--- /dev/null +++ b/README_NEW_CHAT_BUNDLE_22072026165405.txt @@ -0,0 +1,30 @@ +GLMCHAT V2.2.1 — FULL NEW-CHAT HANDOVER BUNDLE +Created: 22 July 2026 16:54:05 BST + +PURPOSE +This bundle contains the latest verified GLMChat V2.2.1 deployment, documentation, +validation evidence, source lineage archives and a continuation brief for a new chat. + +START HERE +1. Read documentation/current/NEW_CHAT_HANDOVER_22072026165405.txt. +2. Use documentation/current/NEXT_CHAT_PROMPT_22072026165405.txt as the first prompt in the new chat. +3. Use release/GLMCHAT_V2.2.1_SERVER_DIRECT_DEPLOY_CONTINUED_22072026154516.zip for direct server extraction. +4. Treat app/ as the exact expanded contents of that deployable ZIP. + +IMPORTANT STATUS +- The deployable application is unchanged from the previously verified release. +- It is a conditional staging candidate, not yet production-proven. +- Live LiteSpeed, full PHP success-path, Together provider and physical Android checks remain open. +- Preserve an existing production storage/ directory during any upgrade. + +DIRECTORY MAP +- app/ Exact expanded server-deploy application. +- release/ Server-direct-deploy ZIP. +- documentation/current/ Current handover, status, verification and continuation files. +- documentation/reference/ Existing product, installation, administration and user guides. +- evidence/ Change reports and validation outputs. +- source_lineage/ Original V2.2 and hardened V2.2.1 source bundles. +- tools/ Static package validator used during the latest continuation. + +DEPLOYMENT ZIP SHA-256 +b67db56f204c6131fea9f046601d02b39cf4f8e365237ef661c21328aa50176e --- /dev/null +++ b/documentation/current/NEW_CHAT_HANDOVER_22072026165405.txt @@ -0,0 +1,66 @@ +GLMCHAT V2.2.1 — NEW-CHAT HANDOVER +Created: 22 July 2026 16:54:05 BST + +AUTHORITATIVE CURRENT RELEASE +- Version: 2.2.1 +- Deployable ZIP: release/GLMCHAT_V2.2.1_SERVER_DIRECT_DEPLOY_CONTINUED_22072026154516.zip +- Deployable ZIP SHA-256: b67db56f204c6131fea9f046601d02b39cf4f8e365237ef661c21328aa50176e +- Expanded application: app/ +- Architecture: React PWA + PHP 8.2+ + SQLite on LiteSpeed/Apache-compatible shared hosting. +- Target: Android mobile, installable PWA, domain root or nested subdirectory. + +CURRENT DISPOSITION +CONDITIONAL STAGING CANDIDATE — NOT PRODUCTION-PROVEN. + +COMPLETED REMEDIATION +- Sensitive offline records protected with AES-GCM after PIN unlock. +- Existing plaintext records migrate after successful unlock. +- Seven-day offline-credential maximum age. +- Controlled service-worker update flow and corrected fallback behaviour. +- No-cache handling for non-fingerprinted runtime scripts. +- Production preview bypass removed. +- Mock provider restricted to APP_ENV=test. +- Light-only production palette. +- New-chat manifest shortcut added; unused Workbox asset removed. +- SBOM, deployment manifest and third-party notices corrected. +- Direct-deploy ZIP flattened for extraction at web-root level. +- README corrected to describe the actual direct-deploy package. + +LATEST VERIFIED CHECKS +- PHP syntax: 44/44 passed. +- JavaScript syntax: 7/7 passed. +- Structural/security/PWA/SQLite assertions: 281 passed. +- Deployment manifest: 81/81 verified. +- SBOM runtime inventory: 80/80 verified. +- Precache entries: 15/15 present. +- Fresh, repeated and 12-to-13 migration scenarios: passed. +- Apache-compatible domain-root and nested-path routing: passed. +- Protected paths: 403 confirmed. +- ZIP integrity, traversal, duplicate and symlink checks: passed. + +NOT YET VERIFIED +- Successful backend execution with all required PHP extensions. +- Live LiteSpeed hosting acceptance. +- Upgrade and rollback using cloned real production storage. +- Live Together GLM-5.2 text, vision, tools and TTS requests. +- Production streaming/cancellation through the real proxy/server stack. +- Concurrency, long-running workflows and SQLite contention. +- IndexedDB quota, storage eviction and low-connectivity conditions. +- Physical Android Chrome, Samsung Internet and TalkBack acceptance. +- Source build, type-check, lint and original automated suites: source repository is absent. + +SERVER