cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(audit): reconcile baseline with verified release repair

Browse Source
This commit is contained in:
cesnimda
2026-09-10 00:19:23 +02:00
parent 68a371c8ed
commit 957fb5740f
3 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/redesign/audit/README.md
+1 -1
View File
@@ -87,6 +87,6 @@ The automated axe suite samples eight routes and largely waits for `body`/`main`
2. The full job workspace, canonical Career Profile, contextual AI review, CV history and adaptive mobile surfaces already exist. The redesign should improve coherence and discoverability.
3. Shared visual semantics and loaded-state accessibility coverage are weaker than the broad test count suggests. Fix foundations before whole-page migration.
4. Five local dashboard visibility switches are not the proposed configurable dashboard. Ordering, resizing and cross-device persistence are future scope requiring a bounded contract.
5. The known standalone TypeScript failure reproduces. The source baseline is documented, but release/production and unresolved integrity gates must not be called green by implication.
5. The known standalone TypeScript failure reproduced during the audit; subsequent authorized release repair `a861ca4` corrected its test-only assertion after patched Next made it build-blocking. Standalone tsc now passes; an explicit standalone CI gate remains outstanding. Release/production and unresolved integrity gates must not be called green by implication.
Next work is **Phase 2 — Functional baseline**, subject to the gates in [RISKS_AND_MIGRATION](RISKS_AND_MIGRATION.md). No Phase 2 code, B07, or redesign component changes were made here.
docs/redesign/audit/RISKS_AND_MIGRATION.md
+3 -3
View File
@@ -11,7 +11,7 @@ This report proposes the next steps; it does not authorize or implement Phase 2,
| Creation replay becomes easier through capture/dialog rerenders | Preview/duplicate warning and subsequent create are separate requests | Preserve current review flow; existing D04 creation-intent ticket is distinct from identity and record revision. No idempotency work in this audit |
| Route consolidation loses entry contracts | Two router layers, legacy `/applications/:id`, old section mappings, `?add`, notification/company deep links | Route manifest + redirect tests before moving navigation; keep capture and OAuth callbacks functional |
| New styling repeats existing contrast/focus defects | Validated F14 theme pair contrast; builder preview scroll-region transition | A01 semantic foreground/background/state colors, A02 preview structure, A03 loaded/manual verification before broad page work |
| Thin initial-state tests create false confidence | Eight-route axe sample; component API mocks; standalone TS2571 | Phase 2 loaded-interaction and type baseline; require feature-ledger evidence per migrated workflow |
| Thin initial-state tests create false confidence | Eight-route axe sample; component API mocks; historical TS2571 now corrected during release repair | Phase 2 loaded-interaction and explicit standalone type gate; require feature-ledger evidence per migrated workflow |
| CV/profile semantics blur in a unified editor | Canonical profile save versus CV override/settings and published slug | Clearly display source versus document override; test master unchanged, source selection, history, publish/unpublish and long PDF |
| AI presentation implies facts or silently applies changes | Contextual suggestions and extraction accept/discard already exist | Preserve preview/reject/apply and source/context metadata; prompt instructions alone do not prove factual accuracy |
| Draft/history/mail/package behavior lost in visual simplification | `ApplicationAssets` 769 lines, inbox 750, correspondence 747; separate persistence/attempt APIs | Extract by cohesive responsibility, not one generic form; keep conflict/send uncertainty, frozen package and unsaved guards |
@@ -28,7 +28,7 @@ Line counts come from the [source census](source-inventory.json); they are prior
## Recommended order
1. **Finish the authorized release attempt and retain the checkpoint.** Required CI and deploy preflight must pass before calling the changes live. Production F04 runtime/firewall/DNS/peer checks remain a separate closure gate. Audit/planning can continue without claiming Phase 0 stability.
2. **Phase 2 — Functional baseline.** Narrow TS2571 and add full type checking; trace preservation IDs to existing tests; add missing loaded workflow/route/AI-review tests. Preserve B01–B06 regression suites. Coordinate outstanding record-integrity and recovery tickets through their existing queue, without silently starting them here.
2. **Phase 2 — Functional baseline.** Add explicit standalone CI type checking (the TS2571 assertion was corrected separately in release repair `a861ca4`); trace preservation IDs to existing tests; add missing loaded workflow/route/AI-review tests. Preserve B01–B06 regression suites. Coordinate outstanding record-integrity and recovery tickets through their existing queue, without silently starting them here.
3. **Phase 3 — UX architecture.** Define grouped navigation, Jobs view switch, destination for embedded Documents/Analytics/Notifications, full-page/preview contract, contextual AI pattern and mobile workflow rules. Map every current route/feature to its destination and backward-compatible entry. Keep API contracts.
4. **Phase 4 — Shared foundations.** Use existing MUI/Emotion/theme system. Resolve proven semantic contrast and focus defects, then unify tokens, page/layout/state primitives, labelled fields, buttons, dialogs/drawers and tables. Avoid a speculative new design-system framework.
