jobtrackingapp/docs/redesign/phase-5/p5-15/EXECUTION_PLAN.md

# P5-15 bounded acceptance programme

Planning source: `46a0c0c6d23464869f50c0d88552963c29cfdacf`, `codex/ui-redesign-phase4`, 2026-10-09. These are proposed execution checkpoints, **not executed tests or authorization to start them in this planning session**. Production `main` automatically deploys on push and remains NO-GO. P5-13 qualification, Docker recovery, AI-review UI and activation remain excluded; B07 and Phases 6–8 do not start.

## Checkpoint and push discipline

Each completed logical unit must be validated, committed, immediately pushed to the development branch and checked against the remote before starting the next unit. A findings-only checkpoint is valid; missing operator evidence is not a reason to create a fake pass or attempt unauthorized production operations. Record source/candidate SHA, exact commands, result paths, counts/deltas, reviewer/device/runtime identity and remaining gaps in its record. After commit, retain the SHA in the execution ledger/final report; the following checkpoint links its predecessor. Resolve this planning commit with `rtk git log -1 --format=%H -- docs/redesign/phase-5/p5-15/README.md`.

Use normal non-force pushes, then fetch and verify equal HEAD/remote SHA, `0 0` divergence and a clean working tree. Never combine several independently completed fixes in an unpushed tree. A remediation can be one small owner-specific fix plus its regression/evidence, not an individual-keystroke commit. Separate production evidence from local UI acceptance. No `main` merge/push is part of this programme; a later explicit release decision must authorize it.

## Proposed order

| ID / scope | Entry criteria | Required evidence and tests | Exit / dependencies | Commit/push boundary |
|---|---|---|---|---|
| **P5-15-00 Acceptance inventory and matrix** | Exact clean P5-14 checkpoint; approved plan and complete original PRES/route inventory available | Static component/action/route review; implementation ancestry; original and current evidence; 57 unique PRES groups, all 31 original patterns plus Analytics; axe/debt classification; documentation/secret/whitespace checks | Planning package internally consistent; unknowns explicitly recorded. No new implementation or fresh suite claim | **This documentation-only checkpoint**, push and stop for owner review |
| **P5-15-01 Functional/preservation audit** | Owner authorizes next checkpoint; 00 reviewed; disposable owned synthetic data and build provenance | Rerun core baseline below; walk every route with proper role/public identity, compatibility/query/dirty/Back rules and current controls. Exercise all applicable original sub-workflows, not only group representatives; use 57-row matrix to enumerate remaining tests | No demonstrated lost action/entry/ownership behavior. Record unknown provider/long-tail flows separately. Preservation regression is NO-GO for affected scope; bounded fixes return to explicit originating owner | Audit evidence/docs/tests as one checkpoint; each completed owner-specific repair separately commit/push before continuing |
| **P5-15-02 Responsive and accessibility audit** | 01 source stable and preservation failures addressed; named states/fixture identities fixed | [Manual script](MANUAL_ACCEPTANCE.md), full stable screenshot sets, loaded expanded axe node triage, actual keyboard/focus and chart/form tests; desktop/tablet/phone/landscape, four theme/locale pairs, Comfortable/Compact Jobs/Trash; normal/reduced motion | Human screen-reader, physical device/software keyboard and actual browser zoom/reflow outcomes have named evidence or remain NOT VERIFIED. Inaccessible essential controls, trap or loss of editing blocks affected acceptance. Automated zero violations is insufficient | Evidence checkpoint; any reproduced shared theme/modal/focus correction is its own tested push. Device/human packet can commit separately when completed |
| **P5-15-03 CV/document correctness qualification** | Accepted revision/native-package baselines; renderer unchanged unless separately justified; synthetic corpus/capture lifecycle ready | Fresh 5 revision cases, 16 standard fidelity fixtures and 8 settings exports plus package/P2-D01/publication/ownership/override-reset/recovery paths. Exact current content/settings; fonts/images settled; actual PDF/page metadata and visual comparisons | 16/16 and 8/8; 36=36 and 24=24 unless fixture expansion is explicitly justified; no count/missing-content/wrong-page/clipping regression. Production-equivalent Linux fonts/photos need separate verified runtime evidence, not local substitution | Correctness/evidence checkpoint. No geometry fix disguised as layout; a genuine renderer repair requires bounded approval/proof and a separate push |
| **P5-15-04 Debt triage and bounded remediation** | 01–03 findings and [debt register](READINESS_DEBT.md) reviewed; exact defect reproduced or explicitly NOT VERIFIED | Prioritize preference-save/SQLite failure, modal feedback and shared-dialog/command focus by actual impact. Record API exception/DB provider/concurrency, draft/readback, repeat rates and negative ownership; no sleep/retry masking. Core baseline after code changes | Every item has A/B/C/D classification, severity, scope/owner and evidence-based disposition. A known failure cannot become harmless by non-recurrence. Backend/product changes beyond acceptance need separate scope decision | **One completed logical fix per push**, then audit-ledger reconciliation. No giant debt-cleanup commit; P5-13, B07, new workflows and unrelated backend repairs stay excluded |
| **P5-15-05 Production evidence and readiness** | Authorized operator access, current recovery inventory and isolated rehearsal target; 04 candidate known; operator tasks scheduled | [Executable operator checklist](READINESS_DEBT.md#production-readiness-operator-checklist--prepared-not-executed); deployed ingress/trust/IP/firewall/DNS/TLS, current complete backup+restore, actual config/provider/schema/keys, migration/rollback rehearsal, protected CI and existing auth/tenant/provider smoke on approved targets | Every release-critical item verified or **Production NO-GO** retained. Do not block independent local evidence while operator tasks are unavailable. Actual production writes/destructive rehearsals require separate authorization | Sanitized evidence/decision checkpoint on development branch; no production merge/push/deploy. Missing evidence record remains a valid bounded NO-GO checkpoint |
| **P5-15-06 Final regression and acceptance decision** | All attempted audits/fixes pushed; final candidate stable; retained exceptions and manual/operator evidence reviewed | Complete final baseline, all representative screen/state visual sets, 57 groups/all routes, AI withholding/unrelated AI, source/revision/frozen/PDF/Settings/permissions, fresh secrets/builds/type/lint and document checks. Independent review of evidence provenance and debt | Report implemented-scope verdict, **original full Phase 5 scope verdict** and Production verdict separately; all P5 implementation/repair/evidence commits listed. Missing P5-13/manual obligations prohibit unconditional full Phase 5 GO | Final acceptance record push; remote/tree verified. Stop before Phase 6/7/8/B07 or any separately authorized deployment |

