feat: NVIDIA Sr DevOps application, drop cohort caps, fix Workday/decision-log bugs

Scout run 2026-09-04 (36 companies, 778 eligible) plus the NVIDIA package it surfaced, and the tooling and policy fixes found along the way. Application - NVIDIA Senior DevOps Engineer, Zurich (JR2024256): submitted 2026-09-05. Evidence Fit 64/100 Stretch, hard gate FAIL x2, channel Weak. Sent on an explicit user override with the working model unresolved, so hybrid-vs-onsite is a live screening topic. 2pp resume + 1pp cover letter, both validators PASS, 0 boxes, 0 Tier 1 findings open. Policy - Drop the 7 Core / 2 Adjacent / 1 Stretch cohort caps. They had no derivation and were overridden whenever they bound, and the cohort was confounded: it tested fit class while holding channel constant at Weak across all six applications. Keep the recording, drop the rationing. - Channel replaces the slot budget as the rationed variable: no application goes out cold when a named contact is published and reachable. - Propagated through shared_ops, session_file_template, cohort_tracker (counts, never counts-against-a-target) and application_cohort.json. Tool fixes - fetch_workday emitted 404 URLs for every Workday company (NVIDIA, Novartis, Equinor): externalPath is site-relative and needs the locale + site prefix. 6/6 short-form 404, 3/3 long-form 200. 773 dead links repaired across 42 archived reports. - find_decision_url silently de-linked decisions on two boards, which is why ruled-out roles kept resurfacing as undecided. RUAG rotates its UUID on repost; BIS migrated its vacancy URL scheme, orphaning 5 decisions including a live application. Fixed as a two-tier match, not a slug key -- slugs collide (two live RUAG reqs shared one). Knowledge base - claims.json: add Bash / shell scripting, the third canonical gap of this shape after Ansible and Linux administration. - bundle_data_platform: BS-4 was framed as a delivered observability stack over what claims.json calls a proof of concept -- the defect the 2026-08-21 sweep was told to look for. - CLAUDE.md and AGENTS.md: correct the RUAG Data Lakehouse shortlist claim, which the JD does not support and which both files still asserted. - resume_template: comment-guard the missing babel/ngerman language block. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QFb8tTCig5r1KzkQiNXcYt
2026-09-05 13:24:44 +02:00
1 parent 89af779bf3
commit a0ec2fedb5
@@ -62,6 +62,7 @@ You write as the strategist but critique as the reader.
 - `resume_builder/canonical/claims.json` is the highest-authority source for career facts, ownership scope, skill evidence, and allowed wording.
 - Files under `output/` are generated artifacts, never evidence sources. Check `resume_builder/canonical/historical_outputs.json` before reusing any historical package.
 - Verify the JD and assess hard gates before writing. Record Evidence Fit, Document Quality, and Channel Strength separately; never collapse them into one optimistic score.
 - **No application quotas.** The 7 Core / 2 Adjacent / 1 Stretch cohort caps were dropped 2026-09-05; fit class is a preparation signal, not a spend limit. **Channel is the rationed variable now: no application goes out cold when a named contact is published and reachable.** Hard gates and NO-GO triggers are unchanged. See `application_strategy.md`.
 - Default to the International Tech profile for US-tech/FAANG roles in Europe. Use the Swiss/DACH profile only when the audience calls for it.
 - Natural bullet length and relevance govern selection. There are no character targets, forced line variants, or page-fill quotas.
 - A cover letter is conditional. Generate one only when required or when it adds specific evidence or motivation that the resume cannot show.
@@ -157,8 +158,9 @@ _Update this section when starting/finishing a JD._
 | Session | Status | Next Command |
 |---------|--------|-------------|
 | NVIDIA - **Senior DevOps Engineer**, **Zürich** (req JR2024256) | **SUBMITTED 2026-09-05.** Evidence Fit **64/100**, fit class **Stretch**, hard gate **FAIL x2**, channel **Weak** (7th consecutive cold submit; this posting published no named contact). 2pp resume 13 bullets + 1pp cover letter 279 words; both validators PASS 0 warnings, 0 boxes, 0 Tier 1 findings open. Measured Document Quality **82/100 pre-edit**; both Tier 1 findings were then closed, so it is better than 82 but **not re-measured - never quote a post-edit estimate as a score**. Submitted on an explicit user override. ⚠ **Hybrid vs 5-day onsite was never resolved before sending** - now a live screening topic, not pre-cleared. Thun→Zürich is ~1h50 each way. Comp is *not* a risk (levels.fyi Greater Zürich IC3 median ≈ CHF 204k). Honest gaps named in the letter: on-prem networking (0 canonical) and that employer-side Linux/Ansible ended Dec 2022, with only the personal `PP-3` server carrying currency. | Await response. **Raise the working model at first contact** - a 5-day-onsite seat would be a late no. |
 | SBB - **Data Engineer (m/w/d)**, Asset Management Infrastrukturanlagen, **Bern** (Job ID 103755) | ⭐ **INTERVIEW INVITED 2026-08-28 - 9. September 2026, 08:30, 45 Min, MS Teams. The only live interview in the log.** Stage **2 of 4** per the posting: *"Virtuelles Kennenlernen mit HR und Fuehrungskraft"*, so **HR together with Andri Wienandts**, not a pure HR screen. Brief: `output/SBB_DataEngineer_AssetMgmt/interview_brief_sbb_2026-09-09.md`. **First conversion of the evidence-first cohort** (6 applications, 2 rejections) and it came from a **COLD submit** - the warm contact printed on the posting was never called. The resume never contained **Snowflake, dbt or Power BI**, the literals an ATS screen would key on, and it still got through: a human read it and the honest-substitution framing held. One data point, do not over-read it. Submitted 2026-08-25, Core, Evidence Fit **79/100**, hard gate PASS, Document Quality **92/100**, no cover letter (SBB waives it). Best practical fit in the log: Bern, German-language, no relocation, EU + B permit. **Four unresolved items, now live call topics:** Anforderungsniveau **K** band (capped GAV, not public, likely below the 180k bar); the seat reads **lateral or below** current Staff + Component Owner scope (the declined-BKW shape); **RAMSI** Java/Spring Boot/Angular is a full responsibility line on a historical/absent stack; Kidz Care scales on gross household income. Gaps to answer honestly: Snowflake, dbt, Argo, Helm, Power BI, Spring Boot, Angular - survivable only because the JD says "z. B.". Thesis stays a **methods prototype**: no operational data, no accuracy figures, PSO surveyed only. | **Decide before 9.9.:** what he does if K lands at 130-150k, if architecture is set elsewhere, or if RAMSI is heavily Angular. Any one can be a no - better decided in advance than improvised on camera. |
-| RUAG C5I - **AI Engineer C5I**, **Thun** (application ID 18027) | **SUBMITTED 2026-08-27** via jobs.ruag.ch (portal only). Evidence Fit **74/100**, fit class **Stretch**, hard gate **FAIL** (R1/R2, the title-defining responsibilities, are Adjacent not Direct), Document Quality **93/100** after a critique-and-fix round, channel **Weak/cold**. German CV 2 pages/13 bullets + motivation letter 1 page/295 words; validators PASS, 0 boxes, visual QA clean. **Cohort now 6/10 and the sole Stretch slot is CONSUMED (Stretch 1/1).** Positioning is his canonical title Staff Data, Analytics & AI Engineer; `PP-3` carries current Linux/hardening evidence and `SW-5` ties DevSecOps to C5I's stated model. The letter names the AI-platform gap in one sentence. Honest gaps: no AI/LLM platform, no compute/GPU cluster, no RAG/retrieval, ML/AI frameworks certification-context only. **Compensation, PSP/project eligibility and level were never resolved and are now live screening topics.** Marco Heinzen's published direct line was never used. **If rejected, do not drop RUAG** - Senior DevOps Engineer C5I and Data Lakehouse / Senior Data Platform Engineer are shortlisted and fit better. | Await response; optional calls to Marco Heinzen (scope/level) and Frank Haugwitz (comp/PSP). |
