cesnimdaPart A — production release decision — 2026-10-08
Production decision: NO-GO. The completed redesign remains a release candidate. Critical production safety evidence is unavailable, so no production-branch merge/push or deployment was performed. No production configuration, service, database, volume, backup or credential was changed; no production endpoint or model was contacted in this assessment.
Assessed source: 1095ef1d29856a2984cd800abd2bbd65dd472d38, codex/ui-redesign-phase4. A fresh git fetch origin and git ls-remote --symref confirm production target main, 27657f31131cd95d42f0e1290853ec9c9b3959a4, at https://git.cesnimda.uk/cesnimda/jobtrackingapp.git. Remote HEAD points to main; no remote master exists. The candidate has 45 additional commits and zero target-only commits. Release/merge commit and deployed candidate SHA: none.
Deployment boundary
Both the fetched main and candidate Gitea workflow run tests on main pushes and pull requests. A successful complete test job automatically enables deployment only for a push to refs/heads/main. Deployment uses the established PROD_HOST, PROD_USER and PROD_SSH_KEY secret mechanism, resets /opt/job-tracker/app to the workflow SHA and invokes deploy.sh. A main push is therefore a production action. Actual remote branch-protection settings and candidate runner acceptance were not verified.
No usable production connection was established. The permitted repository material supplies secret names rather than a verified SSH alias/user, and the current C:/Users/Connor/.ssh/config existence check returned false. Historical operator access does not provide a current connection. No connection was guessed and no secret values, private keys, live .env, cookies or authentication state were retrieved.
Critical evidence and remediation
| Gate | Current result and evidence required |
|---|---|
| F04/B06 actual ingress | Open. Obtain the deployed revision/image IDs, real Traefik placement/router/TLS/upstream/forwarding settings, generated nginx trust entries and observed original socket peer. Show that an untrusted route has a different source, that edge spoofing cannot select client IP/scheme/host, and that the API receives the intended client identity. A shared NAT source for trusted and untrusted paths is a stop condition; use an explicitly reviewed binding/firewall or dedicated proxy route before trusting that peer. |
| Listeners, network and external boundary | Unverified. Inspect actual published/container/host listeners, network membership, Docker NAT/FORWARD and provider/host IPv4/IPv6 controls. From an independent external network, verify direct/spoofed application denial, every intended A/AAAA address, valid TLS and a reachable canonical HTTP redirect. The historical redirect to unreachable HTTPS port 444 has not been reverified or closed. |
| Real-chain runtime and identity | Unverified. On an isolated equivalent topology, prove real nginx startup/configuration rejection/restart stability, trusted/untrusted forwarding, actual backend client-IP observations, A/B rate-budget isolation and B02 account/session context behavior. Local API/Compose tests do not establish the deployed chain. |
| Current backup and restore | Unverified. Inventory a fresh complete database/files/CV/exports/Data Protection keys/tombstones recovery set, integrity, custody, retention and off-host protection. Restore a current production backup into an isolated target; compare counts/content/non-ASCII data, boot the application and prove decryption and deletion-tombstone replay. Historical seeded MariaDB restoration and old gzip-valid database-only dumps are insufficient. |
| Configuration, schema and rollback | Unverified. Confirm the actual database provider/connection, schema/migration history, canonical origin/auth/ingress configuration, current version/counts and recoverable prior images. Rehearse failure injection and code/image rollback on a disposable Linux host with the intended topology, preserving data and failed deployment status. The existing script is a mechanism, not rehearsal evidence. F19's startup fallback to SQLite remains open; confirm the intended provider rather than accepting empty fallback data. |
| Protected CI, deployment and authenticated acceptance | Unverified. Obtain complete candidate remote test/browser results through the protected workflow. After every critical pre-release gate permits deployment, record actual deployment completion, matching SHA/version, /health, /ready and public auth configuration. Verify existing-account login, owner/account separation, application/company counts, Career Profile/languages, workspace, CV variants/themes/public PDF and an existing attachment; verify configured OAuth/email/provider paths with authorized test accounts. Local tests and public health alone cannot establish these outcomes. |
Use the current deployment checklist, backup requirements, disaster recovery guidance and migration compatibility rules. The historical B06 operator handoff retains the exact read-only inventory, sanitized output and SYN-only peer procedure. It is a procedure and historical evidence, not current production acceptance. Restart, invalid-configuration, failure-injection and restore rehearsals belong on isolated targets; no live destructive operation is authorized by this record.
