jobtrackingapp/docs/audits/2026-09-07/validation/implementation-queue.md

Validated implementation queue

Companion to the independent verdict. This is a proposed queue, not authorization to start implementation. Original finding IDs remain stable; V01 strengthens F08 and V02 strengthens F11. No application changes were made by this pass.

Status update, 2026-09-09: the user separately authorized B01–B05, now complete locally: B01, B02, B03, B04, B05. B05 resolves F05 under its documented spreadsheet-text policy; actual Excel before/after proves the arithmetic formula is now text and Norwegian encoding is preserved. Final verification: 902 selected backend, 298 frontend, 18 browser tests, nine B04 rate-policy HTTP scenarios and the unchanged B03 admission probe pass. Release builds and targeted lint pass; R01a's pre-existing standalone TypeScript error remains. HTTP F11/V02, F08/V01 and F06 are resolved locally; overall F11 remains open for B07/deployment. F03 admission is resolved locally; R04 containment/capacity evidence remains open. B06 was subsequently authorized; implementation and pending verification are recorded below.

B06 runtime follow-up, 2026-09-09: Report and operator handoff. Implementation complete; full runtime/production verification incomplete; F04 open. Fresh 166 focused backend, 3 Compose, 6 Production HTTP and 9 B04 HTTP checks pass. Public DNS/valid HTTPS are now observed; direct ports 3000/5202/8080 are unreachable from this workstation, without proof of the rejecting layer. HTTP redirects to unreachable HTTPS port 444. Docker's inference socket failure still blocks actual Compose/Traefik/nginx tests; production peers, backend client IP and host/provider firewall remain unverified. No SSH alias/user was found in permitted non-secret sources. B01–B05 preserved; B07 not started.

Sizing: S = one narrow boundary/configuration change and its meaningful tests; M = one cohesive service/API/client contract that can be understood, implemented, tested and reviewed in one focused session. These are scope estimates, not elapsed-time promises. If a ticket needs unrelated modules, split it at the acceptance boundary below. Do not create a generic framework merely to make tickets share code.

The numbered order is the default integration order. Independent work may start sooner only along the explicitly permitted parallel branches. A conditional feature can stay disabled while unrelated safe work proceeds; a failed recovery gate blocks migrations, not read-only planning or non-schema tests.

Batch 0 — Security, identity and immediate admission

Findings: F11/V02, F08/V01, F03, F06, F05 and conditional F04. These require no data migration and address the most direct ways to cross a boundary or consume shared resources. CSV remains P2 but is inexpensive and isolated.