Operator/human work can be prepared while independent local audits proceed. Do not impersonate it to satisfy ordering. A shared regression blocks dependent evidence; merely unavailable infrastructure does not forbid a local findings-only checkpoint. Each proposed next checkpoint requires the owner's continuation instruction after this planning-only stop.

## Functional audit sequence

1. Compare exact [route disposition](ROUTE_ACCEPTANCE.md) and [navigation migration](../NAVIGATION_MIGRATION.md). Use public, normal account, second account and administrator fixtures. Check every primary/secondary/command/account/notification/context link; invoke visible controls and verify their intended read/write/modal destination. Hidden Admin navigation never proves authorization.
2. Confirm login/logout/remember/revoke/account switch and in-flight cancellation. A must not expose B's draft, notification, preview, job, file or protected proposal. Keep auth/CSRF/tenant negative tests and allowed/denied public/private CV identity distinct.
3. Jobs: equal **complete matching IDs**, standard/custom/unknown statuses, sort, paging, both densities, columns, saved views, selection and partial bulk failures; Table/Board URL switch and `/kanban` alias; pointer/keyboard/no-drag moves, failed move, Trash restore and job Browser Back context/focus. Assess request count/full-array memory with a larger synthetic account; no invented hard maximum.
4. Dashboard/Analytics: real definitions/populations/period/sample, all retained reports/actions, five owner-local flags and account switch; errors distinct from no data. Reproduce server preference persistence under overlapping reads/writes rather than assuming local display is server acknowledgement. No new metrics or Phase 8 layout engine.
5. Job workspace: all seven canonical sections, legacy text aliases and numeric 0–9 navigation-helper arguments (not numeric section URLs); URL/query/history/dirty Cancel/Discard, no write or AI generation on mount; timeline/notes versus answers/checklist/correspondence/calendar/interview boundaries; read-only frozen content and native ZIP/download preservation. `followMode` round-trips **metadata only**; do not claim a compose consumer.
6. CV: all five studio tabs, source/override/CV-only/omitted/custom entry, reset versus Undo versus history restore, reorder alternatives, failed/conflicting saves and draft recovery, selected/sibling/canonical/frozen readback, private/public publication and PDF. Existing geometry oracles remain authoritative.
7. Retained non-migrated Career Profile/library/mail/Settings/Admin/capture/import/export work: use every original PRES row's actions, including low-frequency controls. Route presence is only static proof. Provider-required tasks remain explicitly unverified until an authorized sandbox/operator supplies evidence.

