jobtrackingapp/docs/audits/2026-09-07/validation/implementation-queue.md

# Validated implementation queue

Companion to the [independent verdict](README.md). This is a proposed queue, not authorization to start implementation. Original finding IDs remain stable; V01 strengthens F08 and V02 strengthens F11. No application changes were made by this pass.

**Status update, 2026-09-09:** the user separately authorized B01–B05, now complete locally: [B01](b01-completion.md), [B02](b02-completion.md), [B03](b03-completion.md), [B04](b04-completion.md), [B05](b05-completion.md). B05 resolves F05 under its documented spreadsheet-text policy; actual Excel before/after proves the arithmetic formula is now text and Norwegian encoding is preserved. Final verification: 902 selected backend, 298 frontend, 18 browser tests, nine B04 rate-policy HTTP scenarios and the unchanged B03 admission probe pass. Release builds and targeted lint pass; R01a's pre-existing standalone TypeScript error remains. HTTP F11/V02, F08/V01 and F06 are resolved locally; overall F11 remains open for B07/deployment. F03 admission is resolved locally; R04 containment/capacity evidence remains open. **B06 was subsequently authorized; implementation and pending verification are recorded below.**

**B06 runtime follow-up, 2026-09-09:** [Report and operator handoff](b06-completion.md#runtime-verification-follow-up-2026-09-09). **Implementation complete; full runtime/production verification incomplete; F04 open.** Fresh 166 focused backend, 3 Compose, 6 Production HTTP and 9 B04 HTTP checks pass. Public DNS/valid HTTPS are now observed; direct ports 3000/5202/8080 are unreachable from this workstation, without proof of the rejecting layer. HTTP redirects to unreachable HTTPS port 444. Docker's inference socket failure still blocks actual Compose/Traefik/nginx tests; production peers, backend client IP and host/provider firewall remain unverified. No SSH alias/user was found in permitted non-secret sources. B01–B05 preserved; B07 not started.

**Sizing:** S = one narrow boundary/configuration change and its meaningful tests; M = one cohesive service/API/client contract that can be understood, implemented, tested and reviewed in one focused session. These are scope estimates, not elapsed-time promises. If a ticket needs unrelated modules, split it at the acceptance boundary below. Do not create a generic framework merely to make tickets share code.

The numbered order is the default integration order. Independent work may start sooner only along the explicitly permitted parallel branches. A conditional feature can stay disabled while unrelated safe work proceeds; a failed recovery gate blocks migrations, not read-only planning or non-schema tests.

## Batch 0 — Security, identity and immediate admission

**Findings:** F11/V02, F08/V01, F03, F06, F05 and conditional F04. These require no data migration and address the most direct ways to cross a boundary or consume shared resources. CSV remains P2 but is inexpensive and isolated.

| Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
|---|---|---|---|
| **B01 HTTP import destination enforcement** | M. `Services/JobImport/JobImportService.cs`, resolver/address helper only if needed, named import HTTP registration in `Program.cs`, import/network tests. | Normalize mapped addresses and enforce the same approved-address policy at the actual socket connection. Keep HTTP/HTTPS, redirect refusal, bounded content, cancellation and hostname/TLS verification. Before/after tests must show mapped private/link-local targets never reach a connect/send boundary, validation-to-connect DNS changes cannot redirect a socket privately, and an allowed destination still works. | First ticket. No schema. Network-handler rollback reopens the defect; retain the previous handler only as an emergency operational option with equivalent egress restriction. Do not alter all HttpClients. |
| **B02 Cross-account form/session boundary** | M. `src/auth.ts`, `api.ts`, `App.tsx`, profile/editor state binding, a narrow server precondition if required, auth/browser tests. | Bind retained state and outgoing writes to the identity/session generation that loaded it. Synchronize tabs, invalidate owner caches, ignore late responses, refuse mismatched dispatch. Close the shared-cookie race with a server-checked mismatch precondition where client timing alone is insufficient. Test actual A edit → B login in second tab → A Save, asserting B and A database values unchanged; include slow old GET, logout, Back and same-account reauth. | Independent of record revisions, and must precede persistent drafts or editor refactoring. Coordinate `Program.cs` integration with B01/B04 if adding middleware. No schema. Older clients lacking required protection must be forced to refresh/re-auth safely; do not silently fall back to unsafe writes. |
| **B03 Shared PDF admission — complete locally** | M. Singleton exporter, PDF callers/error mapping, exporter tests. | [Completion and evidence](b03-completion.md). Default one active render per process, one per document owner, zero waiting; validated options, safe 503/504, cancellation/timeout/shutdown cleanup and failure recovery. Permanent public/variant/job/profile boundary tests plus real Chromium smoke. Implementation inspection corrected the original package reference: packages do not render PDFs. | No schema. The simultaneous owner allowance is enforced inside the exporter independently of middleware; time-window owner/IP rate limits remain B04. Tune process capacity and verify containment under R04. No durable queue or renderer service added. |
| **B04 Resolve principal before owner limiting — complete locally** | S. `Program.cs`, existing rate-key helper, permanent real HTTP tests. | [Completion, inventory and evidence](b04-completion.md). Authentication **and endpoint authorization** precede account limiting, including explicit-scheme principal selection; validated owner/IP namespaces, shared-IP account isolation, shared same-account sessions/credentials, preserved IP controls, safe 429/Retry-After. Concurrent, crafted identity, invalid credential, B02 context and trusted/untrusted proxy tests pass. | No schema or policy-window changes. B01/B02/B03 preserved. Process-local counters and B06 deployed ingress verification remain explicit. |
| **B05 Spreadsheet-safe CSV fields — complete locally** | S. `ExportController`, small text helper, byte-preserving UI download and export tests. | [Completion and evidence](b05-completion.md). All 13 text columns neutralize leading `= + - @`, including after whitespace/controls/Unicode format characters, before existing CSV escaping. Typed numbers/dates, stored data and JSON remain unchanged. Parser, HTTP/browser-byte and local Excel checks pass; UTF-8 BOM corrects reproduced Norwegian decoding. | No schema/framework/dependency change. Spreadsheet-safe CSV may visibly retain the apostrophe; raw JSON remains available. LibreOffice runtime verification unavailable; defined policy and compatibility limits documented. |
| **B06 Verify and close ingress bypass path — implementation complete; runtime verification pending** | S source/config change plus operator verification. Compose/nginx/forwarded-proxy tests/docs. | [Implementation, runtime observations and gates](b06-completion.md). Production render has frontend 3000 and no API publication. Fresh API/config tests pass. DNS/valid public HTTPS and failed direct-port connections are observed; HTTP redirects to unreachable port 444. Actual Compose/Traefik/nginx execution is blocked by Docker failure; deployed peer/IP/firewall evidence is absent. F04 remains open. | Read-only production inspection authorized, but no unambiguous SSH alias/user exists in permitted sources; use operator handoff. Deployment changes remain separate. Complete real-container and production evidence; do not start B07. A bad binding can cause downtime; retain a tested topology-specific rollback. |
| **B07 IMAP connected-address enforcement** | M. `ImapService`, focused network policy/connector and IMAP SSRF tests. | Reuse the B01 address-policy conclusion, but respect MailKit's transport. Enforce an approved connected peer on initial connection and reconnect; retain certificate hostname validation and timeouts. Existing mapped normalization is already correct: do not fix it again. | After B01 establishes the small shared policy, with sequential integration if it shares helper code. No schema. Test TLS identity with an injected/local fixture; do not disable validation to connect by IP. |

**Batch stop condition:** V01's actual persisted cross-account save is prevented; HTTP/IMAP outbound address paths and shared PDF admission have failing-before/passing-after evidence; correct owner/IP partitioning remains enforced. Actual ingress reachability proof is required before a public deployment. B01 alone does not close all of F11.

