docs(acceptance): publish verified pre-phase10 evidence handoff

test(handoff): preserve native results in bounded attachment projections
test(handoff): bind verifier source and reject acceptance promotion
2026-10-29 19:11:10 +01:00 · 2026-10-29 18:55:20 +01:00 · 2026-10-29 18:44:08 +01:00 · 2026-10-29 18:30:53 +01:00 · 2026-10-29 14:51:30 +01:00
176 changed files with 5541 additions and 0 deletions
@@ -0,0 +1,2 @@
+# Preserve source instructions and hash-indexed evidence identically across Windows/Linux checkouts.
+* -text
@@ -0,0 +1,209 @@
+{
+  "schemaVersion": 1,
+  "workstreamId": "AUTOMATION-HANDOFF-01",
+  "kind": "ACCEPTANCE",
+  "authority": "EVIDENCE_ONLY",
+  "sourceBranch": "test/pre-phase10-ux-acceptance",
+  "localCommit": "5032ccb41514807c8ca3008c24ca6326be1170de",
+  "localCommitMeaning": "FROZEN_TESTED_APPLICATION_BASELINE",
+  "snapshotHead": "c16a66e2c85b35caa5a4460c186dc77d28e31ccb",
+  "verifiedRemoteCommit": "c16a66e2c85b35caa5a4460c186dc77d28e31ccb",
+  "remoteObservation": "Snapshot verification 2026-10-29T17:55:24.139000+00:00; current final package HEAD must be resolved and read back independently.",
+  "worktreeCleanliness": {
+    "atSourceBaseline": "CLEAN",
+    "atPackageGeneration": "HANDOFF_FILES_ONLY",
+    "requiredAtConsumption": "CLEAN"
+  },
+  "acceptanceStatus": "CONDITIONAL GO",
+  "entryGateStatus": "BLOCKED",
+  "phase10DevelopmentReadiness": "NO-GO",
+  "eligibleForAutomaticExecution": false,
+  "packageStatus": "READY",
+  "verdicts": [
+    {
+      "criterion": "Pre-Phase-10 UX",
+      "status": "CONDITIONAL GO",
+      "evidence": [
+        "TEST_EVIDENCE.json",
+        "TRACEABILITY.md"
+      ],
+      "limits": "Finite automated development review; manual/PDF/model/operator conditions remain."
+    },
+    {
+      "criterion": "CV Integration",
+      "status": "CONDITIONAL GO",
+      "evidence": [
+        "docling-import",
+        "cv-integration-qa",
+        "long-import",
+        "mariadb-provider"
+      ],
+      "limits": "Supported reviewed workflow only; partial extraction and legacy-text generic-AI precondition retained."
+    },
+    {
+      "criterion": "PDF Spacing",
+      "status": "PARTIAL",
+      "evidence": [
+        "VISUAL_REVIEW.md",
+        "windows-template-oracle",
+        "linux-template-oracle"
+      ],
+      "limits": "Unchanged S01 coordinate failures remain; human aesthetic/print approval absent."
+    },
+    {
+      "criterion": "Automated PDF Fidelity",
+      "status": "FAIL",
+      "evidence": [
+        "windows-template-oracle",
+        "linux-template-oracle"
+      ],
+      "limits": "Original24CV+4letter per platform pass; revised corpus fails only S01. No oracle waiver."
+    },
+    {
+      "criterion": "Semantic Content Completeness",
+      "status": "PASS",
+      "evidence": [
+        "windows-template-completeness",
+        "linux-template-completeness"
+      ],
+      "limits": "Finite36 revised CVs/122pages per platform, source markers/bounds; not model semantic truth."
+    },
+    {
+      "criterion": "Human Print Approval",
+      "status": "NOT TESTED",
+      "evidence": [
+        "MANUAL_ACCEPTANCE.md"
+      ],
+      "limits": "Actual printing requires a human/printer; PDF generation is not printing."
+    },
+    {
+      "criterion": "CV AI Accuracy",
+      "status": "BLOCKED",
+      "evidence": [
+        "cv-model-probe",
+        "AI_RESULTS.md"
+      ],
+      "limits": "Three actual synthetic responses rejected; no accepted end-to-end model quality evidence."
+    },
+    {
+      "criterion": "Human/Device Acceptance",
+      "status": "NOT TESTED",
+      "evidence": [
+        "MANUAL_ACCEPTANCE.md"
+      ],
+      "limits": "Automated emulation/axe are separate and do not supply human approval."
+    },
+    {
+      "criterion": "Python Security",
+      "status": "CONDITIONAL",
+      "evidence": [
+        "installed-python-advisories",
+        "pip-audit"
+      ],
+      "limits": "Current exact installed audit retains one vendor-PyPI404; source-scoped P9 disposition, no risk waiver."
+    },
+    {
+      "criterion": "Hosted CI",
+      "status": "BLOCKED",
+      "evidence": [
+        "AUTHORITY.md",
+        ".gitea/workflows/mariadb-integration.yml"
+      ],
+      "limits": "Quarantined lane/current runner isolation unverified;0 fresh hosted database cases."
+    },
+    {
+      "criterion": "Preservation",
+      "status": "PARTIAL",
+      "evidence": [
+        "preservation-register",
+        "TRACEABILITY.md"
+      ],
+      "limits": "All57 criteria and34 routes retained;56PARTIAL/1DEFERRED states are not promoted."
+    },
+    {
+      "criterion": "Git Publication",
+      "status": "VERIFIED",
+      "evidence": [
+        "git-checkpoint"
+      ],
+      "limits": "Exactc16a66e2c85b35caa5a4460c186dc77d28e31ccb snapshot readback; final resolved local/remote HEAD must be independently rechecked after publishing package."
+    },
+    {
+      "criterion": "Phase 10 Development Readiness",
+      "status": "NO-GO",
+      "evidence": [
+        "BLOCKERS.json",
+        "READY_TO_RUN.md"
+      ],
+      "limits": "Missing protected entry/candidate decisions, affected PDF disposition and controller runtime/test-adapter/policy qualification."
+    },
+    {
+      "criterion": "Automation Handoff Package",
+      "status": "READY",
+      "evidence": [
+        "HANDOFF_SCHEMA.json",
+        "TEST_EVIDENCE.json",
+        "CONTRACT.md"
+      ],
+      "limits": "Ready evidence import proposal; not configured or tested inside the separate orchestrator and not authority to execute."
+    },
+    {
+      "criterion": "Production",
+      "status": "NO-GO",
+      "evidence": [
+        "BLOCKERS.json"
+      ],
+      "limits": "No main merge/deploy; independent release/security/backup/recovery/provider/manual approvals absent."
+    }
+  ],
+  "testEvidenceReferences": [
+    "TEST_EVIDENCE.json",
+    "TRACEABILITY.md",
+    "VISUAL_REVIEW.md",
+    "AI_RESULTS.md"
+  ],
+  "unresolvedBlockerIds": [
+    "P10-ENTRY-01",
+    "P10-CANDIDATE-01",
+    "AUTO-RUNTIME-01",
+    "AUTO-ADAPTER-01",
+    "PDF-S01-01",
+    "HUMAN-01",
+    "AI-CV-01",
+    "DET-RECALL-01",
+    "PYSEC-01",
+    "CI-01",
+    "MYSQL-TLS-01",
+    "OPS-01",
+    "NATIVE-SEC-01",
+    "FUTURE-01",
+    "AI-CONTEXT-01",
+    "AUTO-SCOPE-01"
+  ],
+  "permissibleDeferrals": [
+    "HUMAN-01",
+    "AI-CV-01",
+    "DET-RECALL-01",
+    "PYSEC-01",
+    "CI-01"
+  ],
+  "requiredOwnerApprovals": [
+    {
+      "id": "phase10-development-entry",
+      "state": "NOT_PROVIDED_TO_HANDOFF",
+      "authority": "EXTERNAL_PROTECTED_CONTROLLER_APPROVAL"
+    },
+    {
+      "id": "candidate-specific-cleanup-scope",
+      "state": "NOT_PROVIDED_TO_HANDOFF",
+      "authority": "EXTERNAL_PROTECTED_CONTROLLER_APPROVAL"
+    },
+    {
+      "id": "policy-update",
+      "state": "NOT_PROVIDED_TO_HANDOFF",
+      "authority": "EXTERNAL_PROTECTED_CONTROLLER_APPROVAL"
+    }
+  ],
+  "generatedUtc": "2026-10-29T17:56:46.240720+00:00",
+  "recommendation": "Remain BLOCKED for automatic Phase10. Review this complete evidence, resolve affected mandatory conditions and protected scope, qualify the separate runtime/adapter, and adopt final published baseline/policy through its signed approval flow. Do not start any later workstream, merge or deploy."
+}
@@ -0,0 +1,9 @@
+# Bounded real-adapter evaluation authority and limits
+
+AUTOMATION-HANDOFF-01 REQUEST section7 authorises targeted model evaluations when approved immutable artifacts and safe isolated development conditions exist. The earlier owner request approved creation of the local Ollama instance matching the recorded production model name. LOCAL_RUNTIME_ACCEPTANCE.md records the approved official Qwen GGUF/manifest and dedicated local runtime. This permits a bounded synthetic compatibility probe; it does not approve model activation, production access or factual-accuracy acceptance.
+
+Preconditions, checked before inference: Desktop Linux context; exact approved local Ollama image; manifest/blob verification with existing verify_ollama.py; cloud disabled and CPU/memory/concurrency bounds; actual development sidecar keeps CV_IMPORT_AI_ENABLED=false. Inspection found that the existing local service has a read-only root but its dedicated model volume is writable. Do not infer read-only cache protection from that root setting. Instead start a disposable Ollama container using the same immutable image and existing model volume mounted **read-only**, on a generated internal-only network with no published ports. A separate bounded Python client container on that network exercises the adapter. Neither container receives a daemon socket. Remove only these exact owned containers/network afterward. The existing local Ollama service is not changed or restarted.
+
+Exercise only cv_import_ai.analyse using the Python standard-library transport to the isolated `ollama` service alias and explicit model qwen2.5:7b. Three independently authored synthetic EN/Bokmål/adversarial block sets have explicit fact whitelists. Each request retains the existing schema, grounding checks and120-second bound; the entire run is finite. No download, model replacement, cache write, external provider or real personal document is allowed. Record actual native exit, timeout/rejection, structured suggestions, exact expected matches and unsupported claims. Quotes alone do not establish that instruction text is a career fact.
+
+These cases are development compatibility probes, separate from the frozen benchmark and active deterministic Docling pipeline. A small success cannot establish general extraction precision/recall, multilingual quality, safe activation or end-to-end PDF/DOCX model accuracy. Any timeout, malformed output, missed field or unsupported claim stays visible. Phase10 does not gain authority from this test. No service configuration is changed.
@@ -0,0 +1,29 @@
+# AI and parser qualification reconciliation
+
+## What was actually exercised
+
+| Layer | Evidence / decision | What it does not establish |
+|---|---|---|
+| Real Docling parsing | Fresh14 real document-extractor tests; actual PDF/DOCX import browser lanes and live local PDF worker. Native extraction uses pinned model-free Docling | OCR/layout-model or arbitrary-document completeness |
+| Deterministic interpretation | Frozen benchmark evidence remains separately attributed: PDF typed precision100%, recall81.967%; DOCX122/122 typed facts. Fresh oracle/structural helper tests validate their own logic | Population accuracy, real model quality, or every unusual layout |
+| Review/correction/application | Real browser/MariaDB/RD21 lanes exercise approved facts, duplicates, rollback, stale writes and historical preservation | Automatic model semantic truth or human usability approval |
+| Generic queued strategy | Fresh actual local operation succeeded with saved nonempty160-character summary; admin retained a prior provider_unavailable event | First-attempt reliability, latency guarantees or factual CV interpretation |
+| Scheduled job enrichment | Fresh actual scheduler persisted summary681characters plus tags, then read back through API | Semantic quality or external provider/production acceptance |
+| Optional CV model adapter | Three real isolated Qwen requests completed but all three were rejected with ValueError by the adapter. **Compatibility and factual accuracy remain BLOCKED** | Zero accepted suggestions is not zero hallucinations or100% precision |
+| Active CV processing configuration | CV_IMPORT_AI_ENABLED=false; adapter remains disconnected from active deterministic processing | No model activation or owner security-risk acceptance |
+
+## Real adapter probe
+
+[AI_EVALUATION_PLAN.md](AI_EVALUATION_PLAN.md) records authority and guards before inference. The official local qwen2.5:7b Q4_K_M manifest845dbda0ea48ed749caafd9e6037047aa19acfcfd82e704d7ca97d631a0b697e and all stored blobs were hash-verified. A disposable Ollama instance reused those bytes through a **read-only** model-volume mount, with no published ports, internal-only network, cloud disabled, four CPUs/8GiB, one loaded model/parallel request and no daemon socket. A bounded read-only Python client exercised the unchanged adapter using its real transport, JSON schema, source grounding and120-second timeout. Existing development Ollama/services/configuration/cache were not changed. Exact generated containers and the empty network were removed, with cleanup recorded.
+
+EN, Bokmål and instruction-in-source cases took79.009,47.308 and35.811 seconds respectively. All returned the explicit rejected/failed outcome. No raw response was retained by this first probe, so the precise invalid suggestion/schema distinction is not claimed. No accepted semantic precision/recall is computed. These three independently authored development probes are not the frozen corpus and are not PDF/DOCX end-to-end model evaluations. They supply genuine negative compatibility evidence; they do not replace the outstanding full qualification.
+
+Raw source-bound process/results/cases/client hashes are in `.artifacts/automation-handoff-01/model-probe-01/`; portable evidence is indexed in TEST_EVIDENCE.json. The probe process exit0 means the measurement completed and cleanup ran, **not that AI acceptance passed**.
+
+The local runtime's original model volume was found writable despite a read-only container root. This finding informed the isolated read-only mirror above; no stronger existing-cache protection is inferred. Artifact integrity and scoped known-advisory evidence are independent of whole-image/native sandbox security. A fresh read-only inventory of the exact current sidecar image found63 installed distributions;126 exact OSV/PyPI queries returned zero advisory records and one retained PyPI404 for torch2.13.0+cpu. The new raw audit remains INCOMPLETE. Python remains CONDITIONAL under the retained P9-SEC-02 disposition; neither this probe, this incomplete scan nor import-lock zero advisories closes native/whole-image/production qualifications. No package was resolved or installed by the audit.
+
+Future owner-approved qualification must use immutable approved artifacts/runtime and identical frozen documents/annotations, source and prompt hashes; measure precision/recall, record association, dates, hallucinated/unsupported claims, provenance, duplicate behavior, multilingual semantics and review burden. Add missing/malformed output, unavailable service, timeout/cancel/retry, injection, resource and cache-integrity probes. Keep deterministic, model-assisted, user-corrected and persisted outcomes separate. Do not select a permanent general-purpose model or enable the adapter from these results.
+
+## Existing generic-AI precondition
+
+StrategySnapshotService currently requires nonempty legacy ProfileCvText in both admission and generation. The reviewed Docling apply path persists canonical structured facts and deliberately does not overwrite that user-controlled text. Therefore the successful strategy smoke used separately authored fictional CV text as an explicit precondition; it does **not** prove strategy generation from a canonical-only imported profile. Career Profile → CV Editor → PDF is independently tested and does not require this legacy text. Product Review should assess this generic-AI source compatibility as a separate bounded backlog item; do not silently populate legacy text from unreviewed uploaded content or claim every AI option works for every profile/account.
@@ -0,0 +1,23 @@
+# Authority reconciliation — 29 October 2026
+
+This register distinguishes tested implementation, development review, cleanup entry and release. The package is evidence, never an approval token.
+
+| Source | Actual authority / current disposition |
+|---|---|
+| Owner REQUEST.md | Complete bounded handoff/remediation/testing/publication; explicitly do not start Phase10 or the controller. No main merge/production/other-worktree mutation. |
+| docs/redesign/IMPLEMENTATION_PLAN.md, Phase10 | Remove only genuinely obsolete UI after unused-route proof, passing tests and satisfied functionality inventory. No age/name-based removal. |
+| docs/redesign/phase-9/p9-07/PHASE10_HANDOFF.md | Broad cleanup NO-GO; exact candidate/caller/inventory/rollback proof and clean published baseline required. Older RD21 issue is superseded only by the later scoped RD21 remediation evidence, not by assumption. |
+| docs/redesign/phase-9/REQUEST.md:246–252,426–439,581–598 | Unfinished genuine human checks may remain release gates; individual disposition required; PARTIAL is not PASS; independent development/Phase10/production decisions. |
+| docs/redesign/phase-9/p9-sec-02/ACCEPTANCE_ADDENDUM_2026-10-25.md | Scoped Python security CONDITIONAL PASS: vendor-local Torch PyPI404 remains an incomplete scan response, supplemented by installed OSV/vendor/source/model evidence. Hosted MariaDB BLOCKED, current isolation UNVERIFIED. No owner risk acceptance. |
+| docs/cv-redesign/ACCEPTANCE.md and ENTRY.md | Completed model-independent editor development, conditional human/model acceptance. Original standalone scope issue was resolved by the later explicit CV-UX workstream; this is not Phase10 approval. |
+| docs/cv-import/ACCEPTANCE.md | Implemented deterministic workflow conditionally accepted for development/QA. Optional model adapter disabled and disconnected from active processing. No near-100% extraction or production claim. |
+| docs/cv-integration-qa/ACCEPTANCE.md and PHASE_10_HANDOFF.md | Reviewed mapping/persistence improvements qualified; conditional candidate assessment/planning only. No verified unused deletion candidate. |
+| docs/pre-phase10-ux/ACCEPTANCE.md, LOCAL_RUNTIME_ACCEPTANCE.md | A–D implemented; bounded local Docling/generic strategy/enrichment verified. Broad freeze994bf8f and later caa0c6a AI fix have distinct evidence. Revised S01 and human/model/operator gates retained. |
+| Separately committed codex/autonomous-roadmap-01:docs/automation/GATES.md and automation/backlog.json | Execution disabled. `phase10-development-entry` protected approval missing; real sandbox/test adapter qualification blocked. All current checkpoint deferrableGates arrays are empty. Source-only conditional debt cannot silently become an executable deferral. |
+| planning/int-global-jobs-00:docs/global-jobs/00/DEPENDENCIES_AND_GATES.md | GJ-00 planning only; actual remote ref0ec9f98 verified without modifying/merging it. GJ implementation needs Phase10, Product Review, initiative entry and provider-specific rights. |
+
+Observed starting branch/head: test/pre-phase10-ux-acceptance at5032ccb41514807c8ca3008c24ca6326be1170de, clean before handoff files. Ancestry of5032ccb is confirmed. App inventory shows only this active chat at this cwd; the controller chat has its own worktree. This is an observation, not a cross-process filesystem lock. Source hashes are frozen during tests to detect drift.
