Release notes — Conviro AI Chat for Magento 1.5.0 (draft)

Status: release candidate 1.5.0-RC1 (pilot) — 1.5.0 is not released. The candidate is installed only by exact version (composer require conviro/module-aichat:1.5.0-RC1); stores that require a range keep 1.4.x. The date of the stable release and its registry entry are added when the owner publishes it. 1.5.0 builds on 1.4.1 (released 2026-09-27, Release notes 1.4.1); a store on 1.4.0 can go straight to 1.5.0.

In one sentence

A shopper who is signed in to your store and verified by it sees their own orders in the chat — without typing an order number or e-mail — and nobody else ever can; everything is off until you and Conviro switch it on. How it works.

Upgrade

Nothing changes for your shoppers on upgrade: every new feature is off (Upgrade 1.4 → 1.5). Production mode, as the owner of the Magento files (never root):

bin/magento maintenance:enable
composer require 'conviro/module-aichat:^1.5.0'
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento setup:static-content:deploy -f en_US <your store locales>
bin/magento cache:flush
bin/magento maintenance:disable

The command is illustrative until the version is published; the admin's "update available" notice shows the one built for your store. PHP's sodium extension is required (ext-sodium; Composer refuses the install without it). New constructor arguments: in production mode the compile and the static deploy are required.

What changes for you

Area1.5.0
Signed customer identity (beta)New setting group Signed Customer Identity (beta), per website, off by default. When on (and switched on by Conviro), a signed-in shopper's widget gets a 60-second Ed25519 signature from your store — customer id and store view, no name or e-mail — through a same-origin, never-cached request, only after the shopper opens the chat. Security model
My ordersShow verified shoppers their own orders (per website, off by default): order list, detail and tracking numbers in the chat for a verified shopper — this store view by default, the website optionally, never another website; only statuses your storefront shows; no address, e-mail, phone, payment or item prices. Errors are shown as errors, never as "no orders".
Shopper experienceOrder cards with Track, Show more, All orders, Ask about this order (hands the chat to your team with that order, masked), a Sign in button with your store view's login page, 29 widget languages (machine-translated, native review pending).
AdminCustomer Experience & Identity card (Stores › Settings › Conviro Setup and the settings group): key state, key age and 180-day rotation advice, features, store views, Conviro's view, server clock; Test identity bridge (synthetic — no customer, nothing created); Repair access for Order listing permission missing (Sipariş listeleme izni eksik). One summary line on Integration Health. Integration Health
Key managementRotate identity key on the card or bin/magento conviro:identity:rotate-key; the previous key keeps working for 5 minutes. The identity key is separate from the webhook secrets and the API key.
Sign-out and account switchRevoked in the browser at once, in the store by observers (logout, customer deletion, password change / reset) and at Conviro through the new event identity.bindings_revoked (Event reference).
Operations (Phase 5)A First blocker line at the top of the card names the first failing gate, its fix and the matching row of the 30-second runbook; Reset identity (an advanced security action: Conviro_AiChat::identity_reset and ::setup; an impact page and a typed, single-use confirmation first; idempotent per request id and safe under network failure — the old key is deleted only after Conviro confirmed, nothing signs while the outcome is unclear; audited in conviro_identity_reset_audit) revokes every identity key, verified session and open verification of this store's integration only and registers a new key — needs Conviro's reset route (in the Conviro backend that ships with 1.5.0; an older backend changes nothing); the server's clock against Conviro's is read from Conviro's Date header and reported in module-health; the diagnostics bundle gains an identity section (states and counts, never the key); a deleted customer's binding rows are deleted at once. The reset route was tested end to end against the real Conviro API and database; the module side by unit tests.
Guest one-time codeAsk guests for a one-time code before showing an order (per store, off by default; Conviro's magento_guest_otp must be on too): a guest asking about an order first gets a 6-digit code by e-mail; nothing about the order is shown before the code, and nothing says whether the order exists. Needs a mail transport for the workspace. Unit-tested at Conviro; not run end to end with real e-mail delivery.
Order-action requests by verified shoppersCancel / return requests by a verified shopper for their own order (off by default: the store's order-actions switch and Conviro's magento_verified_actions). A staff member approves every request before anything changes in Magento. 1.5.0 adds no Magento write route and no write permission. Unit-tested at Conviro; not run end to end.

Conviro side (deployed separately, before or with 1.5.0)

Permissions and routes

Defaults (decided 2026-09-28)

Default
How long a verification lasts15 minutes, absolute; re-verified silently while the shopper is signed in
When the store is asked to signwhen the shopper opens the chat — never on page load
Which orders a verified shopper sees by defaultthis store view only (website as an option)
Two Conviro workspaces connected to one store URLthe identity key is refused (fail closed)
Key rotation adviceafter 180 days
Retentionhandoff context 30 days, daily counts 400 days, guest code ledger 30 days, identity verifications 7 days after expiry
Guest one-time codeoff; each store switches it on for itself

Not tested / known limits