docs: qualify RD21 remediation and retain provider gates
This commit is contained in:
cesnimda
@@ -0,0 +1,42 @@
|
||||
# RD21 early frontend review
|
||||
|
||||
Read-only source review against the Phase 9 frontend at `8e7e3f6387544e24082ebe2c107c0b868897959e`. Product changes are owned by other agents. No tests, servers, network calls or product edits were performed by this reviewer. This report records source findings, not runtime qualification.
|
||||
|
||||
## Actionable findings
|
||||
|
||||
1. **High — Generic job edit can acknowledge one snapshot and discard later typing.** `job-tracker-ui/src/components/EditJobDialog.tsx:147` submits the full form, but fields at 196–237 and Cancel at 255 remain active while the request is pending. Success at 172–174 closes the dialog regardless of edits made after submission. `save` at 143 has no synchronous pending ref. Retain the original job version, send `expectedVersion`, prevent duplicate submissions, and either freeze fields/close during save or explicitly preserve newer edits. A failure/conflict must keep the dialog draft and show a persistent recoverable error rather than automatically adopting a newer version.
|
||||
|
||||
2. **High — Job loading lacks a request identity guard.** `EditJobDialog.tsx:105–139` neither cancels nor rejects an earlier GET when `jobId`/open changes. A delayed response for A can seed the form after B is selected; subsequent PUT uses the current `jobId`. Keep a generation/job identity check on reads and save completion, clear prior loaded identity while loading, and never enable saving a form whose snapshot belongs to another job. `finally` must also belong to the current request.
|
||||
|
||||
3. **High — Keep each expected version paired with the draft it qualifies.** `ApplicationAssets.tsx:525–528` deliberately retains a cover-letter draft while `useAsset.reload` replaces `data` at 63. `ApplicationPackageDraftsSection` similarly retains draft across parent refresh at 855–859. When adding concurrency fields, do not simply attach the newest `data.revision`/prop version to an older draft: that would authorize the stale content after a reload. Retain the base version with the first edited snapshot; advance it on successful acknowledgement or explicit discard/reload/review. A conflict must not trigger automatic stale-content resubmission.
|
||||
|
||||
4. **Required contract wiring — Career has local serialization but no cross-session token.** `CareerProfilePage.tsx:149` lacks revision in its response type, `loadProfile` at 337–345 does not retain one, PUT at 999 submits the whole structured profile plus raw text, restore at 234 supplies no current version, accept at 414 submits only low-confidence choices, and parse at 906 submits only text. Add response `revision` and request `expectedVersion` to each canonical writer. The reviewed import diff must retain the revision of the comparison the person approved, not silently substitute a subsequently refreshed version. Existing `profileMutationPending` (177, 229, 405, 902, 991) and `editorDisabled` (456) already serialize/block editor mutations locally. Save/restore/review catches retain the draft or choices; preserve this behavior. Success toast is after the mutation promise (1005/240/421), not before persistence acknowledgement.
