jobtrackingapp/docs/redesign/phase-5/production-release-decision/README.md

Part A — production release decision — 2026-10-08

Production decision: NO-GO. The completed redesign remains a release candidate. Critical production safety evidence is unavailable, so no production-branch merge/push or deployment was performed. No production configuration, service, database, volume, backup or credential was changed; no production endpoint or model was contacted in this assessment.

Assessed source: 1095ef1d29856a2984cd800abd2bbd65dd472d38, codex/ui-redesign-phase4. A fresh git fetch origin and git ls-remote --symref confirm production target main, 27657f31131cd95d42f0e1290853ec9c9b3959a4, at https://git.cesnimda.uk/cesnimda/jobtrackingapp.git. Remote HEAD points to main; no remote master exists. The candidate has 45 additional commits and zero target-only commits. Release/merge commit and deployed candidate SHA: none.

Deployment boundary

Both the fetched main and candidate Gitea workflow run tests on main pushes and pull requests. A successful complete test job automatically enables deployment only for a push to refs/heads/main. Deployment uses the established PROD_HOST, PROD_USER and PROD_SSH_KEY secret mechanism, resets /opt/job-tracker/app to the workflow SHA and invokes deploy.sh. A main push is therefore a production action. Actual remote branch-protection settings and candidate runner acceptance were not verified.

No usable production connection was established. The permitted repository material supplies secret names rather than a verified SSH alias/user, and the current C:/Users/Connor/.ssh/config existence check returned false. Historical operator access does not provide a current connection. No connection was guessed and no secret values, private keys, live .env, cookies or authentication state were retrieved.

Critical evidence and remediation

Gate	Current result and evidence required
F04/B06 actual ingress	Open. Obtain the deployed revision/image IDs, real Traefik placement/router/TLS/upstream/forwarding settings, generated nginx trust entries and observed original socket peer. Show that an untrusted route has a different source, that edge spoofing cannot select client IP/scheme/host, and that the API receives the intended client identity. A shared NAT source for trusted and untrusted paths is a stop condition; use an explicitly reviewed binding/firewall or dedicated proxy route before trusting that peer.
Listeners, network and external boundary	Unverified. Inspect actual published/container/host listeners, network membership, Docker NAT/FORWARD and provider/host IPv4/IPv6 controls. From an independent external network, verify direct/spoofed application denial, every intended A/AAAA address, valid TLS and a reachable canonical HTTP redirect. The historical redirect to unreachable HTTPS port 444 has not been reverified or closed.
Real-chain runtime and identity	Unverified. On an isolated equivalent topology, prove real nginx startup/configuration rejection/restart stability, trusted/untrusted forwarding, actual backend client-IP observations, A/B rate-budget isolation and B02 account/session context behavior. Local API/Compose tests do not establish the deployed chain.
Current backup and restore	Unverified. Inventory a fresh complete database/files/CV/exports/Data Protection keys/tombstones recovery set, integrity, custody, retention and off-host protection. Restore a current production backup into an isolated target; compare counts/content/non-ASCII data, boot the application and prove decryption and deletion-tombstone replay. Historical seeded MariaDB restoration and old gzip-valid database-only dumps are insufficient.
Configuration, schema and rollback	Unverified. Confirm the actual database provider/connection, schema/migration history, canonical origin/auth/ingress configuration, current version/counts and recoverable prior images. Rehearse failure injection and code/image rollback on a disposable Linux host with the intended topology, preserving data and failed deployment status. The existing script is a mechanism, not rehearsal evidence. F19's startup fallback to SQLite remains open; confirm the intended provider rather than accepting empty fallback data.
Protected CI, deployment and authenticated acceptance	Unverified. Obtain complete candidate remote test/browser results through the protected workflow. After every critical pre-release gate permits deployment, record actual deployment completion, matching SHA/version, /health, /ready and public auth configuration. Verify existing-account login, owner/account separation, application/company counts, Career Profile/languages, workspace, CV variants/themes/public PDF and an existing attachment; verify configured OAuth/email/provider paths with authorized test accounts. Local tests and public health alone cannot establish these outcomes.