## Batch 1 — Release pipeline and recovery before migrations

**Findings:** F12, F17, F19, conditional F20; the immediate containment portion of F03/F18. This batch intentionally precedes schema-changing concurrency and billing work. A migration is not safe merely because its unit tests pass when the recovery/rollback path is unproven.

| Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
|---|---|---|---|
| **R01a Standalone type gate — partially resolved during authorized release repair, 2026-09-10** | S. `interview-prep.test.tsx`, UI package script, CI workflow. | The patched Next build exposed the historical TS2571. A test-only object matcher now preserves the positive/negative content assertions without dereferencing an unknown Axios payload; 13 interview tests, standalone tsc and Next build pass. An explicit standalone CI command remains outstanding; keep strictness and test coverage. See [release evidence](b06-completion.md#release-dependency-gate--2026-09-10-local--2026-09-09-utc). | Can run in parallel with Batch 0. No production-code behavior or schema. Do not weaken the gate to preserve a green build. |
| **R01b Production DB configuration validation** | S. Provider-selection code in `Program.cs` and startup tests. | Fail startup for an unknown production provider or missing required configured connection. Preserve deliberate dev SQLite defaults and valid explicit SQLite/MariaDB. Assert no fallback database is created on rejected startup. | Integrate after Batch 0 `Program.cs` mutations. No schema; rejecting an existing invalid environment can prevent boot, so validate deployed inputs first. |
| **R02 Consistent recovery-set creation** | M. `deploy.sh`, existing backup runner/scripts, isolated fixture and operator documentation. | Replace live SQLite tar as the DB consistency mechanism; coordinate file inventory/checkpoint or a short write pause, manifest/checksums and incomplete-set marking. Preserve keys/tombstone recovery. For MariaDB, coordinate the file set with the consistent SQL dump. | No new app schema. Can develop synthetic fixture in parallel with Batch 0. A backup that is only present is not yet verified. Keep previous verified sets. |
| **R03 Restore drill and schema-compatible rollback** | M. Deploy rollback logic, isolated restore harness and runbook; no production restore in the implementation session. | Restore latest/previous synthetic sets under active-source writes; integrity, FK owner boundaries, attachment hashes, provider-token decryptability and deletion replay must hold. Run previous/new binaries against the intended schema; allow automatic image rollback only when compatible. Record measured RPO/RTO, required key custody and operator steps. | Depends on R02 and Connor's recovery objectives. **Blocks every schema-changing ticket below.** Failed restore is a stop, not permission to reset the source DB. Do not run downgrade migrations automatically. |
| **R04 PDF/container containment evidence** | S/M. API Dockerfile/Compose and bounded local container test. | Verify non-root filesystem permissions, resource/PID limits and renderer operation. Evaluate sandbox/local-file flags against real templates. Measure a small controlled burst after B03 and pick capacity from evidence. | Depends on B03; coordinate Compose changes with B06. Container changes can break rendering/storage; verify permission/health/PDF before rollout. A separate renderer service is a decision only if adequate containment cannot otherwise be demonstrated. |
| **R05 AI worker survival and recovery** | M. `AiOperationQueue.cs`, worker tests/health signal. | Catch at each worker loop, classify cancellation/transient/fatal outcomes, bound retries and expose lost/degraded workers. Inject claim/owner/result persistence failures at concurrency 1 and 2; core host survives recoverable faults, accepted operations resume after lease recovery, no lost result or endless tight retry. | Independent of schema work; required before enabling this worker. Keep its existing kill switch. Do not change the global background exception policy. |

**Batch stop condition:** strict frontend typing and configured-provider startup are deterministic; a recovery set actually restores, and compatibility governs rollback. AI/PDF enabled features need their own containment proof. R03 must be green before Batch 2 or paid-ledger schema changes are applied.

## Batch 2 — Record integrity, intent retries and storage accounting

**Findings:** F01 and the concrete F10 integrity/admission subset. Agree the convention in D01, then apply it to bounded aggregates. Do not introduce a generic concurrency service, universal event sourcing or globally unique job content.

| Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
|---|---|---|---|
| **D01 CV variant revision protocol** | M. CV variant model/service/controller/editor, context migration and CV tests. | Expected revision/conditional update, transactional history, distinct conflict response and retained draft. Reconcile duplicate revision labels preserving every snapshot, then enforce uniqueness. Include restore-versus-save, stale name/settings and old-client handling. Prove with two contexts and SQLite/MariaDB. | B02 + R03. Establish request/response convention before D02/D03. One cohesive vertical change; keep templates/layout/AI tooling outside the diff. Additive rollout first; old unconditional writers must be rejected or refreshed when enforcement starts. Do not revert to an old writer without a compatibility plan. |
| **D02 Career Profile atomic revision/projection** | M. Career profile service/controller/model, legacy user projection, profile page/tests and migration. | Separate aggregate revision from structured-document schema `version`. Atomically replace children, append history and update the derived legacy projection, or document/test a recoverable projection only if a shared transaction is demonstrably impossible. Cover restore, projection-write failure, delete-versus-save and losing drafts. | D01 contract + R03. Preserve old versions/child IDs as required; no identity/profile-field redesign. Same-account transaction correctness does not replace B02. |
| **D03a Job mutation preconditions** | M. Job aggregate/controller/status operations, admin undo and generated-draft writers that touch the same aggregate; model/migration/tests. | Inventory exact conflicting write sets; apply the agreed revision rule to user read-modify-write paths and prevent background writes from silently replacing newer user drafts. One conflict must not partially update events/opportunity projection. Explicitly justify field-disjoint writes allowed to commute. | D01 convention + R03. Own the schema snapshot serially. If inventory is too broad, split status/full-edit and draft-generation writers into consecutive tickets with each unprotected path left visibly open. Do not claim F01 closed between them. |
| **D03b Job client conflict handling** | M. Existing job detail/edit/status/draft client paths and browser tests. | Send loaded revisions, retain losing edits, explain reload/compare/copy without blind retries; delayed responses cannot replace current owner state. | D03a + B02. Integrate before enabling mandatory job preconditions. No independent schema. No dashboard redesign. |
| **D04 Creation intent idempotency** | M. Manual/imported job creation boundary, relevant client submission state, narrow intent persistence and relational tests. | One key per user creation intent, unique owner/key constraint, payload fingerprint and returned resource identity committed with the creation. Same key/same payload returns the original; same key/different payload conflicts; two owners are independent; a deliberate new application uses a new key. Test lost response/retry and concurrent identical requests. | R03 and settled job creation transaction. Can prepare after D01; integrate after D03 schema changes. Do not deduplicate by company/title/URL globally or retrofit every endpoint. Retain intent records for an explicit retry window; expired-key behavior must be documented. |
| **D05 Atomic attachment byte reservation** | M. Attachment admission/storage service, owner quota state and focused migration/tests. | Reserve bytes atomically before staging, release/commit correctly on cancellation/failure; two near-limit uploads cannot both pass. DB transaction/reservation works across processes. Preserve existing staged-file reconciliation and safe path handling. | R03; integrate after other schema tickets. No silently deleted files to meet a quota. Reservation cleanup/reconciliation must survive crashes. |
| **D06 Generated-file accounting** | M. Existing `AccountOwnedFileInventory`, PDF/artifact/package producers, quota reconciliation/tests. | Account for generated artifacts and temporary/retained export copies with explicit limits and cleanup. Reuse D05 accounting contract; avoid counting only attachments or charging the same retained file twice. Test copy/delete/crash and old existing inventory. | D05 + B03. Rollback retains existing files; a reconciliation disagreement blocks new growth safely and alerts, rather than purging unknown user data. |
| **D07 Bounded exports/history growth** | M per export family. Account export first; jobs export separately if needed. | Measure synthetic 1k/10k owner histories, enforce peak-memory/request bounds, stream JSON/rows into the current ZIP/output as needed. Add conservative growth admission where required. Test account export remains available for existing over-quota data. History pruning is excluded until Connor approves restore promises. | D05/D06 for resource contract; R03 for any persistent limits. Do not jump directly to a queued export platform or optimize 100k rows without evidence. No destructive retention migration. |

**Batch stop condition:** stale client writes cannot win silently; histories remain complete/unambiguous; projection/children updates are atomic; creation retries have a stated contract; bytes cannot exceed admission through concurrency or omitted producers. Both providers need meaningful relational evidence. Preserve all pre-migration data and safe old-client behavior.

