sales-trainer/docs/engineering-log.md

Engineering Log — Sales Trainer

Program status table + dated entries. Append-only entries under docs/engineering-log/.

What this is

A corporate, multi-user sales-training simulator. Admins upload/describe a product → app analyzes it + generates 15 realistic customer personas (5 per intent tier A/B/C) with varied, partially product-aligned pains, negotiation levers, initiation modes (customer/seller), channels (Facebook/LINE), and latent-vs-revealable data. Trainees chat 1:1 (one-shot) to close a sale; customers resist/negotiate/refuse; a separate judge-LLM scores + coaches the result.

Informed by MiroFish (CrowdSight engine) + the hermes-brain-and-tools CrowdSight plugin.

Status table

Milestone	Status	Last verified	Evidence	Next action
M0 Scaffold + auth/roles	complete	2026-08-07	test_m0.py	—
M1 Input & analyze (+pain-fit)	complete	2026-08-07	test_e2e.py	—
M2 Persona groups + generation (15, wrong_text)	complete	2026-08-07	test_e2e.py	—
M3 Report	complete	2026-08-07	test_e2e.py	—
M4 Chat simulator (init modes, one-shot, judge, debrief)	complete	2026-08-07	test_e2e.py	—
M5 Trainee loop (board, weak-areas, gen-persona)	complete	2026-08-07	test_e2e.py	—
M6 Frontend (Vue SPA) + static serving fix	complete	2026-08-07	build + live HTTP 200	—
M7 Docker/deploy/docs	complete	2026-08-07	Dockerfile/compose/README	live-key E2E
Idea-to-implementation audit	deployment blocked	2026-08-13	docs/engineering-log/2026-08-13-idea-implementation-audit.md	complete Sprint 1 live-operation checklist
Sprint 1 security hotfix	local verification + exact-tree reviewer passed; live-operation gate pending	2026-08-14	docs/test-evidence/2026-08-13-sprint-1-security.md, docs/engineering-log/2026-08-14-sprint-1-current-tree.md	operator-approved restricted deploy/rotation/smoke; then reassess Sprint 2 start
Sprint 2–4 final code gate	S4.2/S4.3 code-schema review passed; legacy-security remediation and exact-current scoped review passed; live-operation gate pending	2026-08-15	docs/engineering-log/2026-08-15-final-security-gate.md	operator-approved restricted deploy + authenticated smoke only; production readiness remains pending
S4.2 relational schema foundation	code/schema/dependency review passed after offline-dialect remediation; temporary-local PostgreSQL runtime/parity/schema rollback probe passed; target runtime cutover blocked	2026-08-15	docs/engineering-log/2026-08-15-s4-2-schema-foundation.md, docs/engineering-log/2026-08-15-postgresql-runtime-gate.md, docs/test-evidence/2026-08-15-postgresql-runtime.md, backend/requirements.lock.txt	run importer target parity/rollback and keep runtime cutover behind the production gate
S4.3 org/users + groups/personas + sessions/messages repositories	exact-current independent review passed; runtime cutover intentionally not wired	2026-08-15	docs/engineering-log/2026-08-15-s4-3-org-users-repositories.md, docs/engineering-log/2026-08-15-s4-3-offline-dialect-remediation.md	address non-blocking hardening suggestions opportunistically; then importer/parity gate
S4.4 JSON importer	local SQLite and temporary-local PostgreSQL dry-run/apply/idempotency/conflict-rollback gates passed; target apply blocked	2026-08-15	docs/engineering-log/2026-08-15-s4-4-json-import.md, docs/engineering-log/2026-08-15-postgresql-import-gate.md, docs/test-evidence/2026-08-15-postgresql-import.md	target snapshot checksum/count comparison, retained backup, and operator-approved rollback rehearsal

Guardrails

• No self-registration; admin provisions users. (Verified: register => 404.)
• One persona = one chat per user (one-shot). Enforced in SessionStore + chat start.
• Latent persona fields never leak to trainees pre-result.
• LLM credentials live in .env only; never logged.

