jobtrackingapp/docs/redesign/phase-9/rd21-remediation/COMMANDS.md

Commands and evidence accounting

Run from repository root unless stated. Every shell invocation uses rtk; PowerShell setup is executed in script files or literal single-quoted -Command text to avoid outer-shell expansion. Use installed dependencies and the pinned SDK; no package installation is required for this record. The machine-readable validation contains actual process records, report hashes and case identities. These commands describe completed local runs, not production instructions.

$env:DOTNET_ROOT='C:/Users/Connor/.dotnet'
$env:DOTNET_HOST_PATH='C:/Users/Connor/.dotnet/dotnet.exe'
rtk proxy C:/Users/Connor/.dotnet/dotnet.exe test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore --logger 'trx;LogFileName=backend-final.trx' --results-directory .artifacts/rd21/backend-final
rtk proxy C:/Users/Connor/.dotnet/dotnet.exe build JobTrackerApi/JobTrackerApi.csproj --configuration Release --no-restore

From job-tracker-ui, final frontend/static/build:

rtk proxy node node_modules/jest/bin/jest.js --runInBand --json --outputFile=../.artifacts/rd21/frontend-final.json
rtk proxy npm run typecheck
rtk proxy npm run lint
$env:NEXT_PUBLIC_API_BASE_URL='http://localhost:5302/api'
rtk proxy npm run build

Final browser runs use the existing Release API and final static export. Set DOTNET_ROOT/DOTNET_HOST_PATH as above, PLAYWRIGHT_STATIC_EXPORT=true, PLAYWRIGHT_PREBUILT_EXPORT=true, CV_FIDELITY_OUTPUT=<repo>/.artifacts/rd21/fidelity, CV_SETTINGS_FIDELITY_OUTPUT=<repo>/.artifacts/rd21/settings-fidelity and a distinct PLAYWRIGHT_JSON_OUTPUT_NAME=<repo>/.artifacts/rd21/<lane>.json for each run. No server reuse. From job-tracker-ui:

rtk proxy node node_modules/@playwright/test/cli.js test --list --reporter=json
# Four serial runs, substitute 1/4, 2/4, 3/4, 4/4 and distinct output names.
rtk proxy node node_modules/@playwright/test/cli.js test --shard=1/4 --retries=0 --reporter=list,json --output=../.artifacts/rd21/final-ordinary-shard-1-results
# Each additional config is its own serial run with --retries=0 --reporter=list,json and distinct --output.
rtk proxy node node_modules/@playwright/test/cli.js test --config=../docs/redesign/phase-9/rd21-remediation/diagnostics/playwright.config.ts --retries=0 --reporter=list,json --output=../.artifacts/rd21/final-remediation-results

Lane	Config passed to the same browser command
AI withholding	playwright.cv-ai.config.ts
Auth recovery	playwright.auth-recovery.config.ts
Rate limits	playwright.rate-limits.config.ts
Ingress	playwright.ingress.config.ts
PDF admission	playwright.pdf.config.ts
Preferences	../docs/redesign/phase-5/p5-15/p5-15-01/diagnostics/playwright.config.ts
Historical diagnostic	../docs/redesign/phase-9/p9-05/diagnostics/playwright.config.ts
Historical volume	../docs/redesign/phase-9/p9-05/volume/playwright.config.ts
Conforming volume copy	../docs/redesign/phase-9/rd21-remediation/volume/playwright.config.ts

The two historical commands exit 1 because their original unversioned Career seeds expect 200 but now receive 400. They remain unchanged; no skips or retries hide those failures. Conforming companions supply the source precondition and preserve original assertions/ordering, with stronger independent persisted-state checks. Original baseline reproduction ran data.spec.ts using the historical config at the baseline commit; original-reproduction.json stores its unsafe values.

New diagnostic/volume TypeScript files are checked separately with the installed tsc, using --noEmit --skipLibCheck --target es2022 --module commonjs --moduleResolution node --esModuleInterop --typeRoots job-tracker-ui/node_modules/@types --types node and explicit config/spec filenames from the repository root. An initial root invocation without the explicit installed Node type root failed type resolution; the corrected command exits 0. No package or source change was needed. This does not build or alter the static export.

From repository root, sidecar and offline security:

# Run the following pytest from tools/summarizer with SKIP_MODEL_LOAD=1.
rtk proxy .venv/Scripts/python.exe -m pytest -q tests --junitxml=<repo>/.artifacts/rd21/sidecar.xml
rtk proxy python scripts/test-supply-chain.py
rtk proxy python scripts/test-ollama-evaluation.py
rtk proxy python scripts/test-browser-runtime-retry.py
rtk proxy python scripts/test-ingress.py
rtk proxy python scripts/supply-chain.py scan-secrets
rtk proxy python scripts/supply-chain.py generate-sbom --output .artifacts/rd21/sbom.json
rtk proxy node --test job-tracker-ui/scripts/audit-dependencies.test.mjs job-tracker-ui/scripts/localSMTPfixture.test.mjs
rtk proxy node --test browser-extension/tests/capture-url.test.mjs

Final shard 1 produces the native PDFs/previews. Merge the four Settings measurement files into settings-fidelity/measurements.json preserving all eight fixtures; validate both corpora with the unchanged oracle using bundled Python with PDF dependencies:

rtk proxy C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe scripts/verify-cv-fidelity.py .artifacts/rd21/fidelity
rtk proxy C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe scripts/verify-cv-fidelity.py .artifacts/rd21/settings-fidelity

The actual provenance includes full expanded argv, producer/exit hashes and all PDF/preview input hashes stable before/after oracle runs. Oracle tolerances and historical source files were unchanged. The new volume config/spec are separately bound to original source hashes; one fixture precondition is the only semantic delta. Discovery is list-only and not counted as executed or skipped cases.

Read-only provider probes: rtk proxy docker info --format '{{json .ServerVersion}}', equivalent --context default/desktop-windows info probes, executable lookup for mariadbd,mysqld,mariadb,mysql, and Program Files directory checks. All were unavailable; no service restart, download or connection to a production instance was attempted.

Final hygiene uses rtk git diff --check, tracked-secret scan, local Markdown link existence, 878-input SHA256 comparison, exact discovery/case reconciliation and a diff against the Phase 9 baseline to reject any modified historical Phase 9 file. Normal Git push is restricted to the fix branch; direct ls-remote equality and unchanged main are verified after the reporting commit.