docs: publish PDF remediation and Phase 9 qualification evidence
This commit is contained in:
cesnimda
@@ -0,0 +1,84 @@
|
||||
# P9-REMED-02 — remediation and acceptance addendum
|
||||
|
||||
Date: 25 October 2026. Final local functional qualification is complete. Global automation and broader acceptance remain withheld as described below.
|
||||
|
||||
## Baseline and scope
|
||||
|
||||
Development branch `fix/p9-pdf-security-requalification` descends from accepted development checkpoint `3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28`, the RD21 repair and MariaDB standardisation history. Application source checkpoint is `b313e20bade4def9b8c23d32410278e0333d642c`; the final runtime manifest freezes 1,098 inputs. Documentation and qualification helpers are recorded separately. Main remains `5f835e54a9b74e6b71418422e28431b2af06453f`.
|
||||
|
||||
Historical reports remain intact. No production system, database, model, storage, workflow deployment, SQLite retirement, Phase 10, CV-UX-01 or CV-IMPORT-01 implementation was performed.
|
||||
|
||||
## Repairs and evidence
|
||||
|
||||
The original Linux environment substituted six DejaVu system faces for requested CV fonts. Eleven of the original 24 fixtures failed. Licensed, unmodified static fonts are now embedded at the shared renderer owner and published with their notices and source hashes. Stored template settings and revision contracts are preserved. Segoe UI, Georgia and Arial-family selections have explicitly disclosed portable substitutions. Existing frozen document bytes are not rewritten. See [pipeline](PDF_PIPELINE.md), [font packaging](FONT_PACKAGING.md) and [fixture-by-fixture evidence](PDF_REMEDIATION.md).
|
||||
|
||||
A variable-font investigation was rejected after actual PDF font descriptors exposed Type 3 metric problems. Static upstream fonts passed the unchanged original oracle: 16 fixtures/36 pages plus eight settings states/24 pages. Four independent representative reprints had identical glyph geometry and page pixels; changing PDF creation timestamps mean byte identity is not claimed. All 24 documents retained rendered text under the documented ligature/case/whitespace normalisation. These checkpoint results are separate from final successor runs.
|
||||
|
||||
The first complete browser attempt exposed a preview recovery defect: focus-triggered scrolling moved Retry by 190 pixels between pointer-down and pointer-up, preventing the native click and HTTP request. One guard at the existing focus owner preserves direct region scrolling while keeping focused child controls stationary. Unit and held-pointer browser regressions failed before the repair and passed afterward. The stale-draft fixture now observes actual PUT responses instead of racing the transient Save control; all persistence, history and recovery assertions remain. An unchanged admin matrix passed in isolation after a competing-load deadline failure. Failed predecessor reports remain available and are never counted as accepted final passes.
|
||||
|
||||
Five bounded Python upgrades change only Pillow, pypdf, certifi, urllib3 and setuptools among 49 pinned dependencies. Two parser regressions and actual authenticated sidecar startup/extraction preserve existing contracts. Sixty-five of 109 baseline advisory alias groups were remediated; the remaining filelock/Torch/Transformers findings require qualified compatible fixes or explicit risk disposition. Alias groups are not asserted to be independent exploits. No owner risk acceptance, model inference qualification or model download is implied. See [advisory inventory](security/ADVISORIES.md) and [remediation](security/REMEDIATION.md).
|
||||
|
||||
## Hosted CI
|
||||
|
||||
Historical run 853/job 1743 exited at its first isolation guard before checkout or MariaDB execution. Its job preparation showed host networking and a host Docker-socket bind. The fresh read-only metadata inspection confirms Gitea 1.26.0 and bounded visible run/runner metadata, but supplies no current live private-network/HostConfig proof. No new hosted database execution is claimed. A CLI installation would not establish safe daemon access. See [operator handoff](CI_ISOLATION.md) and [25 October metadata refresh](CI_REFRESH_2026-10-25.md).
|
||||
|
||||
Operator prerequisites remain a dedicated nonproduction runner, verified job/service private network, disposable MariaDB lifecycle, no job socket/privileged execution/public database port/persistent database data or production credentials, and success/failure/cancellation/crash cleanup evidence. The existing guard remains fail-closed. Local Docker results do not satisfy hosted acceptance.
|
||||
|
||||
## Final regression ledger
|
||||
|
||||
[Machine execution ledger](validation.json), [runtime source manifest](runtime-source.json), [qualification helpers](qualification-inputs.json) and [advisory refresh](security/final-refresh.json) retain actual identities and outcomes. There is no drift across1,098 runtime inputs and42 execution helpers. Final application source isb313e20; no product edit followed the freeze.
|
||||
|
||||
| Lane | Actual final outcome |
|
||||
| --- | --- |
|
||||
| Backend |1130 passed,0 failed/skipped |
|
||||
| Frontend |935 passed across105 suites,0 failed/pending/todo |
|
||||
| Ordinary browser |362 passed; exact discovery membership across98+87+88+89,0 retries/skips |
|
||||
| Six browser contracts |23 passed: AI2,auth2,rate9,ingress6,PDF admission1,preferences3 |
|
||||
| RD21 companions |6 passed; separate from real-provider totals |
|
||||
| Diagnostics / route matrix |18 passed, including33 routes across12 viewport/locale/theme combinations and bounded sustained fixture |
|
||||
| Volume / RD21 volume |3+3 passed, separate lanes |
|
||||
| Actual MariaDB12.2.2 |35 integration +1 browser recovery +2 HTTP observations passed; startup51 migrations, independent reads and teardown retained |
|
||||
| Linux producers |5 passed for original24 fixture states; supplemental2 passed separately |
|
||||
| Model-disabled sidecar |58 passed,0 skips; selected-model inference NOT TESTED |
|
||||
| PDF original corpora |Windows24/24 andLinux24/24; each16/36pages+8/24pages, unchanged oracle |
|
||||
| Supplemental PDF |2/2: minimalEN2pages,technicalNB8pages; all64skills and header/footer suppression |
|
||||
| Type checks / lint / production build |PASS |
|
||||
| Existing security helpers / audits |12 commands PASS, including secrets,SBOM,NuGet/npm and boundary guards; not Python risk acceptance |
|
||||
| Offline evidence guards |24 passed (12+2+2+8), separate from application totals |
|
||||
| Fifteen-minute MariaDB workload |PASS:900003ms,250jobs,8Career roles,2readers,3360reads/0failures,20navigations/0failures; p50=25.9ms,p95=36.5ms,p99=43.8ms,max=70.5ms |
|
||||
|
||||
The workload compares IDs, owner/deletion/tenant counts, canonical profile/revision, Identity projection and history count before/after, plus exact Board membership and profile HTTP reads. These are selected invariants, not a full database fingerprint, capacity SLA, production benchmark or server-CPU attribution. Host/Node/CDP resource samples are descriptive and retained. No competing qualification workload ran during its15minutes.
|
||||
|
||||
Failed predecessor95PASS/3FAIL ordinary shard, earlier934 frontend run, variable-font trial and failed obsolete-image repeat remain retained. Focused46-unit/6-browser checks, four pixel-identical reprints and parser-only Linux supplements are not added to complete-suite totals. Final successor suites have no hidden retries/skips. Reconciliation deliberately exits1 for `python-advisories:FINDINGS` and `hosted-mariadb:BLOCKED`; `localFunctionalComplete:true`, `automationComplete:false`.
|
||||
|
||||
The [renderer capsule](renderer-capsule.json) preserves exact local replay identity and full package/locale inventory. It is not a registry reference or database backup; nothing was uploaded/deployed. Source rebuilds with floating base/apt inputs require new qualification. [Cleanup](cleanup.json) verifies no generated test schemas remained, only the owned tmpfs test service was removed and the stopped persistent development container/volume were unchanged. Managed integration server logs are retained. The final shared-container collector retained stdout only; teardown warnings on stderr were observed in tool output, so that one file is not claimed as a complete stderr archive.
|
||||
|
||||
## Preservation and human acceptance
|
||||
|
||||
The [57-group reconciliation](PRESERVATION.md) preserves 56 PARTIAL statuses and C11 DEFERRED, plus all 33 supported routes. PARTIAL is neither automatic failure nor completion. No AI activation, deletion eligibility or semantic provider acceptance is invented. Null-as-inherit design settings, frozen document bytes, Career Profile ownership, revision and tenant boundaries remain required.
|
||||
|
||||
All M09-01–10 human cards remain NOT TESTED; [owner steps](MANUAL_ACCEPTANCE.md) separate screen-reader, keyboard, contrast, zoom, physical-device, Bokmål, print and provider checks. Automated axe, synthetic pointer tests and finite image inspection cannot close these human rows. REQUEST §6 permits unfinished genuine human checks to carry into release gates; missing production evidence alone does not veto isolated development qualification.
|
||||
|
||||
The [60-finding register](FINDINGS.md) retains each original criterion/source, owner, severity, evidence, dependency and closure requirement, with independent Phase 9, Phase 10, production and debt impacts. Creation-intent idempotency remains a separate contract concern; duplicate reminder reads remain documented debt. Neither is silently folded into RD21 stale-write closure.
|
||||
|
||||
## Decisions and remaining conditions
|
||||
|
||||
| Gate | Decision | Basis |
|
||||
| --- | --- | --- |
|
||||
| Linux PDF Fidelity |PASS |Original24 and supplemental2 pass in actual Linux; finite scope, no physical-print claim |
|
||||
| Python Security Advisories |BLOCKED |65 baseline alias groups remediated;44 remain acrossfilelock/Torch/Transformers; model/cache qualification and serious-risk disposition unclosed |
|
||||
| Hosted MariaDB CI |BLOCKED |No verified private runner/service lifecycle;0 hosted database cases |
|
||||
| RD21 |RESOLVED |Original six repair clauses remain satisfied within tested save/concurrency scope; creation idempotency separate |
|
||||
| Phase9 |NO-GO |Acceptance-risk judgment retains the unclosed selected-model/cache security qualification; local functional defects are repaired |
|
||||
| Phase10 Readiness |NO-GO |Independent route/caller/unused-code and functionality-inventory entry evidence remains unproven/unwaived; security risk disposition remains open |
|
||||
| Production |NO-GO |Task restrictions plus independent infrastructure, recovery, deployed identity/security, provider and human gates |
|
||||
|
||||
REQUEST §§9/13/14 call for individual investigation and transparent disposition, not a mechanical veto for every advisory. The model-loading/artifact and shared-cache uncertainty remains material after source-limited assessment; no serious residual risk is accepted on the owner's behalf. Missing production-only evidence and carried human checks do not independently create this Phase9 NO-GO. The final refresh has the same99 provider records/44 alias groups and metadata, plus the disclosed vendorPyPI404; no exact vendor result is fabricated.
|
||||
|
||||
Phase 10 requires the authoritative affected-test, functionality inventory and unused-code/caller evidence; no carry-forward waiver or permission to begin cleanup is inferred. CV-UX-01 remains withheld under the explicit mission instruction. A new feature must receive its own scope and authorisation after applicable entry conditions are satisfied.
|
||||
|
||||
The next development action is to qualify applicable filelock/Torch/Transformers fixes against an approved immutable model artifact, without an unapproved model download, then record per-advisory compatibility/reachability and any owner-only risk decision. Operator runner isolation and owner human acceptance can proceed independently.
|
||||
|
||||
## Publication
|
||||
|
||||
Checkpoint commits: `0554e27` (Python patches), `57dd883` (baseline evidence), `e80815f` (portable static fonts), `b313e20` (preview focus repair and regression fixtures). The evidence checkpoint is the Git commit containing this addendum; [publication ledger](publication.json) records checkpoint identities and verification procedure. Direct post-push HEAD/remote equality, clean tree, ancestry and unchanged main are recorded in the retained publication receipt and final delivery. No force-push, merge or deployment is authorised or performed.
|
||||
@@ -0,0 +1,30 @@
|
||||
# Hosted CI metadata refresh — 25 October 2026
|
||||
|
||||
**Hosted MariaDB CI remains BLOCKED.** This refresh establishes API availability and run metadata, not a newly inspected live runner configuration or a hosted database execution.
|
||||
|
||||
Observation: **2026-10-24T22:14:53.076535Z**, corresponding to **25 October2026 00:14:53 Europe/Paris (CEST)**. Existing Git credentials were used only in memory for bounded GET requests; credentials, headers and helper output are not retained. No job, runtime, build, browser, database, workflow or infrastructure operation was started or changed.
|
||||
|
||||
| Current API fact | Result |
|
||||
| --- | --- |
|
||||
| `/api/v1/version` | HTTP200, Gitea1.26.0 |
|
||||
| Repository metadata | HTTP200; existing credential reports repository admin/push/pull |
|
||||
| Repository runner listing | HTTP200; runner3 `pi-runner-1` remains listed offline, non-ephemeral, labels `ubuntu-latest`/`ubuntu-22.04` |
|
||||
| Instance-runner listing and `/user` | HTTP403; actual runner5 host/instance configuration remains inaccessible |
|
||||
| Latest-runs request | HTTP200; request limit100 returned50 rows, newest observed run853 at3727a72 |
|
||||
| Remediation-branch query | HTTP200, zero returned rows for `fix/p9-pdf-security-requalification`; none of the50 observed latest rows matches that branch |
|
||||
| Latest observed job metadata | Run853/job1743: runner5 `Live-Runner`, completed/failure,24October16:33:16–16:33:23UTC |
|
||||
| Previous observed job metadata | Run852/job1742: same runner5, completed/failure,24October16:24:08–16:24:15UTC |
|
||||
|
||||
The branch query and observed latest window show **no accessible hosted run for the remediation branch**. This bounded read is not an exhaustive assertion about all historical runs or a guarantee that the provider honors every query parameter. Current `.gitea/workflows/mariadb-integration.yml` push filters retain only `codex/rd21-mariadb-standardisation` and `fix/p9-ci-and-requalification`; the remediation branch is excluded. Pull-request/manual triggers still exist. No new trigger or dispatch was added to manufacture another guard failure.
|
||||
|
||||
## Distinguishing old runtime proof from current metadata
|
||||
|
||||
The earlier [CI investigation](CI_ISOLATION.md) inspected the actual **24October run853 log**: reported runner v0.4.1, `node:20-bookworm`, effective merged host networking and host Docker-socket bind, non-privileged job; first isolation guard exited1 before checkout/SDK/MariaDB. Its SHA256 is `448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134`. That is retained historical runtime evidence at3727a72.
|
||||
|
||||
This25October refresh downloaded **metadata only**. It did not re-inspect live HostConfig, download a new runtime log, verify a daemon/host identity or observe private services. Therefore it does **not** claim that the live host configuration is unchanged merely because the latest visible run is unchanged. No new isolation or lifecycle proof is available, and no MariaDB test execution is established.
|
||||
|
||||
## Remaining exact handoff
|
||||
|
||||
The [operator implementation/verification plan](CI_ISOLATION.md#exact-operator-implementation-and-verification-handoff) remains the next action: dedicated nonproduction runner/daemon ownership; unique routing label and pinned supported binary/job image; effective private job/service networking; no job/service daemon socket, host networking, privilege, public database port or persistent database storage; least-privilege secret/token/PR trust and production egress separation; success/failure/cancel/interruption cleanup proof. Only after that evidence may a reviewed workflow/strict CI-service transport change enable actual pinned MariaDB12.2.2 execution.
|
||||
|
||||
Local MariaDB tests, an accessible API, unchanged run metadata, a runner label, or an expected guarded failure cannot satisfy hosted PASS. Production release/infrastructure gates and local RD21 closure remain independent. Sanitized values and hashes of these fresh metadata responses are recorded in [ci-refresh.json](ci-refresh.json); raw responses remain under `.artifacts/p9-remed-02/ci-refresh-20261025/`.
|
||||
@@ -17,6 +17,8 @@ The existing oracle checks actual independently rendered page images, extracted
|
||||
|
||||
Final local packaging image0d1cb44 has the same render-DLL SHA256 as qualified image98ccb723; only the standalone provenance manifest was completed. See raw image-lineage.json. These are local image identities, not asserted pullable registry manifest references. No image was pushed or deployed.
|
||||
|
||||
The separate long-skill producer uses `rtk proxy python docs/redesign/phase-9/p9-remed-02/linux-run.py representative-linux` in a fresh output directory. Then run `rtk proxy python docs/redesign/phase-9/p9-remed-02/representative/proof.py .artifacts/p9-remed-02/representative-linux`. The versioned proof command preserves the exact two-case corpus, records inputs before invoking the unchanged PDF oracle, verifies post-run hashes and content/header-footer assertions, and binds the retained result/report. It refuses to overwrite completed proof. Reconciliation requires that producer manifest and checks current hashes again. These two fixtures are separate from the original24 and ordinary362.
|
||||
|
||||
## Regression and security
|
||||
|
||||
Reuse [the full lane commands](../p9-requal-01/COMMANDS.md) with new `.artifacts/p9-remed-02/` outputs. Run backend and real provider tests before browser servers to avoid apphost locks. Finish frontend/type/lint/build before serial browser discovery and four zero-retry shards, then the six separate contracts, RD21/diagnostic/volume and isolated MariaDB browser/workload lanes. Do not add focused RED/GREEN checks to full totals. The first95/3 shard remains a failed predecessor, not accepted final execution.
|
||||
@@ -24,3 +26,7 @@ Reuse [the full lane commands](../p9-requal-01/COMMANDS.md) with new `.artifacts
|
||||
Python exact lock/patch commands and actual startup/parser limits are in [security remediation](security/REMEDIATION.md); all109 advisory dispositions remain in its inventory. No model download or inference is part of these commands. Existing security helpers, tracked-secret scan and SBOM are separate from advisory closure.
|
||||
|
||||
Remove only the owned disposable database service after all lanes, with the same Compose file/project/profile and `rm --stop --force mariadb-test`. Never use `down -v`, prune development data, expose a host daemon in a job or connect tests to production. Hosted execution remains blocked pending the [operator plan](CI_ISOLATION.md).
|
||||
|
||||
## Exact qualified renderer replay
|
||||
|
||||
The local-only [capsule manifest](renderer-capsule.json) records a377384960-byte image archive with SHA256 `9b98865b14305f97d13502f785fb88129e205229f42e8a6c8980f74f5664fba5`. Before loading, verify that hash, then use `rtk proxy docker image load --input .artifacts/p9-remed-02/renderer-capsule/qualified-renderer.tar` only in an isolated qualification engine. Both local tags resolve to imageID `sha256:0d1cb44ba8f71d54de77459915a7052b894191cfeb75aa32f0c1e7ffdc21fda6`. This is not a pullable registry manifest. The archive is ignored/local, never uploaded; obtain the retained approved artifact from its owner or rebuild and requalify. The complete Debian package/locale inventory is [retained](renderer-runtime-inventory.txt); fonts have their separate immutable source/hash manifest. Existing Dockerfile base/apt inputs float: a source rebuild must record its actual new runtime identity and repeat qualification. No production engine or data is involved.
|
||||
|
||||
@@ -0,0 +1,91 @@
|
||||
# P9-REMED-02 finding and independent gate register
|
||||
|
||||
Date:25 October2026. Baseline3727a72, branch `fix/p9-pdf-security-requalification`; checkpointb313e20. This successor retains all59 earlier findings and adds P9-REMED-PTR01. Historical acceptance reports remain unchanged. [findings.json](findings.json) retains each inherited criterion/source, status, severity, dependency, owner, evidence and exact closure requirement. It separately records the3727a72 status and current bounded assessment.
|
||||
|
||||
**Final local functional regression PASS**, source-bound in [validation.json](validation.json):1130 backend,935 frontend,362 ordinary browser,35 MariaDB and58 sidecar. Separate lanes remain separate. Python findings and hosted isolation keep global automation incomplete; the collector exits1 honestly. Original failed attempts remain retained.
|
||||
|
||||
## Current gate-driving changes
|
||||
|
||||
| Item | Verified checkpoint and current consequence |
|
||||
| --- | --- |
|
||||
| Linux PDF / P9-REQUAL-PDF01 | Baseline11/24 failures reproduced. Original unchanged oracle now16/16+8/8 PASS,36+24pages, with licensed static fonts. Final frozen-source Windows and Linux24/24 plus supplementalLinux2/2 PASS. |
|
||||
| Python / P9-REQUAL-SEC04 |65/109 baseline advisory alias groups remediated;44 remain individually assessed (filelock3,Torch19,Transformers22). Security **BLOCKED**, no owner risk acceptance. |
|
||||
| Hosted CI / RD05 | Historical run853 shows host-network/socket preparation, first-guard exit1 and no database execution; fresh metadata does not reverify live HostConfig. **BLOCKED** pending operator isolation and lifecycle proof. |
|
||||
| Preview recovery / P9-REMED-PTR01 | RAF moved Retry190px during held pointer, so no click/HTTP occurred. Minimal focus-owner repair has unit RED1/46GREEN and native4held-pointer+stale/admin6GREEN. Final935 frontend/362 browser PASS. |
|
||||
| RD21 | RESOLVED within original six save/concurrency requirements; final35 MariaDB tests,1 MariaDB recovery,2 HTTP observations and6 separate browser companions PASS. Creation-intent idempotency remains separate OPEN debt.
|
||||
| Human/provider/production | All human M09 cards remain NOT TESTED. Genuine checks carry into their explicit release gates; missing production infrastructure alone is not a development-phase veto. |
|
||||
|
||||
## Authoritative acceptance boundaries
|
||||
|
||||
[REQUEST §6](../REQUEST.md#6-accessibility-qualification) explicitly carries unfinished genuine human checks into release gates. PARTIAL is neither automatic failure nor completion. The remaining unclosed security risk is a Phase9 acceptance blocker requiring its own disposition; it is not a blanket rule that every advisory is exploitable. Final full-source local functional regression and output evidence now PASS; the security risk disposition remains separate.