5. **Phase 5 — Representative migration.** Shell → Jobs table/board entry → full job workspace → CV editor; dashboard presentation can join after shell tokens stabilize. Preserve a data-rich populated example, empty/error/locked case, mobile and keyboard path for each. Do not modify editor save semantics concurrently with integrity work.
@@ -44,7 +44,7 @@ No router/state/styling dependency replacement is currently recommended. If a la
| Suggested future scope | Boundaries / expected proof | Parallel constraints |
|---|---|---|
| Type and baseline bookkeeping | One test payload narrowing, explicit type script/CI gate, known-failure classification | Independent of visual work; coordinate CI edits with deployment repair |
| Type and baseline bookkeeping | Preserve the corrected test assertion; explicit type script/CI gate, known-failure classification | Independent of visual work; coordinate CI edits with deployment repair |
| Route/preservation regression | Existing route helpers, full/overlay/capture navigation tests | Do not change router structure at the same time |
| Theme semantic contract | Central theme/MUI states + representative loaded contrast fixtures | Separate from backend; integrate before page styling |
| Builder focus contract | Actual preview container, viewport transition and keyboard scroll tests | Must not run concurrently with D01/editor save refactor |
docs/redesign/audit/TEST_INVENTORY.md
+3 -2
View File
@@ -32,15 +32,16 @@ The default browser suite currently contains **18 tests**. The nine special brow
| Fresh packaging regression at `23cc250` | Explicit installed .NET 9.0.317 SDK: Release build + **22/22 PDF admission tests** pass, then **915/915 selected backend tests** pass (same documented external-DNS IMAP exclusion). Results: `.artifacts/redesign-audit/backend.trx` |
| Actual CI push verification | Runs 736/737 exposed missing Compose/token prerequisites; corrected. Run 738 passed Compose/safety/extension/parser/API build, then exposed Linux PDF test-fixture packaging collision. Follow-up result belongs in [release log](../../audits/2026-09-07/validation/b06-completion.md#authorized-release-attempt-and-ci-prerequisite-correction) |
| Fresh Linux backend confirmation | Run 741, `2024c37`, passed **916/916 backend cases**, zero skipped, after test packaging/runtime-location and TLS EOF-or-no-read portability corrections. This includes the locally excluded DNS-dependent case. Application behavior and all security assertions remain protected; deployment has separate gates |
| Subsequent authorized release correction, `a861ca4` | Next 16.3.4/sharp 0.35.4/js-yaml 3.15.2 resolve three blocking dependency entries: installed npm audit **zero vulnerabilities**. Fresh **298 frontend / 18 browser** pass, plus **13 interview tests** after the test-only TS2571 correction. Standalone tsc, lint and production static build pass. Exact commands and failed-before evidence remain in the B06 release log; this is release repair, not a redesign implementation |
| Live/container boundary | Local Docker engine unavailable; F04 production evidence remains incomplete. No audit claim of real proxy-chain success |
The selected broader backend suite was repeated for the PDF fixture packaging change; the frontend suite was not repeated merely for documentation edits. Preserve the distinction between prior unchanged-source evidence, newly executed checks and actual CI failures. Run 739 subsequently failed earlier in the unchanged API compiler with `csc.dll` exit 139 on both existing attempts; it did not reach the corrected test-project build. No test gate was bypassed.
## Exact TypeScript root cause
[Interview test:120](../../../job-tracker-ui/src/interview-prep.test.tsx#L120) reads `.content` from `mockedApi.post.mock.calls[0][1]`. Axios's mocked generic request-data argument is typed `unknown`; the test dereferences it without narrowing. The runtime assertion can pass because Babel removes types. The production component's emitted behavior is not shown broken by this test diagnostic.
[Interview test:120](../../../job-tracker-ui/src/interview-prep.test.tsx#L120) originally read `.content` from `mockedApi.post.mock.calls[0][1]`. Axios's mocked generic request-data argument is typed `unknown`; the test dereferenced it without narrowing. The runtime assertion passed because Babel removes types. The production component's emitted behavior was not shown broken by this test diagnostic.
[tsconfig](../../../job-tracker-ui/tsconfig.json) includes `src`, including tests. CI runs Jest/lint/Next build but has no explicit full standalone `tsc --noEmit` gate. Next's successful build is not evidence that this exact standalone test-inclusive program passed. Phase 2 should narrow the test payload appropriately and introduce a deliberate full type gate. Do not weaken strictness, blanket-exclude tests or call this a P1 production outage. No type fix was made in Phase 1.
[tsconfig](../../../job-tracker-ui/tsconfig.json) includes `src`, including tests. CI runs Jest/lint/Next build but has no explicit full standalone `tsc --noEmit` gate. The patched Next 16.3.4 release build independently failed on this exact diagnostic. Authorized release repair `a861ca4` replaced the property dereference with an object matcher, retaining both positive prompt and negative invented-content assertions. Fresh standalone tsc, 13 interview tests and Next build now pass. The original Phase 1 reproduction above remains historical evidence. Phase 2 still needs a deliberate standalone CI gate; no strictness or test coverage was weakened.
## Missing regression proof before redesign