ff0f680090
Security (requesting-code-review pipeline + independent reviewer): - Fix path traversal on file upload (basename sanitize + resolve-containment) - Fix IDOR: org + owner scoping on all group/chat routes (_authorize_group/_get_owned_group), hide other users' personal groups in listings - Remove XSS via v-html in Chat task (text interpolation) - Add test_security.py (traversal + cross-user denial) — all pass UX/UI (ui-ux-pro-max + frontend-dev-verification): - Global: focus rings, 44px touch targets, hover/press transitions, input focus glow, prefers-reduced-motion, skeleton loaders, empty states, back links, spinner - Login: password toggle, autocomplete, spinner, disabled-when-empty - Cards lift on hover; dashboard skeleton + empty state; analyze button spinner All backend tests pass (m0/m1/routes/security/e2e); frontend builds; served SPA verified via curl.
37 lines
2.0 KiB
Markdown
37 lines
2.0 KiB
Markdown
# Engineering Log — Sales Trainer
|
||
|
||
Program status table + dated entries. Append-only entries under `docs/engineering-log/`.
|
||
|
||
## What this is
|
||
|
||
A corporate, multi-user **sales-training simulator**. Admins upload/describe a product → app
|
||
analyzes it + generates 15 realistic customer personas (5 per intent tier A/B/C) with varied,
|
||
partially product-aligned pains, negotiation levers, initiation modes (customer/seller),
|
||
channels (Facebook/LINE), and latent-vs-revealable data. Trainees chat 1:1 (one-shot) to close
|
||
a sale; customers resist/negotiate/refuse; a separate judge-LLM scores + coaches the result.
|
||
|
||
Informed by MiroFish (CrowdSight engine) + the hermes-brain-and-tools CrowdSight plugin.
|
||
|
||
## Status table
|
||
|
||
| Milestone | Status | Last verified | Evidence | Next action |
|
||
|-----------|--------|---------------|----------|-------------|
|
||
| M0 Scaffold + auth/roles | complete | 2026-08-07 | `test_m0.py` | — |
|
||
| M1 Input & analyze (+pain-fit) | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M2 Persona groups + generation (15, wrong_text) | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M3 Report | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M4 Chat simulator (init modes, one-shot, judge, debrief) | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M5 Trainee loop (board, weak-areas, gen-persona) | complete | 2026-08-07 | `test_e2e.py` | — |
|
||
| M6 Frontend (Vue SPA) + static serving fix | complete | 2026-08-07 | build + live HTTP 200 | — |
|
||
| M7 Docker/deploy/docs | complete | 2026-08-07 | Dockerfile/compose/README | live-key E2E |
|
||
|
||
## Guardrails
|
||
- No self-registration; admin provisions users. (Verified: register => 404.)
|
||
- One persona = one chat per user (one-shot). Enforced in SessionStore + chat start.
|
||
- Latent persona fields never leak to trainees pre-result.
|
||
- LLM credentials live in `.env` only; never logged.
|
||
|
||
## Entry index
|
||
- `2026-08-07-build-out.md` — M0–M7 build-out, decisions, verification, current state.
|
||
- `2026-08-07-security-ux.md` — security hardening (path traversal, IDOR, XSS) + UX/UI polish.
|