docs(phase10): reconcile historical qualification and UI checkpoints

SECURITY.md

@@ -1,41 +0,0 @@
-# Jobjakt Security Policy
-
-## System and scope
-
-Jobjakt manages private career profiles, CVs, letters, applications, correspondence and related account data. Review the repository-owned React/Next static-export UI, ASP.NET Core API, EF data and background processing, Python AI/document sidecar, browser extension, deployment/CI configuration and their trust boundaries. Architecture documentation describes nginx, MariaDB, private files and internal services; actual deployed exposure and identity must be verified separately. Retained SQLite and legacy document paths remain in scope while supported.
-
-This policy supplies review context, not permission to run commands or test live targets. It does not certify existing controls. Root and component policies compose; nearest-path guidance takes precedence.
-
-## Threat model and trust boundaries
-
-Consider anonymous callers, two distinct authenticated owners, administrators, revoked or limited sessions, malicious document authors, incoming webhook senders and compromised external services. Treat route/body identifiers, uploaded files, HTML, job advertisements, external callbacks, logs and model output as untrusted.
-
-Assets include canonical Career Profile facts/history, CV overrides and frozen revisions, application records, attachments, authentication/recovery material, provider tokens, billing entitlements, audit records and recoverable backups. Trace browser-to-API, API-to-database/files/workers, API-to-sidecar and provider callback/outbound fetch boundaries. Do not assume a role, a client UI flag or an internal-network label proves authorization.
-
-## Security invariants
-
-- Establish authenticated identity and owner scope before disclosing or changing private data. Caller-supplied owner IDs cannot replace server identity. Apply ownership to nested resources, lists/search, downloads, exports and background work, not only direct item reads.
-- Enforce administrator and sensitive-operation permissions server-side, including self/last-admin restrictions. Session revocation, recovery, MFA and OAuth state/account-linking controls must preserve the intended identity boundary.
-- Preserve canonical Career Profile ownership, null-as-inherit CV settings and immutable submitted/frozen snapshots. All applicable application/CV/letter writes must enforce existing revision preconditions and atomic persistence; stale operations must not partially commit or overwrite newer data.
-- Bound untrusted document/upload/parser work. Validate type, size, owned paths and lifecycle state; reject traversal and unauthorized retrieval. Rendering/import must not execute active content, dereference unapproved URLs, expose local files or change another owner's data.
-- Treat AI output as a proposal. Keep consent, entitlement, manual fallback, source/revision checks and explicit review/apply boundaries. Private content must not reach an unapproved model/provider; model or document text cannot authorize tool execution.
-- Validate outbound destinations and redirects at network boundaries. Preserve job-provider rights/attribution and mailbox consent separately from sign-in identity. Validate webhook authenticity, identity binding and replay/idempotency where applicable.
-- Preserve browser output encoding, safe HTML/rendering boundaries, origin/cookie/CSRF protections and validated return/navigation targets. UI visibility never substitutes for API authorization.
-- Protect secrets, tokens and private document content in logs, diagnostics, browser bundles, exports and backups. Privacy deletion/retention must account for files, queued work and recovery copies; successful recovery claims require tested database/file/key consistency.
-- Treat CI/deployment inputs and dependencies as supply-chain boundaries. Review least privilege, secret handling, provenance, image/runtime exposure and reversible recovery; test fixtures or historical reports do not prove production configuration.
-
-## Reportable findings and severity context
-
-Report reachable violations with attacker preconditions, affected assets and evidence. Cross-owner private-data disclosure/mutation, account takeover, privilege escalation, unsafe parser/rendering execution, exposed credentials and unauthorized external data transfer warrant impact-based investigation. Separate confirmed reproduction, reasoned likelihood and unverified assumptions.
-
-Evaluate actual source/configuration and supported deployment modes. A package advisory, missing attribute or hypothetical path alone is not a reproduced exploit; equally, a passing mock test or limited deployment mitigation does not close a reachable issue. Record advisory/reachability and runtime evidence separately. Preserve failed, blocked, skipped and unexecuted checks explicitly.
-
-## Exclusions and accepted risk
-
-No vulnerability class, repository component or existing defect is implicitly suppressed. No new risk acceptance, severity downgrade or finding exclusion is granted by this policy. Historical deferred work and compatibility support remain reviewable.
-
-Production, adjacent networks, real personal data and third-party systems are excluded from active testing unless separately and explicitly authorized. This execution restriction does not exclude review of repository-owned integration or deployment code. Synthetic local fixtures are distinct from approved staging and live-service qualification.
-
-## Known limitations and qualification
-
-The independent audit is incomplete. Source analysis, package checks, local fixtures, hosted CI, native accessibility, provider/model behavior, isolated staging and production recovery are separate evidence lanes. Final integrated security review follows relevant application changes. Baseline/deep/final scan results, cost allowance, staging scope and human release acceptance must be recorded separately; none is established by creating this file.

