docs(handoff): reconcile phase 10 authority and publication baseline

docs/automation/handoffs/pre-phase10/AI_EVALUATION_PLAN.md

@@ -0,0 +1,9 @@
+# Bounded real-adapter evaluation authority and limits
+
+AUTOMATION-HANDOFF-01 REQUEST section7 authorises targeted model evaluations when approved immutable artifacts and safe isolated development conditions exist. The earlier owner request approved creation of the local Ollama instance matching the recorded production model name. LOCAL_RUNTIME_ACCEPTANCE.md records the approved official Qwen GGUF/manifest and dedicated local runtime. This permits a bounded synthetic compatibility probe; it does not approve model activation, production access or factual-accuracy acceptance.
+
+Preconditions, checked before inference: Desktop Linux context; exact approved local Ollama image; manifest/blob verification with existing verify_ollama.py; cloud disabled and CPU/memory/concurrency bounds; actual development sidecar keeps CV_IMPORT_AI_ENABLED=false. Inspection found that the existing local service has a read-only root but its dedicated model volume is writable. Do not infer read-only cache protection from that root setting. Instead start a disposable Ollama container using the same immutable image and existing model volume mounted **read-only**, on a generated internal-only network with no published ports. A separate bounded Python client container on that network exercises the adapter. Neither container receives a daemon socket. Remove only these exact owned containers/network afterward. The existing local Ollama service is not changed or restarted.
+
+Exercise only cv_import_ai.analyse using the Python standard-library transport to the isolated `ollama` service alias and explicit model qwen2.5:7b. Three independently authored synthetic EN/Bokmål/adversarial block sets have explicit fact whitelists. Each request retains the existing schema, grounding checks and120-second bound; the entire run is finite. No download, model replacement, cache write, external provider or real personal document is allowed. Record actual native exit, timeout/rejection, structured suggestions, exact expected matches and unsupported claims. Quotes alone do not establish that instruction text is a career fact.
+
+These cases are development compatibility probes, separate from the frozen benchmark and active deterministic Docling pipeline. A small success cannot establish general extraction precision/recall, multilingual quality, safe activation or end-to-end PDF/DOCX model accuracy. Any timeout, malformed output, missed field or unsupported claim stays visible. Phase10 does not gain authority from this test. No service configuration is changed.

docs/automation/handoffs/pre-phase10/AUTHORITY.md

@@ -0,0 +1,23 @@
+# Authority reconciliation — 29 October 2026
+
+This register distinguishes tested implementation, development review, cleanup entry and release. The package is evidence, never an approval token.
+
+| Source | Actual authority / current disposition |
+|---|---|
+| Owner REQUEST.md | Complete bounded handoff/remediation/testing/publication; explicitly do not start Phase10 or the controller. No main merge/production/other-worktree mutation. |
+| docs/redesign/IMPLEMENTATION_PLAN.md, Phase10 | Remove only genuinely obsolete UI after unused-route proof, passing tests and satisfied functionality inventory. No age/name-based removal. |
+| docs/redesign/phase-9/p9-07/PHASE10_HANDOFF.md | Broad cleanup NO-GO; exact candidate/caller/inventory/rollback proof and clean published baseline required. Older RD21 issue is superseded only by the later scoped RD21 remediation evidence, not by assumption. |
+| docs/redesign/phase-9/REQUEST.md:246–252,426–439,581–598 | Unfinished genuine human checks may remain release gates; individual disposition required; PARTIAL is not PASS; independent development/Phase10/production decisions. |
+| docs/redesign/phase-9/p9-sec-02/ACCEPTANCE_ADDENDUM_2026-10-25.md | Scoped Python security CONDITIONAL PASS: vendor-local Torch PyPI404 remains an incomplete scan response, supplemented by installed OSV/vendor/source/model evidence. Hosted MariaDB BLOCKED, current isolation UNVERIFIED. No owner risk acceptance. |
+| docs/cv-redesign/ACCEPTANCE.md and ENTRY.md | Completed model-independent editor development, conditional human/model acceptance. Original standalone scope issue was resolved by the later explicit CV-UX workstream; this is not Phase10 approval. |
+| docs/cv-import/ACCEPTANCE.md | Implemented deterministic workflow conditionally accepted for development/QA. Optional model adapter disabled and disconnected from active processing. No near-100% extraction or production claim. |
+| docs/cv-integration-qa/ACCEPTANCE.md and PHASE_10_HANDOFF.md | Reviewed mapping/persistence improvements qualified; conditional candidate assessment/planning only. No verified unused deletion candidate. |
+| docs/pre-phase10-ux/ACCEPTANCE.md, LOCAL_RUNTIME_ACCEPTANCE.md | A–D implemented; bounded local Docling/generic strategy/enrichment verified. Broad freeze994bf8f and later caa0c6a AI fix have distinct evidence. Revised S01 and human/model/operator gates retained. |
+| Separately committed codex/autonomous-roadmap-01:docs/automation/GATES.md and automation/backlog.json | Execution disabled. `phase10-development-entry` protected approval missing; real sandbox/test adapter qualification blocked. All current checkpoint deferrableGates arrays are empty. Source-only conditional debt cannot silently become an executable deferral. |
+| planning/int-global-jobs-00:docs/global-jobs/00/DEPENDENCIES_AND_GATES.md | GJ-00 planning only; actual remote ref0ec9f98 verified without modifying/merging it. GJ implementation needs Phase10, Product Review, initiative entry and provider-specific rights. |
+
+Observed starting branch/head: test/pre-phase10-ux-acceptance at5032ccb41514807c8ca3008c24ca6326be1170de, clean before handoff files. Ancestry of5032ccb is confirmed. App inventory shows only this active chat at this cwd; the controller chat has its own worktree. This is an observation, not a cross-process filesystem lock. Source hashes are frozen during tests to detect drift.
+
+Gitea observation13:39UTC: DNS/TCP443/HTTPS200/TLS1.3 with certificate verification passed. A normal push published caa0c6a and5032ccb; independent ls-remote returned5032ccb. GJ-00 local and remote both0ec9f98e6ed4a646fc5e017d8eb6fade07653f37. Final handoff publication must be checked again; earlier success does not establish final remote HEAD.
+
+The historical graph at4a8c907 is orientation only (10,691 nodes/34,221 edges, application-code scope). Current source callers, native results and gate texts take precedence. It was not rebuilt or modified in the primary checkout. The separate controller was inspected through committed Git objects only; no file or runtime in its worktree was changed, launched or messaged.

