Platform Changelog

New Features

• CRM Bridge (Phase 5) — membership campaigns auto-create CRM leads with 5-stage pipeline (Lead, Contacted, Interested, Application, Member)
• Telegram Channel — 5th outreach channel using existing Telegram Bot API and telegram_chat_id field
• Smart Channel Selection — learns per-org channel preferences from response rates and times
• 85-Test Harness — unit (39), integration (30), post-deploy (15) tests with SendGrid sandbox mode

Improvements

• Battle-Tested E2E Flow — campaign activate → postcommit chatbot notification → AI compose → SendGrid send → touch updated to 'sent'
• Dynamic Portal Form — shows only campaign-requested fields, with sensitive field blocklist
• Staff Approval Workflow — approve/reject AI-parsed data before applying to org records
• Campaign Dashboard — funnel stats, channel breakdown, agent state overview
• N+1 Query Fix — batch-create touches and agent states in single SQL calls
• Shared LangGraph Checkpointer — single PostgresSaver instance for both compose and response graphs

Bug Fixes

• 38 code review fixes — XSS escaping (portal, chatter, CRM), _execute_odoo write args, postcommit transaction timing, SendGrid sandbox toggle, channel list alignment, max_followups naming, portal blocklist for sensitive fields, domain validation constraint
• Touch write-back — fixed touch_id passing from Odoo to chatbot, write() args format, postcommit hook for transaction visibility
• Bot user permissions — chatbot_api user added to Outreach Manager group on both environments

New Features

• Omnichannel Outreach Engine (mcb_outreach) — new addon for autonomous multi-channel outreach campaigns targeting 3,878+ organizations
• LangGraph Agentic Orchestration — persistent per-org agents that plan, compose, send, wait, and evaluate across email, WhatsApp, SMS, voice, and Discuss
• ElevenAgents Voice Integration — batch calling API with real-time WebSocket transcript monitoring and server tool callbacks for mid-call data collection
• Campaign Management — goal-based targeting with domain filters, channel priority, follow-up scheduling, and rate limiting
• AI Response Parsing — automated extraction of structured data from free-text responses via chatbot FastAPI service

Improvements

• Portal Outreach View — Org Reps can view and respond to outreach requests directly at /my/outreach
• Unified Chatter Timeline — all outreach touches (email, WhatsApp, SMS, voice transcripts) logged to organization mail.thread
• API Gateway Outreach Endpoints — 5 REST endpoints with auth scopes for campaign management
• Outreach Tools — 6 BaseMCBTool tools (send_email, send_whatsapp, send_sms, post_to_chatter, update_org_field, get_org_context)

Bug Fixes

• Security hardening — safe_eval replaces eval for domain filters, webhook HMAC verification, XSS input escaping on portal forms, correct portal record rules using claimed_by_partner_id

New Features

• LangGraph Conversational Chatbot — multi-turn AI agent powered by Gemini 3.1 Pro Preview, asks clarifying questions when info is missing
• Image Vision Analysis — upload images (flyers, posters, screenshots) for AI-powered content extraction via Gemini Vision
• URL Content Analysis — share links and the bot extracts and discusses the page content
• CSS Design System Migration — ~100 hardcoded colors replaced with CSS variables across 9 addons, ~80 unnecessary !important removed
• GDPR Compliance Documentation — full DPIA following ICO guidelines + OpenAI DPA requirements checklist

Improvements

• 26 Unified Messaging Tests — full coverage for Telegram audit trail, channel consolidation, email-to-unified-channel integration
• Mizan Compass Brand Migration — fully migrated from Odoo purple to MCB blue palette
• Chatbot Feature Flag — CHATBOT_USE_LANGGRAPH env var for instant rollback to legacy UnifiedAgent
• 14 Chatbot Tools — existing 12 tools wrapped in LangGraph ToolNode + 2 new (URL analyzer, image analyzer)

Bug Fixes

• Gemini 2.5+ multimodal response handling — extract text from list content parts returned by newer Gemini models
• langchain-google-genai 4.0 compatibility — fixed api_key parameter name and removed deprecated convert_system_message_to_human

New Features

• GDPR PII Compliance — consent banner required before AI chatbot processing across all channels (web, SMS, WhatsApp, Telegram)
• User ID Encryption — Fernet encryption of user identifiers before sending to external AI service, no PII leaves Odoo
• Right-to-Erasure — users can delete chat history via /chatbot/delete-history or by sending DELETE keyword on any channel