The Git migration comparison adds no DDL migration: three historical migration files change documentation comments only, and the snapshot adds concurrency metadata to the existing CV Version property. Compose is unchanged. Existing startup migration/reconciliation still runs, so the actual deployed schema/provider and recovery evidence remain required.
Authorized continuation and preserved deferral
Connor's current instruction authorizes local P5-14 independently of production release. This supersedes the historical release-first continuation condition for that work. Production NO-GO does not stop the authorized P5-14 checkpoint for currently implemented CV workflows. Its acceptance must retain the absent P5-13 AI-review journey and all production/accessibility limitations explicitly; no unconditional Phase 5 completion follows from this scope revision.
P5-13 remains DEFERRED — BLOCKED / NOT QUALIFIED: no new qualification calls or human reviews, and no AI-review UI implementation. Preserve the existing Production guard in Program.cs: CvAiSuggestionService is registered only outside Production, so proposal generation and Apply use the established 503 cv_ai_unavailable boundary before model requests or CV/profile/history mutation. Other AI registrations and ordinary CV editing/save/history/preview/PDF remain under their existing boundaries. This repository guard is not proof of the current deployed service. The frozen qualification packet and return conditions remain intact; no Docker recovery or semantic qualification was attempted.
Preservation is reconciled through the existing 57-group preservation review, original requirements and per-slice successor evidence. That mapping retains its provider/manual/production gaps; it is not an exhaustive coverage percentage or acceptance of every sub-workflow. P5-14 must add its own bounded evidence without removing inherited requirements.
Final validation
Fresh validation against unchanged application/test/configuration source at 1095ef1, before P5-14 changes:
| Check | Actual result |
|---|---|
| Backend Release / focused AI / revision safety | 1,023 / 108 / 5 passing; focused cases are subsets of the backend total |
| Frontend Jest | 455 passing, 81 suites |
| Chromium application browser | 112 actual passing, zero skips/failures/retries; P2-D01 is an ordinary passing case |
| Native real-HTTP contracts | 2 passing, including isolated Production withholding and unrelated-AI availability |
| Sidecar | 49 passing, offline synthetic tests, no model qualification |
| Rate-limit / ingress / PDF admission / Compose configuration | 9 / 6 / 1 / 3 passing |
| Standard preview/PDF fidelity | 16/16, 36 = 36 pages, existing dimensional/position/font/colour tolerances unchanged |
| Settings export fidelity | 8/8, 24 = 24 pages, existing tolerances unchanged |
| TypeScript / separate browser TypeScript / lint | Passing |
| Frontend production / API Release / test-project Release builds | Passing; API/test builds have zero warnings/errors |
| Supply-chain helpers / offline evaluation harness / extension tests | 3 / 5 / 3 passing; harness tests do not make model calls |
| Secrets / working and staged whitespace / documentation links | Passing; 158 current/root Markdown targets checked, historical archive excluded |
No test-count changes. Raw TRX/XML, browser/Jest reports, exported PDFs, measurements and comparisons are retained under ignored .artifacts/p5-release-decision/; VALIDATION.json records counts, commands and incomplete accessibility checks. The browser run retained 229 axe scans, zero reported violations and 1,712 incomplete node occurrences (1,466 contrast, 191 prohibited-attribute, 33 hidden-focus, 18 valid-value and 4 table-header). Incomplete checks and human screen-reader acceptance are open, not passes. Existing themed/localised responsive workflows ran, but native hardware touch and production font/photo qualification are not established by Chromium.
An initial specialized-suite command used an incorrectly constructed CLI argument and found zero tests; it was corrected and all three explicit configurations ran. That accidental development-server launch generated two Next.js instruction files; their generator/provenance was verified and only those generated artifacts were removed. No application source changed or check was weakened.
The release decision remains NO-GO despite these local passes. This documentation checkpoint authorizes no production merge, push or deployment; P5-14 continues separately on the existing development history.