# CV-QA-01 acceptance — 27 October 2026

**Overall: CONDITIONAL GO for the implemented model-independent import workflow and continued development review. Production: NO-GO.** No unconditional extraction, human accessibility, live CV-model or release acceptance is granted. Phase10 is conditionally ready for candidate assessment/planning only; no cleanup implementation starts under this handoff.

## Source, scope and publication

Branch: `test/cv-integration-acceptance`, based on accepted CV-import `ef425c288b38ae0e91dcc216a5c8b6c02c433ab5` and containing CV-UX `4a0af62`. Entry verified actual source/remote/acceptance authority, all84 prior evidence hashes and a fresh70-case MariaDB run. The prior conditional decision permitted this development/QA work, not production.

Application remediations are committed through `89974a257e4192b3d93779000a7df6998afc4051`. The full freeze began at `5e68848` with those changes already in its worktree; before/after hashes bind actual compiled/tested content rather than relying on HEAD alone. **911 frozen files and runtime content remained unchanged**. Three later test/config additions are separately source-bound and qualified, without application/build-input changes. Linux has an independently verified immutable image/source/DLL/migration record. Final reconciliation is [evidence-summary.json](evidence-summary.json).

| Checkpoint | Published commit | Result |
|---|---|---|
| 00 baseline/coverage | `249d068` | Verified accepted ancestry/authority/evidence; fresh real MariaDB70 |
| 01 mapping/new records | `5e68848` | Explicit source-backed authoring/current targets; actual empty-profile creation and rollback |
| 02 interpretation/accuracy | `48b899c` | Conservative labelled multiline/table/list parsing, ambiguity retention and frozen metrics |
| 03 review/merge | `cf0e5c2` | Explicit targets/corrections/reimport, submitted ordering and compatible replay receipts |
| 04 persistence/RD21 | `89974a2` | Actual lifecycle races repaired; status concurrency, retention and terminal-state safety |
| 05 connected journeys | `be67860` | Real Docling through profile/editor/PDF/application/frozen letter/package |
| 06 PDF fidelity | `e416420` | Original Windows/Linux oracles plus long imported three-template output |
| 07 security/resilience | `69f189f` | Actual connection-loss rollback/retry, security/resource/retention evidence |
| 08 usability/manual handoff | `2fdcb60` | Available automation qualified; human/device/contrast/print gates preserved |
| 09 final acceptance | Final report publication | Full regression reconciliation, preservation register and Phase10 handoff; final publication SHA is supplied in the completion message |

Every checkpoint is pushed to the requested branch with remote HEAD checked. No force push, main merge, production deployment, production schema/service/filesystem/model-cache operation or Phase10 implementation was performed by this workstream. Unrelated local tooling, Graphify, Docker and security work is preserved outside these commits.

## Implemented behavior

Before QA, users could accept or correct emitted fields but could not author a missing record/field. Multiline source could attach a later record to an earlier job, repeated text could select the wrong source occurrence, random client-ID sorting could reorder mapped jobs, and lifecycle operations could race with application/retention.

Now users can assign supported canonical fields from owned source evidence, mark their own corrections, deliberately add a record or select an existing revision-bound target, inspect affected values and approve/reject before application. A stale response retains edits but clears destination/confirmation for renewed review. Explicit labels/header-defined order and genuine lists form records; genuinely ambiguous structure remains visible for manual assignment. Source occurrence/page references survive normalization. Submitted order and exact historical receipt replay are preserved. Apply/discard/retention/cancel/retry respect terminal state and canonical transactions.

Career Profile remains canonical; existing services own its revision/history/projections. Source mappings do not create another profile, queue, storage or revision system. CV-only overrides, historical documents, application associations, letters and submitted snapshots remain separate. Actual new-user journeys, multi-record empty-profile provider cases and long imported output prove creation independently from updating existing records.