+| RUAG C5I - **AI Engineer C5I**, **Thun** (application ID 18027) | **SUBMITTED 2026-08-27** via jobs.ruag.ch (portal only). Evidence Fit **74/100**, fit class **Stretch**, hard gate **FAIL** (R1/R2, the title-defining responsibilities, are Adjacent not Direct), Document Quality **93/100** after a critique-and-fix round, channel **Weak/cold**. German CV 2 pages/13 bullets + motivation letter 1 page/295 words; validators PASS, 0 boxes, visual QA clean. (Cohort slot language here is historical: the **7/2/1 caps were dropped 2026-09-05** - see `application_strategy.md`.) Positioning is his canonical title Staff Data, Analytics & AI Engineer; `PP-3` carries current Linux/hardening evidence and `SW-5` ties DevSecOps to C5I's stated model. The letter names the AI-platform gap in one sentence. Honest gaps: no AI/LLM platform, no compute/GPU cluster, no RAG/retrieval, ML/AI frameworks certification-context only. **Compensation, PSP/project eligibility and level were never resolved and are now live screening topics.** Marco Heinzen's published direct line was never used. **If rejected, do not drop RUAG** - **Senior DevOps Engineer C5I** is shortlisted and fits better (still live on the board 2026-09-04). The **Data Lakehouse / Senior Data Platform Engineer** req was a title-match prior the JD does not support: reposted 2026-09-04 as **Senior Data Engineer (MSSQL)**, requiring on-prem MSSQL/Talend/SAP S/4HANA - 0 canonical each - and **ruled out**. | Await response; optional calls to Marco Heinzen (scope/level) and Frank Haugwitz (comp/PSP). |
 | Schweizer Armee - **Kommando Cyber (Kdo Cy)**, DevOps Engineer III (Data Platform), **Zimmerwald** (Ref JRQ$540-19848) | **SUBMITTED 2026-08-27.** Evidence Fit **79/Core**, hard gate **PASS**, Document Quality **92/100**, channel **Weak**. German 2-page CV plus 1-page motivation letter; validators PASS, 0 boxes, visual QA clean. BW-1 surfaces the six-year Bundeswehr officer career. User explicitly accepted the critique's remaining BS-1 wording issue (*„ohne manuellen Eingriff“*) as good enough and submitted unchanged. Cohort evidence-first-2026-01 is now 5/10, Core 3/7. | Await response; optional post-submit call to Marcel Matthey-Doret about Lohnklasse, Engineer-III level and development path. |
 | Google - Software Engineer III, Business Home, Zurich (req 93922217108087494) | **CLOSED - NOT PROCEEDING 2026-07-28** (submitted 2026-07-27; Core, Evidence Fit 89/100, Document Quality 94/100; no interview). Rapid early-screen disposition; known risks were Mid-level versus current Staff scope, data/platform versus product-SWE positioning, preferred algorithms/accessibility gaps, and a cold channel. | Done - cohort rejection recorded; do not treat this outcome alone as a document-quality failure |
 | Microsoft — Principal Forward Deployed Engineer, SWE (German Speaking), Zürich (req 200043897) | **SUBMITTED 2026-07-27** (84.2/100 Pass 2; finalized 2-page resume + 1-page cover letter). Strong native-German, Staff progression, production ownership and enterprise-data-readiness case; honest gaps remain in end-to-end LLM delivery, Azure AI and strategic-account FDE experience. | Done — await response |
@@ -157,7 +157,8 @@ _Update this section when starting/finishing a JD._
 | Session | Status | Next Command |
 |---------|--------|-------------|
-| RUAG C5I - **AI Engineer C5I**, **Thun** (application ID 18027) | **SUBMITTED 2026-08-27** via jobs.ruag.ch (portal only; email and post refused). Evidence Fit **74/100**, fit class **Stretch**, hard gate **FAIL** (R1 and R2, the two title-defining responsibilities, are Adjacent not Direct), Document Quality **93/100** after a full critique-and-fix round (85 pre-edit), truth and provenance 24/25, **0 Tier 1 findings at Round 2**, channel **Weak/cold**. Submitted: German CV **2 pages, 13 bullets** + German motivation letter **1 page, 295 words**; both validators PASS, 0 boxes, text-order and visual QA clean, submission PDFs MD5-verified before sending. **Cohort evidence-first-2026-01 is now 6/10 and the sole Stretch slot is CONSUMED (Core 3/7, Adjacent 2/2, Stretch 1/1)** - any further application must clear Core or Adjacent on its own merits. Positioning is his canonical title **Staff Data, Analytics & AI Engineer**, carried by `BS-1` production ML-inference integration, `BS-6` Linux/Ansible, `SW-3`/`SW-7`/`SW-2` current Kubernetes and data-product work, `PP-3` current self-hosted Linux and hardening, `SW-5` DevSecOps tied to C5I's stated operating model, and the canonical `BW-1` officer career. The letter **names the AI-platform gap in one sentence** and pivots to the operations/platform side. **Honest gaps that travel with it:** no AI/LLM platform built or operated, no compute/GPU cluster, no RAG/retrieval implementation, no formal LLM evaluation; ML/AI-framework depth is certification-context only. **Compensation, PSP/project eligibility and role level were NEVER resolved before sending, so all three are now live screening topics rather than pre-cleared ones.** ⚠ **Marco Heinzen's published direct line (+41 79 568 14 96) was never used** - this went in as a pure cold submit, the sixth consecutive one. **If rejected, that is NOT a signal to drop RUAG:** five other RUAG C5I reqs sit in the scout log, and **Senior DevOps Engineer C5I** and **Data Lakehouse / Senior Data Platform Engineer** are both already shortlisted and are **materially better fits than this one**, sitting on the lane where his evidence is Direct rather than Adjacent. | Await response. Optional but still worthwhile: call **Marco Heinzen** about technical scope and level, and **Frank Haugwitz** about compensation and PSP/project eligibility. Do not react to a single outcome with positioning changes (`application_strategy.md` §38/§74). |
+| NVIDIA - **Senior DevOps Engineer**, **Zürich** (req JR2024256) | **SUBMITTED 2026-09-05.** Recorded in the application record (now 7 entries) and in the scout decision log. ⚠ **Hybrid vs 5-day onsite was never resolved before sending**, so the working model is now a **live screening topic**, not a pre-cleared one - the same pattern as RUAG's comp/PSP. Thun→Zürich is ~1h50 each way; a 5-day-onsite answer is the main disqualifier to watch for. Comp is *not* a risk (levels.fyi Greater Zürich IC3 median ≈ CHF 204k, IC4 ≈ CHF 379k). Channel **Weak - the 7th consecutive cold submit**, though this posting published no named contact, so cold was the only option available. Submission PDFs `Dennis_Thiessen_Resume.pdf` and `Dennis_Thiessen_Cover_Letter.pdf` exist and are MD5-verified against source; letter recompiled so its date reads 5 Sep 2026. ⚠ **The letter carries `	oday` and the submission copies are copies, not build targets - if it is sent on a later day, recompile the letter and refresh both copies first** (`config.md` Output Rules). Submitted despite the hard-gate failures on an explicit user override, the same shape as RUAG AI Engineer C5I. Resume 2pp/13 bullets + 1pp cover letter (279 body words), both validators PASS 0 warnings, 0 boxes, visually inspected. Measured **Document Quality 82/100** at critique; **both Tier 1 findings were fixed 2026-09-05** - `Ubuntu` removed from the skills line (0 canonical; `PP-3` is Debian only, and the Debian→Ubuntu transfer argument belongs in an interview answer, not a skills line) and `security hardening` now marked *(personal server)* per the explicit `claims.json` instruction. Four honest ATS terms were added from existing evidence (configuration management, service reliability, container orchestration, observability), lifting JD term coverage **50%→61%**; no bullet was touched, so the budget stayed at 13 and cadence could not regress. **The critique is now STALE BY DESIGN - the document is better than 82 but that number was not re-measured, so never quote a post-edit estimate as a score.** The headline reorder was deliberately NOT applied: it is a positioning call for the user and `\headline` sits in the FIXED header block. Cover-letter hook is first-party verified (NVIDIA's own live Zürich posting JR2022878); **a hook was DROPPED at verification** - the Phase 0 plan's "Alps / Swiss AI Initiative with ETH Zürich and EPFL" is **not** supported by the first-party NVIDIA newsroom release, which mentions neither EPFL nor any Swiss AI Initiative; that came from secondary coverage. The letter names **both** honest gaps out loud - on-prem networking, and that employer-side Linux/Ansible ended Dec 2022 with only a personal server carrying currency. **⚠ BLOCKING: the working model is still unresolved and no document fix changes that.** Session `output/NVIDIA_SrDevOps_Zurich/session_nvidia_sr_devops.md`; JD scraped live via Playwright and saved verbatim (posted ~2026-09-01, very fresh). Evidence Fit **64/100**, fit class **Stretch**, **hard gate FAIL on two counts**: (1) required line *"Strong expertise in on-premises networking and compute infrastructure"* is a **Gap** - networking is 0 canonical and is not substitutable from data-platform work; (2) **hybrid vs onsite is UNRESOLVED** and the JD is silent - Thun→Zürich is ~1h50 each way. Required tally **3 Direct / 3 Adjacent / 1 Gap**. Recorded as an override rather than a passing gate, the same shape as RUAG AI Engineer C5I. (At the time this also had no free cohort slot; **that constraint no longer exists** - caps dropped 2026-09-05.) **Correction to the same day's scout triage: it called two required lines Gaps; only Q5b networking is one. Q2 (10+ yrs DevOps) is Adjacent and defensible** - a continuous CI/CD/automation thread runs Generali 2015 → today across five employers; the honest weakness is that those roles were titled data/test/research engineer, not DevOps. **The finding that changes the calculus: comp.