+
+Gitea observation13:39UTC: DNS/TCP443/HTTPS200/TLS1.3 with certificate verification passed. A normal push published caa0c6a and5032ccb; independent ls-remote returned5032ccb. GJ-00 local and remote both0ec9f98e6ed4a646fc5e017d8eb6fade07653f37. Final handoff publication must be checked again; earlier success does not establish final remote HEAD.
+
+The historical graph at4a8c907 is orientation only (10,691 nodes/34,221 edges, application-code scope). Current source callers, native results and gate texts take precedence. It was not rebuilt or modified in the primary checkout. The separate controller was inspected through committed Git objects only; no file or runtime in its worktree was changed, launched or messaged.
@@ -0,0 +1,321 @@
+{
+  "schemaVersion": 1,
+  "workstreamId": "AUTOMATION-HANDOFF-01",
+  "kind": "BLOCKERS",
+  "items": [
+    {
+      "id": "P10-ENTRY-01",
+      "description": "No protected owner approval of the final published development baseline and exact cleanup scope was supplied to this handoff.",
+      "evidence": [
+        "AUTHORITY.md",
+        "docs/cv-integration-qa/PHASE_10_HANDOFF.md"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "Exact baseline/scope and independent stage entry",
+      "requiredAction": "Review the completed package and candidate scope; grant phase10-development-entry only through the separate protected approval process. A repository GO is insufficient.",
+      "blockingPhase": [
+        "PHASE-10"
+      ],
+      "responsibleParty": "Owner / protected controller approval authority",
+      "deferralAuthority": null,
+      "classification": "MANDATORY_ENTRY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "P10-CANDIDATE-01",
+      "description": "No proposed product deletion has proven absence of static, dynamic, route and historical-data consumers.",
+      "evidence": [
+        "CLEANUP_INVENTORY.md",
+        "docs/redesign/IMPLEMENTATION_PLAN.md"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "Unused-route proof; passing affected tests; satisfied functionality inventory",
+      "requiredAction": "Prepare and approve a concrete candidate with caller/route/inventory/rollback proof and affected native regression; retain every active compatibility path.",
+      "blockingPhase": [
+        "PHASE-10: each removal candidate"
+      ],
+      "responsibleParty": "Development owner / reviewer",
+      "deferralAuthority": null,
+      "classification": "MANDATORY_ENTRY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "AUTO-RUNTIME-01",
+      "description": "Current single-user controller reports real MXC canary PASS, but no actual owner key or ChatGPT sign-in, operator-controlled policy and disabled real execution; current-context qualification/activation remains incomplete.",
+      "evidence": [
+        "CONTROLLER_ADDENDUM.md",
+        "READY_TO_RUN.md",
+        "controller-current-native-qualification-json",
+        "controller-current-setup-results-json"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "Independent qualified execution boundary",
+      "requiredAction": "Operator must sign into dedicated auth-only profile, configure the actual protected owner key and qualify its host-positive/worker-negative boundary and fresh current-context controls, then independently approve runtime/queue/entry policy. Existing same-user MXC mode does not require a new account or VM; its finite canaries do not qualify actual owner credentials or roadmap execution. This handoff must not operate that runtime.",
+      "blockingPhase": [
+        "AUTOMATIC_PHASE-10_EXECUTION"
+      ],
+      "responsibleParty": "AUTONOMOUS-ROADMAP-01 platform operator",
+      "deferralAuthority": null,
+      "classification": "MANDATORY_ENTRY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "AUTO-ADAPTER-01",
+      "description": "The external controller real-stage test adapter is unconfigured; synthetic orchestration tests are not application qualification.",
+      "evidence": [
+        "ROADMAP.md",
+        "READY_TO_RUN.md"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "Qualified real-stage composite test adapter",
+      "requiredAction": "Install/review actual commands and parsers, source and suite membership, report freshness and failure/skip/retry/cleanup policy. Independently rerun candidate checks; do not set configured=true as a bypass.",
+      "blockingPhase": [
+        "AUTOMATIC_PHASE-10_EXECUTION"
+      ],
+      "responsibleParty": "AUTONOMOUS-ROADMAP-01 test-adapter maintainer",
+      "deferralAuthority": null,
+      "classification": "MANDATORY_ENTRY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "PDF-S01-01",
+      "description": "Revised-template S01 DOM Range versus PDF character-cell coordinate failures remain undispositioned. Raster agreement is a different measurement.",
+      "evidence": [
+        "docs/pre-phase10-ux/ACCEPTANCE.md",
+        "VISUAL_REVIEW.md"
+      ],
+      "severity": "MODERATE",
+      "acceptanceCriterion": "Required preview/PDF fidelity and visual spacing qualification",
+      "requiredAction": "Retain original oracle and all failures. Investigate/fix an actual measured defect; obtain explicit protected scope/criterion disposition if applicability is ambiguous. Do not waive an automated requirement using a model summary or change goldens to conceal failures.",
+      "blockingPhase": [
+        "PHASE-10: document/rendering scope or required PDF gate",
+        "PRODUCTION"
+      ],
+      "responsibleParty": "Document QA owner / owner acceptance authority",
+      "deferralAuthority": null,
+      "classification": "MANDATORY_ENTRY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "HUMAN-01",
+      "description": "Physical device, keyboard/AT/contrast, human EN/Bokmål, typography and actual printing acceptance are not provided.",
+      "evidence": [
+        "MANUAL_ACCEPTANCE.md"
+      ],
+      "severity": "MODERATE",
+      "acceptanceCriterion": "Genuine human/device/language/print acceptance",
+      "requiredAction": "Complete the prioritised manual scenarios; record exact device/AT/language/print evidence outside model-writable approval authority. Candidate-specific regressions still block.",
+      "blockingPhase": [
+        "HUMAN_ACCEPTANCE",
+        "PRODUCTION",
+        "PHASE-10: affected candidate requires preservation"
+      ],
+      "responsibleParty": "Owner / human QA",
+      "deferralAuthority": "docs/redesign/phase-9/REQUEST.md:246–252 permits genuine unfinished human checks as release gates;426–439 requires individual disposition. This is not automatic Phase10 entry or an executable deferral.",
+      "classification": "CONDITIONAL_DEVELOPMENT",
+      "status": "CONDITIONALLY_DEFERRED"
+    },
+    {
+      "id": "AI-CV-01",
+      "description": "The disabled/disconnected CV adapter has no accepted end-to-end semantic qualification. Three real isolated synthetic responses were rejected.",
+      "evidence": [
+        "AI_EVALUATION_PLAN.md",
+        "AI_RESULTS.md",
+        "docs/cv-import/ACCEPTANCE.md"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "No invented facts; source-grounded factual accuracy and explicit user review",
+      "requiredAction": "Keep CV_IMPORT_AI_ENABLED=false and active processing deterministic; qualify immutable model/runtime/schema/prompt on frozen real PDF/DOCX corpus, review burden and adversarial cases before activation. Small generic successes do not qualify CV accuracy.",
+      "blockingPhase": [
+        "CV_MODEL_ACTIVATION",
+        "CV_AI_ACCURACY",
+        "PRODUCTION_AI_QUALITY"
+      ],
+      "responsibleParty": "AI qualification owner",
+      "deferralAuthority": "docs/cv-import/ACCEPTANCE.md permits model-independent conditional development with inactive optional adapter; no security-risk waiver or automatic controller deferral.",
+      "classification": "CONDITIONAL_DEVELOPMENT",
+      "status": "CONDITIONALLY_DEFERRED"
+    },
+    {
+      "id": "DET-RECALL-01",
+      "description": "Frozen deterministic PDF typed recall and unresolved-source precision remain partial; source correction is necessary.",
+      "evidence": [
+        "docs/pre-phase10-ux/ACCEPTANCE.md"
+      ],
+      "severity": "MODERATE",
+      "acceptanceCriterion": "Near-100% is aspirational; preserve unknown/ambiguous facts",
+      "requiredAction": "Preserve source evidence, unknown values, conservative merges and manual corrections; benchmark changes on frozen corpus separately from model probes.",
+      "blockingPhase": [
+        "BROAD_EXTRACTION_ACCURACY_CLAIMS",
+        "PHASE-10: review/legacy compatibility removal"
+      ],
+      "responsibleParty": "CV/import QA owner",
+      "deferralAuthority": "docs/cv-import/ACCEPTANCE.md and docs/cv-integration-qa/ACCEPTANCE.md explicitly condition supported workflow acceptance on these retained limitations.",
+      "classification": "CONDITIONAL_DEVELOPMENT",
+      "status": "CONDITIONALLY_DEFERRED"
+    },
+    {
+      "id": "PYSEC-01",
+      "description": "Full Python dependency security is conditional; retained vendor-local Torch PyPI404 is not a clean two-provider/whole-image verdict.",
+      "evidence": [
+        "docs/redesign/phase-9/p9-sec-02/ACCEPTANCE_ADDENDUM_2026-10-25.md",
+        "docs/redesign/phase-9/p9-sec-02/DISPOSITIONS.md"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "No bypass of Python/model/cache qualification",
+      "requiredAction": "Retain exact installed OSV/vendor wheel/range/source/model evidence and incomplete response; refresh before affected changes/release. Current import-lock zero advisories does not close full runtime/native security.",
+      "blockingPhase": [
+        "PYTHON_UNTRUSTED_PROCESSING_QUALIFICATION",
+        "PRODUCTION",
+        "PHASE-10: affected Python/model path"
+      ],
+      "responsibleParty": "Security / Python qualification owner",
+      "deferralAuthority": "Existing P9-SEC-02 scoped CONDITIONAL PASS and Phase9 development decision; no owner residual-risk acceptance.",
+      "classification": "CONDITIONAL_DEVELOPMENT",
+      "status": "CONDITIONALLY_DEFERRED"
+    },
+    {
+      "id": "CI-01",
+      "description": "Hosted MariaDB remains quarantined; current runner isolation/lifecycle is unverified and no hosted cases are qualified.",
+      "evidence": [
+        "docs/redesign/phase-9/p9-sec-02/CI_ASSESSMENT.md",
+        ".gitea/workflows/mariadb-integration.yml"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "Hosted provider and infrastructure isolation evidence",
+      "requiredAction": "Provision dedicated nonproduction runner/daemon and native private service; prove merged HostConfig/egress/secret boundaries plus success/fail/cancel/crash cleanup, then reviewed enabling change and actual hosted execution. Do not bypass unconditional workflow guard.",
+      "blockingPhase": [
+        "HOSTED_CI_ACCEPTANCE",
+        "PRODUCTION",
+        "AUTOMATION: if hosted lane required"
+      ],
+      "responsibleParty": "CI infrastructure operator",
+      "deferralAuthority": "P9-SEC-02 CI-M01 allows operator-blocked hosted CI while independent local qualification continues; does not qualify controller execution.",
+      "classification": "CONDITIONAL_DEVELOPMENT",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "MYSQL-TLS-01",
+      "description": "MySqlConnector2.4.0 has the retained moderate GHSA-473q-m89c-ghf8 advisory; production TLS configuration was not inspected.",
+      "evidence": [
+        "docs/pre-phase10-ux/DEPENDENCY_AUDIT.md"
+      ],
+      "severity": "MODERATE",
+      "acceptanceCriterion": "Current dependency/reachability disposition; no accepted residual security risk",
+      "requiredAction": "Qualify >=2.6.1 or the documented trusted-CA mitigation; verify actual affected TLS configuration and rerun MariaDB/RD21. Isolated loopback SslMode=None evidence is not production TLS acceptance.",
+      "blockingPhase": [
+        "PRODUCTION_SECURITY_RELEASE"
+      ],
+      "responsibleParty": "Database/security release owner",
+      "deferralAuthority": null,
+      "classification": "PRODUCTION_ONLY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "OPS-01",
+      "description": "Production filesystem integrity, independent off-disk restore/rollback, deployed identity/cache/monitoring and recovery evidence remain unverified.",
+      "evidence": [
+        "docs/redesign/phase-9/p9-sec-02/ACCEPTANCE_ADDENDUM_2026-10-25.md"
+      ],
+      "severity": "CRITICAL",
+      "acceptanceCriterion": "Independent infrastructure, backup, recovery and release acceptance",
+      "requiredAction": "Complete independent operator verification and release approval on authorised infrastructure; do not perform production repairs, DB operations or service/cache changes from this handoff.",
+      "blockingPhase": [
+        "PRODUCTION"
+      ],
+      "responsibleParty": "Production operator / release owner",
+      "deferralAuthority": null,
+      "classification": "PRODUCTION_ONLY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "NATIVE-SEC-01",
+      "description": "Native parser/decoder fuzzing, whole-image review and applicable Windows memory enforcement remain outside the qualified bounded fixture evidence.",
+      "evidence": [
+        "docs/pre-phase10-ux/SECURITY_REVIEW.md"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "Secure bounded untrusted document processing",
+      "requiredAction": "Qualify native resource/isolation/security boundaries; retain page/file/time/child/container admission limits and privacy/retention cleanup.",
+      "blockingPhase": [
+        "PRODUCTION_UNTRUSTED_DOCUMENT_PROCESSING"
+      ],
+      "responsibleParty": "Security / runtime owner",
+      "deferralAuthority": null,
+      "classification": "PRODUCTION_ONLY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "FUTURE-01",
+      "description": "Separate P5-13/C11, LinkedIn, Android, SQLite retirement, MariaDB upgrade, monitoring and country initiatives remain tracked future work.",
+      "evidence": [
+        "ROADMAP.md"
+      ],
+      "severity": "INFORMATIONAL",
+      "acceptanceCriterion": "No silent backlog loss or unrelated implementation",
+      "requiredAction": "Retain initiative-specific entry decisions and dependencies; do not activate withheld features, remove compatibility or perform major upgrades during cleanup.",
+      "blockingPhase": [
+        "SEPARATE_AUTHORISED_WORKSTREAMS"
+      ],
+      "responsibleParty": "Product / initiative owners",
+      "deferralAuthority": null,
+      "classification": "FUTURE_FEATURE",
+      "status": "OPEN"
+    },
+    {
+      "id": "AI-CONTEXT-01",
+      "description": "Generic strategy admission still requires legacy ProfileCvText; successful reviewed structured import alone does not establish that precondition.",
+      "evidence": [
+        "AI_RESULTS.md",
+        "JobTrackerApi/Services/StrategySnapshotService.cs",
+        "JobTrackerApi/Controllers/ProfileCvController.Import.cs"
+      ],
+      "severity": "MODERATE",
+      "acceptanceCriterion": "Do not claim canonical-only import to generic AI compatibility without exercising it",
+      "requiredAction": "Assess canonical-only generic-AI source compatibility during Product Review. Preserve existing consent/source contracts; never silently fill legacy text from unreviewed uploads. The current successful smoke explicitly supplies separately authored fictional CV text.",
+      "blockingPhase": [
+        "GENERIC_AI_FROM_CANONICAL_ONLY_PROFILE_CLAIM"
+      ],
+      "responsibleParty": "Product / AI integration owner",
+      "deferralAuthority": null,
+      "classification": "FUTURE_FEATURE",
+      "status": "OPEN"
+    },
+    {
+      "id": "AUTO-SCOPE-01",
+      "description": "The committed controller policy has stage entry/review approvals but no explicit protected candidate-scope checkpoint after an assessment-only Phase10 entry.",
+      "evidence": [
+        "CONTRACT.md",
+        "GATES.json",
+        "CLEANUP_INVENTORY.md"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "Concrete owner-approved candidate scope before cleanup implementation",
+      "requiredAction": "Bind a full entry approval to already-proven exact candidates, or use the controller's signed policy update to stop after assessment and require a protected candidate-specific-cleanup-scope decision before removal. Do not treat assessment-only approval or worker-written evidence as deletion authority.",
+      "blockingPhase": [
+        "AUTOMATIC_PHASE-10_CLEANUP_IMPLEMENTATION"
+      ],
+      "responsibleParty": "Owner / AUTONOMOUS-ROADMAP-01 policy maintainer",
+      "deferralAuthority": null,
+      "classification": "MANDATORY_ENTRY",
+      "status": "BLOCKED"
+    },
+    {
+      "id": "GIT-RECOVERY-01",
+      "description": "The originally pending caa0c6a and5032ccb publication was recovered and independently read back.",
+      "evidence": [
+        "AUTHORITY.md"
+      ],
+      "severity": "HIGH",
+      "acceptanceCriterion": "Clean directly verified remote baseline",
+      "requiredAction": "Reverify exact final local/remote HEAD after publishing the finished package; normal push only. GJ-00 was independently verified without modifying/merging it.",
+      "blockingPhase": [
+        "PHASE-10: final published baseline"
+      ],
+      "responsibleParty": "Git integration owner",
+      "deferralAuthority": null,
+      "classification": "MANDATORY_ENTRY",
+      "status": "CLOSED"
+    }
+  ]
+}
@@ -0,0 +1,27 @@
+# Phase10 candidate inventory — assessment only
+
+No removal is implemented or approved here. No genuinely unused product component has yet been proven across static, dynamic and historical readers. The concrete negative findings below prevent unsafe deletions; potential consolidation needs a separately approved candidate. All locations are repository-relative.
