# Part A — production release decision — 2026-10-08

**Production decision: NO-GO.** The completed redesign remains a release candidate. Critical production safety evidence is unavailable, so no production-branch merge/push or deployment was performed. No production configuration, service, database, volume, backup or credential was changed; no production endpoint or model was contacted in this assessment.

Assessed source: **`1095ef1d29856a2984cd800abd2bbd65dd472d38`**, `codex/ui-redesign-phase4`. A fresh `git fetch origin` and `git ls-remote --symref` confirm production target **`main`**, **`27657f31131cd95d42f0e1290853ec9c9b3959a4`**, at `https://git.cesnimda.uk/cesnimda/jobtrackingapp.git`. Remote HEAD points to `main`; no remote `master` exists. The candidate has 45 additional commits and zero target-only commits. **Release/merge commit and deployed candidate SHA: none.**

## Deployment boundary

Both the fetched `main` and candidate [Gitea workflow](../../../../.gitea/workflows/ci-deploy.yml) run tests on `main` pushes and pull requests. A successful complete `test` job automatically enables deployment only for a push to `refs/heads/main`. Deployment uses the established `PROD_HOST`, `PROD_USER` and `PROD_SSH_KEY` secret mechanism, resets `/opt/job-tracker/app` to the workflow SHA and invokes [deploy.sh](../../../../deploy/deploy.sh). A `main` push is therefore a production action. Actual remote branch-protection settings and candidate runner acceptance were not verified.

No usable production connection was established. The permitted repository material supplies secret names rather than a verified SSH alias/user, and the current `C:/Users/Connor/.ssh/config` existence check returned false. Historical operator access does not provide a current connection. No connection was guessed and no secret values, private keys, live `.env`, cookies or authentication state were retrieved.

## Critical evidence and remediation

| Gate | Current result and evidence required |
|---|---|
| **F04/B06 actual ingress** | **Open.** Obtain the deployed revision/image IDs, real Traefik placement/router/TLS/upstream/forwarding settings, generated nginx trust entries and observed original socket peer. Show that an untrusted route has a different source, that edge spoofing cannot select client IP/scheme/host, and that the API receives the intended client identity. A shared NAT source for trusted and untrusted paths is a stop condition; use an explicitly reviewed binding/firewall or dedicated proxy route before trusting that peer. |
| **Listeners, network and external boundary** | **Unverified.** Inspect actual published/container/host listeners, network membership, Docker NAT/FORWARD and provider/host IPv4/IPv6 controls. From an independent external network, verify direct/spoofed application denial, every intended A/AAAA address, valid TLS and a reachable canonical HTTP redirect. The historical redirect to unreachable HTTPS port `444` has not been reverified or closed. |
| **Real-chain runtime and identity** | **Unverified.** On an isolated equivalent topology, prove real nginx startup/configuration rejection/restart stability, trusted/untrusted forwarding, actual backend client-IP observations, A/B rate-budget isolation and B02 account/session context behavior. Local API/Compose tests do not establish the deployed chain. |
| **Current backup and restore** | **Unverified.** Inventory a fresh complete database/files/CV/exports/Data Protection keys/tombstones recovery set, integrity, custody, retention and off-host protection. Restore a current production backup into an isolated target; compare counts/content/non-ASCII data, boot the application and prove decryption and deletion-tombstone replay. Historical seeded MariaDB restoration and old gzip-valid database-only dumps are insufficient. |
| **Configuration, schema and rollback** | **Unverified.** Confirm the actual database provider/connection, schema/migration history, canonical origin/auth/ingress configuration, current version/counts and recoverable prior images. Rehearse failure injection and code/image rollback on a disposable Linux host with the intended topology, preserving data and failed deployment status. The existing script is a mechanism, not rehearsal evidence. F19's startup fallback to SQLite remains open; confirm the intended provider rather than accepting empty fallback data. |
| **Protected CI, deployment and authenticated acceptance** | **Unverified.** Obtain complete candidate remote test/browser results through the protected workflow. After every critical pre-release gate permits deployment, record actual deployment completion, matching SHA/version, `/health`, `/ready` and public auth configuration. Verify existing-account login, owner/account separation, application/company counts, Career Profile/languages, workspace, CV variants/themes/public PDF and an existing attachment; verify configured OAuth/email/provider paths with authorized test accounts. Local tests and public health alone cannot establish these outcomes. |

Use the current [deployment checklist](../../../infrastructure/deployment.md), [backup requirements](../../../infrastructure/backups.md), [disaster recovery guidance](../../../infrastructure/disaster-recovery.md) and [migration compatibility rules](../../../database/migrations.md). The [historical B06 operator handoff](../../../_archive/pre-docs-cleanup-2026-09-11/docs/audits/2026-09-07/validation/b06-completion.md#required-deployment-verification--exact-safe-procedure) retains the exact read-only inventory, sanitized output and SYN-only peer procedure. It is a procedure and historical evidence, not current production acceptance. Restart, invalid-configuration, failure-injection and restore rehearsals belong on isolated targets; no live destructive operation is authorized by this record.

