chore: close public release review gaps

Author: codeyogi911

.github/workflows/ci.yml

@@ -33,6 +33,14 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+      - name: Scan private identifiers across complete main history
+        if: github.event_name == 'push'
+        env:
+          PUBLIC_HISTORY_DENYLIST: ${{ secrets.MORROW_PRIVATE_DENYLIST }}
+        run: npm run scan:history
       - name: Install pinned Gitleaks
         env:
           GITLEAKS_URL: https://github.com/gitleaks/gitleaks/releases/download/v8.24.3/gitleaks_8.24.3_linux_x64.tar.gz

README.md

@@ -24,6 +24,7 @@ The module—not the agent or transport adapter—owns lifecycle policy, authori
 
 - Case queues, search, assignment, priority, lifecycle, public replies, and private notes
 - Public knowledge, request intake, private case links, attachments, and bounded attachment evidence
+- Browser text help, optional voice input, and optional read-only Shopify order lookup
 - Channel-neutral conversations with explicit routing to support, sales, both, or no work
 - Signed WhatsApp text ingress and conversation-owned replies
 - Canonical parties, CRM relationships, sourced activities, and scheduled follow-ups

apps/desk/scripts/build-browser-asset.mjs

@@ -0,0 +1,25 @@
+import { build } from 'esbuild'
+import { writeFile } from 'node:fs/promises'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const deskRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+
+export async function buildBrowserAsset(entry, outfile) {
+  const result = await build({
+    entryPoints: [resolve(deskRoot, entry)],
+    bundle: true,
+    format: 'iife',
+    platform: 'browser',
+    target: ['es2022'],
+    minify: true,
+    legalComments: 'none',
+    sourcemap: false,
+    outfile: resolve(deskRoot, outfile),
+    write: false,
+  })
+
+  for (const output of result.outputFiles) {
+    await writeFile(output.path, output.text.replace(/[\t ]+$/gm, ''), 'utf8')
+  }
+}

apps/desk/scripts/build-portal-search.mjs

@@ -1,23 +1,3 @@
-import { build } from 'esbuild'
-import { writeFile } from 'node:fs/promises'
-import { dirname, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { buildBrowserAsset } from './build-browser-asset.mjs'
 
-const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
-
-const result = await build({
-  entryPoints: [resolve(repositoryRoot, 'src/portal/search-client.ts')],
-  bundle: true,
-  format: 'iife',
-  platform: 'browser',
-  target: ['es2022'],
-  minify: true,
-  legalComments: 'none',
-  sourcemap: false,
-  outfile: resolve(repositoryRoot, 'public/portal-search.js'),
-  write: false,
-})
-
-for (const output of result.outputFiles) {
-  await writeFile(output.path, output.text.replace(/[\t ]+$/gm, ''), 'utf8')
-}
+await buildBrowserAsset('src/portal/search-client.ts', 'public/portal-search.js')

apps/desk/scripts/build-voice-demo.mjs

@@ -1,23 +1,3 @@
-import { build } from 'esbuild'
-import { writeFile } from 'node:fs/promises'
-import { dirname, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { buildBrowserAsset } from './build-browser-asset.mjs'
 
-const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
-
-const result = await build({
-  entryPoints: [resolve(repositoryRoot, 'src/voice/demo-client.ts')],
-  bundle: true,
-  format: 'iife',
-  platform: 'browser',
-  target: ['es2022'],
-  minify: true,
-  legalComments: 'none',
-  sourcemap: false,
-  outfile: resolve(repositoryRoot, 'public/voice-demo.js'),
-  write: false,
-})
-
-for (const output of result.outputFiles) {
-  await writeFile(output.path, output.text.replace(/[\t ]+$/gm, ''), 'utf8')
-}
+await buildBrowserAsset('src/voice/demo-client.ts', 'public/voice-demo.js')

apps/desk/test/voice-demo.test.ts

@@ -16,7 +16,7 @@ const BRANDING = voiceBranding({
   displayName: 'Example Company',
   logoUrl: 'https://cdn.example.test/logo.png',
   faviconUrl: '/favicon.png',
-  homeUrl: 'https://fix.example.test/',
+  homeUrl: 'https://company.example.test/',
 })
 
 describe('voice demo boundary', () => {
@@ -166,7 +166,7 @@ describe('voice demo boundary', () => {
 
     expect(html).toContain('<title>Example Company support assistant</title>')
     expect(html).toContain('aria-label="Example Company home"')
-    expect(html).toContain('href="https://fix.example.test/"')
+    expect(html).toContain('href="https://company.example.test/"')
     expect(html).toContain('<img class="brand-logo" src="https://cdn.example.test/logo.png" alt="">')
     expect(html).toContain('<link rel="icon" href="/favicon.png">')
     expect(html).toContain('/workspace-theme.css')

docs/product-v1.md

@@ -4,9 +4,9 @@ This document is the implementation contract for the first public-ready Morrow D
 