Order / ticket	Size and ownership	Concrete scope and acceptance	Dependencies / rollback risk
B01 HTTP import destination enforcement	M. Services/JobImport/JobImportService.cs, resolver/address helper only if needed, named import HTTP registration in Program.cs, import/network tests.	Normalize mapped addresses and enforce the same approved-address policy at the actual socket connection. Keep HTTP/HTTPS, redirect refusal, bounded content, cancellation and hostname/TLS verification. Before/after tests must show mapped private/link-local targets never reach a connect/send boundary, validation-to-connect DNS changes cannot redirect a socket privately, and an allowed destination still works.	First ticket. No schema. Network-handler rollback reopens the defect; retain the previous handler only as an emergency operational option with equivalent egress restriction. Do not alter all HttpClients.
B02 Cross-account form/session boundary	M. src/auth.ts, api.ts, App.tsx, profile/editor state binding, a narrow server precondition if required, auth/browser tests.	Bind retained state and outgoing writes to the identity/session generation that loaded it. Synchronize tabs, invalidate owner caches, ignore late responses, refuse mismatched dispatch. Close the shared-cookie race with a server-checked mismatch precondition where client timing alone is insufficient. Test actual A edit → B login in second tab → A Save, asserting B and A database values unchanged; include slow old GET, logout, Back and same-account reauth.	Independent of record revisions, and must precede persistent drafts or editor refactoring. Coordinate Program.cs integration with B01/B04 if adding middleware. No schema. Older clients lacking required protection must be forced to refresh/re-auth safely; do not silently fall back to unsafe writes.
B03 Shared PDF admission — complete locally	M. Singleton exporter, PDF callers/error mapping, exporter tests.	Completion and evidence. Default one active render per process, one per document owner, zero waiting; validated options, safe 503/504, cancellation/timeout/shutdown cleanup and failure recovery. Permanent public/variant/job/profile boundary tests plus real Chromium smoke. Implementation inspection corrected the original package reference: packages do not render PDFs.	No schema. The simultaneous owner allowance is enforced inside the exporter independently of middleware; time-window owner/IP rate limits remain B04. Tune process capacity and verify containment under R04. No durable queue or renderer service added.
B04 Resolve principal before owner limiting — complete locally	S. Program.cs, existing rate-key helper, permanent real HTTP tests.	Completion, inventory and evidence. Authentication and endpoint authorization precede account limiting, including explicit-scheme principal selection; validated owner/IP namespaces, shared-IP account isolation, shared same-account sessions/credentials, preserved IP controls, safe 429/Retry-After. Concurrent, crafted identity, invalid credential, B02 context and trusted/untrusted proxy tests pass.	No schema or policy-window changes. B01/B02/B03 preserved. Process-local counters and B06 deployed ingress verification remain explicit.
B05 Spreadsheet-safe CSV fields — complete locally	S. ExportController, small text helper, byte-preserving UI download and export tests.	Completion and evidence. All 13 text columns neutralize leading = + - @, including after whitespace/controls/Unicode format characters, before existing CSV escaping. Typed numbers/dates, stored data and JSON remain unchanged. Parser, HTTP/browser-byte and local Excel checks pass; UTF-8 BOM corrects reproduced Norwegian decoding.	No schema/framework/dependency change. Spreadsheet-safe CSV may visibly retain the apostrophe; raw JSON remains available. LibreOffice runtime verification unavailable; defined policy and compatibility limits documented.
B06 Verify and close ingress bypass path — implementation complete; runtime verification pending	S source/config change plus operator verification. Compose/nginx/forwarded-proxy tests/docs.	Implementation, runtime observations and gates. Production render has frontend 3000 and no API publication. Fresh API/config tests pass. DNS/valid public HTTPS and failed direct-port connections are observed; HTTP redirects to unreachable port 444. Actual Compose/Traefik/nginx execution is blocked by Docker failure; deployed peer/IP/firewall evidence is absent. F04 remains open.	Read-only production inspection authorized, but no unambiguous SSH alias/user exists in permitted sources; use operator handoff. Deployment changes remain separate. Complete real-container and production evidence; do not start B07. A bad binding can cause downtime; retain a tested topology-specific rollback.
B07 IMAP connected-address enforcement	M. ImapService, focused network policy/connector and IMAP SSRF tests.	Reuse the B01 address-policy conclusion, but respect MailKit's transport. Enforce an approved connected peer on initial connection and reconnect; retain certificate hostname validation and timeouts. Existing mapped normalization is already correct: do not fix it again.	After B01 establishes the small shared policy, with sequential integration if it shares helper code. No schema. Test TLS identity with an injected/local fixture; do not disable validation to connect by IP.

Batch stop condition: V01's actual persisted cross-account save is prevented; HTTP/IMAP outbound address paths and shared PDF admission have failing-before/passing-after evidence; correct owner/IP partitioning remains enforced. Actual ingress reachability proof is required before a public deployment. B01 alone does not close all of F11.

Batch 1 — Release pipeline and recovery before migrations

Findings: F12, F17, F19, conditional F20; the immediate containment portion of F03/F18. This batch intentionally precedes schema-changing concurrency and billing work. A migration is not safe merely because its unit tests pass when the recovery/rollback path is unproven.

