jobtrackingapp/docs/redesign/phase-9/rd21-remediation/COMMANDS.md

# Commands and evidence accounting

Run from repository root unless stated. Every shell invocation uses `rtk`; PowerShell setup is
executed in script files or literal single-quoted `-Command` text to avoid outer-shell expansion.
Use installed dependencies and the pinned SDK; no package installation is required for this record.
The machine-readable [validation](validation.json) contains actual process records, report hashes
and case identities. These commands describe completed local runs, not production instructions.

```powershell
$env:DOTNET_ROOT='C:/Users/Connor/.dotnet'
$env:DOTNET_HOST_PATH='C:/Users/Connor/.dotnet/dotnet.exe'
rtk proxy C:/Users/Connor/.dotnet/dotnet.exe test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore --logger 'trx;LogFileName=backend-final.trx' --results-directory .artifacts/rd21/backend-final
rtk proxy C:/Users/Connor/.dotnet/dotnet.exe build JobTrackerApi/JobTrackerApi.csproj --configuration Release --no-restore
```

From `job-tracker-ui`, final frontend/static/build:

```powershell
rtk proxy node node_modules/jest/bin/jest.js --runInBand --json --outputFile=../.artifacts/rd21/frontend-final.json
rtk proxy npm run typecheck
rtk proxy npm run lint
$env:NEXT_PUBLIC_API_BASE_URL='http://localhost:5302/api'
rtk proxy npm run build
```

Final browser runs use the existing Release API and final static export. Set
`DOTNET_ROOT`/`DOTNET_HOST_PATH` as above, `PLAYWRIGHT_STATIC_EXPORT=true`,
`PLAYWRIGHT_PREBUILT_EXPORT=true`, `CV_FIDELITY_OUTPUT=<repo>/.artifacts/rd21/fidelity`,
`CV_SETTINGS_FIDELITY_OUTPUT=<repo>/.artifacts/rd21/settings-fidelity` and a distinct
`PLAYWRIGHT_JSON_OUTPUT_NAME=<repo>/.artifacts/rd21/<lane>.json` for each run. No server reuse.
From `job-tracker-ui`:

```powershell
rtk proxy node node_modules/@playwright/test/cli.js test --list --reporter=json
# Four serial runs, substitute 1/4, 2/4, 3/4, 4/4 and distinct output names.
rtk proxy node node_modules/@playwright/test/cli.js test --shard=1/4 --retries=0 --reporter=list,json --output=../.artifacts/rd21/final-ordinary-shard-1-results
# Each additional config is its own serial run with --retries=0 --reporter=list,json and distinct --output.
rtk proxy node node_modules/@playwright/test/cli.js test --config=../docs/redesign/phase-9/rd21-remediation/diagnostics/playwright.config.ts --retries=0 --reporter=list,json --output=../.artifacts/rd21/final-remediation-results
```

| Lane | Config passed to the same browser command |
| --- | --- |
| AI withholding | `playwright.cv-ai.config.ts` |
| Auth recovery | `playwright.auth-recovery.config.ts` |
| Rate limits | `playwright.rate-limits.config.ts` |
| Ingress | `playwright.ingress.config.ts` |
| PDF admission | `playwright.pdf.config.ts` |
| Preferences | `../docs/redesign/phase-5/p5-15/p5-15-01/diagnostics/playwright.config.ts` |
| Historical diagnostic | `../docs/redesign/phase-9/p9-05/diagnostics/playwright.config.ts` |
| Historical volume | `../docs/redesign/phase-9/p9-05/volume/playwright.config.ts` |
| Conforming volume copy | `../docs/redesign/phase-9/rd21-remediation/volume/playwright.config.ts` |

The two historical commands exit 1 because their original unversioned Career seeds expect 200
but now receive 400. They remain unchanged; no skips or retries hide those failures. Conforming
companions supply the source precondition and preserve original assertions/ordering, with stronger
independent persisted-state checks. Original baseline reproduction ran `data.spec.ts` using the
historical config at the baseline commit; `original-reproduction.json` stores its unsafe values.

New diagnostic/volume TypeScript files are checked separately with the installed `tsc`, using
`--noEmit --skipLibCheck --target es2022 --module commonjs --moduleResolution node --esModuleInterop --typeRoots job-tracker-ui/node_modules/@types --types node`
and explicit config/spec filenames from the repository root. An initial root invocation without
the explicit installed Node type root failed type resolution; the corrected command exits 0.
No package or source change was needed. This does not build or alter the static export.

From repository root, sidecar and offline security:

```powershell
# Run the following pytest from tools/summarizer with SKIP_MODEL_LOAD=1.
rtk proxy .venv/Scripts/python.exe -m pytest -q tests --junitxml=<repo>/.artifacts/rd21/sidecar.xml
rtk proxy python scripts/test-supply-chain.py
rtk proxy python scripts/test-ollama-evaluation.py
rtk proxy python scripts/test-browser-runtime-retry.py
rtk proxy python scripts/test-ingress.py
rtk proxy python scripts/supply-chain.py scan-secrets
rtk proxy python scripts/supply-chain.py generate-sbom --output .artifacts/rd21/sbom.json
rtk proxy node --test job-tracker-ui/scripts/audit-dependencies.test.mjs job-tracker-ui/scripts/localSMTPfixture.test.mjs
rtk proxy node --test browser-extension/tests/capture-url.test.mjs
```

Final shard 1 produces the native PDFs/previews. Merge the four Settings measurement files into
`settings-fidelity/measurements.json` preserving all eight fixtures; validate both corpora with
the unchanged oracle using bundled Python with PDF dependencies:

```powershell
rtk proxy C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe scripts/verify-cv-fidelity.py .artifacts/rd21/fidelity
rtk proxy C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe scripts/verify-cv-fidelity.py .artifacts/rd21/settings-fidelity
```

The actual provenance includes full expanded argv, producer/exit hashes and all PDF/preview input
hashes stable before/after oracle runs. Oracle tolerances and historical source files were unchanged.
The new volume config/spec are separately bound to original source hashes; one fixture precondition
is the only semantic delta. Discovery is list-only and not counted as executed or skipped cases.

Read-only provider probes: `rtk proxy docker info --format '{{json .ServerVersion}}'`, equivalent
`--context default`/`desktop-windows` info probes, executable lookup for
`mariadbd,mysqld,mariadb,mysql`, and Program Files directory checks. All were unavailable; no
service restart, download or connection to a production instance was attempted.

Final hygiene uses `rtk git diff --check`, tracked-secret scan, local Markdown link existence,
878-input SHA256 comparison, exact discovery/case reconciliation and a diff against the Phase 9
baseline to reject any modified historical Phase 9 file. Normal Git push is restricted to the fix
branch; direct `ls-remote` equality and unchanged main are verified after the reporting commit.