## Independent decisions

PASS below means the stated finite supported contract, not complete product/human/production acceptance.

| Area | Decision | Basis / limit |
|---|---|---|
| Docling Extraction | **PARTIAL** | Real36-document structural conversion plus connected PDF/DOCX journeys; literal recovery is not arbitrary layout/table semantics; OCR disabled |
| Structured Mapping | **PASS** | Actual allowlisted canonical contracts, source/correction distinction, field/target validation and provider readback; per-field connected evidence limits remain in the mapping matrix |
| New-Record Creation | **PASS** | Independent empty-profile multi-group MariaDB creation; actual source-mapped jobs/education and long12-job/60-skill import |
| Review and Corrections | **PASS** | Source/evidence/current-value controls, correction/rejection/mapping-only apply, explicit approval and stale-target reconfirmation; human usability remains open |
| Duplicate and Conflict Resolution | **PASS** | Conservative exact/revised/older/overlap/similar-employer scenarios, explicit uncertain targets, same-source reimport/replay; no population matching-accuracy claim |
| MariaDB Persistence | **PASS** |80 actual provider tests; atomic children/history/Identity/receipt, rollback, concurrency and actual precommit connection loss with durable retry/replay |
| RD21 Revision Protection | **PASS** | Canonical expected revision and terminal-state guards; real races, six RD21 diagnostics and volume regression; no hosted/power-loss claim |
| CV Editor Integration | **PASS** | Exercised canonical consumption, CV-only changes/revisions, variants, export and application/frozen letter/package preservation; full field-by-field sample limits disclosed |
| PDF Fidelity | **PASS** | Each platform24CV/60pages +4letters/14pages; additional9 imported PDFs/18pages, including142 markers and12 record associations in each long export; human print/typography approval excluded |
| Security and Privacy | **CONDITIONAL** | Scoped static scan0 findings, actual parser/ownership/cleanup/resource tests and current advisory checks; inherited deployment/native-sandbox/privacy/recovery qualifications remain |
| Deterministic Extraction Accuracy | **PARTIAL** | Exact metrics below; unresolved tables, legacy pipe order and wrapped name require user review |
| Real Model Compatibility | **BLOCKED** | No approved isolated CV-model artifact/environment qualified; adapter remains disabled/disconnected |
| Real AI Extraction Accuracy | **BLOCKED** | No real inference; controlled responses never count as model accuracy |
| Human Accessibility/Device Acceptance | **NOT TESTED** | Automated checks and agent visual inspection only; six axe contrast incompletes remain open |
| CV-QA-01 Overall | **CONDITIONAL GO** | Implemented, safely testable workflow delivered; full extraction/human/release acceptance withheld |
| Phase10 Readiness | **CONDITIONAL GO** | Candidate assessment/planning only; no unused deletion candidate verified, cleanup implementation NO-GO |
| Production | **NO-GO** | Unmet release/security/human/operator criteria below; no deployment authorized |

## Regression and accuracy evidence

Full results and native accounting are in [REGRESSION_RESULTS.md](REGRESSION_RESULTS.md): backend **1,336**, frontend **995 /109 suites**, ordinary browser **364**, separate browser configurations **53**, real Docling import browser **7**, actual MariaDB **80**, Python **90**. Original/new benchmark self-checks are11/9, Node helper contracts25, Linux helper contracts11 and legacy seed guards24. Applicable final automated lanes have zero failures/skips/retries. Earlier RED and harness failures remain recorded; overlapping focused/successor runs are not added to totals. TypeScript, lint and builds pass within the documented source bindings.

The separate structural corpus contains18 logical cases, each PDF/DOCX (36 documents). Both formats recover134/134 annotated literal fragments. PDF typed TP100/FP0/FN22: precision100%, recall81.97%, F1 90.09%; DOCX TP122/FP0/FN0: all100%. Source references are PDF24/27 and DOCX27/27; required ambiguity cases6/6 per format. The10-case frozen split is separately reported: PDF47/60 typed facts, DOCX60/60; these overlap the full corpus and are not added.

The unchanged original oracle remains visible: PDF precision93.38%, recall94.63%, derived F1 94.00%; DOCX97.26%/95.30%/96.27%. Its unresolved-source classification and deliberately withheld headerless table facts must not be hidden by better typed-only scores. A wrapped PDF contact name remains truncated, with the omitted word preserved as unresolved source. These synthetic regression results do not estimate population accuracy or real-model quality. See [EXTRACTION_ACCURACY.md](EXTRACTION_ACCURACY.md) and [machine-readable results](benchmarks/RESULTS.json).

