Conviro for Magento 2 — documentation

Module conviro/module-aichat (Magento module Conviro_AiChat), release 1.4.0. 1.4.1 and 1.5.0 are unreleased (branches fix/magento-1.4.1 and feat/magento-1.5.0-customer-hub); pages and sections about them say so. (Updated 2026-09-27: this line named only 1.4.0 while the 1.4.1 pages were already here.)

Documentation status. Written 2026-09-24 against the code on feat/magento-10-10 at d3472ce2; updated 2026-09-25 for revenue attribution and the release-gate R3 fixes. Before the 1.4.0 version bump and before anything was deployed. Unless a page says otherwise, measurements come from the local Magento 2.4.7-p4 test stack (integrations/magento2/dev/; the version matrix of 2026-09-26 re-ran the suite on 2.4.4-p13 and 2.4.9), not from a merchant store or production. No TODO (release pass) line is left.

Where these pages are served. At https://repo.conviro.io/docs/magento2/ — Conviro's API serves them (security review R3, 2026-09-25): public, read-only, cached, rendered from these Markdown files without any raw HTML, under a strict Content Security Policy. English only: they are technical pages for the people who install and operate the module, and the marketing site's 11-locale rule is for marketing pages. The module links its Integration Health rows and setup-wizard steps to <Documentation URL>/<page>#<anchor> (Documentation URL, conviro_aichat/general/docs_url, default https://repo.conviro.io/docs/magento2); the page is the file name without .md (this page is the index). The anchors the module uses are stable <a id>s on these pages (integration-health#row-*, setup-wizard#step-*, reconnect-disconnect#disconnect-from-magento). After editing a page run node apps/api/scripts/build-magento-docs.mjs and commit the copy under apps/api/src/assets/magento-docs/ with it — a test fails while the copy is stale.

What the integration does

Conviro's AI assistant answers your shoppers in chat — product questions, prices, stock, order status and tracking, returns — from your live Magento data, and can prepare order actions that you control.

 Magento store                                  Conviro
 ─────────────                                  ───────
 Conviro_AiChat module
   events (products, stock, orders, …) ──────▶  knowledge base, order history,
     queued locally, sent by cron                leads, cart recovery
   setup wizard, health card, sync jobs ─────▶  store registration, sync progress
 Magento REST API ◀──── OAuth 1.0a signed ────  live reads when a shopper asks,
                                                  approved order actions
 /conviro/webhook/receive ◀── signed ─────────  lead / contact / session events
 storefront widget (browser) ─────────────────▶ chat (cdn.conviro.io, api.conviro.io)

For merchants

PageWhat it covers
Supported versionsWhat was tested, what is declared, what is not tested yet.
InstallationComposer from repo.conviro.io, production-mode commands, manual install.
Setup wizardThe seven steps: environment, browser-mediated connect, Magento OAuth, store views, data sync, AI permissions, verify.
Configuration referenceEvery setting: path, scope, default. Scope rationale: configuration-scopes.md.
Permissions explainedWhat access Conviro gets and why; admin ACL; API key scopes.
AI permissions and the action policyWhat the AI may read; order actions off / customer confirms / team approves; approvals and audit log.
Data syncContinuous sync, initial historical sync, re-sync, repair, progress in both dashboards.
Integration HealthEvery row and status of the health card and how to fix each.
TroubleshootingBy symptom, with stable anchors.
Reconnect and disconnectExactly what is removed where, and what is kept.
Multi-store and multi-websiteScopes, store-view selection, store view in live answers.
Cart recovery and payment assistOpt-in shopper data, the confirmation hold on upgrade, what Conviro does with it.
Signed customer identity and My orders1.5.0, unreleased. A signed-in shopper's own orders in the chat: the four identity states, what shoppers see and never see, how to switch it on (both sides, off by default).
Customer identity runbook1.5.0, unreleased. "Why doesn't it work?" in 30 seconds: the card read top-down, shopper-side checks, key rotation, privacy requests, what to send support.
Trust layer and groundingSource classes, precedence, checks on replies, the inbox grounding indicator.
Headless, PWA and HyväWhat works without Luma; embedding the widget with store code, identity and consent.
Networking and firewallsConviro's measured source address, hosts to allow, WAF / CDN / TLS-terminator notes.
Privacy and field inventoryEvery personal field that leaves Magento, what Conviro stores, hashing, retention, deletion.
Upgrade 1.3.x → 1.4.0Commands, automatic OAuth migration, held cart events, new admin permission, security minimum.
Upgrade 1.4.x → 1.5.0Unreleased. Nothing changes until both switches are on; ext-sodium; rollback.
UninstallDisconnect, remove, clean up.
Release notes 1.5.0 (draft) · 1.4.1 · 1.4.0 · ChangelogWhat's new and what changes.

For developers

PageWhat it covers
ArchitectureOutbox, delivery cron, signatures both ways (exact headers), idempotency, replay protection, OAuth 1.0a dual stack and the legacy bearer window.
Event and data referenceEvery event: trigger, when it is not sent, envelope, fields with types and PII class, retries, Conviro's effect; catalog and order data reference.
Security modelTrust boundaries, secrets, connect handshake, SSRF guard, FPC privacy, signed customer identity (1.5.0, unreleased), open items.
Performance, SLOs and alertsBudgets, local measurements, backend SLOs and alert rules.
Diagnostics bundleContents and redaction.
Development and testingLocal Docker stack, acceptance scripts, PHPUnit, static analysis, CI, releasing.

Other references in the repository: undefined (../dev/README.md) (test stack), undefined (../Conviro/AiChat/README.md) (module README), apps/api/src/modules/magento/SLO.md, apps/api/src/modules/magento/COMPOSER-REGISTRY.md.

Plan §20 coverage

§20 pageHere
1 Magento 2 overviewthis page
2 Supported versionssupported-versions.md
3 Composer installationinstallation.md
4 Connection / OAuth setupsetup-wizard.md, architecture.md
5 Permissions explainedpermissions.md
6 Initial historical sync · 7 Continuous sync model · 14 Re-sync catalogdata-sync.md
8 Catalog data reference · 9 Order data reference · 10 Event referenceevent-reference.md
11 Multi-store setupmulti-store.md
12 Hyvä setup · 13 Headless/PWA setupheadless-pwa.md
15 Troubleshootingtroubleshooting.md
16 Firewall / networkingnetworking-firewall.md
17 Privacy and securityprivacy-field-inventory.md, security-model.md
18 Upgrade guideupgrade-1.3-to-1.4.md, upgrade-1.4-to-1.5.md (unreleased)
19 Uninstalluninstall.md
20 Release notesRELEASE-NOTES-1.5.0.md (draft), RELEASE-NOTES-1.4.1.md, RELEASE-NOTES-1.4.0.md, CHANGELOG.md

Plan §20 also asks that every troubleshooting error shown to a merchant links to its docs anchor. The module's messages do not link to any documentation yet; troubleshooting.md provides stable #symptom-… anchors for that change.

Support: [email protected] · Dashboard: https://app.conviro.io