** levels.fyi Greater Zürich puts NVIDIA IC3 median ≈ CHF 204k and IC4 ≈ CHF 379k, the highest-paying SWE employer in the city - the first role in the log where comp is a reason to *accept* a long commute rather than decline. Caveat: self-reported and equity-heavy after an extraordinary NVDA run; treat base as the reliable part. Strongest match is **R3, CI/CD pipelines for R&D engineering teams** - literally his career shape (`FC-1` Jenkins at a Fraunhofer institute, `BS-6` Ansible/Jenkins for fab analytics teams, `SW-3` Kubernetes + GitLab today). Zürich is NVIDIA's HPC/AI infrastructure-software R&D hub - first-party verified from NVIDIA's own live Zürich posting JR2022878 (*"building the next generation of scalable AI infrastructure ... distributed training, real-time inference, and communication efficiency across large systems"*), which is the hook the letter uses. **The Alps / Swiss AI Initiative framing was checked and dropped** - see above. **Honest gaps that travel with Line truncated
 | RUAG C5I - **AI Engineer C5I**, **Thun** (application ID 18027) | **SUBMITTED 2026-08-27** via jobs.ruag.ch (portal only; email and post refused). Evidence Fit **74/100**, fit class **Stretch**, hard gate **FAIL** (R1 and R2, the two title-defining responsibilities, are Adjacent not Direct), Document Quality **93/100** after a full critique-and-fix round (85 pre-edit), truth and provenance 24/25, **0 Tier 1 findings at Round 2**, channel **Weak/cold**. Submitted: German CV **2 pages, 13 bullets** + German motivation letter **1 page, 295 words**; both validators PASS, 0 boxes, text-order and visual QA clean, submission PDFs MD5-verified before sending. **Cohort evidence-first-2026-01 is now 6/10 and the sole Stretch slot is CONSUMED (Core 3/7, Adjacent 2/2, Stretch 1/1)** - any further application must clear Core or Adjacent on its own merits. Positioning is his canonical title **Staff Data, Analytics & AI Engineer**, carried by `BS-1` production ML-inference integration, `BS-6` Linux/Ansible, `SW-3`/`SW-7`/`SW-2` current Kubernetes and data-product work, `PP-3` current self-hosted Linux and hardening, `SW-5` DevSecOps tied to C5I's stated operating model, and the canonical `BW-1` officer career. The letter **names the AI-platform gap in one sentence** and pivots to the operations/platform side. **Honest gaps that travel with it:** no AI/LLM platform built or operated, no compute/GPU cluster, no RAG/retrieval implementation, no formal LLM evaluation; ML/AI-framework depth is certification-context only. **Compensation, PSP/project eligibility and role level were NEVER resolved before sending, so all three are now live screening topics rather than pre-cleared ones.** ⚠ **Marco Heinzen's published direct line (+41 79 568 14 96) was never used** - this went in as a pure cold submit, the sixth consecutive one. **If rejected, that is NOT a signal to drop RUAG:** five other RUAG C5I reqs sit in the scout log, and **Senior DevOps Engineer C5I** is already shortlisted and is a **materially better fit than this one**, sitting on the lane where his evidence is Direct rather than Adjacent (still live and verified on the board 2026-09-04). The **Data Lakehouse / Senior Data Platform Engineer** req was a title-match prior that the JD does not support — it was reposted 2026-09-04 as **Senior Data Engineer (MSSQL)**, requires on-prem MSSQL / Talend / SAP S/4HANA (0 canonical each), and is **ruled out**. | Await response. Optional but still worthwhile: call **Marco Heinzen** about technical scope and level, and **Frank Haugwitz** about compensation and PSP/project eligibility. Do not react to a single outcome with positioning changes (`application_strategy.md` §38/§74). |
 | Schweizer Armee - **Kommando Cyber (Kdo Cy)**, DevOps Engineer III (Data Platform), **Zimmerwald** (Ref JRQ$540-19848) | **SUBMITTED 2026-08-27.** Evidence Fit **79/Core**, hard gate **PASS**, Document Quality **92/100**, channel **Weak**. Submitted package: German 2-page CV with **15 bullets** and 1-page motivation letter with **300 body words**; validators PASS, 0 boxes, text order and visual QA clean. Canonical **BW-1** records the six-year Bundeswehr officer career and anchors the letter's military/public-service motivation. User explicitly accepted the critique's remaining BS-1 wording issue (*„ohne manuellen Eingriff“*) as good enough and submitted unchanged. Honest gaps remain physical datacenter work, GPGPU, ClickHouse and named Pull-GitOps practice. Cohort evidence-first-2026-01 is now **5/10, Core 3/7**. | Await response; optional post-submit call to Marcel Matthey-Doret about Lohnklasse, Engineer-III level and development path. |
 | Citadel Securities — Platform Engineer, Research Platform Engineering, **Zürich** (also NY/Miami) | **SUBMITTED 2026-08-26.** Cohort slot: **Adjacent 2/2** (cohort now 4/10). ⚠️ **KEY FINDING — the application form's preferred-work-location selector offered NO Zurich**, despite the JD saying "Miami, Zurich or New York" and the site's own Zurich filter returning this req. Careers site is operated by **Citadel Enterprise Americas LLC**; the apply flow is likely US-entity, or the Zurich seat is closed while the posting stands. **This partly supersedes the working-model risk** — if no Zurich seat is reachable through that form, hybrid-vs-onsite is moot and the application may sit against a US req, a hard NO on relocation. **Rule for any future Citadel application: check the form's location selector BEFORE building a package** — the posting's stated locations and the site filter both proved unreliable. User applied with low expectation; cold channel, evergreen standing req. 2pp resume (13 bullets) + 1pp CL (270 words), both validator **PASS, 0 warnings**; JD term coverage 51%→68% after Tier 1 fixes. Critique **STALE by design** (86/100 pre-edit; user chose to submit as-is over re-critiquing; est. ~91 post-edit, never quote as a score). **Cohort entry and decision-log entry deliberately NOT written — no confirmed send date.** Commands ready in the session file. **The working-model question is still open and travels with the application:** Evidence Fit **71/100 (Adjacent, mid-band; revised down from 74)**, qualifications gate PASS but **a practical constraint is UNRESOLVED**, which `critique_framework.md` treats as a NO-GO trigger. **The JD is silent on hybrid vs onsite (0 grep matches), and Ken Griffin is on record that Citadel returned to the office 5 days a week and calls it his most important leadership decision.** If that holds for Zurich, it means ~2–2.5h daily commuting from Bern or relocating — breaking the Bern-based / 2–3 day hybrid bar. Only contrary evidence is a stale 2022 anonymous Fishbowl post about Operations. **Must be asked, not researched** — same class as the SBB K band. Practical constraints scored 5/5 in Phase 0 on an unexamined assumption; corrected to 2/5. **Zero Gaps among the 7 minimum quals**, and all five preferred technologies (Kafka, Kubernetes, Spark, Airflow, distributed DBs) are Direct — **the strongest raw stack alignment in the log**. Title-defining function **splits**: R2 (ingestion/transformation/storage/lifecycle of large datasets) is Direct and describes SW-1/SW-7 exactly; **R1 (design and build the research platform itself) is Adjacent** — the Aker BP authoring-vs-building shape again, and unwritable-around under Scope Discipline. **Classification caveat:** `application_strategy.md`'s "a defining responsibility is only Adjacent → Stretch" would strictly class this Stretch; recorded Adjacent per the Aker BP precedent. Both cohort slots free either way. Gaps: platform authoring at firm scale, no professional quant/finance (now partly mitigated by new **PP-1/PP-2**), SDKs (0 evidence), low-latency/HFT (0 evidence — thesis throughput figure is explicitly barred by `thesis_limits`). **Go is NOT a gap** — Q3 is disjunctive and Python satisfies it. **$175–350k in the posting is a US/NY pay-transparency disclosure, NOT the Zurich number — must be asked.** Channel **Weak/cold** — would be the 5th consecutive cold application, in an office visibly staffed from Google and ETH (platform research head Costas Bekas; Nicolai Meinshausen leads principal research). Cover letter: **YES** if it proceeds — the PP-1 domain story is the main differentiator and needs prose. | **Ask Citadel Securities recruiting whether the Zurich seat is hybrid or 5-day onsite BEFORE building the package.** If 5-day onsite → likely NO-GO on the Bern constraint. If hybrid 2–3 days → resume Phase 2 (plan is written and budget PASSes at 11–14 bullets; two open items: Vizrt VZ-1 C++/distributed bullet, and adding a Projects section for PP-1) |