+
+| ID / location | Replacement / current consumers | Dynamic or compatibility risk; disposition | Preservation / required test / removal risk |
+|---|---|---|---|
+| CLEAN-01 `job-tracker-ui/src/views/CvBuilderEditor.tsx` | Current editor rendered by CvBuilderPage; undo/history hooks are active | New implementation, not obsolete. Retain | CV authoring; blank/history/save/browser/RD21; HIGH |
+| CLEAN-02 `job-tracker-ui/src/components/CvTemplateThumbnail.tsx` | CvTemplateGallery imports it. It now renders actual server sample HTML in a sandboxed iframe | Name does not mean simplified obsolete thumbnail. Lazy/cached sample and error paths active; retain | Templates; preview/unit/browser/native PDF; HIGH |
+| CLEAN-03 `job-tracker-ui/src/components/CvTemplateGallery.tsx` | Current template library/selection callers | Retain gallery semantics, premium checks and explicit Apply. No duplicate proven | CV gallery; template-selection/legacy/browser; HIGH |
+| CLEAN-04 `job-tracker-ui/src/views/career/CvImportReview.tsx` and `CvImportMappingEditor.tsx` | CareerProfilePage renders Docling review for pending/applied runs | Current correction/assignment/duplicate workflow; retain | Career Profile/import; real PDF/DOCX/review/provider rollback; CRITICAL |
+| CLEAN-05 legacy branches in `CareerProfilePage.tsx` and `JobTrackerApi/Controllers/ProfileCvController.cs` | Non-docling runs still use review/accept API and DTOs | Old persisted runs are live consumers. Retain until migration/retention and no-reader evidence | Profile/import/history; legacy and new-run contract/browser; CRITICAL |
+| CLEAN-06 `job-tracker-ui/src/components/DashboardLayoutEditor.tsx` | DashboardView imports it beside DashboardGrid, including navigation guard | Grid adds geometry; editor still owns show/hide/save/reset/conflict controls. Not replaced | Dashboard; geometry/preferences/keyboard/RD21; HIGH |
+| CLEAN-07 `job-tracker-ui/src/dashboardLayout.ts` and `hooks/useDashboardLayout.ts` | DashboardView/Grid/LayoutEditor/unit callers | v1-to-v2 migration, future/hidden widget preservation and CAS remain active | Dashboard/settings; v1/v2/provider/viewport/save conflict; HIGH |
+| CLEAN-08 `job-tracker-ui/src/views/AdminProcessingPage.tsx` | `/admin/processing` in App.tsx; new current view | No superseded admin-processing view verified. Other admin audit/system views serve different functions | Admin/auth/privacy; owner/tenant/rate/redaction/browser; CRITICAL |
+| CLEAN-09 redirects in `job-tracker-ui/src/App.tsx` | `/kanban`, `/correspondence/review`, `/applications/:id` | Existing bookmarks/extensions/query/hash paths; retain aliases | Routes/jobs/correspondence; route-contract/navigation/ownership; HIGH |
+| CLEAN-10 `JobTrackerApi/Models/CvTheme.cs` and `Services/ThemedCvRenderer.cs` design-version branches | Existing CV settings lack v2; only explicit Apply opts in | v1 is historical-document compatibility, not dead rendering code. Retain | CV/letters/frozen packages; unchanged Windows/Linux goldens; CRITICAL |
+| CLEAN-11 `JobTrackerApi/Services/CareerProfileMapper.cs`, import mapping/interpreter owners | Different canonical persistence and reviewed source mapping responsibilities | No duplicate master profile/service proven. Trace side effects before any consolidation | Canonical profile/variants; MariaDB rollback/replay/stale writes; CRITICAL |
+| CLEAN-12 `JobTrackerApi/Services/ApplicationAssetsService.cs` and versioned writers | CV/letter/job/application submission readers | RD21 tokens, no-op/null semantics and frozen packages remain mandatory | Applications/docs; all writers/provider/network recovery; CRITICAL |
+| CLEAN-13 `JobTrackerApi/Migrations/` and `Data/JobTrackerContext.cs` | Development/provider startup and old database adoption paths | Do not delete migrations or automatically retire SQLite/MariaDB compatibility. No major-version change | Data/auth/history; migration up/down/provider/backup restore; CRITICAL |
+| CLEAN-14 `tools/summarizer/parser_child.py`, legacy extraction and Docling environment | Existing text/attachment routes plus separate bounded document converter | New Docling CV path does not replace all extraction consumers. Retain both until actual census | AI/import/attachments; parser security/legacy/Docling; HIGH |
+| CLEAN-15 `tools/summarizer/cv_import_ai.py`, CV_IMPORT_AI_ENABLED | Disabled/disconnected optional interpretation adapter and tests | Withheld capability is not obsolete. Keep disabled; no activation through cleanup | C11/P5-13/import; disabled transport/schema/grounding/negative model probes; HIGH |
+| CLEAN-16 shared style utilities, typography and licensed fonts | MUI/app styles and fixed physical document CSS have different owners | No unused stylesheet/font proven. Dynamic class names, exports, iframe/export embedding need explicit proof | UI/accessibility/PDF/fonts; lint/type/build/browser/native PDF; HIGH |
+| CLEAN-17 package/lock dependencies including react-grid-layout and legacy parser packages | RGL is imported by DashboardGrid; parsers serve retained routes | No unreferenced dependency proven. Age/advisory is not unused proof. Qualify updates separately | Dashboard/import/rendering/security; lock audit/build/provider/PDF; HIGH |
+| CLEAN-18 old tests, golden fixtures, acceptance records | Regression and historical evidence consumers | Never remove because newer tests pass. Keep original failed attempts/oracles | All57 groups; discovery identity and unchanged oracle hashes; HIGH |
+| CLEAN-19 shell/Dashboard duplicate reminder reads (historical P9-PERF-01) | Possible shared-owner optimisation; exact current count not newly measured | Assessment candidate only: measure before/after with failure/account-disposal behavior. No removal eligibility | Notifications/dashboard; loading/refresh/session disposal; MEDIUM |
+
+Every future candidate must name exact symbols and replacement, enumerate current static/dynamic/export/route/old-data consumers, establish an absence of live usage, bind affected preservation IDs, define rollback and run focused plus applicable full regression. An owner-approved scope is required before implementation. The table is bounded evidence, not an exhaustive proof that the repository contains no dead code.
@@ -0,0 +1,28 @@
+# Proposed evidence adapter v1
+
+Contract ID: `urn:jobjakt:pre-phase10-evidence:1`. This is a **proposed evidence import contract**, not a replacement for AUTONOMOUS-ROADMAP-01's committed `automation/schemas/backlog.schema.json` or `result.schema.json`. Both happen to use version1; their document kinds and authority are different. The separate controller snapshot is recorded in GATES.json. Its worktree/policy/state/runtime was not modified or executed.
+
+| Package field | Existing controller integration |
+|---|---|
+| ACCEPTANCE.localCommit | Frozen application/test baseline; independently prove ancestry and application-source equality for the resolved final package commit. Never assume the capture-time remote observation is current |
+| ACCEPTANCE.snapshotHead / verifiedRemoteCommit | Dated provenance only. Resolve final branch HEAD again, require clean local/remote equality, and bind the protected entry request to that actual hash |
+| TEST_EVIDENCE native report/process/source artifacts | Recompute compressed-file hashes, decompress with a strict bound, parse native identities/counters and process exits. Source before/after must agree. Verify all expected ordinary discovery identities exactly once; retain separate lanes and original failures |
+| GATES stage IDs / predecessor / manualApprovals | Projection of the existing seven stages05–11 and their protected approval identifiers. Do not insert this evidence package as a second executable queue or enable execution from it |
+| BLOCKERS classification / blockingPhase | Scope-dependent entry, conditional development debt, production and future work. Neither a conditional result nor a closed unrelated blocker satisfies a mandatory candidate condition |
+| requiredOwnerApprovals | Requests for external protected owner decisions, not records that approval occurred. This package contains no approval token, signature or private key |
+| packageStatus READY | All required evidence/documentation is present and schema-consistent. It says nothing about approval to start Phase10 |
+| phase10DevelopmentReadiness NO-GO / eligibleForAutomaticExecution false | Current authoritative entry decision. The controller must remain blocked pending actual protected approvals, candidate proof, publication and runtime/test-adapter qualification |
+
+The controller's existing `result.schema.json` uses outcomes such as blocked/conditional/complete and blocker/approval/checkpoint fields. A valid handoff with this entry decision maps to **blocked** for Phase10; do not translate validator exit0 into `complete` or a satisfied stage requirement. No result payload can sign its own authority. The controller must independently verify real predecessor acceptance and perform its protected `phase10-development-entry` and stage-review flow.
+
+The current manifest has no declared checkpoint deferrable gates. Human release debt and disabled optional CV AI have individual historical conditional-development authority, but importing that debt does not authorise automatic advancement. A policy change and any actual conditional-deferral must use the controller's owner-controlled signed request process. Required automated failures remain failures. Preserve actual S01 failures and isolated model rejections.
+
+The controller snapshot also has no explicit protected candidate-scope checkpoint between an assessment-only entry and removal. The proposed GATES contract adds `candidate-specific-cleanup-scope` as a source-derived requirement, not as a claim that the live manifest already enforces it. Either the entry grant must already name proven exact candidates, or the operator must adopt a signed policy update that stops after assessment and requires that protected decision before cleanup implementation. This workstream cannot add that hook in the separate worktree. AUTO-SCOPE-01 stays BLOCKED.
+
+## Portable evidence
+
+Native test reports, process observations and source manifests are stored as individually compressed `.gz` files under `evidence/` with exact hashes in TEST_EVIDENCE.json. XML, Jest and ordinary metadata bytes are preserved. Playwright reports with inline attachment bodies use an explicitly labelled transport projection: only `results[].attachments[].body` is externalized. Native cases, counters, errors, retries, statuses, labels and identities remain intact; an indexed audit retains original report/body hashes, sizes, native statistics and original producer paths. This avoids committing roughly77MiB of compressed inline screenshots. The original raw reports remain untouched under `.artifacts/automation-handoff-01/`; no failed result is removed or improved. Importing consumers must recognise this projection and obtain the original raw artifact if their policy requires complete inline bodies. Large videos, traces and model weights are not imported. Actual synthetic PDFs/previews are supplied in the separate visual comparison package.
+
+The package verifier only reads bounded local files/Git and optionally verifies the configured remote. It does not execute report commands, install dependencies, run a controller, inspect protected approval keys or grant readiness. Installed pinned Ajv/jsdom from the existing frontend dev dependency tree provide actual JSON Schema/XML validation; no dependency was added. External consumers may use their own qualified parsers and must not trust this model-writable verifier as their security boundary.
+
+At consumption, require a clean authorised checkout containing the final published package, verify hashes/source/ancestry, and independently run the controller's actual qualified test adapter. Hold protected authority and expected policy/report hashes outside model-writable repository state. If the adapter, signatures, runtime boundary or report transport is unavailable, remain BLOCKED. Do not weaken gates, issue self-approval or edit another worktree as an integration shortcut.
@@ -0,0 +1,17 @@
+# External controller snapshot reconciliation — 29 October 2026
+
+At final review the external worktree advanced from the initially inspected c1663df to **140e182516e86c8718054cf0907593fcd6a38aa7**, branch `codex/autonomous-roadmap-single-user`. This addendum supersedes current-runtime statements based only on the earlier snapshot. Only committed Git objects were read; no external worktree file, setup, login, key, runtime, process, policy or schedule was modified or run by this handoff.
+
+The committed SINGLE_USER_ACCEPTANCE and machine-readable setup/qualification/results now report:
+
+- **69 Python controller tests**, including the original48, and **6 separate .NET signature cases**. These are external-workstream results, not fresh application/handoff executions, and69 must not be added to48.
+- Actual native MXC synthetic filesystem/network/signing canaries PASS, with host-positive controls and seven denied protected-file categories. The earlier legacy CryptUnprotectData failure is historical; it is no longer accurate to describe every supported native mode as failing startup.
+- Same-user installation exists; a new Windows account/VM is not a requirement of this mode. This confinement is not an independently administered account boundary and does not establish exhaustive API/credential safety.
+- Dedicated ChatGPT authentication **NOT_SIGNED_IN**, real owner signing key **NOT_CONFIGURED**, actual owner-key denial **false/not tested**, operator-controlled policy, queue **disabled**, **zero real sessions**. Canary signing-key denial does not qualify a nonexistent actual owner key.
+- Real provider/browser/Python/PDF/security/preservation adapter is still unconfigured. No formal Phase10 entry or accepted candidate-removal scope is supplied. No task was installed; locked-desktop/logged-out/reboot execution remains unqualified.
+
+GATES.json references140e182. The backlog/prompt policy remains based on5032ccb with empty checkpoint deferrableGates; the candidate-scope integration requirement remains open. TEST_EVIDENCE.json indexes the committed external documents/results/backlog as `controller-current-*` artifacts with exact byte hashes, explicitly not as our executed tests. The initial c166 observations remain historical context.
+
+AUTO-RUNTIME-01 remains BLOCKED for **actual key, human sign-in, current-context qualification and independent activation authority**, rather than an assumed universal DPAPI failure or mandatory second account. AUTO-ADAPTER-01, AUTO-SCOPE-01, exact final baseline adoption and Phase10 entry remain separate. The package neither closes nor duplicates the external controller's work.
+
+The operator's next steps, in their own real terminal, are described by that snapshot's SINGLE_USER.md: dedicated same-account authentication, protected owner-key setup, qualification of the exact actual key/current context, and later signed runtime/policy/baseline/entry decisions. Those actions are not performed or pre-approved here. Preserve the external operator-controlled pause until every applicable condition is met.
@@ -0,0 +1,280 @@
+{
+  "schemaVersion": 1,
+  "workstreamId": "AUTOMATION-HANDOFF-01",
+  "kind": "GATES",
+  "contractStatus": "PROPOSED_EVIDENCE_ADAPTER_NOT_EXECUTABLE_POLICY",
+  "controllerCommit": "140e182516e86c8718054cf0907593fcd6a38aa7",
+  "controllerFiles": [
+    "automation/backlog.json",
+    "automation/schemas/backlog.schema.json",
+    "automation/schemas/result.schema.json",
+    "docs/automation/GATES.md",
+    "docs/automation/SINGLE_USER_ACCEPTANCE.md",
+    "docs/automation/SINGLE_USER.md"
+  ],
+  "executionEnabledByThisPackage": false,
+  "externalApprovalPolicy": "Use existing protected RSA/SHA256 owner-SID/request-hash/expiry binding. Bind resolved final baseline, candidate scope, policy/prompt and artifact hashes. No signatures/tokens are created here; all current checkpoint deferrableGates are empty. Any policy update/conditional-deferral requires the controller signed process.",
+  "stages": [
+    {
+      "id": "PHASE-10",
+      "sequence": 5,
+      "requiredPredecessor": [
+        "AUTOMATION-HANDOFF-01 accepted entry and protected owner decision"
+      ],
+      "requiredTestSuites": [
+        "Fresh applicable .NET, React, browser/contracts/import, MariaDB/RD21, Python/Docling, native PDF, type/lint/build/security/preservation lanes",
+        "Stage-specific requirements and independent source-requirements review"
+      ],
+      "minimumEvidence": [
+        "Native nonempty reports and command exits; source/commit/image binding; expected test membership; zero hidden failures/skips/retries",
+        "Original failures retained; actual cleanup and old-data/route compatibility; human/provider/model results separate"
+      ],
+      "requiredGitState": [
+        "Exact approved published baseline ancestry",
+        "Clean authorised feature checkout; normal push and independent exact remote HEAD readback",
+        "No main merge, force push or deployment"
+      ],
+      "preservationChecks": [
+        "All57 original criteria retain status and scope; all33 old routes plus admin processing route",
+        "Canonical Career Profile, CV overrides/frozen versions, letters, applications, auth/tenant and RD21 contracts",
+        "Candidate-specific caller/old-data/rollback proof and unchanged PDF/font oracles"
+      ],
+      "manualApprovals": [
+        "phase10-development-entry",
+        "stage-requirements-review",
+        "candidate-specific-cleanup-scope"
+      ],
+      "permissibleConditionalDeferrals": [],
+      "blockingFindings": [
+        "Missing predecessor or protected approval",
+        "Unqualified runtime/test adapter or missing/wrong-source report",
+        "Unpublished commit; failed mandatory test; undispositioned affected compatibility or security finding",
+        "Missing protected candidate-scope decision before removal; assessment-only entry cannot authorise deletions"
+      ]
+    },
+    {
+      "id": "PRODUCT-REVIEW-01",
+      "sequence": 6,
+      "requiredPredecessor": [
+        "PHASE-10"
+      ],
+      "requiredTestSuites": [
+        "Fresh applicable .NET, React, browser/contracts/import, MariaDB/RD21, Python/Docling, native PDF, type/lint/build/security/preservation lanes",
+        "Stage-specific requirements and independent source-requirements review"
+      ],
+      "minimumEvidence": [
+        "Native nonempty reports and command exits; source/commit/image binding; expected test membership; zero hidden failures/skips/retries",
+        "Original failures retained; actual cleanup and old-data/route compatibility; human/provider/model results separate"
+      ],
+      "requiredGitState": [
+        "Exact approved published baseline ancestry",
+        "Clean authorised feature checkout; normal push and independent exact remote HEAD readback",