docs/automation/handoffs/pre-phase10/CLEANUP_INVENTORY.md

@@ -0,0 +1,27 @@
+# Phase10 candidate inventory — assessment only
+
+No removal is implemented or approved here. No genuinely unused product component has yet been proven across static, dynamic and historical readers. The concrete negative findings below prevent unsafe deletions; potential consolidation needs a separately approved candidate. All locations are repository-relative.
+
+| ID / location | Replacement / current consumers | Dynamic or compatibility risk; disposition | Preservation / required test / removal risk |
+|---|---|---|---|
+| CLEAN-01 `job-tracker-ui/src/views/CvBuilderEditor.tsx` | Current editor rendered by CvBuilderPage; undo/history hooks are active | New implementation, not obsolete. Retain | CV authoring; blank/history/save/browser/RD21; HIGH |
+| CLEAN-02 `job-tracker-ui/src/components/CvTemplateThumbnail.tsx` | CvTemplateGallery imports it. It now renders actual server sample HTML in a sandboxed iframe | Name does not mean simplified obsolete thumbnail. Lazy/cached sample and error paths active; retain | Templates; preview/unit/browser/native PDF; HIGH |
+| CLEAN-03 `job-tracker-ui/src/components/CvTemplateGallery.tsx` | Current template library/selection callers | Retain gallery semantics, premium checks and explicit Apply. No duplicate proven | CV gallery; template-selection/legacy/browser; HIGH |
+| CLEAN-04 `job-tracker-ui/src/views/career/CvImportReview.tsx` and `CvImportMappingEditor.tsx` | CareerProfilePage renders Docling review for pending/applied runs | Current correction/assignment/duplicate workflow; retain | Career Profile/import; real PDF/DOCX/review/provider rollback; CRITICAL |
+| CLEAN-05 legacy branches in `CareerProfilePage.tsx` and `JobTrackerApi/Controllers/ProfileCvController.cs` | Non-docling runs still use review/accept API and DTOs | Old persisted runs are live consumers. Retain until migration/retention and no-reader evidence | Profile/import/history; legacy and new-run contract/browser; CRITICAL |
+| CLEAN-06 `job-tracker-ui/src/components/DashboardLayoutEditor.tsx` | DashboardView imports it beside DashboardGrid, including navigation guard | Grid adds geometry; editor still owns show/hide/save/reset/conflict controls. Not replaced | Dashboard; geometry/preferences/keyboard/RD21; HIGH |
+| CLEAN-07 `job-tracker-ui/src/dashboardLayout.ts` and `hooks/useDashboardLayout.ts` | DashboardView/Grid/LayoutEditor/unit callers | v1-to-v2 migration, future/hidden widget preservation and CAS remain active | Dashboard/settings; v1/v2/provider/viewport/save conflict; HIGH |
+| CLEAN-08 `job-tracker-ui/src/views/AdminProcessingPage.tsx` | `/admin/processing` in App.tsx; new current view | No superseded admin-processing view verified. Other admin audit/system views serve different functions | Admin/auth/privacy; owner/tenant/rate/redaction/browser; CRITICAL |
+| CLEAN-09 redirects in `job-tracker-ui/src/App.tsx` | `/kanban`, `/correspondence/review`, `/applications/:id` | Existing bookmarks/extensions/query/hash paths; retain aliases | Routes/jobs/correspondence; route-contract/navigation/ownership; HIGH |
+| CLEAN-10 `JobTrackerApi/Models/CvTheme.cs` and `Services/ThemedCvRenderer.cs` design-version branches | Existing CV settings lack v2; only explicit Apply opts in | v1 is historical-document compatibility, not dead rendering code. Retain | CV/letters/frozen packages; unchanged Windows/Linux goldens; CRITICAL |
+| CLEAN-11 `JobTrackerApi/Services/CareerProfileMapper.cs`, import mapping/interpreter owners | Different canonical persistence and reviewed source mapping responsibilities | No duplicate master profile/service proven. Trace side effects before any consolidation | Canonical profile/variants; MariaDB rollback/replay/stale writes; CRITICAL |
+| CLEAN-12 `JobTrackerApi/Services/ApplicationAssetsService.cs` and versioned writers | CV/letter/job/application submission readers | RD21 tokens, no-op/null semantics and frozen packages remain mandatory | Applications/docs; all writers/provider/network recovery; CRITICAL |
+| CLEAN-13 `JobTrackerApi/Migrations/` and `Data/JobTrackerContext.cs` | Development/provider startup and old database adoption paths | Do not delete migrations or automatically retire SQLite/MariaDB compatibility. No major-version change | Data/auth/history; migration up/down/provider/backup restore; CRITICAL |
+| CLEAN-14 `tools/summarizer/parser_child.py`, legacy extraction and Docling environment | Existing text/attachment routes plus separate bounded document converter | New Docling CV path does not replace all extraction consumers. Retain both until actual census | AI/import/attachments; parser security/legacy/Docling; HIGH |
+| CLEAN-15 `tools/summarizer/cv_import_ai.py`, CV_IMPORT_AI_ENABLED | Disabled/disconnected optional interpretation adapter and tests | Withheld capability is not obsolete. Keep disabled; no activation through cleanup | C11/P5-13/import; disabled transport/schema/grounding/negative model probes; HIGH |
+| CLEAN-16 shared style utilities, typography and licensed fonts | MUI/app styles and fixed physical document CSS have different owners | No unused stylesheet/font proven. Dynamic class names, exports, iframe/export embedding need explicit proof | UI/accessibility/PDF/fonts; lint/type/build/browser/native PDF; HIGH |
+| CLEAN-17 package/lock dependencies including react-grid-layout and legacy parser packages | RGL is imported by DashboardGrid; parsers serve retained routes | No unreferenced dependency proven. Age/advisory is not unused proof. Qualify updates separately | Dashboard/import/rendering/security; lock audit/build/provider/PDF; HIGH |
+| CLEAN-18 old tests, golden fixtures, acceptance records | Regression and historical evidence consumers | Never remove because newer tests pass. Keep original failed attempts/oracles | All57 groups; discovery identity and unchanged oracle hashes; HIGH |
+| CLEAN-19 shell/Dashboard duplicate reminder reads (historical P9-PERF-01) | Possible shared-owner optimisation; exact current count not newly measured | Assessment candidate only: measure before/after with failure/account-disposal behavior. No removal eligibility | Notifications/dashboard; loading/refresh/session disposal; MEDIUM |
+
+Every future candidate must name exact symbols and replacement, enumerate current static/dynamic/export/route/old-data consumers, establish an absence of live usage, bind affected preservation IDs, define rollback and run focused plus applicable full regression. An owner-approved scope is required before implementation. The table is bounded evidence, not an exhaustive proof that the repository contains no dead code.