Order / ticket	Size and ownership	Concrete scope and acceptance	Dependencies / rollback risk
R01a Standalone type gate — partially resolved during authorized release repair, 2026-09-10	S. interview-prep.test.tsx, UI package script, CI workflow.	The patched Next build exposed the historical TS2571. A test-only object matcher now preserves the positive/negative content assertions without dereferencing an unknown Axios payload; 13 interview tests, standalone tsc and Next build pass. An explicit standalone CI command remains outstanding; keep strictness and test coverage. See release evidence.	Can run in parallel with Batch 0. No production-code behavior or schema. Do not weaken the gate to preserve a green build.
R01b Production DB configuration validation	S. Provider-selection code in Program.cs and startup tests.	Fail startup for an unknown production provider or missing required configured connection. Preserve deliberate dev SQLite defaults and valid explicit SQLite/MariaDB. Assert no fallback database is created on rejected startup.	Integrate after Batch 0 Program.cs mutations. No schema; rejecting an existing invalid environment can prevent boot, so validate deployed inputs first.
R02 Consistent recovery-set creation	M. deploy.sh, existing backup runner/scripts, isolated fixture and operator documentation.	Replace live SQLite tar as the DB consistency mechanism; coordinate file inventory/checkpoint or a short write pause, manifest/checksums and incomplete-set marking. Preserve keys/tombstone recovery. For MariaDB, coordinate the file set with the consistent SQL dump.	No new app schema. Can develop synthetic fixture in parallel with Batch 0. A backup that is only present is not yet verified. Keep previous verified sets.
R03 Restore drill and schema-compatible rollback	M. Deploy rollback logic, isolated restore harness and runbook; no production restore in the implementation session.	Restore latest/previous synthetic sets under active-source writes; integrity, FK owner boundaries, attachment hashes, provider-token decryptability and deletion replay must hold. Run previous/new binaries against the intended schema; allow automatic image rollback only when compatible. Record measured RPO/RTO, required key custody and operator steps.	Depends on R02 and Connor's recovery objectives. Blocks every schema-changing ticket below. Failed restore is a stop, not permission to reset the source DB. Do not run downgrade migrations automatically.
R04 PDF/container containment evidence	S/M. API Dockerfile/Compose and bounded local container test.	Verify non-root filesystem permissions, resource/PID limits and renderer operation. Evaluate sandbox/local-file flags against real templates. Measure a small controlled burst after B03 and pick capacity from evidence.	Depends on B03; coordinate Compose changes with B06. Container changes can break rendering/storage; verify permission/health/PDF before rollout. A separate renderer service is a decision only if adequate containment cannot otherwise be demonstrated.
R05 AI worker survival and recovery	M. AiOperationQueue.cs, worker tests/health signal.	Catch at each worker loop, classify cancellation/transient/fatal outcomes, bound retries and expose lost/degraded workers. Inject claim/owner/result persistence failures at concurrency 1 and 2; core host survives recoverable faults, accepted operations resume after lease recovery, no lost result or endless tight retry.	Independent of schema work; required before enabling this worker. Keep its existing kill switch. Do not change the global background exception policy.

Batch stop condition: strict frontend typing and configured-provider startup are deterministic; a recovery set actually restores, and compatibility governs rollback. AI/PDF enabled features need their own containment proof. R03 must be green before Batch 2 or paid-ledger schema changes are applied.

Batch 2 — Record integrity, intent retries and storage accounting

Findings: F01 and the concrete F10 integrity/admission subset. Agree the convention in D01, then apply it to bounded aggregates. Do not introduce a generic concurrency service, universal event sourcing or globally unique job content.