|
||||
|
||||
## Production caller census
|
||||
|
||||
| Write surface | API owner | Production caller / entry point |
|
||||
|---|---|---|
|
||||
| Generic job PUT | `EditJobDialog.tsx:147` | Shared dialog mounted in `JobTable.tsx:904` and `ApplicationWorkspacePage.tsx:292–296`; workspace header, overview and notes edit actions all open it. No production `updateJob` wrapper was found. |
|
||||
| Career PUT | `CareerProfilePage.tsx:999` | Explicit Save of canonical fields and raw CV text. Extracted `career/CareerProfileSections.tsx` sections only update parent state. |
|
||||
| Career restore | `CareerProfilePage.tsx:234` | History restore; dirty editor blocks it at 229. |
|
||||
| Import accept | `CareerProfilePage.tsx:414` | Reviewed extraction diff and accepted low-confidence IDs. Dirty editor blocks accept at 405/874. Discard at 415 does not write canonical content. |
|
||||
| Legacy canonical parse | `CareerProfilePage.tsx:906` | Advanced raw-text parse; must use current canonical version and consume returned revision. It also calls `editStructuredCv` and marks the editor dirty at 907. |
|
||||
| Extraction queue | `CareerProfilePage.tsx:321,709,727,745` | Upload/rebuild/improve/reprocess enqueue extraction; the explicit accept action is the canonical approval boundary. Do not present queued completion as profile-save acknowledgement. |
|
||||
| Cover-letter save | `applicationWorkspace.ts:298–299` | `ApplicationAssets.tsx:541`, manual/template/accepted AI text through the shared save function. Retain `CoverLetter.revision`; send it as `expectedVersion`. |
|
||||
| Cover-letter restore | `applicationWorkspace.ts:300–301` | `ApplicationAssets.tsx:571`; existing dirty-discard confirmation at 559–566 and busy guard remain. |
|
||||
| Answer/recruiter drafts | `applicationWorkspace.ts:310–311` | `ApplicationAssets.tsx:879`; only mounted by `ApplicationWorkspacePage.tsx:264–270`. Parent overview must expose the job version and pass it with the initial content; consume acknowledged `X-Job-Version` for a subsequent save. |
|
||||
|
||||
`types.ts:83` (`JobApplication`) and the overview/CoverLetter types in `applicationWorkspace.ts` must expose the backend token. Preserve existing request wrappers' real completion semantics; no success-on-rejection conversion. `ApplicationAssets.tsx:535–551,555–583,873–890` already has synchronous busy refs, disabled fields and catch paths retaining drafts. Its workspace route uses `key={jobId}` at `ApplicationWorkspacePage.tsx:263,265`, so those mutations are remounted on job change; do not expand a generic shared-hook redesign based only on its boolean `isCurrent` helper.
|
||||
|
||||
## Related versus separate boundaries
|
||||
|
||||
- **Directly related and now runtime-proven by root:** generic job PUT, cover-letter save/restore, answer/recruiter draft replacement all replace user-owned job snapshot fields. One job-version contract must reach all these callers; generic job PUT includes both `notes` (162) and `coverLetterText` (168), so separate editors cannot be treated as independent aggregates without proof.
|
||||
- **Career compatibility:** legacy `PUT /auth/profile` still accepts `ProfileCvText` and `ProfileCvStructureJson` (`AuthController.cs:535–536`). Current production `ProfilePage.tsx:320` deliberately submits identity fields only. Root/backend review must classify the legacy blob projection path and preserve that identity-only partial-update behavior; this source inspection alone does not prove it overwrites an existing relational canonical aggregate.
|
||||
- **Dashboard has an established separate revision contract:** `useDashboardLayout.ts:105` sends revision, 108 only applies acknowledged state when request/owner generation is current, 112–113 keeps draft on conflict, and 95 blocks retry of an unresolved conflict. It is a useful existing pattern, not evidence that RD21 affects Dashboard.
|
||||
- **CV Builder has its own established version contract:** `cvBuilder.ts:278,284,286`; `CvBuilderEditor.tsx:187–205` serializes saves, advances acknowledged version and stops on conflict; current local drafts can be exported at 344. Preserve canonical-versus-CV override and submitted/frozen boundaries. Do not flatten these into the job/Career token.
|
||||
- **Settings rules are separate:** `SettingsView.tsx:125–147` waits for PUT, retains failed/newer in-flight edits (140–141), and uses a synchronous saving flag. No RD21 cross-session runtime result was established here; record separately rather than broadening this remediation without proof.
|
||||
- **Documents/timeline:** submitted-package reads/capture in `applicationWorkspace.ts:302–309` are a separate frozen snapshot boundary. Timeline/checklist/interview mutations are item-scoped/additive APIs, not this generic PUT caller. This review does not assert universal concurrency safety for them.
|
||||
|
||||
## Regression obligations for the frontend owner
|
||||
|
||||
Cover missing/stale expectedVersion without success acknowledgement, retained editable conflict draft/choices, a delayed old-job GET, pending generic-save typing/close behavior, consecutive saves using the acknowledged token, parent refresh while a draft is dirty, and successful navigation/readback after acknowledgement. Preserve existing serialization, tenant/session interceptors (`api.ts:55–106`), canonical/CV override boundaries and frozen exports. Root owns persisted-state/backend and full regression qualification.