 | SBB - **Data Engineer (m/w/d)**, Asset Management Infrastrukturanlagen, **Bern** (Job ID 103755) | **INTERVIEW INVITED 2026-08-28 - 9. September 2026, 08:30, 45 Min, MS Teams.** Per the posting's own process this is **stage 2 of 4**, *"Virtuelles Kennenlernen mit HR und Fuehrungskraft"* - **HR together with Andri Wienandts**, not a pure HR screen. Brief written to `output/SBB_DataEngineer_AssetMgmt/interview_brief_sbb_2026-09-09.md`. **This is the FIRST interview of the evidence-first cohort** (6 applications, 2 rejections, 1 conversion) and it converted from a **COLD submit** - the channel plan called for phoning Wienandts first and that never happened. **The resume never contained Snowflake, dbt or Power BI**, the three literals an ATS keyword screen would have keyed on; the session had recorded that risk as "accepted, not solvable". It did not filter him out, so a human read the dossier and the honest-substitution framing survived first contact. **One data point, do not over-read it** - but it is evidence against assuming honest omissions are fatal at the screen. Submitted 2026-08-25: 2pp English resume, 13 bullets, no cover letter (SBB waives it), Evidence Fit **79/100 Core**, hard gate **PASS**, Document Quality **92/100**, channel **Weak/cold**. Best practical fit in the log - Bern-based, German-language, no relocation, EU citizen + B permit. **Four things unresolved before submitting and now live call topics:** (1) **Anforderungsniveau K** is a capped GAV band, figures not public, very likely below the 180k bar; (2) the seat reads **lateral or below** current Staff + Component Owner scope, the same shape as the declined BKW, and the JD's only architecture language is a personal skill not an ownership mandate; (3) **RAMSI** Java/Spring Boot/Angular is a whole responsibility line on a stack that is historical or absent - ask its share, do not oversell; (4) Kidz Care scales on gross household income, so far below 90% at this band. Named gaps to answer honestly: Snowflake, dbt, Argo Workflows, Helm, Power BI, Spring Boot, Angular - all non-canonical, all survivable only because the JD prefixes the stack with "z. B.". Thesis stays a **methods prototype**: no real operational data, no accuracy figures, PSO surveyed only, throughput figure barred. | **Prep before 9.9.:** decide in advance what he does if K lands at 130-150k, if architecture is set elsewhere, or if RAMSI is heavily Angular - any one can be a no, and it is better decided before the call than improvised on camera. |
@@ -191,7 +192,12 @@ _See `config.md` for user-specific corrections. Add verified errors here as you
 | Date | Correction | Files fixed |
 |------|-----------|-------------|
-| 2026-08-27 | **A German-language resume was being typeset with English hyphenation patterns, and had been for every German package built from this template.** The RUAG resume loaded `lmodern` but **never `babel`** - the cover letter did (`\usepackage[ngerman]{babel}`), the resume did not. The compiled PDF broke words as `Hal-bleiterfertigung`, `Tran-skription`, `automa-tisierte` and `Foun-dation`: all wrong in German, and exactly the kind of thing a native-German Swiss reader notices without being able to name. It survived an earlier full visual QA because nothing *looks* broken - the lines are justified and the page is clean. Adding `\usepackage[ngerman]{babel}` produced correct breaks (`Halb-leiterfertigung`, `automati-sierte`) and **also cleared an overfull box** introduced when the headline grew. ngerman still breaks `Transkription` after `Tran`, so `\hyphenation{Trans-krip-ti-on}` was added. **Rule: any German-language document must load `babel[ngerman]`, and hyphenation must be checked in the compiled PDF, not assumed from a clean box count.** `resume_template.tex` should be checked for the same omission. | RUAG resume (fixed); `resume_template.tex` (OPEN) |
+| 2026-09-05 | **The ten-application cohort's slot caps (7 Core / 2 Adjacent / 1 Stretch) were DROPPED by user decision.** Two reasons, both evidenced. **(a) The numbers were arbitrary and non-binding:** no derivation existed anywhere, and they were routed around whenever they bound - RUAG AI Engineer went in at Evidence Fit 74 with a hard-gate FAIL, and Citadel was recorded Adjacent when the strict reading said Stretch. **(b) The cohort was a confounded experiment:** it was built to test *fit class*, but the variable it silently held constant was *channel* - `cohort_tracker.py` reports **channel weak: 6, moderate: 0, strong: 0**. It therefore could not separate "Stretch does not convert" from "cold does not convert", and the evidence points away from fit class regardless: the highest-scoring package in the log (Snowflake, ~86) drew no reply in 80 days, while the single interview (SBB) came from a **cold Core submit whose resume was missing the three ATS literals** the session had flagged. **What was kept is the recording, not the rationing** - fit class, hard gate, channel, date, stage and outcome are still logged on every application, because that record is what makes patterns visible rather than re-derived. **Channel replaces the slot budget as the rationed variable: no application goes out cold when a named contact is published and reachable** - Marco Heinzen (RUAG), Andri Wienandts (SBB) and Per Olav Marthinsen (Aker BP) were all published, reachable and never used. **Fit class is now a preparation signal, not a spend limit:** 64/100 means know which two questions are coming, not do not apply. Hard gates and NO-GO triggers are unchanged. **Three real constraints survive independently and must not be dropped with the caps:** Google's 3-applications-per-rolling-30-days and 90-day same-role wait; not stacking a second cold application on one org while the first is pending; and the hours each package actually costs. Propagated to `application_strategy.md`, `shared_ops.md`, `session_file_template.md`, `cohort_tracker.py` (now prints counts, never counts-against-a-target) and `application_cohort.json`. | `application_strategy.md`; `shared_ops.md`; `session_file_template.md`; `cohort_tracker.py`; `application_cohort.json`; `CLAUDE.md` |
 | 2026-09-05 | **`Bash` / shell scripting was missing from `claims.json` entirely - the third canonical gap of exactly this shape, after Ansible and Linux administration (both 2026-08-27).** It surfaced while building the NVIDIA Senior DevOps package: the JD names *"proficient scripting skills in Bash, Python, or Groovy"*, and ten years of Debian administration plus intensive Ansible work at Bosch plainly involve shell scripting - but the canonical file was silent, so under the evidence-first rule the skill was **unwritable** and was deliberately left off the resume. User-confirmed 2026-09-05 and added as `production-historical-and-personal-current`, `output: allowed`, with the same evidence basis as Linux administration (`BS-6` professional 2020-2022; `PP-3` personal and current). The note records two hard limits: it does **not** license **Groovy**, which stays unverified and forbidden, and it does **not** license systems-programming or kernel-level claims. **Systemic lesson, now three times over: the KB is data-engineering shaped and under-records ordinary infrastructure and operations skills. Before scoring any DevOps/platform/SRE JD, ask about ops evidence explicitly rather than trusting `claims.json` to be complete.** Edit note confirmed again: the file is compact inline JSON with CRLF - patch it as text; this change was 6 insertions with no reformatting. | `claims.json` (new skill); NVIDIA resume Languages line |
 | 2026-09-04 | **This file asserted a shortlist that the JD does not support, and the 2026-08-31 scout triage had already caught it — but nothing was written here, so it survived into the next session exactly as that triage predicted.** The RUAG session block called **Senior DevOps Engineer C5I** *and* **Data Lakehouse / Senior Data Platform Engineer** "both already shortlisted and materially better fits… where his evidence is Direct rather than Adjacent." Only the first half held. The Data Lakehouse claim was a **title-match prior**: the live JD is **on-prem, MSSQL, Talend, SAP S/4HANA**, and `claims.json` has **0** for all three. RUAG then settled it itself — between the 08-31 and 09-04 scrapes the req was pulled and reposted as **"Senior Data Engineer (MSSQL) mit Data Lakehouse Perspektive"**, with the disqualifier moved into the title; its sibling *Senior Data Analyst & Data Scientist* was likewise reposted as *Senior BI Specialist (Qlik Sense)*. Required line reads *"mehrjährige Erfahrung im Aufbau und Betrieb von **on premise** Data Warehouse Lösungen"* — his stack is AWS cloud-native. Senior DevOps C5I re-verified live on the board 2026-09-04 and stays rank 1. **Systemic lesson: a triage finding that is not written into this log does not exist. Close the loop in the same session that finds it.** | `CLAUDE.md` (RUAG session block); `reports/2026-09-04.triage.md` |