## Baseline and rerun schedule

The following values are **inherited from P5-14**, not newly executed for P5-15-00. The [P5-14 result package](../p5-14/README.md#final-validation--2026-10-09) records final source hashes, counts, 33 selected images, actual suite dates and all incomplete checks.

| Gate | Inherited passing target / interpretation |
|---|---|
| Complete backend | **1,023**, zero failures/skips |
| Frontend | **459 / 82 suites**, zero failures/skips |
| Main browser | **117 actual passes**, zero failures/skips/retries; P2-D01 ordinary pass |
| Sidecar | **49**, deterministic/offline; not configured-model qualification |
| Focused AI / revision | **108 / 5**, subsets of backend, not additional backend cases |
| Real HTTP | **2**, isolated Production withholding before provider/write and unrelated AI availability |
| Rate-limit / ingress / PDF admission / configuration | **9 / 6 / 1 / 3**, isolated/local; no deployed F04 proof |
| Standard rendering | **16/16; 36 preview = 36 PDF pages** |
| Settings export rendering | **8/8; 24 = 24 pages** |
| Other retained helper suites | Supply-chain **3**, offline evaluation harness **5**, extension **3**; separate existing helpers |
| Static gates | App and E2E/AI TypeScript, lint, frontend production, API/test Release builds, secrets/whitespace/document links |

- Documentation-only checkpoint: validate links/anchors, all IDs/routes/commit ancestry/evidence counts, balanced tables/fences, source-tree unchanged, staged secret and whitespace checks. Reuse inherited suite evidence with matching source/hash limits. **Do not claim fresh suites.**
- Test-only evidence change: run changed fixtures and their owning suite; never rename/skip an ordinary regression. Preserve failed/interrupted reports. Before acceptance, rerun full applicable baseline with the final test candidate.
- Any application change: after the final code change run full applicable backend/frontend/browser/static/build/security/configuration baseline; CV frame/content/settings also rerun revision, standard and settings fidelity/native packages. Shared shell/theme changes rerun all representative screens. Additions/removals require named count explanations.
- Final 06: run everything against one recorded final candidate/build, with fresh native input timestamps and both success/failure evidence. A later substantive change invalidates affected completed evidence. Routine checks use deterministic providers, synthetic accounts and disposable local DBs; **no semantic model calls**.

