Conviro for Magento 2 — documentation
Module conviro/module-aichat (Magento module Conviro_AiChat), release 1.4.0. 1.4.1 and 1.5.0 are unreleased (branches fix/magento-1.4.1 and feat/magento-1.5.0-customer-hub); pages and sections about them say so. (Updated 2026-09-27: this line named only 1.4.0 while the 1.4.1 pages were already here.)
Documentation status. Written 2026-09-24 against the code on
feat/magento-10-10atd3472ce2; updated 2026-09-25 for revenue attribution and the release-gate R3 fixes. Before the 1.4.0 version bump and before anything was deployed. Unless a page says otherwise, measurements come from the local Magento 2.4.7-p4 test stack (integrations/magento2/dev/; the version matrix of 2026-09-26 re-ran the suite on 2.4.4-p13 and 2.4.9), not from a merchant store or production. No TODO (release pass) line is left.Where these pages are served. At https://repo.conviro.io/docs/magento2/ — Conviro's API serves them (security review R3, 2026-09-25): public, read-only, cached, rendered from these Markdown files without any raw HTML, under a strict Content Security Policy. English only: they are technical pages for the people who install and operate the module, and the marketing site's 11-locale rule is for marketing pages. The module links its Integration Health rows and setup-wizard steps to
<Documentation URL>/<page>#<anchor>(Documentation URL,conviro_aichat/general/docs_url, defaulthttps://repo.conviro.io/docs/magento2); the page is the file name without.md(this page is the index). The anchors the module uses are stable<a id>s on these pages (integration-health#row-*,setup-wizard#step-*,reconnect-disconnect#disconnect-from-magento). After editing a page runnode apps/api/scripts/build-magento-docs.mjsand commit the copy underapps/api/src/assets/magento-docs/with it — a test fails while the copy is stale.
What the integration does
Conviro's AI assistant answers your shoppers in chat — product questions, prices, stock, order status and tracking, returns — from your live Magento data, and can prepare order actions that you control.
Magento store Conviro
───────────── ───────
Conviro_AiChat module
events (products, stock, orders, …) ──────▶ knowledge base, order history,
queued locally, sent by cron leads, cart recovery
setup wizard, health card, sync jobs ─────▶ store registration, sync progress
Magento REST API ◀──── OAuth 1.0a signed ──── live reads when a shopper asks,
approved order actions
/conviro/webhook/receive ◀── signed ───────── lead / contact / session events
storefront widget (browser) ─────────────────▶ chat (cdn.conviro.io, api.conviro.io)
- Live, not copied: price, stock and order facts the assistant states are read from your store during the conversation, in the shopper's store view.
- Never in the way: checkout, registration and product saves only write a local queue row; delivery happens in the background.
- Minimal data: orders and customers are kept without names, addresses or phone numbers, e-mails only as a keyed one-way hash.
For merchants
| Page | What it covers |
|---|---|
| Supported versions | What was tested, what is declared, what is not tested yet. |
| Installation | Composer from repo.conviro.io, production-mode commands, manual install. |
| Setup wizard | The seven steps: environment, browser-mediated connect, Magento OAuth, store views, data sync, AI permissions, verify. |
| Configuration reference | Every setting: path, scope, default. Scope rationale: configuration-scopes.md. |
| Permissions explained | What access Conviro gets and why; admin ACL; API key scopes. |
| AI permissions and the action policy | What the AI may read; order actions off / customer confirms / team approves; approvals and audit log. |
| Data sync | Continuous sync, initial historical sync, re-sync, repair, progress in both dashboards. |
| Integration Health | Every row and status of the health card and how to fix each. |
| Troubleshooting | By symptom, with stable anchors. |
| Reconnect and disconnect | Exactly what is removed where, and what is kept. |
| Multi-store and multi-website | Scopes, store-view selection, store view in live answers. |
| Cart recovery and payment assist | Opt-in shopper data, the confirmation hold on upgrade, what Conviro does with it. |
| Signed customer identity and My orders | 1.5.0, unreleased. A signed-in shopper's own orders in the chat: the four identity states, what shoppers see and never see, how to switch it on (both sides, off by default). |
| Customer identity runbook | 1.5.0, unreleased. "Why doesn't it work?" in 30 seconds: the card read top-down, shopper-side checks, key rotation, privacy requests, what to send support. |
| Trust layer and grounding | Source classes, precedence, checks on replies, the inbox grounding indicator. |
| Headless, PWA and Hyvä | What works without Luma; embedding the widget with store code, identity and consent. |
| Networking and firewalls | Conviro's measured source address, hosts to allow, WAF / CDN / TLS-terminator notes. |
| Privacy and field inventory | Every personal field that leaves Magento, what Conviro stores, hashing, retention, deletion. |
| Upgrade 1.3.x → 1.4.0 | Commands, automatic OAuth migration, held cart events, new admin permission, security minimum. |
| Upgrade 1.4.x → 1.5.0 | Unreleased. Nothing changes until both switches are on; ext-sodium; rollback. |
| Uninstall | Disconnect, remove, clean up. |
| Release notes 1.5.0 (draft) · 1.4.1 · 1.4.0 · Changelog | What's new and what changes. |
For developers
| Page | What it covers |
|---|---|
| Architecture | Outbox, delivery cron, signatures both ways (exact headers), idempotency, replay protection, OAuth 1.0a dual stack and the legacy bearer window. |
| Event and data reference | Every event: trigger, when it is not sent, envelope, fields with types and PII class, retries, Conviro's effect; catalog and order data reference. |
| Security model | Trust boundaries, secrets, connect handshake, SSRF guard, FPC privacy, signed customer identity (1.5.0, unreleased), open items. |
| Performance, SLOs and alerts | Budgets, local measurements, backend SLOs and alert rules. |
| Diagnostics bundle | Contents and redaction. |
| Development and testing | Local Docker stack, acceptance scripts, PHPUnit, static analysis, CI, releasing. |
Other references in the repository: undefined (../dev/README.md) (test stack), undefined (../Conviro/AiChat/README.md) (module README), apps/api/src/modules/magento/SLO.md, apps/api/src/modules/magento/COMPOSER-REGISTRY.md.
Plan §20 coverage
| §20 page | Here |
|---|---|
| 1 Magento 2 overview | this page |
| 2 Supported versions | supported-versions.md |
| 3 Composer installation | installation.md |
| 4 Connection / OAuth setup | setup-wizard.md, architecture.md |
| 5 Permissions explained | permissions.md |
| 6 Initial historical sync · 7 Continuous sync model · 14 Re-sync catalog | data-sync.md |
| 8 Catalog data reference · 9 Order data reference · 10 Event reference | event-reference.md |
| 11 Multi-store setup | multi-store.md |
| 12 Hyvä setup · 13 Headless/PWA setup | headless-pwa.md |
| 15 Troubleshooting | troubleshooting.md |
| 16 Firewall / networking | networking-firewall.md |
| 17 Privacy and security | privacy-field-inventory.md, security-model.md |
| 18 Upgrade guide | upgrade-1.3-to-1.4.md, upgrade-1.4-to-1.5.md (unreleased) |
| 19 Uninstall | uninstall.md |
| 20 Release notes | RELEASE-NOTES-1.5.0.md (draft), RELEASE-NOTES-1.4.1.md, RELEASE-NOTES-1.4.0.md, CHANGELOG.md |
Plan §20 also asks that every troubleshooting error shown to a merchant links to its docs anchor. The module's messages do not link to any documentation yet; troubleshooting.md provides stable #symptom-… anchors for that change.
Support: [email protected] · Dashboard: https://app.conviro.io