docs/direct-roadmap/LATEST_CHECKPOINT.md

@@ -1,5 +1,83 @@
 # Direct execution continuation
 
+**Latest implemented/published increment:** `98e9502af5039429fb6da45353e719a27e8aa22d`, codex/a3-ui-04, independently remotely verified; committed source/evidence manifest has zero mismatches. B1 quiet table/board surfaces and persistent right application context implemented; narrow/compact layouts put context after task with jump/return focus. Existing table/board/action/revision owners retained. Fixed reproduced null-nextStep false readiness claim in EN/NB. Final126 selected frontend tests/10 disjoint suites and88 targeted InMemory/SQLite backend tests passed; typecheck/full lint/build passed.16 controlled React search/board/precise-status/detail/context/return journeys,48 whole-page axe scans/captures, zero violations/unexpected writes/page exceptions.16 status PATCHes were intercepted fixture responses, not backend writes. Independent reviewer52 cases overlap126. No native/MariaDB/live provider/model/security/release qualification.
+
+Application-tracking Gate F → A3-IM05 is pending in this chat. Do not start dependent discovery presentation until answered; new international provider implementations retain separate GJ prerequisites/rights. Existing dashboard/nav approvals remain accepted. Review `docs/ui-modernisation/APPLICATIONS_VALIDATION.md` and APPLICATIONS_PUBLICATION.md in integration worktree. UI04 source remains distinct from independent ca519cac document-date patch. Phase10 final acceptance and wider roadmap stay open; these targeted UI counts do not qualify them.
+
+**Newest decision:** owner answered **"Approve dashboard/onboarding and A3-IM04"** on3 November2026. Dashboard Gate F is ACCEPTED; no repeat approval question. Integration worktree now isolates `codex/a3-ui-04` from UI03 receipt `dc93b589c995f4edcc48f658ddde571356d6dd86` (published and independently verified). UI03 remains on its own ref. Next work is B1 applications table/Kanban/full detail with context right; see UI-04.md task ledger. Original integration ref remains d3d33837. No main merge/deployment.
+
+Independent localisation `ca519cacbec6ee8e385927ad31356dacc18b2f2d` on codex/i18n-document-dates is published/remotely verified; committed manifest matches. Reproduced/fixed invalid uploaded wall-clock date rollovers, overflow and trailing junk;40 frontend tests/3 suites, typecheck, scoped lint/build pass. Four historical direct catalogue accesses contextually reviewed; full current literal/backend inventory still open. Not combined with A3 yet; preserve branch separation and integrate only its small accepted patch with combined regression when needed.
+
+**UI03 published:** `c7d26d354c44b0bdd2976cf2f1c2b0737d7cc2d2` on `codex/a3-ui-03`, push succeeded and independent remote readback matched. Committed manifest: zero mismatches. Dashboard/onboarding Gate F question is pending in this chat before A3-IM04; independent localisation remains eligible. Details: `docs/ui-modernisation/DASHBOARD_VALIDATION.md` and `DASHBOARD_PUBLICATION.md` in the integration worktree. Commit emitted unrelated Windows long-path warnings for Codex turn-diff checkpoint refs; real feature commit/publication succeeded, no infrastructure repair performed.
+
+3 November 2026 — newest owner decision: **"Approve navigation and A3-IM03"**. Navigation Gate F992608c7 is ACCEPTED; do not repeat that question. A3-IM03 is implemented in the existing integration worktree on isolated branch `codex/a3-ui-03`, based on992608c7 plus only the independent metadata patch d4b938fa cherry-picked as5e8a07d1. Original integration/UI01/UI02 refs remain unchanged. Dashboard/onboarding qualification and publication receipt follow; earlier navigation-pending text below is historical.
+
+Current UI03 work: new/reset A1 task-first defaults, separate movable agenda widget using explicitly limited recorded attention-feed dates, personal greeting from recorded names, optional owner-scoped resumable setup/skips and on-demand walkthrough. Existing nine widgets/layout geometry/CAS/collisions and source-backed completion remain. Additive agenda whitelist only; no database migration.95 frontend tests/12 suites and36 isolated SQLite backend layout tests pass. Typecheck/full lint/build pass;32 controlled browser scans/captures across16 configurations show zero axe violations;16 synthetic layout saves, no source-data guidance writes. Independent review found no actionable issue; its45 tests overlap95. These are not full Phase10/security/release or native/provider qualifications. See UI03 branch `docs/ui-modernisation/DASHBOARD_VALIDATION.md`. Next dependent owner gate is dashboard/onboarding review before A3-IM04; do not start it from navigation approval alone.
+
+3 November 2026 — newest: owner attachment `a178edeb-c3ef-4c0e-b4c2-bcd1ca84b90b` explicitly ACCEPTS foundation Gate F (`bdd1de0d`, receipt `0d6de714`) and authorises navigation. Do not repeat foundation/final-A3 approval questions. Required later milestone gates remain distinct; ordinary independent work is authorised while awaiting them.
+
+**A3 navigation IMPLEMENTED / TESTED / PUBLISHED; owner review pending.** Commit `992608c77f01d26220d086b2cdc55a3722b88ca5`, branch `codex/a3-ui-02`, independently remotely verified. Existing integration worktree `C:\Users\Connor\.codex\worktrees\direct-roadmap-integration\Job tracker` is now on that branch; original integration ref stays d3d33837 and UI-01 ref stays0d6de714. Reuses AppShell/router/MUI drawer, desktop collapse/storage, five mobile destinations and More, retained secondary tools/admin flags, measured content/scroll/toast clearance, source-bound EN/NB and theme behaviour. Discovery promoted to primary; existing workspace destinations retained. Fixed current-route drawer-close/focus defect and320px label wrapping. All57 groups/34 route declarations retained; no backend/data/renderer/dependency changes.
+
+Fresh navigation evidence: **49 tests /9 suites PASSED**, typecheck/lint/build PASSED; **56 scoped axe sweeps with zero violations**,56 captures. Actual React browser lane:32 screen conditions at320/390/768/1440 EN/NB/light/dark,16 company dialogs,8 More drawers;16 configurations with4 primary route transitions, focus/collapse/More checks, local fixture company save and phone feedback clearance.16 PUTs were intercepted/fulfilled by browser fixtures; no real backend writes.40 existing Google font requests aborted. Core route content may show unavailable-service states: routing checks are not successful backend/domain qualification. Independent source review had no important/critical findings; final committed source/evidence manifest verified. See `docs/ui-modernisation/UI-02.md` and `NAVIGATION_VALIDATION.md` in that branch. Prototype counts are separate historical evidence.
+
+**Navigation Gate F → A3-IM03 is OPEN.** A concise approval question was submitted in this chat after publication. Exact next scope: approved A1 dashboard hierarchy and optional resumable onboarding through existing DashboardView/grid/layout/checklist owners, retaining schema-2/CAS, hidden geometry/gaps, collision handling, drag/resize/keyboard alternatives and existing-data skip/resume. Do not start that dependent increment until owner review is received. Do not treat the foundation approval as blanket later-gate approval. Other independent roadmap work remains eligible under its own gates.
+
+**Independent static I18N fix IMPLEMENTED / TESTED / PUBLISHED.** Commit `d4b938fafbf10541b62134293cea8299f25c4031`, `codex/i18n-build-metadata`, independently remotely verified. Existing i18n worktree `C:\Users\Connor\.codex\worktrees\i18n-00-audit\Job tracker` now uses that integration-derived branch from d3d33837; original codex/i18n-accessible-labels ref remains4172c23d. Reproduced Bokmål mobile menu showing literal `commit`; now uses existing localised version/revision key, retaining version-only fallback and caller-controlled admin metadata visibility. **24 tests /5 suites, typecheck, scoped zero-warning lint and fresh production build PASSED**. No new locale keys or historical dynamic-call review changes. Native report/source manifest verified. No fresh browser/live-service qualification for this separate branch. See `docs/i18n/MOBILE_BUILD_METADATA.md`. Do not add its overlapping existing suites to navigation's49 as a unique combined total.
+
+The I18N patch is **not combined** with frozen navigation review992608c7. After navigation approval, reconcile the next UI baseline and port only its small AppShell hunk/test; never merge the older integration/theme tree wholesale. Run combined targeted metadata/navigation/language evidence after that integration. Full European localisation remains OPEN; all188 historical dynamic reviews remain accounted for, and navigation added four new static EN/NB keys only.
+