|
||||
|
||||
[IMPLEMENTATION_PLAN Phase10](../../IMPLEMENTATION_PLAN.md#phase-10--cleanup) independently requires proof no route uses removed code, affected tests pass and the functionality inventory is satisfied. No unused-code census or cleanup permission is invented. Production TLS/backup/storage/rollback/deployed identity and live-provider gates retain separate owners. C11/P5-13 remains DEFERRED/withheld. Duplicate reminder reads and language metadata remain low documented debt; creation-intent idempotency needs a separate contract before implementation.
|
||||
|
||||
CV-UX-01 and CV-IMPORT-01 remain prohibited by this mission. No supplied authoritative entry rule permits overriding that explicit instruction, and no owner risk acceptance is implied. The final root addendum must name actual remaining conditions; neither a future conditional Phase9 recommendation nor automated fonts/axe checks automatically authorize a new feature project.
|
||||
|
||||
## Complete register
|
||||
|
||||
| ID | Current bounded status | Severity/impact | Phase9 | Phase10 | Production | Debt | Owner/required closure |
|
||||
| --- | --- | --- | --- | --- | --- | --- | --- |
|
||||
| RD01 | OPEN; local static/loopback ingress contracts only | High: wrong client identity or exposed ingress | operator release gate | candidate-specific ingress compatibility proof | BLOCKED pending actual ingress identity | open operational qualification | Release operator: actual TLS/IPv6/firewall/topology/trusted peer and deployed auth evidence |
|
||||
| RD02 | NOT TESTED: independently verified off-disk complete backup/restore | Critical if recovery needed: irreversible loss | no independent veto of isolated functional QA | candidate restore dependency | BLOCKED backup/restore | open operational qualification | Release operator: isolated restore of DB/files/CVs/keys/tombstones, hashes and recovery rehearsal |
|
||||
| RD03 | Fresh MariaDB12.2.2:35 integration cases,1 native recovery,2 HTTP cases and15-minute workload PASS; broader deployed parity remains PARTIAL. | High: schema/provider/startup disagreement | Local bounded provider qualification PASS; deployed parity remains independent. | provider migration proof per candidate | BLOCKED exact deployed parity/migrations | partial broad provider qualification | Database owner: actual approved MariaDB migration, restart, CRUD/constraints/concurrency and effective configuration proof |
|
||||
| RD04 | NOT TESTED: intended Linux rollback | High: failed release cannot be reversed | no independent veto of isolated functional QA | rollback proof per candidate | BLOCKED actual rollback | open operational qualification | Release operator: isolated failure/rollback rehearsal using complete prior images/configuration/recovery set |
|
||||
| RD05 | Hosted MariaDB BLOCKED: historical853/job1743 prepares host-network/socket job and exits first guard; fresh25October metadata has no new database run/private isolation proof. Live HostConfig not re-inspected. | High: healthy endpoint may serve wrong release | Hosted infrastructure qualification BLOCKED; no database test PASS/FAIL inferred. Assess independently from local provider closure. | Hosted evidence absent; independent affected testpass/unused-route/inventory criteria remain required. | BLOCKED deployed identity and operator diagnosis | open CI/release qualification | CI/operator owner: prove isolated private service execution and lifecycle without host socket/privileges/public ports/production coupling, then successful exact hosted TRX and cleanup. Keep workflow BLOCKED while isolation cannot be proven. Separate deployed runner/storage/release identity remains unqualified. |
|
||||
| RD06 | PARTIAL: finite axe/DOM/keyboard evidence; human checks open | High accessibility impact | manual carry-forward allowed only as explicit release qualification (REQUEST §6), no human PASS | affected functionality must remain satisfied; no deletion permission | BLOCKED applicable human accessibility | open human qualification | Accessibility tester: [M09-01–06](../p9-03/MANUAL_CHECKLIST.md), contextual contrast/reader evidence; triage every applicable incomplete |
|
||||
| RD07 | NOT TESTED: physical input/AT/alternate browsers/forced colors | Medium/High usability exclusion | manual carry-forward release qualification; no physical/AT PASS | affected functionality proof still required | BLOCKED supported device/browser/input acceptance | open human qualification | Product/accessibility owners: actual supported devices/browser/input versions and complete workflows |
|
||||
| RD08 | DEFERRED; no new model qualification or activation | High: unqualified proposal semantics | C11 explicitly withheld; separate scope | no activation/deletion eligibility | BLOCKED AI activation unless separately qualified | DEFERRED product/model scope | Separate AI qualification owner: production-equivalent identity/inference, original 366-call protocol, independent human semantics, review UI/integration evidence |
|
||||
| RD09 | Local withheld-operation contract retained; deployed withholding NOT TESTED | High: unreviewed AI write/external request | local withholding contract needs fresh successor | retain withholding and callers | BLOCKED deployed withholding untested | open deployment qualification | Release/AI owners: keep 503/no-provider/no-write guards, verify actual deployment independently |
|
||||
| RD10 | PARTIAL overall: final original Windows24/24 and Linux24/24 fixtures/60pages each PASS; supplemental Linux2/2 (2+8pages) PASS. Human/physical printing/deployed output NOT TESTED. | Medium/High document reliability | Current original Linux/Windows and supplemental output PASS; human physical-print qualifications remain release gates. | affected rendering must preserve output contracts | BLOCKED intended output environment | open output qualification | Document owner: intended Linux/fonts/photo/crop/print and alternate-browser proof, original bytes/geometry |
|
||||
| RD11 | Scoped SQLite bootstrap/WAL mechanism repaired before entry; broad reliability remains PARTIAL | High if preference save fails | scoped WAL repair retained; broad reliability qualification open | retain provider/concurrency safeguards | provider contention remains qualified | retained broader reliability | Database owner: retain held-reader/write proof, distinguish old reproduced mechanism from unproven provider/contention cases |
|
||||
| RD12 | PARTIAL: notification draft/failure recovery and SQLite tests; complete contention/provider behavior unqualified | Medium: settings may not persist | no newly established failure; provider overlap remains qualification | candidate must preserve drafts and recovery | intended-provider qualification open | retained reliability | Database/settings owners: intended-provider overlapping writes and failure/reload recovery with no data loss |
|
||||
| RD13 | Historical Rules 500 mechanism remains UNCONFIRMED | Medium: failed save/draft retention | historical causal mechanism UNCONFIRMED; not relabelled resolved | candidate must preserve Rules recovery | no complete reliability claim | unconfirmed historical observation | Rules/API owners: original failure trace plus controlled causal reproduction and successor regression; passing retry alone insufficient |
|
||||
| RD14 | Historical command/dialog focus incident remains UNCONFIRMED; settled drawer proof is a separate finite result | Medium/High keyboard access | historical causal mechanism UNCONFIRMED; human focus qualification | candidate must preserve trap/return/error states | applicable human checks open | unconfirmed historical observation | Shared UI owner: preserve original observations, reproduce affected modal transitions and actual reader/trap/return behavior |
|
||||
| RD15 | Historical intermittent CV section expansion cause unproven | Medium: editing disrupted | historical cause UNCONFIRMED; no invented current defect | candidate must preserve expansion state | broader reliability qualification | unconfirmed historical observation | CV owner: retain failed observation and reproduce causally before closing; do not weaken expansion assertions |
|
||||
| RD16 | Scoped company-error repair retained; wider reader/dialog/date contract PARTIAL | Medium: recovery/access | scoped repair historical PASS; broader human contract open | candidate-specific recovery proof | human/provider qualification open | partial preserved contract | Company/UI owners: native failed-save → retained draft → successful retry plus human dialogue checks |
|
||||
| RD17 | PARTIAL: prior exclusive15-minute MariaDB workload passed at3727a72; current remediation is not a new workload/capacity SLA. Independent bounded performance qualification retained. | Medium: growing rendering cost | Finite15-minute local MariaDB workload PASS; no capacity SLA. | measured bottleneck and full membership before optimization | no production capacity/SLA claim | O(N) known design limit | Jobs owner: agreed budget, bounded sustained profile and CPU/frame attribution before optimization; preserve full membership |
|
||||
| RD18 | NOT TESTED: physical drag/drop/cancel/browser variants | Medium access/workflow risk | manual carry-forward release qualification; physical behavior not passed | retain accessible reorder alternatives | BLOCKED physical input variants | open device qualification | Input/device tester: real Board/CV selection and named alternatives, no hidden result cap |
|
||||
| RD19 | DEFERRED: reviewed `followMode` consumer | Medium workflow limitation | accepted deferred reviewed consumer; no activation | ineligible to remove metadata/paths | separate activation gate | DEFERRED product scope | Product/mail owner: separate explicit mode→review/action/fallback design; no auto-send or uncertain resend |
|
||||
| RD20 | Optional P5-05 quick preview DEFERRED; Phase 8 Dashboard scope was delivered separately | Low optional scope | optional preview DEFERRED; full workspace retained | no deletion of full workspace/aliases | no independent veto while optional scope remains deferred | DEFERRED optional scope | Product owner: explicit separate brief; retain existing full workspace and all routes |
|
||||
| RD21 | RESOLVED within original six save/concurrency requirements; final35 MariaDB tests,1 MariaDB recovery,2 HTTP observations and6 separate browser companions PASS. Creation-intent idempotency remains separate OPEN debt. | High: stale editor can overwrite acknowledged edits | Original six save/concurrency requirements RESOLVED in tested scope; separate creation debt retained. | no compatibility removal without all-caller/rollback proof | BLOCKED deployment/rollback parity; no historical recovery claim | creation-intent idempotency OPEN, separate concern | Domain/API/UI owners: separate bounded contract issue covering both callers, server compare-and-swap/transaction semantics, conflict recovery and backward compatibility; characterization is not safety acceptance |
|
||||
| RD22 | NOT TESTED: enabled-worker outage recovery/durability | High: duplicate/lost async work | isolated fixtures do not accept enabled producer | retain stable IDs and recovery paths | BLOCKED enabled-worker recovery | open operational qualification | Worker owner: isolated enabled-producer failure/restart/recovery, no-loss/no-duplicate proof before activation |
|
||||
| RD23 | OPEN: actual calendar offset/DST/date-only semantics | Medium: wrong event time | actual offset/DST/date-only unqualified | retain calendar semantics until dedicated proof | BLOCKED calendar activation qualification | open provider semantics | Calendar owner: dedicated boundary/DST/provider proof in authorised sandbox before semantic changes |
|
||||
| RD24 | NOT TESTED: billing/deletion/retention/provider cleanup policy and configuration | High privacy/lifecycle impact | policy and destructive lifecycle outside functional proof | no removal without approved lifecycle policy | BLOCKED policy/restore/provider cleanup | open policy qualification | Product/security/operator owners: approved policy, explicit destructive-action authority, isolated recovery/cleanup proof |
|
||||
| RD25 | PARTIAL: local SMTP/HTTP/provider contracts; actual OAuth/Turnstile/mail/calendar/model unavailable | High identity/privacy/delivery impact | sandbox/provider qualifications remain; fixtures do not pass them | candidate must preserve auth/delivery contracts | BLOCKED applicable real provider evidence | open provider qualification | Approved provider/human tester: sandbox consent/revoke/reconnect/origin/state/delivery/uncertain-attempt proof |
|
||||
| RD26 | Legacy Job/Application cutover OPEN | High compatibility/data loss if removed | no legacy cutover authorized | BLOCKED deletion until expand/verify/contract and all readers/writers | BLOCKED unqualified cutover | open migration scope | Migration owner: expand/verify/contract, restore/rollback and all readers/writers/aliases before removal |
|
||||
| RD27 | NOT TESTED: actual monitoring/alert/recovery coverage | High operational detection risk | no independent veto of isolated functional QA | candidate observability proof where affected | BLOCKED actual alert/recovery | open operational qualification | Operations owner: effective sink, alert trigger, responder/runbook and recovery observations |
|
||||
| RD28 | Ongoing evidence/provenance obligation | High if failures are misrepresented | fresh exact evidence and source binding required | required exact candidate evidence | required exact deployment evidence | ongoing obligation | QA owner: exact source hashes/counts, original failures, no retries/skips/assertion relaxation; separate characterization from safe behavior |
|
||||
| P9-OPS-01 | Previously reported EXT4/Docker storage errors UNRECHECKED | Critical if disk faults persist | not a standalone functional defect; retain stated qualification | no permission to delete; affected-candidate proof | BLOCKED until stated operator closure | retained gate | Production operator only: independent storage-health/repair and recovery qualification under separate authority |
|
||||
| P9-SEC-01 | BLOCKED: five exact compatible/parser pins remove65/109 baseline advisory alias groups;44 remain (filelock3,Torch19,Transformers22), individually assessed without owner risk acceptance. Full model-runtime qualification unavailable. | High dependency risk until assessed | BLOCKER by acceptance-risk judgment under REQUEST9/13/14: selected-model/cache applicability and compatible fixes remain unqualified; not an automatic veto for every advisory. No owner risk waiver. | Unwaived security uncertainty and affected functionality/testpass criteria remain; no cleanup authority. | BLOCKED independent deployed dependencies/model integrity, active parser exposure and release review; local repairs are not deployed. | Remaining serious uncertainty is not accepted optional debt. Individual source-limited assessments remain visible. | Security/sidecar owners: complete narrowly scoped filelock cache/protocol compatibility work, select a patched compatible CPU Torch/Transformers graph, verify immutable model/checkpoint identities and startup/inference/extraction contracts in an approved environment; serious residual risk requires explicit owner disposition. No automatic waiver, model change/download or production action. |
|
||||
| P9-PUB-01 | Remediation checkpoints normally published throughb313e20 as reported in execution ledger; final commit/remote/clean-tree verification remains root publication responsibility. | Resolved for published checkpoint; final commit still needs its own direct equality proof | not a standalone functional defect; retain stated qualification | no permission to delete; affected-candidate proof | BLOCKED until stated operator closure | retained gate | QA: retain failed attempts and verify each subsequent normal push; no force push |
|
||||
| P9-T01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Medium test reliability: parser descendant test could time out before it had a descendant | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | Resolved in tested Windows environment; Linux run remains separate. | QA; `.artifacts/phase9/sidecar-entry-failed.*`, `sidecar-fixture-red.*`, `sidecar-fixture-green.*`, `sidecar.xml` |
|
||||
| P9-L01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Low localisation defect: Admin grid vendor controls appear in English in Bokmål | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | Resolved in observed local integration; no authorisation, pagination or data contract change. | Frontend; `admin-users-page.test.tsx`, `AdminUsersPage.tsx`; retained RED/GREEN logs/JSON |
|
||||
| P9-V01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Medium visual defect: wrapped public h2 lines overlap at320px in EN/NB | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | Bounded fix verified by native geometry/build; the complete final 362-case ordinary successor also passed. | Frontend; `LandingPage.tsx`, new `landing-presentation.spec.ts`; `landing-red`, `landing-qualified`, `landing-accepted` raw reports |
|
||||
| P9-V02 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Medium visual defect: wrapped bottom CTA title lines overlapped | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | bounded CTA repair separate from P9-V01 four-h2 repair | Frontend/QA: preserve existing LandingPage lineHeight1.4 and exact CTA+heading geometry assertions; qualify fresh complete landing and ordinary successors on frozen source, retain original RED/GREEN evidence and native-width images |
|
||||
| P9-L02 | RETAINED low development debt | Low linguistic residual: stored event type `Created` appears in Bokmål job history/audit | nonblocking development debt with visible limit | candidate proof only; no cleanup authority | does not clear independent release gates | Retained nonblocking development qualification; no data mutation proposed. | UI/localisation owner; separately map known event enums with unknown-value fallback and history/audit tests; human wording review |
|
||||
| P9-T02 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Low test compatibility: existing Admin pagination fixture hard-coded the English vendor accessible name in Bokmål mode | fresh affected regression required | candidate proof only; no cleanup authority | does not clear independent release gates | Test-only repair; no product or authorisation change. | QA; `phase7-admin-users.spec.ts`; original shard report/trace and `admin-grid-green` retained. Other English-name callers belong to the separate English JobTable owner and remain unchanged. |
|
||||
| P9-PERF-01 | RETAINED low development debt | Low duplicate report work: shell and Dashboard each initially read reminders | nonblocking development debt with visible limit | candidate proof only; no cleanup authority | does not clear independent release gates | Accepted existing development debt; no Phase 10 implementation here. | Shared reminder read owner; measured benefit and independent shell/dashboard failure/loading tests before consolidation. |
|
||||
| P9-T03 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | High test isolation | fresh exact fixture/case successor | preserve isolation and assertions | not enabled-worker acceptance | no product fix inferred | QA: retain failed run, unchanged no-write assertions, fixture config delta and fresh full successor |
|
||||
| M09-01 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Names, roles, values, selected state, headings, reading order and errors are understandable; retain reader/version and spoken observations. No hidden background content is announced. |
|
||||
| M09-02 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Visible focus, logical order, genuine traps only while modal, Escape and focus restoration; no off-screen/hidden tab stops. Record any transition-specific failure. |
|
||||
| M09-03 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Each action/position/save/error announces once and agrees with visible DOM order; pointer drag has an equivalent keyboard route. |
|
||||
| M09-04 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Applicable normal text ≥4.5:1, large text ≥3:1 and necessary UI boundaries/focus ≥3:1. Record sampled colors/ratios/state. An axe incomplete is not sufficient to close the row. |
|
||||
| M09-05 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Invisible zero badge is absent from announcements; live unread count remains meaningful; closed drawer is neither read nor tabbable. Runtime DOM checks cover only the tested states. |
|
||||
| M09-06 | NOT TESTED | High accessibility qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | accessibility tester Essential controls remain reachable/readable, no lost content or focus; distinguish intentional table/document scrollers from root clipping. Preserve fixed A4/Letter geometry. |
|
||||
| M09-07 | NOT TESTED | Medium/High human/provider/output qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | product owner with physical devices No keyboard-obscured primary action/data loss; reachable touch targets, no accidental destructive action; record device/input mode. Emulated touch does not close this. |
|
||||
| M09-08 | NOT TESTED | Medium/High human/provider/output qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | Bokmål reviewer Natural professional Bokmål, consistent established terms, meaningful messages. Separate authored English content, technical names and provider strings from untranslated application copy. |
|
||||
| M09-09 | NOT TESTED | Medium/High human/provider/output qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | document reviewer Legible fonts, intact glyphs/diacritics, margins, page boundaries, searchable text, photo/crop, correct language/date output and no missing/duplicated content. Retain original bytes, renderer/font versions and print observations. |
|
||||
| M09-10 | NOT TESTED | Medium/High human/provider/output qualification | explicit carry-forward qualification under REQUEST §6; no human result inferred | affected functionality proof required; no deletion authority | BLOCKED until applicable genuine human/provider evidence | open qualification | approved provider tester Correlated origin/state, explicit confirmation, no accidental resend, correct ownership/timezone. Local SMTP/HTTP fixtures do not close external-provider qualification. |
|
||||
| P9-AX-01 | Requires manual inspection | Accessibility qualification; incomplete is not a confirmed violation | carry exact applicable manual qualification; no violation or human PASS inferred | retain accessible functionality; affected-candidate proof required | applicable manual evidence required | human qualification; do not count repeated occurrences as unique defects | Accessibility tester Shared Dashboard drawer settled predicate, Escape focus and24Tab proof pass. Original Analytics transition cause is not proven; human reader/transition qualification remains. |
|
||||
| P9-AX-02 | Requires manual inspection | Accessibility qualification; incomplete is not a confirmed violation | carry exact applicable manual qualification; no violation or human PASS inferred | retain accessible functionality; affected-candidate proof required | applicable manual evidence required | human qualification; do not count repeated occurrences as unique defects | Accessibility tester Contextual foreground/background measurement remains required. |
|
||||
| P9-AX-03 | Requires manual inspection | Accessibility qualification; incomplete is not a confirmed violation | carry exact applicable manual qualification; no violation or human PASS inferred | retain accessible functionality; affected-candidate proof required | applicable manual evidence required | human qualification; do not count repeated occurrences as unique defects | Accessibility tester Contextual foreground/background measurement remains required. |
|
||||
| P9-AX-04 | Not applicable in tested settled hidden state | Accessibility qualification; incomplete is not a confirmed violation | carry exact applicable manual qualification; no violation or human PASS inferred | retain accessible functionality; affected-candidate proof required | historical zero-state not applicable; live reader state still open | human qualification; do not count repeated occurrences as unique defects | Accessibility tester Four current native EN/NB theme vectors: aria-hidden=true and zero area. Actual reader/live unread-state remains separate. |
|
||||
| P9-REQUAL-SEC01 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | High GHSA-846f-f764-76mx SignedCms CPU exhaustion; Moderate GHSA-2fmv-rv2c-59x7 Windows EnvelopedCms behavior. Vulnerable package presence established; application reachability/exploit not claimed. | Bounded compatible repair and affected regression PASS; independent Python gate remains open. | testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority | NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained | published vulnerable package version repaired locally; remaining evidence qualification | Dependency/QA owner: Direct compatible package override System.Security.Cryptography.Pkcs8.0.2; retain MimeKit4.17.0 ownership. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
|
||||
| P9-REQUAL-SEC02 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | Critical package advisories GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r and GHSA-673q-mjm6-r5xr. Vulnerable package presence is distinct from reachable deployed paths; no application exploit claimed. | Bounded compatible repair and affected regression PASS; independent Python gate remains open. | testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority | NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained | published vulnerable package version repaired locally; remaining evidence qualification | Dependency/QA owner: Pin Next and eslint-config-next exactly16.4.1. Existing static export, unoptimized images and Sharp0.35.5 mitigate the image-serving path; they do not close every package advisory. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
|
||||
| P9-REQUAL-SEC03 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | High GHSA-mrhx-c7xc-m3w5 in development dependency graph. No production application reachability/exploit claimed. | Bounded compatible repair and affected regression PASS; independent Python gate remains open. | testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority | NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained | published vulnerable package version repaired locally; remaining evidence qualification | Dependency/QA owner: Use compatible existing ^4 dependency range via Zod4.6.6 override; do not add runtime functionality. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
|
||||
| P9-REQUAL-SEC04 | BLOCKED: five exact compatible/parser pins remove65/109 baseline advisory alias groups;44 remain (filelock3,Torch19,Transformers22), individually assessed without owner risk acceptance. Full model-runtime qualification unavailable. | Critical/high provider labels include source-limited model/cache applicability uncertainty; not44 confirmed exploits. One exact vendor PyPI query404 disclosed. | BLOCKER by acceptance-risk judgment under REQUEST9/13/14: selected-model/cache applicability and compatible fixes remain unqualified; not an automatic veto for every advisory. No owner risk waiver. | Unwaived security uncertainty and affected functionality/testpass criteria remain; no cleanup authority. | BLOCKED independent deployed dependencies/model integrity, active parser exposure and release review; local repairs are not deployed. | Remaining serious uncertainty is not accepted optional debt. Individual source-limited assessments remain visible. | Security/sidecar owners: complete narrowly scoped filelock cache/protocol compatibility work, select a patched compatible CPU Torch/Transformers graph, verify immutable model/checkpoint identities and startup/inference/extraction contracts in an approved environment; serious residual risk requires explicit owner disposition. No automatic waiver, model change/download or production action. |
|
||||
| P9-REQUAL-DB01 | LOCALLY REPAIRED at2b26953; three real RED/GREEN cases, full35 MariaDB/1123 backend and complete successor browser/workload PASS. | High functional provider defect: Documents index returns500 on actual MariaDB startup schema; no acknowledged-save loss reproduced | Provider query repair and complete successor qualification PASS within tested scope. | not permission to remove provider/schema/alias compatibility | withheld: no production operation or deployed qualification | no schema/table collation migration required for this repair | API DocumentsIndexService owner: narrow read-only projection fix, actual MariaDB regression including tenant/search/data preservation, fresh affected full successors |
|
||||
| P9-REQUAL-PDF01 | RESOLVED within original Linux24-fixture scope: final16/16 fidelity36pages plus8/8 settings24pages PASS, unchanged oracle; finalWindows24/24 and supplementalLinux2/2 PASS. No physical-print/deployed output claim. | High: exported documents shift geometry and gain pages relative to preview. | Confirmed Linux failure closed by final source-bound unchanged-oracle evidence. | Affected functionality/testpass and independent route/unused-code/inventory criteria still required; no cleanup authority. | Human/print/deployed-renderer/release conditions remain unqualified. | Original functional defect resolved in tested scope; human/deployed output qualification remains separate. | Document/QA owners: bind final frozen-source Linux and Windows24-fixture results to unchanged oracle/content/geometry checks, review intentional portable font replacement and retained historical bytes; human/physical printing remains M09-09, not automated closure. |
|
||||
| P9-REMED-PTR01 | RESOLVED within tested scope: focused unitRED/46GREEN and native6GREEN retained; final complete935 frontend/362 ordinary browser PASS with no retries/skips. Source review found no remaining Important issue. | High usability/recovery defect: pointer-down focus schedules a RAF that scrolls the pane190px before pointer-up; Retry target moves, so no click handler/HTTP retry occurs. | Confirmed pointer defect closed by failing-before and complete passing successor evidence. | No cleanup authority; preserve focused recovery behavior and satisfy independent route/inventory/testpass criteria. | Local repair not deployed; physical/device/human and release evidence remain. | Bounded functional repair, not optional optimization. Original admin deadline failure retained as unreproduced in isolated focused successor. | Frontend/QA owners: retain direct-region focus scrolling/mobile-pane selection while preventing descendant-control target movement; bind unit46/46 plus held-pointer4/4 and stale-draft/admin6/6 focused proof to final935 frontend/362 browser successors. No blanket timeout increase or assertion weakening. |
|
||||
|
||||
Inherited evidence entries retain their original historical wording (including then-pending checks) and are explicitly labelled historicalBaselineEvidence in JSON. Current status and final source-bound validation are separate; historical reports were not rewritten.
