Webchat QA and Rollout Guide

Objective

Define the minimum quality and operations process before broad webchat rollout.

Quality Gates

1. All webchat API routes pass integration tests.
2. Embed script works on desktop and mobile breakpoints.
3. CORS and domain restrictions are verified.
4. AI fallback behavior is validated under failures.
5. Dashboard setup can generate working snippet.

Test Plan

Unit tests

• token signing and verification
• token expiry behavior
• origin allow/deny logic
• request validation for init/message/config

Integration tests

• init creates/reuses visitor and conversation
• message persists inbound and outbound transcript
• config returns safe-only payload
• guards for invalid token, origin, and conversation

E2E tests

• embed boot sequence
• launcher open/close behavior
• message roundtrip rendering
• mobile viewport behavior

Chaos tests

• AI timeout
• engine unavailable
• CORS misconfiguration
• message storm and rate-limit pressure

Monitoring Dashboard

Admin monitoring is available at /admin/webchat-monitoring and should be reviewed before broadening rollout.

• active sites and sites with live traffic
• sessions, conversations, messages, widget events
• error-event rate and last-activity freshness
• incident counts by blocked-origin, token, rate-limit, rollout
• pilot-tenant summaries and rollout recommendation card

Rollout Sequence

1. Enable behind webchat_enabled feature flag.
2. Internal validation tenants only.
3. Pilot 1 to 2 external tenants.
4. Expand by plan tier when SLO targets are stable.
5. Run post-rollout hardening and update playbook.