+Design approval continuity is local-only at `3d6976be` on codex/product-modernisation; original A3 prototype237c79b8 and five concepts remain unchanged. No design-branch push. AST-only Graphify updates ran locally; generated graphs remain untracked. Prior orchestrator/pre-P10 worktrees are untouched. No main merge, deployment, destructive migration, provider access or model activation.
+
+Wider roadmap stays OPEN: Phase10 final acceptance (no new deletion candidate), Product Review/full A3 implementation, GJ predecessor/provider permissions, European market/native localisation, homepage visual/claims approval, final integrated security and live recovery/hosted CI/release qualifications. Existing scoped evidence remains applicable only to its source-bound scope. No human/native-device/screen-reader/actual-zoom, physical PDF/container, provider/model, production or final security pass is inferred. The following entries are historical and superseded where they still describe foundation Gate F as pending.
+
+3 November 2026 — latest: final A3 design/implementation authorisation RECEIVED in owner attachment137309c9-7463-4c4c-9b1c-6fb689d588d7. Gates C/D/E approved for that stated scope; do not ask for the same final A3 approval again. Verbatim text is committed in implementation branch `docs/ui-modernisation/A3_APPROVAL.md`. Design approval status updated locally at `b7051a3e` on restricted/local-only codex/product-modernisation; frozen prototype remains237c79b8, no new concept.
+
+Actual A3 implementation checkpoint `bdd1de0dd3259e4e9e9f46c81948f865317c6054`, subsequent evidence/review receipt `0d6de71403015b0e44ca410d0ce2b844b75b893d`, branch `codex/a3-ui-01` in the existing `C:\Users\Connor\.codex\worktrees\direct-roadmap-integration\Job tracker` isolated worktree. Original codex/direct-roadmap-integration ref remains at d3d33837. Branch was created from that accepted integration, not by merging the older design tree. Existing theme.ts now implements D1 semantic palette/navigation colours, typography, quiet surfaces and shared controls. Actual sidebar structure, A1 dashboard and other feature layouts are NOT yet implemented. Theme/controls are A3-IM01, only part of owner UI-01.
+
+Fresh implementation evidence:30 theme/state/dialog tests in5 suites plus5 disjoint CV-thumbnail/navigation tests in2 suites, all passed; baseline28 and reviewer16 overlap and are not added. Full typecheck, lint, static production build passed. Real built React with controlled API fixtures:32 screen conditions at320/390/768/1440, EN/NB and light/dark;16 company-dialog keyboard journeys;48 scoped axe sweeps, zero violations;32 screenshots. No page exceptions or backend writes. All32 inherited Google font requests were blocked, not fetched. Native JSON, screenshots and source/export-asset manifest committed. Independent code review found no important/critical findings. Final committed manifest verified. No backend/live-service/model/provider/native/human/physical-PDF/final security qualification claimed; actual browser zoom remains untested. Source/route/data/renderer contracts preserved; only shared theme application source changed.
+
+Publication now works without repair: normal push and independent remote read-back confirmed implementation bdd1de0d. Subsequent documentation receipt0d6de714 pushed; latest read-back receipt recorded in this chat. Design branch remains unpublished by its specific restriction. Older connection-failure entries below remain historical actual results, not current publication status.
+
+UI Gate F remains OPEN before A3-IM02 navigation: the approved handoff at237c79b8 explicitly says "Owner milestone review before next increment" for A3-IM01. Review the actual implementation evidence at docs/ui-modernisation/UI-01.md and VALIDATION.md in codex/a3-ui-01. After that review, proceed through approved navigation scope without repeating ordinary-change approvals. Do not infer Gate F approval from the earlier generic continue message sent before this validated checkpoint existed. Other independent work remains eligible under its original Phase10/provider/native/security/recovery gates. No orchestrator or pre-P10 changes, main merge or deployment.
+
+All prior final-A3-approval-pending text below is historical and superseded by the explicit attachment authorisation above. All188 historical dynamic-call reviews remain accounted for; full European localisation, Phase10 acceptance, integrated security and release readiness remain open.
+
+3 November 2026 — newest design checkpoint: `237c79b8cb3e280d7e4d1ef95cdbb2c77bb81c69` on local-only `codex/product-modernisation`, worktree `C:\Users\Connor\.codex\worktrees\product-modernisation\Job tracker`. Consolidated A3 http://127.0.0.1:4317/a3.html; handoff `docs/product-modernisation/08-a3-handoff/README.md` in that worktree. Owner explicitly confirmed A3: original A1 dashboard, D1 foundation, B1 tracking, editor left/preview right, application context right, desktop grouped sidebar/hybrid mobile, overview-first Career Profile, agenda-first calendar/month preference and automation under Settings. Do not restart five-concept exploration. Final production design/implementation approval remains OPEN (Gates C/D/E); no production UI replacement was authorised or implemented.
+
+Publication result: local roadmap receipt `3eca2df0ad396544e4d2d1a60b4aed7164f127dc` committed successfully. Normal push to origin/feature/phase10-cleanup FAILED: `Failed to connect to git.cesnimda.uk:443 after 21119 ms: Could not connect to server`. Independent `git ls-remote --heads` also FAILED to connect after 21106 ms. No remote publication or verification is claimed for this receipt or the subsequent failure-record commit. Retry normal phase-branch publication/read-back when the existing remote becomes reachable; do not repair Gitea, change infrastructure or publish the restricted design branch.
+
+Fresh isolated prototype evidence: 480 unique screen/layout/state conditions (320 populated + 160 generic states), 496 helper render/overflow calls including overlaps, 11 scoped behaviour checks, 44 screenshots and 50 scoped axe sweeps with zero returned violations. 57 inherited groups mapped (56 PARTIAL/1 DEFERRED retained), 34 inherited route strings confirmed in integration source. New direct profile edit/progress, local widget/calendar preferences, letter history/dirty navigation/optional fixed suggestion, account/session and processing-monitor interactions. Source/evidence manifest verified against committed Git bytes using LF-normalised text/raw PNG hashes. AST-only graph refresh completed locally (18,902 nodes/46,671 edges); generated graph remains untracked. Not real application E2E, full WCAG/native/device acceptance, provider/AI operation, Phase 10 or security/release acceptance. Advanced existing controls are explicitly retained components rather than fully simulated lab functionality.
+
+Design commit is **not pushed or remotely verified**, under the design workshop's existing publication restriction. This primary continuation receipt may be published through the normal authorised Phase 10 development-branch workflow; it does not publish the design branch. Integration remains `d3d338376444b8abdcaf7200f682faa3daf1ad10` and earlier continuation `aa36075bef21385610c7522bf9fa8d7fc929fe89`; do not merge the older design branch application tree wholesale into integration. After explicit final approval, create implementation increments from the reconciled integration baseline and retain Gate F milestone reviews.
+
+Next owner action: review the consolidated A3 handoff and explicitly approve or request changes to the final design system and proposed ten-milestone production implementation roadmap. Independent ordinary work remains eligible in the appropriate existing worktrees: localisation context/literals and European QA architecture, bounded source security remediation/review, remaining Phase 10 qualification, design-neutral launch preparation and offline release qualification. Do not represent this design review gate as blocking every unrelated package. Preserve provider/predecessor/native-language/homepage-visual/security-scan/staging/live-recovery/hosted-CI gates. No orchestrator access, pre-P10 modification, main merge or production deployment.
+
+All older entries below are historical; use the latest counts and source-specific receipts above rather than reopening already reviewed 188 dynamic-call inventory entries.
+
+Newest direct execution checkpoint: isolated combined application review branch `codex/direct-roadmap-integration` published and independently verified at `d3d338376444b8abdcaf7200f682faa3daf1ad10`, worktree `C:\Users\Connor\.codex\worktrees\direct-roadmap-integration\Job tracker`. It preserves approved CLEAN-20 and integrates exact validated I18N/backup paths, with no change to accepted automation handoff records, API sources or workflow configuration. See its docs/direct-roadmap/INTEGRATION_CHECKPOINT.md. Fresh combined checks: 195 selected frontend tests in 16 suites; full typecheck/lint/build; five mocked backup-function tests and Bash syntax, all passed. Additional catalogue QA: 10 tests in three suites; subsequent language-control QA: 17 tests in three suites, with overlap explicitly retained separately. Latest runtime language-control fix has its own fresh passing production build. Native JSON reports archived. No fresh browser, final integrated security, real provider/model, live restore or production qualification.