|
||||
@@ -0,0 +1,173 @@
|
||||
# Manual acceptance cards — P9-REMED-02
|
||||
|
||||
**All M09-01–10 remain NOT TESTED by a human in this remediation.** These cards expand the unchanged [original checklist](../p9-03/MANUAL_CHECKLIST.md); they record no fabricated execution. Under [REQUEST §6](../REQUEST.md#6-accessibility-qualification), unfinished checks carry into release gates. They are not automatically57 preservation defects or proof of a present failure. Relevant RD06/07/10/14/18/23/25 qualifications remain independent of local automation.
|
||||
|
||||
Before each card, record exact final application commit, static-export/API assembly/source-manifest hashes, environment URL, MariaDB image/config digest and effective nonproduction configuration. Use the final qualified build from the root validation ledger; no card may silently run against a stale build. Record tester name/role, UTC start/end, OS/browser/AT/device/font/printer versions and test-data IDs. Use isolated development or specifically approved sandbox environments, never production. If any environment/permission/device is absent, leave that applicable portion NOT TESTED and record the dependency; no implication of failure or pass.
|
||||
|
||||
Synthetic pack: one owner plus separate admin and foreign tenant accounts, two independent same-owner sessions;250 jobs only when the approved isolated fixture provides them; one ordinary job with long title/notes/timeline; long Career history with8 roles/48 distinct bullets, Åse/æ/ø, one-/multi-page CVs, optional sections and synthetic photo; notifications0/1/many, all9 Dashboard widgets. Use controlled provider inboxes for M09-10. Verify seed readback first. Do not create/delete/reset live records. Preserve frozen document hashes before/after any relevant workflow. Controlled failure injection is an approved harness action, not an invitation to stop a real service.
|
||||
|
||||
Priority P1 identifies release/accessibility/data/output/provider qualification; P2 is professional language review. Priority does not grant production or provider authority. Complete cards against both English and Bokmål and light/dark where applicable, retaining per-state evidence rather than one unexplained aggregate checkmark.
|
||||
|
||||
## M09-01 — Reader landmarks and complete forms (P1)
|
||||
|
||||
Owner: Accessibility tester. Status: **NOT TESTED**.
|
||||
|
||||
Environment: NVDA with a supported Windows browser, then VoiceOver with Safari on supported Apple hardware. Record actual versions.
|
||||
|
||||
Steps: With reader speech enabled, traverse /login, /jobs, /jobs/{synthetic-id}, /career, /career/builder/{synthetic-id}, /documents and /settings by headings, landmarks, tab/form navigation. Trigger an invalid field and a failed save in the approved test harness, then recover. Open and settle-close drawer/dialog/menu. Repeat equivalent journey with VoiceOver.
|
||||
|
||||
Pass criterion: Names/roles/values/selection, hierarchy, errors and reading order understandable; modal background not announced; successful/error status accurately announced.
|
||||
|
||||
Fail criterion: Missing or misleading name/state, hidden content spoken, unreachable form or unannounced blocking error.
|
||||
|
||||
Evidence to retain: Spoken transcript or recording, reader settings and exact failing/successful control; no real personal data.
|
||||
|
||||
## M09-02 — Focus and modal transitions (P1)
|
||||
|
||||
Owner: Accessibility tester. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Supported desktop browser, keyboard only; repeat drawer at narrow width. Actual reader can supplement, never substitute keyboard navigation.
|
||||
|
||||
Steps: Start at skip link; Tab/Shift+Tab through navigation and command dialog. Open Add/Edit Job, confirmation, select and menu; Cancel, Escape and submit/retry after a controlled failed save. Move through job sections and CV preview/history. Open/close drawer repeatedly including during ordinary transitions.
|
||||
|
||||
Pass criterion: Visible logical focus; modal trap only while open; Escape/cancel returns focus to initiating usable control; no closed/offscreen tab stops or lost focus.
|
||||
|
||||
Fail criterion: Keyboard trap outside modal, disappearing focus, background tabbing during modal or inability to recover after failure.
|
||||
|
||||
Evidence to retain: Short video plus focus sequence/control names and transition timing; preserve historical RD14 observation even if current run passes.
|
||||
|
||||
## M09-03 — Dashboard announcements and deliberate recovery (P1)
|
||||
|
||||
Owner: Accessibility tester. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Supported browser and actual reader; two independent authenticated sessions for same synthetic owner. Approved isolated harness for failed response.
|
||||
|
||||
Steps: On /dashboard open Customize. Hide/show a widget, Earlier/Later, resize, Cancel; reopen, Reset cancel then confirm. Create stale layout in second session and save it; first session Save must conflict, retain draft and offer review/reload. Inject one save failure using approved harness, then deliberately recover. Save empty layout and restore visible widgets.
|
||||
|
||||
Pass criterion: Each action/order/save/error announced once, spoken position agrees with DOM order, keyboard alternative to pointer exists, conflicts/failures retain draft and never claim saved.
|
||||
|
||||
Fail criterion: Silent/misleading status, inaccessible reordering or lost rejected draft.
|
||||
|
||||
Evidence to retain: Reader transcript, before/after order/revision and response status; do not capture credentials.
|
||||
|
||||
## M09-04 — Contextual painted contrast (P1)
|
||||
|
||||
Owner: Accessibility tester. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Actual supported browser, light/dark, painted-color sampling tool; include focused/hover/disabled/native-select/scrolled states.
|
||||
|
||||
Steps: Use original P9-AX-02/03 affected nodes from inherited triage. Inspect size controls, all53 painted-background occurrences grouped by cause, scrolled CV editor and fixed chrome. Open native select and inspect applicable text/UI/focus in both themes; retain each affected cause/node/state mapping.
|
||||
|
||||
Pass criterion: Normal text >=4.5:1; large text >=3:1; necessary UI boundaries/focus >=3:1. Apply documented WCAG exceptions only to truly inactive controls; record why.
|
||||
|
||||
Fail criterion: Any applicable ratio below threshold or no reliable painted sample for a required state; unresolved sample stays NOT TESTED.
|
||||
|
||||
Evidence to retain: Foreground/background actual paint colors, ratio, node/state and screenshot; automation incomplete alone is not closure.
|
||||
|
||||
## M09-05 — Hidden badges and settled drawer (P1)
|
||||
|
||||
Owner: Accessibility tester. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Actual reader plus browser accessibility tree; Dashboard and original Analytics drawer context.
|
||||
|
||||
Steps: Inspect unread=0 hidden badge, then synthetic positive unread count. Open drawer; inspect modal background and reading/tab order; settle-close and repeat reader traversal and24 Tab presses. Repeat in Analytics context matching inherited occurrence.
|
||||
|
||||
Pass criterion: Zero badge absent from announcements, positive count meaningful, open modal excludes background appropriately; settled closed drawer neither spoken nor tabbable.
|
||||
|
||||
Fail criterion: Hidden zero announcement, missing positive count, closed drawer reader/focus access or background leakage during modal.
|
||||
|
||||
Evidence to retain: Accessibility tree, speech and focus record per exact state. Passing settled Dashboard does not retroactively explain original Analytics cause.
|
||||
|
||||
## M09-06 — Reflow, clipping and visible controls (P1)
|
||||
|
||||
Owner: Accessibility tester. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Real browser100/200/400% zoom, text-only enlargement where supported, increased text spacing and forced colors; record OS/browser and actual zoom method.
|
||||
|
||||
Steps: At each setting traverse Jobs pagination, job/document section tabs, CV tabs/controls, Settings inputs and significant forms using keyboard. Scroll intentional table/document/Board scrollers, then reach every primary action. Check long EN/NB labels and error states.
|
||||
|
||||
Pass criterion: Essential content and focused actions readable/reachable, no root clipping or lost focus; intentional scrollers remain usable; fixed A4/Letter document geometry preserved.
|
||||
|
||||
Fail criterion: Unreachable clipped control/text, obscured primary action or focus, broken forced-colors affordance.
|
||||
|
||||
Evidence to retain: Screenshot at each setting, focused control and scroll path. The historical16 offviewport states remain explicit targets; zero root overflow alone is insufficient.
|
||||
|
||||
## M09-07 — Physical input and interruption (P1)
|
||||
|
||||
Owner: Product owner with physical devices. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Actual supported phone and tablet, portrait/landscape, software keyboard, touch/pointer as applicable; record model/OS/browser/input.
|
||||
|
||||
Steps: Edit long Career/job/letter text while keyboard is open. Open drawer/dialog/select, rotate, recover after Cancel and controlled failed save. Reorder Dashboard/Board using supported touch action and named alternative; cancel drag. Traverse CV preview; download synthetic PDF.
|
||||
|
||||
Pass criterion: Primary action not obscured by keyboard; draft retained across intended interruptions; reachable touch targets; no unintended destructive/move operation; alternatives usable.
|
||||
|
||||
Fail criterion: Obscured save, lost draft, accidental destructive/move, unusable touch target or failed supported download.
|
||||
|
||||
Evidence to retain: Device video/screenshots including keyboard/rotation and result readback. Emulated touch cannot close this card.
|
||||
|
||||
## M09-08 — Professional Bokmål and terminology (P2)
|
||||
|
||||
Owner: Professional Bokmål reviewer. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Application nb locale on exact build; both themes, narrow and desktop, ordinary user and separate synthetic admin. Include dates/numbers/plural states.
|
||||
|
||||
Steps: Review registration/recovery, errors/validation, onboarding, Dashboard customization, Jobs/Board/history, Career/import, CV/library, documents/mail, notifications, Settings/Admin. Use long names,0/1/many counts and boundary date/number values. Inspect accessible names with reader. Record raw Created metadata separately from application copy.
|
||||
|
||||
Pass criterion: Natural professional Bokmål, consistent established terms, meaningful validation/names and correct date/number presentation. Distinguish authored/provider English and technical names.
|
||||
|
||||
Fail criterion: Untranslated application string, unnatural/misleading term, incorrect locale format or inaccessible label; authored English alone is not defect.
|
||||
|
||||
Evidence to retain: Exact key/control and screenshot, proposed wording and reviewer rationale. P9-L02 remains low debt until separately implemented/reviewed.
|
||||
|
||||
## M09-09 — Intended-environment PDF fidelity (P1)
|
||||
|
||||
Owner: Document reviewer. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Intended Linux renderer/font set, supported primary and alternate browsers and actual printer or approved print workflow. Record versions/fonts/template/page size.
|
||||
|
||||
Steps: Generate synthetic one- and multi-page EN/NB CVs in every supported template, with long words/employment/bullets, missing optional sections, Å/æ/ø/special characters and permitted synthetic photo. Compare preview with downloaded originals; inspect/search/copy text; print representative pages including first/last/page-break boundaries.
|
||||
|
||||
Pass criterion: Legible fonts/glyphs, correct language/date, no missing/duplicate content, intact margins/header/footer/page breaks, photo/crop and preview/export agreement.
|
||||
|
||||
Fail criterion: Missing glyph/content, overflow/cutoff, duplicate blocks, wrong pagination/font/photo or illegible printed output.
|
||||
|
||||
Evidence to retain: Original PDF bytes+SHA256, page count, renderer/font/browser versions, screenshots/print observations and named template. Existing60-page automated oracle is separate.
|
||||
|
||||
## M09-10 — Real provider consent, delivery and uncertain outcomes (P1)
|
||||
|
||||
Owner: Approved provider tester. Status: **NOT TESTED**.
|
||||
|
||||
Environment: Explicitly authorized nonproduction OAuth/Turnstile/mail/calendar sandbox accounts, controlled recipient inboxes and timezone/DST scenarios. No production credentials or real personal documents.
|
||||
|
||||
Steps: Test Google/Microsoft consent and denied/cancelled popup; validate expected origin/state. Verify/reset email to sandbox inbox including used/expired token. Link mailbox, revoke grant and reconnect. Simulate uncertain send only with approved sandbox fixture, then review rather than automatically resend. Create calendar events around DST transitions, explicit offsets and date-only boundaries.
|
||||
|
||||
Pass criterion: Correct owner/origin/state, explicit confirmation, recoverable revoke/reconnect, actual intended mail delivery, no accidental resend and correct timezone/date semantics.
|
||||
|
||||
Fail criterion: Cross-owner/mismatched state accepted, resend without deliberate review, failed intended delivery or wrong event time/date.
|
||||
|
||||
Evidence to retain: Correlated sanitized provider request/response/delivery/event timestamps, exact account scope and timezone expectation. Local SMTP/HTTP tests do not close provider semantics.
|
||||
|
||||
## Recording and closure
|
||||
|
||||
For each state, retain a row: `card ID | tester | UTC | commit/build hashes | environment | OS/browser/AT/device | synthetic IDs | steps actually executed | expected | observed | PASS/FAIL/NOT TESTED | evidence path/hash | defect ID/owner/retest`. A failed observation gets a bounded reproducible defect and linked evidence; keep the original failure, then record a new successor after repair. Untested subcases stay explicit; completing one browser/device never closes another. Redact tokens, credentials and unrelated personal information. Store recordings/reader transcript/PDF bytes in approved nonproduction evidence storage and link them from the final ledger.
|
||||
|
||||
A genuine tester reviews every applicable subcase before closing the card; product/accessibility/provider owners accept any documented non-applicable state with a reason. An AI screenshot review, DOM assertion, healthy endpoint or axe0-violation result cannot sign these cards. C11/P5-13 semantics, infrastructure/backup/restore/rollback, monitoring, creation idempotency and enabled-worker recovery have separate gates and are not authorized by this checklist. No Phase10 implementation or release approval follows automatically.
|
||||
|
||||
## P9-REMED-02 priorities and current portable-font environment
|
||||
|
||||
No card above has been performed by a human in this task. Prioritize M09-09 (new deterministic open-font output and real printing), M09-01/02/06 (reader, keyboard/focus and zoom), then M09-07 (physical-device/pointer interruptions). M09-08 professional Bokmål and M09-10 real provider semantics remain independently required in their applicable release contexts. This priority is not an assertion that every missing human row vetoes Phase9; REQUEST§6 permits explicit release carry-forward.
|
||||
|
||||
For every card use a frozen build that includes the final preview focus repair, packaged fonts and security lock. Final complete regression is currently pending; checkpointb313e20 alone is not a final qualification receipt. Record the actual source/static/API hashes, MariaDB12.2.2 image/server identity, browser/renderer, locale and device versions. Use synthetic nonproduction accounts/data and approved provider sandboxes only. An absent reader/device/printer/sandbox leaves that subcase NOT TESTED; do not infer PASS from emulation or axe.
|
||||
|
||||
M09-09 supplemental exact actions:
|
||||
|
||||
1. Record current document-font manifest/license hashes and effective selected faces. SegoeUI stacks now use Selawik, Arial/Helvetica stacks use Arimo, Georgia uses Gelasio; Roboto/Poppins/RobotoMono are packaged. These are explicitly disclosed replacements, not proprietary original fonts. Do not copy operating-system fonts or edit stored settings to simulate parity.
|
||||
2. Render one-page and long multi-page EN/NB documents across supported templates and explicit/inherited font settings, including regular/bold/italic content, Norwegian Å/æ/ø, long headings/skills/history, empty optional sections, header/footer and A4/Letter page-break boundaries. Save/download, close and reopen original PDF bytes in the primary and alternate supported viewers.
|
||||
3. Compare preview/export content, positions, page dimensions/count, glyph legibility and line breaks. Compare the retained pre-remediation document to the new render and explicitly record the intended open-font visual change; do not require proprietary glyph shapes or hide unexpected layout changes by approving a new snapshot.
|
||||
4. Print representative first/middle/last pages with printer scaling disabled or an explicitly recorded intended scaling mode; inspect physical margins, glyphs, clipping, photos, headers/footers and boundary content. Record paper/driver/device settings, originalPDF SHA256 and photographs/scans of output where permitted.
|
||||
5. Pass only the actually exercised supported template/device/viewer/print combinations with legible complete content and correct intended layout. Missing/duplicate content, cut glyphs, wrong pagination/dimensions, unexplained fallback or an unusable printed output is FAIL with a bounded defect. Any unavailable combination remains NOT TESTED.
|
||||
|
||||
M09-02/07 supplemental pointer action: after a controlled CV preview failure, press and hold the Retry preview control briefly through a normal layout frame before releasing; confirm the target remains stationary and exactly the intended retry/recovery occurs. Repeat keyboard activation and direct preview-region focus, two themes/languages where applicable, and actual touch devices. Automated held-pointer4/4 is finite regression evidence, not physical-device/human acceptance.
|
||||
|
||||
Security and infrastructure are not signed off by these cards.44 Python advisory alias groups, selected-model/cache compatibility, hosted runner isolation/lifecycle, production backup/restore/rollback/filesystem integrity and deployed identities retain separate named owners. No tester or AI silently accepts serious residual risk. CV-UX-01 and CV-IMPORT-01 remain prohibited in this mission regardless of a future Phase9 conditional decision.
|
||||
@@ -0,0 +1,46 @@
|
||||
# Linux PDF remediation evidence
|
||||
|
||||
The original baseline is reproduced on Debian12, .NET9.0.21 and Chromium156.0.8078.47, with a Windows Chromium151.0.7922.34 preview client. Linux locale is POSIX; HTML is explicitly UTF-8 with variant-controlled EN/NB language. Runtime/image/font inventory is retained in `.artifacts/p9-remed-02/baseline/environment.json` and producer process records. Page geometry, print CSS, template data, fixture inputs and original oracle were not changed.
|
||||
|
||||
Baseline:13/24 pass,65 PDF pages versus60 preview pages. Original Linux font inventory contains only six DejaVu faces; requested Segoe UI/Arial/Georgia/Roboto/Poppins/mono stacks have no packaged resources. PDFs show actual DejaVu substitution against Windows reference fonts. All11 failed fixtures show cumulative position/wrapping drift, with five extra pages across the roomy document and four after-settings states. Baseline checks report no missing/extra markers, blank pages, physical-dimension, font-size, RGB or vertical-safe-area errors. That distinguishes the observed failures from unproven clipping or missing-content causes.
|
||||
|
||||
The shared ThemedCvRenderer now embeds licensed portable faces, preserving persisted font-stack strings/null inheritance and all Career/settings/revision owners. A font-only identical-HTML experiment isolates the metric effect: both engines produce the same text and four pages with maximum word-position difference0.023mm. See FONT_PACKAGING.md for the precise effective families and intended glyph changes. Historical frozen exports are untouched; this does not promise proprietary-font pixel identity for newly rendered documents.