## Conditions, impact and required action

| Unmet criterion / evidence | Impact and severity | Required action / owner | Gate scope |
|---|---|---|---|
| Arbitrary PDF table/column relationships; newPDF recall100/122, frozen47/60; original headerless tables withheld | Manual assignment burden; **medium** grouping/completeness limitation. Full automatic extraction GO withheld | Extraction owner preserves unsupported/review boundary, verifies source and extends layout qualification without positional guesses | Does not block unrelated candidate assessment; blocks any broad automatic-accuracy production claim |
| Retained headerless pipe grammar assumes title/qualification before employer/institution (`CvDocumentInterpreter`194–202) | Reversed unsupported order can misattribute critical identity; **high qualification risk**, mitigated by mandatory source review; no silent canonical application | User must correct/map source; developer must qualify/remove this assumption before claiming order-independent extraction | Full semantic acceptance withheld; related cleanup cannot remove review/compatibility; not a blanket block on unrelated Phase10 assessment |
| One original PDF wrapped name splits into two paragraphs; first emitted value lacks final word | **Medium** contact correctness/review burden; complete text remains available | User corrects before approval; extractor owner needs structural evidence to join safely, not surname guessing | Full arbitrary-name accuracy withheld; no unrelated cleanup prohibition |
| Narrow technical-template word wrapping and sparse minimal final page, observed in rendered imports | **Medium/low** readability/page-packing limitations; no lost markers or out-of-page words | Document/manual QA owner reviews settings/templates and records acceptable presentation or a separately scoped fix | Human presentation/print acceptance open; not itself proof of data loss or an unrelated cleanup block |
| Six axe scans: zero violations but one serious color-contrast incomplete each; no actual human/device/AT/native-language/print run | Severity of actual contrast defect **unestablished**; axe flags serious inspection need | Product/QA owners complete [manual checklist](ACCESSIBILITY_AND_MANUAL_QA.md), measured contrast and representative real equipment/language review | Human/release acceptance blocked; candidate-specific accessibility preservation still required |
| CV-model compatibility/semantic accuracy untested; adapter disabled | **High activation gate**; no AI quality/compatibility assurance | Model/security owner supplies approved immutable model/tokenizer digests and safe isolated read-only/offline/bounded environment, resolves cache/dependency qualification, then runs identical frozen schema/grounding/date/association/hallucination/resource tests | Blocks CV-AI activation/claims; does not invalidate the working deterministic path or automatically block unrelated Phase10 development |
| Windows memory is observed rather than kernel-enforced; native parser hook is defense in depth; sustained target-host capacity not qualified | **High release-isolation gate**; bounded local tests cannot prove production exhaustion protection | Infrastructure/security owner qualifies deployment sandbox, egress/filesystem/resource limits and representative-host capacity/recovery | Production security/operations withheld; synthetic development remains permitted |
| Applied candidate/audit includes unselected source facts after original-file expiry; source retention7days or1day plus sweep interval | **Privacy release gate**; canonical rejection is not erasure of source/audit | Privacy/product owner approves disclosed retention/account-erasure/backup handling; no exception accepted by this report | Production privacy decision withheld; no permission to delete audit/compatibility structures during cleanup |
| Latest P9 security conditional disposition:99 fixed/version-verified +10 scoped exclusions; vendorCPU torch PyPI query gap, hosted CI isolation and production filesystem/off-disk restore/deployed identity unresolved | **High release qualification gate**; neither all historically unresolved nor globally cleared | Security/release/operator owners provide current scoped advisory disposition, hosted isolation, immutable deployed identity and actual backup/restore evidence | Production withheld. Authoritative Phase10 candidate criteria remain caller/route/inventory/test proof, not automatic production readiness |
| No unused component/dependency/route verified; active old-run accept and redirects remain | **High deletion risk** if inferred from names alone | Development owner nominates a concrete unused candidate, proves callers/old-data/route/inventory/tests and rollback before seeking separate cleanup authorization | Blocks cleanup implementation now; assessment/planning conditionally ready. No Phase10 work starts automatically |

No reproducible critical lost-data, cross-owner, false-success or broken-transaction defect remains in the qualified current scenarios. This is not a guarantee about untested documents or environments. All57 preservation groups and33 routes remain; historical56 PARTIAL/C11 DEFERRED states are carried forward in [preservation.json](preservation.json) and the dated Phase9 addendum without erasing prior findings.

## Handoff and stop

Use [PHASE_10_HANDOFF.md](PHASE_10_HANDOFF.md) for active compatibility owners, supersession/dependency inventory and candidate requirements. The owner actions above are required before their corresponding acceptance can change. Keep the CV-model adapter disabled; no permanent general-purpose model is selected. This workstream stops after final report publication and remote verification. No main merge, deployment or Phase10 implementation follows from conditional acceptance.