+
+I18N finite key-domain census COMPLETE at published/read-back `4172c23d7ce13e8327a5e51bbb09f296c24fb9b8`: all 188 historical indices accounted for, 108 original + 80 supplemental, zero pending. Register schema 3 declares LF-normalised reviewed-text hashes for checkout portability, preserves original historical hashes, and distinguishes repeated same-line calls by immutable inventory index. This does not close every-string context, direct access/backend literals, European registry/native/plural/market or release gates. Tests enforce equal EN/Bokmål keys, placeholder sets and nonblank values across 3,119 keys per language; resources and translations were not invented or published for candidate locales. Only integration branch additionally contains the new catalogue tests, supported-language native-name/NB control fix and corrected JobFlowBar caller note. Prefer that branch for further ordinary integrated development.
+
+Phase 10 separately published/read-back `db818e5ebd19eeedc05ae58dc3f7a908ce0e713d`: 14 new disjoint AttachmentConsistencyTests passed; selected backend coverage now 103, frontend Phase 10 coverage remains 92. P10-05 remains OPEN; do not claim complete regression/acceptance. Security source matrix follow-through published/read-back `88bcd6d91c6823ffc6bbc6a6de176ab7769e729f`: actual relational ownership denial evidence identified; HTTP/missing-owner/list/upload/MariaDB/final scan gaps retained. No Codex Security scan launched; desktop workflow references read, setup/capability/cost/scope and final integrated gates remain separate.
+
+Homepage preparation published/read-back `af8c48ce7090f2c56bc8f9a47494b440312ec12a` on feature/launch-site-redesign: design-neutral content, locale and crawlable-HTML/SEO contracts; unchanged rendering-shell sources matched the available build, whose raw export lacked descriptive content/canonical/hreflang. No layout/route/metadata implementation or public marketing publication. Five application concepts and requested comparison ready in product-modernisation local-only commit `2f081e6f`: docs/product-modernisation/CONCEPT_COMPARISON.md and REVIEW_PACK.md, http://127.0.0.1:4317/gallery.html. No sixth concept and no final unapproved UI design implementation. Preserve design branch publishing restriction and all prior owner selections.
+
+Next eligible work: use the integration branch for remaining literal/direct-access/localisation context work; continue bounded source audit without representing it as a plugin scan or final security gate; qualify full Phase 10/preservation evidence using unchanged source-bound results; complete detailed product journeys and review preparation without final design implementation. Remaining owner/environment gates: final design/implementation roadmap, locale market/native reviewer and Montenegrin identity, required predecessor acceptance/provider/data grants for GJ stages, approved public-site visuals/claims, scan policy/paid deep budget/named staging scope, isolated Linux recovery/hosted CI and production/human/device decisions. No orchestrator access, pre-P10 changes, main merge or deployment.
+
+Current continuation after 2a4acc17: Phase 10 acceptance register published/read back at `6f29ed4cdb7b259318282f365d737f6cfdb6a682` (P10-05 remains OPEN). Fresh integrity check: 263 indexed artifact hashes and 1,279 retained source hashes match; only approved App.css absent. No extra deletion candidate.
+
+I18N branch latest published/read-back `ebd33fcf0040ed7ebe659c75171873a88cdfc025`. Actual fixes: `2108ea50` session-change message uses existing EN/NB catalogue outside private providers; `7b132ec4` own-property guards for completeness/timeline unknown labels; `36db9322` inherited-name pipeline alias fallback. Selected runs separately: 17 session tests, 41 label/workflow tests, 29 pipeline/board tests, all passing. Typecheck and scoped lint passed for each implementation package. Static production build passed before the final one-line pipeline patch; do not claim a fresh final-pipeline build. Local AST graph update completed, 18,560 nodes / 46,020 edges; generated graphs untracked. Sanitized 17/41 native reports committed; pipeline native JSON remains ignored locally. DYNAMIC_RESOLUTION_REGISTER.json binds 18 individually matched supplemental call sites and reviewed source hashes to the original inventory: 126 resolved / 62 pending of 188, no duplicate counts. Final integrated security tests remain open until relevant application changes are complete.
+
+Five rendered UI concepts are review-ready: product-modernisation local-only commit `c678ebdb`, docs/product-modernisation/REVIEW_PACK.md. Gallery http://127.0.0.1:4317/gallery.html; preferred expanded A3 http://127.0.0.1:4317/expanded.html. All 70 original screenshot files and ten gallery previews confirmed present; accepted 75-screenshot execution reused, not rerun. Earlier owner choices retained; no final unapproved design implementation. Design branch not pushed under its specific publishing restriction.
+
+Global Jobs eligibility rechecked against planning branch docs/global-jobs/00/DEPENDENCIES_AND_GATES.md, PROVIDER_RIGHTS_MATRIX.md and OWNER_ACTIONS.md. Their old blanket no-implementation authority is superseded only by later direct-chat authorisation for independent ordinary work; required Phase 10/Product Review acceptance, stage/data/lifecycle/provider grants remain open. GJ-00 evidence is dated 28 October, not a fresh provider check. No credentials, registrations, scraping or provider calls occurred. European localisation registry/market/native-review choices, public homepage visual/claims approval, final design, hosted/live recovery/CI and security scan/staging gates remain separate; do not silently mark them complete.
+
+Next eligible work: continue the 62 unresolved dynamic calls using the machine register to avoid repeats; review processing-monitor external-key maps for inherited-property behavior, then finite interview/prep/action maps; finish European catalogue context/legal evidence and eligible fixture checks; continue security owner-filter/source matrix review without final integrated scanning. Prepare fresh build/browser checks when relevant app scope stabilises, retaining all baseline/source boundaries. No immediate owner input is required for this offline work. No orchestrator access, pre-P10 edits, main merge or production deployment.
+
+Newest continuation receipts: Phase 10 `ba826de1e5c959352e4442ab2fec5d02445dd32d` (89 backend + 92 frontend selected cases, separately counted); I18N `bab240914e30fb1e8e3756fbe568cbd60e39db32` (120/188 dynamic calls resolved; 68 pending); security offline preflight `0a17a33db7b9944693976df432f1e5a319277279`. All three refs were independently read back after normal publication. Security worktree: C:\Users\Connor\.codex\worktrees\security-offline-preflight\Job tracker, branch codex/security-offline-preflight. It contains partial Phase 00/01 inventory, ROE, eight-row source endpoint matrix and honest scan register. No scan or active staging attack executed; no policy file written. Continue there from docs/security/01-threat-model.md, completing owner-filter/sibling-path/source matrix review and actual plugin capability preflight. Read further subordinate prompts before entering later audit stages. Audit acceptance remains open.
+
+Decisions parked for owner catch-up: exact proposed root security policy before any policy write; separately bounded deep-scan cost/runtime; named isolated staging hosts/accounts/rates before active attacks; final comprehensive product design and implementation roadmap; native-language/market and release/human/device gates. None is required for the next offline source review. Session-boundary English text remains an implementation item requiring privacy/unmount regression checks; preserve old-provider teardown. Orchestrator and pre-P10 worktree remain untouched.
+
 Latest continuation: P10-04 selected regression has 89 backend cases and 92 frontend tests passing, zero failures/skips/pending. Native evidence is archived under docs/redesign/phase-10/p10-04-evidence; P10-04.md records exact filters, source boundaries and remaining qualification. Backend checkpoint `525b5fe4d74ab75f711651fe3a36b988b07abc4d` was independently remotely verified. I18N finite-map review was published/read back at `f577565f7146c6e0cba6edd00b4e804b032ad670`: 112 dynamic calls resolved / 76 pending. It verified 15 letter/completeness keys in both catalogues; checklist default review verified all 14 current defaults but retained the legacy unknown-key gap. No additional cleanup or production change.
 