 ## Product boundary
 
-V1 includes case queues and search, complete case workspaces, manual case opening, public replies, private notes, status, priority, category, assignment, customer corrections, knowledge articles, attachments, magic-link customer threads, inbound email, agent-customizable rich outbound notifications, manually recorded phone cases, signed WhatsApp text conversations with explicit Desk/CRM routing and conversation-owned replies, immutable audit evidence, operational diagnostics, canonical Directory adoption, first-class CRM sales leads, CRM relationship state, sourced activities, scheduled follow-ups, cross-module customer context, operation closure contracts, and inactive improvement proposals with independent evaluation records.
+V1 includes case queues and search, complete case workspaces, manual case opening, public replies, private notes, status, priority, category, assignment, customer corrections, knowledge articles, attachments, magic-link customer threads, inbound email, agent-customizable rich outbound notifications, browser text and optional voice assistance, optional read-only Shopify order lookup, manually recorded phone cases, signed WhatsApp text conversations with explicit Desk/CRM routing and conversation-owned replies, immutable audit evidence, operational diagnostics, canonical Directory adoption, first-class CRM sales leads, CRM relationship state, sourced activities, scheduled follow-ups, cross-module customer context, operation closure contracts, and inactive improvement proposals with independent evaluation records.
 
-V1 excludes customer passwords, community features, live chat, non-WhatsApp social channels, WhatsApp media/templates/status receipts, opportunity/deal pipelines, configurable CRM objects, sales forecasting, store integrations, macros, general workflow automation, SLA timers, analytics, CSAT, custom fields, an integration marketplace, autonomous candidate activation, and multi-tenant SaaS.
+V1 excludes customer passwords, community features, live human chat, telephone-network calling, non-WhatsApp social channels, WhatsApp media/templates/status receipts, opportunity/deal pipelines, configurable CRM objects, sales forecasting, write-capable store integrations, macros, general workflow automation, SLA timers, analytics, CSAT, custom fields, an integration marketplace, autonomous candidate activation, and multi-tenant SaaS.
 
 ## Required interfaces
 
@@ -79,7 +79,7 @@ The public support homepage is an agent conversation that grounds ordinary quest
 - Tool success, provider acceptance, delivery, and business outcome remain distinct states.
 - Runtime evidence may motivate a proposal but cannot activate a prompt, playbook, policy, tool, ontology, model, or code version.
 
-The domain vocabulary is fixed to `open | waiting_on_customer | on_hold | resolved | closed`, `low | normal | high | urgent`, `portal | email | manual | whatsapp`, and `queued | accepted | blocked | failed | indeterminate`. A Conversation is channel evidence; a Case is support work; a Sales Lead is qualification work.
+The domain vocabulary is fixed to `open | waiting_on_customer | on_hold | resolved | closed`, `low | normal | high | urgent`, `portal | email | manual | whatsapp | voice`, and `queued | accepted | blocked | failed | indeterminate`. A Conversation is channel evidence; a Case is support work; a Sales Lead is qualification work.
 
 ## Architecture
 

scripts/scan-public-readiness.mjs

@@ -65,7 +65,7 @@ for (const filename of await walk(root)) {
     if (lowered.includes(token.toLowerCase())) failures.push(`${rel}: contains a deployment-specific identity token`)
   }
   for (const email of personalEmails(text)) failures.push(`${rel}: contains non-example email ${email}`)
-  if (/\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/i.test(text) && rel === 'wrangler.jsonc') {
+  if (/\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/i.test(text) && /^wrangler(?:\.[^.]+)*\.jsonc$/.test(path.basename(filename))) {
     failures.push(`${rel}: contains a concrete resource identifier`)
   }
   if (/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/.test(text)) failures.push(`${rel}: contains a private key`)