## Batch 3 — Paid account lifecycle

**Finding:** F02, with retention/deletion policy and conditional premium worker dependencies. Correct entitlement and deletion behavior precedes billing UX. This batch can be prepared earlier, but paid behavior stays gated until it is complete.

| Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
|---|---|---|---|
| **P01 Purchase intent** | M. Billing checkout/gateway, narrow persisted attempt and billing tests. | Stable purchase-attempt identity reused after double-click/timeout, provider idempotency and explicit handling of an existing/pending subscription. Two simultaneous requests and an unknown first result cannot create a second intended purchase. | R03; reuse D04's intent principles, not necessarily its table. Billing schema integration has one owner. Retain attempt/customer IDs during rollback; disable new checkout on unresolved state. |
| **P02 Entitlement reconciliation** | M. Billing handler, entitlement derivation, local transaction/reconciliation and tests. | Reconcile relevant current customer subscriptions, not whichever event's subscription was processed last. Atomically commit local provider state and role consequences; failures cause safe retry. Test active+cancelled subscriptions, delayed/out-of-order/concurrent events, duplicate delivery and failure between local writes. | P01/local identity contract. A synchronous design with provider retries is acceptable; durable inbox only if acknowledging deferred work. Reconciliation must recover missed delivery. Old images cannot safely reinterpret a new billing ledger without a reviewed compatibility plan. |
| **P03 Deletion versus paid lifecycle** | M. Existing deletion stages, billing cancellation seam, UI confirmation only as required and lifecycle tests. | First guard active/uncertain billing and pending checkout. Then implement the chosen cancellation/access policy; retain provider identifiers until confirmed resolution. Retry unavailable provider safely, handle deletion racing checkout/webhooks, and preserve minimal approved billing/deletion records. | P01/P02 + Connor's deletion/retention policy. Sandbox must prove the charged-account scenario. Do not erase the identity then attempt cancellation. Preserve pending stages across rollback; suspend new deletion admission if reconciliation is unhealthy. |

**Batch stop condition:** authorized Stripe sandbox confirms one intended purchase, correct entitlement, provider retry/reconciliation and no continuing unresolved charge after completed deletion. Disabled deletion is a temporary containment state, not completion. Enabled premium features also require R05 where applicable. No paid-beta admission until these conditions and recovery/accessibility gates hold.

## Batch 4 — Accessibility and shared design foundations

**Finding:** F14 plus the test coverage gap. These tickets may begin in parallel early on their own files; their integration must preserve B02/D01 form behavior. Structural fixes come before cosmetic redesign.

| Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
|---|---|---|---|
| **A01 Semantic theme/component colors** | S/M. `src/theme.ts`, necessary shared MUI overrides and loaded-state accessibility fixtures. | Correct small-text success/primary contrast in light/dark default/hover/focus/selected states. Check actual foreground/background pairs across chips, tabs and outlined buttons; preserve filled-button contrast. | Can proceed independently of backend work. No schema. Theme changes have broad visual impact: inspect both themes on existing pages before integration. Do not change every page or replace MUI. |
| **A02 Builder preview keyboard structure** | S. `CvBuilderEditor` preview region and focused browser tests. | Make the overflowing preview region named/focusable as appropriate; prove keyboard scrolling, focus visibility and no trap for iframe/page content. Include mobile→desktop transition, one/multiple pages and editing/preview controls. | A01 can proceed independently, but do not edit this file simultaneously with D01. No schema; avoid blanket tabindex additions. |
| **A03 Accessibility coverage and manual gate** | M test/documentation session; defects found become bounded follow-ups. | Loaded builder/profile/job detail + key dialogs/errors, EN/NB, both themes, mobile and desktop. Wait for meaningful data, not merely main. Complete keyboard/NVDA-or-Narrator, zoom/reflow/text spacing, forced colors and focus/error/reauthentication checks. | A01/A02 and stable B02/D01 conflicts. Automated success cannot substitute for manual evidence. No new accessibility compliance claim from axe alone. |

**Batch stop condition:** primary workflows, save/conflict recovery and preview are operable by keyboard with usable focus and announcements; shared contrast fixes and representative loaded-state axe coverage pass. New primary-flow structural defects block public exposure; purely cosmetic work does not.