 Next: continue independent audit, remaining i18n owner maps/literals, and P10-05 evidence reconciliation. Keep final design/implementation approval, market/language decisions, provider/licensing access, live recovery, hosted CI and human/device gates open; ordinary local work need not wait for these unrelated gates. No user input is required for the next static review package.

docs/redesign/phase-10/P10-04.md

@@ -22,3 +22,9 @@ The three filters are disjoint: 89 distinct backend cases passed, zero failed/sk
 Frontend PASSED: five suites, 92 tests, zero failures/pending, native exit 0, 41.237 seconds. Exact selected paths: `career-history-view.test.tsx`, `application-assets.test.tsx`, `cover-letter-document.test.tsx`, `cv-document-controls.test.tsx`, `cv-import-review.test.tsx`; Jest `--runInBand --runTestsByPath`, local mocked contracts. [Native JSON](p10-04-evidence/frontend-document-workflows.json.gz), uncompressed SHA256 `b919a96d94218ff166de684f6b82d3ce6f34d47b51d52480721e8955df2df257`. Browser/real PDF fidelity and semantic AI quality are separate evidence. Backend and frontend counts remain separate.
 
 Migration rehearsal/rollback, MariaDB integration, sidecar, complete suites, security acceptance, hosted CI and human/device qualification remain NOT RUN here. Reuse unchanged accepted renderer evidence only within its source/fixture/environment boundaries. No migration or destructive cleanup is proposed. P10-05 remains open; production remains NO-GO.
+
+## Additional attachment qualification
+
+Fresh AttachmentConsistencyTests execution: 14 PASSED, zero failures/skips, native exit 0. Reused the existing Release assembly with --no-build/--no-restore after confirming no backend/test source difference between the Phase 10 and security branches. Relational temporary SQLite and synthetic files only. The named case Another_users_attachment_cannot_be_downloaded_renamed_or_deleted verifies three NotFound results and preserves the foreign file/row. Other selected cases cover upload/storage consistency. This is direct controller/local fixture evidence, not authenticated HTTP or deployed/MariaDB isolation acceptance. No application code changed.
+
+[Native TRX](p10-04-evidence/attachment-ownership-and-storage.trx.gz). These 14 cases are disjoint from the earlier 89 backend cases: selected backend coverage is now 103 distinct cases, with the 92 frontend tests kept separate. Complete suites and P10-05 remain open.

docs/redesign/phase-10/P10-05.md

@@ -0,0 +1,34 @@
+# P10-05 — Acceptance reconciliation (OPEN)
+
+3 November2026 reconciliation: parsed all four retained backend TRX artifacts and the frontend native JSON. **103 distinct historical backend cases**, zero case overlap/failure/skip; **92 historical frontend tests/5 suites** passed. [Machine reconciliation](p10-04-evidence/EVIDENCE_RECONCILIATION.json) retains uncompressed artifact hashes and counters. This is fresh evidence inspection, not fresh test execution. Application source under job-tracker-ui/src, JobTrackerApi and tools has no diff from the published cleanup checkpoint78f7396a to this branch's current documentation checkpoints.
+
+Final A3 design/implementation approval is now received; dashboard and navigation milestone reviews are also accepted. A3 application-tracking implementation98e9502a is published separately and awaits its own Gate F. None of those UI branches, independent localisation fixes, or their selected test counts is integrated into this frozen cleanup branch or substituted for complete Phase10 qualification. Independent audit/preservation closure and the required environment/human qualifications remain open.
+
+2 November 2026. This is an acceptance work register, not final acceptance. P10-01 CLEAN-20 is the only implemented deletion. P10-02/03 retain reviews found no additional proven-safe candidate. No further cleanup is authorised or needed merely to populate a checkpoint.
+
+## Evidence applicability
+
+Fresh integrity check at continuation from 2a4acc17: all 263 indexed TEST_EVIDENCE artifact hashes match; 1,279 application-source hashes match the accepted source-after manifest, with only the approved App.css absent and zero changed-file mismatches. Paths were resolved under the expected repository/evidence root before reading. This establishes historical source applicability, not fresh execution or a complete independent audit. New reports and native test artifacts are outside the application manifest.
+
+| Required area | Evidence disposition | Remaining limit |
+| --- | --- | --- |
+| Cleanup eligibility | CLEAN-20 blob/callers and narrow approval recorded in P10-00/01 | No additional deletion proven |
+| Frontend types/lint/build | PASSED fresh for CSS deletion; P10-01 | Full-suite execution is not represented by these checks |
+| Focused browser EN/NB/theme/responsive | PASSED five selected cases; P10-01 | Canary is not full browser regression or device acceptance |
+| Backend document/data contracts | PASSED 103 distinct selected historical cases, including14 attachment cases; P10-04 and3 November reconciliation | Not complete backend regression; no fresh execution in this reconciliation |
+| Frontend document workflows | PASSED 92 selected tests; P10-04 | Not complete frontend regression |
+| Routes/capabilities | Existing 34-route and 57-group reconciliation retained | 56 PARTIAL / one DEFERRED is not 57 accepted groups; independent closure review pending |
+| Historical CV/document/PDF | Accepted source/fixture-bound evidence retained; affected document contracts freshly checked | No fresh physical/PDF visual metric acceptance; unchanged metrics must not be reopened without affected change |
+| Complete suites/browser contracts | Historical evidence remains source-bound | No fresh full-suite result in this cleanup branch; reviewer must reconcile required acceptance scope explicitly |
+| MariaDB/migration rollback/restore | Existing qualifications remain scoped | Current independent environment and recovery qualification incomplete; no database migration added or executed |
+| Sidecar/security/accessibility/hosted CI | Existing limited evidence retained | Full independent audit, actual plugin scans, integrated qualification, hosted/human/device gates remain open |
+
+## Decisions
+
+- CLEAN-20 implementation: locally validated and published; no further code cleanup proposed.
+- Phase 10 completion: OPEN; full acceptance is not established by targeted counts or this report.
+- Redesign completion and post-redesign Product Review acceptance: OPEN; final A3 design is approved and staged implementation is underway, with separate milestone and integrated qualification gates.
+- Independent product/research/i18n/security offline work: may continue under the owner's direct parallel-work authorisation. Do not claim upstream acceptance or integrated release qualification for isolated branches.
+- Production release: NO-GO. No merge or deployment authorised.
+
+Next: reconcile complete accepted suite evidence and remaining preservation-group qualifications, complete independent audit coverage, and record genuine reviewer/owner decisions. Keep active-host, provider, model, migration and paid-scan gates distinct from ordinary source review. Do not rerun thousands of unchanged tests solely as a restart demonstration. If a relevant implementation changes, refresh its affected checks and final integrated qualification accordingly.