Entry index

• 2026-08-07-build-out.md — M0–M7 build-out, decisions, verification, current state.
• 2026-08-07-security-ux.md — security hardening (path traversal, IDOR, XSS) + UX/UI polish.
• 2026-08-07-auth-gitea.md — username login + first-time admin setup + Gitea push.
• 2026-08-07-docker-final.md — historical prebuilt-frontend/dist fix; superseded on 2026-08-15 by the source-built Docker/CI contract in the current Dockerfile.
• 2026-08-07-login-after-setup.md — can't-login-after-setup = deployment data non-persistence, not login logic (verified).
• 2026-08-07-login-email-fix.md — REAL fix: verify() resolves username OR email; "wrong password" after logout→login was email-login not resolving a user.
• 2026-08-07-ui-tablayout.md — 3-tab UI per spec: admin dashboard + date filter, personal dashboard, training w/ difficulty, settings profile.
• 2026-08-09-idea-flow-qa-deploy.md — idea-flow UX cleanups, 2-scenario model + recontact-as-trait, live QA on EasyPanel + auto-deploy, per-turn LLM judge for win/loss, persona variant, 15-persona auto-gen (this session).
• 2026-08-13-idea-implementation-audit.md — source-to-runtime audit; core flow verified, but independent probes reproduced arbitrary account takeover, two tenant bypasses, and additional product/runtime gaps.
• 2026-08-13-sprint-1-security-hotfix.md — S1.1–S1.6 implementation, verification, and deployment warning.
• 2026-08-14-sprint-1-current-tree.md — latest response-boundary and organization-update race fixes, exact verification evidence, and pending reviewer/live gates.
• 2026-08-14-final-review.md — final exact-tree reviewer approval, regression evidence, and explicit operational limits.
• 2026-08-15-auth-version-review-reconciliation.md — stale async auth-version finding, current lock-path verification, and pending fresh exact-tree review.
• 2026-08-15-s4-2-schema-foundation.md — test-first SQLAlchemy/Alembic schema foundation, tenant constraints, dependency lock, and generated-dist cleanup.
• 2026-08-15-s4-3-org-users-repositories.md — org/user repository contracts and SQLAlchemy adapters, with no runtime cutover.
• 2026-08-15-s4-3-offline-dialect-remediation.md — exact-current reviewer finding, test-first offline Alembic guard remediation, and fresh-review status.
• 2026-08-15-legacy-security-review.md — timed-out independent reviews and fail-closed gate handling.
• 2026-08-15-legacy-security-review-retries.md — repeated bounded retry timeouts and final pending reviewer.
• 2026-08-15-legacy-security-remediation-verification.md — historical 247-test verification, timeout handling, and prior scoped-review gate.
• 2026-08-15-legacy-rate-limit-migration.md — current legacy rate-limit migration remediation, 280/4 local evidence, and fresh pending review gates.
• 2026-08-15-final-security-gate.md — 319/166/4 local verification, dependency/tooling blocker, and three clean exact-current scoped reviewer verdicts; production-operation gate remains pending.
• 2026-08-15-postgresql-runtime-gate.md — temporary-local PostgreSQL upgrade, tenant/uniqueness probe, ORM/migration parity, offline DDL, and schema downgrade evidence; target cutover remains pending.
• 2026-08-15-postgresql-import-gate.md — temporary-local PostgreSQL importer dry-run, apply, idempotency, conflict rejection, transaction rollback, and cleanup evidence; target apply remains pending.
• docs/test-evidence/2026-08-15-legacy-security-remediation.md — test-first remediation, local verification, and independent-review boundary.
• docs/test-evidence/2026-08-15-postgresql-runtime.md — automated PostgreSQL gate evidence separated from Docker, Redis, importer, and production blockers.
• docs/test-evidence/2026-08-15-postgresql-import.md — temporary-local PostgreSQL importer evidence and target-operation boundary.
• 2026-08-15-s4-4-json-import.md — fail-closed dry-run/apply importer, idempotency, backup, and parity blockers.