+        "No main merge, force push or deployment"
+      ],
+      "preservationChecks": [
+        "All57 original criteria retain status and scope; all33 old routes plus admin processing route",
+        "Canonical Career Profile, CV overrides/frozen versions, letters, applications, auth/tenant and RD21 contracts",
+        "Candidate-specific caller/old-data/rollback proof and unchanged PDF/font oracles"
+      ],
+      "manualApprovals": [
+        "product-ranked-scope",
+        "stage-requirements-review"
+      ],
+      "permissibleConditionalDeferrals": [],
+      "blockingFindings": [
+        "Missing predecessor or protected approval",
+        "Unqualified runtime/test adapter or missing/wrong-source report",
+        "Unpublished commit; failed mandatory test; undispositioned affected compatibility or security finding"
+      ]
+    },
+    {
+      "id": "INT-GLOBAL-JOBS-01",
+      "sequence": 7,
+      "requiredPredecessor": [
+        "PRODUCT-REVIEW-01"
+      ],
+      "requiredTestSuites": [
+        "Fresh applicable .NET, React, browser/contracts/import, MariaDB/RD21, Python/Docling, native PDF, type/lint/build/security/preservation lanes",
+        "Stage-specific requirements and independent source-requirements review"
+      ],
+      "minimumEvidence": [
+        "Native nonempty reports and command exits; source/commit/image binding; expected test membership; zero hidden failures/skips/retries",
+        "Original failures retained; actual cleanup and old-data/route compatibility; human/provider/model results separate"
+      ],
+      "requiredGitState": [
+        "Exact approved published baseline ancestry",
+        "Clean authorised feature checkout; normal push and independent exact remote HEAD readback",
+        "No main merge, force push or deployment"
+      ],
+      "preservationChecks": [
+        "All57 original criteria retain status and scope; all33 old routes plus admin processing route",
+        "Canonical Career Profile, CV overrides/frozen versions, letters, applications, auth/tenant and RD21 contracts",
+        "Candidate-specific caller/old-data/rollback proof and unchanged PDF/font oracles"
+      ],
+      "manualApprovals": [
+        "global-jobs-implementation",
+        "product-ranked-scope",
+        "provider-licences-and-display-rights",
+        "stage-requirements-review"
+      ],
+      "permissibleConditionalDeferrals": [],
+      "blockingFindings": [
+        "Missing predecessor or protected approval",
+        "Unqualified runtime/test adapter or missing/wrong-source report",
+        "Unpublished commit; failed mandatory test; undispositioned affected compatibility or security finding"
+      ]
+    },
+    {
+      "id": "I18N-01",
+      "sequence": 8,
+      "requiredPredecessor": [
+        "INT-GLOBAL-JOBS-01"
+      ],
+      "requiredTestSuites": [
+        "Fresh applicable .NET, React, browser/contracts/import, MariaDB/RD21, Python/Docling, native PDF, type/lint/build/security/preservation lanes",
+        "Stage-specific requirements and independent source-requirements review"
+      ],
+      "minimumEvidence": [
+        "Native nonempty reports and command exits; source/commit/image binding; expected test membership; zero hidden failures/skips/retries",
+        "Original failures retained; actual cleanup and old-data/route compatibility; human/provider/model results separate"
+      ],
+      "requiredGitState": [
+        "Exact approved published baseline ancestry",
+        "Clean authorised feature checkout; normal push and independent exact remote HEAD readback",
+        "No main merge, force push or deployment"
+      ],
+      "preservationChecks": [
+        "All57 original criteria retain status and scope; all33 old routes plus admin processing route",
+        "Canonical Career Profile, CV overrides/frozen versions, letters, applications, auth/tenant and RD21 contracts",
+        "Candidate-specific caller/old-data/rollback proof and unchanged PDF/font oracles"
+      ],
+      "manualApprovals": [
+        "human-linguistic-and-market-qualification",
+        "i18n-scope",
+        "stage-requirements-review"
+      ],
+      "permissibleConditionalDeferrals": [],
+      "blockingFindings": [
+        "Missing predecessor or protected approval",
+        "Unqualified runtime/test adapter or missing/wrong-source report",
+        "Unpublished commit; failed mandatory test; undispositioned affected compatibility or security finding"
+      ]
+    },
+    {
+      "id": "LAUNCH-SITE-01",
+      "sequence": 9,
+      "requiredPredecessor": [
+        "I18N-01"
+      ],
+      "requiredTestSuites": [
+        "Fresh applicable .NET, React, browser/contracts/import, MariaDB/RD21, Python/Docling, native PDF, type/lint/build/security/preservation lanes",
+        "Stage-specific requirements and independent source-requirements review"
+      ],
+      "minimumEvidence": [
+        "Native nonempty reports and command exits; source/commit/image binding; expected test membership; zero hidden failures/skips/retries",
+        "Original failures retained; actual cleanup and old-data/route compatibility; human/provider/model results separate"
+      ],
+      "requiredGitState": [
+        "Exact approved published baseline ancestry",
+        "Clean authorised feature checkout; normal push and independent exact remote HEAD readback",
+        "No main merge, force push or deployment"
+      ],
+      "preservationChecks": [
+        "All57 original criteria retain status and scope; all33 old routes plus admin processing route",
+        "Canonical Career Profile, CV overrides/frozen versions, letters, applications, auth/tenant and RD21 contracts",
+        "Candidate-specific caller/old-data/rollback proof and unchanged PDF/font oracles"
+      ],
+      "manualApprovals": [
+        "homepage-design-selection",
+        "stage-requirements-review"
+      ],
+      "permissibleConditionalDeferrals": [],
+      "blockingFindings": [
+        "Missing predecessor or protected approval",
+        "Unqualified runtime/test adapter or missing/wrong-source report",
+        "Unpublished commit; failed mandatory test; undispositioned affected compatibility or security finding"
+      ]
+    },
+    {
+      "id": "SECURITY-AUDIT-01",
+      "sequence": 10,
+      "requiredPredecessor": [
+        "LAUNCH-SITE-01"
+      ],
+      "requiredTestSuites": [
+        "Fresh applicable .NET, React, browser/contracts/import, MariaDB/RD21, Python/Docling, native PDF, type/lint/build/security/preservation lanes",
+        "Stage-specific requirements and independent source-requirements review"
+      ],
+      "minimumEvidence": [
+        "Native nonempty reports and command exits; source/commit/image binding; expected test membership; zero hidden failures/skips/retries",
+        "Original failures retained; actual cleanup and old-data/route compatibility; human/provider/model results separate"
+      ],
+      "requiredGitState": [
+        "Exact approved published baseline ancestry",
+        "Clean authorised feature checkout; normal push and independent exact remote HEAD readback",
+        "No main merge, force push or deployment"
+      ],
+      "preservationChecks": [
+        "All57 original criteria retain status and scope; all33 old routes plus admin processing route",
+        "Canonical Career Profile, CV overrides/frozen versions, letters, applications, auth/tenant and RD21 contracts",
+        "Candidate-specific caller/old-data/rollback proof and unchanged PDF/font oracles"
+      ],
+      "manualApprovals": [
+        "isolated-adversarial-targets",
+        "material-security-findings-disposition",
+        "security-test-environment-and-scope",
+        "stage-requirements-review"
+      ],
+      "permissibleConditionalDeferrals": [],
+      "blockingFindings": [
+        "Missing predecessor or protected approval",
+        "Unqualified runtime/test adapter or missing/wrong-source report",
+        "Unpublished commit; failed mandatory test; undispositioned affected compatibility or security finding"
+      ]
+    },
+    {
+      "id": "RELEASE-READINESS-01",
+      "sequence": 11,
+      "requiredPredecessor": [
+        "SECURITY-AUDIT-01"
+      ],
+      "requiredTestSuites": [
+        "Fresh applicable .NET, React, browser/contracts/import, MariaDB/RD21, Python/Docling, native PDF, type/lint/build/security/preservation lanes",
+        "Stage-specific requirements and independent source-requirements review"
+      ],
+      "minimumEvidence": [
+        "Native nonempty reports and command exits; source/commit/image binding; expected test membership; zero hidden failures/skips/retries",
+        "Original failures retained; actual cleanup and old-data/route compatibility; human/provider/model results separate"
+      ],
+      "requiredGitState": [
+        "Exact approved published baseline ancestry",
+        "Clean authorised feature checkout; normal push and independent exact remote HEAD readback",
+        "No main merge, force push or deployment"
+      ],
+      "preservationChecks": [
+        "All57 original criteria retain status and scope; all33 old routes plus admin processing route",
+        "Canonical Career Profile, CV overrides/frozen versions, letters, applications, auth/tenant and RD21 contracts",
+        "Candidate-specific caller/old-data/rollback proof and unchanged PDF/font oracles"
+      ],
+      "manualApprovals": [
+        "release-evidence-review",
+        "stage-requirements-review"
+      ],
+      "permissibleConditionalDeferrals": [],
+      "blockingFindings": [
+        "Missing predecessor or protected approval",
+        "Unqualified runtime/test adapter or missing/wrong-source report",
+        "Unpublished commit; failed mandatory test; undispositioned affected compatibility or security finding"
+      ]
+    }
+  ],
+  "separateInitiatives": [
+    "P5-13/C11 AI qualification and model assessment",
+    "LinkedIn feasibility",
+    "Android application",
+    "SQLite retirement",
+    "MariaDB upgrade strategy",
+    "Monitoring and operational improvements",
+    "Future country integrations"
+  ]
+}
@@ -0,0 +1,52 @@
+# AUTOMATION-HANDOFF-01 — completed evidence handoff
+
+**Package READY; Pre-Phase-10 UX and CV Integration CONDITIONAL GO; Phase10 development NO-GO; automatic execution NOT authorised; production NO-GO.** This handoff completes safely achievable evidence work, not the missing owner/operator qualifications.
+
+Branch: `test/pre-phase10-ux-acceptance`. Frozen tested application baseline: **5032ccb41514807c8ca3008c24ca6326be1170de**. It contains CV-UX4a0af62, CV-QA4a8c907, cumulative3255da9 and strategy correction caa0c6a. Handoff-only descendants do not change application, existing tests or deployment. Resolve the final package commit using `git rev-parse HEAD`, and independently compare its remote ref and clean working tree: a file cannot truthfully embed the hash of the commit containing itself. ACCEPTANCE.json labels its earlier snapshot/readback explicitly. `verify.mjs --verify-remote` checks the actual current HEAD.
+
+The two previously unpublished commits caa0c6a/5032ccb and completed handoff checkpoints8804231,78e5296,657db9d,c16a66e were normally pushed and exact remote refs read back. DNS/TCP443/HTTPS/TLS and Git recovered without disabling certificate checks. GJ-00 planning remained separately published at0ec9f98e6ed4a646fc5e017d8eb6fade07653f37, diverging18/2 commits from5032ccb; it was not merged or modified. Primary and separate controller worktrees were preserved.
+
+## Fresh execution results
+
+| Lane | Actual outcome |
+|---|---|
+| .NET backend | **1448 passed**,0 failed/skipped |
+| React frontend | **1031 passed /112 suites**,0 failed/pending |
+| Ordinary browser | **380 passed** across four disjoint discovery-verified shards;0 failed/skipped/flaky/retries |
+| Specialized browser contracts | **53 passed**: AI2, auth2, rate9, ingress6, PDF admission1, preferences3, RD21 6, diagnostics18, volume3, RD21-volume3 |
+| Real import browser journeys | **8 passed**: Docling3, integration QA4, long import1 |
+| Real MariaDB | **90 provider tests +3 browser cases passed**, isolated data and fixture cleanup verified |
+| Native Linux rendering browser | **8 passed**, source/image/runtime identity and cleanup retained |
+| Python | **83 offline +14 real Docling passed**; native JUnit repeat replaces overlapping console run |
+| Existing helper/oracle tests | **9 new-benchmark +11 original-benchmark +11 Linux-helper +25 Node-helper passed** |
+| TypeScript, lint, frontend/API builds, Linux native build, Windows apphost restoration | All exit0 |
+| Handoff verification | **18 passed** native parser/schema/source/approval unit and package negative tests; report `handoff-validator` supersedes bootstrap7 |
+| Original PDF fidelity | Per platform24 CVs/60 pages and4 letters/14 pages PASS |
+| Revised PDF corpus | Per platform36 CVs/122 pages content/bounds PASS; full-height sidebar43/43 pages PASS; matching letters18/38 pages PASS |
+| Revised unchanged S01 fidelity | **FAIL: Windows28/36 and Linux20/36 fail S01 only**; criteria unchanged |
+
+These are separate executed lanes, not an assertion that every case exercises a unique product scenario. The original broad regression completed once with source unchanged. Follow-up fixture/collector failures and their non-overlapping recovery are retained in [QUALIFICATION_FAILURES.md](QUALIFICATION_FAILURES.md). Native command arguments, timestamps, exit codes, test identities, source maps and immutable runtime observations are portable artifacts indexed in [TEST_EVIDENCE.json](TEST_EVIDENCE.json). Historical totals and repeated runs are not added to fresh totals.
+
+## Actual local workflow and limits
+
+The existing development environment remains available at `http://jobbjakt.local/`; no handoff-doc activation was necessary. A fresh synthetic PDF passed through the real worker to pending review with owner-correlated events. Separate browser/MariaDB tests cover Upload→Review/correct→Approve→canonical Career Profile→CV Editor→PDF and durable rollback/concurrency protections. Synthetic owner erasure completed. Generic queued strategy and scheduled enrichment actually saved nonempty results; strategy retained a prior provider_unavailable failure. Generic strategy used separately authored fictional ProfileCvText: canonical-only imported structured facts do not satisfy that legacy precondition. AI-CONTEXT-01 records the gap without overwriting user-controlled text.
+
+Real conversion and deterministic extraction are distinct from model inference. Three safely isolated real CV-adapter probes used the approved existing Qwen artifact through a **read-only** model mount; all three were rejected. No compatibility or semantic-accuracy PASS is possible. The active CV adapter remains disabled/disconnected. No model download/replacement, existing Ollama/cache modification or permanent model selection occurred. [AI_RESULTS.md](AI_RESULTS.md) distinguishes actual inference, contract doubles, historical deterministic precision/recall and future qualification.
+
+Security is **CONDITIONAL**: import-lock48 dependencies had0 reported advisories; frontend production0, full frontend5 low; current NuGet scan reports MySqlConnector2.4.0 moderate GHSA-473q-m89c-ghf8. Exact installed Python audit queried63 distributions/126 endpoints with0 advisory records but retained vendor Torch PyPI404, so remains INCOMPLETE. No security risk was accepted on the owner's behalf. Prior source-diff review is historical scoped evidence, not a newly executed exhaustive scan. Hosted MariaDB/CI, native-image, production TLS/filesystem/off-disk backup/recovery/cache/operator qualification remain open in their own scopes.
+
+## Independent decisions and handoff
+
+[ACCEPTANCE.json](ACCEPTANCE.json) contains all15 independent decisions. PDF spacing PARTIAL, revised automated fidelity FAIL, finite semantic content completeness PASS; human printing/device/AT/language NOT TESTED; CV AI BLOCKED; Python security CONDITIONAL; hosted CI BLOCKED; preservation PARTIAL; Git snapshot publication VERIFIED. All57 preservation criteria and34 routes remain retained at their existing56 PARTIAL/1 DEFERRED classifications. No test or historical acceptance record was weakened.
+
+- [TRACEABILITY.md](TRACEABILITY.md): every requested capability mapped to current owners, actual reports and limits.
+- [VISUAL_REVIEW.md](VISUAL_REVIEW.md) and [owner-review.zip](visual/owner-review.zip): actual54 PDFs and first/final comparisons for owner decisions.
+- [MANUAL_ACCEPTANCE.md](MANUAL_ACCEPTANCE.md):11 prioritised human/device/AT/copy/print/workflow checks, all pending.
+- [BLOCKERS.json](BLOCKERS.json) and [AUTHORITY.md](AUTHORITY.md): mandatory entry blockers, source-authorised conditional development debt, production-only blockers and future work kept separate.
+- [PHASE10_BASELINE.md](PHASE10_BASELINE.md) and [CLEANUP_INVENTORY.md](CLEANUP_INVENTORY.md): exact source/compatibility baseline and19 concrete retain/assessment entries; **no approved product removal**.
+- [GATES.json](GATES.json), [ROADMAP.md](ROADMAP.md), [CONTRACT.md](CONTRACT.md), [HANDOFF_SCHEMA.json](HANDOFF_SCHEMA.json): proposed versioned evidence contract, stage05–11 dependencies and separately retained initiatives.
+- [REPRODUCE.md](REPRODUCE.md) and [READY_TO_RUN.md](READY_TO_RUN.md): independent verification and protected entry conditions.
+
+The separate controller was inspected through committed Git objects only, initially c1663df and finally **140e182516e86c8718054cf0907593fcd6a38aa7**. [CONTROLLER_ADDENDUM.md](CONTROLLER_ADDENDUM.md) reconciles its newer single-user mode:69 external Python cases (includes earlier48),6 signature cases and actual MXC canaries PASS, but dedicated sign-in and real owner key missing, operator-controlled/disabled, real adapter unconfigured and no Phase10 authority. Those tests were not rerun here. The older DPAPI failure remains historical. Empty checkpoint deferrableGates and AUTO-SCOPE-01 still require protected policy/candidate decisions. This package does not install a second controller, launch a queue, generate approval signatures or supply an owner decision.
+
+**Required owner/operator action:** review the actual PDFs and affected S01 requirement, complete applicable manual checks, approve the resolved final published baseline and exact cleanup candidate scope through protected approval, and qualify the separate sandbox/test adapter and signed policy. Existing source-authorised conditional debt is not an executable waiver. Production-only issues are not blanket blockers on unrelated assessment, and conditional development permission is not production acceptance. Until mandatory conditions are satisfied, the orchestrator must remain BLOCKED. No Phase10, Product Review, Global Jobs, main merge or production deployment was started.
