cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(qa): close local runtime acceptance and record publication blocker

Browse Source
This commit is contained in:
cesnimda
2026-10-29 13:10:47 +01:00
parent caa0c6a2ef
commit 5032ccb415
10 changed files with 994 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pre-phase10-ux/ACCEPTANCE.md
+102
View File
@@ -0,0 +1,102 @@
# PRE-P10-UX cumulative acceptance — 2026-10-29
Decision: **CONDITIONAL GO for development review and the next QA handoff. Production: NO-GO. Phase 10 implementation is not authorised.** This dated report supplements the historical A/B/C/D reports; it does not replace their original evidence or promote conditional acceptance.
## Scope and source
The accepted CV-QA baseline is `4a8c907d70cbed235728f7d690b5409e72b93abe`, containing CV-UX `4a0af62`. The cumulative A–D application source is `3255da9fc6e5d885432bed60f37f4cc47b7dd00d`; the broad regression freeze is `994bf8f8bbf0df3c53111ca7f66af97fe0680013`. Changes through that freeze affect test compatibility and evidence, not application behavior. A subsequent real local smoke exposed a strategy JSON contract conflict, corrected in `caa0c6a2efea5a6e9d8910f55fb00fd982cd48fd`; see the [narrow addendum](STRUCTURED_STRATEGY_ADDENDUM.md). The machine-readable [evidence summary](evidence-summary.json) binds the broad results and retains limitations. Raw evidence is under `.artifacts/pre-phase10-ux/` and `.artifacts/cv-ux-01/` in this worktree.
Published checkpoints:
| Branch | Published source/checkpoint |
|---|---|
| `codex/cv-builder-blank-undo` | `663023a088573e44abea8da1c1858da934af77e9` |
| `feature/cv-template-library-review` | `3f4db8ca8183704945915ae4d2053e641bafa5b2`, activation addendum `aea7c29` |
| `feature/dashboard-interactive-grid` | `0bd290e788fc525157fe59ca830d39d5748fd192` |
| `feature/admin-processing-monitor` | `3255da9fc6e5d885432bed60f37f4cc47b7dd00d` |
| `test/pre-phase10-ux-acceptance` | final evidence and operational handoff continue from `994bf8f` |
No main merge or production deployment occurred. Unrelated changes in the primary checkout are preserved.
## Delivered behavior
Blank CV creation now starts genuinely blank, with explicit Career Profile selection and bounded document undo/redo. Existing inherited CV contracts remain compatible. New or explicitly applied template designs have increased title spacing, full-height sidebars, actual rendered gallery previews, matching cover letters and bounded photo handling. Historical designs remain unchanged until the user explicitly applies an updated design.
The dashboard uses revision-safe persisted geometry, actual drag/resize and keyboard controls, responsive linear layout and compact disclosures. The administration monitor exposes owner-scoped, redacted operation state and structured history with bounded polling, filters, safe job links and genuine failure timestamps. Worker operations propagate correlation IDs to the sidecar.
The former upload-to-queue dead end has an enabled local document worker and real Docling extraction. The supported workflow is upload → actual processing states → source-grounded review/correction → explicit approval → revision-safe Career Profile → CV Editor → PDF. Canonical profile facts, frozen CV versions, CV overrides and application associations remain independently protected. External AI consent and account entitlements still apply; worker configuration does not waive them.
## Fresh automated verification
| Lane | Result |
|---|---|
| .NET backend | 1,447 passed, zero failed/skipped |
| React frontend | 1,031 passed in 112 suites |
| Ordinary browser | 380 distinct cases qualified by exact-identity reconciliation |
| Specialized browser | 53 cases: AI/auth/rate/ingress/admission/preferences/RD21/diagnostics/volume |
| Real Docling browser | 8 distinct journeys, including long CV and historical-document preservation |
| Real MariaDB provider | 90 passed, temporary-schema cleanup confirmed |
| Additional MariaDB browser | 3 passed: save/conflict/network recovery and concurrency observations |
| Linux browser | 8 passed, immutable image/source/DLL binding and cleanup |
| Python | 81 offline contract/security tests; 14 real Docling tests |
| Other deterministic checks | benchmark oracle 11; structural helpers 9; Node helpers 25; Linux lifecycle 11; seed guard 29 |
| TypeScript / lint / frontend build | passed; local `/api` build separately passed |
These totals are separate lanes, not one additive test total. The ordinary browser result is a composite: `integration-04` retained two old smoke assumptions; `integration-05` reran all nine corrected smoke cases and the remaining 95 cases. Only the two failed identities are replaced; the overlapping seven are not counted twice. Specialized diagnostics retained four obsolete always-visible-control assumptions; all 18 passed after a test-only update in `integration-06`. No automated retries were used. The assertions now exercise explicit Career Profile selection and keyboard-opened dashboard disclosures; source/runtime binding proves application behavior was unchanged between these recovery runs. See [smoke compatibility](SMOKE_COMPATIBILITY.md) and [diagnostic compatibility](DIAGNOSTIC_COMPATIBILITY.md).
The real zoom extension harness passed both language/theme cases and six repeated cases after correcting extension startup and network-guard behavior. One long-path diagnostic launch succeeded; that alone does not exclude every path-related failure. The short owned temporary profile remains a robustness measure.
After the narrow strategy correction, the complete backend suite passed **1,448** tests and the complete offline Python lane passed **83** tests. One intervening backend run retained an outdated untyped strategy mock; its failure and the corrected full rerun are preserved. The frontend source/rendering/persistence schemas did not change. Earlier frontend, browser, provider and PDF results remain bound to their original freeze; they were not all rerun after this narrow AI-mode change. Actual local queue/Docling and direct sidecar checks provide the additional runtime evidence, with limitations in the local report.