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,49 @@
|
||||
# RD21 final-review fix wave
|
||||
|
||||
Scope: exactly the two findings in final-review.md. Product changes are Program.cs and ApplicationWorkspacePage.tsx; existing ApplicationAssets dirty-draft/revision ownership stays intact. No commits or pushes by this worker. Coordinator documentation changes were preserved.
|
||||
|
||||
## Fixes
|
||||
|
||||
1. Existing AllowReact CORS policy exposes X-Job-Version. Origins, credentials, CSRF and client fail-closed revision validation are unchanged.
|
||||
2. Each Answers entry has an identity tied to its job/entry lifetime. The existing aggregate overview loader accepts source fields and revision together, and Answers mounts only after that entry's successful read. Failed reads retain the existing Retry behavior. Late prior-entry/job requests cannot enable the editor. Existing post-save refresh keeps the same editor identity, so the dirty draft guard remains effective. Other workspace tab switches do not all trigger reads; leaving a loaded Answers section skips an unnecessary read, while leaving an unfinished initial read still loads the header.
|
||||
|
||||
## RED evidence
|
||||
|
||||
- `final-fix-jest-red.log`: 2 failed, 19 skipped. Both new entry tests found stale `42|Saved answer|Saved recruiter message|7` props before a fresh read, including a late-entry race.
|
||||
- `final-fix-browser-red.log`: 2 failed against the unchanged API and pre-fix static export. Actual cross-origin browser JavaScript observed a 204 but a null X-Job-Version while independent SQLite already held Version 2 and the exact answer marker. The cover-save→Answers case exposed the editable answer textbox while the fresh read was held.
|
||||
- Preliminary browser harness attempts were not behavioral evidence: one had incorrect environment quoting/default dotnet SDK selection; another used the wrong database column for answers and timed out waiting for the missing read. Corrected assertions use the established Notes answer marker and the final RED log above contains the intended failures.
|
||||
|
||||
## Commands and GREEN results
|
||||
|
||||
All terminal invocations were prefixed by `rtk`; PowerShell built-ins ran through `rtk proxy powershell -NoProfile -Command`. Paths below are relative to the repository, except the pinned SDK. UI commands ran in job-tracker-ui.
|
||||
|
||||
```powershell
|
||||
# RED Jest
|
||||
npm test -- --runInBand application-workspace-overlay.test.tsx --testNamePattern='entering Answers|late previous Answers-entry'
|
||||
# GREEN Jest
|
||||
npm test -- --runInBand application-workspace-overlay.test.tsx application-assets.test.tsx
|
||||
# API build
|
||||
& C:/Users/Connor/.dotnet/dotnet.exe build JobTrackerApi/JobTrackerApi.csproj --configuration Release --no-restore
|
||||
# Frontend build
|
||||
$env:NEXT_PUBLIC_API_BASE_URL='http://localhost:5302/api'
|
||||
npm run build
|
||||
# Focused lint
|
||||
npx eslint src/views/ApplicationWorkspacePage.tsx src/application-workspace-overlay.test.tsx --max-warnings=0
|
||||
# Browser RED and GREEN (GREEN additionally emitted JSON and retained proof attachments)
|
||||
$env:PLAYWRIGHT_STATIC_EXPORT='true'
|
||||
$env:PLAYWRIGHT_PREBUILT_EXPORT='true'
|
||||
$env:DOTNET_ROOT='C:/Users/Connor/.dotnet'
|
||||
$env:DOTNET_HOST_PATH='C:/Users/Connor/.dotnet/dotnet.exe'
|
||||
npx playwright test --config=../docs/redesign/phase-9/rd21-remediation/diagnostics/playwright.config.ts persistence.spec.ts --grep 'cross-origin browser|cover-letter save then' --reporter=list,json --output=../.superpowers/sdd/PLAN/final-fix-browser-results
|
||||
```
|
||||
|
||||
- Focused Jest: **55 passed, 2 suites**, final-fix-jest-green.log. Includes four new entry/failed-read/race/navigation tests and existing dirty parent-refresh regression. These are an overlapping subset of the coordinator's eventual broad suite, never additive to it.