@@ -0,0 +1,120 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "urn:jobjakt:pre-phase10-evidence:1",
+  "title": "Proposed pre-Phase10 evidence contract v1; not an execution or approval policy",
+  "oneOf": [
+    { "$ref": "#/definitions/acceptance" },
+    { "$ref": "#/definitions/gates" },
+    { "$ref": "#/definitions/blockers" },
+    { "$ref": "#/definitions/evidence" }
+  ],
+  "definitions": {
+    "sha": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "commit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+    "strings": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+    "commonVersion": { "const": 1 },
+    "workstream": { "const": "AUTOMATION-HANDOFF-01" },
+    "status": { "enum": ["GO", "CONDITIONAL GO", "NO-GO", "PASS", "PARTIAL", "FAIL", "BLOCKED", "NOT TESTED", "CONDITIONAL", "VERIFIED", "READY", "INCOMPLETE"] },
+    "counts": {
+      "type": "object", "additionalProperties": false,
+      "required": ["passed", "failed", "skipped", "retries", "unexecuted"],
+      "properties": {
+        "passed": { "type": "integer", "minimum": 0 }, "failed": { "type": "integer", "minimum": 0 },
+        "skipped": { "type": "integer", "minimum": 0 }, "retries": { "type": "integer", "minimum": 0 },
+        "unexecuted": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "verdict": {
+      "type": "object", "additionalProperties": false, "required": ["criterion", "status", "evidence", "limits"],
+      "properties": { "criterion": { "type": "string" }, "status": { "$ref": "#/definitions/status" }, "evidence": { "$ref": "#/definitions/strings" }, "limits": { "type": "string", "minLength": 1 } }
+    },
+    "approval": {
+      "type": "object", "additionalProperties": false, "required": ["id", "state", "authority"],
+      "properties": { "id": { "type": "string" }, "state": { "const": "NOT_PROVIDED_TO_HANDOFF" }, "authority": { "const": "EXTERNAL_PROTECTED_CONTROLLER_APPROVAL" } }
+    },
+    "acceptance": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schemaVersion", "workstreamId", "kind", "authority", "sourceBranch", "localCommit", "localCommitMeaning", "snapshotHead", "verifiedRemoteCommit", "remoteObservation", "worktreeCleanliness", "acceptanceStatus", "entryGateStatus", "phase10DevelopmentReadiness", "eligibleForAutomaticExecution", "packageStatus", "verdicts", "testEvidenceReferences", "unresolvedBlockerIds", "permissibleDeferrals", "requiredOwnerApprovals", "generatedUtc", "recommendation"],
+      "properties": {
+        "schemaVersion": { "$ref": "#/definitions/commonVersion" }, "workstreamId": { "$ref": "#/definitions/workstream" }, "kind": { "const": "ACCEPTANCE" },
+        "authority": { "const": "EVIDENCE_ONLY" }, "sourceBranch": { "const": "test/pre-phase10-ux-acceptance" },
+        "localCommit": { "$ref": "#/definitions/commit" }, "localCommitMeaning": { "const": "FROZEN_TESTED_APPLICATION_BASELINE" },
+        "snapshotHead": { "$ref": "#/definitions/commit" }, "verifiedRemoteCommit": { "anyOf": [{ "$ref": "#/definitions/commit" }, { "type": "null" }] },
+        "remoteObservation": { "type": "string", "minLength": 1 },
+        "worktreeCleanliness": { "type": "object", "additionalProperties": false, "required": ["atSourceBaseline", "atPackageGeneration", "requiredAtConsumption"], "properties": { "atSourceBaseline": { "const": "CLEAN" }, "atPackageGeneration": { "enum": ["CLEAN", "HANDOFF_FILES_ONLY"] }, "requiredAtConsumption": { "const": "CLEAN" } } },
+        "acceptanceStatus": { "const": "CONDITIONAL GO" }, "entryGateStatus": { "const": "BLOCKED" },
+        "phase10DevelopmentReadiness": { "const": "NO-GO" }, "eligibleForAutomaticExecution": { "const": false },
+        "packageStatus": { "enum": ["READY", "INCOMPLETE"] }, "verdicts": { "type": "array", "minItems": 12, "items": { "$ref": "#/definitions/verdict" } },
+        "testEvidenceReferences": { "$ref": "#/definitions/strings" }, "unresolvedBlockerIds": { "$ref": "#/definitions/strings" },
+        "permissibleDeferrals": { "$ref": "#/definitions/strings" }, "requiredOwnerApprovals": { "type": "array", "minItems": 1, "items": { "$ref": "#/definitions/approval" } },
+        "generatedUtc": { "type": "string", "format": "date-time" }, "recommendation": { "type": "string", "minLength": 1 }
+      }
+    },
+    "stage": {
+      "type": "object", "additionalProperties": false,
+      "required": ["id", "sequence", "requiredPredecessor", "requiredTestSuites", "minimumEvidence", "requiredGitState", "preservationChecks", "manualApprovals", "permissibleConditionalDeferrals", "blockingFindings"],
+      "properties": {
+        "id": { "type": "string" }, "sequence": { "type": "integer", "minimum": 5, "maximum": 11 },
+        "requiredPredecessor": { "$ref": "#/definitions/strings" }, "requiredTestSuites": { "$ref": "#/definitions/strings" },
+        "minimumEvidence": { "$ref": "#/definitions/strings" }, "requiredGitState": { "$ref": "#/definitions/strings" },
+        "preservationChecks": { "$ref": "#/definitions/strings" }, "manualApprovals": { "$ref": "#/definitions/strings" },
+        "permissibleConditionalDeferrals": { "$ref": "#/definitions/strings" }, "blockingFindings": { "$ref": "#/definitions/strings" }
+      }
+    },
+    "gates": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schemaVersion", "workstreamId", "kind", "contractStatus", "controllerCommit", "controllerFiles", "executionEnabledByThisPackage", "externalApprovalPolicy", "stages", "separateInitiatives"],
+      "properties": {
+        "schemaVersion": { "$ref": "#/definitions/commonVersion" }, "workstreamId": { "$ref": "#/definitions/workstream" }, "kind": { "const": "GATES" },
+        "contractStatus": { "const": "PROPOSED_EVIDENCE_ADAPTER_NOT_EXECUTABLE_POLICY" }, "controllerCommit": { "$ref": "#/definitions/commit" },
+        "controllerFiles": { "$ref": "#/definitions/strings" }, "executionEnabledByThisPackage": { "const": false },
+        "externalApprovalPolicy": { "type": "string", "minLength": 1 }, "stages": { "type": "array", "minItems": 7, "maxItems": 7, "items": { "$ref": "#/definitions/stage" } },
+        "separateInitiatives": { "$ref": "#/definitions/strings" }
+      }
+    },
+    "blocker": {
+      "type": "object", "additionalProperties": false,
+      "required": ["id", "description", "evidence", "severity", "acceptanceCriterion", "requiredAction", "blockingPhase", "responsibleParty", "deferralAuthority", "classification", "status"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[A-Z][A-Z0-9-]+$" }, "description": { "type": "string", "minLength": 1 }, "evidence": { "$ref": "#/definitions/strings" },
+        "severity": { "enum": ["CRITICAL", "HIGH", "MODERATE", "LOW", "INFORMATIONAL"] }, "acceptanceCriterion": { "type": "string" },
+        "requiredAction": { "type": "string", "minLength": 1 }, "blockingPhase": { "$ref": "#/definitions/strings" }, "responsibleParty": { "type": "string", "minLength": 1 },
+        "deferralAuthority": { "anyOf": [{ "type": "string", "minLength": 1 }, { "type": "null" }] },
+        "classification": { "enum": ["MANDATORY_ENTRY", "CONDITIONAL_DEVELOPMENT", "PRODUCTION_ONLY", "FUTURE_FEATURE"] },
+        "status": { "enum": ["OPEN", "BLOCKED", "CONDITIONALLY_DEFERRED", "CLOSED"] }
+      }
+    },
+    "blockers": {
+      "type": "object", "additionalProperties": false, "required": ["schemaVersion", "workstreamId", "kind", "items"],
+      "properties": { "schemaVersion": { "$ref": "#/definitions/commonVersion" }, "workstreamId": { "$ref": "#/definitions/workstream" }, "kind": { "const": "BLOCKERS" }, "items": { "type": "array", "minItems": 1, "items": { "$ref": "#/definitions/blocker" } } }
+    },
+    "artifact": {
+      "type": "object", "additionalProperties": false, "required": ["id", "path", "sha256", "description"],
+      "properties": { "id": { "type": "string" }, "path": { "type": "string", "minLength": 1 }, "sha256": { "$ref": "#/definitions/sha" }, "description": { "type": "string" }, "projection": { "const": "PLAYWRIGHT_INLINE_ATTACHMENT_BODIES_EXTERNALIZED" }, "sourceSha256": { "$ref": "#/definitions/sha" }, "sourceRelativePath": { "type": "string" }, "externalizedAttachmentCount": { "type": "integer", "minimum": 1 }, "projectionAuditArtifactId": { "type": "string" } },
+      "dependencies": { "projection": ["sourceSha256", "sourceRelativePath", "externalizedAttachmentCount", "projectionAuditArtifactId"] }
+    },
+    "report": {
+      "type": "object", "additionalProperties": false,
+      "required": ["id", "bindingScope", "sourceCommit", "executedFromCommit", "status", "exitCode", "artifactId", "processArtifactId", "processPointer", "nativeFormat", "counts", "membershipSha256", "limits"],
+      "properties": {
+        "id": { "type": "string" }, "bindingScope": { "enum": ["APPLICATION", "HANDOFF_VERIFIER"] }, "sourceCommit": { "$ref": "#/definitions/commit" }, "executedFromCommit": { "$ref": "#/definitions/commit" },
+        "status": { "enum": ["PASS", "PARTIAL", "FAIL", "BLOCKED", "METADATA"] }, "exitCode": { "type": "integer" },
+        "artifactId": { "type": "string" }, "processArtifactId": { "type": "string" }, "processPointer": { "type": "string", "pattern": "^/" },
+        "nativeFormat": { "enum": ["trx", "junit", "jest", "playwright", "pytest", "unittest", "node-test", null] },
+        "counts": { "$ref": "#/definitions/counts" }, "membershipSha256": { "$ref": "#/definitions/sha" }, "limits": { "type": "string", "minLength": 1 }
+      }
+    },
+    "evidence": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schemaVersion", "workstreamId", "kind", "testedCommit", "verifierCommit", "verifierSourceArtifactId", "sourceManifestArtifactId", "sourceAfterArtifactId", "ordinaryDiscoveryArtifactId", "ordinaryReportIds", "artifacts", "reports", "historicalEvidence", "environment", "notRun", "generatedUtc"],
+      "properties": {
+        "schemaVersion": { "$ref": "#/definitions/commonVersion" }, "workstreamId": { "$ref": "#/definitions/workstream" }, "kind": { "const": "TEST_EVIDENCE" },
+        "testedCommit": { "$ref": "#/definitions/commit" }, "sourceManifestArtifactId": { "type": "string" }, "sourceAfterArtifactId": { "type": "string" },
+        "verifierCommit": { "$ref": "#/definitions/commit" }, "verifierSourceArtifactId": { "type": "string" },
+        "ordinaryDiscoveryArtifactId": { "type": "string" }, "ordinaryReportIds": { "$ref": "#/definitions/strings" },
+        "artifacts": { "type": "array", "minItems": 1, "items": { "$ref": "#/definitions/artifact" } }, "reports": { "type": "array", "minItems": 1, "items": { "$ref": "#/definitions/report" } },
+        "historicalEvidence": { "$ref": "#/definitions/strings" }, "environment": { "$ref": "#/definitions/strings" }, "notRun": { "$ref": "#/definitions/strings" }, "generatedUtc": { "type": "string", "format": "date-time" }
+      }
+    }
+  }
+}
@@ -0,0 +1,19 @@
+# Prioritised owner acceptance
+
+All human rows are **NOT TESTED** until the owner supplies actual evidence through the protected approval mechanism. Do not commit approval tokens/signatures or personal CVs. Use fictional data and http://jobbjakt.local; admin scenarios require an existing Admin account, AI scenarios require consent/entitlement and the workflow's existing CV-text precondition. For revised spacing, use a new CV or explicitly Apply the updated design v2; historical v1 designs remain unchanged. Capture date, exact source/image, device/OS/browser/assistive technology, steps, result and synthetic-only screenshot/PDF where appropriate. Never include passwords, cookies or personal documents.
+
+| ID / priority | Workflow and preconditions | Steps and expected pass criterion | Evidence and gate |
+|---|---|---|---|
+| HUMAN-01 / P0 | CV Builder; blank and seeded fictional Career Profile | Create Blank: no inherited name/contact/photo/summary/job/empty headings. Choose From Career Profile and select sections explicitly; save, refresh and verify only selected facts. Reorder, Undo/Redo, type with native undo, switch documents. Pass if no cross-document or unintended inherited facts and saved content survives refresh | Screen recording plus safe save/readback; blocks affected cleanup acceptance if behavior changes; broad human release gate remains |
+| HUMAN-02 / P0 | Same CV open in two sessions | Save a change in sessionA, then stale sessionB. Pass if B clearly reports conflict, retains draft/recovery and never overwrites A. Exercise failed save/retry; successful UI must correspond to durable reload | Synthetic before/after/version evidence; data-integrity failure blocks development immediately |
+| HUMAN-03 / P0 | Career Profile import with synthetic PDF/DOCX and existing matching job | Upload; observe real stages; compare original/evidence; correct employer/title/date; reject an unsupported field; resolve duplicate conservatively; approve. Refresh profile and open CV Editor/export. Pass if approved facts persist, unapproved/unknown facts stay absent, existing unrelated details/old CVs remain | Source, corrections and final synthetic profile/PDF; actual integrity defects block development; human usability completion remains open |
+| HUMAN-04 / P1 | Physical phone and tablet, each light/dark | CV editor, import source/review switching, templates, jobs and dashboard. Use touch/software keyboard and rotate. Pass if primary actions remain reachable, no clipped content or accidental data loss; dashboard mobile order must not rewrite desktop geometry | Real device names/OS/browser and screenshots; production human/device gate; emulated viewport is not evidence |
+| HUMAN-05 / P1 | Keyboard only, then actual NVDA/VoiceOver (name/version required) | Navigate upload/review, editor dialogs/history, template selection, dashboard drag/resize/show-hide/save and admin filters/details/poll pause. Pass if labels/status announcements/focus order/dialog return work and no keyboard trap occurs | AT observations and failures; production accessibility gate, candidate-specific affected controls must be preserved |
+| HUMAN-06 / P1 | Every CV and matching letter theme, short/dense EN/NB, with/without optional photo | Inspect review package's actual PDF/preview images, then open current app. Check title clearance, section rhythm, font weights/diacritics, bullets, margins/columns, page breaks, footer/sidebar height, missing/clipped text and excessive whitespace. Pass requires recorded decisions per template/case, not blanket approval | Annotated synthetic PDF/screenshots; S01 remains failed until measured correction or explicit criterion disposition; no automatic waiver |
+| HUMAN-07 / P1 | Actual printer; A4 and Letter as supported | Print representative single/sidebar/multipage CV and letter at intended scale; compare PDF preview. Pass if margins, page breaks, typography and all content survive actual printing | Printer/driver/settings and photos of synthetic printouts; production print gate; PDF download is insufficient |
+| HUMAN-08 / P1 | Proficient English and Norwegian Bokmål reviewers | Review jobs, Career Profile/import, CV editor, template/letter labels, dashboard, account/settings and admin/error/progress copy. Pass if terminology, dates, instructions and errors read naturally and preserve meaning | Reviewer language competence and concrete corrections; production linguistic gate. Other locales must not be represented as implemented without catalog/runtime evidence |
+| HUMAN-09 / P1 | Dashboard edit mode and jobs workspace | Drag/resize/show/hide; save/reload, cross-session conflict and narrow viewport; track a fictional job through existing statuses. Pass if widgets/data/filters persist and keyboard alternatives match | Synthetic steps/screenshots; confirmed regression blocks affected cleanup |
+| HUMAN-10 / P1 | Admin and non-admin accounts | Compare submitting owner and linked import/job; filters, stages, duration/failure/event history, pause/reconnect. Attempt non-admin access. Pass if attribution is correct, private source/prompt/result/lease/path data is absent and non-admin is denied | Safe status/authorization observations, never raw sensitive logs; disclosure/auth defect blocks development |
+| HUMAN-11 / P1 | Explicitly consented local generic AI on fictional job/profile | Inspect saved strategy/enrichment and source facts. Pass only the reviewed sample if suggestions are appropriate, no invented candidate proof and structured failures are understandable. Never approve an entire model from one result | Source/output comparison, sample-specific decision; blocks AI quality/activation claims, not unrelated cleanup assessment |
+
+Human aesthetic preferences may be returned as specific revisions. None of these rows grants cleanup entry. Before Phase10 implementation, the owner must approve the **resolved published baseline and exact candidate scope**, with any permitted deferral identified and signed through the separate controller's protected approval flow. The current manifest declares no checkpoint deferrable gates; changing that policy itself requires its signed policy-update process. Do not answer these questions by editing ACCEPTANCE.json.
@@ -0,0 +1,25 @@
+# Exact Phase10 assessment baseline
+
+Application baseline: **5032ccb41514807c8ca3008c24ca6326be1170de**, branch **test/pre-phase10-ux-acceptance**, remote origin `https://git.cesnimda.uk/cesnimda/jobtrackingapp.git`. It contains CV-UX4a0af62, CV-QA4a8c907, A–D3255da9 and the structured-strategy correctioncaa0c6a. All four ancestry checks were rerun successfully in this workstream. Do not base cleanup on main.
+
+The handoff checkpoint8804231be4e7c309a62d9d6e7d07c9ae0809bc3c was normally pushed and independently read back. Later handoff commits must also be published and verified. The **final integration ref is the resolved clean published HEAD containing this package**; obtain its exact hash with Git and bind the protected owner decision to it. A file cannot contain its own Git commit hash. ACCEPTANCE.json therefore distinguishes the frozen tested application baseline, capture-time HEAD/remote observation and required current consumption checks. Documentation-only descendants are bounded to `docs/automation/handoffs/pre-phase10/`; application or existing-test changes invalidate that shortcut and require fresh affected evidence.
+
+The separate controller's final inspected snapshot is140e182516e86c8718054cf0907593fcd6a38aa7, descended from initially inspected c1663df and based on5032ccb. [CONTROLLER_ADDENDUM.md](CONTROLLER_ADDENDUM.md) distinguishes new MXC canary PASS from still-missing actual key/sign-in/runtime activation and test adapter. Its branch is not modified here. The operator must use its existing signed policy-update/configure process to adopt the final approved integration baseline/context artifacts **before real execution**, qualify its current context/test adapter and obtain the required entry approval. Do not edit its policy silently or run another controller. No baseline replacement after started work is authorised by this package.
+
+GJ-00 planning local/remote0ec9f98e6ed4a646fc5e017d8eb6fade07653f37 is separately verified. Relative to5032ccb, the integration and planning branches have18 and2 unique commits respectively. Neither is a safe blind replacement for the other. No merge/cherry-pick was performed. Future authorised integration must reconcile the planning documents against the later accepted application source.
+
+## Preservation contract
+
+Retain all57 original capability groups and their existing56PARTIAL/oneDEFERRED qualification states. Preserve the33 original routes plus `/admin/processing` (34 current source routes), including legacy aliases. Route membership is only a source check, not full behavior acceptance. Keep the original criteria rather than promoting them from new unit/browser results.
+
+Career Profile stays canonical; null-as-inherit overrides, explicit blank flags, per-CV customisation, frozen/submitted packages, letter/application versions, tenant/owner filters, durable operation state, transactional profile application and RD21 expected-version/rollback/retry contracts remain active. Do not reinterpret creation-intent idempotency as proven: the earlier provider observation explicitly records repeated creation bodies as non-idempotent.
+
+Keep design-version1 rendering for existing/historical CVs; v2 is explicit. Keep old-run import review/accept DTOs and routes. Keep SQLite compatibility/migrations pending separately approved retirement; no MariaDB major upgrade. Preserve licensed fonts, unchanged original PDF goldens and all recorded S01 failures. Keep disabled C11/P5-13/model interpretation withheld.
+
+## Scope and compatibility checks
+
+[CLEANUP_INVENTORY.md](CLEANUP_INVENTORY.md) contains concrete current consumers and risks. **No product removal is approved or proven unused.** The safe next activity is candidate assessment and owner review; implementation needs the independent entry decision. Each proposed candidate must name exact symbols/routes/replacement/consumers, old-data and dynamic-reference risks, affected preservation IDs, rollback and focused proof. Then run applicable full backend/frontend/browser/contracts/import/MariaDB/RD21/Python/security/native Windows/Linux PDF/type/lint/build checks with native identities and exits.
+
+The current native/Node/browser producer commands and source/process identities are retained in the portable TEST_EVIDENCE package. Regenerate isolated fixture databases, never target jobtracker_dev or production for destructive testing. Development runtime application commit remainscaa0c6a, which is source-equivalent to the application portions of5032ccb and these documentation-only descendants. It was not replaced merely to change a displayed documentation commit.
+
+Production remains NO-GO; physical-device, human/AT/language/print, affected S01 disposition, real CV semantic quality, hosted CI/runtime isolation, native/image review and production operator qualifications remain separately tracked. None of these histories is deleted or accepted on the owner's behalf.
@@ -0,0 +1,48 @@
+# AUTOMATION-HANDOFF-01 implementation plan
+
+> **For agentic workers:** Use superpowers:executing-plans inline. Steps use checkbox syntax. This plan is execution of the owner's attached specification, not authority to start Phase 10.
+
+**Goal:** Export an independently verifiable, fail-closed pre-Phase-10 evidence package.
+
+**Architecture:** Reuse existing application tests, parser/native runtime, original PDF oracles and preservation owners. Export a proposed versioned evidence contract alongside the separately committed orchestrator contract; never change or run that worktree/controller. Owner approvals remain external and protected.
