cesnimda
8.5 KiB
AUTOMATION-HANDOFF-01 — completed evidence handoff
Package READY; Pre-Phase-10 UX and CV Integration CONDITIONAL GO; Phase10 development NO-GO; automatic execution NOT authorised; production NO-GO. This handoff completes safely achievable evidence work, not the missing owner/operator qualifications.
Branch: test/pre-phase10-ux-acceptance. Frozen tested application baseline: 5032ccb415. It contains CV-UX4a0af62, CV-QA4a8c907, cumulative3255da9 and strategy correction caa0c6a. Handoff-only descendants do not change application, existing tests or deployment. Resolve the final package commit using git rev-parse HEAD, and independently compare its remote ref and clean working tree: a file cannot truthfully embed the hash of the commit containing itself. ACCEPTANCE.json labels its earlier snapshot/readback explicitly. verify.mjs --verify-remote checks the actual current HEAD.
The two previously unpublished commits caa0c6a/5032ccb and completed handoff checkpoints8804231,78e5296,657db9d,c16a66e were normally pushed and exact remote refs read back. DNS/TCP443/HTTPS/TLS and Git recovered without disabling certificate checks. GJ-00 planning remained separately published at0ec9f98e6ed4a646fc5e017d8eb6fade07653f37, diverging18/2 commits from5032ccb; it was not merged or modified. Primary and separate controller worktrees were preserved.
Fresh execution results
| Lane | Actual outcome |
|---|---|
| .NET backend | 1448 passed,0 failed/skipped |
| React frontend | 1031 passed /112 suites,0 failed/pending |
| Ordinary browser | 380 passed across four disjoint discovery-verified shards;0 failed/skipped/flaky/retries |
| Specialized browser contracts | 53 passed: AI2, auth2, rate9, ingress6, PDF admission1, preferences3, RD21 6, diagnostics18, volume3, RD21-volume3 |
| Real import browser journeys | 8 passed: Docling3, integration QA4, long import1 |
| Real MariaDB | 90 provider tests +3 browser cases passed, isolated data and fixture cleanup verified |
| Native Linux rendering browser | 8 passed, source/image/runtime identity and cleanup retained |
| Python | 83 offline +14 real Docling passed; native JUnit repeat replaces overlapping console run |
| Existing helper/oracle tests | 9 new-benchmark +11 original-benchmark +11 Linux-helper +25 Node-helper passed |
| TypeScript, lint, frontend/API builds, Linux native build, Windows apphost restoration | All exit0 |
| Handoff verification | 18 passed native parser/schema/source/approval unit and package negative tests; report handoff-validator supersedes bootstrap7 |
| Original PDF fidelity | Per platform24 CVs/60 pages and4 letters/14 pages PASS |
| Revised PDF corpus | Per platform36 CVs/122 pages content/bounds PASS; full-height sidebar43/43 pages PASS; matching letters18/38 pages PASS |
| Revised unchanged S01 fidelity | FAIL: Windows28/36 and Linux20/36 fail S01 only; criteria unchanged |
These are separate executed lanes, not an assertion that every case exercises a unique product scenario. The original broad regression completed once with source unchanged. Follow-up fixture/collector failures and their non-overlapping recovery are retained in QUALIFICATION_FAILURES.md. Native command arguments, timestamps, exit codes, test identities, source maps and immutable runtime observations are portable artifacts indexed in TEST_EVIDENCE.json. Historical totals and repeated runs are not added to fresh totals.
Actual local workflow and limits
The existing development environment remains available at http://jobbjakt.local/; no handoff-doc activation was necessary. A fresh synthetic PDF passed through the real worker to pending review with owner-correlated events. Separate browser/MariaDB tests cover Upload→Review/correct→Approve→canonical Career Profile→CV Editor→PDF and durable rollback/concurrency protections. Synthetic owner erasure completed. Generic queued strategy and scheduled enrichment actually saved nonempty results; strategy retained a prior provider_unavailable failure. Generic strategy used separately authored fictional ProfileCvText: canonical-only imported structured facts do not satisfy that legacy precondition. AI-CONTEXT-01 records the gap without overwriting user-controlled text.