## Batch 5 — Product and workflow corrections

**Findings:** F21, F07, F15, F13, F16 and F09. These are scoped product/operational fixes, not grounds for a simultaneous whole-app rewrite.

| Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
|---|---|---|---|
| **W01 Date-only calendar contract** | S/M. Calendar shared event conversion/provider-link/ICS tests and minimal labels if necessary. | Follow-ups/deadlines remain dates and export all-day with correct exclusive end date. Test UTC control, offset-bearing inputs separately, DST transitions and both database/server timezone settings. | Can prepare early; avoid database date migration by default. Resolve any real timed-field evidence separately. Existing external events will not be magically corrected; describe behavior for newly exported events. |
| **W02 Reminder outcome semantics** | M. Reminder worker/sender result contract and existing durable email-attempt seam where reusable. | Distinguish suppressed, accepted, failed and unknown; persist per-reminder outcome/dedup intent. Test later-send failure, commit failure, disabled sender and uncertain SMTP result. Auth resend remains recoverable; do not promise exactly-once SMTP. | Use R05 failure-boundary convention and R03 before any attempt schema. No second email platform. Provider sandbox/local mailbox sink before enabling revised sending. Unknown sends are not blindly replayed. |
| **W03 Sensitive response cache policy** | S. Private export/document/auth response policy and header tests. | Apply appropriate no-store to sensitive personalized responses, retain public/shared route semantics and verify proxy behavior. Handle CSP separately if it affects preview frames. | B02 is independently required; headers do not fix stale React state. No schema. Test public CV/static assets and PDF preview before changing global headers. |
| **W04 Admin event/data minimization** | M. Admin diagnostics and security mutation metadata; targeted logging cleanup may be a separate S ticket. | Minimize unnecessary private fields, record high-impact actor/action/target/outcome, avoid full URLs/documents/provider errors in logs, test role revocation/denied verbs. Preserve intentional admin capabilities. | Connor's actual support/retention policy; R03 before new audit storage. No speculative support role, impersonation or tamper-proof claims. Audit record migration must retain existing evidence. |
| **W05 Draft recovery decision and narrow pilot** | M, one editor only. Existing draft/dirty-state helpers and the chosen editor. | Keep warnings and in-memory edits; if approved, add opt-in owner/schema/expiry-scoped local recovery with explicit restore. Test offline, expired session, denied/quota storage, account change and conflicting revision. | **Must follow B02 and D01/D02**, plus Connor's local-content decision. No service worker/PWA or indiscriminate private caches. Rollback must not mix or silently apply old drafts. |

**Batch stop condition:** each workflow's narrower acceptance passes; no silent time shift, suppressed-as-delivered message, ownerless draft or accidental private logging. Decisions about retention/local drafts remain explicit rather than hidden in implementation defaults.

## Batch 6 — Broader UX and measured operational hardening

**Findings:** remaining F16/F18 and measured F10 scale concerns; original product proposals with no reproduced blocker. CPU admission, quota safety, restore and worker containment are already in earlier batches.

| Order / ticket | Size and ownership | Concrete scope and acceptance | Dependencies / rollback risk |
|---|---|---|---|
| **U01 Route-by-route UX correction** | S/M per chosen workflow, one page/interaction family. | Prioritize observed task completion problems, terminology and empty/error/loading states. Preserve owner/revision/focus primitives. Test the full user task in EN/NB and both themes. | B02/D01–D03/A01–A03. Do not redesign every route in one session; no schema unless separately scoped. Revert one route safely. |
| **O01 Reproducible release inputs** | S/M per build ecosystem. API Docker restore/SDK inputs first, then other lock/pin/scan evidence. | Actual image build honors intended SDK/build props and lock files; retain release provenance and an explicit advisory exception policy. Verify supported versions/current advisories only when external access is authorized. | Coordinate with R04 Dockerfile and R01 CI ownership; do not combine broad runtime upgrades with audit repairs. Rebuild/test the changed artifact and preserve known-good images. |
| **O02 Capacity, monitoring and operator drills** | M per measured bottleneck or drill. | Measure representative rows/export sizes/query plans/RSS; fix demonstrated hotspots, alert on storage, restored-backup age, worker health and billing divergence. Validate support/deletion/key rotation/incident procedures. | Early bounds and recovery already complete. Tune limits with evidence; no speculative Redis, broker, read replica or service split. No destructive load against production. |

