jobtrackingapp/docs/direct-roadmap/LATEST_CHECKPOINT.md

Direct execution continuation

Newest direct execution checkpoint: isolated combined application review branch codex/direct-roadmap-integration published and independently verified at d3d338376444b8abdcaf7200f682faa3daf1ad10, worktree C:\Users\Connor\.codex\worktrees\direct-roadmap-integration\Job tracker. It preserves approved CLEAN-20 and integrates exact validated I18N/backup paths, with no change to accepted automation handoff records, API sources or workflow configuration. See its docs/direct-roadmap/INTEGRATION_CHECKPOINT.md. Fresh combined checks: 195 selected frontend tests in 16 suites; full typecheck/lint/build; five mocked backup-function tests and Bash syntax, all passed. Additional catalogue QA: 10 tests in three suites; subsequent language-control QA: 17 tests in three suites, with overlap explicitly retained separately. Latest runtime language-control fix has its own fresh passing production build. Native JSON reports archived. No fresh browser, final integrated security, real provider/model, live restore or production qualification.

I18N finite key-domain census COMPLETE at published/read-back 4172c23d7ce13e8327a5e51bbb09f296c24fb9b8: all 188 historical indices accounted for, 108 original + 80 supplemental, zero pending. Register schema 3 declares LF-normalised reviewed-text hashes for checkout portability, preserves original historical hashes, and distinguishes repeated same-line calls by immutable inventory index. This does not close every-string context, direct access/backend literals, European registry/native/plural/market or release gates. Tests enforce equal EN/Bokmål keys, placeholder sets and nonblank values across 3,119 keys per language; resources and translations were not invented or published for candidate locales. Only integration branch additionally contains the new catalogue tests, supported-language native-name/NB control fix and corrected JobFlowBar caller note. Prefer that branch for further ordinary integrated development.

Phase 10 separately published/read-back db818e5ebd19eeedc05ae58dc3f7a908ce0e713d: 14 new disjoint AttachmentConsistencyTests passed; selected backend coverage now 103, frontend Phase 10 coverage remains 92. P10-05 remains OPEN; do not claim complete regression/acceptance. Security source matrix follow-through published/read-back 88bcd6d91c6823ffc6bbc6a6de176ab7769e729f: actual relational ownership denial evidence identified; HTTP/missing-owner/list/upload/MariaDB/final scan gaps retained. No Codex Security scan launched; desktop workflow references read, setup/capability/cost/scope and final integrated gates remain separate.

Homepage preparation published/read-back af8c48ce7090f2c56bc8f9a47494b440312ec12a on feature/launch-site-redesign: design-neutral content, locale and crawlable-HTML/SEO contracts; unchanged rendering-shell sources matched the available build, whose raw export lacked descriptive content/canonical/hreflang. No layout/route/metadata implementation or public marketing publication. Five application concepts and requested comparison ready in product-modernisation local-only commit 2f081e6f: docs/product-modernisation/CONCEPT_COMPARISON.md and REVIEW_PACK.md, http://127.0.0.1:4317/gallery.html. No sixth concept and no final unapproved UI design implementation. Preserve design branch publishing restriction and all prior owner selections.

Next eligible work: use the integration branch for remaining literal/direct-access/localisation context work; continue bounded source audit without representing it as a plugin scan or final security gate; qualify full Phase 10/preservation evidence using unchanged source-bound results; complete detailed product journeys and review preparation without final design implementation. Remaining owner/environment gates: final design/implementation roadmap, locale market/native reviewer and Montenegrin identity, required predecessor acceptance/provider/data grants for GJ stages, approved public-site visuals/claims, scan policy/paid deep budget/named staging scope, isolated Linux recovery/hosted CI and production/human/device decisions. No orchestrator access, pre-P10 changes, main merge or deployment.

Current continuation after 2a4acc17: Phase 10 acceptance register published/read back at 6f29ed4cdb7b259318282f365d737f6cfdb6a682 (P10-05 remains OPEN). Fresh integrity check: 263 indexed artifact hashes and 1,279 retained source hashes match; only approved App.css absent. No extra deletion candidate.