Order / ticket	Size and ownership	Concrete scope and acceptance	Dependencies / rollback risk
D01 CV variant revision protocol	M. CV variant model/service/controller/editor, context migration and CV tests.	Expected revision/conditional update, transactional history, distinct conflict response and retained draft. Reconcile duplicate revision labels preserving every snapshot, then enforce uniqueness. Include restore-versus-save, stale name/settings and old-client handling. Prove with two contexts and SQLite/MariaDB.	B02 + R03. Establish request/response convention before D02/D03. One cohesive vertical change; keep templates/layout/AI tooling outside the diff. Additive rollout first; old unconditional writers must be rejected or refreshed when enforcement starts. Do not revert to an old writer without a compatibility plan.
D02 Career Profile atomic revision/projection	M. Career profile service/controller/model, legacy user projection, profile page/tests and migration.	Separate aggregate revision from structured-document schema version. Atomically replace children, append history and update the derived legacy projection, or document/test a recoverable projection only if a shared transaction is demonstrably impossible. Cover restore, projection-write failure, delete-versus-save and losing drafts.	D01 contract + R03. Preserve old versions/child IDs as required; no identity/profile-field redesign. Same-account transaction correctness does not replace B02.
D03a Job mutation preconditions	M. Job aggregate/controller/status operations, admin undo and generated-draft writers that touch the same aggregate; model/migration/tests.	Inventory exact conflicting write sets; apply the agreed revision rule to user read-modify-write paths and prevent background writes from silently replacing newer user drafts. One conflict must not partially update events/opportunity projection. Explicitly justify field-disjoint writes allowed to commute.	D01 convention + R03. Own the schema snapshot serially. If inventory is too broad, split status/full-edit and draft-generation writers into consecutive tickets with each unprotected path left visibly open. Do not claim F01 closed between them.
D03b Job client conflict handling	M. Existing job detail/edit/status/draft client paths and browser tests.	Send loaded revisions, retain losing edits, explain reload/compare/copy without blind retries; delayed responses cannot replace current owner state.	D03a + B02. Integrate before enabling mandatory job preconditions. No independent schema. No dashboard redesign.
D04 Creation intent idempotency	M. Manual/imported job creation boundary, relevant client submission state, narrow intent persistence and relational tests.	One key per user creation intent, unique owner/key constraint, payload fingerprint and returned resource identity committed with the creation. Same key/same payload returns the original; same key/different payload conflicts; two owners are independent; a deliberate new application uses a new key. Test lost response/retry and concurrent identical requests.	R03 and settled job creation transaction. Can prepare after D01; integrate after D03 schema changes. Do not deduplicate by company/title/URL globally or retrofit every endpoint. Retain intent records for an explicit retry window; expired-key behavior must be documented.
D05 Atomic attachment byte reservation	M. Attachment admission/storage service, owner quota state and focused migration/tests.	Reserve bytes atomically before staging, release/commit correctly on cancellation/failure; two near-limit uploads cannot both pass. DB transaction/reservation works across processes. Preserve existing staged-file reconciliation and safe path handling.	R03; integrate after other schema tickets. No silently deleted files to meet a quota. Reservation cleanup/reconciliation must survive crashes.
D06 Generated-file accounting	M. Existing AccountOwnedFileInventory, PDF/artifact/package producers, quota reconciliation/tests.	Account for generated artifacts and temporary/retained export copies with explicit limits and cleanup. Reuse D05 accounting contract; avoid counting only attachments or charging the same retained file twice. Test copy/delete/crash and old existing inventory.	D05 + B03. Rollback retains existing files; a reconciliation disagreement blocks new growth safely and alerts, rather than purging unknown user data.
D07 Bounded exports/history growth	M per export family. Account export first; jobs export separately if needed.	Measure synthetic 1k/10k owner histories, enforce peak-memory/request bounds, stream JSON/rows into the current ZIP/output as needed. Add conservative growth admission where required. Test account export remains available for existing over-quota data. History pruning is excluded until Connor approves restore promises.	D05/D06 for resource contract; R03 for any persistent limits. Do not jump directly to a queued export platform or optimize 100k rows without evidence. No destructive retention migration.

Batch stop condition: stale client writes cannot win silently; histories remain complete/unambiguous; projection/children updates are atomic; creation retries have a stated contract; bytes cannot exceed admission through concurrency or omitted producers. Both providers need meaningful relational evidence. Preserve all pre-migration data and safe old-client behavior.

Batch 3 — Paid account lifecycle

Finding: F02, with retention/deletion policy and conditional premium worker dependencies. Correct entitlement and deletion behavior precedes billing UX. This batch can be prepared earlier, but paid behavior stays gated until it is complete.