REQUIREMENTS +- PHP 8.2 or newer. +- Extensions: sqlite3, curl, json, openssl, mbstring, fileinfo and zip. +- HTTPS. +- .htaccess overrides enabled. +- storage/ writable by PHP but denied from public HTTP access. + +UPGRADE WARNING +Back up and preserve the existing storage/ directory. Do not overwrite, delete or +replace production storage/ unless a separately verified migration/restore plan says so. + +WORKING RULE +Before any future modification, snapshot the actual app and compare every final file +against that baseline. Make only the smallest task-specific change and generate the +required timestamped unified-diff record. --- /dev/null +++ b/documentation/current/NEXT_CHAT_PROMPT_22072026165405.txt @@ -0,0 +1,17 @@ +Use autonomous-app-completion on the attached GLMChat V2.2.1 new-chat handover bundle. + +Treat app/ and release/GLMCHAT_V2.2.1_SERVER_DIRECT_DEPLOY_CONTINUED_22072026154516.zip as the authoritative current release. Read documentation/current/NEW_CHAT_HANDOVER_*.txt, CURRENT_ISSUE_STATUS_*.txt and the latest validation report before acting. + +Continue autonomously from the outstanding production gates. Do not redo or claim already completed checks without evidence. Before changing any application file, create a complete baseline snapshot from the actual files. Preserve all unrelated features, structure, styling, data, routes, PWA behaviour and PHP/SQLite/LiteSpeed architecture. Do not delete or overwrite production storage data. + +Priority order: +1. Set up a PHP 8.2+ environment with sqlite3, curl, mbstring, zip, fileinfo, json and openssl. +2. Run the successful backend, authentication, migration and SQLite workflows. +3. Validate root and nested LiteSpeed deployment, rewrites, private-path denials, HTTPS, cookies and security headers. +4. Test an upgrade and rollback against a cloned real pre-V2.2.1 storage directory. +5. Run live Together text, vision, function/tool and TTS acceptance, including failure paths. +6. Test streaming, cancellation, concurrency, long-running workflows, quota pressure and file/ZIP handling. +7. Complete physical Android Chrome, Samsung Internet and TalkBack acceptance when available. +8. Obtain or identify the matching source repository before claiming build, type-check, lint or source test completion. + +Fix confirmed defects using the smallest safe changes. After each stage, self-verify and continue without awaiting confirmation. On completion, regenerate the manifest/SBOM where applicable, create the required timestamped CHANGES_hhmmddmmyyyy.txt unified diff, update documentation, and provide a verified direct-deploy ZIP plus a complete new-chat handover bundle. --- /dev/null +++ b/documentation/current/CURRENT_ISSUE_STATUS_22072026165405.txt @@ -0,0 +1,59 @@ +GLMCHAT V2.2.1 — CURRENT ISSUE STATUS REGISTER + +RELEASE-BLOCKING EXTERNAL GATES — OPEN +P0-001 Successful PHP backend path with all required extensions. +P0-002 Live LiteSpeed domain-root deployment acceptance. +P0-003 Live LiteSpeed nested-subdirectory acceptance. +P0-004 Target-host .htaccess and private-path enforcement. +P0-005 Live HTTPS, proxy and session-cookie behaviour. +P0-006 Upgrade using a cloned real production database/storage directory. +P0-007 Tested rollback after an intentionally failed upgrade. +P0-008 Live Together API-key validation and error paths. +P0-009 Live GLM-5.2 chat, reasoning, streaming and cancellation. +P0-010 Live function calling and autonomous PHP-tool execution. +P0-011 Live vision routing and image validation. +P0-012 Live Together TTS voice generation and playback. +P0-013 Streaming/SSE behaviour through the production LiteSpeed/proxy stack. +P0-014 Physical Android Chrome acceptance. +P0-015 Physical Samsung Internet acceptance. +P0-016 Physical TalkBack acceptance. + +MATERIAL OPEN RISKS +P1-002 Six-digit PIN remains a limited-entropy local secret; device-bound passkey/WebAuthn protection remains recommended for high-sensitivity use. +P1-004 Offline revocation cannot be immediate while a device remains disconnected; the seven-day maximum age limits but does not remove this constraint. +P1-010 Source build and test