|
||||
|
||||
The first variable-font packaging trial aligned all preview/export page counts and markers but exposed a separate PDF metadata problem: reviewed variable faces exported as Type3 without FontBBox/Ascent/Descent in the Linux engine. In the inspected header, the inferred glyph top was14.8167mm even though independent PDF images showed it inside the physical margin. Static upstream originals emit Type0, with proper16.6109mm glyph bounds, and satisfy the unchanged safe-area check. No locally modified fonts, reference snapshots or tolerance changes are used.
|
||||
|
||||
The static checkpoint passes all24 original fixtures and60 pages. This covers all nine current themes, one/multiple pages, long employment/bullets/headings and ordinary skills, EN/NB characters, custom settings, empty optional fields and boundary text. Every rendered HTML body text node is present in reopened PDF glyph streams after explicit NFKC ligature expansion, whitespace normalization and casefold for existing CSS text-transform; this presence check does not certify original letter-case fidelity. Independent oracle markers, geometry, safe areas, font sizes and colors remain separate checks.
|
||||
|
||||
Four representative independent reprints have exact per-glyph geometry and rendered page-pixel equality across their pages. PDF byte equality is not claimed because creation metadata changes. All60 exported page images and comparison sheets were generated. Finite AI visual inspection covered default-minimal/page1, long-nb-code/page4 and light-en-after/page3: the selected comparisons retain aligned text, margins, final-page content and accent styling. This is not human visual acceptance or physical printing. Locale/alternate-engine/physical-printer qualifications remain explicit owner cards.
|
||||
|
||||
The prior collector is reused unchanged with original16-fixture/36-page and8-fixture/24-page totals and exact eight settings states. Final frozen-source Windows and Linux successors both pass the same original24 fixtures/60pages. Their native reports, unchanged oracle and input/report hashes are recorded in pdf-remediation.json; broader qualification and the separate supplemental cases retain their own outcomes. This table preserves the baseline versus static-checkpoint comparison.
|
||||
|
||||
| Original fixture | Baseline preview/PDF | Baseline | Static preview/PDF | Static |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| default-modern | 1/1 | PASS | 1/1 | PASS |
|
||||
| default-minimal | 1/1 | PASS | 1/1 | PASS |
|
||||
| default-executive | 1/1 | PASS | 1/1 | PASS |
|
||||
| default-technical | 1/1 | PASS | 1/1 | PASS |
|
||||
| default-ats-classic | 1/1 | PASS | 1/1 | PASS |
|
||||
| default-nordic | 1/1 | PASS | 1/1 | PASS |
|
||||
| default-elegant | 1/1 | PASS | 1/1 | PASS |
|
||||
| default-creative | 1/1 | PASS | 1/1 | PASS |
|
||||
| default-code | 1/1 | PASS | 1/1 | PASS |
|
||||
| long-en-minimal | 4/4 | FAIL | 4/4 | PASS |
|
||||
| long-nb-code | 4/4 | FAIL | 4/4 | PASS |
|
||||
| compact-8mm-letter | 4/4 | FAIL | 4/4 | PASS |
|
||||
| roomy-28mm-nb | 5/6 | FAIL | 5/5 | PASS |
|
||||
| grid-and-bubbles | 1/1 | FAIL | 1/1 | PASS |
|
||||
| long-sidebar-nb | 5/5 | FAIL | 5/5 | PASS |
|
||||
| unbreakable-and-boundary | 4/4 | FAIL | 4/4 | PASS |
|
||||
| light-en-before | 3/3 | PASS | 3/3 | PASS |
|
||||
| light-en-after | 3/4 | FAIL | 3/3 | PASS |
|
||||
| light-nb-before | 3/3 | PASS | 3/3 | PASS |
|
||||
| light-nb-after | 3/4 | FAIL | 3/3 | PASS |
|
||||
| dark-en-before | 3/3 | PASS | 3/3 | PASS |
|
||||
| dark-en-after | 3/4 | FAIL | 3/3 | PASS |
|
||||
| dark-nb-before | 3/3 | PASS | 3/3 | PASS |
|
||||
| dark-nb-after | 3/4 | FAIL | 3/3 | PASS |
|
||||
|
||||
All individual failures, font identities and measured maximum after-position differences are preserved in [pdf-remediation.json](pdf-remediation.json). Legacy renderers/frozen artifacts remain unchanged; these24 corpora qualify the current themed pipeline, not every historical renderer or physical device.
|
||||
|
||||
Supplemental long-skill-list, long-heading, empty-section and browser-generated-header/footer suppression checks PASS separately on real MariaDB/Linux: minimalEN2pages and technicalNB8pages. All64 S-markers and Norwegian name characters persist; independent HTTP readback preserves profile/revision and CV version. They are not counted in the original24 or ordinary362. Pre/post oracle input and report hashes are required by reconciliation. The current renderer suppresses Chromium URL/date headers/footers. A retained ShowPageNumbers DTO property has no current renderer/control consumer; numbered footer output is not claimed or added as a new feature.
|
||||
@@ -0,0 +1,18 @@
|
||||
# P9-REMED-02 preservation reconciliation
|
||||
|
||||
Baseline3727a72; branch `fix/p9-pdf-security-requalification`; dated25October2026. [Machine register](preservation.json) carries all57 capability groups and all33 supported routes forward with original criteria, owners, evidence, severity, dependency, closure and gate fields. **56 remain PARTIAL and C11 DEFERRED.** No source census or focused passing test promotes a whole capability.
|
||||
|
||||
The historical source is [P9-REQUAL preservation](../p9-requal-01/preservation.json). That package's complete362-browser/33-route results remain historical. Final source-bound local functional regression PASS is in validation.json; the first95/3 ordinary attempt is retained and not accepted or added to final totals.
|
||||
|
||||
## Changed owners and preservation obligations
|
||||
|
||||
| Owner/change | Bounded evidence | Preserved boundary / remaining qualification |
|
||||
| --- | --- | --- |
|
||||
| Shared ThemedCvRenderer + packaged fonts | OriginalLinux24/24 checkpoint PASS,36+24pages, unchanged oracle | Career data, CV settings strings/null-as-inherit, variants/revisions/history and stored PDF bytes unchanged. New open-font glyph shapes/metrics intentionally replace platform fallback; legal font notices/provenance retained. Final Windows/Linux24/24 and supplementalLinux2/2 PASS; human print review remains NOT TESTED. |
|
||||
| Python exact requirements/hash lock |65/109 advisory alias groups removed; model-disabled58-case checkpoint and real parser/startup checks | Existing API/extraction and withholding behavior retained.44 advisory groups and actual model/cache compatibility unqualified; no model download or owner risk acceptance. |
|
||||
| Preview Paper focus guard | Unit46/46 and native held-pointer4/4 plus stale/admin6/6 focused proof | Direct-region scrolling/mobile pane selection retained; descendant buttons no longer move before pointer-up. Strict draft/download/history/version assertions remain. Final935 frontend/362 browser PASS. |
|
||||
| Hosted CI | Fresh run853 BLOCKED | No workflow/runner/deployment changes. Local provider tests never relabelled hosted execution. |
|
||||
|
||||
Both original PDF corpora/fixture membership, tolerances and historical evidence remain. Canonical Career Profile owns content; variants remain presentation lenses. Null means inherit, not clear; no migration or compatibility-alias retirement occurs. Existing frozen PDFs are not regenerated or deleted. No route removal, SQLite retirement, database-version change, new AI feature, C11 activation or Phase10/CV-UX/CV-IMPORT work is authorized.
|
||||
|
||||
The new [finding register](FINDINGS.md) keeps Phase9, Phase10, production-only gates and nonblocking debt independent. All applicable [human cards](MANUAL_ACCEPTANCE.md) remain NOT TESTED. Production infrastructure limitations alone do not veto development acceptance, but unclosed mandatory security and affected regression requirements still need evidence/disposition.
|
||||
@@ -0,0 +1,12 @@
|
||||
# P9-REMED-02 evidence package
|
||||
|
||||
Start with the [25 October acceptance addendum](ACCEPTANCE_ADDENDUM_2026-10-25.md). Local functional qualification is complete; Python security and hosted CI remain blocked. Phase9/Phase10/production remain NO-GO.
|
||||
|
||||
- [Linux PDF root cause and all 24 before/after fixtures](PDF_REMEDIATION.md), [pipeline ownership](PDF_PIPELINE.md), [font packaging and licences](FONT_PACKAGING.md).
|
||||
- [Python advisory inventory](security/ADVISORIES.md), [bounded upgrades and compatibility evidence](security/REMEDIATION.md).
|
||||
- [Hosted isolation and operator prerequisites](CI_ISOLATION.md), [current metadata limits](CI_REFRESH_2026-10-25.md).
|
||||
- [All 60 findings and independent acceptance gates](FINDINGS.md), [57-group/33-route preservation](PRESERVATION.md), [human/device/provider testing cards](MANUAL_ACCEPTANCE.md).
|
||||
- [Machine results](validation.json), [acceptance decisions](acceptance.json), [publication ledger](publication.json).
|
||||
- [Reproduction commands](COMMANDS.md), [independent source review](SOURCE_REVIEW.md).
|
||||
|
||||
Historical reports in earlier Phase 9 directories are preserved. Raw local reports, PDFs, page images, traces, process outcomes and replay material live under `.artifacts/p9-remed-02/`; links to local raw files require that retained evidence checkout. Machine-readable source/report hashes bind the actual execution, not a claim that every local artifact is available from Git alone. No private test credentials or renderer archive are published as repository data.
|
||||
@@ -11,3 +11,9 @@ The reviewer verified all109 advisory rows contain the required fields and the e
|
||||
The final delta review found no Critical or Important finding in the preview focus guard or fixture changes. Descendant controls retain their pointer positions; mobile-pane selection remains and direct preview-region focus still scrolls its pane. The native regression now holds pointer-down through layout frames. The stale-draft fixture observes real autosave409/200 responses while retaining its draft/download/version/history assertions.
|
||||
|
||||
Runtime proof is owned by the qualification ledger. Source review does not certify PDF fidelity, full model inference, hosted isolation, accessibility compliance, physical printing or production readiness.
|
||||
# Supplemental evidence review — 25 October
|
||||
|
||||
Independent read-only review of the new qualification wrappers, representative producers and reconciliation found an Important acceptance gap: a stale supplemental PDF result could pass without exact membership or pre-oracle input binding. The producer now records every input hash before the unchanged oracle, verifies inputs afterward and records the report hash. Reconciliation requires this existing manifest, exact two-fixture membership and successful report/case equality, required artifacts, original oracle identity and current input/report hashes. Follow-up independent review found no remaining Critical/Important issue in that delta. Eight offline collector checks pass; these are evidence-accounting checks, not additional application/browser/PDF execution. The owned waiting helper was restarted before the supplemental lane began; its source transition is retained in raw restart receipts.
|
||||
# Final narrative review limit
|
||||
|
||||
The additional independent final-document consistency pass could not run because the reviewer reached its usage limit. Earlier independent application and evidence-helper reviews completed, including closure of the Important pre/post oracle binding finding. Final narrative, counts, links and hashes were checked by the primary agent; no independent final narrative approval is claimed.
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
# P9-REMED-02 execution checklist
|
||||
|
||||
- [x] Verify dedicated development ancestry and preserve main.
|
||||
- [x] Reproduce all original Linux PDF failures and trace the shared pipeline.
|
||||
- [x] Package licensed static fonts, retain settings/revisions, pass focused unchanged 24-fixture oracle.
|
||||
- [x] Assess Python advisories individually; apply five bounded pinned upgrades and parser/startup checks.
|
||||
- [x] Inspect hosted metadata without changing infrastructure; retain isolation guard and operator handoff.
|
||||
- [x] Repair the reproduced preview pointer defect with failing regression proof and independent source review.
|
||||
- [x] Prepare 60-finding register, 57-group/33-route preservation and M09 owner cards.
|
||||
- [x] Complete serial fresh regression, Linux/Windows successors and isolated MariaDB workload.
|
||||
- [x] Complete supplemental long-skill documents, final exact-pin advisory refresh and renderer replay capsule.
|
||||
- [x] Reconcile exact outcomes, source/report hashes and independent gate decisions.
|
||||
- Publication: the commit containing this file carries the validated evidence. The post-push receipt and final delivery record remote equality, clean tree, ancestry and unchanged main after that commit exists.
|
||||
|
||||
Withheld: owner risk acceptance, hosted runner changes, human/device/provider results, production operations, SQLite retirement and new feature work.
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"reportDate": "2026-10-25",
|
||||
"observedUtc": "2026-10-24T23:20:20.946229+00:00",
|
||||
"applicationCheckpoint": "b313e20bade4def9b8c23d32410278e0333d642c",
|
||||
"verdicts": {
|
||||
"Linux PDF Fidelity": "PASS",
|
||||
"Python Security Advisories": "BLOCKED",
|
||||
"Hosted MariaDB CI": "BLOCKED",
|
||||
"RD21": "RESOLVED",
|
||||
"Phase 9": "NO-GO",
|
||||
"Phase 10 Readiness": "NO-GO",
|
||||
"Production": "NO-GO"
|
||||
},
|
||||
"localFunctionalComplete": true,
|
||||
"automationComplete": false,
|
||||
"cvUx01": "WITHHELD; not started or authorised by this mission",
|
||||
"phase9Reason": "Acceptance-risk judgment: residual selected-model loading/artifact and cache-lock applicability/compatibility remains unqualified; no owner serious-risk acceptance. Not an automatic veto for every advisory or production-only condition.",
|
||||
"phase10Reason": "Independent no-unused-route/caller and functionality-inventory criteria remain unproven/unwaived, with security risk disposition open. No cleanup implementation.",
|
||||
"securityAccounting": {
|
||||
"beforeRecords": 249,
|
||||
"beforeGroups": 109,
|
||||
"afterRecords": 99,
|
||||
"afterGroups": 44,
|
||||
"remediatedGroups": 65
|
||||
},
|
||||
"hostedExecutedMariaDbCases": 0,
|
||||
"humanM09": "NOT TESTED",
|
||||
"preservation": {
|
||||
"groups": 57,
|
||||
"partial": 56,
|
||||
"deferred": 1,
|
||||
"supportedRoutes": 33
|
||||
},
|
||||
"remainingConditions": [
|
||||
"Validate compatible filelock/Torch/Transformers fixes with approved immutable model/tokenizer/checkpoint identities and real representative inference, or obtain explicit owner disposition for serious residual risk after applicability evidence. No large model download in this mission.",
|
||||
"Operator: verify isolated hosted runner/private disposable MariaDB services and lifecycle, then retain actual hosted tests and cleanup. No production socket or unnecessary privileges.",
|
||||
"Before Phase10: satisfy authoritative route/caller, affected-test and functionality inventory entry criteria; no carry-forward waiver inferred.",
|
||||
"Before release: complete applicable owner M09 accessibility/device/language/print/provider cards and independent infrastructure/security/recovery gates."
|
||||
],
|
||||
"nextAction": "Bounded selected-model/cache security qualification using an approved immutable local artifact; operator isolation and human testing can proceed independently."
|
||||
}
|
||||
@@ -0,0 +1,230 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"reportLocalDate": "2026-10-25",
|
||||
"timezone": "Europe/Paris",
|
||||
"observedUtc": "2026-10-24T22:14:53.076535+00:00",
|
||||
"observedLocal": "2026-10-25T00:14:53.076535+02:00",
|
||||
"verdict": "BLOCKED",
|
||||
"scope": "Fresh GET metadata only; no new runner runtime or private service isolation proof",
|
||||
"giteaVersion": "1.26.0",
|
||||
"httpStatuses": {
|
||||
"version": 200,
|
||||
"repository": 200,
|
||||
"repository-runners": 200,
|
||||
"instance-runners": 403,
|
||||
"user": 403,
|
||||
"runs-latest100": 200,
|
||||
"runs-branch-query": 200,
|
||||
"jobs-853": 200,
|
||||
"jobs-852": 200
|
||||
},
|
||||
"repositoryPermissions": {
|
||||
"admin": true,
|
||||
"push": true,
|
||||
"pull": true
|
||||
},
|
||||
"repositoryRunners": [
|
||||
{
|
||||
"id": 3,
|
||||
"name": "pi-runner-1",
|
||||
"status": "offline",
|
||||
"busy": false,
|
||||
"disabled": false,
|
||||
"ephemeral": false,
|
||||
"labels": [
|
||||
{
|
||||
"id": 0,
|
||||
"name": "ubuntu-latest",
|
||||
"type": "custom"
|
||||
},
|
||||
{
|
||||
"id": 1,
|
||||
"name": "ubuntu-22.04",
|
||||
"type": "custom"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"observedLatestRunCount": 50,
|
||||
"latestObservedRuns": [
|
||||
{
|
||||
"id": 853,
|
||||
"head_sha": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
|
||||
"head_branch": "fix/p9-ci-and-requalification",
|
||||
"status": "completed",
|
||||
"conclusion": "failure",
|
||||
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/853",
|
||||
"created_at": null,
|
||||
"updated_at": null
|
||||
},
|
||||
{
|
||||
"id": 852,
|
||||
"head_sha": "7092697cb3e20a5f22e173648fd544de3de6c553",
|
||||
"head_branch": "fix/p9-ci-and-requalification",
|
||||
"status": "completed",
|
||||
"conclusion": "failure",
|
||||
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/852",
|
||||
"created_at": null,
|
||||
"updated_at": null
|
||||
},
|
||||
{
|
||||
"id": 851,
|
||||
"head_sha": "5ac11549b2caa27469aa9fb2b5b9ed402471a453",
|
||||
"head_branch": "fix/p9-ci-and-requalification",
|
||||
"status": "completed",
|
||||
"conclusion": "failure",
|
||||
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/851",
|
||||
"created_at": null,
|
||||
"updated_at": null
|
||||
},
|
||||
{
|
||||
"id": 850,
|
||||
"head_sha": "2b26953d6f3c3fdacdffefa2c0a696c9084f1afd",
|
||||
"head_branch": "fix/p9-ci-and-requalification",
|
||||
"status": "completed",
|
||||
"conclusion": "failure",
|
||||
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/850",
|
||||
"created_at": null,
|
||||
"updated_at": null
|
||||
},
|
||||
{
|
||||
"id": 849,
|
||||
"head_sha": "1a1b7c82213c24fbbc9bd4e1553a92f4c76eabd9",
|
||||
"head_branch": "fix/p9-ci-and-requalification",
|
||||
"status": "completed",
|
||||
"conclusion": "failure",
|
||||
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/849",
|
||||
"created_at": null,
|
||||
"updated_at": null
|
||||
}
|
||||
],
|
||||
"remediationBranchQuery": {
|
||||
"observedCount": 0,
|
||||
"allReturnedRowsMatchRequestedBranch": true,
|
||||
"matchingRunIds": [],
|
||||
"note": "An empty or ignored query is not proof of all historical branch executions."