Order / ticket	Size and ownership	Concrete scope and acceptance	Dependencies / rollback risk
P01 Purchase intent	M. Billing checkout/gateway, narrow persisted attempt and billing tests.	Stable purchase-attempt identity reused after double-click/timeout, provider idempotency and explicit handling of an existing/pending subscription. Two simultaneous requests and an unknown first result cannot create a second intended purchase.	R03; reuse D04's intent principles, not necessarily its table. Billing schema integration has one owner. Retain attempt/customer IDs during rollback; disable new checkout on unresolved state.
P02 Entitlement reconciliation	M. Billing handler, entitlement derivation, local transaction/reconciliation and tests.	Reconcile relevant current customer subscriptions, not whichever event's subscription was processed last. Atomically commit local provider state and role consequences; failures cause safe retry. Test active+cancelled subscriptions, delayed/out-of-order/concurrent events, duplicate delivery and failure between local writes.	P01/local identity contract. A synchronous design with provider retries is acceptable; durable inbox only if acknowledging deferred work. Reconciliation must recover missed delivery. Old images cannot safely reinterpret a new billing ledger without a reviewed compatibility plan.
P03 Deletion versus paid lifecycle	M. Existing deletion stages, billing cancellation seam, UI confirmation only as required and lifecycle tests.	First guard active/uncertain billing and pending checkout. Then implement the chosen cancellation/access policy; retain provider identifiers until confirmed resolution. Retry unavailable provider safely, handle deletion racing checkout/webhooks, and preserve minimal approved billing/deletion records.	P01/P02 + Connor's deletion/retention policy. Sandbox must prove the charged-account scenario. Do not erase the identity then attempt cancellation. Preserve pending stages across rollback; suspend new deletion admission if reconciliation is unhealthy.

Batch stop condition: authorized Stripe sandbox confirms one intended purchase, correct entitlement, provider retry/reconciliation and no continuing unresolved charge after completed deletion. Disabled deletion is a temporary containment state, not completion. Enabled premium features also require R05 where applicable. No paid-beta admission until these conditions and recovery/accessibility gates hold.

Batch 4 — Accessibility and shared design foundations

Finding: F14 plus the test coverage gap. These tickets may begin in parallel early on their own files; their integration must preserve B02/D01 form behavior. Structural fixes come before cosmetic redesign.

Order / ticket	Size and ownership	Concrete scope and acceptance	Dependencies / rollback risk
A01 Semantic theme/component colors	S/M. src/theme.ts, necessary shared MUI overrides and loaded-state accessibility fixtures.	Correct small-text success/primary contrast in light/dark default/hover/focus/selected states. Check actual foreground/background pairs across chips, tabs and outlined buttons; preserve filled-button contrast.	Can proceed independently of backend work. No schema. Theme changes have broad visual impact: inspect both themes on existing pages before integration. Do not change every page or replace MUI.
A02 Builder preview keyboard structure	S. CvBuilderEditor preview region and focused browser tests.	Make the overflowing preview region named/focusable as appropriate; prove keyboard scrolling, focus visibility and no trap for iframe/page content. Include mobile→desktop transition, one/multiple pages and editing/preview controls.	A01 can proceed independently, but do not edit this file simultaneously with D01. No schema; avoid blanket tabindex additions.
A03 Accessibility coverage and manual gate	M test/documentation session; defects found become bounded follow-ups.	Loaded builder/profile/job detail + key dialogs/errors, EN/NB, both themes, mobile and desktop. Wait for meaningful data, not merely main. Complete keyboard/NVDA-or-Narrator, zoom/reflow/text spacing, forced colors and focus/error/reauthentication checks.	A01/A02 and stable B02/D01 conflicts. Automated success cannot substitute for manual evidence. No new accessibility compliance claim from axe alone.