Improvements

• 90-Day Data Retention — daily cron automatically deletes chatbot messages older than 90 days
• Chatbot Service Security — API key middleware protects /chat endpoints, PII scrubbed from 16 log lines across 7 files
• CSRF Protection — re-enabled on public chatbot endpoint, Odoo token now enforced

Bug Fixes

• Omnichannel consent consistency — SMS, WhatsApp, and Telegram now use identical consent flow and messaging

New Features

• SRE: Sentry Error Tracking — integrated across all 4 services (Odoo, API Gateway, Chatbot, Document Processor) with separate projects per service
• SRE: Telegram Alerting — @mcb_health_bot sends real-time alerts for health check failures, recoveries, Twilio balance warnings, and Sentry error spikes
• New mcb_sre Addon — dedicated SRE module with Telegram alert service, Sentry webhook receiver, and rate-limited alert delivery

Improvements

• Correlation IDs — X-Request-ID header flows from API Gateway through Odoo for cross-service request tracing with Sentry tags
• Health Check Transition Alerts — batched failure notifications and individual recovery alerts when service status changes
• Twilio Balance Alerts — now route to Telegram in addition to Odoo chatter for faster response
• Graceful Shutdown — all FastAPI services flush Sentry events on SIGTERM before Railway container restart
• Sentry Webhook Security — HMAC-SHA256 signature verification on inbound Sentry alert webhooks

Bug Fixes

• Health check NULL status handling — old checks with unset status no longer silently miss first failure transition

New Features

• SendGrid Email Infrastructure — domain-authenticated outbound (noreply@mcbx.app) + Inbound Parse webhook for receiving @mcbx.app emails with routing rules
• Email Routing System — 6 configurable rules (admin forwarding, noreply auto-reply, support, verify/outreach thread matching, catch-all)
• Odoo Mail Integration — SendGrid inbound feeds into mail.thread for chatter replies, discuss channels, and mail aliases
• AskMCB Chatbot — installed and activated on production with /chatbot routes

Improvements

• CI/CD Overhaul — 4 broken workflows rewritten to use actual pytest test suite (smoke, BDD, functional), all green
• Full Platform Audit — 5 parallel agents scanned 18 addons: 147 QWeb templates, 144 models, 60+ security ACLs, 27 CSS files, 17 manifests
• Backend Form View Fix — chatter flex layout squeezed form sheet to zero width at wide viewports, fixed with flex-shrink constraint
• Repository transferred from fielderone to muazamsarfaraz with Railway auto-update

Bug Fixes

• Org Finder services 500 — field name mismatch (service_ids→service_tag_ids) + QWeb .items() sandbox violation
• WhatsApp webhook 403 — wrong Twilio config param key (twilio.auth_token→sms_twilio.auth_token)
• Google Fonts CDN removed from backend assets — external @import broke Odoo form rendering
• Global .o_form_sheet CSS override removed — max-width:1400px conflicted with Odoo flexbox layout
• Stats panel overflow fixed — height:100vh changed to max-height with overflow-y:auto

New Features

• MCB API Gateway — 111 REST endpoints across 16 modules with Swagger docs, MCP server for AI agents, developer portal with self-service registration and webhooks
• WriteToPower Expansion — 22 endpoints including MP voting records, parliamentary questions, NewsAPI integration, postal letter service, bulk email generation, analytics dashboards
• Petition Integration Roadmap — research and design for UK Parliament petition discovery + MCB community petition-to-letter pipeline

Improvements

• Security Hardening — audited all 14 addons, fixed 6 CRITICAL + 10 HIGH issues: raw SQL replaced with ORM, XSS prevention, CV upload validation, rate limiting on public APIs, sensitive field restrictions
• API Gateway Integration Standard — all new addons now MUST expose Swagger-documented API endpoints
• Development Skill Updated — odoo-development skill now covers security rules, API gateway pattern, addon UI templates, Odoo 19 syntax

Bug Fixes

• API key prefix collision — validate against all matching keys not just first
• Odoo False-to-None coercion — all gateway schemas handle Odoo's False and Many2one [id, name] format
• pybreaker call_async bug in Python 3.11 — removed, using direct exception handling
• Railway deployment fixes — Dockerfile system deps, line endings, healthcheck timeout

