jobtrackingapp/docs/redesign/phase-9/p9-requal-01/PLAN.md

P9-REQUAL-01 — Hosted CI and Phase 9 Requalification

Approved specification: owner's P9-REQUAL-01 mission and implementation plan in this conversation. Baseline: 549b2cba5a791862ba3f854312ea819a86dc42a0; branch fix/p9-ci-and-requalification. Main must remain 5f835e54a9b74e6b71418422e28431b2af06453f.

Tasks

1. Verify baseline/raw evidence; register RD01–RD28, Phase9 findings, M09-01–10 and57 preservation groups with independently sourced Phase9/Phase10/production/debt gates.
2. Investigate Gitea1.26/act_runner0.4.1 service isolation. Change only the database-test workflow. Prefer private runner-managed services after isolation/lifecycle proof; otherwise retain BLOCKED and provide an operator handoff. Never add a host socket, privileges, public ports, DinD or production access.
3. Map RD21 closure; reproduce safe outstanding observations, minimally repair confirmed in-scope defects, provide human test cards, and run a15minute isolated MariaDB workload with250 applications/two paced readers and exact before/after state checks.
4. Freeze rebuilt source/artifacts; run full backend/frontend/browser/contracts/MariaDB/sidecar/security/types/lint/build/PDF/preservation lanes. Retain exact membership, failures, exclusions, process exits and source/report hashes.
5. Independent whole-branch review; bounded fixes and affected successors; publish dated addendum, five verdicts, next action, exact commit/remote/main verification.

Boundaries and accounting

No Phase10 implementation, SQLite retirement, DB-version change, production operations, main merge or force push. No manual/physical-device/provider semantics claim from automation. C11/P5-13 stays withheld. Existing1,123backend/32MariaDB/1MariaDBbrowser/18diagnostic/3volume results are historical, not fresh runs. Use fresh .artifacts/p9-requal-01/ paths, zero hidden retries/skips and independent durable reads. Production-only gates do not automatically veto Phase9. Conditional Phase10 requires explicit authoritative carry-forward eligibility.

Execution ledger

• Entry: clean baseline/remote equality and RD21 ancestry verified during planning; clean entry rechecked before branch creation.

• Ruling: use the clean existing checkout on the explicitly requested dedicated branch; retain installed tooling and historical raw evidence, without creating another checkout or asking for routine confirmation.

• Pre-flight: CI transport changes may affect fixture guards; keep default loopback protection and require verified private lifecycle before adding any CI-service endpoint. Performance source is separate; execute its workload without other qualification workloads.

• Task1: started. Task2: started. Task3: started. Task4/5: pending.

• Task2: complete safe workflow checkpoint 75cd04c; fresh hosted847 explicitly BLOCKED at first isolation gate. Merged host socket/network are unknown infrastructure, not permission to execute Docker.

• Ruling: live audits reproduced vulnerable Pkcs/Next/Zod locks; apply compatible narrow pins and refresh locked graphs, then supersede affected pre-pin results. No application flow/API/schema change or policy bypass.

• Post-pin checkpoint: NuGet/npm audits clear, backend1123, frontend934/105suites, MariaDB32, types/lint/static build pass. Frozen1042 runtime inputs recorded before full browser lanes. Independent review found missing P9-V02 register row; repaired, with56 unique findings including3 new security items.

• Source checkpoint 1a1b7c8: register/manual/harness package published; later Python advisory review adds its independent open security gate. Hosted849 confirms the isolation blocker at this source checkpoint.

• Harness findings: record schema ownership before diagnostic writes; make nested config server working directories explicit; compare canonical Career storage using its actual null-property omission, keeping exact before/after SQL equality. All failures and predecessor manifests retained; independent review confirms the narrow fixes.

• Actual provider defect: sustained preflight /documents fails with mixed-collation UNION on MariaDB. Three real RED cases reproduce it; provider-only name-projection repair 2b26953 passes those cases and the full35-case provider suite. Backend1123 also passes; no schema or table-collation migration.

• Hardened harness checkpoint 5ac1154 published. Fresh frontend934/105, backend1123, MariaDB35, sidecar56, types/lint/build and existing security helpers pass. Fresh static/API artifacts plus1043 runtime inputs and14 qualification-helper inputs are frozen before a new complete serial browser regression. Register now58 findings; all57 preservation groups/33 routes retained. Performance/Linux/final publication remain pending their actual results.

• Final checkpoint: all runtime lanes completed; ordinary362, real MariaDB35 plus browser1/HTTP2/workload PASS. Linux producers5 PASS but unchanged PDF oracles13/24 PASS; Python advisory gate OPEN. Register59; Phase9/Phase10/production NO-GO, hosted BLOCKED, bounded RD21 RESOLVED. Final deliverables and publication receipt are indexed in README.md. No Phase10 work.