Batch stop condition: primary workflows, save/conflict recovery and preview are operable by keyboard with usable focus and announcements; shared contrast fixes and representative loaded-state axe coverage pass. New primary-flow structural defects block public exposure; purely cosmetic work does not.

Batch 5 — Product and workflow corrections

Findings: F21, F07, F15, F13, F16 and F09. These are scoped product/operational fixes, not grounds for a simultaneous whole-app rewrite.

Order / ticket	Size and ownership	Concrete scope and acceptance	Dependencies / rollback risk
W01 Date-only calendar contract	S/M. Calendar shared event conversion/provider-link/ICS tests and minimal labels if necessary.	Follow-ups/deadlines remain dates and export all-day with correct exclusive end date. Test UTC control, offset-bearing inputs separately, DST transitions and both database/server timezone settings.	Can prepare early; avoid database date migration by default. Resolve any real timed-field evidence separately. Existing external events will not be magically corrected; describe behavior for newly exported events.
W02 Reminder outcome semantics	M. Reminder worker/sender result contract and existing durable email-attempt seam where reusable.	Distinguish suppressed, accepted, failed and unknown; persist per-reminder outcome/dedup intent. Test later-send failure, commit failure, disabled sender and uncertain SMTP result. Auth resend remains recoverable; do not promise exactly-once SMTP.	Use R05 failure-boundary convention and R03 before any attempt schema. No second email platform. Provider sandbox/local mailbox sink before enabling revised sending. Unknown sends are not blindly replayed.
W03 Sensitive response cache policy	S. Private export/document/auth response policy and header tests.	Apply appropriate no-store to sensitive personalized responses, retain public/shared route semantics and verify proxy behavior. Handle CSP separately if it affects preview frames.	B02 is independently required; headers do not fix stale React state. No schema. Test public CV/static assets and PDF preview before changing global headers.
W04 Admin event/data minimization	M. Admin diagnostics and security mutation metadata; targeted logging cleanup may be a separate S ticket.	Minimize unnecessary private fields, record high-impact actor/action/target/outcome, avoid full URLs/documents/provider errors in logs, test role revocation/denied verbs. Preserve intentional admin capabilities.	Connor's actual support/retention policy; R03 before new audit storage. No speculative support role, impersonation or tamper-proof claims. Audit record migration must retain existing evidence.
W05 Draft recovery decision and narrow pilot	M, one editor only. Existing draft/dirty-state helpers and the chosen editor.	Keep warnings and in-memory edits; if approved, add opt-in owner/schema/expiry-scoped local recovery with explicit restore. Test offline, expired session, denied/quota storage, account change and conflicting revision.	Must follow B02 and D01/D02, plus Connor's local-content decision. No service worker/PWA or indiscriminate private caches. Rollback must not mix or silently apply old drafts.

Batch stop condition: each workflow's narrower acceptance passes; no silent time shift, suppressed-as-delivered message, ownerless draft or accidental private logging. Decisions about retention/local drafts remain explicit rather than hidden in implementation defaults.

Batch 6 — Broader UX and measured operational hardening

Findings: remaining F16/F18 and measured F10 scale concerns; original product proposals with no reproduced blocker. CPU admission, quota safety, restore and worker containment are already in earlier batches.

Order / ticket	Size and ownership	Concrete scope and acceptance	Dependencies / rollback risk
U01 Route-by-route UX correction	S/M per chosen workflow, one page/interaction family.	Prioritize observed task completion problems, terminology and empty/error/loading states. Preserve owner/revision/focus primitives. Test the full user task in EN/NB and both themes.	B02/D01–D03/A01–A03. Do not redesign every route in one session; no schema unless separately scoped. Revert one route safely.
O01 Reproducible release inputs	S/M per build ecosystem. API Docker restore/SDK inputs first, then other lock/pin/scan evidence.	Actual image build honors intended SDK/build props and lock files; retain release provenance and an explicit advisory exception policy. Verify supported versions/current advisories only when external access is authorized.	Coordinate with R04 Dockerfile and R01 CI ownership; do not combine broad runtime upgrades with audit repairs. Rebuild/test the changed artifact and preserve known-good images.
O02 Capacity, monitoring and operator drills	M per measured bottleneck or drill.	Measure representative rows/export sizes/query plans/RSS; fix demonstrated hotspots, alert on storage, restored-backup age, worker health and billing divergence. Validate support/deletion/key rotation/incident procedures.	Early bounds and recovery already complete. Tune limits with evidence; no speculative Redis, broker, read replica or service split. No destructive load against production.

