instance_config` to the Hub; it only omits `instance_metrics`. The corresponding behavior is asserted in `spec/lib/chatwoot_hub_spec.rb`.

### Other unsolicited/vendor-controlled egress to remove
- Chatwoot Hub daily sync and onboarding registration
- Chatwoot Hub `/send_push` relay fallback
- Hub-hosted changelog fetch
- silent cwctl command reporting to the Hub
- automatic signup email-domain website/DNS branding enrichment
- Amplitude browser analytics
- Sentry/frontend/backend remote error reporting
- optional remote APM agents
- arbitrary dashboard scripts and remote GTM container execution
- enterprise marketing conversion tracking (proprietary/cloud-only; pending separate legal/compatibility decision)

### Implementation order
1. Follow dependency order in `.hermes/plans/chatwoot-private/README.md`.
2. Establish the baseline and privacy audit harness before behavior changes.
3. Remove Hub sync/registration/manual refresh, push relay, cwctl telemetry, signup-domain enrichment and remote changelog.
4. Neutralize/remove analytics, remote error reporting/APM and script injection.
5. Stop at the Runbook 09 input gate until approved brand values/assets are supplied.
6. Add central brand defaults and replace visible assets/copy without renaming compatibility APIs.
7. Run static and isolated dynamic egress gates, positive feature-traffic tests, full review and visual QA.
8. Complete upstream-history and merge-rehearsal workflow; never mix upstream merge with customization commits.

### User decisions required before implementation
- Product name, canonical/support/docs domains, logos/icons and email sender name
- Private Gitea repository name
- Whether to keep deprecated widget API aliases (recommended: yes)
- Whether local-only logs are sufficient or a self-hosted observability endpoint is required
- Push notification plan and own FCM/VAPID credentials

### Safety/legal notes
- Root is MIT, but `enterprise/` is proprietary; do not ship enterprise features without a separate license.
- No remote repository was created, no files were pushed and no deployment was performed.