|
||||
- API Release build: **pass, 0 warnings/errors**, final-fix-api-build.log.
|
||||
- UI static build including TypeScript: **pass**, final-fix-ui-build.log. Rebuilt after final source edits.
|
||||
- Focused ESLint: **pass, zero warnings**, final-fix-lint.log. An initial unnecessary-dependency warning was fixed by making the entry identity contain its job/active values.
|
||||
- Browser: **2 passed**, final-fix-browser-green.log/json. Actual JS fetch sees the committed revision; two native consecutive Answers saves acknowledge success and advance revisions with independently read SQLite answer markers. Native cover-letter save advances the shared job revision; subsequent held Answers-entry read exposes no answer textbox; released snapshot allows native answer save using the cover-letter revision and preserves both persisted fields. Attachments contain revision observations and SQLite rows.
|
||||
- `rtk git diff --check`: pass.
|
||||
|
||||
The controlled browser servers use isolated synthetic SQLite data and localhost ports 3300/5302. Existing isolated migration/DataProtection and NO_COLOR/FORCE_COLOR startup warnings remain in logs. No external service calls, production operations or real user data were used.
|
||||
|
||||
Broad frontend/backend/browser lanes, MariaDB/provider/deployed/manual qualifications remain with the coordinator. This report is focused regression evidence, not production acceptance.
|
||||
Binary file not shown.
@@ -0,0 +1,21 @@
|
||||
# RD21 scoped final re-review
|
||||
|
||||
Scope: one re-review of `05a7386..1b89a77`, using the supplied exact diff, final-review.md, final-fix-report.md, connected workspace/draft source, and focused execution log summaries. No new full-branch audit or test execution was performed.
|
||||
|
||||
## Finding verdicts
|
||||
|
||||
1. **Committed revision header hidden by CORS: ADDRESSED.** `JobTrackerApi/Program.cs:151` explicitly exposes `X-Job-Version` through the existing allowlisted, credentialed policy. The client still rejects missing/invalid committed revisions. The new browser test reads the header using actual page JavaScript and performs two consecutive native Answers saves with direct SQLite assertions, covering the original browser-specific failure rather than only APIRequestContext headers.
|
||||
|
||||
2. **Answers initialized from stale sibling-write snapshot: ADDRESSED.** `job-tracker-ui/src/views/ApplicationWorkspacePage.tsx:81-83,142-146,157-165,277` gives each Answers entry a new identity and mounts its editor only after a matching successful overview read. Text fields and revision are accepted together. Request invalidation excludes late prior-entry/job results. Failed initial reads stay closed until retry succeeds. Leaving Answers avoids a redundant read when a workspace snapshot has already been accepted; leaving an unfinished direct-entry read still obtains the header. Existing post-save refresh retains the editor identity, and the unchanged `ApplicationAssets.tsx:858-862` dirty-draft guard keeps a draft paired with its original revision when parent props refresh.
|
||||
|
||||
## New material breakage
|
||||
|
||||
None identified in this fix diff. No additional fixes requested by this scoped re-review.
|
||||
|
||||
## Evidence and assessment
|
||||
|
||||
Read log summaries confirm focused Jest **55 passed across 2 suites** and focused browser **2 passed**. The added tests cover delayed prior-entry responses, failed read/retry, leaving an unfinished initial entry, cross-origin header access, consecutive native saves, and cover-letter-to-Answers persistence. These are inspected execution artifacts, not independently rerun tests; the focused results overlap broader suites and must not be added to their totals. API/UI build and lint passes are reported in final-fix-report.md; this review did not independently execute them.