+
+**Tech Stack:** Existing .NET/React/Python/Playwright/MariaDB fixtures, Node's installed JSON Schema validator, Git and JSON/Markdown.
+
+**Spec:** REQUEST.md, byte-preserved owner request.
+
+## Global constraints
+
+No Phase 10, later feature work, main merge, production operations, destructive database changes, acceptance waivers or approval signatures. Keep jobbjakt.local available. Work only on test/pre-phase10-ux-acceptance; preserve the primary and automation worktrees. Never turn a schema-valid GO into entry authority.
+
+## Review focus
+
+- Old or missing native reports must not become fresh PASS evidence.
+- Source hashes and commit ancestry must bind reports despite documentation-only commits.
+- Failure/skip/retry counts and all 57 preservation criteria remain visible.
+- Missing protected approvals and remote publication must block automatic execution.
+- Historical CV rendering, old import runs, redirects, SQLite and migrations are retain-by-default.
+
+## Checkpoints
+
+- [x] AUTO-H01: capture clean starting source/ancestry/remote/session observations; reconcile original CV-UX/import/QA/RD21/Phase9/Phase10 gates and committed orchestrator policy. Produce capability traceability and authority register.
+- [x] AUTO-H02/H03: investigate unchanged S01 PDF failures using actual synthetic rendered bytes, preserve the original oracle, nominate only confirmed formatting defects; run safe parser/model/security checks with existing immutable artifacts. Prepare labelled visual comparison artifacts. No CV-model activation or semantic PASS by inference.
+- [x] AUTO-H04/H05: produce prioritised owner scenarios with blocking scope; diagnose DNS/TCP/HTTPS/TLS/Git separately, normal-push this branch if reachable, inspect GJ-00 ref without changing it.
+- [x] AUTO-H06: run fresh applicable backend/frontend/browser/Docling/MariaDB/RD21/Python/build/type/lint/security/preservation lanes in isolated fixtures. Capture native commands/exits/reports/test identities/source hashes; retain failures and compare historical counts separately.
+- [x] AUTO-H07: create HANDOFF.md, ACCEPTANCE.json, GATES.json, BLOCKERS.json, TEST_EVIDENCE.json, MANUAL_ACCEPTANCE.md, PHASE10_BASELINE.md, READY_TO_RUN.md, HANDOFF_SCHEMA.json. Add minimal schema/evidence verification and negative tests proving missing/tampered/wrong-source reports or fake owner approvals cannot authorise execution.
+- [x] AUTO-H08: record exact candidate/retain inventory, roadmap stages05–11 and separately tracked initiatives, independent decisions and owner actions. Review whole package, validate, commit, normal-push/read-back if available; otherwise preserve precise publication blocker. Stop. Final publication/cleanliness is resolved dynamically after the containing commit, not self-asserted by a hash inside it.
+
+## Initial rulings
+
+The sole active app-inventory chat using this cwd is this task; the separate active controller chat uses another worktree. A clean starting status and subsequent source freeze detect observed source drift; this is not a filesystem lock or proof against every external writer. No cross-chat message or other-worktree write is authorised.
+
+The existing controller's result/backlog schemas are not acceptance-package schemas. Use a separately versioned **proposed evidence contract**, with explicit mapping to its protected signed entry/deferral/review gates, not a competing executable queue. Do not copy/configure its runtime or fabricate signatures.
+
+The initial commit normalised the copied request's CRLF bytes. Scoped .gitattributes now preserves the original request and hash-indexed package bytes exactly across checkouts; no instruction or acceptance criterion is changed. Native evidence is compressed individually for portable verification rather than relying on ignored files in another worktree.
+
+Existing Phase9 authority allows genuinely unfinished human checks as release debt and individually scoped conditional development; it does not grant broad Phase10 entry or accept unresolved security risks. Exact candidate approval and unused-caller proof remain mandatory. This handoff can be READY as evidence while Phase10 remains BLOCKED.
+
+## Final verification and review
+
+All safely achievable checkpoints completed; completion of the evidence task does not complete the outstanding gates. The final combined18 parser/schema/source/authority/package-negative tests passed and supersede bootstrap7. Native required-readiness exit3 and RTK-wrapper exit1 were independently distinguished. Fresh-context whole-package review found no actionable defects; its scope included source/report/exit binding, approval boundaries, decompression/path limits, temporary-directory cleanup and84 visual ZIP entries matching manifest hashes. The reviewer did not rerun product/production/human tests or grant protected approval. Final publisher must verify clean current HEAD and exact remote equality.
+
+The external controller advanced during this task; CONTROLLER_ADDENDUM.md records the final read-only140e182 snapshot and narrower remaining actual-key/sign-in/context gates. No controller operation occurred here. Updated package text uses LF except existing CRLF files and the exact byte-preserved owner request; compressed native artifacts retain original bytes. No application or pre-existing test source was changed.
@@ -0,0 +1,16 @@
+# Retained failures and recovery
+
+Failed attempts are not deleted, counted as passing tests or hidden by retries.
+
+| Attempt | Actual failure | Correction / boundary |
+|---|---|---|
+| post-01 | Temporary proxy exited before any browser case; immediate port lookup raised KeyError | A separate reproduction retained nginx's exact `mkdir /var/cache/nginx/fastcgi_temp: Read-only file system` error. The one-off fixture omitted FastCGI/uwsgi/scgi paths. post-02 points all temporary paths into the existing bounded `/tmp` mount and checks startup state. Root stays read-only; no application/configuration or test assertion changed |
+| proxy-reproduction-02 | Expected diagnostic exit1 before tests | Exact logs/state and owned-resource cleanup retained; not a product failure or extra test case |
+| post-02 Linux build | The runner incorrectly supplied an output outside `.artifacts/cv-ux-01`; existing helper rejected it before build | linux-post-03 resumes only the unfinished Linux/audit work under a fresh allowed child. The helper guard was preserved; already passing import/MariaDB/Windows lanes were not rerun or double-counted |
+| linux-post-03 collector | Native build and8 Linux browser cases passed; follow-up checker targeted nonexistent `templates` instead of actual `template-library` | linux-pdf-post-04 runs only unfinished PDF/audit checks against the actual corpus. No duplicate Linux browser total or application change |
+| Initial portable export | Raw Playwright JSON with inline screenshots exceeded the verifier's8MiB decompression limit | Original raw files remain untouched. Portable projections remove only inline attachment body strings, retaining all cases/status/errors/retries/counters and a per-body/source/projection hash audit. Visual PDFs/images are separately packaged. The limit stays enforced |
+| Revised S01 oracle | Windows8/36 and Linux16/36 pass; original2mm coordinate threshold unchanged | Remaining28/20 failures are S01-only. Content, name wrapping, sidebar raster and visible-ink diagnostics are distinct evidence. No golden/tolerance change or aesthetic self-approval |
+| Isolated real CV-model probe | All3 synthetic responses rejected with ValueError | No model/validator replacement or activation. Compatibility/semantic accuracy remains BLOCKED; process exit0 means the measurement completed |
+| Initial handoff-validator RED | New tests failed because implementation module was absent | Native parser/hash/approval tests implemented and rerun; final unit/integration results supersede overlapping focused runs, without adding them |
+
+Raw evidence is under `.artifacts/automation-handoff-01/`, with portable native reports/process/source artifacts in TEST_EVIDENCE.json. The original broad regression ran once to completion with all four groups passing and source unchanged; it is not the previous workstream's composite recovery result. Transient provider_unavailable history on the fresh successful strategy operation is retained in the local-worker result; it is not described as first-attempt success.
@@ -0,0 +1,26 @@
+# Ready-to-run conditions
+
+**Phase10 and real autonomous execution remain BLOCKED. This package does not authorise either.** A structurally READY evidence package can truthfully contain a NO-GO entry decision.
+
+Before the separate controller starts anything, its operator must independently:
+
+1. Resolve the final `test/pre-phase10-ux-acceptance` HEAD from Gitea and local Git; require exact equality, clean checkout and ancestry of5032ccb. Do not assume main contains the redesign. The package's localCommit is the frozen application baseline; its snapshotHead/remote observation are dated evidence, not self-referential claims about the later package commit.
+2. Validate HANDOFF_SCHEMA.json and every indexed compressed native report/process/source artifact. Recompute hashes, native counters and identities, reject absent/unexecuted/failing/skipped/retried required cases, and check commit/source/image correspondence. Documentation-only descendants are explicitly bounded; any application/test change requires affected fresh qualification. Package metadata is not its own authority.
+3. Obtain a protected `phase10-development-entry` approval bound to the **resolved final published commit**, exact candidate scope, current policy/prompt and artifact hashes. No approval was supplied to this handoff, and none is generated. A worker-written GO or signed-looking JSON is not approval.
+4. Establish concrete unused caller/route/old-data proof, affected57-group/34-route preservation, rollback and candidate tests before any removal. Current inventory has **no approved removal**. Retain legacy CV design/run behavior, aliases, revision/persistence contracts, SQLite and migrations.
+5. Resolve affected S01/rendering acceptance or obtain an explicit protected applicability decision supported by unchanged original failures and real visual evidence. Do not silently reinterpret a required automated failure as a deferral. Complete applicable human checks; existing release-only debt does not independently forbid unrelated assessment, but also does not grant implementation authority.
+6. Qualify the separate controller's actual owner key, dedicated sign-in and fresh current execution context, then install/approve the real stage composite test adapter. The latest inspected140e182 single-user mode reports69 external Python cases (includes the earlier48),6 signature cases and actual MXC canary PASS; actual owner key/authentication/activation remain missing. Canary PASS and static queue validity do not qualify real roadmap execution. See CONTROLLER_ADDENDUM.md; this workstream did not modify or run it.
+7. Reconcile individual conditional debt with the existing signed policy. Current checkpoint deferrableGates arrays are empty. Any future policy/conditional-deferral requires the controller's protected approval flow and cannot override a mandatory automated requirement. Keep hosted CI BLOCKED until actual isolated execution and cleanup proof; keep CV AI disabled and production NO-GO.
+
+Local package checks:
+
+```powershell
+rtk proxy node --test docs/automation/handoffs/pre-phase10/verify.test.mjs docs/automation/handoffs/pre-phase10/package.test.mjs
+rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs
+rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs --verify-remote
+rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs --require-ready
+```
+
+Normal validation exit0 means evidence integrity is consistent; it prints Phase10 BLOCKED. `--require-ready` deliberately produces native Node exit3 for this unapproved snapshot (the installed RTK wrapper maps nonzero child exits to1). This verifier does not run tests, launch a queue, validate/issue owner signatures or modify the controller. The controller must perform its own protected checks and fresh candidate verification. If it lacks these capabilities, stop rather than trusting a repository status.
+
+No protected owner key/token, credentials, model cache or production endpoint belongs in this package. The separate worktree was inspected through committed Git objects only. No second orchestrator, scheduled automation, main merge, deployment or Phase10 implementation was started.
@@ -0,0 +1,22 @@
+# Reproducing and consuming this evidence
+
+Start in a clean checkout of the **resolved published** `test/pre-phase10-ux-acceptance` branch, containing5032ccb. Do not reset another worktree or assume main contains the application baseline. Use repository-supported tools and isolated fixtures; no production database, service, model cache or credentials are needed.
+
+```powershell
+rtk proxy git status --short
+rtk proxy git rev-parse HEAD
+rtk proxy git merge-base --is-ancestor 5032ccb41514807c8ca3008c24ca6326be1170de HEAD
+rtk proxy node --test docs/automation/handoffs/pre-phase10/verify.test.mjs docs/automation/handoffs/pre-phase10/package.test.mjs
+rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs --verify-remote
+rtk proxy node docs/automation/handoffs/pre-phase10/verify.mjs --require-ready
+```
+
+The final command must fail closed and report BLOCKED/eligible:false. The native Node exit is3; the installed RTK wrapper maps that child failure to shell exit1. Both were observed separately. Normal validation exit0 confirms internal evidence consistency only. Run the installed frontend dependencies' Ajv validator through the existing module; do not fetch dependencies or unapproved runtime artifacts implicitly. Node24.19.0, .NET SDK9.0.317, Python3.12.10 and Docker29.7.2 were observed. Absolute native report paths are producer metadata; compressed artifact paths resolve relative to this directory.
+
+The four primary structured files ACCEPTANCE/GATES/BLOCKERS/TEST_EVIDENCE validate against HANDOFF_SCHEMA draft7. The verifier checks each compressed artifact SHA/size, bounded decompression, native test counters and membership, exit-code process pointer, commit binding, source-before/after equality and current tracked source scope, ordinary discovery coverage, verifier code committed identity and protected decision invariants. Portable Playwright projections externalize **only** inline attachment body strings; an indexed audit retains original report SHA/path and each omitted body's SHA/length. Case/status/error/retry/stat data is retained. Original raw reports remain unchanged under the producer artifact root. These projections and review JPEGs must not be described as byte-identical originals or used to waive a policy requiring the original attachment payloads.
+
+For fresh application execution, inspect the exact process artifact referenced by each report, including argv, timestamps, exit and executedFromCommit. The one-off bounded producer scripts are also indexed; they are QA records, not a new roadmap executor. Restore the same immutable fixture/image inputs and use a **new** allowed output directory. Do not blindly replay destructive setup, reuse a previous run's paths or accept stored PASS as a new run. Relevant repository lanes include backend `dotnet test`, UI `npm test -- --watchAll=false --runInBand`, `npm run typecheck`, lint/build, four ordinary Playwright shards with `--retries=0`, isolated import/MariaDB and native Linux renderer helpers, and Python offline/real-Docling suites. The process records carry exact filters/configuration rather than an approximate command assembled from historical totals.
+
+Source-binding excludes only the new handoff package; any change in the indexed application/test/helper/previous acceptance scope fails validation until affected evidence is rerun and reviewed. Its frozen baseline is5032ccb; `executedFromCommit` preserves the actual later documentation-only execution commit. The verifier has its own immutable verifierCommit/source map. A later documentation commit does not pretend the earlier tests executed at that future hash. Actual final Git cleanliness/publication must be checked at consumption and bound into any protected approval.
+
+Do not add bootstrap unit7 to final combined validator totals, repeated Python console97 to native JUnit97, or the Linux eight browser cases to each PDF recovery attempt. Native document measurement totals are not test-case totals. See QUALIFICATION_FAILURES.md before interpreting intermediate exit1 records. Source manifests and artifact hashes establish correspondence and detect accidental drift; they are **not cryptographic owner attestation** and cannot defeat a malicious writer who controls every evidence file. The independent protected controller must retain its own trust roots, report generation/review and approval process.
@@ -0,0 +1,909 @@
+# Jobjakt — AUTOMATION-HANDOFF-01
+## Finish Pre-Phase-10 Acceptance and Prepare for Autonomous Roadmap Execution
+
+### Your role
+
+Act as Jobjakt's senior QA engineer, release engineer, software architect, Git integration specialist and autonomous-development handoff coordinator.
+
+Your task is to complete the remaining safely achievable Pre-Phase-10 acceptance work and prepare a reliable, machine-readable handoff for the separate AUTONOMOUS-ROADMAP-01 Codex orchestrator.
+
+**Do not begin Phase 10.**
+
+Your objective is to leave the development repository in a verified, clean, reproducible state from which an independently authorised automation system can safely begin Phase 10 and eventually continue through the remaining roadmap.
+
+Work autonomously through normal development, testing, remediation, documentation and feature-branch publication.
+
+Only interrupt me when genuine human approval, manual testing or external infrastructure action is needed.
+
+---
+
+# 1. Starting baseline
+
+Latest reported development environment:
+
+Local URL:
+`http://jobbjakt.local/`
+
+Branch:
+`test/pre-phase10-ux-acceptance`
+
+Latest reported commit:
+`5032ccb`
+
+Reported status:
+
+- Working tree clean.
+- Backend: 1,448 tests passed.
+- Frontend: 1,031 tests passed.
+- Python: 83 tests passed.
+- Real MariaDB: 90 tests passed.
+- Ordinary browser regression: 380 tests passed.
+- Real CV extraction verified.
+- Queued AI strategy generation verified.
+- Scheduled job enrichment verified.
+- Conflicting JSON instructions in the strategy route corrected.
+- Synthetic accounts and temporary test containers cleaned up.
+- Two local commits remain unpublished because Git server connectivity failed.
+- Production remains NO-GO.
+- No merge or deployment occurred.
+
+Outstanding qualifications include:
+
+- CV AI extraction and semantic accuracy.
+- Human accessibility testing.
+- Physical-device testing.
+- Human language review.
+- PDF template spacing and visual qualification.
+- Historical Phase 9, Python dependency and CI requirements where still applicable.
+- Existing production-only infrastructure and recovery gates.
+
+Read the actual current evidence before relying on this summary.
+
+Primary documentation:
+
+`docs/pre-phase10-ux/ACCEPTANCE.md`
+
+`docs/pre-phase10-ux/CV_QA_HANDOFF.md`
+
+Also inspect the authoritative CV-UX, CV-IMPORT, CV-QA, RD21, Phase 9, Phase 10 and preservation documentation.
+
+Verify which reported checks are actually complete, which were conditionally accepted and which remain outstanding.
+
+Do not invent evidence for missing results.
+
+---
+
+# 2. Relationship to the automation orchestrator
+
+A separate workstream named:
+
+`AUTONOMOUS-ROADMAP-01`
+
+is responsible for building a persistent Windows-compatible Codex orchestrator.
+
+That orchestrator will eventually process the approved roadmap:
+
+05 — Phase 10 cleanup.
+
+06 — PRODUCT-REVIEW-01.
+
+07 — INT-GLOBAL-JOBS-01.
+
+08 — I18N-01 translations.
+
+09 — LAUNCH-SITE-01 homepage redesign.
+
+10 — SECURITY-AUDIT-01.
+
+11 — RELEASE-READINESS-01.
+
+Your responsibility is **not** to implement or run this orchestrator.
+
+Your responsibility is to make the current repository and its acceptance evidence suitable for the orchestrator to consume.
+
+You must provide:
+
+- An authoritative accepted development baseline.
+- A complete pre-Phase-10 blocker register.
+- Structured acceptance evidence.
+- Stage dependency and gate definitions.
+- Explicit deferrals and reasons.
+- Human approval requirements.
+- Git branch and remote state.
+- Reproducible verification commands.
+- An exact Phase 10 handoff.
+
+Coordinate through documented contracts, not by modifying the other worktree or running a second orchestrator.
+
+---
+
+# 3. Git and worktree safety
+
+Stay on the currently authorised Pre-Phase-10 development branch, or the verified equivalent worktree containing its complete history.
+
+Before making changes:
+
+1. Verify Git status.
+2. Verify current HEAD.
+3. Verify ancestry of commit `5032ccb`.
