[ripgrim]

Summary

Bring the CRM onto Neo’s design system and replace dashboard charts with EvilCharts.

• Match Neo’s shell, sidebar shader, workspace and account menus, command search, tables, settings, forms, and chat surfaces.
• Keep one shared workspace and preserve the classic login experience.
• Add responsive record sheets with queue navigation, interruptible motion, and focus restoration.

Before: 711c909 (main). After: 0a0cf9b (this PR). Both production builds use the same local seeded data.

Desktop: 1440 × 900. Phone: 390 × 844.

Before (Desktop overview, light)	After (Desktop overview, light)

Before (Desktop overview, dark)	After (Desktop overview, dark)

Before (Deals list)	After (Deals list)

Before (Record sheet)	After (Record sheet)

Before (Phone overview, light)	After (Phone overview, light)

Before (Phone overview, dark)	After (Phone overview, dark)

Workflow videos

Both MP4 recordings use 1440 × 900 at 60 fps.
The before recording lasts 8.3 seconds. The after recording lasts 10.1 seconds.
The after recording also shows the new record navigation arrows.

Before (Desktop workflow)	After (Desktop workflow)
workflow-before.mp4	workflow-after.mp4

Problem

CRM screens use inconsistent spacing, controls, icons, loading states, and metadata separators.
Record sheets need reliable navigation and motion.
Charts need exact reporting-currency values and keyboard access.

UX Flow

Open the CRM
└─ Navigate through the Neo shell, command menu, or top-right chat entry
   └─ Open a record from the current list
      └─ Cycle through records, follow related records, then close back to the list

Solution

Keep CRM’s Radix contracts and centralize Neo tokens, components, motion, icons, and responsive patterns in packages/ui.
Use skeletons for page loads and guards for unsaved creation forms and uncopied API keys.
Remove decorative bullet separators and em dashes from interface copy.

Use EvilCharts’ ECharts canvas provider for dashboard charts.
Keep exact money formatting, hidden data tables, keyboard tooltips, atomic announcements, reduced motion, and forced-colors focus.
Record totals exclude stale reporting-currency conversions and archived pipeline records.

Dependency remediation updates Better Auth and its plugins together to 1.7.7.
It patches the parser, upload, URI, query, HTTP-client, and validation dependencies without suppressing advisories.
Slack linking uses the current social API and retains the registered callback URL through a guarded redirect.
Mailbox refresh selects the local account row ID. Regression tests cover both contracts.
The frozen lockfile audit reports zero vulnerabilities.

Validation

• Clean-checkout type checks, lint, and anti-slop lint pass.
• Production app build passes.
• App tests: 253 pass. UI test entry points: 12 pass.
• API tests: 432 pass. Auth tests: 68 pass. All monorepo package suites pass.
• Agent tests: 403 pass. The earlier task-retirement failure does not reproduce in the current full runs.
• Browser reviews cover desktop and phone layouts, light and dark themes, sheet motion, keyboard controls, and emulated forced colors.

The initial design push uses the documented WIP exception. The dependency-fix push runs all normal hooks.
Unrelated local .tripwire/ and tripwire.ts files stay outside this commit.

Issues

1. RISK — Audit findings are patched. The security update changes Microsoft account identifiers.
   Fix: follow the verified Microsoft identifier migration in docs/setup.md before deployment.

2. RISK — The earlier task-retirement limit failure does not reproduce in the current full runs.
   Fix: not changed. Keep the existing regression test for database-plan-dependent failures.

3. RISK — Lint reports six existing barrel-export warnings in unchanged database and telemetry modules.
   Fix: not done. Lint exits successfully.

4. UNKNOWN — Native VoiceOver speech remains unverified.
   Fix: run a manual speech check on a host that keeps VoiceOver active.

5. UNKNOWN — Native Windows High Contrast and speech remain unverified.
   Fix: run a manual check on Windows. Chromium forced-colors emulation passes.

6. BROKEN — The automatic PR workflow lacks GitHub permission to create pull requests.
   Fix: this draft uses the authenticated CLI and the repository-generated title. Repository automation still needs permission.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
crm-agent	Ready	Preview	Oct 27, 2026 11:33pm UTC
crm-api	Ready	Preview	Oct 27, 2026 11:33pm UTC
crm-app	Ready	Preview	Oct 27, 2026 11:33pm UTC