|
||||
|
||||
Both code-review findings are closed at `1b89a77`. Broader backend/frontend/browser qualification remains coordinator-owned. Required MariaDB runtime qualification remains unavailable: **formal RD21 closure remains UNRESOLVED** under the unchanged acceptance criteria, even where SQLite implementation evidence passes. This is not Phase 9, Phase 10, production or merge authorization.
|
||||
|
||||
No additional behaviors were set aside as new scope judgments in this fix-only review. The prior review's separately identified bounds remain in force. No product, test, database, Git-state, build, browser or external-network operations were performed; only this requested review report was written.
|
||||
@@ -0,0 +1,34 @@
|
||||
# RD21 final source review
|
||||
|
||||
Reviewed baseline `8e7e3f6387544e24082ebe2c107c0b868897959e` through `05a7386`, using the supplied exact diff, REQUEST.md, PLAN.md, progress ledger, earlier backend reviews, and connected production source. Verdict: **needs fixes** for the two findings below before final qualification.
|
||||
|
||||
The main repair is sound in the reviewed paths: source revisions accompany drafts, canonical/Identity/import writes share transactions, EF compares original revisions at the eventual update, and the UI retains rejected drafts. The package draft guard deliberately preserves its original revision when parent props change; keep that property during fixes.
|
||||
|
||||
## Findings
|
||||
|
||||
### 1. High: expose the committed revision header to browser clients
|
||||
|
||||
- Changed consumer: `job-tracker-ui/src/applicationWorkspace.ts:313-316`.
|
||||
- Connected configuration: `JobTrackerApi/Program.cs:144-152`; default cross-origin client: `job-tracker-ui/src/api.ts:40-47`.
|
||||
- The new application-drafts client requires `response.headers["x-job-version"]` after the 204 response. The CORS policy allows request headers but never exposes this response header. In the supported localhost UI/API setup, browsers therefore hide it from Axios. The database commits successfully, then the client throws `Missing committed job revision.` and leaves the draft dirty with the previous revision. Retrying that same draft then gets 409.
|
||||
- This is a false failed-save acknowledgement in an ordinary development configuration, independent of an actual conflicting writer. Same-origin requests and Playwright APIRequestContext calls do not exercise the restriction.
|
||||
- Suggested fix: expose `X-Job-Version` through the existing credentialed CORS policy. Retain the client's fail-closed validation. Add an actual cross-origin browser Answers save followed by another save, verifying acknowledgement, the advanced revision, and persisted text.
|
||||
|
||||
### 2. Medium: open Answers from a fresh coherent snapshot after other workspace writes
|
||||
|
||||
- Changed binding: `job-tracker-ui/src/views/ApplicationWorkspacePage.tsx:264-270`.
|
||||
- Connected lifecycle: `ApplicationWorkspacePage.tsx:127-152,159-176,263`; `job-tracker-ui/src/components/ApplicationAssets.tsx:511-547,849-862,881`.
|
||||
- The workspace fetches its overview on mount/job/locale changes and selected callbacks. A successful cover-letter save changes the shared job revision but only updates the cover-letter component; it does not refresh the overview. Changing the application subsection does not load the overview either. Opening Answers then initializes its source revision from that older overview. Example: overview revision 7, save letter to revision 8, open Answers, type an answer, save with expectedVersion 7: 409 despite no competing editor. Reopening Answers repeats the same stale initialization until a full workspace reload or another action happens to refresh its overview. CV attachment and other job mutations without an overview refresh can produce the same stale source.
|
||||
- Suggested fix: fetch a coherent answer/recruiter-text/revision snapshot when entering Answers, or invalidate/refresh the shared overview after all relevant job mutations. Prevent editing before that initial fresh read is accepted; do not merely update a revision independently of its source text, and never replace the revision of an already dirty draft. A cover-letter-only callback fix would leave other shared-job writers unhandled.
