moreminimore-chat/HANDOFF.md

HANDOFF

Current state

Implementation is in progress in /Users/kunthawat/Gitea/Chatwoot; source changes are present and remain unpushed.

Latest handoff — 2026-08-16 (updated)

• 19dc449 — SM-07 local-only observability: Sentry/APM packages and boot paths removed; exception tracking remains local-only; exact post-commit review for 372f316..19dc449 passed with empty blocking arrays.
• 2ef6fa5 — SM-07 remediation: surfaces a thread-safe in-process per-account last_request_summary(account_id:) sink so FilteredCountInstrumentation's documented local observability signals are consumable instead of discarded (fixes the deleg_96a5daef blocker). No APM/New Relic / off-box egress; sink probe passed; independent exact committed-diff review deleg_087e4a3f pending.
• 364e72f — SM-08 dashboard arbitrary-script injection removal: DASHBOARD_SCRIPTS reader/config/sink removed; exact post-commit review passed with empty blocking arrays; Vite production build exited 0.
• 8101395 — residual Community Chatwoot Hub egress removal is committed and independently approved (deleg_49d6ee2e, passed=true, blocking arrays empty): Hub URL/push relay/sync/registration/event/changelog egress removed; changelog.js is a local empty-feed adapter exporting default ChangelogApi with no axios/fetch/network and its spec traps both; billing_url is HTTPS-only/host/no-userinfo and never Hub-falls-back; Enterprise base_url preserved with edition-safe spec; privacy_audit uses a narrow per-file/per-rule (hub-url) exception with deployment guard unchanged.
• Code checkpoints: 2ef6fa5 (SM-07 remediation) and 8101395 (residual Hub). Current repository HEAD is 8101395. No push, deploy, HTTP request, DNS lookup, or credential use occurred.

Verified checkpoints

• 8ebb320 — privacy/branding audit harness.
• 832a7fd — Hub sync/registration/telemetry removal.
• 1a3697f — restored only the compatibility APIs required by direct push/billing callers.
• 8b1a033 — removed the Chatwoot Hub push relay; exact post-commit independent review passed.
• 3458272 — removed cwctl telemetry from the installer; exact post-commit independent review passed.
• d9bf4c4 — removed community signup/onboarding website-branding enrichment; split exact post-commit reviews deleg_5e2578c5 (backend) and deleg_ee3e217f (frontend) passed with empty blocking arrays.
• ced77af — SM-06 Product Analytics removal and dashboard config allowlist remediation; pre-commit review deleg_f9644984 and exact post-commit review deleg_9b0a2f63 passed with empty security/logic arrays.

Current work / uncheckpointed work

• SM-05 community signup enrichment removal is checkpointed at d9bf4c4; pre-commit review, commit hooks, and split exact post-commit reviews passed. The enterprise service/spec remain unchanged and fail with NameError: uninitialized constant WebsiteBrandingService. This remains an explicit architecture/legal blocker; do not add a dummy service or restore remote enrichment.
• SM-06 is verified at ced77af. Its follow-up fix applies .slice(*GLOBAL_CONFIG_KEYS) before merging app_config, preventing stale/unrequested values such as CLOUD_ANALYTICS_TOKEN from reaching serialized window.globalConfig. SM-07 local-only observability and the remaining SM-08 dashboard/config script-injection work are still uncheckpointed. The community Help Center SM-08 correction is committed as 5619cc3: remove GTM remote-container execution, reject/remove legacy GTM config, and retain only fixed allow-listed provider snippets for explicit admin configuration. Exact post-commit review deleg_dd3db5b7 passed with empty blocking arrays. Enterprise marketing conversion tracking remains outside this community scope pending legal/compatibility review.