docs/automation/handoffs/pre-phase10/MANUAL_ACCEPTANCE.md

@@ -0,0 +1,19 @@
+# Prioritised owner acceptance
+
+All human rows are **NOT TESTED** until the owner supplies actual evidence through the protected approval mechanism. Do not commit approval tokens/signatures or personal CVs. Use fictional data and http://jobbjakt.local; admin scenarios require an existing Admin account, AI scenarios require consent/entitlement. Capture date, exact source/image, device/OS/browser/assistive technology, steps, result and synthetic-only screenshot/PDF where appropriate. Never include passwords, cookies or personal documents.
+
+| ID / priority | Workflow and preconditions | Steps and expected pass criterion | Evidence and gate |
+|---|---|---|---|
+| HUMAN-01 / P0 | CV Builder; blank and seeded fictional Career Profile | Create Blank: no inherited name/contact/photo/summary/job/empty headings. Choose From Career Profile and select sections explicitly; save, refresh and verify only selected facts. Reorder, Undo/Redo, type with native undo, switch documents. Pass if no cross-document or unintended inherited facts and saved content survives refresh | Screen recording plus safe save/readback; blocks affected cleanup acceptance if behavior changes; broad human release gate remains |
+| HUMAN-02 / P0 | Same CV open in two sessions | Save a change in sessionA, then stale sessionB. Pass if B clearly reports conflict, retains draft/recovery and never overwrites A. Exercise failed save/retry; successful UI must correspond to durable reload | Synthetic before/after/version evidence; data-integrity failure blocks development immediately |
+| HUMAN-03 / P0 | Career Profile import with synthetic PDF/DOCX and existing matching job | Upload; observe real stages; compare original/evidence; correct employer/title/date; reject an unsupported field; resolve duplicate conservatively; approve. Refresh profile and open CV Editor/export. Pass if approved facts persist, unapproved/unknown facts stay absent, existing unrelated details/old CVs remain | Source, corrections and final synthetic profile/PDF; actual integrity defects block development; human usability completion remains open |
+| HUMAN-04 / P1 | Physical phone and tablet, each light/dark | CV editor, import source/review switching, templates, jobs and dashboard. Use touch/software keyboard and rotate. Pass if primary actions remain reachable, no clipped content or accidental data loss; dashboard mobile order must not rewrite desktop geometry | Real device names/OS/browser and screenshots; production human/device gate; emulated viewport is not evidence |
+| HUMAN-05 / P1 | Keyboard only, then actual NVDA/VoiceOver (name/version required) | Navigate upload/review, editor dialogs/history, template selection, dashboard drag/resize/show-hide/save and admin filters/details/poll pause. Pass if labels/status announcements/focus order/dialog return work and no keyboard trap occurs | AT observations and failures; production accessibility gate, candidate-specific affected controls must be preserved |
+| HUMAN-06 / P1 | Every CV and matching letter theme, short/dense EN/NB, with/without optional photo | Inspect review package's actual PDF/preview images, then open current app. Check title clearance, section rhythm, font weights/diacritics, bullets, margins/columns, page breaks, footer/sidebar height, missing/clipped text and excessive whitespace. Pass requires recorded decisions per template/case, not blanket approval | Annotated synthetic PDF/screenshots; S01 remains failed until measured correction or explicit criterion disposition; no automatic waiver |
+| HUMAN-07 / P1 | Actual printer; A4 and Letter as supported | Print representative single/sidebar/multipage CV and letter at intended scale; compare PDF preview. Pass if margins, page breaks, typography and all content survive actual printing | Printer/driver/settings and photos of synthetic printouts; production print gate; PDF download is insufficient |
+| HUMAN-08 / P1 | Proficient English and Norwegian Bokmål reviewers | Review jobs, Career Profile/import, CV editor, template/letter labels, dashboard, account/settings and admin/error/progress copy. Pass if terminology, dates, instructions and errors read naturally and preserve meaning | Reviewer language competence and concrete corrections; production linguistic gate. Other locales must not be represented as implemented without catalog/runtime evidence |
+| HUMAN-09 / P1 | Dashboard edit mode and jobs workspace | Drag/resize/show/hide; save/reload, cross-session conflict and narrow viewport; track a fictional job through existing statuses. Pass if widgets/data/filters persist and keyboard alternatives match | Synthetic steps/screenshots; confirmed regression blocks affected cleanup |
+| HUMAN-10 / P1 | Admin and non-admin accounts | Compare submitting owner and linked import/job; filters, stages, duration/failure/event history, pause/reconnect. Attempt non-admin access. Pass if attribution is correct, private source/prompt/result/lease/path data is absent and non-admin is denied | Safe status/authorization observations, never raw sensitive logs; disclosure/auth defect blocks development |
+| HUMAN-11 / P1 | Explicitly consented local generic AI on fictional job/profile | Inspect saved strategy/enrichment and source facts. Pass only the reviewed sample if suggestions are appropriate, no invented candidate proof and structured failures are understandable. Never approve an entire model from one result | Source/output comparison, sample-specific decision; blocks AI quality/activation claims, not unrelated cleanup assessment |
+
+Human aesthetic preferences may be returned as specific revisions. None of these rows grants cleanup entry. Before Phase10 implementation, the owner must approve the **resolved published baseline and exact candidate scope**, with any permitted deferral identified and signed through the separate controller's protected approval flow. The current manifest declares no checkpoint deferrable gates; changing that policy itself requires its signed policy-update process. Do not answer these questions by editing ACCEPTANCE.json.