Use the current deployment checklist, backup requirements, disaster recovery guidance and migration compatibility rules. The historical B06 operator handoff retains the exact read-only inventory, sanitized output and SYN-only peer procedure. It is a procedure and historical evidence, not current production acceptance. Restart, invalid-configuration, failure-injection and restore rehearsals belong on isolated targets; no live destructive operation is authorized by this record.

The Git migration comparison adds no DDL migration: three historical migration files change documentation comments only, and the snapshot adds concurrency metadata to the existing CV Version property. Compose is unchanged. Existing startup migration/reconciliation still runs, so the actual deployed schema/provider and recovery evidence remain required.

Authorized continuation and preserved deferral

Connor's current instruction authorizes local P5-14 independently of production release. This supersedes the historical release-first continuation condition for that work. Production NO-GO does not stop the authorized P5-14 checkpoint for currently implemented CV workflows. Its acceptance must retain the absent P5-13 AI-review journey and all production/accessibility limitations explicitly; no unconditional Phase 5 completion follows from this scope revision.

P5-13 remains DEFERRED — BLOCKED / NOT QUALIFIED: no new qualification calls or human reviews, and no AI-review UI implementation. Preserve the existing Production guard in Program.cs: CvAiSuggestionService is registered only outside Production, so proposal generation and Apply use the established 503 cv_ai_unavailable boundary before model requests or CV/profile/history mutation. Other AI registrations and ordinary CV editing/save/history/preview/PDF remain under their existing boundaries. This repository guard is not proof of the current deployed service. The frozen qualification packet and return conditions remain intact; no Docker recovery or semantic qualification was attempted.

Preservation is reconciled through the existing 57-group preservation review, original requirements and per-slice successor evidence. That mapping retains its provider/manual/production gaps; it is not an exhaustive coverage percentage or acceptance of every sub-workflow. P5-14 must add its own bounded evidence without removing inherited requirements.

Final validation

Fresh validation against unchanged application/test/configuration source at 1095ef1, before P5-14 changes:

Check	Actual result
Backend Release / focused AI / revision safety	1,023 / 108 / 5 passing; focused cases are subsets of the backend total
Frontend Jest	455 passing, 81 suites
Chromium application browser	112 actual passing, zero skips/failures/retries; P2-D01 is an ordinary passing case
Native real-HTTP contracts	2 passing, including isolated Production withholding and unrelated-AI availability
Sidecar	49 passing, offline synthetic tests, no model qualification
Rate-limit / ingress / PDF admission / Compose configuration	9 / 6 / 1 / 3 passing
Standard preview/PDF fidelity	16/16, 36 = 36 pages, existing dimensional/position/font/colour tolerances unchanged
Settings export fidelity	8/8, 24 = 24 pages, existing tolerances unchanged
TypeScript / separate browser TypeScript / lint	Passing
Frontend production / API Release / test-project Release builds	Passing; API/test builds have zero warnings/errors
Supply-chain helpers / offline evaluation harness / extension tests	3 / 5 / 3 passing; harness tests do not make model calls
Secrets / working and staged whitespace / documentation links	Passing; 158 current/root Markdown targets checked, historical archive excluded

No test-count changes. Raw TRX/XML, browser/Jest reports, exported PDFs, measurements and comparisons are retained under ignored .artifacts/p5-release-decision/; VALIDATION.json records counts, commands and incomplete accessibility checks. The browser run retained 229 axe scans, zero reported violations and 1,712 incomplete node occurrences (1,466 contrast, 191 prohibited-attribute, 33 hidden-focus, 18 valid-value and 4 table-header). Incomplete checks and human screen-reader acceptance are open, not passes. Existing themed/localised responsive workflows ran, but native hardware touch and production font/photo qualification are not established by Chromium.

An initial specialized-suite command used an incorrectly constructed CLI argument and found zero tests; it was corrected and all three explicit configurations ran. That accidental development-server launch generated two Next.js instruction files; their generator/provenance was verified and only those generated artifacts were removed. No application source changed or check was weakened.

The release decision remains NO-GO despite these local passes. This documentation checkpoint authorizes no production merge, push or deployment; P5-14 continues separately on the existing development history.