## Existing command owners and safe order

These commands are a proposed run recipe, **not execution evidence**. Use installed project/bundled runtimes; do not install a replacement renderer, fetch external providers or expose keys. Set the task-specific artifacts directory; no existing historical captures are overwritten. Preserve existing single-worker backend/browser constraints and do not execute several suites against port 5302 concurrently.

```powershell
# Repository root; resolve these installed paths before starting.
$taskDotnet = 'C:/Users/Connor/.dotnet/dotnet.exe'
$taskPython = 'C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe'
$env:DOTNET_ROOT = 'C:/Users/Connor/.dotnet'
$env:DOTNET_HOST_PATH = $taskDotnet
rtk proxy $taskDotnet build JobTrackerApi/JobTrackerApi.csproj --configuration Release --no-restore -warnaserror
rtk proxy $taskDotnet build JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore -warnaserror
rtk proxy $taskDotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build --logger 'trx;LogFileName=p5-15-final.trx' --results-directory .artifacts/p5-15/final/backend -- xUnit.parallelizeTestCollections=false xUnit.maxParallelThreads=1
rtk proxy tools/summarizer/.venv/Scripts/python.exe -m pytest tools/summarizer/tests
rtk proxy $taskPython -X utf8 scripts/test-ingress.py
rtk proxy $taskPython -X utf8 scripts/test-supply-chain.py
rtk proxy $taskPython -X utf8 scripts/test-ollama-evaluation.py
rtk proxy node --test browser-extension/tests/capture-url.test.mjs
# In job-tracker-ui, using its existing package/config files:
rtk proxy npm.cmd test -- --runInBand --watchAll=false --json --outputFile=../.artifacts/p5-15/final/frontend.json
rtk proxy npm.cmd run typecheck
rtk proxy npm.cmd run lint
$env:NEXT_PUBLIC_API_BASE_URL = 'http://localhost:5302/api'
$env:NEXT_TELEMETRY_DISABLED = '1'
rtk proxy npm.cmd run build
$env:PLAYWRIGHT_STATIC_EXPORT = 'true'
$env:PLAYWRIGHT_PREBUILT_EXPORT = 'true'
$env:PLAYWRIGHT_REUSE_SERVERS = 'false'
$env:CV_FIDELITY_OUTPUT = '../.artifacts/p5-15/final/fidelity'
$env:CV_SETTINGS_FIDELITY_OUTPUT = '../.artifacts/p5-15/final/settings-fidelity'
# Use a distinct JSON file/output directory per config; execute sequentially.
$env:PLAYWRIGHT_JSON_OUTPUT_FILE = '../.artifacts/p5-15/final/browser.json'
rtk proxy node node_modules/@playwright/test/cli.js test --retries=0 --reporter=list,json --output=../.artifacts/p5-15/final/browser-results
$env:PLAYWRIGHT_JSON_OUTPUT_FILE = '../.artifacts/p5-15/final/http.json'
rtk proxy node node_modules/@playwright/test/cli.js test --config=playwright.cv-ai.config.ts --retries=0 --reporter=list,json --output=../.artifacts/p5-15/final/http-results
$env:PLAYWRIGHT_JSON_OUTPUT_FILE = '../.artifacts/p5-15/final/rate-limit.json'
rtk proxy node node_modules/@playwright/test/cli.js test --config=playwright.rate-limits.config.ts --retries=0 --reporter=list,json --output=../.artifacts/p5-15/final/rate-limit-results
$env:PLAYWRIGHT_JSON_OUTPUT_FILE = '../.artifacts/p5-15/final/ingress.json'
rtk proxy node node_modules/@playwright/test/cli.js test --config=playwright.ingress.config.ts --retries=0 --reporter=list,json --output=../.artifacts/p5-15/final/ingress-results
$env:PLAYWRIGHT_JSON_OUTPUT_FILE = '../.artifacts/p5-15/final/pdf-admission.json'
rtk proxy node node_modules/@playwright/test/cli.js test --config=playwright.pdf.config.ts --retries=0 --reporter=list,json --output=../.artifacts/p5-15/final/pdf-admission-results
# Back at repository root, after collecting FRESH native measurements/PDFs:
rtk proxy $taskPython -X utf8 scripts/verify-cv-fidelity.py .artifacts/p5-15/final/fidelity
rtk proxy $taskPython -X utf8 scripts/verify-cv-fidelity.py .artifacts/p5-15/final/settings-fidelity
rtk proxy $taskPython -X utf8 scripts/supply-chain.py scan-secrets
rtk git diff --check
rtk git diff --cached --check
```

Capture flags/output roots and the settings-measurement assembly must be set using the existing [P5-12 recipe](../p5-12/README.md#reproduction-commands) and [P5-14 provenance](../p5-14/evidence/build-provenance.json); running the oracle against copied old PDFs is not a fresh result. Run focused AI/revision subsets with the recorded test-class filters for a separate count report, but do not add them to 1,023. E2E/AI TypeScript is outside the application tsconfig: recreate the existing temporary augmentation/config used by P5-14, include current E2E/AI files and record its contents/hash before running the separate compiler. The ignored local config path alone is not a portable specification. Supply the same link/anchor/PRES/table checks used by planning below; a historical validator in `.artifacts` is a local helper, not a production/test dependency.

## Evidence and decisions

Every screenshot/result needs source SHA, final build fingerprint, route/query/state, account role, fixture IDs/timezone/reference time, viewport/orientation/theme/locale/density, readiness signal and capture/reviewer date. Preserve initial failures and actual retries separately; do not count expected/incomplete/not-run as success. Trace files with cookies/headers/account tokens remain ignored; commit sanitized outcome tables, meaningful synthetic excerpts, measured values and useful images. Use [visual acceptance](../VISUAL_ACCEPTANCE.md) rather than screenshot volume as the standard.

**Implemented-scope GO** requires all declared critical behavioral, accessibility/document and security gates for that finite scope; **CONDITIONAL GO/PARTIAL** may describe explicitly limited evidence with owners/conditions, never a severe unresolved regression. **Original full Phase 5 GO is unavailable** while P5-13 qualification/review/UI and mandatory human/device acceptance remain incomplete. **Production GO is unavailable** until every A-class gate in [READINESS_DEBT](READINESS_DEBT.md) passes for the actual intended deployed configuration and a separate release authorization is given. Missing evidence is NOT VERIFIED; demonstrated unsafe behavior is FAIL. No verdict starts deployment or the next redesign phase.