docs/automation/handoffs/pre-phase10/PLAN.md

@@ -0,0 +1,40 @@
+# AUTOMATION-HANDOFF-01 implementation plan
+
+> **For agentic workers:** Use superpowers:executing-plans inline. Steps use checkbox syntax. This plan is execution of the owner's attached specification, not authority to start Phase 10.
+
+**Goal:** Export an independently verifiable, fail-closed pre-Phase-10 evidence package.
+
+**Architecture:** Reuse existing application tests, parser/native runtime, original PDF oracles and preservation owners. Export a proposed versioned evidence contract alongside the separately committed orchestrator contract; never change or run that worktree/controller. Owner approvals remain external and protected.
+
+**Tech Stack:** Existing .NET/React/Python/Playwright/MariaDB fixtures, Node's installed JSON Schema validator, Git and JSON/Markdown.
+
+**Spec:** REQUEST.md, byte-preserved owner request.
+
+## Global constraints
+
+No Phase 10, later feature work, main merge, production operations, destructive database changes, acceptance waivers or approval signatures. Keep jobbjakt.local available. Work only on test/pre-phase10-ux-acceptance; preserve the primary and automation worktrees. Never turn a schema-valid GO into entry authority.
+
+## Review focus
+
+- Old or missing native reports must not become fresh PASS evidence.
+- Source hashes and commit ancestry must bind reports despite documentation-only commits.
+- Failure/skip/retry counts and all 57 preservation criteria remain visible.
+- Missing protected approvals and remote publication must block automatic execution.
+- Historical CV rendering, old import runs, redirects, SQLite and migrations are retain-by-default.
+
+## Checkpoints
+
+- [ ] AUTO-H01: capture clean starting source/ancestry/remote/session observations; reconcile original CV-UX/import/QA/RD21/Phase9/Phase10 gates and committed orchestrator policy. Produce capability traceability and authority register.
+- [ ] AUTO-H02/H03: investigate unchanged S01 PDF failures using actual synthetic rendered bytes, preserve the original oracle, nominate only confirmed formatting defects; run safe parser/model/security checks with existing immutable artifacts. Prepare labelled visual comparison artifacts. No CV-model activation or semantic PASS by inference.
+- [ ] AUTO-H04/H05: produce prioritised owner scenarios with blocking scope; diagnose DNS/TCP/HTTPS/TLS/Git separately, normal-push this branch if reachable, inspect GJ-00 ref without changing it.
+- [ ] AUTO-H06: run fresh applicable backend/frontend/browser/Docling/MariaDB/RD21/Python/build/type/lint/security/preservation lanes in isolated fixtures. Capture native commands/exits/reports/test identities/source hashes; retain failures and compare historical counts separately.
+- [ ] AUTO-H07: create HANDOFF.md, ACCEPTANCE.json, GATES.json, BLOCKERS.json, TEST_EVIDENCE.json, MANUAL_ACCEPTANCE.md, PHASE10_BASELINE.md, READY_TO_RUN.md, HANDOFF_SCHEMA.json. Add minimal schema/evidence verification and negative tests proving missing/tampered/wrong-source reports or fake owner approvals cannot authorise execution.
+- [ ] AUTO-H08: record exact candidate/retain inventory, roadmap stages05–11 and separately tracked initiatives, independent decisions and owner actions. Review whole package, validate, commit, normal-push/read-back if available; otherwise preserve precise publication blocker. Stop.
+
+## Initial rulings
+
+The sole active app-inventory chat using this cwd is this task; the separate active controller chat uses another worktree. A clean starting status and subsequent source freeze detect observed source drift; this is not a filesystem lock or proof against every external writer. No cross-chat message or other-worktree write is authorised.
+
+The existing controller's result/backlog schemas are not acceptance-package schemas. Use a separately versioned **proposed evidence contract**, with explicit mapping to its protected signed entry/deferral/review gates, not a competing executable queue. Do not copy/configure its runtime or fabricate signatures.
+
+Existing Phase9 authority allows genuinely unfinished human checks as release debt and individually scoped conditional development; it does not grant broad Phase10 entry or accept unresolved security risks. Exact candidate approval and unused-caller proof remain mandatory. This handoff can be READY as evidence while Phase10 remains BLOCKED.

