jobtrackingapp/docs/release-readiness/01_SYSTEM_INVENTORY.md

Preliminary release discovery

2026-11-02. Branch planning/release-readiness-discovery; accepted conditional development baseline 5cb903b989742b7a96cb22ddf4c0e24993b18980. Stage 1 IN_PROGRESS. No release candidate nominated. Production NO-GO. This report records source inspection and a bounded offline check, not full release qualification.

Component / inspected owner	Dependency / failure boundary	Required release evidence
job-tracker-ui/package.json, Dockerfile, nginx.conf.template	Next static export, React/MUI and React Router; nginx serves out, proxies /api/, /health, /ready; configured host and forwarded-header handling	Exact build/image, browser journeys and deployed proxy/TLS identity
JobTrackerApi/Program.cs, JobTrackerApi.csproj	net9.0, EF 9.0.14, Pomelo 9.0.0; authentication/authorization then rate limiting/session middleware and controllers	Endpoint-by-endpoint ownership/session/CSRF/error tests; source registration alone is not security proof
JobTrackerApi/Data/DatabaseConfiguration.cs	Defaults to MariaDB; missing connection throws; SQLite requires explicit transitional selection	Actual MariaDB migration/upgrade/rollback and preservation evidence; retain legacy paths
docker-compose.database.yml	Development persistent volume and separate integration tmpfs service; MariaDB 12.2.2 pinned digest; loopback ports	Isolated provider tests; no claim of equality with production
Career/CV domain and PDF	Program registers CareerProfileService, ApplicationAssetsService, CV/letter renderers and Playwright exporter	Canonical facts, null-as-inherit, revisions, historical artifacts and physical print remain separate contracts
Background services	Program registers backup, rules, reminders, saved search, export, enrichment, summarizer probe, AI operation, retention, email recovery and account deletion workers	Verify configuration, failure recovery and tenant isolation for enabled workers; registration is not runtime activation
Auth/mail/provider integrations	Architecture documents Google/Microsoft identity, Gmail/Graph/IMAP/SMTP, NAV, optional translation, local/external AI, Stripe	Synthetic local tests separate from licensed/provider/account delivery and consent
.gitea/workflows/ci-deploy.yml	Test pipeline; deployment limited by source condition to push on refs/heads/main	Fresh hosted artifact/commit/runner evidence; development branch push is not hosted qualification
.gitea/workflows/mariadb-integration.yml	Isolated runner label, explicit initial exit-1 isolation gate	Operator isolation evidence and authorised workflow review before enabling; do not remove gate during discovery
Existing backup/deployment runbooks	Database, attachments/CV artifacts, keys and deletion tombstones; code rollback differs from data restore	Disposable restore with independent content/decryption/deletion checks; approved RPO/RTO and failure rehearsal

Public boundary currently inspected: nginx host routing, /health, /ready, /api/; API controllers are mapped but a complete anonymous/authenticated endpoint census is still PENDING. External mail/job/AI requests, uploaded documents, browser credentials, database records and stored artifacts are separate trust boundaries. No live endpoints, Docker engines, databases, credentials, models or production services were accessed.

Local development, test and production are not interchangeable: integration uses a generated project and disposable service; production needs the external network, server-side environment, actual ingress and operator controls. Current architecture/runbooks describe these differences; exact intended staging/production configuration and image identity remain unverified.

The latest handoff's source-bound PDF metric/visual approvals supersede the older acceptance paragraph describing unchanged S01 coordinate failures. They are preserved for the approved development scope. Physical print, device, AT and language review remain open. No export was rerun because no renderer/font/fixture/application source changed.