New Features

• askMCB Full Cleanup — removed dead OrgFinderBot/LangGraph from chatbot-service, renamed addon mcb_vmm_chatbot to mcb_askmcb
• Chatbot Service v2.0 — streamlined to UnifiedAgent-only architecture (-4,400 lines)

Improvements

• Addon Rename — full database migration script for mcb_vmm_chatbot to mcb_askmcb across 7 DB tables
• Documentation — rewrote all integration guides removing VMM/LangChain references
• Cross-Addon Updates — updated mcb_messaging, mcb_status, CI workflows, and 105+ BDD test files

New Features

• askMCB Chatbot Cleanup — removed obsolete bot registry, cleaned chatbot channel views, simplified livechat integration

Improvements

• Livechat Channel — cleaned up deprecated VMM chatbot fields and views
• Chatbot Views — simplified admin interface, removed legacy bot management tabs
• Code Quality — removed unused imports and dead code paths across chatbot modules

New Features

• Universal Search Bar — askMCBx search component integrated into homepage with autocomplete dropdown
• Home Screen Navigation — BFS optimization, mobile horizontal scroll nav, ARIA roles (tablist, tab, aria-current)
• CI Test Coverage — expanded from 6/17 to 17/17 addons in CI matrix with parallel jobs

Improvements

• Mizan v2.95 — tier badge CSS, accordion animations, sticky tier params on breadcrumbs, 13 new unit tests
• Community Dashboard — cleaned stale duplicate templates, version bump to 19.0.1.53
• WriteToPower v3 — NewsAPI keywords now read from DB with 10-min cache, version bump to 19.0.5.0.0
• askMCB Data Quality — verification badges per level, service tag pills on search results
• Robust Template System — migrated 11 _is_public() references across 6 addons to MCBControllerMixin role variables

Improvements

• Vision test pipeline fixed — updated to Gemini 3.1 Pro and Claude Sonnet 4.6, fixed Playwright viewport handling and prompt template escaping
• All 33 visual review tests passing with AI-powered scoring (avg 7.8/10)

Bug Fixes

• Fixed logo cutoff on mobile — responsive header with 36px logo, truncated title, hidden subtitle
• Fixed Sign Up button invisible on mobile — forced dark text on .btn-light inside colored header
• Fixed livechat FAB — MCB purple branding, chat icon fallback, hover tooltip instead of unexplained blue circle
• Fixed text contrast WCAG AA compliance — darkened --mcb-gray-600, --mcb-text-muted, universal search colors

New Features

• askMCB rebrand — chatbot landing page (/chatbot) redesigned as askMCB AI Assistant with violet brand, shared component compliance (hero, stats, process steps, feature cards, CTA), interactive search section with hint chips

Improvements

• Learning Academy course detail page redesigned with green branding — hero gradient, styled sidebar with green accent, green tabs, polished Join button, better breadcrumb contrast, responsive card design

Improvements

• Landing page design system compliance across 5 addons — converted to shared QWeb components (hero, feature cards, stat cards, process steps, CTA)
• Prayer Timetable landing page: added How It Works, Features, and CTA sections with teal color scheme
• Learning Academy landing page: green color scheme with statistics section
• Class Manager landing page: converted category cards and CTA to shared components
• Removed 615 lines of dead CSS across WriteToPower, YourVoice, and Class Manager portals
• Fixed FA5-only icons (fa-quran, fa-book-open, fa-mosque) to FA4 equivalents across all addons

Improvements

• Cleaned up 250 lines of dead CSS from org_finder_portal.css — old custom styles replaced by shared design system components

Bug Fixes

• Fixed invisible category card icons on Org Finder landing page — replaced undefined mcb-icon-circle with shared mcb-feature-icon component
• Fixed category grid layout from 4-column to 3-column to match actual category count
• Removed green heading override that conflicted with blue design theme

New Features

• Criteria browser search — filter 215 criteria instantly by name, code, or description
• Collapsible pillar sections — click to expand/collapse each pillar group for easier navigation