docs/redesign/phase-10/p10-04-evidence/EVIDENCE_RECONCILIATION.json

@@ -0,0 +1,112 @@
+{
+  "reviewDate": "2026-11-03",
+  "kind": "historical evidence reconciliation, not fresh tests",
+  "backendReports": [
+    {
+      "file": "attachment-ownership-and-storage.trx.gz",
+      "uncompressedSha256": "b589ad1139cb200d9de64b863d65e3304cea0230eda55d89476e5f79347fe84a",
+      "cases": 14,
+      "counters": {
+        "total": "14",
+        "executed": "14",
+        "passed": "14",
+        "failed": "0",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      }
+    },
+    {
+      "file": "document-contracts.trx.gz",
+      "uncompressedSha256": "692a0fe8016140c3198e76e6b3c1d56f438d80390666bc7f1b2dc06b4ac4ead5",
+      "cases": 27,
+      "counters": {
+        "total": "27",
+        "executed": "27",
+        "passed": "27",
+        "failed": "0",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      }
+    },
+    {
+      "file": "p10-04-import-compatibility.trx.gz",
+      "uncompressedSha256": "844cd54ff382bff0d48429336f8588ab010f0c72ea255ca02fe300b1561dc513",
+      "cases": 36,
+      "counters": {
+        "total": "36",
+        "executed": "36",
+        "passed": "36",
+        "failed": "0",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      }
+    },
+    {
+      "file": "p10-04-local-data-compatibility.trx.gz",
+      "uncompressedSha256": "1ac55913fdc3b705afbed27829fb280bef08d33c62fa26faa2c04e23c0c95908",
+      "cases": 26,
+      "counters": {
+        "total": "26",
+        "executed": "26",
+        "passed": "26",
+        "failed": "0",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      }
+    }
+  ],
+  "backendDistinctCases": 103,
+  "overlaps": [],
+  "frontend": {
+    "numTotalTests": 92,
+    "numPassedTests": 92,
+    "numFailedTests": 0,
+    "numPendingTests": 0,
+    "numTotalTestSuites": 5
+  },
+  "notIntegrated": [
+    "A3-IM03",
+    "A3-IM04",
+    "ca519cac document-date fix"
+  ]
+}

docs/security-audit/CODEX_SECURITY_SCAN_REGISTER.md

@@ -1,14 +0,0 @@
-# Codex Security scan register
-
-3 November2026 update: owner approved exact root policy creation/publication. Define-security-policy workflow COMPLETED for root policy only; source base88bcd6d9, exact candidate and resolver results in ../security/ROOT_POLICY_APPROVAL.md. Managed standalone artifact ID/path is documented there; there is no scan ID. Root now resolves for API/UI, nested CV-doc policy remains closest. Baseline/deep/final scans below remain NOT RUN/BLOCKED; no charges, active targets or release acceptance approved. Earlier policy-pending entries are historical.
-
-2 November 2026. Source baseline `ba826de1e5c959352e4442ab2fec5d02445dd32d`, branch codex/security-offline-preflight. Owner confirms installation; actual tool metadata/skill files verified. Production/third parties excluded. Paid/deep compute allowance pending. ROE: ../security/00-rules-of-engagement.md.
-
-| Phase/workflow | Status | Actual evidence and limits |
-| --- | --- | --- |
-| 00 define-security-policy review | NOT RUN (full workflow); resolver substep COMPLETED | Installed helper resolve-security-md --list exited 0, returned two docs-only policies. No root policy created; proposal/review/approval remains. No scan ID. |
-| 01 baseline standard scan | NOT RUN | Skill/tool exposure checked; threat-model/policy and capability preflight pending. No scan artifacts or findings. |
-| 03 deep scan | BLOCKED | Baseline and separately approved compute/cost scope missing. No scan launched. |
-| 15 final standard and diff scans | NOT RUN | Await baseline, remediation range and independent verification. |
-
-No scan findings, closure verdicts or human release acceptance are implied by tool availability or regression tests.

docs/security/00-rules-of-engagement.md

@@ -1,11 +0,0 @@
-# Security Phase 00 — offline engagement draft
-
-2 November 2026. Owner: Connor, direct-chat roadmap authorisation. Source baseline `ba826de1e5c959352e4442ab2fec5d02445dd32d`; isolated branch `codex/security-offline-preflight`. Phase 00 is PARTIAL, not accepted.
-
-Authorised now: source inspection, harmless synthetic local fixtures, minimal ordinary remediation within approved roadmap boundaries, sanitized reports and branch publication. No network attack target has been approved. Production, adjacent LAN services, real accounts/data, identity/payment/email providers, live AI/models, orchestrator state/keys/configuration/queue and the pre-P10 acceptance worktree are excluded.
-
-Active staging testing is BLOCKED until exact host/IP, test users/roles, rate/concurrency/duration limits, independent database/storage, disabled egress and recovery/stop controls are approved and verified. Do not infer those from example localhost URLs or repository credentials. Emergency stop: terminate only the named audit-owned fixture process; never stop existing production/user services.
-
-Proposed fixture boundary: disposable synthetic tenant A, tenant B and administrator; separate temporary data root and database; inert CV files and canary records; mocked OAuth, billing, email, job providers and AI. No routable credentials. Snapshot and restore qualification must precede staged mutation. This plan has not been instantiated or approved for active network testing.
-
-Evidence: only sanitized reports/test artifacts in Git. Do not inspect real .env values, auth/signing stores or personal documents. Findings require calibrated confidence and safe reproduction; absence of a scan result proves nothing. No root SECURITY.md policy edits, suppressed findings or accepted risks are authorised by this draft.