Batch stop condition: release evidence matches the intended audience and enabled features. Public paid readiness depends on verified real operational/support behavior, not completion of every cosmetic item in the original audit inventory.

Safe parallel work and prohibited overlap

• B01 HTTP boundary, B02 identity analysis/tests, B03 exporter, B05 CSV, R01a typing, R02 synthetic backup fixture and A01 theme can proceed independently with assigned file ownership. Shared Program.cs, CI and Compose edits still integrate sequentially.
• B07 follows the address-policy decision in B01. Do not develop competing outbound-policy helpers or two versions of the same HTTP handler.
• Only one migration/context snapshot owner integrates at a time. D01 → D02 → D03a → D04 → D05/P01 schema commits are serialized even if isolated test/client work is prepared in parallel.
• D03b may be prepared against D03a's agreed API but cannot independently change the protocol. P01/P02/P03 share billing state and must integrate in that order; do not build billing UX against unsettled entitlement rules.
• B02/auth/editor lifecycle must settle before W05 persistent drafts. D01 and A02 both touch CvBuilderEditor: serialize edits or explicitly divide non-overlapping responsibility and review their combined behavior.
• A01 shared tokens precedes U01 visual redesign. A03 final accessibility evidence follows the combined form/identity/conflict changes, even if fixtures are written earlier.
• R02/R03 may run alongside non-schema security fixes. Their failure blocks migration/deployment advancement; it does not block safe source inspection or independent unit-test preparation.

B01 first-session handoff — completed 2026-09-08 (scope retained)

Take B01 only. Objective: prevent HTTP job import from connecting to private/local/link-local destinations through mapped IPv4 or a validation-versus-connection DNS change, while preserving legitimate imports.

1. Read the validated F11/V02 evidence and current JobImportService, IHostAddressResolver, named import HttpClient registration and existing import tests. Reproduce the mapped-address guard failure with a non-network fake.
2. Add the narrow mapped-address normalization and move/enforce policy at the actual connection boundary. Prefer the existing .NET HTTP/socket facilities; preserve original hostname/SNI/certificate checks, redirects disabled, bounded response size and cancellation. Do not modify unrelated HttpClients or add a network framework.
3. Add regression tests for IPv4/IPv6/mapped/loopback/link-local/mixed answers, differing resolution answers, allowed address, timeout/cancel and TLS hostname behavior. Use controlled local/fake transport; no real private host/metadata or third-party DNS calls. A validator-only unit test does not prove the DNS race is closed.
4. Run the focused backend import/network tests and the affected API build. Review the diff for accidental request, TLS, proxy or parser changes; document any deployment egress assumptions and the remaining IMAP ticket.

Owned files: import service and a narrowly justified adjacent address/connection helper, the named import HTTP registration in Program.cs, and related tests. Excluded: IMAP implementation (B07), CV/billing/schema/UI changes, deployment, global policy rewrites and dependency upgrades. No migration. If safe connected-peer enforcement cannot be verified locally, retain the passing normalization fix as a bounded partial change but leave B01/F11 open; do not claim validator-only protection closes SSRF.

Handoff acceptance: the retained exploit fixtures fail against the original and pass against the change; connection-time tests prove no denied peer is attempted; allowed requests still behave correctly; no TLS relaxation, source data change or unrelated edits. These criteria now pass for B01; see the completion record. Subsequently authorized B02–B05 also pass their local acceptance criteria with documented limits; see their completion records above. B06 was subsequently authorized and implemented, with local topology and production verification still pending. Complete those gates before closure; B07 and the broad overhaul remain unstarted.