docs/automation/handoffs/pre-phase10/REQUEST.md

@@ -0,0 +1,909 @@
+# Jobjakt — AUTOMATION-HANDOFF-01
+## Finish Pre-Phase-10 Acceptance and Prepare for Autonomous Roadmap Execution
+
+### Your role
+
+Act as Jobjakt's senior QA engineer, release engineer, software architect, Git integration specialist and autonomous-development handoff coordinator.
+
+Your task is to complete the remaining safely achievable Pre-Phase-10 acceptance work and prepare a reliable, machine-readable handoff for the separate AUTONOMOUS-ROADMAP-01 Codex orchestrator.
+
+**Do not begin Phase 10.**
+
+Your objective is to leave the development repository in a verified, clean, reproducible state from which an independently authorised automation system can safely begin Phase 10 and eventually continue through the remaining roadmap.
+
+Work autonomously through normal development, testing, remediation, documentation and feature-branch publication.
+
+Only interrupt me when genuine human approval, manual testing or external infrastructure action is needed.
+
+---
+
+# 1. Starting baseline
+
+Latest reported development environment:
+
+Local URL:
+`http://jobbjakt.local/`
+
+Branch:
+`test/pre-phase10-ux-acceptance`
+
+Latest reported commit:
+`5032ccb`
+
+Reported status:
+
+- Working tree clean.
+- Backend: 1,448 tests passed.
+- Frontend: 1,031 tests passed.
+- Python: 83 tests passed.
+- Real MariaDB: 90 tests passed.
+- Ordinary browser regression: 380 tests passed.
+- Real CV extraction verified.
+- Queued AI strategy generation verified.
+- Scheduled job enrichment verified.
+- Conflicting JSON instructions in the strategy route corrected.
+- Synthetic accounts and temporary test containers cleaned up.
+- Two local commits remain unpublished because Git server connectivity failed.
+- Production remains NO-GO.
+- No merge or deployment occurred.
+
+Outstanding qualifications include:
+
+- CV AI extraction and semantic accuracy.
+- Human accessibility testing.
+- Physical-device testing.
+- Human language review.
+- PDF template spacing and visual qualification.
+- Historical Phase 9, Python dependency and CI requirements where still applicable.
+- Existing production-only infrastructure and recovery gates.
+
+Read the actual current evidence before relying on this summary.
+
+Primary documentation:
+
+`docs/pre-phase10-ux/ACCEPTANCE.md`
+
+`docs/pre-phase10-ux/CV_QA_HANDOFF.md`
+
+Also inspect the authoritative CV-UX, CV-IMPORT, CV-QA, RD21, Phase 9, Phase 10 and preservation documentation.
+
+Verify which reported checks are actually complete, which were conditionally accepted and which remain outstanding.
+
+Do not invent evidence for missing results.
+
+---
+
+# 2. Relationship to the automation orchestrator
+
+A separate workstream named:
+
+`AUTONOMOUS-ROADMAP-01`
+
+is responsible for building a persistent Windows-compatible Codex orchestrator.
+
+That orchestrator will eventually process the approved roadmap:
+
+05 — Phase 10 cleanup.
+
+06 — PRODUCT-REVIEW-01.
+
+07 — INT-GLOBAL-JOBS-01.
+
+08 — I18N-01 translations.
+
+09 — LAUNCH-SITE-01 homepage redesign.
+
+10 — SECURITY-AUDIT-01.
+
+11 — RELEASE-READINESS-01.
+
+Your responsibility is **not** to implement or run this orchestrator.
+
+Your responsibility is to make the current repository and its acceptance evidence suitable for the orchestrator to consume.
+
+You must provide:
+
+- An authoritative accepted development baseline.
+- A complete pre-Phase-10 blocker register.
+- Structured acceptance evidence.
+- Stage dependency and gate definitions.
+- Explicit deferrals and reasons.
+- Human approval requirements.
+- Git branch and remote state.
+- Reproducible verification commands.
+- An exact Phase 10 handoff.
+
+Coordinate through documented contracts, not by modifying the other worktree or running a second orchestrator.
+
+---
+
+# 3. Git and worktree safety
+
+Stay on the currently authorised Pre-Phase-10 development branch, or the verified equivalent worktree containing its complete history.
+
+Before making changes:
+
+1. Verify Git status.
+2. Verify current HEAD.
+3. Verify ancestry of commit `5032ccb`.
+4. Inspect pending local commits.
+5. Identify the configured Gitea remote.
+6. Confirm the worktree is not being modified by another Codex session.
+7. Determine which branch contains the latest accepted integration history.
+
+Do not assume `main` includes the redesign.
+
+Do not reset, rebase destructively, cherry-pick blindly or force-push.
+
+Do not alter the separate automation worktree.
+
+Do not merge into `main`.
+
+Do not deploy production.
+
+If new commits are required, keep them on the authorised pre-Phase-10 branch and document their hashes.
+
+---
+
+# 4. P10-HANDOFF-00 — Comprehensive acceptance reconciliation
+
+Begin with a complete review of the existing acceptance evidence.
+
+Determine whether the currently reported implementation genuinely satisfies the mandatory development requirements.
+
+Investigate:
+
+### CV Builder
+
+- Creating a completely blank CV with zero unwanted content sections.
+- Creating a CV from Career Profile.
+- Undo/redo across supported editor operations.
+- Save, refresh and recovery.
+- Multiple-session editing.
+- Existing CV compatibility.
+- Historical document preservation.
+
+### CV templates
+
+- Existing template spacing.
+- New template library.
+- Optional-photo templates.
+- Font consistency.
+- Page margins.
+- Section spacing.
+- Bullet indentation.
+- Multi-page layout.
+- PDF preview/export agreement.
+
+### CV import
+
+- Real PDF extraction.
+- Real DOCX extraction.
+- Career Profile mapping.
+- New-record creation.
+- Review and corrections.
+- Duplicate handling.
+- Transactional MariaDB persistence.
+- Failure recovery.
+- Source provenance.
+
+### Dashboard
+
+- Widget drag-and-drop.
+- Resizing.
+- Show/hide controls.
+- Layout persistence.
+- Mobile behaviour.
+- Keyboard accessibility.
+- Existing preference compatibility.
+
+### Admin Processing Monitor
+
+- Job attribution to the submitting user.
+- Related job application or import record.
+- Processing stage.
+- Status and duration.
+- Failure diagnostics.
+- Sanitised event logs.
+- Administrative authorisation.
+- Tenant isolation.
+- Log redaction.
+
+### AI workflows
+
+- CV extraction.
+- Queued AI strategy generation.
+- Scheduled job enrichment.
+- Safe structured outputs.
+- Processing failure handling.
+- Disabled/unqualified AI functionality.
+- Model compatibility and semantic qualification requirements.
+
+### Application preservation
+
+- Existing routes.
+- Authentication.
+- Career Profile.
+- Jobs and applications.
+- CVs.
+- Cover letters.
+- Dashboard.
+- Settings.
+- Administration.
+- English/Norwegian.
+- Existing functionality-preservation contracts.
+
+Use actual repository implementation and evidence.
+
+Create a traceability matrix mapping each required capability to its test evidence and acceptance status.
+
+Do not claim that an untested feature passed merely because its implementation exists.
+
+---
+
+# 5. P10-HANDOFF-01 — Fix remaining bounded defects
+
+Investigate the remaining pre-Phase-10 defects.
+
+Prioritise:
+
+1. User-data loss or corruption.
+2. Broken Career Profile persistence.
+3. Import approval failures.
+4. Missing-record creation.
+5. Undo/redo defects.
+6. Incorrect blank CV behaviour.
+7. Broken template spacing or clipping.
+8. Missing PDF content.
+9. Admin authorisation or sensitive-log exposure.
+10. Broken dashboard persistence.
+11. Confirmed regressions in existing workflows.
+
+Fix reproducible defects that are within the current acceptance scope.
+
+For each fix:
+
+- Record the reproduction.
+- Identify the root cause.
+- Implement the smallest maintainable correction.
+- Add regression tests.
+- Run targeted verification.
+- Update the acceptance matrix.
+
+Do not begin unrelated product features.
+
+Do not redesign major parts of Jobjakt unnecessarily.
+
+If a requested change is genuinely outside the existing acceptance scope, record it as a separate backlog item rather than silently expanding Phase 10.
+
+Do not change acceptance criteria solely to obtain a PASS.
+
+---
+
+# 6. P10-HANDOFF-02 — PDF spacing and document qualification
+
+The remaining PDF spacing review requires particular attention.
+
+The original PDF fidelity fixtures previously passed on Windows and Linux, but this does not automatically establish that every template has excellent spacing.
+
+Perform a dedicated visual and functional audit of the current CV template library.
+
+Render representative synthetic CVs using every available template.