docs/security/01-threat-model.md

@@ -1,17 +0,0 @@
-# Phase 01 — partial source-backed threat model
-
-2 November 2026, baseline ba826de1e5c959352e4442ab2fec5d02445dd32d. PARTIAL; baseline scan NOT RUN. Read the complete Phase 01 prompt and architecture frontend/backend/data-flow/integrations, API reference, security notes and deployment overview. The graph query failed because the new isolated worktree has no graph; direct scoped source review followed. No active network request or live-service test.
-
-Verified dependency and documented data-flow inventory is in ASSESSMENT_INDEX.md. Threat actors to test: anonymous caller, tenant A, tenant B, administrator, revoked/limited session, malicious document author, incoming webhook sender and compromised external service. Assets: canonical career profile and history, CV/letter snapshots, application records, attachments, OAuth/mail tokens, sessions, billing entitlements, backups and administrative privileges. Secret values have not been inspected.
-
-Source boundary observations (not proof of a secure deployment):
-
-- AttachmentsController requires the local authentication scheme. List first queries the requested job; download/rename call FindOwnedAttachmentAsync. Downloads reject unmanaged paths and pending/missing files. Global filter/helper implementation, alternate upload paths and negative tests still need independent audit.
-- UsersController declares Admin role authorization. Role mutation and reset/email operations require endpoint-specific review; class attributes alone do not establish safe privilege transitions.
-- BillingController status/checkout/portal explicitly use local authentication; webhook explicitly allows anonymous requests and caps request size at 1 MB. Webhook verifies the Stripe signature via ConstructEvent, rejects invalid signatures, then refreshes subscription state. This can trigger external Stripe egress when configured; do not execute it against a real provider during offline tests. Review identity binding, replay, price qualification and mock negative coverage before acceptance.
-
-Initial attack tree: reach another tenant's data via object IDs, background execution or shared files; obtain higher privilege via role/session/OAuth flows; cross file/network/model boundaries through uploaded content; forge billing authority through webhook or stale subscription state; expose secrets through public bundles/logs/backups. Each branch requires source tracing plus synthetic negative proof. These are hypotheses, not confirmed vulnerabilities.
-
-ASVS Level 2 is a proposed planning target for private employment data, not a compliance claim. No unverified requirement IDs or vulnerability identifiers are assigned. Partial endpoint matrix is ENDPOINT_AUTH_MATRIX.csv; tests listed there are candidate existing suites, NOT executed audit evidence. Full route enumeration, middleware/global filter review, deployed exposure and complete endpoint/test mapping remain open.
-
-Next permitted review: resolve owner filters and attachment sibling paths, inspect auth/session middleware, and complete the source matrix. Baseline standard scan requires the documented capability preflight and recorded results; no scan pass is inferred from this threat model. Root policy changes, if proposed, require exact-diff approval under the policy skill; keep review-only work progressing meanwhile.

docs/security/ASSESSMENT_INDEX.md

@@ -1,21 +0,0 @@
-# Independent security assessment continuation
-
-3 November2026 — root policy proposal explicitly approved and applied; ROOT_POLICY_APPROVAL.md records exact text identity and successful API/UI/nested policy resolution. This closes the root-policy decision only. Baseline/deep/final scans, current integration target/capability/cost preflight, full matrix and staging/human/release qualifications remain open. No new application/security fix or vulnerability closure is claimed.
-
-Continuation: ATTACHMENT_OWNERSHIP_REVIEW.md traces the parent ownership filter and corrects the reflection-only test assumption. Fourteen existing relational fixture tests freshly passed on identical Phase 10 backend/test sources; native evidence published at db818e5e. Matrix distinguishes direct controller denials from unexecuted HTTP/list/upload/missing-owner/MariaDB checks. No full security scan or final integrated acceptance is implied.
-
-Phase 00 offline preflight, 2 November 2026. Branch `codex/security-offline-preflight`, application baseline `ba826de1e5c959352e4442ab2fec5d02445dd32d`. No application/security implementation changed. No staging attacks or production access.
-
-Read the external master, complete Phase 00 prompt, ROE/finding/release/scan-register templates, repository auditor skill, Codex Security policy and standard-scan skill instructions. Remaining stage prompts must be read before entering their stages. The old master heading “DO NOT START THIS NOW” is superseded for permitted offline work by the owner's later direct execution instruction; protected gates remain.
-
-Verified inventory: package.json identifies Next 16.4.1, React 19/MUI/TypeScript; API csproj targets .NET 9 with EF SQLite and Pomelo MariaDB, Identity/JWT, Stripe, MailKit; Python requirements identify FastAPI/transformers/document dependencies. These are source dependencies, not deployed identities or proven reachable features. Architecture overview documents nginx/static export -> API -> DB/files/internal AI and provider boundaries; runtime exposure remains unverified. Preserve canonical Career Profile, CV null-as-inherit overrides, letter history and JobApplication.Version/RD21 contracts. No technology-version vulnerability claim is made without advisory/reachability analysis.
-
-Baseline evidence reused from this exact source ancestry: P10-04 has 89 backend and 92 frontend tests passing, independently source-bound native artifacts. CLEAN-20 has five focused browser checks plus type/lint/build evidence. These are regression evidence, not a completed security audit; this new worktree did not rerun them. Backup parser repair exists on a separate published branch and is not integrated here.
-
-Plugin exposure: standard/deep scan, draft/artifact/progress tools and documented skill files are available. The actual policy resolver ran successfully and found only docs/cv-import/SECURITY.md and docs/redesign/phase-9/p9-requal-01/SECURITY.md. Neither is an inherited root policy for API/UI source. No baseline/deep scan has run. Root policy creation needs exact proposed diff and separate owner approval under define-security-policy; defer that decision while independent source review continues. No new charge approved; deep scan remains blocked.
-
-Execution order: finish inventory/threat boundaries and baseline policy review; standard scan after required preflight/gates; deep scan only with cost scope; phases 02–12 offline review/fixture work in source order; active phase 13 only with approved isolated target; remediation and independent retest; final full standard/diff scans; human release gate. Read every applicable subordinate prompt before its work. Do not treat these milestones as complete based on this plan.
-
-Open: approved ROE/staging isolation, complete trust-boundary/endpoint matrix, root policy decision, baseline/final scans, deep-scan allowance, full independent audit, provider/device/CI/deployment identity and live backup/restore. Security release recommendation: BLOCKED/NO-GO pending evidence. No new vulnerability has been asserted in Phase 00.
-
-Next permitted action: read Phase 01 and the linked architecture topics, verify endpoint/actor boundaries from source, and prepare the policy proposal without writing an unapproved root policy. No user input is immediately required for that review.