claims cannot be reproduced because the matching source repository, package files and suites are absent. +P1-011 React 16.0.0 and ReactDOM 16.0.1 require a formal dependency-risk decision and controlled source-level upgrade plan. +P1-013 Real long-running workflow, concurrency, lease and contention testing is outstanding. +P1-014 IndexedDB quota, transaction failure and browser-eviction testing is outstanding. +P1-015 Large file and hostile ZIP handling on the target host is outstanding. +P1-016 Current Together model, voice and cost settings require live verification. + +IMPORTANT OPEN UX/ACCEPTANCE ITEMS +P2-010 Mandatory security headers must be confirmed on the target host, not only the compatibility harness. +P2-011 The install-before-setup product decision requires physical-browser acceptance and recovery testing. +P2-012 Low-connectivity, packet-loss and captive-portal behaviour remains untested. +P2-013 Downloads and Android storage handling remain untested on target browsers. +P3-005 Physical screenshots/device evidence is not included. + +CONFIRMED CLOSED OR REMEDIATED +P1-001 Offline sensitive-data encryption. +P1-003 Offline credential maximum age. +P1-005 Background replay description corrected to match actual behaviour. +P1-006 Runtime helper cache policy. +P1-007 Controlled service-worker updates. +P1-008 Production mock-provider restriction. +P1-009 SBOM regeneration and exact inventory. +P1-012 Third-party notices. +P2-001 Service-worker fallback response. +P2-002 Service-worker registration diagnostics. +P2-003 Production preview bypass. +P2-004 Light-only interface alignment. +P2-005 Direct-deploy documentation paths. +P2-006 Conditional-staging release wording. +P2-007 Public-root documentation duplication. +P2-008 Offline-lock wording and encrypted-record behaviour. +P2-009 Normal update-ready interface. +P3-001 Unused Workbox asset. +P3-002 New-chat PWA shortcut. +P3-003 SBOM scope/inventory consistency. +P3-004 Documentation duplication in the public deployable tree. --- /dev/null +++ b/documentation/current/BUNDLE_CONTENTS_22072026165405.txt @@ -0,0 +1,33 @@ +GLMCHAT V2.2.1 NEW-CHAT BUNDLE CONTENTS + +app/ + Exact expanded contents of the latest server-direct-deploy ZIP. + +release/ + GLMCHAT_V2.2.1_SERVER_DIRECT_DEPLOY_CONTINUED_22072026154516.zip + +source_lineage/ + GLMCHAT_V2.2_APP_AND_DOCUMENTATION_BUNDLE_22072026124256.zip + GLMCHAT_V2.2.1_HARDENED_BUNDLE_22072026130816.zip + +current documentation/ + NEW_CHAT_HANDOVER_22072026165405.txt + NEXT_CHAT_PROMPT_22072026165405.txt + CURRENT_ISSUE_STATUS_22072026165405.txt + BUNDLE_CONTENTS_22072026165405.txt + GLMCHAT_V2.2.1_CONTINUED_VALIDATION_22072026154516.txt + GLMCHAT_V2.2.1_SERVER_EXTRACTION_VERIFICATION_22072026133627.txt + FINAL_VALIDATION_22072026130658.txt + +reference documentation/ + Administration, installation, release, route/UI, feature map, user guide, + remediation, hardening and outstanding-gate documents from the hardened bundle. + +evidence/ + Existing unified-diff reports and latest static/HTTP validation outputs. + +tools/ + Latest static package validator. + +prepackage validation/ + HANDOVER_PREPACKAGE_VALIDATION_22072026165405.txt # TASK VERIFICATION # Requested task: Create a complete GLMChat V2.2.1 ZIP for continuation in a new chat. # Scope matched: Yes # Build: Not run # Type-check: Not run # Lint: Not run # Automated tests: Not run # Targeted checks: Passed # PWA checks: Passed # Feature loss detected: No # Data loss detected: No # Structural changes detected: No application structural changes; handover-only bundle structure added # Regressions detected: No # Unrelated changes reverted: None # Checks not run: Source build, type-check, lint and original automated suites are unavailable because the deployment bundle excludes source/package/test files. Live PHP/provider/device checks remain external. # Validation notes: The expanded app and included deploy ZIP were compared to the authoritative latest release. Application files were not modified. Archive safety, manifest integrity, PHP/JavaScript syntax, JSON parsing and handover completeness were checked before packaging.