+
+Include:
+
+- Short CV.
+- Long CV.
+- Multiple employers.
+- Dense education.
+- Long skill lists.
+- Several languages.
+- Norwegian characters.
+- Optional profile photographs.
+- Multi-page content.
+- Cover letters where applicable.
+
+Check:
+
+- Section spacing.
+- Line height.
+- Paragraph rhythm.
+- Headers.
+- Margins.
+- List indentation.
+- Column alignment.
+- Page breaks.
+- Font weights.
+- Text clipping.
+- Missing content.
+- Excessive whitespace.
+- Preview/PDF differences.
+
+Generate actual rendered preview images or PDFs for inspection.
+
+Fix measurable formatting defects.
+
+Create a visual comparison package for owner review where aesthetic approval is necessary.
+
+Retain historical document compatibility and existing licensed-font arrangements.
+
+Do not modify golden fixtures merely to conceal regressions.
+
+Distinguish:
+
+- Automated PDF fidelity: PASS/FAIL.
+- Semantic content completeness: PASS/FAIL.
+- Visual spacing qualification: PASS/PARTIAL/FAIL.
+- Human print approval: PASS/NOT TESTED.
+
+If human visual or printing acceptance is required by the authoritative Phase 10 entry criteria, prepare the relevant review artifacts and keep that gate pending until I approve them.
+
+---
+
+# 7. P10-HANDOFF-03 — Real AI and security qualification
+
+Review the actual current AI architecture.
+
+The latest report states real CV extraction, queued AI strategy generation and scheduled enrichment have been verified.
+
+Determine precisely what was exercised.
+
+Distinguish:
+
+- Real Docling parsing.
+- Deterministic extraction.
+- Model-assisted processing.
+- Queued task execution.
+- Structured-output validation.
+- Real model inference.
+- Semantic correctness.
+- User-reviewed final output.
+- Source-grounded accuracy.
+
+Do not interpret a successful AI request or completed background job as proof of good AI output.
+
+Inspect the existing model qualification and Python dependency security evidence.
+
+Determine which checks can safely run in the isolated development environment.
+
+If approved model artifacts and safe runtime conditions exist, conduct authorised targeted model evaluations.
+
+Otherwise preserve the relevant qualification as BLOCKED or NOT TESTED.
+
+Do not download large models to production.
+
+Do not change live Ollama services or model caches.
+
+Do not accept security risks on my behalf.
+
+If optional AI functionality is disabled, isolated and not required for Phase 10 code cleanup, document whether its remaining qualification can legally and technically be deferred under the existing acceptance criteria.
+
+Do not falsely mark AI production-ready.
+
+---
+
+# 8. P10-HANDOFF-04 — Human and manual acceptance
+
+Prepare a prioritised owner-test package.
+
+Include:
+
+- What to test.
+- Why it matters.
+- Exact page or workflow.
+- Preconditions.
+- Test steps.
+- Expected behaviour.
+- Pass/fail criteria.
+- Evidence to capture.
+- Whether the test blocks Phase 10 or production only.
+
+Cover:
+
+- Real mobile/tablet.
+- Keyboard-only usage.
+- Screen reader.
+- English copy.
+- Norwegian Bokmål copy.
+- Other implemented languages.
+- CV editor usability.
+- Template visual approval.
+- PDF printing.
+- Job tracking.
+- Dashboard layout.
+- Admin diagnostics.
+- AI-generated content review where enabled.
+
+Complete checks that can genuinely be performed automatically.
+
+Do not fabricate physical-device, human language, screen-reader or printing test results.
+
+Where a mandatory human decision is needed, flag it clearly.
+
+Prefer a small, well-prioritised owner checklist over a large unstructured testing document.
+
+---
+
+# 9. P10-HANDOFF-05 — Resolve Git publication
+
+Two local commits were reported to be awaiting publication.
+
+Diagnose the Gitea connectivity issue safely.
+
+Verify:
+
+- Remote URL.
+- DNS.
+- Network reachability.
+- HTTPS connectivity.
+- TLS validation.
+- Git authentication, if reached.
+- Local/remote branch divergence.
+
+If the remote becomes available, perform a normal push of the authorised development branch.
+
+Verify remote HEAD equals the intended local commit.
+
+Do not force-push.
+
+Do not disable TLS verification.
+
+Do not expose tokens or credentials.
+
+If connectivity remains unavailable:
+
+- Preserve all local commits.
+- Record precise diagnostics.
+- Mark Git publication BLOCKED.
+- Provide exact operator actions.
+- Do not declare the remote branch published.
+
+A pending or failed push must be represented accurately in the automation handoff.
+
+Do not let the orchestrator silently assume that a local commit exists remotely.
+
+Also inspect the separately completed GJ-00 planning branch's publication status without merging or modifying it.
+
+---
+
+# 10. P10-HANDOFF-06 — Full regression baseline
+
+After bounded remediation, run the applicable regression suites.
+
+Include:
+
+- .NET backend.
+- React frontend.
+- Ordinary browser.
+- CV import browser journeys.
+- Real MariaDB integration.
+- RD21 concurrency and recovery.
+- Python sidecar.
+- Document extraction.
+- Queued processing.
+- Scheduled job enrichment.
+- CV Editor.
+- PDF fidelity.
+- Dashboard customisation.
+- Admin processing monitor.
+- Browser contracts.
+- TypeScript.
+- Lint.
+- Builds.
+- Security scans.
+- Existing functionality preservation.
+
+Use approved isolated environments.
+
+Record:
+
+- Commands.
+- Exit codes.
+- Environment details.
+- Passed/failed/skipped counts.
+- Test report paths.
+- Final commit.
+- Relevant test artifacts.
+- Any checks not run.
+
+Do not treat previously reported counts as newly executed evidence.
+
+Never weaken tests merely to achieve a green result.
+
+Ensure generated test reports are attributable to the specific tested commit.
+
+---
+
+# 11. P10-HANDOFF-07 — Define precise Phase 10 entry gates
+
+This is the most important orchestration requirement.
+
+Review the authoritative Phase 10 entry criteria.
+
+Separate all outstanding work into:
+
+### A. Mandatory Phase 10 blockers
+
+Issues that must be resolved before code cleanup can safely begin.
+
+### B. Permissible conditional-development deferrals
+
+Items that may remain outstanding during Phase 10 only where an existing approved acceptance rule permits it.
+
+### C. Production release blockers
+
+Issues that can be addressed later without invalidating Phase 10 development.
+
+### D. Future feature work
+
+Items belonging to the post-Phase-10 product roadmap.
+
+For every item include:
+
+- Stable ID.
+- Description.
+- Evidence.
+- Severity.
+- Relevant acceptance criterion.
+- Required action.
+- Blocking phase.
+- Responsible party.
+- Deferral authority, if any.
+- Current status.
+
+Do not infer that an item is deferrable simply because it is inconvenient.
+
+If a requirement is ambiguous or a conditional entry needs owner judgement, request approval rather than inventing permission.
+
+Do not require every production-only infrastructure issue to be resolved before non-production Phase 10 work unless the authoritative criteria actually require it.
+
+Likewise, do not advance with unresolved mandatory development-entry blockers.
+
+---
+
+# 12. P10-HANDOFF-08 — Machine-readable orchestration contract
+
+Produce structured artifacts for the AUTONOMOUS-ROADMAP-01 orchestrator.
+
+Place handoff documentation under:
+
+`docs/automation/handoffs/pre-phase10/`
+
+Use repository conventions where appropriate.
+
+Required artifacts:
+
+### `HANDOFF.md`
+
+Human-readable overview of the current accepted state and readiness.
+
+### `ACCEPTANCE.json`
+
+Machine-readable status.
+
+Include:
+
+- Schema version.
+- Workstream ID.
+- Source branch.
+- Local commit.
+- Verified remote commit, if available.
+- Worktree cleanliness.
+- Acceptance status.
+- Entry-gate status.
+- Test evidence references.
+- Unresolved blocker IDs.
+- Permissible deferrals.
+- Required owner approvals.
+- Generation timestamp.
+- Recommendation for Phase 10.
+
+### `GATES.json`
+
+Define stage-specific gate requirements, including:
+
+- Required predecessor.
+- Required test suites.
+- Minimum acceptable evidence.
+- Required Git state.
+- Required preservation checks.
+- Required manual approvals.
+- Permissible conditional deferrals.
+- Blocking findings.
+
+### `BLOCKERS.json`
+
+Structured unresolved-issue register.
+
+### `TEST_EVIDENCE.json`
+
+Index machine-verifiable test results and report artifacts.
+
+Include commit binding and actual process exit codes.
+
+### `MANUAL_ACCEPTANCE.md`
+
+Prioritised human test and approval checklist.
+
+### `PHASE10_BASELINE.md`