|
||||
},
|
||||
"remediationBranchRunsInObservedLatestWindow": [],
|
||||
"latestAccessibleJobs": [
|
||||
{
|
||||
"runId": 853,
|
||||
"head_sha": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
|
||||
"jobs": [
|
||||
{
|
||||
"id": 1743,
|
||||
"name": "mariadb",
|
||||
"status": "completed",
|
||||
"conclusion": "failure",
|
||||
"runner_id": 5,
|
||||
"runner_name": "Live-Runner",
|
||||
"started_at": "2026-10-24T16:33:16Z",
|
||||
"completed_at": "2026-10-24T16:33:23Z"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"runId": 852,
|
||||
"head_sha": "7092697cb3e20a5f22e173648fd544de3de6c553",
|
||||
"jobs": [
|
||||
{
|
||||
"id": 1742,
|
||||
"name": "mariadb",
|
||||
"status": "completed",
|
||||
"conclusion": "failure",
|
||||
"runner_id": 5,
|
||||
"runner_name": "Live-Runner",
|
||||
"started_at": "2026-10-24T16:24:08Z",
|
||||
"completed_at": "2026-10-24T16:24:15Z"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"workflow": {
|
||||
"path": ".gitea/workflows/mariadb-integration.yml",
|
||||
"sha256": "f7579be39a4b4318567edf98ba8dff0d6991ceae96ae27b917e6847253b1f850",
|
||||
"remediationBranchPushTrigger": false,
|
||||
"pullRequestAndManualTriggersRetained": true,
|
||||
"changedByInvestigation": false
|
||||
},
|
||||
"historicalRuntimeEvidence": {
|
||||
"runId": 853,
|
||||
"jobId": 1743,
|
||||
"observedRunDate": "2026-10-24",
|
||||
"sourceCommit": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
|
||||
"hostNetworkingAndSocketObservedHistorically": true,
|
||||
"guardExitCode": 1,
|
||||
"mariaDbTestsExecuted": false,
|
||||
"logPath": ".artifacts/p9-remed-02/ci/successor/job-1743.log",
|
||||
"logSha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134"
|
||||
},
|
||||
"liveHostConfigReinspected": false,
|
||||
"newRuntimeLogsDownloaded": false,
|
||||
"currentLiveHostConfigClaim": "UNKNOWN; old runtime log cannot certify unchanged current configuration",
|
||||
"newIsolationProof": false,
|
||||
"hostedJobsDispatched": false,
|
||||
"runtimeBuildBrowserDatabaseActions": false,
|
||||
"productionAccess": false,
|
||||
"nextAction": "Existing CI_ISOLATION.md exact operator implementation and verification handoff; then reviewed workflow/transport change and actual hosted database execution",
|
||||
"rawMetadataEvidence": [
|
||||
{
|
||||
"httpStatus": 200,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/version.json",
|
||||
"bytes": 20,
|
||||
"sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e"
|
||||
},
|
||||
{
|
||||
"httpStatus": 200,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/repository.json",
|
||||
"bytes": 2315,
|
||||
"sha256": "d385d76a70133ff55a546f0e2b23823b69d549cc60ca4afa3f7ed4fda3866314"
|
||||
},
|
||||
{
|
||||
"httpStatus": 200,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/repository-runners.json",
|
||||
"bytes": 232,
|
||||
"sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45"
|
||||
},
|
||||
{
|
||||
"httpStatus": 403,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/instance-runners.json",
|
||||
"bytes": 164,
|
||||
"sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1"
|
||||
},
|
||||
{
|
||||
"httpStatus": 403,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/user.json",
|
||||
"bytes": 163,
|
||||
"sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b"
|
||||
},
|
||||
{
|
||||
"httpStatus": 200,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/runs-latest100.json",
|
||||
"bytes": 203806,
|
||||
"sha256": "3f965970c2e81233bc192d2e6aeefd458ea0a36ba7cbca87bc37c9a34ed998ca"
|
||||
},
|
||||
{
|
||||
"httpStatus": 200,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/runs-branch-query.json",
|
||||
"bytes": 36,
|
||||
"sha256": "c88e581390a4c04eaddaf6dc1bafd07c56d33e594c62ad3498c7313043b39bbf"
|
||||
},
|
||||
{
|
||||
"httpStatus": 200,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/jobs-853.json",
|
||||
"bytes": 1867,
|
||||
"sha256": "d3aa3ca89944f436bbae0042b685072cd9f2b7b615eaadf545e9135ded2a6486"
|
||||
},
|
||||
{
|
||||
"httpStatus": 200,
|
||||
"path": ".artifacts/p9-remed-02/ci-refresh-20261025/jobs-852.json",
|
||||
"bytes": 1867,
|
||||
"sha256": "e2b2cc8bd24094bac0766561fe5ce79ec42987cfd291b27d8896c74e2abe10b6"
|
||||
}
|
||||
],
|
||||
"limits": [
|
||||
"Latest request limit100 returned50; not exhaustive full history",
|
||||
"Branch query returned0 and latest50 contain no remediation-branch run; query support not independently certified",
|
||||
"Instance/userAPI403; actual runner host/daemon/secret isolation unavailable",
|
||||
"No new runtime logs or lifecycle tests"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
{
|
||||
"observedUtc": "2026-10-24T23:18:15.464284+00:00",
|
||||
"status": "PASS",
|
||||
"disposableContainer": "jobtracker-it-p9-requal-mariadb-test-1",
|
||||
"project": "jobtracker-it-p9-requal",
|
||||
"service": "mariadb-test",
|
||||
"tmpfsOnly": true,
|
||||
"loopbackPort": 33308,
|
||||
"remainingGeneratedSchemas": 0,
|
||||
"cleanupExitCode": 0,
|
||||
"containerAbsent": true,
|
||||
"developmentBefore": {
|
||||
"id": "9586dffa6f909794a8bd35a6239c03f969de9a530eea75cd01323584630b0f4c",
|
||||
"state": "exited",
|
||||
"volumes": [
|
||||
"jobtracker-local_mariadb_dev"
|
||||
]
|
||||
},
|
||||
"developmentAfter": {
|
||||
"id": "9586dffa6f909794a8bd35a6239c03f969de9a530eea75cd01323584630b0f4c",
|
||||
"state": "exited",
|
||||
"volumes": [
|
||||
"jobtracker-local_mariadb_dev"
|
||||
]
|
||||
},
|
||||
"dockerServer": "29.7.2",
|
||||
"scope": "Only the owned disposable test service was removed. Persistent development container/volume preserved. No production access/down-v/prune."
|
||||
}
|
||||
@@ -0,0 +1,343 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"observedUtc": "2026-10-25T02:25:57.975110+00:00",
|
||||
"scope": "Package files except this self-referential manifest plus selected raw process/native records. PDF input/report and runtime/helper hashes are chained through the respective manifests. Local raw artifacts and image archive are not asserted published in Git.",
|
||||
"files": {
|
||||
".artifacts/p9-remed-02/final/ai-exit.json": {
|
||||
"sha256": "e5de1091cf53edc948f22585517cfe348e4b1c1d739ce5cc055fe6c6c7b7de04",
|
||||
"bytes": 549
|
||||
},
|
||||
".artifacts/p9-remed-02/final/auth-exit.json": {
|
||||
"sha256": "f7a48b2670cec7edae23d0939653e91ad578a1690f68ea57e5d2f5b7d854dcde",
|
||||
"bytes": 562
|
||||
},
|
||||
".artifacts/p9-remed-02/final/backend/backend.trx": {
|
||||
"sha256": "c8c68a57852afe71bbfb08a9596fc81329867334147af316bfa70cae3a166f43",
|
||||
"bytes": 1626386
|
||||
},
|
||||
".artifacts/p9-remed-02/final/backend-exit.json": {
|
||||
"sha256": "6306f677a0adc040c7fa015b12e331c19008511adf667d46269ee2693bef01c5",
|
||||
"bytes": 615
|
||||
},
|
||||
".artifacts/p9-remed-02/final/build-exit.json": {
|
||||
"sha256": "f47c53c4872b71a4737c9f8e2ddfa7cf73e1529fd5dbd20badb52a201ed58a8f",
|
||||
"bytes": 372
|
||||
},
|
||||
".artifacts/p9-remed-02/final/diagnostics-exit.json": {
|
||||
"sha256": "33dee75bb303941d802771982ec83dfbb5475c206bc3f70b4358042c974d8d6e",
|
||||
"bytes": 604
|
||||
},
|
||||
".artifacts/p9-remed-02/final/discovery-exit.json": {
|
||||
"sha256": "ed2d91835abeda357d5aafc2f50a66d269cd8d2f15d4cec8253af7674d47c77b",
|
||||
"bytes": 534
|
||||
},
|
||||
".artifacts/p9-remed-02/final/frontend-exit.json": {
|
||||
"sha256": "a5c7e15691233fc6ac3007deecce64d4bb0109c378e5f20d70c1366577464024",
|
||||
"bytes": 485
|
||||
},
|
||||
".artifacts/p9-remed-02/final/ingress-exit.json": {
|
||||
"sha256": "c4f0c391f2ef85ab82c440982d6e876d01283bd66e4d3d63ea2ac0ea47e3b813",
|
||||
"bytes": 560
|
||||
},
|
||||
".artifacts/p9-remed-02/final/lint-exit.json": {
|
||||
"sha256": "9aa18577c60606c6ebdddbf3d0868f0c2ad267e8651a87b0157fb0b98da2774d",
|
||||
"bytes": 374
|
||||
},
|
||||
".artifacts/p9-remed-02/final/mariadb/mariadb.trx": {
|
||||
"sha256": "1e3642b161112f5349754747f928a6e023bb974fa3694aefa179c15712893aad",
|
||||
"bytes": 57075
|
||||
},
|
||||
".artifacts/p9-remed-02/final/mariadb-browser-exit.json": {
|
||||
"sha256": "9cb798144713e93cecdfcad6097e926d6659d98d912d087c7cb618e9545d7672",
|
||||
"bytes": 1994
|
||||
},
|
||||
".artifacts/p9-remed-02/final/mariadb-exit.json": {
|
||||
"sha256": "d3bc49f54a0c7ec8bb31fb02fdbe0228a9aa797ecb3ed06cd755757ebe7f4ccd",
|
||||
"bytes": 434
|
||||
},
|
||||
".artifacts/p9-remed-02/final/mariadb-observations-exit.json": {
|
||||
"sha256": "3b2d5b9659223d38a1ab6663a1946fd0cabb9b616c3040bda8d9f9ed56aaac36",
|
||||
"bytes": 2068
|
||||
},
|
||||
".artifacts/p9-remed-02/final/native-pdf.json": {
|
||||
"sha256": "b6e000f41de8f2eaee00dbe32fbef349752645ef298ee7112cfad96010b0046f",
|
||||
"bytes": 23913
|
||||
},
|
||||
".artifacts/p9-remed-02/final/ordinary-1-exit.json": {
|
||||
"sha256": "e21cbb80f7aa50e6c381c365b26bb4617705e72346d0550871e04926d844bd8b",
|
||||
"bytes": 542
|
||||
},
|
||||
".artifacts/p9-remed-02/final/ordinary-2-exit.json": {
|
||||
"sha256": "cfe9de61084bd9502236069bbc8e9c0242f32649ba2b9ecfaa542adca71ec073",
|
||||
"bytes": 542
|
||||
},
|
||||
".artifacts/p9-remed-02/final/ordinary-3-exit.json": {
|
||||
"sha256": "9ff105ee6987b1b599b52d7d318b55b33f9576902b8340e5f95738c2b0d346f6",
|
||||
"bytes": 540
|
||||
},
|
||||
".artifacts/p9-remed-02/final/ordinary-4-exit.json": {
|
||||
"sha256": "a2f489885e962859ab6b49dbe492659c92fc4a205ee60b88c1c73d3f05e0b7d3",
|
||||
"bytes": 531
|
||||
},
|
||||
".artifacts/p9-remed-02/final/pdf-admission-exit.json": {
|
||||
"sha256": "9900112eefaff8605ac58fde5fcdcae32689b5a0502cc2460e1dfc15014f782b",
|
||||
"bytes": 569
|
||||
},
|
||||
".artifacts/p9-remed-02/final/performance/result.json": {
|
||||
"sha256": "3cff8dc8b9a9d0ed252c25a0309a43aa5d0c007e02a6781ba8f9aa7214ab068c",
|
||||
"bytes": 815906
|
||||
},
|
||||
".artifacts/p9-remed-02/final/performance-exit.json": {
|
||||
"sha256": "1560e9e66bf4909040a9033e4f436444f6a881c92b0e04e714c85ad20d8270ec",
|
||||
"bytes": 2024
|
||||
},
|
||||
".artifacts/p9-remed-02/final/preferences-exit.json": {
|
||||
"sha256": "517d841fb627b1cc70751dbb17451849d2c0b1163a71c61256992793e105457f",
|
||||
"bytes": 613
|
||||
},
|
||||
".artifacts/p9-remed-02/final/rate-exit.json": {
|
||||
"sha256": "02303c6dcd213fca6c6c1ddb4dedb5deae5b218e65d7388f15b1c0a1a7663ee2",
|
||||
"bytes": 548
|
||||
},
|
||||
".artifacts/p9-remed-02/final/rd21-exit.json": {
|
||||
"sha256": "efedc8cda8e56fb6a0ef3976adcb40d002ad5061ef0c76383d758967922316df",
|
||||
"bytes": 601
|
||||
},
|
||||
".artifacts/p9-remed-02/final/rd21-volume-exit.json": {
|
||||
"sha256": "1caf39b6d9cd6226f2ad14c84269a906f25a5b333f56e73e785abfd46119b99b",
|
||||
"bytes": 599
|
||||
},
|
||||
".artifacts/p9-remed-02/final/security/commands.json": {
|
||||
"sha256": "3cb347539fd3bf227fb003ffd7da1bd12adbad75c3e6422c219b28f8ee54111f",
|
||||
"bytes": 4234
|
||||
},
|
||||
".artifacts/p9-remed-02/final/security/frontend-audit.json": {
|
||||
"sha256": "d9c606b6a528f555f39586a823dd8041ac8c0dd4333b0abc1e08df29b2550c08",
|
||||
"bytes": 365
|
||||
},
|
||||
".artifacts/p9-remed-02/final/security/nuget-advisories.log": {
|
||||
"sha256": "7fecc0be102f77c2d18f6c27db3cf9e7d94dda96fbb33235afba91782658e284",
|
||||
"bytes": 269
|
||||
},
|
||||
".artifacts/p9-remed-02/final/security/sbom.json": {
|
||||
"sha256": "870cfb203901909f3c260112d7343f0a4f02a7acaa45552713f7433612b5b74f",
|
||||
"bytes": 605465
|
||||
},
|
||||
".artifacts/p9-remed-02/final/sidecar-exit.json": {
|
||||
"sha256": "d9a91ee244304abfab8f9f68627f646cc3b4e5c780e3010decf66182abf0609a",
|
||||
"bytes": 546
|
||||
},
|
||||
".artifacts/p9-remed-02/final/sidecar.xml": {
|
||||
"sha256": "827566e05f683551a5ea66433b969aee0aac4e6fb9bcdf4d5fb8dfce99ff2beb",
|
||||
"bytes": 33455
|
||||
},
|
||||
".artifacts/p9-remed-02/final/types-exit.json": {
|
||||
"sha256": "648ba9add0344e545592cb6bfaf9a223b462e00f64edb0f5afcaa3413ec4d451",
|
||||
"bytes": 390
|
||||
},
|
||||
".artifacts/p9-remed-02/final/volume-exit.json": {
|
||||
"sha256": "bc5003d56f4f77890d56d8a09c98fdc2a7dd1c4f79fc878e2ede91f820ee2680",
|
||||
"bytes": 590
|
||||
},
|
||||
".artifacts/p9-remed-02/final-checks/cleanup.json": {
|
||||
"sha256": "f6c9dc755c989fa8dc73769c0f1e472801c3c5b34f7b60648650c76f04a60704",
|
||||
"bytes": 932
|
||||
},
|
||||
".artifacts/p9-remed-02/final-linux/linux-pdf.json": {
|
||||
"sha256": "43ee00f4e3f72cf90c56f9b9936ea30adf16e57f61678c80b63ab2cd5d072662",
|
||||
"bytes": 25356
|
||||
},
|
||||
".artifacts/p9-remed-02/renderer-capsule/result.json": {
|
||||
"sha256": "8942787fd48307014a06e44a25be47666c5dcb19f248815b2524b82781185241",
|
||||
"bytes": 925
|
||||
},
|
||||
".artifacts/p9-remed-02/representative-linux/oracle-inputs.json": {
|
||||
"sha256": "b263a6472eadecb98cd2e8f131203426086528aadcec3df6a212232ecc94bfc2",
|
||||
"bytes": 3950
|
||||
},
|
||||
".artifacts/p9-remed-02/representative-linux/result.json": {
|
||||
"sha256": "0aca9ddbed2d8fdfbdf213e10e3de9ccf729060ef5686e81a088b79dd0e5a4a7",
|
||||
"bytes": 55769
|
||||
},
|
||||
".artifacts/p9-remed-02/security-refresh-20261025/comparison.json": {
|
||||
"sha256": "b33bf7ff8f5363659f4c27708eb31459301aa92a1a11e4d16ea27d975fadc4e5",
|
||||
"bytes": 833
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/acceptance.json": {
|
||||
"sha256": "3030ab1a4340246930e038e6c0a006ee77d4e6551c3eb87a74467a6de491a6fe",
|
||||
"bytes": 2370
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/ACCEPTANCE_ADDENDUM_2026-10-25.md": {
|
||||
"sha256": "39e9a3e59c579cf4070498bc7784d0fbf9e20bfe6016ce7ffa8be9bab254c63c",
|
||||
"bytes": 12216
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/ci-isolation.json": {
|
||||
"sha256": "fba3d09f6656aa5062eb457754b53b0727553357cd393daf6ec323480dbe45a6",
|
||||
"bytes": 6908
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/ci-refresh.json": {
|
||||
"sha256": "eed7264c72a7b889ae5d4f7a18d94115013ee59a7ffe8db7732976404b27f6fa",
|
||||
"bytes": 7815
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/CI_ISOLATION.md": {
|
||||
"sha256": "483ac8201c5d3864b5ee1820549989177c1a884e00b0498e7a96ec55c0d712c1",
|
||||
"bytes": 10676
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/CI_REFRESH_2026-10-25.md": {
|
||||
"sha256": "19a5a35a15ea3ac275a16925b029efef1eddc5a6f071bd6db77f2e999b664a0f",
|
||||
"bytes": 4045
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/cleanup.json": {
|
||||
"sha256": "f6c9dc755c989fa8dc73769c0f1e472801c3c5b34f7b60648650c76f04a60704",
|
||||
"bytes": 932
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/COMMANDS.md": {
|
||||
"sha256": "bfac99e45b5fafa809b45e6cbf1a2940df5bff2f7cfd8a0e67d96620b7c3d5a0",
|
||||
"bytes": 5850
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/findings.json": {
|
||||
"sha256": "28931a4cc751e49b21d5882cdef26c9574416834e96965d46a5b9e78e31d2d21",
|
||||
"bytes": 124334
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/FINDINGS.md": {
|
||||
"sha256": "3da4000e71c9c528af8da909e9d0cfbce0cf47e5e7c6b7facfd476225641412d",
|
||||
"bytes": 37418
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/FONT_PACKAGING.md": {
|
||||
"sha256": "8f93ab6bece22a051954b6627127478f3d829d4d1a0dc36c147189b4003b37f9",
|
||||
"bytes": 4026
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/linux/playwright.config.ts": {
|
||||
"sha256": "7fafcf47592429bd471a3b71dd5516f013345c93f04018ee1a5c45c6566dfed5",
|
||||
"bytes": 906
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/linux-run.py": {
|
||||
"sha256": "71dc80666e4851d6564b4610b436eabb213c7d84153e5dc8a61fb820b840448c",
|
||||
"bytes": 1131
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/MANUAL_ACCEPTANCE.md": {
|
||||
"sha256": "3c22cff2cbe1a6c8ae1c2d373bbe2d5b1e7f93be364bad52706898baa7378f01",
|
||||
"bytes": 18090
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/mariadb-lane.py": {
|
||||
"sha256": "44d5ab4d45aba42b0e2d5f1b8a16b8ed8cb59b77e275fa72cb577f3464fe05d1",
|
||||
"bytes": 590
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/offline-checks.json": {
|
||||
"sha256": "75fd131f649ab30eba866309f4507aaa9261ae16d1139b25bbe824d8e032408b",
|
||||
"bytes": 685
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/pdf-baseline.json": {
|
||||
"sha256": "96000091b1fc8980f9bde8bf5bd6ca65b379368c63c436966f30212c2032c4e7",
|
||||
"bytes": 1011
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/pdf-remediation.json": {
|
||||
"sha256": "1956098d251d787cc1d4ec623a2f1f0126ea05c55d577d13f4c2b952bec96eaf",
|
||||
"bytes": 38000
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/pdf-static-checkpoint.json": {
|
||||
"sha256": "ee8f7bf868dd37327ef7dd2af37e30b5ec06421aa85a73abd41a8aa236a1bbd8",
|
||||
"bytes": 25297
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/PDF_PIPELINE.md": {
|
||||
"sha256": "8fbaa3ac1084bd512befd3d07596a1c5b341b3b0e783f79ff5be8cdc94e1a46a",
|
||||
"bytes": 8825
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/PDF_REMEDIATION.md": {
|
||||
"sha256": "13cdb50c36d744484700fce39fc2844206c61c7a64168a0c46961defa8530ada",
|
||||
"bytes": 6144
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/PLAN.md": {
|
||||
"sha256": "7dd0f773c123452cb52abfc7b2e000b688fda2d1aa5e87359097062d2e770e02",
|
||||
"bytes": 7512
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/preservation.json": {
|
||||
"sha256": "f4766b977d1443c57688671c22d2cd3f24e8122abd374c5d5b29333847b677be",
|
||||
"bytes": 231495
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/PRESERVATION.md": {
|
||||
"sha256": "516fa3cdc2289f89c5496f2f5c5e6449a65e564284ef9dad52660c19fb620562",
|
||||
"bytes": 2926
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/publication-checks.json": {
|
||||
"sha256": "5517d86b31cefba032e39a4313592df2e4be1ca828a913be9c1a2c03d5abcae7",
|
||||
"bytes": 535
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/publication.json": {
|
||||
"sha256": "093822216ab2d43d47483995bf4b7bc375b052b3835f1a612d19941aef8a7807",
|
||||
"bytes": 1187
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/qualification-inputs.json": {
|
||||
"sha256": "15ade9af91e0cab62ecbd7e46e8dbcf0102d693c741b2d10638a2191e4d44ee2",
|
||||
"bytes": 6239
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/README.md": {
|
||||
"sha256": "a45c9d03fb62e13ef3343b7c158b9f2429cc55666b85e4717e28320bfe1f0d3a",
|
||||
"bytes": 1525
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/reconcile.py": {
|
||||
"sha256": "93e92db64f2248d56ad44d5b261e45c7c05dc24710eb6067b458c9b6749c621f",
|
||||
"bytes": 12485
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/renderer-capsule.json": {
|
||||
"sha256": "8942787fd48307014a06e44a25be47666c5dcb19f248815b2524b82781185241",
|
||||
"bytes": 925
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/renderer-runtime-inventory.txt": {
|
||||
"sha256": "c772f6f92be4aca93b96d85b8c7867c36175c8fdff22e1d3ec13d49ef314c5b7",
|
||||
"bytes": 8711
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/representative/long-skills.spec.ts": {
|
||||
"sha256": "209a414d48c6991d84b03d1183f29a59bffbf62e96602a735f40a31d34ec61f0",
|
||||
"bytes": 5519
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/representative/playwright.config.ts": {
|
||||
"sha256": "7b578ac1291da2f560525c5488cde8bd1ff51949d4dc1ad5c14da530c772dc8a",
|
||||
"bytes": 620
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/representative/proof.py": {
|
||||
"sha256": "ee8880abe5a7ca441cb0a8c5d66b29d491f63723ae16bae245a362b4c7872653",
|
||||
"bytes": 3194
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/runtime-source.json": {
|
||||
"sha256": "7b1c11b926a675f5ef2444c59fb62141590b29b07d6a78f1e1348a908d4e157a",
|
||||
"bytes": 142538
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/security/ADVISORIES.md": {
|
||||
"sha256": "7c3d6a3a927402510e91fe44dc3c0a0ea30fbc24f8be10ec367946fcfde2a3cb",
|
||||
"bytes": 17919
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/security/advisory-inventory.json": {
|
||||
"sha256": "1f4f1fe8400e4f78d9c9b2d21f28b1c09a75a064ee69144231215aca13cf975b",
|
||||
"bytes": 794994
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/security/final-refresh.json": {
|
||||
"sha256": "b33bf7ff8f5363659f4c27708eb31459301aa92a1a11e4d16ea27d975fadc4e5",
|
||||
"bytes": 833
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/security/REMEDIATION.md": {
|
||||
"sha256": "98025d19e5dfc752222ba3861eaa457e8562bf7f4016a3cfc3ebabae90ee3e41",
|
||||
"bytes": 8187
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/security/validation.json": {
|
||||
"sha256": "f8b73bcbfe1537cd606b2fbb26dfb8621eac4c5931c9366f18d6a99e8f510b7f",
|
||||
"bytes": 4380
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/SOURCE_REVIEW.md": {
|
||||
"sha256": "1b1c1e41d0216eb5736c7e5bd0807ccd9007924e450d16acd688a8b89b729ce9",
|
||||
"bytes": 3547
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/test-reconcile.py": {
|
||||
"sha256": "88985f3d517a90b19175570f97ca2134a682d94b2b36327b64323a6078f678dd",
|
||||
"bytes": 3211
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/TODO.md": {
|
||||
"sha256": "53a8fcbd4fd64284d03185331f3ab1af9b3efe71f291b677541a9a10f0fb9d51",
|
||||
"bytes": 1366
|
||||
},
|
||||
"docs/redesign/phase-9/p9-remed-02/validation.json": {
|
||||
"sha256": "fdbfa54a7b3c0bcfdf99057cc58c803832ecb35c6809428f1e4fb2ff61f773b1",
|
||||
"bytes": 1990115
|
||||
}
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -17,5 +17,7 @@ if sys.argv[1] != 'baseline':
|
||||
runner.IMAGE = 'jobtracker-p9-remed-api:fonts'
|
||||
runner.VERSION = 'p9-remed-02-fonts'
|
||||
runner.CONFIG = '../docs/redesign/phase-9/p9-remed-02/linux/playwright.config.ts'
|
||||
if sys.argv[1] == 'representative-linux':
|
||||
runner.CONFIG = '../docs/redesign/phase-9/p9-remed-02/representative/playwright.config.ts'
|
||||
runner.COMMIT = subprocess.check_output(['rtk','proxy','git','rev-parse','HEAD'],text=True).strip()
|
||||
runner.main()
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
"""Reuse the guarded provider/browser workload lifecycle with a new evidence destination."""