Bug Fixes

• Fixed Silver badge icon not showing (fa-medal is FA5-only, replaced with fa-star for FA4 compatibility)
• Fixed Silver stats text contrast on rankings page (was too light on light background)
• Fixed criteria card descriptions truncating to single line — now shows 3 lines
• Fixed empty state icon on rankings page (fa-chart-bar FA5 replaced with fa-bar-chart FA4)

Improvements

• Full Mizan v2.97 data import — all 215 criteria updated with 33 structured fields via JSON-RPC, 7 stale criteria archived, criteria count corrected from 220 to 215
• Version badge displayed on criteria browser hero section and criterion detail pages showing Mizan framework version (v2.9.7)

Improvements

• Mizan v2.97 Islamic references update — refreshed islamic_references_structured data across 147 of 215 criteria with improved Quranic verse citations, Hadith references, fiqh principles, and Islamic concepts

New Features

• Mizan Excellence Standards v2.95 upgrade with tier-aware progressive disclosure UI
• Import wizard rewrite supporting all 33 JSON fields with upsert by criterion code
• 5-tab criterion detail page (Overview, Requirements, Assessment, Islamic References, Regulatory)
• Tier-based content filtering via URL query params (?tier=basic/good/better/best) for organisation-size-appropriate views
• Super group sub-headers on criteria browser page with tier relevance indicators on cards

Improvements

• New model fields: maqasid_mapping, islamic_verification, change_log, tier_summary, criterion_status
• Expanded module selections (CORE, M1, M7, M8, M9) and outcome types (Excellence, Compliance, Impact, Compliance and Culture)
• Maturity level progression display (Level 1-5) with collapsible sections
• Rich Islamic references rendering with Quran and Hadith source links
• Organisation size applicability table showing partial/full coverage per criterion

Bug Fixes

• Fixed signup/CTA buttons showing white text on white background in addon landing page hero sections — Odoo's s_cover class was overriding button text colors

Bug Fixes

• WriteToPower: fix Postworks status check failing with 400 error — DocumentSubmissionId was being overwritten with UniqueNumberReference (URN) after first status poll, causing all subsequent status queries to fail
• Improved Postworks API error handling to extract detailed error messages instead of raw HTTP exceptions

Improvements

• Removed 10 nested container violations across 6 addons (community dashboard, class manager, people hub, prayer timetable, events, recruitment, org finder) — portal pages now use the parent layout container correctly
• WriteToPower CSS cleanup — replaced remaining hardcoded rgba/hex colors with CSS custom properties and removed unnecessary !important declarations
• Added container nesting convention documentation as ASCII diagram in portal_layout template

Bug Fixes

• Telegram chatbot now renders markdown responses with proper formatting (bold headers, clickable links) instead of raw syntax
• Fixed search impressions tracking error (Organization.write() missing positional argument) in AskMCB chatbot service

Improvements

• WriteToPower CSS refactor — migrated to MCB design system with --wtp-* token pattern (matching YourVoice --yv-* approach)
• Replaced 100+ hardcoded hex values and unprefixed CSS variables with semantic --wtp-* tokens using --mcb-* fallbacks
• Deduplicated Quill editor styles (3 blocks consolidated to 1), removed duplicate keyframes and topic card definitions
• Added :focus-visible outlines and prefers-reduced-motion support to compose wizard interactive elements
• Fixed var(--primary) typos and wrong MCB green (#1a5632) references in WTP context

New Features

• AskMCB data quality layer — URL validation with blocklist and domain plausibility checking on organisation save
• Verification-aware search ranking — verified organisations shown first with badges in search results
• Structured JSON responses from AskMCB with verified/unverified result grouping and disclaimers
• Search impression tracking — counts how often each organisation appears in AskMCB results
• Automated nudge emails — weekly cron sends "people are searching for you" to unverified orgs with high search impressions
• Staff URL Review Queue — new backend view to review and correct flagged website URLs
• One-time URL migration sweep validates all existing organisation URLs on first deploy

Bug Fixes

• WriteToPower: fix plain text extraction, tracking error, send button resilience

Improvements

• YourVoice UI/UX overhaul — replaced 50+ hardcoded colors with CSS variables, added focus indicators and prefers-reduced-motion support
• Collapsible sidebars on mobile for idea list and my ideas pages
• Multi-breakpoint responsive design (992px, 768px, 576px) with fluid typography and 44px touch targets
• Portal header now uses teal brand color instead of default blue
• Fixed portal header container width not spanning full desktop width