+
+Exact branch and commit ancestry, preservation scope, safe cleanup targets and required compatibility checks.
+
+### `READY_TO_RUN.md`
+
+Exact conditions required to start automated Phase 10.
+
+### `HANDOFF_SCHEMA.json`
+
+JSON Schema for the exported acceptance package.
+
+Validate all structured JSON.
+
+Use stable keys and explicit status enums.
+
+Do not include secrets, personal data or machine-specific credentials.
+
+Absolute local paths may be included as informational references, but prefer repository-relative paths for portable automation.
+
+---
+
+# 13. Critical acceptance-security rule
+
+The handoff package is evidence, not authority by itself.
+
+A Codex-generated `ACCEPTANCE.json` must not be able to bypass a gate simply by claiming:
+
+`"status": "GO"`
+
+The orchestrator must independently verify:
+
+- Required report existence.
+- Test exit codes.
+- Commit correspondence.
+- Remote publication.
+- Accepted predecessor stages.
+- Mandatory blocker status.
+- Applicable owner approvals.
+
+Owner approvals must be maintained outside the model-writable repository or through another protected approval mechanism.
+
+Do not generate approval tokens or owner signatures.
+
+Do not mark human acceptance PASS without actual approval evidence.
+
+If the external orchestrator already defines an acceptance schema, conform to it where compatible rather than creating a conflicting parallel standard.
+
+If it is still under development, produce a clearly versioned proposed contract and document the integration requirements.
+
+---
+
+# 14. P10-HANDOFF-09 — Phase 10 cleanup inventory
+
+Prepare the scope for the actual Phase 10 task.
+
+Identify proven superseded components and code.
+
+Include:
+
+- Legacy CV Editor components.
+- Old CV import components.
+- Replaced dashboard layout configuration.
+- Superseded admin-processing views.
+- Unused style utilities.
+- Duplicate services.
+- Unreferenced frontend routes.
+- Obsolete feature flags.
+- Potentially unused dependencies.
+- Historical compatibility components that must remain.
+- Database code with active compatibility requirements.
+
+For every proposed removal include:
+
+- Location.
+- Why it appears obsolete.
+- Evidence of actual replacement.
+- Current consumers.
+- Dynamic/runtime reference risks.
+- Related preservation group.
+- Required regression test.
+- Removal risk.
+
+Do not remove these items as part of the handoff.
+
+Do not delete old PDF renderers, document mappings or migrations solely because newer implementations exist.
+
+Do not retire SQLite automatically.
+
+Do not perform MariaDB major-version upgrades.
+
+Phase 10 will make removal decisions using this evidence.
+
+---
+
+# 15. P10-HANDOFF-10 — Reconcile the remaining roadmap
+
+The automation queue after Phase 10 is intended to contain:
+
+05 — Phase 10 final redesign cleanup.
+
+06 — PRODUCT-REVIEW-01 full application review.
+
+07 — INT-GLOBAL-JOBS-01 international, cross-industry job discovery.
+
+08 — I18N-01 expanded translations and locale qualification.
+
+09 — LAUNCH-SITE-01 multilingual homepage redesign.
+
+10 — SECURITY-AUDIT-01 adversarial audit and remediation.
+
+11 — RELEASE-READINESS-01 production qualification.
+
+Also preserve separate tracked initiatives:
+
+- Deferred P5-13 AI qualification and model assessment.
+- LinkedIn integration feasibility.
+- Android application.
+- SQLite retirement.
+- MariaDB upgrade strategy.
+- Monitoring and operational improvements.
+- Future country integrations.
+
+These initiatives must not be silently discarded simply because they aren't numbered 05–11.
+
+Highlight the dependencies:
+
+- Global Job Search depends on approved planning and provider permissions.
+- Internationalisation overlaps with Global Job Search and homepage work.
+- Product Review requires owner approval before starting its resulting implementation scope.
+- Homepage final visual design requires owner approval.
+- Production requires independent security, backup, recovery and release approval.
+
+Create an automation-friendly roadmap summary without starting any later workstream.
+
+---
+
+# 16. Autonomous execution checkpoints
+
+Execute safely in this order:
+
+### AUTO-H01 — Baseline and acceptance reconciliation
+Read the reports, verify actual Git state and establish existing evidence.
+
+### AUTO-H02 — Targeted defect remediation
+Fix bounded confirmed pre-Phase-10 defects.
+
+### AUTO-H03 — PDF and AI qualification
+Complete permitted verification and document remaining blocked items.
+
+### AUTO-H04 — Manual acceptance preparation
+Produce focused human test packages and record genuine approvals.
+
+### AUTO-H05 — Git publication recovery
+Publish pending development commits if the remote is available.
+
+### AUTO-H06 — Full regression
+Establish commit-bound verification evidence.
+
+### AUTO-H07 — Structured automation handoff
+Produce and validate schemas, gates, blocker registers and evidence manifests.
+
+### AUTO-H08 — Phase 10 readiness
+Determine the actual acceptance decision and exact automation prerequisites.
+
+Commit and push validated checkpoints.
+
+If the remote is unavailable, continue safe independent work and preserve commits locally.
+
+Do not claim remote publication when it is unverified.
+
+---
+
+# 17. Required final decisions
+
+Issue independent verdicts for:
+
+**Pre-Phase-10 UX:** GO / CONDITIONAL GO / NO-GO.
+
+**CV Integration:** GO / CONDITIONAL GO / NO-GO.
+
+**PDF Spacing:** PASS / PARTIAL / FAIL.
+
+**CV AI Accuracy:** PASS / PARTIAL / BLOCKED.
+
+**Human/Device Acceptance:** PASS / PARTIAL / NOT TESTED.
+
+**Python Security:** PASS / CONDITIONAL / BLOCKED.
+
+**Hosted CI:** PASS / BLOCKED / FAIL.
+
+**Preservation:** PASS / PARTIAL / FAIL.
+
+**Git Publication:** VERIFIED / BLOCKED.
+
+**Phase 10 Development Readiness:** GO / CONDITIONAL GO / NO-GO.
+
+**Automation Handoff Package:** READY / INCOMPLETE.
+
+**Production:** GO / NO-GO.
+
+Every verdict must cite actual supporting evidence.
+
+Distinguish implementation completion from acceptance, deployment and release readiness.
+
+---
+
+# 18. Final report
+
+At completion, report:
+
+1. Current branch and final commit.
+2. Working-tree status.
+3. Remote publication state.
+4. Defects fixed.
+5. Tests executed and actual totals.
+6. Outstanding mandatory blockers.
+7. Permitted deferrals.
+8. Human actions required.
+9. Automation handoff artifacts created.
+10. Acceptance schema validation result.
+11. Phase 10 entry decision.
+12. Exact integration baseline for the orchestrator.
+13. Whether the orchestrator may start automatically.
+14. What it must verify independently before doing so.
+
+If Phase 10 receives an authoritative GO or approved CONDITIONAL GO, mark the handoff eligible for orchestration.
+
+However, **do not actually begin Phase 10**.
+
+If required conditions remain outstanding, mark the stage BLOCKED and state exactly how it can become READY.
+
+---
+
+# 19. Hard restrictions
+
+Do not:
+
+- Merge into `main`.
+- Deploy production.
+- Start Phase 10.
+- Start Global Job Search.
+- Start the Product Review.
+- Modify the separate automation worktree.
+- Fabricate owner approval.
+- Self-approve acceptance exceptions.
+- Bypass Python security qualifications.
+- Modify live Ollama.
+- Download unapproved production models.
+- Change production MariaDB.
+- Perform destructive database migrations.
+- Modify production Docker services.
+- Modify or repair production filesystems.
+- Remove compatibility code prematurely.
+- Lower test requirements to achieve a GO.
+
+Do not introduce unnecessary changes that disrupt the locally running `jobbjakt.local` environment.
+
+If a test requires destructive operations, use a disposable database or isolated test environment.
+
+---
+
+# FINAL INSTRUCTION
+
+Starting from the real current Pre-Phase-10 acceptance state, complete all safely achievable outstanding acceptance and remediation work.
+
+Restore Git publication where possible.
+
+Prepare a **machine-readable, independently verifiable Phase 10 handoff** suitable for AUTONOMOUS-ROADMAP-01.
+
+Make the handoff robust enough that the orchestrator can identify:
+
+- What has passed.
+- What is blocked.
+- What may be deferred.
+- Which human approvals are required.
+- Which exact commit forms the accepted baseline.
+- Whether Phase 10 may begin.
+
+Work autonomously, commit and push validated checkpoints, and prepare all necessary documentation.
+
+**STOP after the final handoff report. Do not start Phase 10, merge into main or deploy production.**