|
||||
import importlib.util
|
||||
from pathlib import Path
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
spec = importlib.util.spec_from_file_location('qualified_mariadb_lane', HERE.parent/'p9-requal-01/mariadb-lane.py')
|
||||
runner = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(runner)
|
||||
runner.OUT = runner.ROOT/'.artifacts/p9-remed-02/final'
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
raise SystemExit(runner.main())
|
||||
except ValueError as error:
|
||||
raise SystemExit(runner.scrub(str(error)))
|
||||
@@ -0,0 +1,34 @@
|
||||
[
|
||||
{
|
||||
"name": "prior-reconciliation",
|
||||
"command": [
|
||||
"python",
|
||||
"docs/redesign/phase-9/p9-requal-01/test-reconcile.py"
|
||||
],
|
||||
"exitCode": 0
|
||||
},
|
||||
{
|
||||
"name": "prior-lifecycle",
|
||||
"command": [
|
||||
"python",
|
||||
"docs/redesign/phase-9/p9-requal-01/test-mariadb-lane.py"
|
||||
],
|
||||
"exitCode": 0
|
||||
},
|
||||
{
|
||||
"name": "prior-linux",
|
||||
"command": [
|
||||
"python",
|
||||
"docs/redesign/phase-9/p9-requal-01/test-linux-run.py"
|
||||
],
|
||||
"exitCode": 0
|
||||
},
|
||||
{
|
||||
"name": "successor-reconciliation",
|
||||
"command": [
|
||||
"python",
|
||||
"docs/redesign/phase-9/p9-remed-02/test-reconcile.py"
|
||||
],
|
||||
"exitCode": 0
|
||||
}
|
||||
]
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"observedUtc": "2026-10-25T02:25:57.963495+00:00",
|
||||
"status": "PASS",
|
||||
"localMarkdownLinks": "PASS",
|
||||
"uniqueFindings": 60,
|
||||
"preservationGroups": 57,
|
||||
"supportedRoutes": 33,
|
||||
"frozenRuntimeInputs": 1098,
|
||||
"frozenHelpers": 42,
|
||||
"zeroSourceDrift": true,
|
||||
"functionalResults": "PASS",
|
||||
"globalGateExitCode": 1,
|
||||
"expectedUnclosed": [
|
||||
"python-advisories:FINDINGS",
|
||||
"hosted-mariadb:BLOCKED"
|
||||
],
|
||||
"independentFinalNarrativeReview": "UNAVAILABLE: reviewer usage limit; primary-agent checks only"
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"reportDate": "2026-10-25",
|
||||
"branch": "fix/p9-pdf-security-requalification",
|
||||
"baseline": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
|
||||
"mainExpected": "5f835e54a9b74e6b71418422e28431b2af06453f",
|
||||
"applicationCheckpoint": "b313e20bade4def9b8c23d32410278e0333d642c",
|
||||
"validatedPushedCheckpoints": [
|
||||
"0554e27af1f2695767bde18d68e776ccdf76d5cd",
|
||||
"57dd88322a1fc363a83f974ac07a9f1dbfd6c16e",
|
||||
"e80815f8df94d26f7d35b8249b4e6e1a65922df3",
|
||||
"b313e20bade4def9b8c23d32410278e0333d642c"
|
||||
],
|
||||
"evidenceCheckpoint": "The Git commit containing this file; no self-referential commit hash asserted.",
|
||||
"finalReceipt": ".artifacts/p9-remed-02/publication-receipt.json",
|
||||
"verificationRequired": [
|
||||
"normal push only",
|
||||
"direct remote branch equals local HEAD",
|
||||
"clean working tree",
|
||||
"3727a72 and original0d16RD21 ancestry",
|
||||
"local and remote main unchanged"
|
||||
],
|
||||
"prohibitedOperationsPerformed": false,
|
||||
"localFunctionalComplete": true,
|
||||
"automationComplete": false,
|
||||
"reconciliationExitCode": 1,
|
||||
"expectedRemainingGateStates": [
|
||||
"python-advisories:FINDINGS",
|
||||
"hosted-mariadb:BLOCKED"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
{
|
||||
"purpose": "Qualification helper snapshot before provider, supplemental and refresh execution; primary runtime source1098 separately frozen.",
|
||||
"inputs": {
|
||||
".artifacts/p9-remed-02/final-provider-stage.py": "b3b56e4072f2f30b87bdafe69d02a6c90a8acb2f95c4b927d8cf9e2057796a27",
|
||||
".artifacts/p9-remed-02/final-run.py": "0ac377fb99852317b6192dd251e1f66e620a6f23709f0d735c905818b526548b",
|
||||
".artifacts/p9-remed-02/final-stage.py": "d207fe7a4e053316807c7b28dcc81e9eb63b500f0840ae6af25b934270dcc3e9",
|
||||
".artifacts/p9-remed-02/representative-stage.py": "e7fd653c1049d66dc77081e33646527d05b609f178d930b9a5812eb8e1867dc7",
|
||||
".artifacts/p9-remed-02/security-refresh.py": "2b212e73ea0878849fd111ea3406f8af0ed0d293f56a65298d5340b25dc69255",
|
||||
"docs/redesign/phase-5/p5-15/p5-15-01/diagnostics/playwright.config.ts": "f05fcaee1d3e63b740677f6974b8be44b07678e9d0eda98e2c696290e39be85d",
|
||||
"docs/redesign/phase-5/p5-15/p5-15-01/diagnostics/preferences.spec.ts": "697f9ec511d275cd86515c7d0963da152855c78a96edcc692a6a477e02c778f8",
|
||||
"docs/redesign/phase-9/p9-05/diagnostics/accessibility.spec.ts": "d3f50d569eb46f9a7d7468d798770d481fc8c0819b13543f0dde9d23cb6f3e30",
|
||||
"docs/redesign/phase-9/p9-05/diagnostics/data.spec.ts": "b33a99c3b280f7cac8ed4294e0a4a0a297f4761708e5414e3bf768f8146a7780",
|
||||
"docs/redesign/phase-9/p9-05/diagnostics/matrix.spec.ts": "5ff904f619cc195fc3f8b8d5c74ff482d63a3048da38494b29fed349d4d0c699",
|
||||
"docs/redesign/phase-9/p9-05/diagnostics/playwright.config.ts": "66918486833e0184cb1920b06186e3cd3a7d62041102162089821c05d12ee614",
|
||||
"docs/redesign/phase-9/p9-05/diagnostics/sustained.spec.ts": "76db0ac115e4745b67186b116421e2d7c374bd2e8f87a2fd40f04215e7b463c2",
|
||||
"docs/redesign/phase-9/p9-05/volume/playwright.config.ts": "0df97a9de76c0bbb9a0035fcec00bda0a665e0e6ba92ae5377bfc20869dac1c6",
|
||||
"docs/redesign/phase-9/p9-05/volume/volume.spec.ts": "9a3abd9f4a8fe558e643bf481dc9a0d1857975e9d532fda6c95e27cf437f7908",
|
||||
"docs/redesign/phase-9/p9-remed-02/linux-run.py": "71dc80666e4851d6564b4610b436eabb213c7d84153e5dc8a61fb820b840448c",
|
||||
"docs/redesign/phase-9/p9-remed-02/linux/playwright.config.ts": "7fafcf47592429bd471a3b71dd5516f013345c93f04018ee1a5c45c6566dfed5",
|
||||
"docs/redesign/phase-9/p9-remed-02/mariadb-lane.py": "44d5ab4d45aba42b0e2d5f1b8a16b8ed8cb59b77e275fa72cb577f3464fe05d1",
|
||||
"docs/redesign/phase-9/p9-remed-02/representative/long-skills.spec.ts": "209a414d48c6991d84b03d1183f29a59bffbf62e96602a735f40a31d34ec61f0",
|
||||
"docs/redesign/phase-9/p9-remed-02/representative/playwright.config.ts": "7b578ac1291da2f560525c5488cde8bd1ff51949d4dc1ad5c14da530c772dc8a",
|
||||
"docs/redesign/phase-9/p9-requal-01/linux-run.py": "106970e3bb6c0a7cd090caea195c5002f0accc029f286c1058460dc3be3f4e63",
|
||||
"docs/redesign/phase-9/p9-requal-01/linux/playwright.config.ts": "89f12b541a018789798d118c66f748963ede2c10b008a3e4c0e79140899f06a0",
|
||||
"docs/redesign/phase-9/p9-requal-01/mariadb-lane.py": "b9b4c75a556bb2d38293db5959887c175ee43036f6e71592d31f552df7decbb6",
|
||||
"docs/redesign/phase-9/p9-requal-01/observations/persistence.spec.ts": "8a85878b9b39b142738adb150c92e7a73dd9dee87a17b69a48c96d045cdc516b",
|
||||
"docs/redesign/phase-9/p9-requal-01/observations/playwright.config.ts": "05f53ebf7eb1786a57eac32289346d27641609815a2127ad1641c0ebc27fda81",
|
||||
"docs/redesign/phase-9/p9-requal-01/pdf-proof.py": "958f9d88a4475c78a20dee1f76fa961885cbfdef4212e45eca18eac4ffa85b9a",
|
||||
"docs/redesign/phase-9/p9-requal-01/performance/mariadb-proof.mjs": "d0ead1e67db241f478b28fcb57c55a9932a41f45fe4e6de2104fc28c636810bc",
|
||||
"docs/redesign/phase-9/p9-requal-01/performance/metrics.mjs": "fc61dec32c67c30b26d8c07c9224685847526856a8b1bf345873cf5c11d554ba",
|
||||
"docs/redesign/phase-9/p9-requal-01/performance/playwright.config.ts": "68308727bd544a82cebc640b0a84c732cc70d23283c3b9d1c6c5a8d6c939d99b",
|
||||
"docs/redesign/phase-9/p9-requal-01/performance/sustained.spec.ts": "7bc1fb44a077865149ce28fb15ecae37ce2e01baebb444cb7ae9bd7e8efad010",
|
||||
"docs/redesign/phase-9/p9-requal-01/reconcile.py": "7b96482362341b2572b8b4b7f682811eeb005b42ebc039fc08126bde5c533f78",
|
||||
"docs/redesign/phase-9/p9-requal-01/test-linux-run.py": "feaafae7d85642c33208c86a6c76ff132f409a00bc71087db938cf46fee05c16",
|
||||
"docs/redesign/phase-9/p9-requal-01/test-mariadb-lane.py": "7cc4b7a892d44a8b3dd305474a3bbfc8afd33e912b645be769416317cadf1e17",
|
||||
"docs/redesign/phase-9/p9-requal-01/test-reconcile.py": "34a9428edfc34e192b1db200da5fbe49bc15588e725c8eae9b37e6ee76634304",
|
||||
"docs/redesign/phase-9/rd21-remediation/diagnostics/persistence.spec.ts": "3a41ff274fff9e29522698ce08c79e3b23a9b9c197f24e252b20e43d76d1497c",
|
||||
"docs/redesign/phase-9/rd21-remediation/diagnostics/playwright.config.ts": "5b655b8d1d28b405893c3ee8fcad4d5c07ed7c1e8c1b20c4dad92ec1d67a813a",
|
||||
"docs/redesign/phase-9/rd21-remediation/diagnostics/readonly-db-proof.py": "da08c21c5a1f39075a45d1ff92c863ec8fe8d401d0c90ec80b45898e65729d7c",
|
||||
"docs/redesign/phase-9/rd21-remediation/diagnostics/sustained.spec.ts": "d7c03d76021f546031cb2a2645fc99f0db9eb43ee0ad861fdc91a77c207726cb",
|
||||
"docs/redesign/phase-9/rd21-remediation/volume/playwright.config.ts": "9a689d58947778fbe601d4287129f49dc85a69688b3ba1d76bbada47a6d5a4f5",
|
||||
"docs/redesign/phase-9/rd21-remediation/volume/volume.spec.ts": "e682394b0c11116df9e588fbb2ce923184c32eb0dd0475c4fd94f2914302be96",
|
||||
"scripts/mariadb-integration.py": "410cede3ca8794de99735a579ac626a34b6a56ee89c6ef63880d692153c7cd97",
|
||||
"scripts/verify-cv-fidelity.py": "64f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87",
|
||||
"docs/redesign/phase-9/p9-remed-02/representative/proof.py": "ee8880abe5a7ca441cb0a8c5d66b29d491f63723ae16bae245a362b4c7872653"
|
||||
},
|
||||
"reportingOnlyInputsAtSplit": {
|
||||
"docs/redesign/phase-9/p9-remed-02/reconcile.py": "509c613768d3916c460dbf0761f573064e8803729c15f3629b74a6dc5870dab4",
|
||||
"docs/redesign/phase-9/p9-remed-02/test-reconcile.py": "d2d924e838275717716754180621fde476e58f7177da5aac1c477d4ab940028e"
|
||||
},
|
||||
"reportingPolicy": "Reporting-only collector/test may receive final evidence readers; final hash and4guard outcomes recorded at publication. Executed producer/lifecycle inputs remain immutable."
|
||||
}
|
||||
@@ -0,0 +1,148 @@
|
||||
"""Source-bound successor accounting; the one declared frontend addition never masks missing cases."""
|
||||
import copy
|
||||
import datetime
|
||||
import importlib.util
|
||||
import hashlib
|
||||
import json
|
||||
import sys
|
||||
import xml.etree.ElementTree as ET
|
||||
from pathlib import Path
|
||||
|
||||
HERE=Path(__file__).resolve().parent
|
||||
spec=importlib.util.spec_from_file_location('qualified_reconciliation',HERE.parent/'p9-requal-01/reconcile.py')
|
||||
prior=importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(prior)
|
||||
ROOT=prior.ROOT
|
||||
RAW=ROOT/'.artifacts/p9-remed-02/final'
|
||||
prior.RAW=RAW
|
||||
ADDED_CASE='focusing a preview retry control keeps its pointer target stationary'
|
||||
|
||||
def validate_representative(proof,report):
|
||||
expected={'long-skills-minimal-en','long-skills-technical-nb'}
|
||||
cases=report.get('fixtures',[])
|
||||
if (proof.get('status')!='PASS' or proof.get('oracleExitCode')!=0
|
||||
or report.get('total')!=2 or report.get('passed')!=2 or len(cases)!=2
|
||||
or {case.get('fixture') for case in cases}!=expected
|
||||
or any(case.get('pass') is not True or case.get('failures')!=[] for case in cases)
|
||||
or proof.get('cases')!=cases):
|
||||
raise ValueError('Supplemental PDF membership, oracle outcome or retained cases differ.')
|
||||
|
||||
def require_unchanged(inputs):
|
||||
if any(not Path(name).is_file() or hashlib.sha256(Path(name).read_bytes()).hexdigest()!=digest for name,digest in inputs.items()):
|
||||
raise ValueError('Supplemental PDF input/report drift.')
|
||||
|
||||
def frontend_cases(report,baseline,exit_code):
|
||||
reference=copy.deepcopy(baseline)
|
||||
suites=[suite for suite in reference['testResults'] if suite['name'].replace('\\','/').endswith('/job-tracker-ui/src/cv-builder-deep-link.test.tsx')]
|
||||
if len(suites)!=1: raise ValueError('Missing or ambiguous frontend membership reference.')
|
||||
# This adds an expectation, never an execution outcome, to the old934-case multiset.
|
||||
suites[0]['assertionResults'].append({'fullName':ADDED_CASE})
|
||||
return prior.jest_results(report,reference,exit_code,935)
|
||||
|
||||
def main():
|
||||
results={'backend':prior.collect_trx('backend','backend/backend.trx',1130),
|
||||
'mariadb':prior.collect_trx('mariadb','mariadb/mariadb.trx',35)}
|
||||
for i in range(1,5): results[f'ordinary-{i}']=prior.collect_browser(f'ordinary-{i}')
|
||||
try:
|
||||
if any(results[f'ordinary-{i}']['status']!='PASS' for i in range(1,5)): raise ValueError('Incomplete ordinary shards.')
|
||||
cases=prior.reconcile_ordinary(prior.load(RAW/'discovery.json'),[results[f'ordinary-{i}']['cases'] for i in range(1,5)])
|
||||
if len(cases)!=362: raise ValueError('Unexpected ordinary discovery membership.')
|
||||
results['ordinary']={'status':'PASS','passed':362,'discovery':prior.identity(RAW/'discovery.json')}
|
||||
except (FileNotFoundError,ValueError) as error: results['ordinary']={'status':'NOT_COMPLETE','reason':str(error)}
|
||||
for name,count in {'ai':2,'auth':2,'rate':9,'ingress':6,'pdf-admission':1,'preferences':3,'rd21':6,'diagnostics':18,'volume':3,'rd21-volume':3,'mariadb-browser':1,'mariadb-observations':2}.items():
|
||||
results[name]=prior.collect_browser(name,count)
|
||||
old_raw=prior.RAW
|
||||
prior.RAW=ROOT/'.artifacts/p9-remed-02/final-linux'
|
||||
results['linux-renderer']=prior.collect_browser('linux-renderer',5)
|
||||
prior.RAW=ROOT/'.artifacts/p9-remed-02/representative-linux'
|
||||
representative=prior.collect_browser('linux-renderer',2)
|
||||
try:
|
||||
proof=prior.load(prior.RAW/'result.json')
|
||||
root=prior.RAW/'linux/fidelity'
|
||||
report=prior.load(root/'fidelity-results.json')
|
||||
validate_representative(proof,report)
|
||||
measurements=prior.load(root/'measurements.json')
|
||||
if len(measurements['fixtures'])!=2 or {case['fixture'] for case in measurements['fixtures']}!={case['fixture'] for case in report['fixtures']}:
|
||||
raise ValueError('Supplemental measurements membership differs.')
|
||||
binding=prior.RAW/'oracle-inputs.json'
|
||||
inputs=prior.load(binding)['inputs']
|
||||
if proof.get('inputs')!=inputs or proof.get('reportSha256')!=hashlib.sha256((root/'fidelity-results.json').read_bytes()).hexdigest():
|
||||
raise ValueError('Supplemental producer input/report binding differs.')
|
||||
oracle=str((ROOT/'scripts/verify-cv-fidelity.py').resolve())
|
||||
if inputs.get(oracle)!='64f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87':
|
||||
raise ValueError('Supplemental original oracle identity differs.')
|
||||
for case in report['fixtures']:
|
||||
for name in ['render.html','export.pdf','measurements.json']:
|
||||
if str((root/case['fixture']/name).resolve()) not in inputs: raise ValueError('Supplemental required artifact missing.')
|
||||
require_unchanged(inputs)
|
||||
representative['oracle']=proof
|
||||
representative['oracleEvidence']=prior.identity(prior.RAW/'result.json')
|
||||
representative['inputBinding']=prior.identity(binding)
|
||||
representative['report']=prior.identity(root/'fidelity-results.json')
|
||||
except FileNotFoundError as error: representative.update(status='NOT_COMPLETE',reason=str(error))
|
||||
except ValueError as error: representative.update(status='FAIL',reason=str(error))
|
||||
results['pdf-representative']=representative
|
||||
prior.RAW=old_raw
|
||||
try:
|
||||
path=RAW/'frontend.json';data=prior.load(path);process=prior.load(RAW/'frontend-exit.json')
|
||||
reference=ROOT/'.artifacts/p9-requal-01/frontend.json'
|
||||
accepted=prior.load(HERE.parent/'p9-requal-01/validation.json')['results']['frontend']['report']['sha256']
|
||||
if prior.identity(reference)['sha256']!=accepted: raise ValueError('Historical frontend reference changed.')
|
||||
if f"test('{ADDED_CASE}'" not in (ROOT/'job-tracker-ui/src/cv-builder-deep-link.test.tsx').read_text(encoding='utf-8'): raise ValueError('Declared added regression is absent from source.')
|
||||
cases=frontend_cases(data,prior.load(reference),process['exitCode'])
|
||||
expected={'numPassedTests':935,'numTotalTests':935,'numFailedTests':0,'numPendingTests':0,'numTodoTests':0,'numPassedTestSuites':105,'numTotalTestSuites':105,'numFailedTestSuites':0}
|
||||
if any(data.get(k)!=v for k,v in expected.items()): raise ValueError('Frontend aggregate counts differ.')