The Git migration comparison adds **no DDL migration**: three historical migration files change documentation comments only, and the snapshot adds concurrency metadata to the existing CV `Version` property. Compose is unchanged. Existing startup migration/reconciliation still runs, so the actual deployed schema/provider and recovery evidence remain required.

## Authorized continuation and preserved deferral

**Connor's current instruction authorizes local P5-14 independently of production release.** This supersedes the historical release-first continuation condition for that work. Production NO-GO does not stop the authorized P5-14 checkpoint for currently implemented CV workflows. Its acceptance must retain the absent P5-13 AI-review journey and all production/accessibility limitations explicitly; no unconditional Phase 5 completion follows from this scope revision.

P5-13 remains **DEFERRED — BLOCKED / NOT QUALIFIED**: no new qualification calls or human reviews, and no AI-review UI implementation. Preserve the existing Production guard in [Program.cs](../../../../JobTrackerApi/Program.cs): `CvAiSuggestionService` is registered only outside Production, so proposal generation and Apply use the established `503 cv_ai_unavailable` boundary before model requests or CV/profile/history mutation. Other AI registrations and ordinary CV editing/save/history/preview/PDF remain under their existing boundaries. This repository guard is not proof of the current deployed service. The frozen [qualification packet](../p5-13-qualification/README.md) and [return conditions](../OPEN_BLOCKERS.md#p5-13-deferred-debt-and-return-conditions--2026-10-08) remain intact; no Docker recovery or semantic qualification was attempted.

Preservation is reconciled through the existing [57-group preservation review](../release-readiness/PRESERVATION_REVIEW.md), original requirements and per-slice successor evidence. That mapping retains its provider/manual/production gaps; it is not an exhaustive coverage percentage or acceptance of every sub-workflow. P5-14 must add its own bounded evidence without removing inherited requirements.

## Final validation

Fresh validation against unchanged application/test/configuration source at `1095ef1`, before P5-14 changes:

| Check | Actual result |
|---|---|
| Backend Release / focused AI / revision safety | **1,023 / 108 / 5 passing**; focused cases are subsets of the backend total |
| Frontend Jest | **455 passing**, 81 suites |
| Chromium application browser | **112 actual passing**, zero skips/failures/retries; P2-D01 is an ordinary passing case |
| Native real-HTTP contracts | **2 passing**, including isolated Production withholding and unrelated-AI availability |
| Sidecar | **49 passing**, offline synthetic tests, no model qualification |
| Rate-limit / ingress / PDF admission / Compose configuration | **9 / 6 / 1 / 3 passing** |
| Standard preview/PDF fidelity | **16/16**, **36 = 36 pages**, existing dimensional/position/font/colour tolerances unchanged |
| Settings export fidelity | **8/8**, **24 = 24 pages**, existing tolerances unchanged |
| TypeScript / separate browser TypeScript / lint | Passing |
| Frontend production / API Release / test-project Release builds | Passing; API/test builds have zero warnings/errors |
| Supply-chain helpers / offline evaluation harness / extension tests | **3 / 5 / 3 passing**; harness tests do not make model calls |
| Secrets / working and staged whitespace / documentation links | Passing; 158 current/root Markdown targets checked, historical archive excluded |

No test-count changes. Raw TRX/XML, browser/Jest reports, exported PDFs, measurements and comparisons are retained under ignored `.artifacts/p5-release-decision/`; [VALIDATION.json](VALIDATION.json) records counts, commands and incomplete accessibility checks. The browser run retained **229 axe scans**, zero reported violations and **1,712 incomplete node occurrences** (1,466 contrast, 191 prohibited-attribute, 33 hidden-focus, 18 valid-value and 4 table-header). Incomplete checks and human screen-reader acceptance are **open**, not passes. Existing themed/localised responsive workflows ran, but native hardware touch and production font/photo qualification are not established by Chromium.

An initial specialized-suite command used an incorrectly constructed CLI argument and found zero tests; it was corrected and all three explicit configurations ran. That accidental development-server launch generated two Next.js instruction files; their generator/provenance was verified and only those generated artifacts were removed. No application source changed or check was weakened.

The release decision remains **NO-GO** despite these local passes. This documentation checkpoint authorizes no production merge, push or deployment; P5-14 continues separately on the existing development history.