RD21 checks cover stale writes, retry/recovery, transaction rollback, ownership and confirmed persistence. The extra MariaDB observation explicitly records non-idempotent repeated creation bodies; it is not evidence of creation-intent idempotency.
## Actual PDF evidence and remaining failure
Each platform passed the original 24 CVs/60 pages and four cover letters/14 pages. Revised output covered 36 CVs/122 pages and 18 matching letters/38 pages. Source completeness, bounds and name wrapping passed; sidebar raster coverage passed all 43 relevant pages on each platform. Additional imported PDFs retained their original semantic assertions, including three long documents with 142 source markers and 12 employment-record associations each.
**The unchanged revised S01 coordinate oracle remains PARTIAL: Windows 8/36 pass, Linux 16/36 pass.** The remaining 28/20 cases fail only S01's 2 mm positional threshold. A separate visible-ink check within three pixels and inspected raster contact sheets do not waive that failure. Human typography, printing and physical-device acceptance remain open. No claim that all PDF fidelity checks passed is made.
## Extraction benchmark and performance
The frozen synthetic corpus contains 18 logical cases in PDF and DOCX, 36 actual source-hash-bound files. Docling versions are 2.142.1, core 2.104.0 and parse 7.23.0. Structural conversion ran without models or network, with read-only storage and CPU/memory/time bounds. All 36 converted; 89.283 seconds total, median 2.4381 seconds, p95 2.89724 seconds, maximum 3.63939 seconds. Maximum observed child RSS was 150,408 KiB; extracted output totalled 31,664 bytes. This is not whole-application resource or production-load qualification.
| Metric | PDF | DOCX |
|---|---|---|
| Literal facts | 134/134 | 134/134 |
| Typed facts TP / FP / FN | 100 / 0 / 22 | 122 / 0 / 0 |
| Typed precision / recall | 100% / 81.967% | 100% / 100% |
| Exact employment records | 13/16 | 16/16 |
| Exact education records | 4/6 | 6/6 |
| Provenance records | 24/27 | 27/27 |
| Ambiguity abstention | 6/6 | 6/6 |
The separate frozen ten-case subset per format has PDF typed recall 47/60 (78.33%) and DOCX 60/60. PDF unresolved-source detection produced TP16/FP27/FN2: precision 37.21%, recall 88.89%, indicating review burden. Zero typed false positives here is not a population hallucination guarantee. These results measure deterministic extraction, not model-assisted CV interpretation or the user's corrected mapping accuracy. Reviewed transactional application is covered separately by integration tests.
Supported qualification covers text PDF and DOCX, EN/Bokmål, multi-page, tables, columns, incomplete dates and bounded synthetic long histories. Scanned/image-only/OCR-heavy and unusual unsupported documents require explicit unreadable/review handling; OCR and general layout completeness are not qualified. Missing facts remain unknown. Near-100% factual extraction remains aspirational.
## Independent decisions
| Criterion | Decision | Limit |
|---|---|---|
| Blank creation / undo-redo | PASS | automated scope; human interaction review open |
| Revised spacing | PARTIAL | unchanged S01 coordinate failures |
| Template library / matching letters / photo | PASS | automation; human design/print/device review open |
| Dashboard / admin monitor / event viewer | PASS | isolated development automation |
| Secure upload / Docling extraction | PASS | supported bounded fixtures; native parser fuzz qualification open |
| Structured mapping / review / progress-recovery | PASS | supported contracts; incomplete extraction remains visible |
| MariaDB persistence / RD21 revision safety | PASS | isolated provider and browser evidence |
| Deterministic extraction accuracy | PARTIAL | PDF recall and review burden above |
| Real CV AI compatibility / factual accuracy | BLOCKED | no immutable isolated CV-model quality qualification |
| Preservation | CONDITIONAL | all 57 original criteria retained: 56 PARTIAL, one DEFERRED; 33 original routes plus admin route |
| Security and privacy | CONDITIONAL | advisory, operator and parser limits below |
| PRE-P10-UX / CV-QA handoff | CONDITIONAL GO | explicit remaining acceptance debt |
| Phase 10 readiness | CONDITIONAL GO for candidate assessment/planning only | implementation remains unauthorised |
| Production | NO-GO | no deployment or blanket acceptance |
## Security, privacy and owner actions
The sealed security diff reviewed 136 files through `d52403d`, with no reportable findings. The subsequent `3255da9` addendum was separately reviewed and its failure-timestamp finding fixed; it is outside the original sealed scan. See [security evidence](SECURITY_REVIEW.md). npm production advisory count is zero; full npm has five low development-tool advisories. Python import lock audit has zero. NuGet identifies one distinct moderate MySqlConnector 2.4.0 advisory, repeated by its consumers: [GHSA-473q-m89c-ghf8](https://github.com/advisories/GHSA-473q-m89c-ghf8). Before release, qualify an upgrade to at least 2.6.1 or the documented trusted-CA configuration and rerun provider/RD21 checks. Production TLS configuration was not inspected. See [dependency audit](DEPENDENCY_AUDIT.md).
Owner acceptance still requires real keyboard/screen-reader and contrast review, physical desktop/tablet/mobile testing, English/Bokmål language review, actual printing, revised S01 disposition, isolated real CV-model qualification, external provider credentials/consent where applicable, and production filesystem/off-disk backup/model-cache/operator evidence. A healthy endpoint or synthetic local response does not satisfy these gates.
Local runtime activation and synthetic worker outcomes are recorded separately in [local runtime acceptance](LOCAL_RUNTIME_ACCEPTANCE.md). The [QA handoff](CV_QA_HANDOFF.md) identifies the next bounded work. Do not merge, deploy or begin Phase 10 from this conditional report.