|
||||
results['frontend']={'status':'PASS','passed':935,'suites':105,'cases':cases,'report':prior.identity(path),'process':process,'membershipReference':prior.identity(reference),'declaredAddedCase':ADDED_CASE}
|
||||
except FileNotFoundError as error: results['frontend']={'status':'NOT_RUN','reason':str(error)}
|
||||
except ValueError as error: results['frontend']={'status':'FAIL','reason':str(error)}
|
||||
for name in ['types','lint','build','sidecar']:
|
||||
try:
|
||||
process=prior.load(RAW/(name+'-exit.json'))
|
||||
result={'status':'PASS' if process['exitCode']==0 else 'FAIL','process':process,'log':prior.identity(RAW/(name+'.log'))}
|
||||
if name=='sidecar':
|
||||
result['cases']=prior.sidecar_results(ET.parse(RAW/'sidecar.xml').getroot(),58)
|
||||
result['report']=prior.identity(RAW/'sidecar.xml')
|
||||
results[name]=result
|
||||
except FileNotFoundError as error: results[name]={'status':'NOT_RUN','reason':str(error)}
|
||||
except ValueError as error: results[name]={'status':'FAIL','reason':str(error)}
|
||||
for name,path in [('performance',RAW/'performance/result.json'),('windows-pdf',RAW/'native-pdf.json'),('linux-pdf',ROOT/'.artifacts/p9-remed-02/final-linux/linux-pdf.json')]:
|
||||
try:
|
||||
data=prior.load(path)
|
||||
if name.endswith('pdf'):
|
||||
if hashlib.sha256((ROOT/'scripts/verify-cv-fidelity.py').read_bytes()).hexdigest()!='64f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87': raise ValueError('Original PDF oracle changed.')
|
||||
if data.get('inputDrift') or any(hashlib.sha256(Path(file).read_bytes()).hexdigest()!=digest for file,digest in data['inputs'].items()): raise ValueError('PDF inputs changed after qualification.')
|
||||
if len(data['lanes'])!=2 or any(lane['status']!='PASS' or lane['exitCode']!=0 or hashlib.sha256(Path(lane['report']).read_bytes()).hexdigest()!=lane['reportSha256'] for lane in data['lanes']): raise ValueError('PDF lane/report failure or drift.')
|
||||
results[name]={'status':data['status'],'record':data,'evidence':prior.identity(path)}
|
||||
except FileNotFoundError as error: results[name]={'status':'NOT_RUN','reason':str(error)}
|
||||
except ValueError as error: results[name]={'status':'FAIL','reason':str(error)}
|
||||
try:
|
||||
path=RAW/'security/commands.json';commands=prior.load(path)
|
||||
passed,vulnerabilities=prior.security_results(commands,prior.load(RAW/'security/frontend-audit.json'),prior.load(RAW/'security/nuget-advisories.log'))
|
||||
results['security-helpers']={'status':'PASS' if passed else 'FAIL','commands':commands,'evidence':prior.identity(path),'nugetVulnerabilities':vulnerabilities,'scope':'Twelve bounded helpers/audits; not Python advisory closure.'}
|
||||
except FileNotFoundError as error: results['security-helpers']={'status':'NOT_RUN','reason':str(error)}
|
||||
except ValueError as error: results['security-helpers']={'status':'FAIL','reason':str(error)}
|
||||
security=prior.load(HERE/'security/validation.json')
|
||||
if prior.identity(ROOT/security['dependencyGraph']['lock']['path'])['sha256']!=security['dependencyGraph']['lock']['sha256']: raise ValueError('Python lock changed after assessment.')
|
||||
python_result={'status':'NOT_COMPLETE','gate':security['gate'],'accounting':security['accounting'],'evidence':prior.identity(HERE/'security/validation.json'),'inventory':prior.identity(HERE/'security/advisory-inventory.json')}
|
||||
refresh=ROOT/'.artifacts/p9-remed-02/security-refresh-20261025/comparison.json'
|
||||
try:
|
||||
latest=prior.load(refresh)
|
||||
if not latest['sameLock']: raise ValueError('Refreshed advisory lock differs.')
|
||||
python_result.update(status='FINDINGS' if latest['sameAdvisoryIdentities'] else 'FINDINGS_UPDATED',refresh=latest,refreshEvidence=prior.identity(refresh))
|
||||
except FileNotFoundError: python_result['reason']='Final exact-pin advisory refresh not complete.'
|
||||
results['python-advisories']=python_result
|
||||
results['hosted-mariadb']={'status':'BLOCKED','executedMariaDbCases':0,'evidence':prior.identity(HERE/'ci-isolation.json'),'metadataRefresh':prior.identity(HERE/'ci-refresh.json'),'scope':'Historical host-network/socket blocker; current metadata supplies no live private-isolation or database-execution proof.'}
|
||||
manifest=prior.load(RAW/'source-freeze.json')
|
||||
drift=[name for name,digest in manifest['inputs'].items() if not (ROOT/name).is_file() or hashlib.sha256((ROOT/name).read_bytes()).hexdigest()!=digest]
|
||||
helpers=prior.load(RAW/'qualification-inputs.json')
|
||||
helper_drift=[name for name,digest in helpers['inputs'].items() if not (ROOT/name).is_file() or hashlib.sha256((ROOT/name).read_bytes()).hexdigest()!=digest]
|
||||
local={k:v for k,v in results.items() if k not in ['python-advisories','hosted-mariadb']}
|
||||
record={'schemaVersion':1,'observedUtc':datetime.datetime.now(datetime.timezone.utc).isoformat(),'collectionOnly':'--collect-only' in sys.argv,'baseline':'3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28','branch':'fix/p9-pdf-security-requalification','sourceIdentity':prior.identity(RAW/'source-freeze.json'),'applicationCheckpoint':manifest['applicationCheckpoint'],'frozenInputCount':len(manifest['inputs']),'runtimeDrift':drift,'helperIdentity':prior.identity(RAW/'qualification-inputs.json'),'frozenHelperCount':len(helpers['inputs']),'helperDrift':helper_drift,'countPolicy':'Separate lanes; focused/predecessor executions are not added to complete successor totals. Frontend expects historical934 multiset plus one declared regression.','localFunctionalComplete':not drift and not helper_drift and all(v['status']=='PASS' for v in local.values()),'automationComplete':not drift and not helper_drift and all(v['status']=='PASS' for v in results.values()),'results':results}
|
||||
(HERE/'validation.json').write_text(json.dumps(record,indent=2)+'\n',encoding='utf-8')
|
||||
print(json.dumps({name:value['status'] for name,value in results.items()}))
|
||||
if drift or helper_drift: raise SystemExit('Frozen runtime/helper input drift: '+str(drift+helper_drift))
|
||||
if '--collect-only' not in sys.argv:
|
||||
try: prior.require_complete(results)
|
||||
except ValueError as error: raise SystemExit(str(error))
|
||||
|
||||
if __name__=='__main__':main()
|
||||
@@ -0,0 +1,15 @@
|
||||
{
|
||||
"status": "PASS",
|
||||
"observedUtc": "2026-10-24T23:16:30.983185+00:00",
|
||||
"localImageId": "sha256:0d1cb44ba8f71d54de77459915a7052b894191cfeb75aa32f0c1e7ffdc21fda6",
|
||||
"tags": [
|
||||
"jobtracker-p9-remed-api:fonts",
|
||||
"jobtracker-p9-remed-api:qualified-e80815f"
|
||||
],
|
||||
"archive": ".artifacts/p9-remed-02/renderer-capsule/qualified-renderer.tar",
|
||||
"archiveBytes": 377384960,
|
||||
"archiveSha256": "9b98865b14305f97d13502f785fb88129e205229f42e8a6c8980f74f5664fba5",
|
||||
"runtimeInventorySha256": "c772f6f92be4aca93b96d85b8c7867c36175c8fdff22e1d3ec13d49ef314c5b7",
|
||||
"sourceApiCheckpoint": "e80815f",
|
||||
"scope": "Static API image replay capsule, not a database/container/volume backup or asserted pullable registry reference. Runtime database data/credentials/tmpfs are not committed to this image. Local-only, never uploaded or deployed. Source rebuilds using floating base/apt tags require new qualification."
|
||||
}
|
||||
@@ -0,0 +1,297 @@
|
||||
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
|
||||
NAME="Debian GNU/Linux"
|
||||
VERSION_ID="12"
|
||||
VERSION="12 (bookworm)"
|
||||
VERSION_CODENAME=bookworm
|
||||
ID=debian
|
||||
HOME_URL="https://www.debian.org/"
|
||||
SUPPORT_URL="https://www.debian.org/support"
|
||||
BUG_REPORT_URL="https://bugs.debian.org/"
|
||||
LANG=
|
||||
LANGUAGE=
|
||||
LC_CTYPE="POSIX"
|
||||
LC_NUMERIC="POSIX"
|
||||
LC_TIME="POSIX"
|
||||
LC_COLLATE="POSIX"
|
||||
LC_MONETARY="POSIX"
|
||||
LC_MESSAGES="POSIX"
|
||||
LC_PAPER="POSIX"
|
||||
LC_NAME="POSIX"
|
||||
LC_ADDRESS="POSIX"
|
||||
LC_TELEPHONE="POSIX"
|
||||
LC_MEASUREMENT="POSIX"
|
||||
LC_IDENTIFICATION="POSIX"
|
||||
LC_ALL=
|
||||
adduser 3.134
|
||||
adwaita-icon-theme 43-1
|
||||
apt 2.6.1
|
||||
at-spi2-common 2.46.0-5
|
||||
base-files 12.4+deb12u15
|
||||
base-passwd 3.6.1
|
||||
bash 5.2.15-2+b13
|
||||
bsdutils 1:2.38.1-5+deb12u3
|
||||
ca-certificates 20250419~deb12u2
|
||||
chromium 156.0.8078.47-1~deb12u1
|
||||
chromium-common 156.0.8078.47-1~deb12u1
|
||||
coreutils 9.1-1
|
||||
curl 7.88.1-10+deb12u15
|
||||
dash 0.5.12-2
|
||||
dbus 1.14.10-1~deb12u1
|
||||
dbus-bin 1.14.10-1~deb12u1
|
||||
dbus-daemon 1.14.10-1~deb12u1
|
||||
dbus-session-bus-common 1.14.10-1~deb12u1
|
||||
dbus-system-bus-common 1.14.10-1~deb12u1
|
||||
dbus-user-session 1.14.10-1~deb12u1
|
||||
dconf-gsettings-backend:amd64 0.40.0-4
|
||||
dconf-service 0.40.0-4
|
||||
debconf 1.5.82
|
||||
debian-archive-keyring 2023.3+deb12u2
|
||||
debianutils 5.7-0.5~deb12u1
|
||||
diffutils 1:3.8-4
|
||||
dmsetup 2:1.02.185-2
|
||||
dpkg 1.21.23
|
||||
e2fsprogs 1.47.0-2+b2
|
||||
findutils 4.9.0-4
|
||||
fontconfig 2.14.1-4
|
||||
fontconfig-config 2.14.1-4
|
||||
fonts-dejavu-core 2.37-6
|
||||
gcc-12-base:amd64 12.2.0-14+deb12u1
|
||||
gpgv 2.2.40-1.1+deb12u2
|
||||
grep 3.8-5
|
||||
gtk-update-icon-cache 3.24.38-2~deb12u3
|
||||
gzip 1.12-1
|
||||
hicolor-icon-theme 0.17-2
|
||||
hostname 3.23+nmu1
|
||||
init-system-helpers 1.65.2+deb12u1
|
||||
libacl1:amd64 2.3.1-3
|
||||
libapparmor1:amd64 3.0.8-3
|
||||
libapt-pkg6.0:amd64 2.6.1
|
||||
libargon2-1:amd64 0~20171227-0.3+deb12u1
|
||||
libasound2:amd64 1.2.8-1+b1
|
||||
libasound2-data 1.2.8-1
|
||||
libasyncns0:amd64 0.8-6+b3
|
||||
libatk-bridge2.0-0:amd64 2.46.0-5
|
||||
libatk1.0-0:amd64 2.46.0-5
|
||||
libatspi2.0-0:amd64 2.46.0-5
|
||||
libattr1:amd64 1:2.5.1-4
|
||||
libaudit-common 1:3.0.9-1
|
||||
libaudit1:amd64 1:3.0.9-1
|
||||
libavahi-client3:amd64 0.8-10+deb12u1
|
||||
libavahi-common-data:amd64 0.8-10+deb12u1
|
||||
libavahi-common3:amd64 0.8-10+deb12u1
|
||||
libblkid1:amd64 2.38.1-5+deb12u3
|
||||
libbrotli1:amd64 1.0.9-2+deb12u1
|
||||
libbsd0:amd64 0.11.7-2
|
||||
libbz2-1.0:amd64 1.0.8-5+b1
|
||||
libc-bin 2.36-9+deb12u14
|
||||
libc6:amd64 2.36-9+deb12u14
|
||||
libcairo-gobject2:amd64 1.16.0-7
|
||||
libcairo2:amd64 1.16.0-7
|
||||
libcap-ng0:amd64 0.8.3-1+b3
|
||||
libcap2:amd64 1:2.66-4+deb12u3+b1
|
||||
libcolord2:amd64 1.4.6-2.2
|
||||
libcom-err2:amd64 1.47.0-2+b2
|
||||
libcrypt1:amd64 1:4.4.33-2
|
||||
libcryptsetup12:amd64 2:2.6.1-4~deb12u2
|
||||
libcups2:amd64 2.4.2-3+deb12u9
|
||||
libcurl4:amd64 7.88.1-10+deb12u15
|
||||
libdatrie1:amd64 0.2.13-2+b1
|
||||
libdav1d6:amd64 1.0.0-2+deb12u1
|
||||
libdb5.3:amd64 5.3.28+dfsg2-1
|
||||
libdbus-1-3:amd64 1.14.10-1~deb12u1
|
||||
libdconf1:amd64 0.40.0-4
|
||||
libdebconfclient0:amd64 0.270
|
||||
libdeflate0:amd64 1.14-1
|
||||
libdevmapper1.02.1:amd64 2:1.02.185-2
|
||||
libdouble-conversion3:amd64 3.2.1-1
|
||||
libdrm-amdgpu1:amd64 2.4.114-1+b1
|
||||
libdrm-common 2.4.114-1
|
||||
libdrm-intel1:amd64 2.4.114-1+b1
|
||||
libdrm-nouveau2:amd64 2.4.114-1+b1
|
||||
libdrm-radeon1:amd64 2.4.114-1+b1
|
||||
libdrm2:amd64 2.4.114-1+b1
|
||||
libedit2:amd64 3.1-20221030-2
|
||||
libelf1:amd64 0.188-2.1
|
||||
libepoxy0:amd64 1.5.10-1
|
||||
libexpat1:amd64 2.5.0-1+deb12u5
|
||||
libext2fs2:amd64 1.47.0-2+b2
|
||||
libfdisk1:amd64 2.38.1-5+deb12u3
|
||||
libffi8:amd64 3.4.4-1
|
||||
libflac12:amd64 1.4.2+ds-2
|
||||
libfontconfig1:amd64 2.14.1-4
|
||||
libfontenc1:amd64 1:1.1.4-1
|
||||
libfreetype6:amd64 2.12.1+dfsg-5+deb12u4
|
||||
libfribidi0:amd64 1.0.8-2.1
|
||||
libgbm1:amd64 22.3.6-1+deb12u2
|
||||
libgcc-s1:amd64 12.2.0-14+deb12u1
|
||||
libgcrypt20:amd64 1.10.1-3+deb12u1
|
||||
libgdk-pixbuf-2.0-0:amd64 2.42.10+dfsg-1+deb12u4
|
||||
libgdk-pixbuf2.0-common 2.42.10+dfsg-1+deb12u4
|
||||
libgl1:amd64 1.6.0-1
|
||||
libgl1-mesa-dri:amd64 22.3.6-1+deb12u2
|
||||
libglapi-mesa:amd64 22.3.6-1+deb12u2
|
||||
libglib2.0-0:amd64 2.74.6-2+deb12u9
|
||||
libglvnd0:amd64 1.6.0-1
|
||||
libglx-mesa0:amd64 22.3.6-1+deb12u2
|
||||
libglx0:amd64 1.6.0-1
|
||||
libgmp10:amd64 2:6.2.1+dfsg1-1.1
|
||||
libgnutls30:amd64 3.7.9-2+deb12u7
|
||||
libgpg-error0:amd64 1.46-1
|
||||
libgraphite2-3:amd64 1.3.14-1+deb12u1
|
||||
libgssapi-krb5-2:amd64 1.20.1-2+deb12u5
|
||||
libgtk-3-0:amd64 3.24.38-2~deb12u3
|
||||
libgtk-3-common 3.24.38-2~deb12u3
|
||||
libharfbuzz-subset0:amd64 6.0.0+dfsg-3
|
||||
libharfbuzz0b:amd64 6.0.0+dfsg-3
|
||||
libhogweed6:amd64 3.8.1-2
|
||||
libice6:amd64 2:1.0.10-1
|
||||
libicu72:amd64 72.1-3+deb12u1
|
||||
libidn2-0:amd64 2.3.3-1+b1
|
||||
libip4tc2:amd64 1.8.9-2
|
||||
libjbig0:amd64 2.1-6.1
|
||||
libjpeg62-turbo:amd64 1:2.1.5-2
|
||||
libjson-c5:amd64 0.16-2
|
||||
libk5crypto3:amd64 1.20.1-2+deb12u5
|
||||
libkeyutils1:amd64 1.6.3-2
|
||||
libkmod2:amd64 30+20221128-1
|
||||
libkrb5-3:amd64 1.20.1-2+deb12u5
|
||||
libkrb5support0:amd64 1.20.1-2+deb12u5
|
||||
liblcms2-2:amd64 2.14-2+deb12u1
|
||||
libldap-2.5-0:amd64 2.5.13+dfsg-5
|
||||
liblerc4:amd64 4.0.0+ds-2
|
||||
libllvm15:amd64 1:15.0.6-4+b1
|
||||
liblz4-1:amd64 1.9.4-1
|
||||
liblzma5:amd64 5.4.1-1+deb12u2
|
||||
libmd0:amd64 1.0.4-2
|
||||
libminizip1:amd64 1.1-8+deb12u1
|
||||
libmount1:amd64 2.38.1-5+deb12u3
|
||||
libmp3lame0:amd64 3.100-6
|
||||
libmpg123-0:amd64 1.31.2-1+deb12u1
|
||||
libncursesw6:amd64 6.4-4
|
||||
libnettle8:amd64 3.8.1-2
|
||||
libnghttp2-14:amd64 1.52.0-1+deb12u3
|
||||
libnspr4:amd64 2:4.35-1
|
||||
libnss3:amd64 2:3.87.1-1+deb12u4
|
||||
libogg0:amd64 1.3.5-3
|
||||
libopenh264-7:amd64 2.3.1+dfsg-3+deb12u2
|
||||
libopenjp2-7:amd64 2.5.0-2+deb12u3
|
||||
libopus0:amd64 1.3.1-3
|
||||
libp11-kit0:amd64 0.24.1-2
|
||||
libpam-modules:amd64 1.5.2-6+deb12u2
|
||||
libpam-modules-bin 1.5.2-6+deb12u2
|
||||
libpam-runtime 1.5.2-6+deb12u2
|
||||
libpam-systemd:amd64 252.39-1~deb12u2
|
||||
libpam0g:amd64 1.5.2-6+deb12u2
|
||||
libpango-1.0-0:amd64 1.50.12+ds-1
|
||||
libpangocairo-1.0-0:amd64 1.50.12+ds-1
|
||||
libpangoft2-1.0-0:amd64 1.50.12+ds-1
|
||||
libpciaccess0:amd64 0.17-2
|
||||
libpcre2-8-0:amd64 10.42-1+deb12u2
|
||||
libpixman-1-0:amd64 0.42.2-1
|
||||
libpng16-16:amd64 1.6.39-2+deb12u6
|
||||
libproc2-0:amd64 2:4.0.2-3
|
||||
libpsl5:amd64 0.21.2-1
|
||||
libpulse0:amd64 16.1+dfsg1-2+b1
|
||||
librtmp1:amd64 2.4+20151223.gitfa8646d.1-2+b2
|
||||
libsasl2-2:amd64 2.1.28+dfsg-10
|
||||
libsasl2-modules-db:amd64 2.1.28+dfsg-10
|
||||
libseccomp2:amd64 2.5.4-1+deb12u1
|
||||
libselinux1:amd64 3.4-1+b6
|
||||
libsemanage-common 3.4-1
|
||||
libsemanage2:amd64 3.4-1+b5
|
||||
libsensors-config 1:3.6.0-7.1
|
||||
libsensors5:amd64 1:3.6.0-7.1
|
||||
libsepol2:amd64 3.4-2.1
|
||||
libsm6:amd64 2:1.2.3-1
|
||||
libsmartcols1:amd64 2.38.1-5+deb12u3
|
||||
libsndfile1:amd64 1.2.0-1+deb12u1
|
||||
libsqlite3-0:amd64 3.40.1-2+deb12u2
|
||||
libss2:amd64 1.47.0-2+b2
|
||||
libssh2-1:amd64 1.10.0-3+deb12u1
|
||||
libssl3:amd64 3.0.22-1~deb12u1
|
||||
libstdc++6:amd64 12.2.0-14+deb12u1
|
||||
libsystemd-shared:amd64 252.39-1~deb12u2
|
||||
libsystemd0:amd64 252.39-1~deb12u2
|
||||
libtasn1-6:amd64 4.19.0-2+deb12u1
|
||||
libthai-data 0.1.29-1
|
||||
libthai0:amd64 0.1.29-1
|
||||
libtiff6:amd64 4.5.0-6+deb12u4
|
||||
libtinfo6:amd64 6.4-4
|
||||
libudev1:amd64 252.39-1~deb12u2
|
||||
libunistring2:amd64 1.0-2
|
||||
libuuid1:amd64 2.38.1-5+deb12u3
|
||||
libvorbis0a:amd64 1.3.7-1
|
||||
libvorbisenc2:amd64 1.3.7-1
|
||||
libwayland-client0:amd64 1.21.0-1
|
||||
libwayland-cursor0:amd64 1.21.0-1
|
||||
libwayland-egl1:amd64 1.21.0-1
|
||||
libwayland-server0:amd64 1.21.0-1
|
||||
libwebp7:amd64 1.2.4-0.2+deb12u1
|
||||
libx11-6:amd64 2:1.8.4-2+deb12u2
|
||||
libx11-data 2:1.8.4-2+deb12u2
|
||||
libx11-xcb1:amd64 2:1.8.4-2+deb12u2
|
||||
libxau6:amd64 1:1.0.9-1
|
||||
libxaw7:amd64 2:1.0.14-1
|
||||
libxcb-dri2-0:amd64 1.15-1
|
||||
libxcb-dri3-0:amd64 1.15-1
|
||||
libxcb-glx0:amd64 1.15-1
|
||||
libxcb-present0:amd64 1.15-1
|
||||
libxcb-randr0:amd64 1.15-1
|
||||
libxcb-render0:amd64 1.15-1
|
||||
libxcb-shape0:amd64 1.15-1
|
||||
libxcb-shm0:amd64 1.15-1
|
||||
libxcb-sync1:amd64 1.15-1
|
||||
libxcb-xfixes0:amd64 1.15-1
|
||||
libxcb1:amd64 1.15-1
|
||||
libxcomposite1:amd64 1:0.4.5-1
|
||||
libxcursor1:amd64 1:1.2.1-1
|
||||
libxdamage1:amd64 1:1.1.6-1
|
||||
libxdmcp6:amd64 1:1.1.2-3
|
||||
libxext6:amd64 2:1.3.4-1+b1
|
||||
libxfixes3:amd64 1:6.0.0-2
|
||||
libxft2:amd64 2.3.6-1
|
||||
libxi6:amd64 2:1.8-1+b1
|
||||
libxinerama1:amd64 2:1.1.4-3
|
||||
libxkbcommon0:amd64 1.5.0-1
|
||||
libxkbfile1:amd64 1:1.1.0-1
|
||||
libxml2:amd64 2.9.14+dfsg-1.3~deb12u6
|
||||
libxmu6:amd64 2:1.1.3-3
|
||||
libxmuu1:amd64 2:1.1.3-3
|
||||
libxnvctrl0:amd64 525.85.05-3~deb12u1
|
||||
libxpm4:amd64 1:3.5.12-1.1+deb12u1
|
||||
libxrandr2:amd64 2:1.5.2-2+b1
|
||||
libxrender1:amd64 1:0.9.10-1.1
|
||||
libxshmfence1:amd64 1.3-1
|
||||
libxt6:amd64 1:1.2.1-1.1
|
||||
libxtst6:amd64 2:1.2.3-1.1
|
||||
libxv1:amd64 2:1.0.11-1.1
|
||||