+4. Inspect pending local commits.
+5. Identify the configured Gitea remote.
+6. Confirm the worktree is not being modified by another Codex session.
+7. Determine which branch contains the latest accepted integration history.
+
+Do not assume `main` includes the redesign.
+
+Do not reset, rebase destructively, cherry-pick blindly or force-push.
+
+Do not alter the separate automation worktree.
+
+Do not merge into `main`.
+
+Do not deploy production.
+
+If new commits are required, keep them on the authorised pre-Phase-10 branch and document their hashes.
+
+---
+
+# 4. P10-HANDOFF-00 — Comprehensive acceptance reconciliation
+
+Begin with a complete review of the existing acceptance evidence.
+
+Determine whether the currently reported implementation genuinely satisfies the mandatory development requirements.
+
+Investigate:
+
+### CV Builder
+
+- Creating a completely blank CV with zero unwanted content sections.
+- Creating a CV from Career Profile.
+- Undo/redo across supported editor operations.
+- Save, refresh and recovery.
+- Multiple-session editing.
+- Existing CV compatibility.
+- Historical document preservation.
+
+### CV templates
+
+- Existing template spacing.
+- New template library.
+- Optional-photo templates.
+- Font consistency.
+- Page margins.
+- Section spacing.
+- Bullet indentation.
+- Multi-page layout.
+- PDF preview/export agreement.
+
+### CV import
+
+- Real PDF extraction.
+- Real DOCX extraction.
+- Career Profile mapping.
+- New-record creation.
+- Review and corrections.
+- Duplicate handling.
+- Transactional MariaDB persistence.
+- Failure recovery.
+- Source provenance.
+
+### Dashboard
+
+- Widget drag-and-drop.
+- Resizing.
+- Show/hide controls.
+- Layout persistence.
+- Mobile behaviour.
+- Keyboard accessibility.
+- Existing preference compatibility.
+
+### Admin Processing Monitor
+
+- Job attribution to the submitting user.
+- Related job application or import record.
+- Processing stage.
+- Status and duration.
+- Failure diagnostics.
+- Sanitised event logs.
+- Administrative authorisation.
+- Tenant isolation.
+- Log redaction.
+
+### AI workflows
+
+- CV extraction.
+- Queued AI strategy generation.
+- Scheduled job enrichment.
+- Safe structured outputs.
+- Processing failure handling.
+- Disabled/unqualified AI functionality.
+- Model compatibility and semantic qualification requirements.
+
+### Application preservation
+
+- Existing routes.
+- Authentication.
+- Career Profile.
+- Jobs and applications.
+- CVs.
+- Cover letters.
+- Dashboard.
+- Settings.
+- Administration.
+- English/Norwegian.
+- Existing functionality-preservation contracts.
+
+Use actual repository implementation and evidence.
+
+Create a traceability matrix mapping each required capability to its test evidence and acceptance status.
+
+Do not claim that an untested feature passed merely because its implementation exists.
+
+---
+
+# 5. P10-HANDOFF-01 — Fix remaining bounded defects
+
+Investigate the remaining pre-Phase-10 defects.
+
+Prioritise:
+
+1. User-data loss or corruption.
+2. Broken Career Profile persistence.
+3. Import approval failures.
+4. Missing-record creation.
+5. Undo/redo defects.
+6. Incorrect blank CV behaviour.
+7. Broken template spacing or clipping.
+8. Missing PDF content.
+9. Admin authorisation or sensitive-log exposure.
+10. Broken dashboard persistence.
+11. Confirmed regressions in existing workflows.
+
+Fix reproducible defects that are within the current acceptance scope.
+
+For each fix:
+
+- Record the reproduction.
+- Identify the root cause.
+- Implement the smallest maintainable correction.
+- Add regression tests.
+- Run targeted verification.
+- Update the acceptance matrix.
+
+Do not begin unrelated product features.
+
+Do not redesign major parts of Jobjakt unnecessarily.
+
+If a requested change is genuinely outside the existing acceptance scope, record it as a separate backlog item rather than silently expanding Phase 10.
+
+Do not change acceptance criteria solely to obtain a PASS.
+
+---
+
+# 6. P10-HANDOFF-02 — PDF spacing and document qualification
+
+The remaining PDF spacing review requires particular attention.
+
+The original PDF fidelity fixtures previously passed on Windows and Linux, but this does not automatically establish that every template has excellent spacing.
+
+Perform a dedicated visual and functional audit of the current CV template library.
+
+Render representative synthetic CVs using every available template.
+
+Include:
+
+- Short CV.
+- Long CV.
+- Multiple employers.
+- Dense education.
+- Long skill lists.
+- Several languages.
+- Norwegian characters.
+- Optional profile photographs.
+- Multi-page content.
+- Cover letters where applicable.
+
+Check:
+
+- Section spacing.
+- Line height.
+- Paragraph rhythm.
+- Headers.
+- Margins.
+- List indentation.
+- Column alignment.
+- Page breaks.
+- Font weights.
+- Text clipping.
+- Missing content.
+- Excessive whitespace.
+- Preview/PDF differences.
+
+Generate actual rendered preview images or PDFs for inspection.
+
+Fix measurable formatting defects.
+
+Create a visual comparison package for owner review where aesthetic approval is necessary.
+
+Retain historical document compatibility and existing licensed-font arrangements.
+
+Do not modify golden fixtures merely to conceal regressions.
+
+Distinguish:
+
+- Automated PDF fidelity: PASS/FAIL.
+- Semantic content completeness: PASS/FAIL.
+- Visual spacing qualification: PASS/PARTIAL/FAIL.
+- Human print approval: PASS/NOT TESTED.
+
+If human visual or printing acceptance is required by the authoritative Phase 10 entry criteria, prepare the relevant review artifacts and keep that gate pending until I approve them.
+
+---
+
+# 7. P10-HANDOFF-03 — Real AI and security qualification
+
+Review the actual current AI architecture.
+
+The latest report states real CV extraction, queued AI strategy generation and scheduled enrichment have been verified.
+
+Determine precisely what was exercised.
+
+Distinguish:
+
+- Real Docling parsing.
+- Deterministic extraction.
+- Model-assisted processing.
+- Queued task execution.
+- Structured-output validation.
+- Real model inference.
+- Semantic correctness.
+- User-reviewed final output.
+- Source-grounded accuracy.
+
+Do not interpret a successful AI request or completed background job as proof of good AI output.
+
+Inspect the existing model qualification and Python dependency security evidence.
+
+Determine which checks can safely run in the isolated development environment.
+
+If approved model artifacts and safe runtime conditions exist, conduct authorised targeted model evaluations.
+
+Otherwise preserve the relevant qualification as BLOCKED or NOT TESTED.
+
+Do not download large models to production.
+
+Do not change live Ollama services or model caches.
+
+Do not accept security risks on my behalf.
+
+If optional AI functionality is disabled, isolated and not required for Phase 10 code cleanup, document whether its remaining qualification can legally and technically be deferred under the existing acceptance criteria.
+
+Do not falsely mark AI production-ready.
+
+---
+
+# 8. P10-HANDOFF-04 — Human and manual acceptance
+
+Prepare a prioritised owner-test package.
+
+Include:
+
+- What to test.
+- Why it matters.
+- Exact page or workflow.
+- Preconditions.
+- Test steps.
+- Expected behaviour.
+- Pass/fail criteria.
+- Evidence to capture.
+- Whether the test blocks Phase 10 or production only.
+
+Cover:
+
+- Real mobile/tablet.
+- Keyboard-only usage.
+- Screen reader.
+- English copy.
+- Norwegian Bokmål copy.
+- Other implemented languages.
+- CV editor usability.
+- Template visual approval.
+- PDF printing.
+- Job tracking.
+- Dashboard layout.
+- Admin diagnostics.
+- AI-generated content review where enabled.
+
+Complete checks that can genuinely be performed automatically.
+
+Do not fabricate physical-device, human language, screen-reader or printing test results.
+
+Where a mandatory human decision is needed, flag it clearly.
+
+Prefer a small, well-prioritised owner checklist over a large unstructured testing document.
+
+---
+
+# 9. P10-HANDOFF-05 — Resolve Git publication
+
+Two local commits were reported to be awaiting publication.
+
+Diagnose the Gitea connectivity issue safely.
+
+Verify:
+
+- Remote URL.
+- DNS.
+- Network reachability.
+- HTTPS connectivity.
+- TLS validation.
+- Git authentication, if reached.
+- Local/remote branch divergence.
+
+If the remote becomes available, perform a normal push of the authorised development branch.
+
+Verify remote HEAD equals the intended local commit.
+
+Do not force-push.
+
+Do not disable TLS verification.
+
+Do not expose tokens or credentials.
+
+If connectivity remains unavailable:
+
+- Preserve all local commits.
+- Record precise diagnostics.
+- Mark Git publication BLOCKED.
+- Provide exact operator actions.
+- Do not declare the remote branch published.
+
+A pending or failed push must be represented accurately in the automation handoff.
+
+Do not let the orchestrator silently assume that a local commit exists remotely.
+
+Also inspect the separately completed GJ-00 planning branch's publication status without merging or modifying it.
+
+---
+
+# 10. P10-HANDOFF-06 — Full regression baseline
+
+After bounded remediation, run the applicable regression suites.
+
+Include:
+
+- .NET backend.
+- React frontend.
+- Ordinary browser.
+- CV import browser journeys.
+- Real MariaDB integration.
+- RD21 concurrency and recovery.
+- Python sidecar.
+- Document extraction.
+- Queued processing.
+- Scheduled job enrichment.
+- CV Editor.
+- PDF fidelity.
+- Dashboard customisation.
+- Admin processing monitor.
+- Browser contracts.
+- TypeScript.
+- Lint.
+- Builds.
+- Security scans.
+- Existing functionality preservation.
+
+Use approved isolated environments.
+
+Record:
+
+- Commands.
+- Exit codes.
+- Environment details.
+- Passed/failed/skipped counts.
+- Test report paths.
+- Final commit.
+- Relevant test artifacts.
+- Any checks not run.
+
+Do not treat previously reported counts as newly executed evidence.
+
+Never weaken tests merely to achieve a green result.
+
+Ensure generated test reports are attributable to the specific tested commit.
+
+---
+
+# 11. P10-HANDOFF-07 — Define precise Phase 10 entry gates
+
+This is the most important orchestration requirement.
+
+Review the authoritative Phase 10 entry criteria.
+
+Separate all outstanding work into:
+
+### A. Mandatory Phase 10 blockers
+
+Issues that must be resolved before code cleanup can safely begin.
+
+### B. Permissible conditional-development deferrals
+
+Items that may remain outstanding during Phase 10 only where an existing approved acceptance rule permits it.
+
+### C. Production release blockers
+
+Issues that can be addressed later without invalidating Phase 10 development.
+
+### D. Future feature work
+
+Items belonging to the post-Phase-10 product roadmap.
+
+For every item include:
+
+- Stable ID.
+- Description.
+- Evidence.
+- Severity.
+- Relevant acceptance criterion.
+- Required action.
+- Blocking phase.
+- Responsible party.
+- Deferral authority, if any.
+- Current status.
+
+Do not infer that an item is deferrable simply because it is inconvenient.
+
+If a requirement is ambiguous or a conditional entry needs owner judgement, request approval rather than inventing permission.
+
+Do not require every production-only infrastructure issue to be resolved before non-production Phase 10 work unless the authoritative criteria actually require it.
+
+Likewise, do not advance with unresolved mandatory development-entry blockers.
+
+---
+
+# 12. P10-HANDOFF-08 — Machine-readable orchestration contract
+
+Produce structured artifacts for the AUTONOMOUS-ROADMAP-01 orchestrator.
+
+Place handoff documentation under:
+
+`docs/automation/handoffs/pre-phase10/`
+
+Use repository conventions where appropriate.
+
+Required artifacts:
+
+### `HANDOFF.md`
+
+Human-readable overview of the current accepted state and readiness.
+
+### `ACCEPTANCE.json`
+
+Machine-readable status.
+
+Include:
+
+- Schema version.
+- Workstream ID.
+- Source branch.
+- Local commit.
+- Verified remote commit, if available.
+- Worktree cleanliness.
+- Acceptance status.
+- Entry-gate status.
+- Test evidence references.
+- Unresolved blocker IDs.
+- Permissible deferrals.
+- Required owner approvals.
+- Generation timestamp.
+- Recommendation for Phase 10.
+
+### `GATES.json`
+
+Define stage-specific gate requirements, including:
+
+- Required predecessor.
+- Required test suites.
+- Minimum acceptable evidence.
+- Required Git state.
+- Required preservation checks.
+- Required manual approvals.
+- Permissible conditional deferrals.
+- Blocking findings.
+
+### `BLOCKERS.json`
+
+Structured unresolved-issue register.
+
+### `TEST_EVIDENCE.json`
+
+Index machine-verifiable test results and report artifacts.
+
+Include commit binding and actual process exit codes.
+
+### `MANUAL_ACCEPTANCE.md`
+
+Prioritised human test and approval checklist.
+
+### `PHASE10_BASELINE.md`
+
+Exact branch and commit ancestry, preservation scope, safe cleanup targets and required compatibility checks.
+
+### `READY_TO_RUN.md`
+
+Exact conditions required to start automated Phase 10.
+
+### `HANDOFF_SCHEMA.json`
+
+JSON Schema for the exported acceptance package.
+
+Validate all structured JSON.
+
+Use stable keys and explicit status enums.
+
+Do not include secrets, personal data or machine-specific credentials.
+
+Absolute local paths may be included as informational references, but prefer repository-relative paths for portable automation.
+
+---
+
+# 13. Critical acceptance-security rule
+
+The handoff package is evidence, not authority by itself.
+
+A Codex-generated `ACCEPTANCE.json` must not be able to bypass a gate simply by claiming:
+
+`"status": "GO"`
+
+The orchestrator must independently verify:
+
+- Required report existence.
+- Test exit codes.
+- Commit correspondence.
+- Remote publication.
+- Accepted predecessor stages.
+- Mandatory blocker status.
+- Applicable owner approvals.
+
+Owner approvals must be maintained outside the model-writable repository or through another protected approval mechanism.
+
+Do not generate approval tokens or owner signatures.
+
+Do not mark human acceptance PASS without actual approval evidence.
+
+If the external orchestrator already defines an acceptance schema, conform to it where compatible rather than creating a conflicting parallel standard.
+
+If it is still under development, produce a clearly versioned proposed contract and document the integration requirements.
+
+---
+
+# 14. P10-HANDOFF-09 — Phase 10 cleanup inventory
+
+Prepare the scope for the actual Phase 10 task.
+
+Identify proven superseded components and code.
+
+Include:
+
+- Legacy CV Editor components.
+- Old CV import components.
+- Replaced dashboard layout configuration.
+- Superseded admin-processing views.
+- Unused style utilities.
+- Duplicate services.
+- Unreferenced frontend routes.
+- Obsolete feature flags.
+- Potentially unused dependencies.
+- Historical compatibility components that must remain.
+- Database code with active compatibility requirements.
+
+For every proposed removal include:
+
+- Location.
+- Why it appears obsolete.
+- Evidence of actual replacement.
+- Current consumers.
+- Dynamic/runtime reference risks.
+- Related preservation group.
+- Required regression test.
+- Removal risk.
+
+Do not remove these items as part of the handoff.
+
+Do not delete old PDF renderers, document mappings or migrations solely because newer implementations exist.
+
+Do not retire SQLite automatically.
+
+Do not perform MariaDB major-version upgrades.
+
+Phase 10 will make removal decisions using this evidence.
+
+---
+
+# 15. P10-HANDOFF-10 — Reconcile the remaining roadmap
+
+The automation queue after Phase 10 is intended to contain:
+
+05 — Phase 10 final redesign cleanup.
+
+06 — PRODUCT-REVIEW-01 full application review.
+
+07 — INT-GLOBAL-JOBS-01 international, cross-industry job discovery.
+
+08 — I18N-01 expanded translations and locale qualification.
+
+09 — LAUNCH-SITE-01 multilingual homepage redesign.
+
+10 — SECURITY-AUDIT-01 adversarial audit and remediation.
+
+11 — RELEASE-READINESS-01 production qualification.
+
+Also preserve separate tracked initiatives:
+
+- Deferred P5-13 AI qualification and model assessment.
+- LinkedIn integration feasibility.
+- Android application.
+- SQLite retirement.
+- MariaDB upgrade strategy.
+- Monitoring and operational improvements.
+- Future country integrations.
+
+These initiatives must not be silently discarded simply because they aren't numbered 05–11.
+
+Highlight the dependencies:
+
+- Global Job Search depends on approved planning and provider permissions.
+- Internationalisation overlaps with Global Job Search and homepage work.
+- Product Review requires owner approval before starting its resulting implementation scope.
+- Homepage final visual design requires owner approval.
+- Production requires independent security, backup, recovery and release approval.
+
+Create an automation-friendly roadmap summary without starting any later workstream.
+
+---
+
+# 16. Autonomous execution checkpoints
+
+Execute safely in this order:
+
+### AUTO-H01 — Baseline and acceptance reconciliation
+Read the reports, verify actual Git state and establish existing evidence.
+
+### AUTO-H02 — Targeted defect remediation
+Fix bounded confirmed pre-Phase-10 defects.
+
+### AUTO-H03 — PDF and AI qualification
+Complete permitted verification and document remaining blocked items.
+
+### AUTO-H04 — Manual acceptance preparation
+Produce focused human test packages and record genuine approvals.
+
+### AUTO-H05 — Git publication recovery
+Publish pending development commits if the remote is available.
+
+### AUTO-H06 — Full regression
+Establish commit-bound verification evidence.
+
+### AUTO-H07 — Structured automation handoff
+Produce and validate schemas, gates, blocker registers and evidence manifests.
+
+### AUTO-H08 — Phase 10 readiness
+Determine the actual acceptance decision and exact automation prerequisites.
+
+Commit and push validated checkpoints.
+
+If the remote is unavailable, continue safe independent work and preserve commits locally.
+
+Do not claim remote publication when it is unverified.
+
+---
+
+# 17. Required final decisions
+
+Issue independent verdicts for:
+
+**Pre-Phase-10 UX:** GO / CONDITIONAL GO / NO-GO.
+
+**CV Integration:** GO / CONDITIONAL GO / NO-GO.
+
+**PDF Spacing:** PASS / PARTIAL / FAIL.
+
+**CV AI Accuracy:** PASS / PARTIAL / BLOCKED.
+
+**Human/Device Acceptance:** PASS / PARTIAL / NOT TESTED.
+
+**Python Security:** PASS / CONDITIONAL / BLOCKED.
+
+**Hosted CI:** PASS / BLOCKED / FAIL.