I18N branch latest published/read-back ebd33fcf0040ed7ebe659c75171873a88cdfc025. Actual fixes: 2108ea50 session-change message uses existing EN/NB catalogue outside private providers; 7b132ec4 own-property guards for completeness/timeline unknown labels; 36db9322 inherited-name pipeline alias fallback. Selected runs separately: 17 session tests, 41 label/workflow tests, 29 pipeline/board tests, all passing. Typecheck and scoped lint passed for each implementation package. Static production build passed before the final one-line pipeline patch; do not claim a fresh final-pipeline build. Local AST graph update completed, 18,560 nodes / 46,020 edges; generated graphs untracked. Sanitized 17/41 native reports committed; pipeline native JSON remains ignored locally. DYNAMIC_RESOLUTION_REGISTER.json binds 18 individually matched supplemental call sites and reviewed source hashes to the original inventory: 126 resolved / 62 pending of 188, no duplicate counts. Final integrated security tests remain open until relevant application changes are complete.

Five rendered UI concepts are review-ready: product-modernisation local-only commit c678ebdb, docs/product-modernisation/REVIEW_PACK.md. Gallery http://127.0.0.1:4317/gallery.html; preferred expanded A3 http://127.0.0.1:4317/expanded.html. All 70 original screenshot files and ten gallery previews confirmed present; accepted 75-screenshot execution reused, not rerun. Earlier owner choices retained; no final unapproved design implementation. Design branch not pushed under its specific publishing restriction.

Global Jobs eligibility rechecked against planning branch docs/global-jobs/00/DEPENDENCIES_AND_GATES.md, PROVIDER_RIGHTS_MATRIX.md and OWNER_ACTIONS.md. Their old blanket no-implementation authority is superseded only by later direct-chat authorisation for independent ordinary work; required Phase 10/Product Review acceptance, stage/data/lifecycle/provider grants remain open. GJ-00 evidence is dated 28 October, not a fresh provider check. No credentials, registrations, scraping or provider calls occurred. European localisation registry/market/native-review choices, public homepage visual/claims approval, final design, hosted/live recovery/CI and security scan/staging gates remain separate; do not silently mark them complete.

Next eligible work: continue the 62 unresolved dynamic calls using the machine register to avoid repeats; review processing-monitor external-key maps for inherited-property behavior, then finite interview/prep/action maps; finish European catalogue context/legal evidence and eligible fixture checks; continue security owner-filter/source matrix review without final integrated scanning. Prepare fresh build/browser checks when relevant app scope stabilises, retaining all baseline/source boundaries. No immediate owner input is required for this offline work. No orchestrator access, pre-P10 edits, main merge or production deployment.

Newest continuation receipts: Phase 10 ba826de1e5c959352e4442ab2fec5d02445dd32d (89 backend + 92 frontend selected cases, separately counted); I18N bab240914e30fb1e8e3756fbe568cbd60e39db32 (120/188 dynamic calls resolved; 68 pending); security offline preflight 0a17a33db7b9944693976df432f1e5a319277279. All three refs were independently read back after normal publication. Security worktree: C:\Users\Connor.codex\worktrees\security-offline-preflight\Job tracker, branch codex/security-offline-preflight. It contains partial Phase 00/01 inventory, ROE, eight-row source endpoint matrix and honest scan register. No scan or active staging attack executed; no policy file written. Continue there from docs/security/01-threat-model.md, completing owner-filter/sibling-path/source matrix review and actual plugin capability preflight. Read further subordinate prompts before entering later audit stages. Audit acceptance remains open.

Decisions parked for owner catch-up: exact proposed root security policy before any policy write; separately bounded deep-scan cost/runtime; named isolated staging hosts/accounts/rates before active attacks; final comprehensive product design and implementation roadmap; native-language/market and release/human/device gates. None is required for the next offline source review. Session-boundary English text remains an implementation item requiring privacy/unmount regression checks; preserve old-provider teardown. Orchestrator and pre-P10 worktree remain untouched.