libxxf86dga1:amd64 2:1.1.5-1
|
||||
libxxf86vm1:amd64 1:1.1.4-1+b2
|
||||
libxxhash0:amd64 0.8.1-1
|
||||
libz3-4:amd64 4.8.12-3.1
|
||||
libzstd1:amd64 1.5.4+dfsg2-5
|
||||
login 1:4.13+dfsg1-1+deb12u2
|
||||
logsave 1.47.0-2+b2
|
||||
mawk 1.3.4.20200120-3.1
|
||||
mount 2.38.1-5+deb12u3
|
||||
ncurses-base 6.4-4
|
||||
ncurses-bin 6.4-4
|
||||
openssl 3.0.22-1~deb12u1
|
||||
passwd 1:4.13+dfsg1-1+deb12u2
|
||||
perl-base 5.36.0-7+deb12u4
|
||||
procps 2:4.0.2-3
|
||||
sed 4.9-1+deb12u1
|
||||
shared-mime-info 2.2-1
|
||||
systemd 252.39-1~deb12u2
|
||||
systemd-sysv 252.39-1~deb12u2
|
||||
sysvinit-utils 3.06-4
|
||||
tar 1.34+dfsg-1.2+deb12u1
|
||||
tzdata 2026c-0+deb12u1
|
||||
usr-is-merged 37~deb12u1
|
||||
util-linux 2.38.1-5+deb12u3
|
||||
util-linux-extra 2.38.1-5+deb12u3
|
||||
x11-common 1:7.7+23
|
||||
x11-utils 7.7+5
|
||||
xdg-utils 1.1.3-4.1
|
||||
xkb-data 2.35.1-1
|
||||
zlib1g:amd64 1:1.2.13.dfsg-1
|
||||
@@ -0,0 +1,57 @@
|
||||
import { expect,test } from '../../../../../job-tracker-ui/node_modules/@playwright/test';
|
||||
import fs from 'node:fs/promises';
|
||||
import path from 'node:path';
|
||||
|
||||
const api='http://localhost:5302/api';
|
||||
for(const [themeId,language] of [['minimal','en'],['technical','nb']] as const){
|
||||
test(`portable fonts preserve long skills, headings and empty sections ${themeId}/${language}`,async({page,context,browser})=>{
|
||||
test.setTimeout(180_000);
|
||||
await context.addInitScript(()=>localStorage.setItem('uiLanguage','en'));
|
||||
await context.route('**/*',route=>{
|
||||
const url=new URL(route.request().url());
|
||||
return ['localhost','127.0.0.1'].includes(url.hostname)||['data:','blob:','about:'].includes(url.protocol)?route.continue():route.abort();
|
||||
});
|
||||
expect((await page.request.post(`${api}/auth/login`,{data:{email:'e2e@example.test',password:'E2ePassword123!'}})).status()).toBe(200);
|
||||
const me=await(await page.request.get(`${api}/auth/me`)).json();
|
||||
const csrf=(await context.storageState()).cookies.find(cookie=>cookie.name==='XSRF-TOKEN')!.value;
|
||||
const headers={'X-CSRF-TOKEN':csrf,'X-Session-Context':me.sessionContext};
|
||||
const skills=Array.from({length:64},(_,i)=>`S${String(i+1).padStart(2,'0')} ${language==='nb'?'Tilgjengelige og pålitelige løsninger for norske arbeidssøkere æøå':'Accessible reliable engineering workflows with verified outcomes'} ${i+1}`);
|
||||
const current=await(await page.request.get(`${api}/career/profile`)).json();
|
||||
expect((await page.request.put(`${api}/career/profile`,{headers,data:{expectedVersion:current.revision,profile:{version:'1',contact:{fullName:'Åse Østby æøå',headline:'R01 Verified portable document heading — reliable accessible engineering'},summary:[],jobs:[],education:[],projects:[],skills}}})).status()).toBe(200);
|
||||
const source=await(await page.request.get(`${api}/career/profile`)).json();
|
||||
expect(source.profile.skills).toEqual(skills);
|
||||
const created=await page.request.post(`${api}/cv/variants`,{headers,data:{name:`Supplemental ${themeId}/${language}`,settings:{themeId,language,skillsStyle:'bullets',sections:[{key:'skills',title:'R02 Long heading for verified professional skills and documented engineering capabilities — æøå'}]}}});
|
||||
expect(created.status()).toBe(200);const variant=await created.json();
|
||||
await page.goto(`/career/builder/${variant.id}`);
|
||||
const frame=page.getByTitle('CV preview',{exact:true});
|
||||
await expect.poll(()=>frame.evaluate(element=>(element as HTMLIFrameElement).contentDocument?.documentElement.dataset.cvPreviewReady)).toBe('true');
|
||||
const measured=await frame.evaluate(element=>{
|
||||
const doc=(element as HTMLIFrameElement).contentDocument!,win=doc.defaultView!,width=Number(doc.documentElement.dataset.cvPreviewWidth),height=Number(doc.documentElement.dataset.cvPreviewHeight);
|
||||
const tokens=[];const walker=doc.createTreeWalker(doc.body,NodeFilter.SHOW_TEXT);let node;
|
||||
while((node=walker.nextNode()))for(const match of(node.textContent||'').matchAll(/\b[SEBPR]\d{2}\b/g)){
|
||||
const range=doc.createRange();range.setStart(node,match.index!);range.setEnd(node,match.index!+match[0].length);const rect=range.getClientRects()[0],style=win.getComputedStyle(node.parentElement!);const index=Math.floor(rect.x/width);
|
||||
tokens.push({token:match[0],x:rect.x-index*width,y:rect.y+index*height,fontSize:style.fontSize,color:style.color});
|
||||
}
|
||||
return{tokens,effectiveMargin:win.getComputedStyle(doc.documentElement).getPropertyValue('--cv-page-margin'),text:doc.body.innerText};
|
||||
});
|
||||
for(const skill of skills)expect(measured.text).toContain(skill);
|
||||
const pages=await page.locator('[data-cv-page]').count();expect(pages).toBeGreaterThan(1);
|
||||
const root=path.join(process.env.CV_FIDELITY_OUTPUT!,`long-skills-${themeId}-${language}`);await fs.mkdir(root,{recursive:true});
|
||||
const rendered=await(await page.request.get(`${api}/cv/variants/${variant.id}/preview`)).json();
|
||||
const download=await page.request.post(`${api}/cv/variants/${variant.id}/export-pdf`,{headers});expect(download.status()).toBe(200);
|
||||
await fs.writeFile(path.join(root,'render.html'),rendered.html);await fs.writeFile(path.join(root,'export.pdf'),await download.body());
|
||||
for(let i=1;i<=pages;i++){
|
||||
const srcDoc=await page.getByTitle(`CV preview page ${i}`,{exact:true}).getAttribute('srcdoc');
|
||||
const capture=await browser.newPage({viewport:{width:794,height:1123}});
|
||||
try{await capture.setContent(srcDoc!);await expect.poll(()=>capture.evaluate(()=>document.documentElement.dataset.cvPreviewReady)).toBe('true');await capture.screenshot({path:path.join(root,`preview-${i}.png`)});}finally{await capture.close();}
|
||||
}
|
||||
await fs.writeFile(path.join(root,'measurements.json'),JSON.stringify({browserVersion:browser.version(),fixtures:[{fixture:path.basename(root),settings:variant.settings,previewPages:pages,measured}]},null,2));
|
||||
const independent=await browser.newContext();
|
||||
try{
|
||||
expect((await independent.request.post(`${api}/auth/login`,{data:{email:'e2e@example.test',password:'E2ePassword123!'}})).status()).toBe(200);
|
||||
const persisted=await(await independent.request.get(`${api}/career/profile`)).json();
|
||||
expect(persisted.profile).toEqual(source.profile);expect(persisted.revision).toBe(source.revision);
|
||||
expect((await(await independent.request.get(`${api}/cv/variants/${variant.id}`)).json()).version).toBe(variant.version);
|
||||
}finally{await independent.close();}
|
||||
});
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
import { defineConfig } from '../../../../../job-tracker-ui/node_modules/@playwright/test';
|
||||
import base from '../../../../../job-tracker-ui/playwright.config';
|
||||
import path from 'node:path';
|
||||
if (process.env.P9_REQUAL_LINUX_READY !== 'p9-remed-02-fonts') throw new Error('Use the isolated verified Linux renderer lifecycle.');
|
||||
const servers=Array.isArray(base.webServer)?base.webServer:[base.webServer!];
|
||||
export default defineConfig({...base,testDir:__dirname,testMatch:'*.spec.ts',workers:1,retries:0,
|
||||
webServer:[{...servers[1],cwd:path.resolve(__dirname,'../../../../../job-tracker-ui'),reuseExistingServer:false}]});
|
||||
@@ -0,0 +1,38 @@
|
||||
from pathlib import Path
|
||||
import subprocess,json,datetime,re,sys,hashlib
|
||||
ROOT=Path(__file__).resolve().parents[5]
|
||||
PDF="C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe" if sys.platform=='win32' else sys.executable
|
||||
out=Path(sys.argv[1]).resolve()
|
||||
assert out.is_relative_to(ROOT/".artifacts/p9-remed-02")
|
||||
assert not (out/"result.json").exists(), "Preserve previous evidence."
|
||||
root=out/'linux/fidelity'
|
||||
files=[root/'long-skills-minimal-en/measurements.json',root/'long-skills-technical-nb/measurements.json']
|
||||
records=[json.loads(p.read_text(encoding='utf-8')) for p in files]
|
||||
assert len({r['browserVersion'] for r in records})==1
|
||||
fixtures=[f for r in records for f in r['fixtures']]
|
||||
assert {f['fixture'] for f in fixtures}=={'long-skills-minimal-en','long-skills-technical-nb'}
|
||||
assert len(fixtures)==2
|
||||
(root/'measurements.json').write_text(json.dumps({'browserVersion':records[0]['browserVersion'],'fixtures':fixtures},indent=2,ensure_ascii=False)+'\n',encoding='utf-8')
|
||||
inputs={str(path.resolve()):hashlib.sha256(path.read_bytes()).hexdigest() for path in root.rglob('*') if path.is_file()}
|
||||
inputs[str((ROOT/'scripts/verify-cv-fidelity.py').resolve())]='64f82e622cc11483c33307d987e969f6cf27f82ab6bdbd72c2aeb1bfbceade87'
|
||||
assert all(hashlib.sha256(Path(name).read_bytes()).hexdigest()==digest for name,digest in inputs.items())
|
||||
(out/'oracle-inputs.json').write_text(json.dumps({'inputs':inputs},indent=2)+'\n',encoding='utf-8')
|
||||
with (out/'oracle.log').open('w',encoding='utf-8') as log:
|
||||
result=subprocess.run(['rtk','proxy',PDF,'-B','scripts/verify-cv-fidelity.py',str(root)],cwd=ROOT,stdout=log,stderr=subprocess.STDOUT)
|
||||
record={'oracleExitCode':result.returncode,'status':'PASS' if result.returncode==0 else 'FAIL','scope':'Two supplemental real-MariaDB/Linux long-skill fixtures, separate from original24 and ordinary362.','observedUtc':datetime.datetime.now(datetime.timezone.utc).isoformat()}
|
||||
report=json.loads((root/'fidelity-results.json').read_text(encoding='utf-8'))
|
||||
assert all(hashlib.sha256(Path(name).read_bytes()).hexdigest()==digest for name,digest in inputs.items()),'Oracle input drift'
|
||||
record['inputs']=inputs
|
||||
record['reportSha256']=hashlib.sha256((root/'fidelity-results.json').read_bytes()).hexdigest()
|
||||
assert report['total']==2 and {f['fixture'] for f in report['fixtures']}=={f['fixture'] for f in fixtures}
|
||||
record['cases']=report['fixtures']
|
||||
for case in report['fixtures']:
|
||||
text='\n'.join(p['text'] for p in case['pages'])
|
||||
assert set(re.findall(r'\bS\d{2}\b',text))=={f'S{i:02}' for i in range(1,65)},case['fixture']
|
||||
assert 'Åse' in text and 'Østby' in text,case['fixture']
|
||||
assert text.count('Åse')==1,case['fixture']
|
||||
assert all(value not in text for value in ['file://','http://localhost','document.html']),case['fixture']
|
||||
assert not re.search(r'\b(?:20\d\d[-/.]\d{1,2}[-/.]\d{1,2}|\d{1,2}[-/.]\d{1,2}[-/.](?:20)?\d{2})\b',text),case['fixture']
|
||||
(out/'result.json').write_text(json.dumps(record,indent=2,ensure_ascii=False)+'\n',encoding='utf-8')
|
||||
print('Supplemental long-skills/header-footer proof:',record['status'],flush=True)
|
||||
raise SystemExit(result.returncode)
|
||||
File diff suppressed because it is too large
Load Diff
@@ -48,3 +48,5 @@ Filelock4 changes some shared-cache/on-disk lock protocols; the inspected Huggin
|
||||
Torch/Transformers records include many alternative model, conversion, Trainer, optimizer and compiler operations with no matching application call found. Those absences are explicitly source-limited. Fixed-repository `from_pretrained` loading still exists without an immutable revision/artifact integrity record; actual checkpoint format and model dependency internals remain unqualified. The standard user cache contained no DistilBART snapshot, and no model download/inference was attempted. Some provider records describe other library versions/model families; the inventory retains those ranges and does not assert a reproduced exploit in this application.
|
||||
|
||||
Next security action: select and validate a compatible patched Torch/Transformers CPU graph for the existing model, verify immutable model/tokenizer/checkpoint identities, startup and representative inference/extraction contracts in an approved local environment. Alternatively, the product/security owner must explicitly decide any serious residual risk after applicability evidence. This task does not accept it for them. Container isolation, resource limits and mocked inference tests do not close that gate. Bootstrap pip/wheel, base OS/OCR libraries and actual production identities remain separate release audit obligations.
|
||||
|
||||
Final exact-pin refresh at2026-10-24T23:16:26Z (25October local):49pins/98queries,99records/3packages, same advisory identities and metadata, no added/removed IDs. The known vendor PyPI404 is retained;97 requests succeeded. See [final-refresh.json](final-refresh.json). Current model-disabled full regression again passes58 cases; no real model qualification is implied.
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"lockSha256": "23f200fef330e2677ff4a47e5fcbaa327f98c3d4ebdcf73e2047e9f61664e7cb",
|
||||
"sameLock": true,
|
||||
"queryCount": 98,
|
||||
"packageCount": 49,
|
||||
"advisoryRecords": 99,
|
||||
"findingPackages": 3,
|
||||
"coverageErrors": [
|
||||
{
|
||||
"package": "torch",
|
||||
"version": "2.6.0+cpu",
|
||||
"provider": "pypi",
|
||||
"httpStatus": 404,
|
||||
"error": "HTTPError"
|
||||
}
|
||||
],
|
||||
"observedUtc": "2026-10-24T23:16:26.272101+00:00",
|
||||
"sameAdvisoryIdentities": true,
|
||||
"addedIds": [],
|
||||
"removedIds": [],
|
||||
"metadataChanges": [],
|
||||
"rawSummarySha256": "0d02e084704112a8a3be9d6630181363e24e0c6010a226315efb71a2a20009cc",
|
||||
"scope": "Public exact locked-pin queries, no installation, inference, exploit or owner risk acceptance. Prior per-advisory dispositions retained only where identities/ranges remain applicable."
|
||||
}
|
||||
@@ -0,0 +1,49 @@
|
||||
import copy,importlib.util,unittest,tempfile,json
|
||||
from pathlib import Path
|
||||
|
||||
spec=importlib.util.spec_from_file_location('successor',Path(__file__).with_name('reconcile.py'))
|
||||
successor=importlib.util.module_from_spec(spec);spec.loader.exec_module(successor)
|
||||
|
||||
class FrontendSuccessorMembership(unittest.TestCase):
|
||||
def setUp(self):
|
||||
cases=[{'fullName':f'original-{i}','status':'passed'} for i in range(934)]
|
||||
cases[1]['fullName']=cases[0]['fullName']
|
||||
self.baseline={'testResults':[{'name':'/repo/job-tracker-ui/src/cv-builder-deep-link.test.tsx','assertionResults':cases}]}
|
||||
self.actual=copy.deepcopy(self.baseline)
|
||||
self.actual['testResults'][0]['assertionResults'].append({'fullName':successor.ADDED_CASE,'status':'passed'})
|
||||
def test_accepts_exactly_one_declared_addition_without_mutating_reference(self):
|
||||
before=copy.deepcopy(self.baseline)
|
||||
self.assertEqual(len(successor.frontend_cases(self.actual,self.baseline,0)),935)
|
||||
self.assertEqual(self.baseline,before)
|
||||
def test_missing_original_or_changed_duplicate_multiplicity_is_rejected(self):
|
||||
self.actual['testResults'][0]['assertionResults'][1]['fullName']='unexpected-replacement'
|
||||
with self.assertRaises(ValueError): successor.frontend_cases(self.actual,self.baseline,0)
|
||||
def test_added_case_cannot_be_skipped_or_retried(self):
|
||||
self.actual['testResults'][0]['assertionResults'][-1]['status']='pending'
|
||||
with self.assertRaises(ValueError): successor.frontend_cases(self.actual,self.baseline,0)
|
||||
def test_nonzero_process_cannot_be_promoted(self):
|
||||
with self.assertRaises(ValueError): successor.frontend_cases(self.actual,self.baseline,1)
|
||||
|
||||
class RepresentativeEvidence(unittest.TestCase):
|
||||
def setUp(self):
|
||||
self.temporary=tempfile.TemporaryDirectory();self.addCleanup(self.temporary.cleanup)
|
||||
self.root=Path(self.temporary.name)
|
||||
cases=[{'fixture':name,'pass':True,'failures':[]} for name in ['long-skills-minimal-en','long-skills-technical-nb']]
|
||||
self.report={'total':2,'passed':2,'fixtures':cases}
|
||||
self.proof={'status':'PASS','oracleExitCode':0,'cases':cases}
|
||||
def test_exact_membership_and_matching_successful_cases(self):
|
||||
successor.validate_representative(self.proof,self.report)
|
||||
def test_empty_or_unrelated_report_is_rejected(self):
|
||||
for report in [{'total':0,'passed':0,'fixtures':[]},dict(self.report,fixtures=[self.report['fixtures'][0]]*2)]:
|
||||
with self.assertRaises(ValueError): successor.validate_representative(self.proof,report)
|
||||
def test_failed_or_changed_case_is_rejected(self):
|
||||
report=copy.deepcopy(self.report);report['fixtures'][0]['failures']=['clipping']
|
||||
with self.assertRaises(ValueError): successor.validate_representative(self.proof,report)
|
||||
def test_hash_drift_is_rejected(self):
|
||||
file=self.root/'export.pdf';file.write_bytes(b'original')
|
||||
inputs={str(file):successor.hashlib.sha256(file.read_bytes()).hexdigest()}
|
||||
successor.require_unchanged(inputs)
|
||||
file.write_bytes(b'changed')
|
||||
with self.assertRaises(ValueError): successor.require_unchanged(inputs)
|
||||
|
||||
if __name__=='__main__':unittest.main()
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user