**Batch stop condition:** release evidence matches the intended audience and enabled features. Public paid readiness depends on verified real operational/support behavior, not completion of every cosmetic item in the original audit inventory.

## Safe parallel work and prohibited overlap

- B01 HTTP boundary, B02 identity analysis/tests, B03 exporter, B05 CSV, R01a typing, R02 synthetic backup fixture and A01 theme can proceed independently with assigned file ownership. Shared `Program.cs`, CI and Compose edits still integrate sequentially.
- B07 follows the address-policy decision in B01. Do not develop competing outbound-policy helpers or two versions of the same HTTP handler.
- Only **one migration/context snapshot owner** integrates at a time. D01 → D02 → D03a → D04 → D05/P01 schema commits are serialized even if isolated test/client work is prepared in parallel.
- D03b may be prepared against D03a's agreed API but cannot independently change the protocol. P01/P02/P03 share billing state and must integrate in that order; do not build billing UX against unsettled entitlement rules.
- B02/auth/editor lifecycle must settle before W05 persistent drafts. D01 and A02 both touch `CvBuilderEditor`: serialize edits or explicitly divide non-overlapping responsibility and review their combined behavior.
- A01 shared tokens precedes U01 visual redesign. A03 final accessibility evidence follows the combined form/identity/conflict changes, even if fixtures are written earlier.
- R02/R03 may run alongside non-schema security fixes. Their failure blocks migration/deployment advancement; it does not block safe source inspection or independent unit-test preparation.

## B01 first-session handoff — completed 2026-09-08 (scope retained)

**Take B01 only. Objective:** prevent HTTP job import from connecting to private/local/link-local destinations through mapped IPv4 or a validation-versus-connection DNS change, while preserving legitimate imports.

1. Read the validated F11/V02 evidence and current `JobImportService`, `IHostAddressResolver`, named import HttpClient registration and existing import tests. Reproduce the mapped-address guard failure with a non-network fake.
2. Add the narrow mapped-address normalization and move/enforce policy at the actual connection boundary. Prefer the existing .NET HTTP/socket facilities; preserve original hostname/SNI/certificate checks, redirects disabled, bounded response size and cancellation. Do not modify unrelated HttpClients or add a network framework.
3. Add regression tests for IPv4/IPv6/mapped/loopback/link-local/mixed answers, differing resolution answers, allowed address, timeout/cancel and TLS hostname behavior. Use controlled local/fake transport; no real private host/metadata or third-party DNS calls. A validator-only unit test does not prove the DNS race is closed.
4. Run the focused backend import/network tests and the affected API build. Review the diff for accidental request, TLS, proxy or parser changes; document any deployment egress assumptions and the remaining IMAP ticket.

**Owned files:** import service and a narrowly justified adjacent address/connection helper, the named import HTTP registration in `Program.cs`, and related tests. **Excluded:** IMAP implementation (B07), CV/billing/schema/UI changes, deployment, global policy rewrites and dependency upgrades. No migration. If safe connected-peer enforcement cannot be verified locally, retain the passing normalization fix as a bounded partial change but leave B01/F11 open; do not claim validator-only protection closes SSRF.

**Handoff acceptance:** the retained exploit fixtures fail against the original and pass against the change; connection-time tests prove no denied peer is attempted; allowed requests still behave correctly; no TLS relaxation, source data change or unrelated edits. These criteria now pass for B01; see the [completion record](b01-completion.md). Subsequently authorized B02–B05 also pass their local acceptance criteria with documented limits; see their completion records above. B06 was subsequently authorized and implemented, with local topology and production verification still pending. Complete those gates before closure; B07 and the broad overhaul remain unstarted.