jobtrackingapp/docs/release-readiness/03_ENDPOINT_ENVIRONMENT_CENSUS.md

Release discovery · endpoint and environment census

Source baseline f19e7ebf4aeae350b43fa84cf115c393030280f0 on codex/release-backup-parser. Read-only source census. The 41 unique controller route prefixes are grouped below. Controller and action attributes, fallback authorisation, proxy policy, and runtime responses are separate checks. Repeat endpoint-level runtime verification on the accepted release candidate.

Surface	Route owners under /api	Qualification owner and required failure cases
Identity and accounts	auth, auth/2fa, auth/sessions, account-lifecycle, export	Auth/session, account lifecycle and export tests. Cover invalid/expired/revoked session, CSRF for cookie writes, rate limits, recent sign-in, owner isolation and final deletion policy.
Job tracking and discovery	jobapplications, jobapplications/{jobId:int} and its checklist, focus-plan, workspace, ai paths, calendar, companies, jobimport, job-discovery	Ownership, RD21, application/workspace, calendar and import/provider tests. Cover foreign/missing IDs, stale writes, parser/source denial and documented provider rights.
Career and files	career/evidence, career/profile, profile-cv, cv, documents, attachments, public-cv, backup	CV revision, import, document, public CV and backup tests. Cover frozen revisions, public opt-in and withdrawal, private downloads, upload limits, physical renderer qualification and scoped restoration.
Mail	correspondence, email, email/drafts, gmail, imap, microsoft-graph	Email ownership, Gmail, provider and draft tests. Verify OAuth state, consent/expiry, mailbox ownership, idempotent send, uncertain outcome recovery and real delivery separately.
Personal processing	ai/settings, ai/usage, notification-settings, notifications, operations, rules	Tenant/worker/AI tests. Verify entitlement and account isolation, no model start by default, queue and lease recovery, and redacted failures.
Administration and billing	admin/audit, admin/processing, admin/system, users, billing, client-errors	AdminProcessing, Users, AuthAndSystem, Billing and ClientErrors tests. Cover role denial, minimisation, signed webhooks, safe input and rate/size controls. Client error intake relies on the configured fallback auth policy, so verify both supported configurations.

Outside the controllers, GET /health reports process/build liveness and GET /ready checks database connectivity with a terse 503 on failure. They cannot stand in for authenticated application smoke. OpenAPI is mapped only in Development. Explicit anonymous controller paths include auth configuration and entry/recovery flows, the 2FA challenge, provider callbacks, Stripe webhook and opted-in public CV HTML/PDF. They still need route-specific proof of token, signature, consent or data scope as applicable. Public CV HTML carries a noindex header and the PDF action has a named rate limit. Source inspection does not establish actual ingress controls.

Environment	Source contract	Evidence required at the gate
Local dev	Development compose has backend, frontend and optional local AI service. Development MariaDB uses a persistent dev volume.	Confirm isolated config, version and selected service flags. Keep developer data and credentials out of shared artifacts.
Disposable integration	Database compose pins MariaDB 12.2.2 by digest and declares a separate test service.	Prove ephemeral storage, port and project isolation, migrations and cleanup. Keep the hosted isolation gate until operator evidence exists.
Staging and recovery rehearsal	The release procedure requires an isolated, approved target. No running target or staging identity was inspected here.	Freeze image/config/migration IDs, scope credentials and network, use synthetic or approved sanitised data, and prove rollback/restore and alert behaviour.
Production	Production compose separates frontend, backend, AI service and Ollama. Exact deployed versions, ingress, mounted data and service activation are external evidence.	Verify proxy and TLS, only intended exposed routes, build identity, readiness, provider/worker boundaries, and the operator's approved release decision.

No API, hosted CI, staging, production, Docker, provider or model operation was executed for this census. No configuration secret values were read. Stage 1 has a source-bound surface map. Exact endpoint/runtime evidence, candidate identity and recovery qualification remain open.