docs/automation/handoffs/pre-phase10/ROADMAP.md

@@ -0,0 +1,17 @@
+# Roadmap contract projection
+
+Read from committed codex/autonomous-roadmap-01 policy only. This projection is not a second queue, does not configure execution and does not authorise any stage. The external controller must reconcile its immutable manifest with the final published handoff commit and obtain protected approvals. All current deferrableGates arrays are empty; a conditional status alone cannot advance.
+
+| Sequence / stage | Required predecessor | Additional authority before implementation/advancement |
+|---|---|---|
+|05 PHASE-10 | Finished pre-Phase10 evidence and exact published baseline | phase10-development-entry; exact unused candidate/consumer/inventory/rollback proof; qualified native sandbox and actual stage test adapter; signed stage-requirements-review. No cleanup started here |
+|06 PRODUCT-REVIEW-01 | Accepted Phase10 | Independent review/ranked proposals, then product-ranked-scope approval before resulting implementation scope |
+|07 INT-GLOBAL-JOBS-01 | Accepted Product Review, reviewed GJ-00 planning | global-jobs-implementation, product-ranked-scope; provider-licences-and-display-rights before provider checkpoint. Never infer scraping/content rights from technical reachability |
+|08 I18N-01 | Accepted Global Jobs | i18n-scope and later human-linguistic-and-market-qualification; coordinate locale/geography/taxonomy and marketing catalogs. Drafts do not enable public locales |
+|09 LAUNCH-SITE-01 | Accepted I18N | Four actual design concepts/research, owner homepage-design-selection before implementation, preserved revision feedback; no model-selected final design |
+|10 SECURITY-AUDIT-01 | Accepted homepage | security-test-environment-and-scope, isolated-adversarial-targets, significant scanner cost approval where applicable, material-security-findings-disposition and stage review |
+|11 RELEASE-READINESS-01 | Accepted security audit | Independent backup/restore/recovery/deployed/security/provider/manual evidence, release-evidence-review and stage review. Recommendation only; this queue has no main merge/deploy stage |
+
+Separately retained initiatives: P5-13/C11 deferred AI model assessment and semantic qualification; LinkedIn feasibility; Android application; staged SQLite retirement; MariaDB upgrade strategy; monitoring/operational improvement; future country integrations. These are tracked future work, not silently completed, deleted or smuggled into cleanup. No MariaDB major upgrade or SQLite retirement is authorised here.
+
+GJ-00 branch planning/int-global-jobs-00 is independently published at0ec9f98e6ed4a646fc5e017d8eb6fade07653f37; it diverges from the later pre-Phase10 integration history. Do not blindly cherry-pick/merge its planning commit. Future authorised integration must reconcile its documents against the accepted current development source and provider evidence freshness, preserving every completed workstream.

docs/automation/handoffs/pre-phase10/verify_git.py

@@ -0,0 +1,65 @@
+"""Bounded read-only Gitea diagnostics; credentials remain in Git's configured helper."""
+import datetime
+import json
+from pathlib import Path
+import socket
+import ssl
+import subprocess
+import urllib.error
+import urllib.request
+
+
+def main():
+    import argparse
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output', required=True, type=Path)
+    args = parser.parse_args()
+    assert not args.output.exists(), 'Preserve earlier observations'
+    def git(*command):
+        result = subprocess.run(['rtk', 'proxy', 'git', *command], text=True, capture_output=True, timeout=45)
+        return result
+    url = git('remote', 'get-url', 'origin').stdout.strip()
+    assert url == 'https://git.cesnimda.uk/cesnimda/jobtrackingapp.git'
+    record = dict(observedUtc=datetime.datetime.now(datetime.timezone.utc).isoformat(), remote=url,
+                  localCommit=git('rev-parse', 'HEAD').stdout.strip(), tlsVerificationDisabled=False)
+    try:
+        addresses = sorted({item[4][0] for item in socket.getaddrinfo('git.cesnimda.uk', 443, type=socket.SOCK_STREAM)})
+        record['dns'] = dict(status='PASS', addresses=addresses)
+    except OSError as error:
+        record['dns'] = dict(status='BLOCKED', errorType=type(error).__name__)
+    try:
+        with socket.create_connection(('git.cesnimda.uk', 443), timeout=5):
+            record['tcp443'] = dict(status='PASS')
+    except OSError as error:
+        record['tcp443'] = dict(status='BLOCKED', errorType=type(error).__name__)
+    try:
+        with socket.create_connection(('git.cesnimda.uk', 443), timeout=5) as connection:
+            with ssl.create_default_context().wrap_socket(connection, server_hostname='git.cesnimda.uk') as secured:
+                record['tls'] = dict(status='PASS', protocol=secured.version(), certificateVerified=True)
+    except OSError as error:
+        record['tls'] = dict(status='BLOCKED', errorType=type(error).__name__, certificateVerified=False)
+    class NoRedirect(urllib.request.HTTPRedirectHandler):
+        def redirect_request(self, *unused):
+            return None
+    try:
+        with urllib.request.build_opener(NoRedirect()).open('https://git.cesnimda.uk/api/v1/version', timeout=6) as response:
+            record['https'] = dict(status='PASS', httpStatus=response.status)
+    except (OSError, urllib.error.URLError) as error:
+        record['https'] = dict(status='BLOCKED', errorType=type(error).__name__, httpStatus=getattr(error, 'code', None))
+    command = ['ls-remote', '--exit-code', 'origin', 'refs/heads/test/pre-phase10-ux-acceptance', 'refs/heads/planning/int-global-jobs-00']
+    try:
+        result = git(*command)
+        refs = dict(reversed(line.split()) for line in result.stdout.splitlines() if len(line.split()) == 2)
+        record['git'] = dict(argv=['git', *command], exitCode=result.returncode, refs=refs,
+                             authentication='REACHED' if result.returncode == 0 else 'NOT_ESTABLISHED')
+    except subprocess.TimeoutExpired:
+        record['git'] = dict(argv=['git', *command], exitCode=None, refs={}, authentication='NOT_ESTABLISHED', timeoutSeconds=45)
+    record['publication'] = 'VERIFIED' if record['git']['refs'].get('refs/heads/test/pre-phase10-ux-acceptance') == record['localCommit'] else 'BLOCKED'
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    args.output.write_text(json.dumps(record, indent=2) + '\n', encoding='utf-8')
+    print(json.dumps(record))
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())