# 02 - M1.10 Revision Sheet & Interview Q&A

Short revision summary for **Milestone 1.10**.

---

## 1. Quick Summary

- **Goal:** Perform full Milestone 1 exit audit across all steps (M1.1–M1.9).
- **Test Results:** 13 unit tests passed in pytest (100% green), 8 E2E verification steps passed against live backend server.
- **Milestone 1 Exit Check:** Widget loads on test page, creates/restores session, opens/closes panel, and exchanges echo messages with backend.

---

## 2. 5 Key Interview Q&As

#### Q1: What is the exit criteria for Milestone 1?
**Answer:** The widget loads on a host page, extracts `siteId`, creates/restores a session in `localStorage`, opens/closes, and exchanges a typed message with the backend returning an echo response.

#### Q2: Why is multi-tenancy isolation important starting from Milestone 1?
**Answer:** Multi-tenancy isolation via `siteId` guarantees that all database queries, session records, and storage keys belong strictly to a single tenant account, preventing cross-tenant data leaks.

#### Q3: How does the system validate browser origin security during session creation?
**Answer:** The backend extracts the immutable HTTP `Origin` header from the browser request and validates it against the tenant's registered `domain` using an origin validator helper.

#### Q4: Why is Vanilla JS + Shadow DOM used instead of React or Vue for the client widget?
**Answer:** Vanilla JS produces a ultra-lightweight bundle without framework overhead (~11.9kb), and Shadow DOM guarantees host website CSS styles cannot distort widget elements.

#### Q5: What is deferred to later milestones?
**Answer:** Real-time presence tracking and agent dashboard (Milestone 2), human handoff (Milestone 3), and Rule Engine/AI/RAG (Milestone 4).