|
||||
- Add a connected workspace regression: load workspace, save a cover letter, switch to Answers, save an answer successfully; retain the existing test that parent refresh cannot authorize an older dirty draft.
|
||||
|
||||
## Review bounds and deferred judgments
|
||||
|
||||
- Inspected the Career, generic job, cover-letter, application-drafts and legacy tailored-CV replacement paths, revision mapping/migration, exception handling, related frontend consumers, session response interceptor, workspace mount/unmount behavior, and selected deterministic regression source. Earlier task-1/task-2 backend reviews remain complementary evidence, not new execution results.
|
||||
- Test/build/browser results supplied by the coordinator were not rerun or independently certified here. The supplied full browser run was still pending; partial runs cannot establish full regression acceptance. MariaDB runtime qualification is unavailable and remains outstanding. No production or release-readiness claim is made.
|
||||
- Existing extraction-run discard-versus-accept lifecycle concurrency was considered but not reproduced or expanded into this changed-contract review. The existing discard command has no canonical replacement payload; any separate lifecycle repair needs its own evidence and coordinator scope ruling.
|
||||
- No product files, tests, database, Git state, build or browser lanes were changed. Only this requested review artifact was written. No external network calls were made.
|
||||
|
||||
## Assessment
|
||||
|
||||
**Ready for final acceptance: no, with the two bounded fixes above pending.** Neither finding demonstrates a bypass of the backend stale-write guard; both are user-visible save regressions caused by incomplete integration of the new shared revision contract. Requalify the repaired source, including browser-level acknowledgement and the connected workspace sequence, before reassessing RD21 and Phase 9.
|
||||
@@ -0,0 +1,33 @@
|
||||
# SDD ledger — plan: docs/redesign/phase-9/rd21-remediation/PLAN.md
|
||||
|
||||
Spec: REQUEST.md in the plan directory. Baseline 8e7e3f6387544e24082ebe2c107c0b868897959e.
|
||||
Preflight table and rulings are recorded in PLAN.md. No implementation has started.
|
||||
Original unchanged browser reproduction: exit 0, characterization passes, both lostFirstEdit=true.
|
||||
This is a reproduced safety failure, not acceptance.
|
||||
|
||||
- Task 1: implemented and reviewed with no material findings; 14 dedicated SQLite cases included in full backend 1,109 passing. Report task-1-report.md, review task-1-review.md. Remaining MariaDB runtime lane explicit.
|
||||
- Task 2: coordinator job infrastructure/related writers and tests implemented. Eight dedicated SQLite cases, three legacy bypass cases (replace one obsolete legacy success test), one migration upgrade/rollback case. Full Release backend 1,109 passed, zero failed/skipped. Backend review requested before commit.
|
||||
- Task 3: frontend_fix implemented shared dialog/Career/assets revision retention, in-flight locks and late-read guards. Focused 76 passed; full Jest pending. Lint/typecheck pass. Source stable pending whole review.
|
||||
- Task 4: browser_proof writing isolated direct-SQLite/navigation/session journey. Root full sidecar 56 passed (model load disabled), offline security/tooling checks all exit 0. Browser/build lanes pending frontend completion.
|
||||
|
||||
Checkpoint commit 8f2cad6: reproduction, root cause and plan pushed to exact dedicated branch.
|
||||
Checkpoint commit 12f342c: reviewed Career/job backend repair and tests pushed; full backend 1,109 passed.
|
||||
Checkpoint commit 05a7386: frontend contracts/draft retention and new browser proof committed locally; final qualification pending before its remote push.
|
||||
Whole-branch final review found exactly two material integration findings: CORS fails to expose committed job revision header; Answers entry seeds stale cached overview after sibling mutation. One fix-wave implementer assigned both (review_fixes, model gpt-6-astra after original frontend worker hit usage quota).
