jobtrackingapp/docs/redesign/phase-5/release-readiness/README.md

# Completed redesign release preparation — 2026-10-08

**Production decision: NO-GO. No production-branch merge/push or deployment occurred.** This is a release-candidate/deferred-work checkpoint, not a release record asserting that the application is live. Connor authorized release only after safety gates and P5-14 only after verified release. Those conditions remain unmet. No Docker recovery was attempted.

Source: `9c9157507937b3e084a7ca1e79a2ebd77d0b0928`, `codex/ui-redesign-phase4`. Fetched production target: `origin/main` **`27657f31131cd95d42f0e1290853ec9c9b3959a4`**. The source is ahead by 43 commits with zero target-only commits at inspection. Authoritative remote: `origin`, `https://git.cesnimda.uk/cesnimda/jobtrackingapp.git`. No remote `master` exists. The final candidate/debt checkpoint is identified by Git when committed; **release commit and merge commit: none**.

## Release routing and protections

[CI](../../../../.gitea/workflows/ci-deploy.yml) runs on `main` pushes and pull requests. Deployment automatically follows its successful `test` job only for a push to `refs/heads/main`; it uses the established `PROD_HOST`, `PROD_USER`, `PROD_SSH_KEY` mechanism, resets the server checkout to the workflow SHA and invokes [deploy.sh](../../../../deploy/deploy.sh). Do not create/push a new `master`, force-push or treat a feature-branch push as production deployment. No CI secret was read; no current authorized deployment connection/session is available here. Remote protected-runner acceptance remains unverified; local checks cannot replace it.

The normal deployment script validates environment/ingress, takes database/files backups before replacement and aborts if backup fails, then deploys commit-tagged images. Failure rolls back prior backend/frontend images and remains a failure. [Current deployment](../../../infrastructure/deployment.md), [backup](../../../infrastructure/backups.md) and [disaster-recovery](../../../infrastructure/disaster-recovery.md) runbooks require current version/counts, complete restorable recovery set, protected keys/tombstones and actual rollback/restore evidence. The existence of a script or historical seeded restore does not establish a fresh production recovery set.

No new database migration exists between fetched `main` and the source: three historical migration files differ only in documentation comments. The existing CV `Version` property gains concurrency metadata in the model snapshot; no new DDL migration was added. Startup still runs existing migration/reconciliation behavior. Actual deployed schema/provider/connection settings remain unverified; API fallback to SQLite (F19) is still open and must not substitute for confirming correct deployment configuration. Compose is unchanged. New optional external-AI routing entries in `.env.example` were already introduced by grounding readiness; no production environment update is assumed or performed.

## Candidate scope and deferred capability

| Completed local slice | Implementation checkpoint |
|---|---|
| P5-00 shell readiness | `926f2e5`, followed by baseline/concurrent initialization proofs `38cf37e`, `57a6bd0` |
| P5-01 AppShell/grouped navigation | `8e56cea` |
| P5-02 existing global shell utilities | `0f54007`; human screen-reader acceptance remains open |
| P5-03 Jobs Table/mobile cards | `7127005` |
| P5-04a Board presentation | `42a696b` |
| P5-04b shared query/workspace integration | readiness `6fc8937`, integration `384dfa8` |
| P5-06 personal Dashboard | `ec6baae` |
| P5-07 existing-report Analytics destination | `42a6e42` |
| P5-08a Job header/Overview | `fadf99a` |
| P5-08b deeper Job sections | readiness `acd1d94`, implementation `ac6d782` |
| P5-09 CV frame/navigation | revision readiness `046dc30`, pagination repair `efc9e7b`, implementation `44b944e` |
| P5-10 CV section editing/source clarity | `fc9598b` |
| P5-11 live-preview chrome | `673cff1` |
| P5-12 template/document controls | `d8d262e` |
| Deterministic CV grounding/proposal prerequisites | `2398ff3`; model qualification and P5-13 review UI **not accepted** |

Phase 1–4 foundations/evidence remain in the source history. P5-05 quick preview remains deferred. P5-13 semantic qualification/UI remains **DEFERRED — BLOCKED / NOT QUALIFIED** in [OPEN_BLOCKERS](../OPEN_BLOCKERS.md#p5-13-deferred-debt-and-return-conditions--2026-10-08); the frozen [corpus/rubric/recovery package](../p5-13-semantic-qualification/README.md) remains intact. No model qualification calls or human reviews were added. No Phase 5 completion claim is made.

### Withholding unqualified CV review

The candidate exposed both new CV proposal endpoints through the previously shipped CV assistant affordances. A deferred UI alone would not withhold the new API. The smallest release-safety correction uses the controller's existing optional suggestion-service seam: **omit `CvAiSuggestionService` registration in Production**, so generation and Apply return the established **503 `cv_ai_unavailable`** before model requests or CV/profile/history mutation. No feature flag, new concurrency/grounding system or global AI disable is introduced. Development qualification/regression routing remains intact; `ISummarizerService`, AI workspace, job analysis, letters/interview preparation and other AI registrations remain available under their existing authorization/privacy/provider conditions.