docs/security/ATTACHMENT_OWNERSHIP_REVIEW.md

@@ -1,11 +0,0 @@
-# Attachment ownership follow-through
-
-2 November 2026. Source review plus bounded existing relational fixtures; not complete Phase 05, integrated security testing or deployed acceptance.
-
-AttachmentsController.FindOwnedAttachmentAsync:42–47 includes JobApplication while selecting the raw child ID. JobTrackerContext:169–170 denies missing owners and filters JobApplication by CurrentUserId; the Attachment relation at 264–268 uses the parent foreign key. Attachment itself does not have a separate owner filter. Download, Rename and Delete all call this helper. ListForJob first checks the owned JobApplication exists, then limits child rows to that ID. Maintain these relationships; raw child queries without equivalent parent checks are not automatically safe.
-
-AttachmentsControllerTests contains attribute/extension/size reflection tests, not cross-tenant behavioral proof. OwnershipGuardTests similarly checks helper presence. The stronger existing AttachmentConsistencyTests.Another_users_attachment_cannot_be_downloaded_renamed_or_deleted seeds a foreign job/file, clears tracking, checks three NotFound results and verifies the row/file remain.
-
-Fresh targeted execution on the Phase 10 working tree: all 14 AttachmentConsistencyTests passed, zero failures/skips, exit 0, temporary SQLite and synthetic files only. Before execution, git diff between security and Phase 10 branches showed no JobTrackerApi/JobTrackerApi.Tests source difference. Existing Release assembly used --no-build/--no-restore. Evidence published and independently verified on Phase 10 at `db818e5ebd19eeedc05ae58dc3f7a908ce0e713d`, docs/redesign/phase-10/p10-04-evidence/attachment-ownership-and-storage.trx.gz. Uncompressed SHA256 `b589ad1139cb200d9de64b863d65e3304cea0230eda55d89476e5f79347fe84a`.
-
-Result: selected local controller/storage behavior PASSED. Not an authenticated HTTP attack, complete negative list/upload/missing-owner matrix, MariaDB retest, production probe or final scan. Keep those gaps open. No new vulnerability or production exception is asserted; no backend fix was needed for these reviewed paths. Final integrated scan/testing stays deferred until relevant application changes are complete.

docs/security/ENDPOINT_AUTH_MATRIX.csv

@@ -1,10 +0,0 @@
-method,route,source,declared_auth,control_observed,sensitive_asset_or_effect,candidate_test_suite,audit_execution
-GET,/api/attachments/{jobId:int},AttachmentsController.cs:87,local scheme,parent owner-filtered existence check before child listing,attachment metadata,AttachmentConsistencyTests,source reviewed; negative list and HTTP NOT RUN
-GET,/api/attachments/download/{id:int},AttachmentsController.cs:103,local scheme,parent Include ownership filter and managed path checks,attachment bytes,AttachmentConsistencyTests,PASSED foreign-owner controller rejection; HTTP NOT RUN
-PATCH,/api/attachments/{id:int},AttachmentsController.cs:125,local scheme,parent Include ownership filter via shared helper,metadata and AI-use flag,AttachmentConsistencyTests,PASSED foreign-owner controller rejection; HTTP NOT RUN
-DELETE,/api/attachments/{id:int},AttachmentsController.cs:170,local scheme,parent Include ownership filter via shared helper,attachment removal,AttachmentConsistencyTests,PASSED foreign-owner controller rejection with row/file retained; HTTP NOT RUN
-GET,/api/billing/status,BillingController.cs:42,local scheme,method declares local authentication,entitlement status,BillingControllerTests,NOT RUN
-POST,/api/billing/checkout,BillingController.cs:58,local scheme,method declares local authentication; provider mocked only,checkout session,BillingControllerTests,NOT RUN
-POST,/api/billing/portal,BillingController.cs:104,local scheme,method declares local authentication; provider mocked only,billing portal,BillingControllerTests,NOT RUN
-POST,/api/billing/webhook,BillingController.cs:132,AllowAnonymous,signature verification and size limit; full binding audit pending,subscription entitlement,BillingControllerTests,NOT RUN
-PUT,/api/users/{id}/roles,UsersController.cs:142,Admin role at class,privilege transition review pending,account roles,UsersControllerTests,NOT RUN

docs/security/ROOT_POLICY_APPROVAL.md

@@ -1,13 +0,0 @@
-# Root policy approval and resolver verification
-
-3 November2026. Owner explicitly answered **"Approve policy creation and publication"** to the exact41-line SECURITY.md proposal and target in this chat. Approval includes validating the chain and committing/publishing on the security review branch; it does not approve a scan, charge, active testing or production action.
-
-Target was reread and remained absent; HEAD was88bcd6d91c6823ffc6bbc6a6de176ab7769e729f and worktree was clean before creation. Applied text matches the approved candidate exactly after normal newline decoding. Policy LF SHA256: `4ec5365bdc1f84410b596b893463572b035f03d1260f51af722d1c32c8fa3eb3`.
-
-Installed define-security-policy workflow: policy inventory and root/nearest-path guidance reviewed; both existing docs-only policies resolved inside the repository, regular files below1MiB. API had no inherited policy before the change. After creation the actual resolver exited0 for JobTrackerApi and job-tracker-ui with the new root policy, and for docs/cv-import with root plus its existing nearer policy. No inherited policy overwritten. Diff whitespace check passed. No application tests run for this Markdown-only change.
-
-Exact proposal retained through Codex Security managed standalone artifact storage: `artifacts/root-policy-proposal.md`, artifact SHA256 `5d00af57cfa55de2792218916fd9cf646b470d821db6e8afee5c59c76dba116b`, at `C:\Users\Connor\.codex\state\plugins\codex-security\scans\Job-tracker\artifacts-ad2afb630ff68e10e32f349b87541ffb5778071babb98965362c085936a3f385\artifacts\root-policy-proposal.md`. Persistent readback succeeded. This is a standalone document collection, not a scan ID or result.
-
-No new finding exclusion, risk acceptance or severity downgrade. Canonical-profile, tenant, revision, parser/file, AI-consent, provider and recovery invariants remain review requirements, not assertions that all controls already pass. No secret values or private user content read/exported. Source-security and final integrated acceptance remain open.
-
-Next: reconcile the intended immutable integration revision before a baseline scan, finish capability/cost/scope preflight and record actual results. The older offline audit branch is not a final scan of A3 UI changes. Deep allowance and isolated staging remain distinct protected decisions; final integrated scanning follows relevant application changes.