Local development stack and tests

For engineers changing the module or the Conviro Magento backend. The authoritative how-to for the Docker stack is undefined (../dev/README.md); this page is the map.

Local Magento stack

integrations/magento2/dev/ — a disposable Docker Compose project (conviro-magento-test):

ServiceVersion
MagentoMage-OS 1.0.6 (= Magento Open Source 2.4.7-p4), developer mode, no sample data, 2FA disabled, Luma
PHP8.3 CLI + Composer 2 (memory_limit=4G)
DatabaseMariaDB 10.6
SearchOpenSearch 2.5.0 (OPENSEARCH_TAG to change)

The module is bind-mounted read-only at app/code/Conviro/AiChat. MSI is enabled. Magento lives in a named volume, never in the git tree.

cd integrations/magento2/dev
./install-magento.sh   # stack + Mage-OS + setup:install (module disabled)
./module-verify.sh     # enable module, setup:upgrade, setup:di:compile, schema checks
./serve.sh             # php -S on :8089  (./serve.sh stop)

tests/mock-conviro.mjs plays Conviro (API and the connect approval page); tests/harness.php runs inside the PHP container for fixtures and direct service calls.

Acceptance scripts

Run with the stack up and serve.sh running. Latest recorded results are from the commit messages (3bb49b22, 2026-09-24).

ScriptCoversLast recorded
module-verify.shfresh install and upgrade, setup:upgrade, setup:di:compile, declared schemaPASS
tests/receive-webhook.shinbound webhook signature, window, tenant, unknown event, replay12/12
tests/oauth-roundtrip.tsbackend OAuth signer accepted by Magento; forged signature and Bearer refused11/11 (15/15 with the MSI endpoints in 90c79bc8/09cfe93b)
tests/outbox-e2e.shConviro down → order placed, events queued; delivered signed and once; disable/delete; 401 held; 400 dead; enqueue p95 < 20 ms15/15
tests/fpc-privacy.shno customer identity in cacheable HTML3/3
tests/commerce-facts.tsstore-view resolution, MSI salability, configurable children, products-render-info price16/16 with fixture assertions off (18/18 with them on in 90c79bc8/fff8da0a)
tests/admin-health.shIntegration Health card through the real admin, timings, actions, diagnostics download32/32
tests/catalog-resync.shcheckpointed catalog re-sync21/21
tests/setup-wizard.shthe seven wizard steps, connect handshake refusals, store selection, held cart toggle, disconnect/reconnect, OAuth migration58/58
tests/sync-jobs.shorder history, customer import, inventory events and re-sync, back-pressure, repair, stop conditions57/57
tests/diagnostics.shbundle contents and redaction19/19

Version matrix (release gates R1 / R2)

integrations/magento2/dev/matrix/run.sh <version> [phases] builds one disposable stack per Magento release (targets/*.env), installs Magento from mirror.mage-os.org, then runs the upgrade path (the released 1.3.5 zip, configured like a live store against the mock, then this code as 1.4.0) and the fresh path (a clean store, this code as 1.4.0), each followed by the dev suite below and a scan of the PHP and Magento logs. hyva adds the open-source Hyvä theme. Results go to dev/matrix/results/<version>/ (git-ignored); usage in the header of undefined (../dev/matrix/run.sh). The machine it runs on is shared: one core for PHP, one script at a time with pauses, real-browser scripts alone.

Results 2026-09-26 (branch feat/magento-matrix), PASS/FAIL counts per script, upgrade path / fresh install:

Script2.4.9, PHP 8.42.4.4-p13, PHP 8.1
install steps (setup:upgrade, setup:di:compile, static deploy, production mode)OK / OKOK / OK
storefront-browser (real browser, Luma)12/0 (developer mode) / 12/0 (production)12/0 / 12/0 (production)
module-verifyOK / OKOK / OK
receive-webhook21/0 / 21/021/0 / 21/0
fpc-privacy7/0 / 7/07/0 / 7/0
outbox-e2e25/0 / 25/025/0 / 25/0
oauth-roundtrip73/0 (+1 note: bearer switch left on by 1.3.5) / 74/073/0 / 74/0
commerce-facts18/0 / 18/018/0 / 18/0
catalog-resync21/0 / 21/0 (19/2 once: cron:run timing, 21/0 on re-run)21/0 / 21/0
diagnostics19/0 / 19/019/0 / 19/0
admin-health33/0 / 33/033/0 / 33/0
setup-wizard58/0 / 58/058/0 / 58/0
sync-jobs57/0 / 57/057/0 / 57/0
attribution (real browser)40/0 / 40/040/0 / 40/0
privacy-deletion10/0 / 10/010/0 / 10/0
retention7/0 / 7/07/0 / 7/0
payment-assist12/0 / 12/012/0 / 12/0
admin-permissions17/0 / 17/017/0 / 17/0
connect-lifecycle27/0 / 27/027/0 / 27/0
widget-identity (real browser)6/0 / 6/06/0 / 6/0

Hyvä on 2.4.9 (default theme 1.5.2, magento2-luma-checkout 1.1.7, no licence needed): storefront-browser 12/0 in production mode (every Hyvä page without RequireJS; checkout is the Luma fallback, CSP enforced there), fpc-privacy 7/0, attribution 40/0 (consent accepted through Hyvä's own cookie banner), widget-identity 6/0. Hyvä Checkout is licensed and was not tested.

No deprecation, notice or warning from 1.4.0 code in any run's logs. Every other script failure on the way was traced and is fixed in the module, the backend, the harness or the docs (commits 6aaa1215 → the matrix branch head).

Package install test (release gate R4, 2026-09-26)

run.sh 2.4.7-p4 (target targets/2.4.7-p4.env, Mage-OS 1.0.6 = Magento 2.4.7-p4 on PHP 8.3) installs the exact zip the registry serves (MODULE_ARTIFACT=conviro-module-aichat-1.4.0-RC1.zip from apps/api/src/assets/composer, its sha1 checked against packages.json) through a local Composer artifact repository — not a worktree snapshot. The platform is copied from the dev stack's volume (nothing downloaded). Results, feat/magento-10-10 at d4502bb9:

Unit tests and static analysis

Backend tests

Jest suites under apps/api/src/modules/magento/__tests__, apps/api/src/modules/ai-actions/__tests__, apps/api/src/modules/commerce-trust/__tests__ and apps/api/src/modules/temporal/commerce. Opt-in real-Postgres specs: magento-commerce-sync.pg.spec.ts (COMMERCE_SYNC_PG_URL) and the AI action store spec (AI_ACTIONS_PG_URL).

Releasing

apps/api/src/modules/magento/COMPOSER-REGISTRY.md, "Cutting a new release": bump composer.json + etc/module.xml and commit → node scripts/build-composer-registry.mjs → commit src/assets/composer/ and deploy the API → check the zip answers 200 → only then bump MagentoService.MODULE_LATEST_VERSION and deploy. The registry script refuses to drop published versions, to rebuild a published version with different bytes, and to ship CRLF. For 1.4.0 the backend (with migrations 0219–0229) must be live before the package is published — see Release notes.