Legacy CV assistant controls may remain visible and report existing unavailable errors; no P5-13 review UI is implemented. This is temporary withholding under the explicit deferral, not fulfillment of PRES-C11 model/UI acceptance. Ordinary CV editing/save/history/preview/PDF stays available. The candidate's local Production-mode API proof is separate from live verification: **production availability cannot be asserted without the deployed SHA/session**. This correction has not been deployed.

The application-code change is confined to `JobTrackerApi/Program.cs`: one existing service registration becomes environment-conditional. `CvAiReadinessTests.cs` adds the generation/apply no-write theory cases; `playwright.cv-ai.config.ts` adds a disposable, isolated Production API using the existing fixture configuration; `cv-ai-readiness.spec.ts` verifies the actual HTTP constructor/registration boundary and continued unrelated AI availability. The Production fixture disables launch-profile override and retains Secure-cookie semantics over its explicit test-only loopback transport. No controller, prompt/provider, frontend application, renderer, environment file, Compose, CI, dependency or migration implementation was changed for this checkpoint.

## Production blockers and next evidence

| Gate | Result / action needed |
|---|---|
| **F04 actual ingress/runtime** | **Open, release-blocking.** Existing G-RELEASE requires real Traefik socket peer/nginx trust, effective client IP, listeners/direct/spoofed access, firewall/NAT/IPv6, DNS/TLS/redirect and restart evidence. Local 6-case ingress/3-case Compose checks do not close it. Historical public HTTPS success and connection failures do not prove it; the prior HTTP-to-unreachable-`:444` observation remains unverified today |
| **Current recovery/configuration/schema/rollback** | **Unverified, release-blocking.** Operator must inspect current backend SHA/version and counts, correct provider/connection settings, a fresh complete DB/files/keys/tombstones recovery set and required restore/rollback evidence. No database reset/volume deletion/destructive migration is authorized |
| Protected CI and deploy outcome | **Unverified.** The `main` test job must pass; actual deploy status, deployed SHA and authenticated smoke must be recorded. No main push was performed to discover whether unsafe production gates might pass |
| P5-13 qualification/UI | Explicitly deferred; production CV proposal workflow must stay unavailable until the [return conditions](../OPEN_BLOCKERS.md#p5-13-deferred-debt-and-return-conditions--2026-10-08) pass. Local candidate withholding does not qualify the model or verify current production |
| Human accessibility/font/photo/pointer/touch qualification | Remains open with scope/limitations in each slice; no complete screen-reader/physical-touch certification. Mandatory P5-15 items retained |

Separate debt remains: Dashboard preference-save 500, Board full-result scaling/native touch, deferred `followMode` UI, nested CV drag/drop ownership, incomplete axe/manual checks and other [recorded blockers](../OPEN_BLOCKERS.md). Default-disabled workers, paid-deletion/billing activation, provider delivery and calendar semantics are not enabled or silently changed by this candidate. No unrelated remediation occurred.

## Local validation and preservation

Final executed results are recorded here after the candidate correction. They do not assert live production acceptance. All 57 capability groups and retained routes are reconciled in [PRESERVATION_REVIEW](PRESERVATION_REVIEW.md); mapped contracts are not an exhaustive provider/manual/production coverage percentage. PRES-C11 includes the explicit production deferral; ordinary revision/rendering/source boundaries remain required.

All applicable local suites were executed after the final application correction. The sanitized [validation summary](VALIDATION.json) records actual results, timings, unchanged fidelity tolerances and incomplete accessibility counts; raw disposable data, authentication state, traces and synthetic provider payloads remain outside Git.

| Validation | Final result | Change from inherited baseline |
|---|---|---|
| Complete backend, including auth/authz/account ownership | **1,023/1,023** | **+2** unavailable-service generation/apply theory cases |
| Focused AI/privacy/proposal subset | **108/108** | **+2**, the same cases already included in the backend total |
| CV revision safety subset | **5/5** | Unchanged, included in backend total |
| Frontend | **455/455**, 81 suites | Unchanged |
| Complete Chromium browser | **112/112** | Unchanged; 18.9 minutes, no retries/skips/expected failures. P2-D01 remains ordinary passing |
| Isolated real-HTTP AI contract | **2/2** | **+1** Production withholding/unrelated-AI proof; Development grounding/stale/no-write proof retained |
| Sidecar | **49/49** | Unchanged; deterministic fixtures, no configured-model qualification |
| Standard native rendering fidelity | **16/16; 36 preview = 36 PDF pages** | Unchanged tolerances, no measured failures |
| Settings/native exports | **8/8; 24 preview = 24 PDF pages** | Unchanged tolerances, no measured failures |
| Rate-limit / ingress / PDF admission / configuration | **9 / 6 / 1 / 3** | Unchanged; isolated local APIs, not real production ingress |
| Supply-chain helpers / offline evaluation harness / extension | **3 / 5 / 3** | Existing checks; offline harness is not a model run |
| TypeScript / isolated HTTP fixture TypeScript / lint | **Pass** | No baseline/configuration change |
| Frontend production / API Release build | **Pass** | API `-warnaserror`: zero warnings/errors |
| Tracked-secret / whitespace / current local-document targets | **Pass** | 154 current/root Markdown documents, zero missing targets; historical archive excluded. Frozen qualification evidence unchanged |