Improvements

• WriteToPower campaign mode — new "Your Details" step collects name, email, address before generating campaign letter
• Auto-fill postcode from MP search and address from geocoder
• Campaign letter placeholders now correctly substitute user name and address
• POSTWORKS sender details pre-filled from Your Details step

Improvements

• WriteToPower landing page — moved "Not sure where to start?" and "Know who to write to?" entry point cards above the topic grid for better discoverability

Improvements

• Consolidated mcb_community_assets and mcb_community_social into mcb_community_dashboard as stats panel sections
• Assets now display as categorised list in stats panel instead of map markers (cleaner map experience)
• Single addon install for all Community Dashboard features (no separate addon dependencies)
• Removed Mapbox marker code from asset discovery (stats panel only rendering)

New Features

• Community Dashboard Social Upgrade — Two new addons extending the Community Dashboard:
• MCB Community Assets — Google Places API integration for mapping local mosques, halal restaurants, Islamic schools, community centres and general amenities per LSOA
• Muslim Fulfilment Score — Weighted walkability scoring (0-100) based on proximity to mosques (30%), halal food (25%), community centres (20%), Islamic schools (15%), and general amenities (10%)
• MCB Community Social — Bookmarks, threaded comments with likes, social sharing (WhatsApp, Twitter, Facebook, email, copy link), and branded PDF area reports
• Shared Area View — Public shareable snapshots of LSOA statistics with full server-side rendered demographics, employment, health, crime, deprivation, housing, and walkability data
• Insights Page Asset Discovery — "Discover Local Assets" button on insights page triggers Google Places API and displays walkability score with nearby assets inline

Improvements

• 11 asset categories seeded (6 Muslim-specific, 5 general) with Google Places type mappings
• Lazy-loading strategy for Google Places — assets fetched on-demand per LSOA to optimise API costs
• Haversine distance calculation for nearest-asset metrics
• 90-day expiring share tokens with view count tracking
• QWeb PDF reports with MCB branding and full data source attributions

New Features

• Postworks delivery status tracking — 30-minute cron job polls Postworks API for letter status updates (submitted → processing → dispatched → delivered)
• Manual "Refresh Status" button on postal letter admin form for on-demand status checks
• Chatter messages posted automatically when letter status changes

Bug Fixes

• Fix PDF letter text clipping — subject line was cut off due to double CSS + wkhtmltopdf margins
• Fix PDF letter body rendering as wall of text — now formats content with proper paragraph breaks

Improvements

• WriteToPower v3 — Production UX fixes
• Direct CSS and JS loading to bypass stale Odoo asset bundle cache
• Inline critical CSS for topic grid layout (display:grid, responsive breakpoints)
• Init guard to prevent double-initialization from bundle + direct script
• Asset bundle clear in Railway start script for future deploys

Bug Fixes

• Fix topic grid not displaying as grid on production (stale asset bundle)
• Fix compose page topic cards not populating (JS bundle missing populateComposeTopicGrid)
• Fix ?topic_code= and ?direct=1 query params not working (stale JS)
• Fix regulator selection not advancing to Step 2 (Charity Commission click)
• Fix AI suggest and free-text concern link functionality

New Features

• WriteToPower v3 - Topic-First UX Redesign
• Topic-First Landing Page — Choose from 13 curated civic topics (Healthcare, Education, Islamophobia, Foreign Affairs, etc.) instead of starting with a recipient
• AI Topic Suggest — Describe your concern in free text and AI recommends the best topic and recipient type
• Recommended Recipients — Each topic suggests the most effective recipient types (MP, minister, regulator, journalist, etc.)
• Government Ministers Database — 8 key UK government ministers with contact details
• Media Outlets Database — 8 major UK media outlets (BBC, ITV, Guardian, etc.)
• Think Tanks Database — 6 UK think tanks and policy organisations
• "Also Write To" Panel — After sending, suggests writing to another recipient type about the same issue

Improvements

• Complete 4-step compose wizard: Topic → Recipient → Message → Review & Send
• Context bar showing selected topic and recipient as persistent chips
• Journalist search by beat/topic
• Local council postcode lookup
• MP writing prompts from Parliament API (voting record + questions filtered by topic)
• Dynamic topic system managed via admin panel
• Topics include NewsAPI keywords for relevant article discovery