|
||||
Pre-wave process-recorded full Jest: 930 passed / 105 suites, zero failed/pending, exit 0; first remediation browser 4/4 exit 0. Ordinary shard 1 interrupted after 22 passes for confirmed review findings; no full-suite claim.
|
||||
Current build/browser/native lanes reserved for review_fixes targeted RED/GREEN; coordinator owns docs only until released.
|
||||
Fix wave complete at 1b89a77, committed and pushed. Scoped re-review final-re-review.md: both findings ADDRESSED, no new material finding. Focused actual55 Jest / 2 browser, API/UI build and lint pass. Four new Jest cases are in the existing overlay suite; two new browser cases are in the new remediation diagnostic suite.
|
||||
Final source frozen: source-manifest.json 878 inputs, SHA256 7487f343786928e90a3c8a740571c29e5c934c80fa822abb80c7a39483e1353b. Final backend Release .artifacts/rd21/backend-final/backend-final.trx:1109 passed/0failed/0skipped, exit0. Final frontend still running via root session23912 (.artifacts/rd21/frontend-final.json+exit when done). Root static checks session93844 (.artifacts/rd21/final-static-checks.json when done).
|
||||
Root serialized browser pipeline session29901: .artifacts/rd21/final-browser-all.ps1 -> final-remediation6cases -> final-ordinary-shard-1..4 -> final-ai/auth/rate/ingress/pdf/preferences/volume -> final-historical-postfix. Current first5remediation cases pass; sustained follows. All final raw results use final-* prefixes. Source-manifest checks run before each shard and at end. Do not start another build/browser process while this pipeline is active.
|
||||
Original interrupted ordinary-shard-1.log moved to interrupted-ordinary-shard-1.log (22 actual passes, no full result). Preserve superseded full930Jest and initial4remediation outcomes separately; never add overlapping runs.
|
||||
Ruling: formal RD21 closure remains UNRESOLVED because the authoritative issue explicitly requires SQLite AND supported MariaDB runtime evidence. Local SQLite implementation can be repaired/verified without falsely closing the full supported-provider requirement. All Docker contexts have absent pipes and no native MariaDB/MySQL command/common installation exists; no install/restart/network fetch attempted.
|
||||
Pending: exact final results and failures, native PDF oracle (.artifacts/rd21/native-documents.py uses final-shard1 producers), preservation57/33 +56PARTIAL/C11DEFERRED, dated addendum/commands/rulings/review evidence, final doc commit/push/ref equality+clean worktree. No production/Phase10 work. Do not delete this ledger until necessary evidence is copied out.
|
||||
Root full native evidence: .artifacts/rd21/backend-full/backend-full.trx, 1,109/0/0.
|
||||
Ruling: related cover letter/application-drafts/structured tailored-CV losses were reproduced directly in SQLite before adding source guards; include them in this repair. Close obsolete /auth/profile projection-only bypass with an explicit 400 and canonical endpoint guidance.
|
||||
Ruling: field-specific lifecycle commands and distinct settings/other-record writers are reviewed separately; absence of a full-snapshot precondition alone is not a newly reproduced defect.
|
||||
Ruling: preserve historical diagnostics/data.spec.ts byte-for-byte. Its post-fix unversioned seed must fail closed; a conforming companion will preserve the original A/B ordering and assert rejection + durable state.
|
||||
|
||||
Ruling: WSL bash unavailable; installed Git Bash successfully runs skill workspace/brief scripts.
|
||||
Ruling: exact requested branch already isolated from main, user authorizes autonomous pushes.
|
||||
|
||||
Task 1: complete (commits 8f2cad6..12f342c, review clean). Task 2: complete (commits 8f2cad6..12f342c, review clean). Task 3: complete (commits 12f342c..1b89a77, final review findings addressed). Task 4: safe local qualification complete; backend1109/frontend934/ordinary362/contracts23/sidecar56/remediation6/adaptedVolume3; historical16pass2fail+volume2pass1fail retained; formal MariaDB requirement remains open. All878 frozen inputs and PDF/volume hashes stable;57 groups/33 routes,56PARTIAL/C11DEFERRED. Final reporting/publication follows; no production/main/Phase10 action. Rulings copied to REVIEW_RULINGS.md; full ledger preserved in reviews/progress.md and raw archive.
