[verified] build tourism signal dashboard

docs/engineering-log.md

@@ -0,0 +1,32 @@
+# Engineering Log — SET50 Alternative Data Platform
+
+## Current status
+
+| Milestone | Status | Evidence | Next action |
+|---|---|---|---|
+| M0 repo foundation | complete | Flask API, Vue/Vite shell | replace fixture with source adapter |
+| Tourism deterministic signal | complete | 7 backend tests pass | add replayable real source |
+| Internal paper ledger | complete | POST/readback through live API | persist in PostgreSQL later |
+| Dashboard | complete | Vite build + live HTML/API checks | visual browser capture after permission is available |
+| LLM analysis | deferred | intentionally no LLM dependency in M0 | add after signal lineage is stable |
+| Webhook receiver | deferred | contract only, no external receiver | choose after core app is usable |
+| MT5 bridge | deferred | not started | paper bridge after webhook decision |
+
+## Guardrails
+
+- Research and paper modes only.
+- No live orders, external webhook receiver, broker credentials, or MT5 connection.
+- Deterministic signal is authoritative; LLM will remain downstream.
+- Fixture source is clearly marked and must be replaced before investment use.
+- `target_weight` is recorded in the internal paper ledger; it is not an order.
+
+## Verification
+
+- Backend: 10 unittest tests pass.
+- Independent review: **PASSED**; no concrete security or logic blockers.
+- Reviewer suggestions: set `PAPER_COOKIE_SECURE=1` outside local HTTP; replace in-memory sessions before multi-worker deployment.
+- Frontend: `npm run build` passes with Vite.
+- Backend health endpoint returns HTTP 200 JSON.
+- Dashboard served HTML contains the current title, Vue mount point and Vite entry.
+- Paper ledger POST and readback work through the live API.
+- Browser visual capture was blocked by Chrome remote-debugging permission; no permission dialog was clicked.