Latest continuation: P10-04 selected regression has 89 backend cases and 92 frontend tests passing, zero failures/skips/pending. Native evidence is archived under docs/redesign/phase-10/p10-04-evidence; P10-04.md records exact filters, source boundaries and remaining qualification. Backend checkpoint 525b5fe4d74ab75f711651fe3a36b988b07abc4d was independently remotely verified. I18N finite-map review was published/read back at f577565f7146c6e0cba6edd00b4e804b032ad670: 112 dynamic calls resolved / 76 pending. It verified 15 letter/completeness keys in both catalogues; checklist default review verified all 14 current defaults but retained the legacy unknown-key gap. No additional cleanup or production change.

Next: continue independent audit, remaining i18n owner maps/literals, and P10-05 evidence reconciliation. Keep final design/implementation approval, market/language decisions, provider/licensing access, live recovery, hosted CI and human/device gates open; ordinary local work need not wait for these unrelated gates. No user input is required for the next static review package.

Latest cross-workstream receipt (2 November 2026): I18N attachment preview fix published and independently read back at 4939585fb1272de69f4b1776f6a8f08af639762a; supplemental checklist category review at 1559697eda967b8c767ac6595ba934877df89fcd on codex/i18n-accessible-labels. Thirteen focused attachment/file-picker tests passed, typecheck passed, scoped lint passed. Graph update completed locally (18,548 nodes / 45,998 edges); generated graph remains untracked. See the I18N worktree's docs/i18n/ATTACHMENT_PREVIEW_LABEL.md and CHECKLIST_DYNAMIC_REVIEW.md. Dynamic review now 109 resolved / 79 pending, supplementing the historical inventory. Phase 10 latest published retain-review checkpoint is 927f909b0d65a24d617f0bac20d4c1fd7693f072. These receipts supersede older pending statements below.

Next independently executable work: inspect checklist backend/default and legacy system-key coverage, continue the remaining dynamic/literal reviews, and progress P10-04/05 qualification. Four checklist template calls remain open pending compatibility analysis. Product design still awaits final comprehensive design approval before full production overhaul. No live provider/model/production qualification or complete security audit is claimed.

Latest: CLEAN-20 published and remotely verified at 78f7396adb2f1d3452c10e60bc0dbbd3a4a602e4. P10-02/03 bounded retain reviews recorded; no further deletion nominated. P10-04/05 and independent audit remain open. Earlier pending-publication statements below describe the preceding checkpoint.

2 November 2026. Latest owner authorisation permits independent ordinary application work, preserves genuine gates, and explicitly approves CLEAN-20 only. Older statements requiring that approval are superseded.

• Phase 10: CLEAN-20 implemented and verified, see ../redesign/phase-10/P10-01.md. Publication pending exact receipt. P10-02–05 remain open; no extra cleanup approved.
• Release readiness: backup connection-parser fix published and read back at f19e7ebf4aeae350b43fa84cf115c393030280f0 on codex/release-backup-parser, in release-readiness-discovery worktree. 31 offline tests passed; no live restore/deployment qualification.
• Product modernisation: isolated codex/product-modernisation worktree, latest local checkpoint 192095b8; design prototypes and user choices retained under docs/product-modernisation. A1 dashboard + D1 foundation + B1 tracking, CV editor left/preview right, context right; overview-first Career Profile; agenda/month calendar including application deadlines; automation under Settings. No final full-application implementation approval. Prototype commits not remotely published.
• I18N: codex/i18n-accessible-labels branch created from 55adc1d; implementation pending. Earlier translation audit counts remain historical; do not claim all dynamic calls fixed.

Next authorised work: publish validated CLEAN-20 normally and independently verify ref, then P10-02 retained-compatibility review and eligible independent fixes. Preserve primary/pre-P10 worktrees and all source-defined gates. No orchestrator commands, keys, configuration or queue changes; no main merge, models or production deployment. Full security/product/release acceptance remains incomplete.