Evidence and blockers

• SM-03 exact post-commit review passed for 1a3697f..8b1a033; reviewer suggestions are to add explicit missing/blank/partial Firebase negative coverage and clarify legacy FCM configuration names in .env.example.
• SM-04 exact post-commit review passed for 1a3697f..3458272; Bash 3.2 compatibility and fail-closed privacy-test behavior were verified.
• SM-05 exact committed range 3458272..d9bf4c4 passed split independent reviews: backend deleg_5e2578c5 and frontend deleg_ee3e217f; both returned complete five-key verdicts with empty security and logic arrays. Frontend targeted run passed 9 suites/8 tests. Backend RSpec rerun is environment-blocked because Ruby 3.4.4 is required but only 3.4.10 is installed and the bundle has no usable rspec executable.
• SM-06 exact committed range a96b977..ced77af changed one controller line and passed fresh pre-commit/post-commit independent review. Raw merge leaked a stubbed analytics token; the allowlist slice now removes unrequested keys before layout serialization. Committed Ruby syntax, diff check, and security scan passed. Rails RSpec/RuboCop remain blocked because the active Ruby is 2.6.10 and Bundler 2.5.16 is unavailable.
• SM-08 exact post-commit review deleg_dd3db5b7 passed for d9bf4c4..5619cc3; 57 portal model/controller examples, GTM regression 3/3, Ruby/ERB syntax, RuboCop, ESLint/Prettier, Vite build and privacy-audit harness passed. Full Vitest with TZ=UTC passes 414 files / 4176 tests, 0 failed.
• No push or deploy has occurred.
• Approved product name, domains, logos/icons and sender/legal values are still missing; stop before SM-09/10.
• Full Rails/frontend suites, production-like DB checks, HTTP/DNS egress capture, git fetch --unshallow, and upstream merge rehearsal remain outstanding. The full Vitest frontend baseline is clean under TZ=UTC: 414 files / 4176 tests passed, 0 failed (the earlier "407/15 failed" record was a non-UTC run artifact; timezone-sensitive tests all pass under UTC).
• Temporary test services/configuration stay under /tmp; never commit them or secrets.

Repository baseline

• Path: /Users/kunthawat/Gitea/Chatwoot
• Origin: https://github.com/chatwoot/chatwoot.git
• Branch: develop
• Initial baseline commit: 9a73c1473ffa0ae6a9c7725046b8ca17922dcc83
• Latest checkpoint: ced77af (SM-06 Product Analytics plus dashboard config allowlist remediation; exact post-commit review deleg_9b0a2f63 passed). SM-08 Help Center remains separately verified at 5619cc3.
• Clone is shallow; fetch full upstream history before merge/rebase rehearsal.

Primary deliverable

• .hermes/plans/2026-08-15_092534-chatwoot-private-rebrand.md
• Small-model execution index: .hermes/plans/chatwoot-private/README.md
• The execution package contains 00-execution-contract.md plus runbooks 01–12 with 58 unique SM-* tasks. Send only one task at a time and review its exact diff/test evidence before advancing.

Most important finding

DISABLE_TELEMETRY=true is not a complete opt-out. lib/chatwoot_hub.rb still posts instance_config to the Hub; it only omits instance_metrics. The corresponding behavior is asserted in spec/lib/chatwoot_hub_spec.rb.

Other unsolicited/vendor-controlled egress to remove

• Chatwoot Hub daily sync and onboarding registration
• Chatwoot Hub /send_push relay fallback
• Hub-hosted changelog fetch
• silent cwctl command reporting to the Hub
• automatic signup email-domain website/DNS branding enrichment
• Amplitude browser analytics
• Sentry/frontend/backend remote error reporting
• optional remote APM agents
• arbitrary dashboard scripts and remote GTM container execution
• enterprise marketing conversion tracking (proprietary/cloud-only; pending separate legal/compatibility decision)

Implementation order

1. Follow dependency order in .hermes/plans/chatwoot-private/README.md.
2. Establish the baseline and privacy audit harness before behavior changes.
3. Remove Hub sync/registration/manual refresh, push relay, cwctl telemetry, signup-domain enrichment and remote changelog.
4. Neutralize/remove analytics, remote error reporting/APM and script injection.
5. Stop at the Runbook 09 input gate until approved brand values/assets are supplied.
6. Add central brand defaults and replace visible assets/copy without renaming compatibility APIs.
7. Run static and isolated dynamic egress gates, positive feature-traffic tests, full review and visual QA.
8. Complete upstream-history and merge-rehearsal workflow; never mix upstream merge with customization commits.

User decisions required before implementation

• Product name, canonical/support/docs domains, logos/icons and email sender name
• Private Gitea repository name
• Whether to keep deprecated widget API aliases (recommended: yes)
• Whether local-only logs are sufficient or a self-hosted observability endpoint is required
• Push notification plan and own FCM/VAPID credentials

Safety/legal notes

• Root is MIT, but enterprise/ is proprietary; do not ship enterprise features without a separate license.
• No remote repository was created, no files were pushed and no deployment was performed.