Real conversion and deterministic extraction are distinct from model inference. Three safely isolated real CV-adapter probes used the approved existing Qwen artifact through a read-only model mount; all three were rejected. No compatibility or semantic-accuracy PASS is possible. The active CV adapter remains disabled/disconnected. No model download/replacement, existing Ollama/cache modification or permanent model selection occurred. AI_RESULTS.md distinguishes actual inference, contract doubles, historical deterministic precision/recall and future qualification.
Security is CONDITIONAL: import-lock48 dependencies had0 reported advisories; frontend production0, full frontend5 low; current NuGet scan reports MySqlConnector2.4.0 moderate GHSA-473q-m89c-ghf8. Exact installed Python audit queried63 distributions/126 endpoints with0 advisory records but retained vendor Torch PyPI404, so remains INCOMPLETE. No security risk was accepted on the owner's behalf. Prior source-diff review is historical scoped evidence, not a newly executed exhaustive scan. Hosted MariaDB/CI, native-image, production TLS/filesystem/off-disk backup/recovery/cache/operator qualification remain open in their own scopes.
Independent decisions and handoff
ACCEPTANCE.json contains all15 independent decisions. PDF spacing PARTIAL, revised automated fidelity FAIL, finite semantic content completeness PASS; human printing/device/AT/language NOT TESTED; CV AI BLOCKED; Python security CONDITIONAL; hosted CI BLOCKED; preservation PARTIAL; Git snapshot publication VERIFIED. All57 preservation criteria and34 routes remain retained at their existing56 PARTIAL/1 DEFERRED classifications. No test or historical acceptance record was weakened.
- TRACEABILITY.md: every requested capability mapped to current owners, actual reports and limits.
- VISUAL_REVIEW.md and owner-review.zip: actual54 PDFs and first/final comparisons for owner decisions.
- MANUAL_ACCEPTANCE.md:11 prioritised human/device/AT/copy/print/workflow checks, all pending.
- BLOCKERS.json and AUTHORITY.md: mandatory entry blockers, source-authorised conditional development debt, production-only blockers and future work kept separate.
- PHASE10_BASELINE.md and CLEANUP_INVENTORY.md: exact source/compatibility baseline and19 concrete retain/assessment entries; no approved product removal.
- GATES.json, ROADMAP.md, CONTRACT.md, HANDOFF_SCHEMA.json: proposed versioned evidence contract, stage05–11 dependencies and separately retained initiatives.
- REPRODUCE.md and READY_TO_RUN.md: independent verification and protected entry conditions.
The separate controller was inspected through committed Git objects only, initially c1663df and finally 140e182516. CONTROLLER_ADDENDUM.md reconciles its newer single-user mode:69 external Python cases (includes earlier48),6 signature cases and actual MXC canaries PASS, but dedicated sign-in and real owner key missing, operator-controlled/disabled, real adapter unconfigured and no Phase10 authority. Those tests were not rerun here. The older DPAPI failure remains historical. Empty checkpoint deferrableGates and AUTO-SCOPE-01 still require protected policy/candidate decisions. This package does not install a second controller, launch a queue, generate approval signatures or supply an owner decision.
Required owner/operator action: review the actual PDFs and affected S01 requirement, complete applicable manual checks, approve the resolved final published baseline and exact cleanup candidate scope through protected approval, and qualify the separate sandbox/test adapter and signed policy. Existing source-authorised conditional debt is not an executable waiver. Production-only issues are not blanket blockers on unrelated assessment, and conditional development permission is not production acceptance. Until mandatory conditions are satisfied, the orchestrator must remain BLOCKED. No Phase10, Product Review, Global Jobs, main merge or production deployment was started.