 | 2026-09-04 | **The scout's decision log was silently de-linking decisions on two boards, so ruled-out roles kept resurfacing as undecided — this, not forgetfulness, is why the 08-31 RUAG rule-outs all came back `dec=None`.** `_decision_key` had no pattern for either board, so it fell back to the raw path. **RUAG** regenerates the UUID in `/offene-stellen/<slug>/<uuid>` on every repost (*DevOps Engineer C5I* moved `349979ee…` → `f48073a5…`), recovering **2** orphaned decisions. Fixed in `find_decision_url` as a **two-tier match** — exact key first, slug only as a fallback and only when unambiguous in the log — **not** as a slug key: that was tried and rejected because slugs collide (two live reqs shared `flugzeugmechanikerin-technician-mechanical-f-a-18` on the board that day, so one `skip` would have decided both, the exact cross-req failure `_decision_key`'s host-scoping was designed to prevent). **BIS** migrated `/careers/vacancies/jrNNNNNN.htm` → `/vacancy/jrNNNNNN`, orphaning **5** — including the **`applied` row for jr100429**, a live application; fixed with a `jr`-id pattern. Report rows carrying a decision went **49 → 65**, and **14 verified rule-outs were backfilled** with their quoted JD reasons. **NVIDIA Senior DevOps Engineer was deliberately left undecided** — it fails the cohort test as written but the override is the user's call, and a `skip` would foreclose it. ⚠ Surfaced by the BIS fix: **jr100429 is off the BIS board** (listed through 08-27, absent from both full runs since) — the req closed, so there is no open BIS application to stack against. **Rule: when a triage rules a role out, write it to `decisions.json` in the same session — and if a role you know was decided shows as undecided, suspect the key before assuming nobody recorded it.** | `scout.py` (`_JOB_ID_PATTERNS`); `state/decisions.json` (14 backfilled) |
 | 2026-09-04 | **Every Workday job URL the scout has ever emitted was a 404, across three companies and every report in the archive.** `fetch_workday` built links as `https://{host}{externalPath}`, but `externalPath` is *site*-relative (`/job/<loc>/<slug>_<req>`) and needs the locale and site segments. Verified: **6/6 short-form URLs returned HTTP 404** across NVIDIA, Novartis and Equinor — including a `-1`-suffixed row and a `Switzerland-Remote` slug, ruling out per-row drift — while **3/3 `…/en-US/{site}/job/…` returned HTTP 200**. Patched in `scout.py:fetch_workday`; 49 URLs in `reports/2026-09-04.json` and 16 in the `.md` repaired in place. Seen-state keys on the Workday req id, not the URL, so nothing was falsely re-flagged as new. **Reports before 2026-09-04 still carry the broken form — any NVIDIA, Novartis or Equinor role previously dismissed as a dead link was mis-dismissed and deserves a re-check.** Roche is unaffected (it uses the `phenom` adapter). Caught only because a JD read was attempted; a keyword-scorer triage would never have surfaced it. | `scout.py` (`fetch_workday`); `reports/2026-09-04.json` + `.md` (URLs repaired) |
 | 2026-08-27 | **A German-language resume was being typeset with English hyphenation patterns, and had been for every German package built from this template.** The RUAG resume loaded `lmodern` but **never `babel`** - the cover letter did (`\usepackage[ngerman]{babel}`), the resume did not. The compiled PDF broke words as `Hal-bleiterfertigung`, `Tran-skription`, `automa-tisierte` and `Foun-dation`: all wrong in German, and exactly the kind of thing a native-German Swiss reader notices without being able to name. It survived an earlier full visual QA because nothing *looks* broken - the lines are justified and the page is clean. Adding `\usepackage[ngerman]{babel}` produced correct breaks (`Halb-leiterfertigung`, `automati-sierte`) and **also cleared an overfull box** introduced when the headline grew. ngerman still breaks `Transkription` after `Tran`, so `\hyphenation{Trans-krip-ti-on}` was added. **Rule: any German-language document must load `babel[ngerman]`, and hyphenation must be checked in the compiled PDF, not assumed from a clean box count.** `resume_template.tex` should be checked for the same omission. **Checked 2026-09-04: the template loads no `babel` at all.** It is an English template, so it rides TeX's default English patterns and renders correctly as-is — loading `ngerman` unconditionally would be wrong. Fixed instead with a loud comment block at the package list carrying the ngerman + `\hyphenation` lines ready to uncomment, so the German case cannot be missed silently. No change to English output. | RUAG resume (fixed); `resume_template.tex` (fixed 2026-09-04 — comment-guarded) |
 | 2026-08-27 | **`IBM AI Engineering` was on resumes for months with no primary-source record, and `PyTorch` was under-recorded as a result.** The `/critique` flagged it as the only line a canonical preflight could not confirm: the other three certifications sit in `thiessen_certifications.md` with issuer, date and certificate number, while this one existed only in `bundle_ml_ai_engineer.md`. The user supplied the PDF (`C:\myCloud\Bewerbungsunterlagen\Zeugnisse\Zertifikate\cert_IBM_AI_Engineering.pdf`) and it was read directly: **IBM via Coursera, 4 Jun 2020**, no expiry, verify code `3ZBZFVAL6A34`, six courses, name on the certificate `Dennis Thiessen` (sz variant, as on ITIL and iSAQB). Recorded as entry **#8**. It also proves **PyTorch**, which `claims.json` had as `coursework-or-personal-unverified`; upgraded to `evidence: certification` with `output` unchanged at `certification-context-only`. The certificate is explicitly **non-credit** and confers no grade or degree - never present it as an academic qualification. **Same shape as the Ansible/Linux/Bosch-promotion gaps: the claim was true, the KB simply had no record of it.** | `thiessen_certifications.md` (entry 8); `claims.json` (PyTorch evidence) |
 | 2026-08-27 | **`claims.json` had no Bosch promotion date, so a Swisscom-style title line was unwritable from the canonical file.** Asked to render Bosch like Swisscom ("Senior Data Engineer, Data Analysis (Beförderung xy)"), the canonical file offered only a combined `official_title` "Engineer / Senior Engineer, Data Analysis" with **no `title_history` and no date** - while SWISSCOM has a full `title_history`. The data existed one layer down: `experience_bosch.md` records it LinkedIn-confirmed as Data Engineer **Feb 2020 - Jan 2021** and **Senior** Data Engineer **Jan 2021 - Dez 2022**. Added to `claims.json` as `title_history`, with `display_title` set to the user's own preferred wording **"Senior Data Engineer, Data Analysis"** and `official_title` left untouched as the formal Zeugnis string. **Systemic lesson, the same shape as the Ansible/Linux gaps: `claims.json` is the declared highest authority but is not always the most complete file - when it is silent, check the `experience/` files before telling the user something is unwritable.** Edit note: the file uses compact inline JSON and CRLF; a `json.dumps(indent=2)` rewrite reformats all ~700 lines. Patch it as text. | `claims.json` (BOSCH title_history, display_title); RUAG resume |
 | 2026-08-27 | **Vizrt shown as "DevOps Engineer" alone, on user instruction.** Canonical `official_title` is **"Test Automation Engineer"**; `display_title` is "Test Automation / DevOps Engineer". The user asked to drop "Test Automation" for the RUAG C5I package. Bullet content (CI/CD quality gates, Python backend for distributed transcoding) supports the DevOps framing and the user is the authority on his own role - but **this is the one title on that document that will not match a Zeugnis word-for-word**, so flag it rather than silently propagate it. Not written into `claims.json`: it is a per-package display choice, not a canonical correction. | RUAG resume (session file records the flag) |
@@ -612,7 +612,10 @@ def fetch_workday(args):
                "id": jid,
                "title": p.get("title", ""),
                "location": p.get("locationsText", "") + " " + ext,
-                "url": f"https://{host}{ext}",
+                # externalPath is site-relative ("/job/<loc>/<slug>_<req>"), so it needs the
