cesnimda
33 lines
5.7 KiB
Markdown
33 lines
5.7 KiB
Markdown
# Reproduction commands and boundaries
|
|
|
|
Use the dedicated development branch, pinned .NET9.0.317 SDK at `C:/Users/Connor/.dotnet/dotnet.exe` with DOTNET_ROOT, existing frontend lock and Python3.12 sidecar environment. Keep every invocation in a fresh output directory. Do not run build/test workloads concurrently with browser or sustained performance qualification. No command targets production.
|
|
|
|
## Linux PDF
|
|
|
|
1. Build the existing API Dockerfile locally: `rtk proxy docker build -f JobTrackerApi/Dockerfile -t jobtracker-p9-remed-api:fonts .`. Record build log, actual image identity, runtime/browser versions and input hashes. The qualified renderer uses Debian12 Chromium156.0.8078.47/.NET9.0.21 with embedded static fonts; do not silently substitute a newer renderer and reuse these results.
|
|
2. Start only the pinned disposable MariaDB12.2.2 integration service from `docker-compose.database.yml`, Compose project `jobtracker-it-p9-requal`, integration profile, MARIADB_TEST_PORT33308, with `up -d --wait mariadb-test`. Preserve the distinct stopped development service/volume. The existing runner verifies pin, tmpfs ownership, health, version and loopback binding.
|
|
3. From repository root run `rtk proxy python docs/redesign/phase-9/p9-remed-02/linux-run.py <unique-attempt>`. It reuses the qualified lifecycle and overrides only output, image and diagnostic identity/configuration. `baseline` selects the historical image; use another unique name for the remediation. It executes the five original producers representing all24 original fixture states, using the Windows Chromium preview client and Linux API renderer. It verifies51 actual migrations and removes its owned API container/private network/generated schema. No earlier evidence is overwritten.
|
|
4. Run the unchanged collector with bundled PDF tooling:
|
|
|
|
```powershell
|
|
rtk proxy <pdf-python> -B docs/redesign/phase-9/p9-requal-01/pdf-proof.py --platform linux --fidelity-root .artifacts/p9-remed-02/<attempt>/linux/fidelity --settings-root .artifacts/p9-remed-02/<attempt>/linux/settings-fidelity --output .artifacts/p9-remed-02/<attempt>/oracle --record .artifacts/p9-remed-02/<attempt>/linux-pdf.json
|
|
```
|
|
|
|
The existing oracle checks actual independently rendered page images, extracted markers/geometry/fonts/colors/safe areas and exact preview/export pagination. The collector retains the original16/36-page and8/24-page corpora and exact eight settings states. Neither oracle nor fixture references/tolerances were changed. The existing `test-linux-run.py` and `test-mariadb-lane.py` are offline lifecycle guards, never real provider qualification.
|
|
|
|
Final local packaging image0d1cb44 has the same render-DLL SHA256 as qualified image98ccb723; only the standalone provenance manifest was completed. See raw image-lineage.json. These are local image identities, not asserted pullable registry manifest references. No image was pushed or deployed.
|
|
|
|
The separate long-skill producer uses `rtk proxy python docs/redesign/phase-9/p9-remed-02/linux-run.py representative-linux` in a fresh output directory. Then run `rtk proxy python docs/redesign/phase-9/p9-remed-02/representative/proof.py .artifacts/p9-remed-02/representative-linux`. The versioned proof command preserves the exact two-case corpus, records inputs before invoking the unchanged PDF oracle, verifies post-run hashes and content/header-footer assertions, and binds the retained result/report. It refuses to overwrite completed proof. Reconciliation requires that producer manifest and checks current hashes again. These two fixtures are separate from the original24 and ordinary362.
|
|
|
|
## Regression and security
|
|
|
|
Reuse [the full lane commands](../p9-requal-01/COMMANDS.md) with new `.artifacts/p9-remed-02/` outputs. Run backend and real provider tests before browser servers to avoid apphost locks. Finish frontend/type/lint/build before serial browser discovery and four zero-retry shards, then the six separate contracts, RD21/diagnostic/volume and isolated MariaDB browser/workload lanes. Do not add focused RED/GREEN checks to full totals. The first95/3 shard remains a failed predecessor, not accepted final execution.
|
|
|
|
Python exact lock/patch commands and actual startup/parser limits are in [security remediation](security/REMEDIATION.md); all109 advisory dispositions remain in its inventory. No model download or inference is part of these commands. Existing security helpers, tracked-secret scan and SBOM are separate from advisory closure.
|
|
|
|
Remove only the owned disposable database service after all lanes, with the same Compose file/project/profile and `rm --stop --force mariadb-test`. Never use `down -v`, prune development data, expose a host daemon in a job or connect tests to production. Hosted execution remains blocked pending the [operator plan](CI_ISOLATION.md).
|
|
|
|
## Exact qualified renderer replay
|
|
|
|
The local-only [capsule manifest](renderer-capsule.json) records a377384960-byte image archive with SHA256 `9b98865b14305f97d13502f785fb88129e205229f42e8a6c8980f74f5664fba5`. Before loading, verify that hash, then use `rtk proxy docker image load --input .artifacts/p9-remed-02/renderer-capsule/qualified-renderer.tar` only in an isolated qualification engine. Both local tags resolve to imageID `sha256:0d1cb44ba8f71d54de77459915a7052b894191cfeb75aa32f0c1e7ffdc21fda6`. This is not a pullable registry manifest. The archive is ignored/local, never uploaded; obtain the retained approved artifact from its owner or rebuild and requalify. The complete Debian package/locale inventory is [retained](renderer-runtime-inventory.txt); fonts have their separate immutable source/hash manifest. Existing Dockerfile base/apt inputs float: a source rebuild must record its actual new runtime identity and repeat qualification. No production engine or data is involved.
|