The two new backend cases prove 503 `cv_ai_unavailable`, no provider calls and unchanged CV/profile/history for generation and Apply when the existing optional service is absent. The new native Production HTTP case failed before the correction (expected 503, received 200), then passed with real authentication/Pro scope, section/document generation and Apply unavailable, unchanged persisted snapshots and zero provider calls. It also proves an existing profile-CV rewrite and AI workspace read remain available. Existing grounding evaluation, stale expected-version/history protection, tenant isolation, frozen package/attachment readback and private/public exports pass. A passing mock/synthetic-provider contract does not establish deployed availability or model factuality.

### Rendered and accessibility evidence

The unchanged browser suite exercises English/Bokmål, light/dark, desktop/intermediate/320px layouts, shell entry/return, commands/notifications, Jobs Table/Board/Trash and density, Dashboard/Analytics, Job deep sections/frozen content and CV frame/source/preview/settings/history. Fresh assistant visual inspection of `dashboard-desktop-light-en.png`, `dashboard-320-dark-nb.png`, `desktop-content.png` and `one-page-code-fit-320.png` confirms the existing hierarchy/reflow, white document canvas and visible preview focus remain intact in those captures. These are samples, not complete visual certification; the earlier per-slice evidence and limitations remain authoritative.

**229 automated axe scans report zero violations**, with incomplete node occurrences retained: `color-contrast` 1,466; `aria-hidden-focus` 33; `aria-prohibited-attr` 191; `aria-valid-attr-value` 18; `th-has-data-cells` 4. These are repeated node occurrences across scans, not unique defects or passed checks. Automated browser-driven keyboard contracts pass; no human spoken-name/live-announcement, physical touch, production font/photo, forced-colour or full reflow acceptance was performed. No open item is closed from these automated results.

### Reproduction and evidence boundaries

Use the existing installed SDK, bundled Python and sidecar virtual environment, with every shell command prefixed through `rtk`. Root checks: `dotnet build JobTrackerApi/JobTrackerApi.csproj --configuration Release --no-restore -warnaserror`; complete `dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build`; focused `CvAi|AiWorkspace|AiPrivacyPolicy|MeteredSummarizerService` and `CvRevisionReadinessTests` filters; sidecar `pytest`; the existing `scripts/test-ingress.py`, `scripts/test-supply-chain.py`, `scripts/test-ollama-evaluation.py` and extension capture tests. Native export comparisons reuse `scripts/verify-cv-fidelity.py` for the standard and assembled four-pair settings reports, exactly as documented in [P5-12](../p5-12/README.md#reproduction-commands).

UI checks: `npm test -- --runInBand --silent`; `npm run typecheck`; strict standalone `tsc` for `playwright.cv-ai.config.ts` and `ai-tests/cv-ai-readiness.spec.ts`; `npm run lint`; `npm run build`; complete Playwright Chromium suite with `PLAYWRIGHT_STATIC_EXPORT=true` and fresh `CV_FIDELITY_OUTPUT` / `CV_SETTINGS_FIDELITY_OUTPUT` destinations; separate `playwright.cv-ai.config.ts`, rate-limit, ingress and PDF configurations. The last three share port 5302 and ran sequentially after the complete browser run. All APIs used disposable synthetic local data, inert or deterministic provider fixtures and no production/model access. Local artifacts are under `.artifacts/p5-release-readiness/`; use the sanitized summary for committed counts.

## Stop and continuation boundary

**NO-GO for production release; P5-14 not started.** No production target commit, merge, deployment, runtime health/login/navigation/Jobs/Dashboard/CV/PDF smoke or new development branch from released `main` exists for this task. Only the existing development branch receives the bounded debt/safety checkpoint. Do not claim that the changes are live.

Next operator task: supply the existing authorized production connection or sanitized current runtime/configuration/recovery/ingress evidence and complete the already documented G-RELEASE procedure. After those conditions and protected CI are satisfied, revalidate the final candidate, merge history-preservingly into `main`, push without force, verify deployed SHA/data/authenticated workflows, then create a `codex/` development branch from verified `main` for conditionally scoped P5-14. P5-15 must retain the P5-13 debt, conditional acceptance and individual-checkpoint push rule. No P5-13 UI, P5-14, P5-15 or B07 implementation occurs here.