                # locale + site prefix. Without it every Workday URL 404s — verified 2026-09-04
                # on NVIDIA, Novartis and Equinor (4/4 short form 404, long form 200).
                "url": f"https://{host}/en-US/{site}{ext}",
                "posted": p.get("postedOn", ""),
                "description": "",
            })
@@ -1704,6 +1707,10 @@ _JOB_ID_PATTERNS = [
    # Workday: trailing _REQID on the job slug (Roche 202608-120791-1, Novartis REQ-…, NVIDIA JR…).
    # Also collapses the /apply suffix some rows carry and others don't.
    (r"myworkdayjobs\.com$",      r"_([A-Za-z]*[\d-]+\d)(?:/apply)?/?$"),
    # BIS migrated its vacancy URLs from /careers/vacancies/jrNNNNNN.htm to /vacancy/jrNNNNNN,
    # orphaning every decision recorded under the old scheme — including the `applied` row for
    # jr100429. The jr-id is stable across both. (Verified 2026-09-04.)
    (r"bis\.org$",                r"/(jr\d+)"),
    (r"smartrecruiters\.com$",    r"/(\d{6,})"),
    (r"greenhouse\.io$",          r"/jobs/(\d+)"),
    (r"careers\.cisco\.com$",     r"/job/(\d+)"),
@@ -1788,12 +1795,32 @@ def index_decisions(decisions):
    return idx
 _RUAG_SLUG = re.compile(r"^https://jobs\.ruag\.ch/offene-stellen/([^/]+)/[0-9a-f-]{36}/?$")
 def _ruag_slug(url):
    m = _RUAG_SLUG.match(url.strip())
    return m.group(1) if m else None
 def find_decision_url(decisions, url):
    """Existing log URL for the same job, if one is already recorded under a drifted URL."""
    key = _decision_key(url)
    for existing in decisions:
        if _decision_key(existing) == key:
            return existing
    # RUAG regenerates the UUID in /offene-stellen/<slug>/<uuid> when a req is reposted, so the
    # exact key misses and an already-judged role resurfaces as undecided — this is what happened
    # to every RUAG rule-out between the 2026-08-31 and 09-04 runs. The slug survives the repost,
    # but it is NOT unique: RUAG had two live reqs sharing
    # `flugzeugmechanikerin-technician-mechanical-f-a-18` on 2026-09-04. So the slug is only a
    # fallback, and only when it is unambiguous in the log — never let one skip decide two reqs.
    slug = _ruag_slug(url)
    if slug:
        matches = [e for e in decisions if _ruag_slug(e) == slug]
        if len(matches) == 1:
            return matches[0]
    return None
@@ -1,6 +1,6 @@
 {
  "cohort_id": "evidence-first-2026-01",
-  "status": "active",
+  "status": "active (log, not a capped cohort)",
  "started": "2026-07-27",
  "target_mix": {
    "core": 7,
@@ -85,6 +85,17 @@
      "hard_gate": "fail",
      "channel": "weak",
      "outcome": "applied"
    },
    {
      "company": "NVIDIA",
      "role": "Senior DevOps Engineer, Zurich (JR2024256)",
      "application_date": "2026-09-05",
      "fit_class": "stretch",
      "evidence_fit": 64.0,
      "hard_gate": "fail",
      "channel": "weak",
      "outcome": "applied"
    }
-  ]
+  ],
  "policy_change_2026_09_05": "Slot caps (7 core / 2 adjacent / 1 stretch) DROPPED by user decision. target_mix is retained only as a record of the original design and is no longer read by cohort_tracker.py or enforced anywhere. This file continues as a durable application log. Channel is now the rationed variable: no application goes out cold when a named contact is published and reachable. See resume_builder/reference/application_strategy.md."
 }
@@ -1511,13 +1511,6 @@
    "note": "Claude judgment 2026-07-06: direct title match on data lakehouse/data platform, local WLB-exception tier",
    "date": "2026-07-06"
  },
  "https://jobs.ruag.ch/offene-stellen/devops-engineer-c5i/349979ee-d679-4dcf-acba-66662b0a1ecf": {
    "company": "RUAG (Thun/Bern)",
    "title": "DevOps Engineer C5I m/f/d",
    "decision": "shortlist",
    "note": "Claude judgment 2026-07-06: DevOps title match, local tier; you already pulled a JD dump for this exact req (jd_ruag_devops_c5i.txt), signalling prior interest",
    "date": "2026-07-06"
  },
  "https://jobs.ruag.ch/offene-stellen/senior-software-engineer-mit-ai-ml-erfahrung/ca1f10d4-6fe8-4ff4-a189-28d440349750": {
    "company": "RUAG (Thun/Bern)",
    "title": "Senior Software Engineer mit AI/ML Erfahrung m/f/d",
@@ -1810,13 +1803,6 @@
    "note": "Submitted 2026-08-26. Adjacent, Evidence Fit 71, Document Quality ~91 est (critique scored 86 pre-Tier-1). 2pp resume + 1pp CL, both validator PASS. IMPORTANT FINDING: the application form's preferred-work-location dropdown offered NO Zurich option, despite the JD body saying 'Miami, Zurich or New York' and the site's own Zurich filter returning this req. Careers site is operated by Citadel Enterprise Americas LLC. Treat the Zurich seat as unconfirmed for any future Citadel application - check the form before investing. Working-model question (5-day onsite?) never resolved and may now be moot. Channel cold; user applied with low expectation.",
    "date": "2026-08-26"
  },
  "https://careers.axpo.com/jobs/8263436-staff-plattform-engineer-w-m-d": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "User decision 2026-08-27: not of interest. Baden is a 90min commute from Thun and Axpo is unlikely to pay materially above his current ~140k. RULE: for a commute that long the package must be much better - BIS-style tax-free or FAANG-like comp. Azure + Terraform are also named requirements with 0 canonical evidence, but that was NOT the deciding factor.",
    "date": "2026-08-27"
  },
  "https://jobs.ruag.ch/offene-stellen/ai-engineer-c5i/4afaa9aa-74c1-4b4d-9232-cf65651ce8ec": {
    "company": "RUAG C5I",
    "title": "AI Engineer C5I (Thun)",
@@ -1844,5 +1830,117 @@
    "decision": "applied",
    "note": "Submitted 2026-08-27. Ref JRQ$540-19848, Zimmerwald. Core, Evidence Fit 79, Document Quality 92, hard gate PASS, channel weak. German 2-page CV plus 1-page motivation letter; the six-year Bundeswehr officer career is included as military-context and motivation evidence. User explicitly accepted the critique's remaining BS-1 wording issue ('ohne manuellen Eingriff') as good enough and submitted without the proposed correction. Honest gaps at submission: physical datacenter work, Pull-GitOps as a named practice, GPGPU, ClickHouse and second Swiss official language. Lohnklasse and Engineer-III level were not recorded as clarified.",
    "date": "2026-08-27"
  },
  "https://jobs.ruag.ch/offene-stellen/senior-devops-kubernetes-engineer-c5i/2eef27f6-9546-499d-8492-c1cec22f548a": {
    "company": "",
    "title": "",
    "decision": "shortlist",
    "note": "Rank 1 and the only Core-classifiable target in the log. Re-verified live on the board 2026-09-04. Every required line has canonical evidence: Kubernetes SW-3/SW-7, Linux BS-6/PP-3, GitLab CI-CD SW-5/VZ-1, Ansible BS-6. Only von-Vorteil items missing (VMware/Nutanix/Proxmox, 0 canonical). JD states militärische Karriere als höherer Unteroffizier oder Offizier von Vorteil, so BW-1 scores. Gated on the Frank Haugwitz call (comp, PSP eligibility, whether a second C5I application is welcome while 18027 is pending).",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/senior-data-engineer-mssql-mit-data-lakehouse-perspektive/96da2356-d9f4-45da-a0ed-caa1acbe8ef9": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "JD read 2026-09-04. Repost of the pulled Data Lakehouse / Senior Data Platform Engineer req with the disqualifier moved into the title. Required: mehrjährige Erfahrung im Aufbau und Betrieb von ON PREMISE Data Warehouse Lösungen, plus MSSQL, Talend, SAP S/4HANA. claims.json has 0 for MSSQL, Talend and SAP; his stack is AWS cloud-native. Settles the 2026-08-31 downgrade.",
    "date": "2026-09-04"
  },