|
||||
@@ -0,0 +1,9 @@
|
||||
# Task 1 independent source review
|
||||
|
||||
Reviewed the working Career backend patch against `8f2cad6`, REQUEST.md and PLAN Task 1. No actionable correctness/security finding identified in the reviewed change.
|
||||
|
||||
Scope: CareerProfileService, CareerProfileController, ProfileCvController parse/diff/accept and pipeline changes, CareerProfile.Version concurrency configuration in JobTrackerContext, Rd21CareerPersistenceTests and associated caller/fixture changes. No product edits or test/server/network runs performed for this review.
|
||||
|
||||
Checks included the eventual EF revision comparison, missing/stale preconditions, first-save owner-unique translation, controller-owned transaction scope across canonical row/children/history/Identity/import metadata, failure rollback and tracker clearing, read-only coherent relational snapshot/raw-text reads, restore behavior, unchanged tenant filters and public owner-specific read behavior. The four production canonical replacement callers use explicit expected revisions; no blind-save overload was introduced.
|
||||
|
||||
Evidence boundary: test source and the worker's report were inspected; their executions were not independently repeated. The first-save SQLite test starts competing requests after both editors read revision zero; it does not independently exercise the MySQL duplicate-index error branch. Actual MariaDB transaction/constraint qualification, full backend regression and frontend/browser acknowledgement/retention remain coordinator-owned. The worker report explicitly preserves these qualifications and marks its newest revision-zero raw-text case pending the next coordinator run.
|
||||
@@ -0,0 +1,11 @@
|
||||
# Task 2 independent source review
|
||||
|
||||
Reviewed the working backend change against `8f2cad6`, REQUEST.md and PLAN Task 2. No actionable material correctness/security finding identified in the reviewed change.
|
||||
|
||||
Scope: JobApplication.Version; DbContext synchronous/asynchronous SaveChanges revision advancement and concurrency mapping; AddJobRevision migration/model snapshot and migration test; generic job PUT ownership/precondition/event/opportunity handling; legacy tailored CV structured/text and application-draft replacements; cover-letter save/restore and returned revisions; workspace revisions; global concurrency exception handler; legacy AuthController CV-write rejection; dedicated RD21 persistence/authentication fixtures. Production frontend references to the changed job/asset contracts were also searched for compatibility; this is not full frontend lifecycle acceptance.
|
||||
|
||||
The caller precondition is checked against the loaded source and the eventual database update independently compares the EF original revision. Forced modification of Version covers otherwise unchanged snapshot saves. Generic PUT saves the opportunity projection and lifecycle events in the same SaveChanges transaction and clears its failed tracked state. Cover-letter history and text share one SaveChanges transaction. Related structured CV state and its job text/revision are likewise committed together. The read DTOs carry their source job revision; 204 endpoints expose the committed revision header. Company reassignment remains tenant filtered.
|
||||
|
||||
Writer census check: ordinary tracked partial/background JobApplication writers inherit the new EF token and revision advancement; no production bulk update of editable JobApplication text was found. The existing startup-only owner backfill uses raw SQL for owner assignment, rather than an editor text replacement. CV generation is a server-created replacement whose loaded JobApplication is now guarded at its eventual SaveChanges; existing variant/frozen-document ownership remains separate.
|
||||
|
||||
Evidence inspected: `.artifacts/rd21/backend-full/backend-full.trx` counters report 1109 executed/passed, zero failed, error, timeout, aborted or notExecuted. No tests, migrations, servers or network calls were run during this review. The migration regression source covers SQLite upgrade/rollback/content preservation. These checks do not qualify actual MariaDB behavior, browser/session draft retention, or production deployment.
|
||||
Reference in New Issue
Block a user