# Commands and evidence accounting Run from repository root unless stated. Every shell invocation uses `rtk`; PowerShell setup is executed in script files or literal single-quoted `-Command` text to avoid outer-shell expansion. Use installed dependencies and the pinned SDK; no package installation is required for this record. The machine-readable [validation](validation.json) contains actual process records, report hashes and case identities. These commands describe completed local runs, not production instructions. ```powershell $env:DOTNET_ROOT='C:/Users/Connor/.dotnet' $env:DOTNET_HOST_PATH='C:/Users/Connor/.dotnet/dotnet.exe' rtk proxy C:/Users/Connor/.dotnet/dotnet.exe test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore --logger 'trx;LogFileName=backend-final.trx' --results-directory .artifacts/rd21/backend-final rtk proxy C:/Users/Connor/.dotnet/dotnet.exe build JobTrackerApi/JobTrackerApi.csproj --configuration Release --no-restore ``` From `job-tracker-ui`, final frontend/static/build: ```powershell rtk proxy node node_modules/jest/bin/jest.js --runInBand --json --outputFile=../.artifacts/rd21/frontend-final.json rtk proxy npm run typecheck rtk proxy npm run lint $env:NEXT_PUBLIC_API_BASE_URL='http://localhost:5302/api' rtk proxy npm run build ``` Final browser runs use the existing Release API and final static export. Set `DOTNET_ROOT`/`DOTNET_HOST_PATH` as above, `PLAYWRIGHT_STATIC_EXPORT=true`, `PLAYWRIGHT_PREBUILT_EXPORT=true`, `CV_FIDELITY_OUTPUT=/.artifacts/rd21/fidelity`, `CV_SETTINGS_FIDELITY_OUTPUT=/.artifacts/rd21/settings-fidelity` and a distinct `PLAYWRIGHT_JSON_OUTPUT_NAME=/.artifacts/rd21/.json` for each run. No server reuse. From `job-tracker-ui`: ```powershell rtk proxy node node_modules/@playwright/test/cli.js test --list --reporter=json # Four serial runs, substitute 1/4, 2/4, 3/4, 4/4 and distinct output names. rtk proxy node node_modules/@playwright/test/cli.js test --shard=1/4 --retries=0 --reporter=list,json --output=../.artifacts/rd21/final-ordinary-shard-1-results # Each additional config is its own serial run with --retries=0 --reporter=list,json and distinct --output. rtk proxy node node_modules/@playwright/test/cli.js test --config=../docs/redesign/phase-9/rd21-remediation/diagnostics/playwright.config.ts --retries=0 --reporter=list,json --output=../.artifacts/rd21/final-remediation-results ``` | Lane | Config passed to the same browser command | | --- | --- | | AI withholding | `playwright.cv-ai.config.ts` | | Auth recovery | `playwright.auth-recovery.config.ts` | | Rate limits | `playwright.rate-limits.config.ts` | | Ingress | `playwright.ingress.config.ts` | | PDF admission | `playwright.pdf.config.ts` | | Preferences | `../docs/redesign/phase-5/p5-15/p5-15-01/diagnostics/playwright.config.ts` | | Historical diagnostic | `../docs/redesign/phase-9/p9-05/diagnostics/playwright.config.ts` | | Historical volume | `../docs/redesign/phase-9/p9-05/volume/playwright.config.ts` | | Conforming volume copy | `../docs/redesign/phase-9/rd21-remediation/volume/playwright.config.ts` | The two historical commands exit 1 because their original unversioned Career seeds expect 200 but now receive 400. They remain unchanged; no skips or retries hide those failures. Conforming companions supply the source precondition and preserve original assertions/ordering, with stronger independent persisted-state checks. Original baseline reproduction ran `data.spec.ts` using the historical config at the baseline commit; `original-reproduction.json` stores its unsafe values. New diagnostic/volume TypeScript files are checked separately with the installed `tsc`, using `--noEmit --skipLibCheck --target es2022 --module commonjs --moduleResolution node --esModuleInterop --typeRoots job-tracker-ui/node_modules/@types --types node` and explicit config/spec filenames from the repository root. An initial root invocation without the explicit installed Node type root failed type resolution; the corrected command exits 0. No package or source change was needed. This does not build or alter the static export. From repository root, sidecar and offline security: ```powershell # Run the following pytest from tools/summarizer with SKIP_MODEL_LOAD=1. rtk proxy .venv/Scripts/python.exe -m pytest -q tests --junitxml=/.artifacts/rd21/sidecar.xml rtk proxy python scripts/test-supply-chain.py rtk proxy python scripts/test-ollama-evaluation.py rtk proxy python scripts/test-browser-runtime-retry.py rtk proxy python scripts/test-ingress.py rtk proxy python scripts/supply-chain.py scan-secrets rtk proxy python scripts/supply-chain.py generate-sbom --output .artifacts/rd21/sbom.json rtk proxy node --test job-tracker-ui/scripts/audit-dependencies.test.mjs job-tracker-ui/scripts/localSMTPfixture.test.mjs rtk proxy node --test browser-extension/tests/capture-url.test.mjs ``` Final shard 1 produces the native PDFs/previews. Merge the four Settings measurement files into `settings-fidelity/measurements.json` preserving all eight fixtures; validate both corpora with the unchanged oracle using bundled Python with PDF dependencies: ```powershell rtk proxy C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe scripts/verify-cv-fidelity.py .artifacts/rd21/fidelity rtk proxy C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe scripts/verify-cv-fidelity.py .artifacts/rd21/settings-fidelity ``` The actual provenance includes full expanded argv, producer/exit hashes and all PDF/preview input hashes stable before/after oracle runs. Oracle tolerances and historical source files were unchanged. The new volume config/spec are separately bound to original source hashes; one fixture precondition is the only semantic delta. Discovery is list-only and not counted as executed or skipped cases. Read-only provider probes: `rtk proxy docker info --format '{{json .ServerVersion}}'`, equivalent `--context default`/`desktop-windows` info probes, executable lookup for `mariadbd,mysqld,mariadb,mysql`, and Program Files directory checks. All were unavailable; no service restart, download or connection to a production instance was attempted. Final hygiene uses `rtk git diff --check`, tracked-secret scan, local Markdown link existence, 878-input SHA256 comparison, exact discovery/case reconciliation and a diff against the Phase 9 baseline to reject any modified historical Phase 9 file. Normal Git push is restricted to the fix branch; direct `ls-remote` equality and unchanged main are verified after the reporting commit.