  "https://www.bis.org/vacancy/jr100472": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "JD read 2026-09-04. Architecture GOVERNANCE, not building: define and maintain architectural strategies and frameworks, enterprise-architecture standards, architecture forums. Aker BP authoring-vs-building shape for the third time. Plus required Managerial Experience 1 to 3 years supervising teams, and 6 to 10 years in architecture. His titles are Component Owner / Application Owner, technical ownership, not people management. Also jr100429 silent since 2026-07-10, so stacking applies. Deadline 21 Sep 2026, 3-yr FTC.",
    "date": "2026-09-04"
  },
  "https://careers.axpo.com/jobs/8247206-data-automation-engineer-w-m-d": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "POSTING IS DEAD. Left Unverifiable on 2026-08-31; re-checked 2026-09-04 and the Teamtailor API still returns the row while the public page still returns HTTP 404. Stale row in Axpo's feed, not a transient. Treat Axpo API rows as needing a live page check before any Phase 0.",
    "date": "2026-09-04"
  },
  "https://careers.axpo.com/jobs/8263436-staff-platform-engineer-w-m-d": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "USER DECISION 2026-08-27: not of interest. Baden is a 90min commute from Thun and Axpo is unlikely to pay materially above his current ~140k. RULE: for a commute that long the package must be much better - BIS-style tax-free or FAANG-like comp. Azure + Terraform are also named requirements with 0 canonical evidence, but that was NOT the deciding factor. // JD re-read 2026-09-04 (URL had drifted from staff-plattform- to staff-platform-, so it resurfaced untagged): confirms the requirement text - fundierte Kenntnisse in Kubernetes, Microsoft Azure, Terraform. claims.json has Azure as evidence:unverified / output:FORBIDDEN and Terraform unverified. Decision unchanged and the commute/comp reason still governs.",
    "date": "2026-09-04"
  },
  "https://jobs.postfinance.ch/PostFinance/job/Kubernetes-Engineer/74638-de_DE": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "JD read 2026-09-04. Best geography in the log (Bern/Homeoffice) and dead-on lane work: on-prem vanilla Kubernetes (Talos), GitLab CI/CD, GitOps, Grafana. Blocked on PUBLISHED COMP: CHF 115'000-130'000 at 100%, printed in the JD. Below the current ~140k, far below the 180k bar. Also requires Go for controllers/operators (Golang 0 canonical) and Terraform (unverified). Fourth PostFinance req with a printed band in the 100-135k range - this is a comp-bar exclusion, not a fit exclusion. Revisit only if the comp bar moves.",
    "date": "2026-09-04"
  },
  "https://career2.successfactors.eu/sfcareer/jobreqcareer?jobId=1628&locale=de_DE&company=Swissgrid": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "JD read 2026-09-04. Real level upside (leads ~5 experts, represents Swissgrid externally) but two required Gaps: fundierte Kenntnisse der Funktionsweise von elektrischen Energiesystemen (Elektrotechnik) und des Netzbetriebs - 0 canonical, this is a power-systems role wearing an AI title - and nachweisbare Führungserfahrung in the civilian-engineering sense (BW-1 is genuine leadership but not an engineering-management record). Aarau commute from Thun compounds it.",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/devops-engineer-c5i/f48073a5-1687-46d4-b2ae-62a60c51c9ad": {
    "company": "RUAG (Thun/Bern)",
    "title": "DevOps Engineer C5I m/f/d",
    "decision": "skip",
    "note": "DOWNGRADE from the stale 2026-07-06 shortlist. JD read 2026-08-31: same platform core as Senior DevOps (Kubernetes) C5I but down-level, and it adds required Windows EDR management and Data Rights Management / Tagging & Labeling - 0 canonical each. Weaker twin of rank 1; if RUAG C5I gets one application it should be the Senior DevOps (Kubernetes) req.",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/head-of-devops-office-c5i/abc407b4-7a20-441a-9689-f6d244c99224": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "TITLE IS MISLEADING - not a DevOps role. JD read 2026-08-31: this is the office/reception function of the C5I business area - travel management, vehicle admin, personnel admin, MS Office, kaufmännische Ausbildung / Direktionsassistent:in. Do not re-surface it as a platform role.",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/senior-bi-specialist-qlik-sense-mit-advanced-analytics-perspektive/7b5084b3-5bab-42fb-b211-bf77f5353f6c": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "Repost of Senior Data Analyst & Data Scientist (JD read 2026-08-31) with the disqualifier moved into the title. Qlik Sense is the title-defining tool and Qlik is 0 canonical; the req also carries SAP S/4HANA (0 canonical).",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/senior-software-engineer-c5i/4ed6e938-293d-4f9a-9d22-627bab9bb5ae": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "JD read 2026-08-31. OSINT/GEOINT full-stack; React + TypeScript frontend is required and React is 0 canonical. Interesting domain, wrong lane.",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/principal-system-engineering-c5i/b7442824-223a-425e-95e2-b238924212da": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "JD read 2026-08-31. Real level upside and the officer career is stated as an advantage, but the required umfassende Kenntnisse von Netzwerk-, Firewall- und Servertechnologien is a title-defining gap: Firewall 0 and Netzwerk 0 canonical. Would classify Stretch, and the Stretch slot is consumed.",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/system-architektin-mit-devsecops-flair/f11df831-34a9-4bda-a35b-81c004bc73b2": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "JD read 2026-08-31. TOGAF/ArchiMate/UML/SparxEA/arc42 security-architecture authoring - documentation-standard depth with 0 canonical evidence - plus a Zürich Seebach commute.",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/ict-architect-c5i/aa4ce14b-c713-4b2b-931b-8c94ef041de2": {
    "company": "",
    "title": "",
    "decision": "paused",
    "note": "NOT a skip - blocked on cohort arithmetic, revisit when a slot frees. JD read 2026-08-31: cloud-native/K8s/microservices architecture plus business-IT stakeholder management are Direct, officer career stated as an advantage, and the Architect title is the level upside the BKW decline asked for. But the title-defining Konzeption von System- und Plattformarchitekturen is org-scope against his domain-scope Component Owner evidence - the Aker BP authoring-vs-building shape. Defining-responsibility-only-Adjacent classes it Stretch (1/1 consumed); the Citadel/Aker BP precedent would record it Adjacent (2/2 consumed). Both exits closed, so it is only actionable if a Phase 0 scores the architecture responsibility genuinely Direct - and the JD reading says it is not.",
    "date": "2026-09-04"
  },
  "https://jobs.ruag.ch/offene-stellen/data-lakehouse-engineer-senior-data-platform-engineer/40022": {
    "company": "",
    "title": "",
    "decision": "skip",
    "note": "STALE SHORTLIST from 2026-07-06, cleared 2026-09-04. The req was pulled from the board between the 08-31 and 09-04 scrapes and reposted as Senior Data Engineer (MSSQL) mit Data Lakehouse Perspektive. The 07-06 shortlist was a title-match prior; the JD is on-prem MSSQL/Talend/SAP S/4HANA, 0 canonical each. See the successor req's own decision row.",
    "date": "2026-09-04"
  },
  "https://nvidia.wd5.myworkdayjobs.com/en-US/NVIDIAExternalCareerSite/job/Switzerland-Zurich/Senior-DevOps-Engineer_JR2024256": {
    "company": "",
    "title": "",
    "decision": "applied",