+
+**Preservation:** PASS / PARTIAL / FAIL.
+
+**Git Publication:** VERIFIED / BLOCKED.
+
+**Phase 10 Development Readiness:** GO / CONDITIONAL GO / NO-GO.
+
+**Automation Handoff Package:** READY / INCOMPLETE.
+
+**Production:** GO / NO-GO.
+
+Every verdict must cite actual supporting evidence.
+
+Distinguish implementation completion from acceptance, deployment and release readiness.
+
+---
+
+# 18. Final report
+
+At completion, report:
+
+1. Current branch and final commit.
+2. Working-tree status.
+3. Remote publication state.
+4. Defects fixed.
+5. Tests executed and actual totals.
+6. Outstanding mandatory blockers.
+7. Permitted deferrals.
+8. Human actions required.
+9. Automation handoff artifacts created.
+10. Acceptance schema validation result.
+11. Phase 10 entry decision.
+12. Exact integration baseline for the orchestrator.
+13. Whether the orchestrator may start automatically.
+14. What it must verify independently before doing so.
+
+If Phase 10 receives an authoritative GO or approved CONDITIONAL GO, mark the handoff eligible for orchestration.
+
+However, **do not actually begin Phase 10**.
+
+If required conditions remain outstanding, mark the stage BLOCKED and state exactly how it can become READY.
+
+---
+
+# 19. Hard restrictions
+
+Do not:
+
+- Merge into `main`.
+- Deploy production.
+- Start Phase 10.
+- Start Global Job Search.
+- Start the Product Review.
+- Modify the separate automation worktree.
+- Fabricate owner approval.
+- Self-approve acceptance exceptions.
+- Bypass Python security qualifications.
+- Modify live Ollama.
+- Download unapproved production models.
+- Change production MariaDB.
+- Perform destructive database migrations.
+- Modify production Docker services.
+- Modify or repair production filesystems.
+- Remove compatibility code prematurely.
+- Lower test requirements to achieve a GO.
+
+Do not introduce unnecessary changes that disrupt the locally running `jobbjakt.local` environment.
+
+If a test requires destructive operations, use a disposable database or isolated test environment.
+
+---
+
+# FINAL INSTRUCTION
+
+Starting from the real current Pre-Phase-10 acceptance state, complete all safely achievable outstanding acceptance and remediation work.
+
+Restore Git publication where possible.
+
+Prepare a **machine-readable, independently verifiable Phase 10 handoff** suitable for AUTONOMOUS-ROADMAP-01.
+
+Make the handoff robust enough that the orchestrator can identify:
+
+- What has passed.
+- What is blocked.
+- What may be deferred.
+- Which human approvals are required.
+- Which exact commit forms the accepted baseline.
+- Whether Phase 10 may begin.
+
+Work autonomously, commit and push validated checkpoints, and prepare all necessary documentation.
+
+**STOP after the final handoff report. Do not start Phase 10, merge into main or deploy production.**
@@ -0,0 +1,17 @@
+# Roadmap contract projection
+
+Read from committed codex/autonomous-roadmap-01 policy only. This projection is not a second queue, does not configure execution and does not authorise any stage. The external controller must reconcile its immutable manifest with the final published handoff commit and obtain protected approvals. All current deferrableGates arrays are empty; a conditional status alone cannot advance.
+
+| Sequence / stage | Required predecessor | Additional authority before implementation/advancement |
+|---|---|---|
+|05 PHASE-10 | Finished pre-Phase10 evidence and exact published baseline | phase10-development-entry; exact unused candidate/consumer/inventory/rollback proof; qualified native sandbox and actual stage test adapter; signed stage-requirements-review. No cleanup started here |
+|06 PRODUCT-REVIEW-01 | Accepted Phase10 | Independent review/ranked proposals, then product-ranked-scope approval before resulting implementation scope |
+|07 INT-GLOBAL-JOBS-01 | Accepted Product Review, reviewed GJ-00 planning | global-jobs-implementation, product-ranked-scope; provider-licences-and-display-rights before provider checkpoint. Never infer scraping/content rights from technical reachability |
+|08 I18N-01 | Accepted Global Jobs | i18n-scope and later human-linguistic-and-market-qualification; coordinate locale/geography/taxonomy and marketing catalogs. Drafts do not enable public locales |
+|09 LAUNCH-SITE-01 | Accepted I18N | Four actual design concepts/research, owner homepage-design-selection before implementation, preserved revision feedback; no model-selected final design |
+|10 SECURITY-AUDIT-01 | Accepted homepage | security-test-environment-and-scope, isolated-adversarial-targets, significant scanner cost approval where applicable, material-security-findings-disposition and stage review |
+|11 RELEASE-READINESS-01 | Accepted security audit | Independent backup/restore/recovery/deployed/security/provider/manual evidence, release-evidence-review and stage review. Recommendation only; this queue has no main merge/deploy stage |
+
+Separately retained initiatives: P5-13/C11 deferred AI model assessment and semantic qualification; LinkedIn feasibility; Android application; staged SQLite retirement; MariaDB upgrade strategy; monitoring/operational improvement; future country integrations. These are tracked future work, not silently completed, deleted or smuggled into cleanup. No MariaDB major upgrade or SQLite retirement is authorised here.
+
+GJ-00 branch planning/int-global-jobs-00 is independently published at0ec9f98e6ed4a646fc5e017d8eb6fade07653f37; it diverges from the later pre-Phase10 integration history. Do not blindly cherry-pick/merge its planning commit. Future authorised integration must reconcile its documents against the accepted current development source and provider evidence freshness, preserving every completed workstream.
@@ -0,0 +1,42 @@
+# Capability-to-evidence traceability
+
+Fresh source baseline: **5032ccb41514807c8ca3008c24ca6326be1170de**. Report IDs below resolve through TEST_EVIDENCE.json to native reports, actual process exits, test identities and source hashes. PASS means the finite automated behavior exercised, not blanket feature, semantic, human or production acceptance. No application source or existing test was changed for this handoff.
+
+| Required capability | Current owner / actual tests | Fresh report IDs | Decision and limits |
+|---|---|---|---|
+| Completely blank CV, zero unwanted sections | CvBuilderEditor; `e2e/pre-p10-cv-editor.spec.ts`; CvBlankPersistenceTests | ordinary-1/2/3/4, backend, mariadb-provider | Automated PASS; actual blank durable save exercised |
+| Create from Career Profile, section selection | CvBuilderEditor/CareerProfileMapper; pre-p10 editor and cv-section-scope specs | ordinary shards, backend, frontend | Automated PASS; profile remains canonical; explicit supported selections |
+| Undo/redo across supported operations | editor history; pre-p10 editor spec and frontend tests | ordinary shards, frontend | Automated PASS for bounded document operations; not undo of every remote side effect |
+| Save, refresh, lost response and recovery | ApplicationAssetsService/version tokens; provider and RD21 suites | mariadb-provider, mariadb-browser, rd21, rd21-volume | Automated PASS; success requires read-back/durable write |
+| Multiple-session editing, stale writes | existing revision contract; MariaDB concurrency suites | mariadb-provider, rd21, preferences | Automated PASS for conflicts/no lost update; not simultaneous human usability approval |
+| Existing CVs, frozen revisions, job variants and submitted packages | ApplicationAssetsService; original renderer; documents-contract/cv-library specs | backend, ordinary shards, original PDF artifacts | Automated finite PASS; no old-data rewrite; preservation overall remains PARTIAL |
+| Nine-template library and actual previews | CvTemplateGallery/Thumbnail; actual sandboxed HTML samples, explicit Apply | frontend, ordinary shards, windows/linux-browser | Automated PASS; aesthetics PARTIAL |
+| Existing/new title and section spacing | CvTheme/ThemedCvRenderer design versions | windows/linux-template-oracle, -name-ink | PARTIAL: unchanged S01 failures; never waived by ink diagnostic |
+| Optional photos, crop and theme persistence | editor/photo/theme owners; revised corpus | frontend, ordinary shards, template measurements | Automated finite PASS with synthetic geometric photo; human photo/layout review open |
+| Font consistency/weights, margins, headings, bullets/columns/page breaks | licensed bundled fonts/shared physical renderer; original and revised oracles | original PDF artifacts; template-completeness/-name-wrap/-sidebar | Content/bounds PASS; coordinate fidelity FAIL; visual rhythm/whitespace PARTIAL |
+| Multi-page and long names/skills/education, Norwegian characters | four revised fixture profiles and matching letters | template-completeness; matching-letter proofs | 36 CVs/122 pages and18 letters/38 pages per platform; automated finite PASS, physical printing NOT TESTED |
+| Real PDF and DOCX conversion | bounded Python Docling; import-tests/cv-import-docling.spec.ts; Python document tests | docling-import, python-docling | Automated PASS for supported text PDF/DOCX fixtures; scanned/OCR/layout breadth not qualified |
+| Real worker dispatch and progress | existing CV worker/store/AdminProcessing owners | local-worker, docling-import, diagnostics | Actual queued→running/extracting→pending_review plus owner-correlated events PASS; finite timeout/cancel tests separate |
+| Canonical Career Profile field mapping/new records | import interpreter/mapper/reviewed persistence; import-tests/cv-integration-qa.spec.ts | cv-integration-qa, long-import, mariadb-provider, backend | Automated supported workflow PASS; deterministic recall remains PARTIAL; unknown values must stay unknown |
+| Review/correction, group/field approval, source evidence | career/CvImportReview/CvImportMappingEditor | cv-integration-qa, docling-import, frontend, backend | Automated PASS; original PDF preview, DOCX source download/text; no claim of inline Word renderer |
+| Duplicate/conflict resolution, preserve existing values | reviewed apply owner and provider tests | mariadb-provider, cv-integration-qa, backend | Automated PASS for exercised matching/update/skip paths; conservative human decisions retained |
+| Transactional MariaDB apply, idempotent replay, rollback | CvImportReviewedPersistenceTests/CvImportConnectionLossTests/CvImportLifecycleConcurrencyTests | mariadb-provider | 90 provider cases overall, not90 import-only cases; rollback/concurrency/replay covered |
+| Revision safety and repeated requests | existing profile/job revisions and RD21 contracts | mariadb-provider, rd21, mariadb-observations | PASS for covered concurrency/recovery. Two observation cases document repeated creation behavior; do not prove creation-intent idempotency |
+| Failure/retry/cancellation/restart and provenance | CV worker durable states/source ownership and parser tests | backend, python-offline, docling-import, long-import, diagnostics | Automated PASS for finite cases; ownership/tenant/source checks retained; no indefinite success by timers |
+| Dashboard actual drag/resize | DashboardGrid + LayoutEditor; phase8-dashboard-customisation and dashboard-presentation specs | ordinary shards, frontend, preferences | Automated PASS; keyboard alternatives, collision and persistence covered |
+| Dashboard show/hide/save/reset, v1 preferences and stale-save conflicts | dashboardLayout/useDashboardLayout | preferences, frontend, ordinary shards | Automated PASS; hidden/future widget data retained |
+| Dashboard mobile and keyboard use | responsive linear layout/navigation guard | ordinary shards, frontend | Automated viewport/keyboard/axe PASS; physical mobile and AT NOT TESTED |
+| Admin owner + related job/import attribution | AdminProcessingPage/controller/store | diagnostics, backend, local-worker | Automated PASS for scoped IDs and real events; no cross-user progress/result access accepted |
+| Admin stage/status/duration/failures and bounded polling | admin-processing.spec.ts and API tests | diagnostics, frontend, backend | Automated PASS; provider_unavailable history retained even when retry succeeds |
+| Sanitised event logs, redaction, authorisation and tenant isolation | processing diagnostics service + authorisation tests | diagnostics, auth, rate, ingress, backend | Automated PASS for exercised payloads/roles; no claim of exhaustive repository security scan |
+| Real Docling vs deterministic interpretation | separate converter/grounding/interpreter | python-docling, python-offline, benchmark-new/-original, import journeys | Real conversion PASS; extraction recall PARTIAL; benchmark fixtures are finite synthetic source facts |
+| Queued AI strategy generation | existing generic operation worker/StrategySnapshotService | local-worker, ai, backend | Real local queue completed and persisted summary; earlier provider failure retained; separately authored ProfileCvText required |
+| Scheduled job enrichment | current scheduled worker/sidecar | local-worker | Actual scheduler persisted summary+tags at configured cadence; semantic correctness NOT qualified |
+| Safe structured outputs and model failures | cv_import_ai.py and grounding tests; isolated immutable probe | python-offline, cv-model-probe, model-verification artifacts | Contract tests PASS; all3 real CV probes rejected. CV model compatibility/accuracy BLOCKED; adapter stays disabled/disconnected |
+| Generic AI from imported structured profile alone | StrategySnapshotService requires legacy ProfileCvText | AI_RESULTS.md, BLOCKERS AI-CONTEXT-01 | NOT QUALIFIED: reviewed import deliberately does not populate legacy raw CV text; no fabricated compatibility claim |
+| Routes, auth, jobs/applications, CV/letters, settings, administration | existing shared owners; redesign-preservation and route specs | ordinary shards, auth, backend, frontend, preservation-register | 380 ordinary cases with discovery identity; all57 preservation entries/34 routes retained,56 PARTIAL/1 DEFERRED unchanged |
+| EN/Bokmål, light/dark, responsive/reduced motion | existing translations/themes/a11y specs | ordinary shards, frontend, native PDF measurements | Finite automated PASS; human copy/contrast/AT/device approval NOT TESTED. Other languages not newly qualified |
+
+`ordinary-*` denotes four disjoint reports (380 unique executed cases), not an extra suite added to the total. Specialized contracts have53 cases, import journeys8, real-provider browser checks3 and Linux native-browser checks8; these are separate lanes, not all unique product scenarios. Backend1448 and frontend1031 include many of the behaviors above; row counts must never be summed.
+
+See [VISUAL_REVIEW.md](VISUAL_REVIEW.md), [AI_RESULTS.md](AI_RESULTS.md), [MANUAL_ACCEPTANCE.md](MANUAL_ACCEPTANCE.md), [AUTHORITY.md](AUTHORITY.md) and [BLOCKERS.json](BLOCKERS.json) for the deliberately unfinished acceptance decisions. No listed PASS supplies protected Phase10 approval.
@@ -0,0 +1,25 @@
+# Current template visual review — 29 October 2026
+
+**Visual spacing: PARTIAL. Automated revised fidelity: FAIL. Human approval and actual printing: NOT TESTED.** No tolerance, golden, font, renderer or application source was changed during this handoff.
+
+Download [owner-review.zip](visual/owner-review.zip) (about 5 MB). It contains **36 actual CV PDFs and 18 matching cover-letter PDFs**, first/final contact sheets, and adjacent short-CV preview/export images for all nine templates. [manifest.json](visual/manifest.json) records original source and packaged SHA-256 values. PDFs are byte-preserved; JPEG review images are compressed navigation aids, never pixel oracles. Synthetic names, email addresses, long identifiers, Norwegian characters and geometric photo placeholders are deliberate fixtures.
+
+| Fresh measurement | Windows | Linux | Meaning |
+|---|---:|---:|---|
+| Original CV corpus | 24 documents / 60 pages PASS | 24 / 60 PASS | Historical rendering compatibility |
+| Original cover letters | 4 / 14 PASS | 4 / 14 PASS | Historical letter compatibility |
+| Revised CV content/bounds | 36 / 122 PASS | 36 / 122 PASS | Source markers retained; physical text bounds checked |
+| Revised unchanged coordinate oracle | 8/36 PASS; 28 S01-only failures | 16/36 PASS; 20 S01-only failures | Existing 2 mm criterion still fails; exit1 retained |
+| Full-height sidebar raster | 43/43 applicable pages PASS | 43/43 PASS | Actual PDF color samples through top and bottom rows |
+| Name wrap and separate visible-ink checks | PASS | PASS | Distinct diagnostics; cannot waive S01 |
+| Matching themed cover letters | 18 / 38 pages PASS | 18 / 38 PASS | Finite source markers, bounds and theme checks |
+
+The revised corpus covers modern, minimal, executive, technical, ats-classic, nordic, elegant, creative and code; four short/medium/long/dense EN/Bokmål profiles. Dense cases include 12 employers, education and long skill lists. Separate matching letters cover short EN and long Bokmål. Native report IDs are `windows-template-*`, `linux-template-*`, original-PDF/letter artifacts and matching-letter proof artifacts in TEST_EVIDENCE.json. Each measurement is separate from browser test totals.
+
+Agent inspection of the short first-page and dense final-page sheets confirms the intended template differences and full-height colored sidebars are visible. Long names wrap, and some dense final pages have considerable trailing whitespace after the final sections. That observation is a review question, not a new automated failure or a human aesthetic decision. Actual PDFs, bounds/marker diagnostics and unchanged S01 failures remain available for independent inspection.
+
+Open [short first pages](visual/templates-contact-short-en-first.jpg) and [dense final pages](visual/templates-contact-dense-nb-last.jpg), then the corresponding PDFs at 100%. Compare title-to-subtitle/content gaps, heading rhythm, line height, paragraph/bullet indentation, page margins, column alignment, breaks, photo/no-photo variants, font weights and final-page whitespace. Inspect first **and** final pages of long/dense records, not just gallery thumbnails. Print representative classic, modern, code and sidebar layouts at actual size. Record template/profile/page, platform, screenshot or print, result and requested correction using MANUAL_ACCEPTANCE.md cases HUMAN-06/HUMAN-07.
+
+The current gallery uses actual rendered sample HTML; changing template is preview-only until **Apply**. New CVs or explicit Apply use design version2. Existing version1, frozen/historical CVs and submitted packages retain their renderer/settings until an explicit supported edit. This handoff does not rewrite old documents.
+
+S01 compares text-coordinate baselines; separate raster ink diagnostics are closer while still not satisfying the original criterion. No reproducible missing-content/clipping defect was established by the finite checks. An owner must resolve the affected fidelity requirement or supply a protected applicability decision for a concrete cleanup candidate. This evidence does not change a mandatory test into optional release debt.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
cesnimda	26d531cc90	docs(acceptance): publish verified pre-phase10 evidence handoff	2026-10-29 19:11:10 +01:00
cesnimda	c16a66e2c8	test(handoff): preserve native results in bounded attachment projections	2026-10-29 18:55:20 +01:00
cesnimda	657db9d294	test(handoff): bind verifier source and reject acceptance promotion	2026-10-29 18:44:08 +01:00
cesnimda	78e5296881	test(handoff): add fail-closed evidence schema and qualification records	2026-10-29 18:30:53 +01:00
cesnimda	8804231be4	docs(handoff): reconcile phase 10 authority and publication baseline	2026-10-29 14:51:30 +01:00