Improvements

• Rate limiting on public search endpoint (5s per IP) using same pattern as WriteToPower and Recruitment
• Input validation on search queries (3-500 characters, whitespace stripped)
• ARIA combobox accessibility attributes for screen reader support on universal search bar (role, aria-expanded, aria-owns, aria-activedescendant)
• Chatbot tool _execute_odoo calls standardised to keyword arguments across BlogSearch, YourVoice, and WebsitePage tools

Bug Fixes

• Fix askMCBx Bot livechat view xpath targeting non-existent 'operators' page in Odoo 19 (changed to 'options')
• Production recovery - added missing DB columns for mcb_vmm_chatbot module (use_vmm_bot, vmm_bot_mode, vmm_bot_welcome_message)

Security

• XSS prevention in universal search bar -- all LLM-sourced content now escaped via escapeHtml() before DOM insertion
• Rate limiting prevents abuse of public AI search endpoint (LLM API credit protection)
• Input length validation prevents oversized payloads to search endpoint

New Features

• WriteToPower v2 - Unified Advocacy Platform
• Write to MPs, regulators, government ministers, journalists, media outlets, think tanks, and councils from one compose wizard
• NewsAPI integration - relevant article suggestions to strengthen letters
• Step 0 recipient type selector with 7 recipient categories
• AI prompt adaptation per recipient type (formal complaints for regulators, story pitches for journalists, etc.)
• UK regulator seed data (Ofcom, EHRC, IPSO, ICO, FCA, CMA, Charity Commission, IOPC)
• Postworks postal enabled for MPs, ministers, and councils
• Non-PII telemetry tracking with anonymous session IDs and optional user linking
• Message queuing with automatic retry (exponential backoff) for failed sends
• Admin analytics dashboard (pivot, graph, list views) under WriteToPower menu
• Privacy notice on compose page explaining data collection policy

Improvements

• Updated landing page to reflect unified advocacy platform capabilities
• Compose wizard now starts with recipient type selection (Step 0)
• AI-generated letters tailored to each recipient type
• Send options adapt per recipient type (email, postal, complaint form link)
• Queue processes every 5 minutes via cron with completion email notifications

Bug Fixes

• Fixed search dropdown clipping inside overflow-hidden hero section - portal pattern moves dropdown to document.body with fixed positioning and dynamic repositioning on scroll/resize

New Features

• integrate askMCBx bot with im_livechat widget
• unified capabilities menu via explore_options
• integrate Project Ad'l legal guidance into askMCB chatbot (#214)
• Telegram integration for askMCB chatbot
• rename Universal Search Bar to askMCBx
• universal search bar v1.65 - complete implementation
• register universal search JS and CSS in assets
• add /chatbot/api/search proxy endpoint for universal search
• add YourVoiceSearchTool for universal search
• make UnifiedAgent provider-agnostic with LLM_API_KEY, LLM_BASE_URL, LLM_MODEL

Bug Fixes

• search dropdown clipping AI text responses
• search rate limiting - per-session keys, 2s limit, auto-retry
• instruct LLM to present explore_options results in full, not summarised
• force Ad'l tool usage for legal queries via keyword detection
• stronger system prompt to force Ad'l tool usage for legal queries
• force LLM to use Ad'l tool for legal questions instead of own knowledge
• list_course_categories now shows courses when no tags exist
• force chatbot service rebuild with course search fix
• chatbot course search - handle generic queries and use website_published
• address 7 code review findings (3 critical, 4 important)
• search dropdown clipping inside overflow-hidden hero section
• send numeric user_id to chatbot service (was string, caused 422)
• remove BOM and non-ASCII chars from JS/CSS comments
• replace non-UTF-8 em dash in chatbot.py docstring
• predeploy logging to DATABASE for module upgrade diagnostics
• add persistent logging to predeploy module upgrade
• footer copyright JS - use readyState check pattern for reliable execution (v1.61)
• complete footer overhaul with MCB branding (v1.60)
• footer copyright - JS fallback + post-upgrade COW cleanup (v1.59)

Documentation

• update activeContext and progress for v1.67 production deployment
• update Memory Bank for v1.66 production deployment
• update Memory Bank for v1.65 production deployment
• add universal search bar implementation plan (13 tasks)
• add universal search bar design document