    "note": "SUBMITTED 2026-09-05. Evidence Fit 64/100 Stretch, hard gate FAIL x2, channel Weak/cold - the 7th consecutive cold submit. Submitted under explicit user override: the required line 'Strong expertise in on-premises networking and compute infrastructure' is a Gap (networking 0 canonical), and hybrid-vs-onsite was NEVER RESOLVED before sending, so the working model is now a live screening topic rather than a pre-cleared one - same pattern as RUAG comp/PSP. Package: 2pp resume 13 bullets + 1pp cover letter 279 words, both validators PASS 0 warnings, 0 boxes, 0 Tier 1 findings open. Measured Document Quality 82/100 pre-edit; both Tier 1 findings closed afterwards so it is better than 82 but NOT re-measured - never quote a post-edit estimate as a score. The letter names both honest gaps out loud: on-prem networking, and that employer-side Linux/Ansible ended Dec 2022 with only a personal server carrying currency. Comp is NOT a risk here: levels.fyi Greater Zuerich IC3 median ~CHF 204k, IC4 ~CHF 379k. Thun-Zuerich is ~1h50 each way, so a 5-day-onsite answer is the main disqualifier to watch for.",
    "date": "2026-09-05"
  }
-}
+}
@@ -0,0 +1,95 @@
 ====================================================================================================
 URL: https://nvidia.wd5.myworkdayjobs.com/en-US/NVIDIAExternalCareerSite/job/Switzerland-Zurich/Senior-DevOps-Engineer_JR2024256
 HTTP: 200
 TITLE: Senior DevOps Engineer
 --------------------------------------------------------------------------------
 Skip to main content
 CAREERS AT NVIDIA
 Sign In
 Home
 Search for Jobs
 Senior DevOps Engineer page is loaded
 Senior DevOps Engineer
 Apply
 locations
 Switzerland, Zurich
 time type
 Full time
 posted on
 Posted 3 Days Ago
 job requisition id
 JR2024256
 NVIDIA is a world leader in Artificial Intelligence, High-Performance Computing, and Visualization. Our invention, the GPU, has transformed modern computing and is at the heart of our products and services. We set the standard in groundbreaking technology, making NVIDIA one of the technology industry’s most desirable employers. We are seeking a talented and passionate DevOps Engineer to join our team. 
 If you excel at creative problem-solving, thrive in a fast-paced environment, and are eager to collaborate with distributed teams, we want to hear from you!
 What You’ll Be Doing: 
 Design, build, and maintain robust HPC and cloud infrastructure utilizing state-of-the-art technologies and cutting-edge hardware. 
 Automate the deployment, configuration, and management of network and compute resources, including bare metal servers, network switches, and VMs.
 Develop and streamline CI/CD pipelines to enable continuous integration and delivery for our R&D engineering teams.
 Optimize infrastructure for availability, performance, observability, security, scalability, and cost-efficiency. Collaborate closely with software development teams to integrate automated testing and quality assurance into deployment workflows.
 Troubleshoot and resolve issues spanning infrastructure, networking, hardware, and software environments. Stay current with industry trends and incorporate best practices in DevOps and infrastructure management.
 What We Need to See: 
 Bachelor’s or Master’s degree in Computer Science, Data Science, Engineering, or a related field.
 10+ years of experience building and maintaining DevOps processes, with a strong focus on automation and reliability.
 Solid experience with major Linux distributions (CentOS, Ubuntu, RedHat). Proficient scripting skills in Bash, Python, or Groovy.
 Deep understanding of Linux virtualization technologies (QEMU/KVM, Docker) and orchestrators like Kubernetes.
 Hands-on experience with configuration management tools (e.g., Ansible). Strong expertise in on-premises networking and compute infrastructure.
 Familiarity with CI/CD tools such as Jenkins, GitHub/GitLab, Kubernetes, and GitHub Actions. Excellent written and verbal communication skills in English.
 Ways To Stand Out From The Crowd: 
 Experience working in agile DevOps teams and complex technical environments Proven ability to achieve or exceed security, reliability, scalability, and availability goals.
 In-depth understanding of modern HPC and infrastructure architectures.
 Passion for staying at the forefront of emerging technologies and best practices
 Join and work on technologies that are transforming entire industries. We offer an innovative and inclusive environment where your contributions matter, and your ideas shape the future.
 Similar Jobs (5)
 Senior HPC AI Cluster Engineer
 locations
 2 Locations
 time type
 Full time
 posted on
 Posted 24 Days Ago
 Senior Software Developer
 locations
 2 Locations
 time type
 Full time
 posted on
 Posted 30+ Days Ago
 Senior Site Reliability Engineer, DGX Cloud
 locations
 2 Locations
 time type
 Full time
 posted on
 Posted 15 Days Ago
 View All 5 Jobs
 NVIDIA pioneered accelerated computing. Today, our AI infrastructure powers global intelligence, transforming every industry.
 Learn more about NVIDIA.
 Follow Us
 Applicant Privacy Policy
 © 2026 Workday, Inc. All rights reserved.
@@ -0,0 +1,227 @@
 # Critique — NVIDIA, Senior DevOps Engineer (Zurich, JR2024256)
 Date: 2026-09-04 · Documents: `e2e_nvidia_sr_devops_resume.tex` (2pp, 13 bullets),
 `e2e_nvidia_sr_devops_cover_letter.tex` (1pp, 279 body words) · No prior critique.
 > Per `critique_framework.md`, fit, document quality and channel are scored separately and never
 > collapsed into one number. **This package is not submit-ready on document quality alone** — the fit
 > gate failed twice at Phase 0 and one of those failures is still unresolved.
 ---
 ## 1. Fit verdict and hard gates
 | | |
 |---|---|
 | **Evidence Fit** | **64/100 — Stretch** (unchanged from Phase 0; documents do not move evidence) |
 | **Hard gate** | **FAIL ×2** |
 | **Channel** | **Weak** — cold portal application, the 7th consecutive one |
 | **Cohort** | evidence-first-2026-01 at 6/10. Core 3/7 free; **Adjacent 2/2 and Stretch 1/1 both consumed** — no slot of the right class exists. Proceeding is an explicit user override, recorded as such |
 **Gate failure 1 — a required qualification is a Gap.** *"Strong expertise in on-premises networking
 and compute infrastructure."* Networking is 0 canonical. Not writable around, and correctly not
 written around.
 **Gate failure 2 — an unresolved practical constraint. STILL OPEN.** The JD is silent on hybrid vs
 onsite; Thun→Zurich is ~1h50 each way. `critique_framework.md` §1 treats this as a NO-GO trigger, and
 the Citadel precedent in `CLAUDE.md` says it **must be asked, not researched**. **Nothing should be
 submitted until NVIDIA recruiting answers this.** It is the single highest-value open action on the
 application, above every document fix below.
 ---
 ## 2. Document Quality — 82/100
 | Dimension | Weight | Score | Note |
 |---|---:|---:|---|
 | Truth and provenance | 25 | **22** | Scope discipline is exemplary across all six risky objects. One unsupported token (Tier 1 #1) and one canonical instruction not followed (Tier 1 #2) |
 | Information hierarchy | 20 | **17** | Employer/title/dates prominent and correct, promotions shown, positions intact across the page break. Costs a point for the headline/recency mismatch (Tier 2 #1) |
 | Bullet evidence and impact | 20 | **15** | Specific, scoped, no invented metrics — but **zero quantified outcomes anywhere**, against a JD that asks for "proven ability to achieve or exceed" goals. Not fixable: every canonical claim is `metrics: unverified`. It still costs |
 | Relevance and terminology | 15 | **11** | JD term coverage **19/38 = 50%**. Four honest wins available (Tier 2 #2) |
 | Skills evidence | 10 | **8** | Every line traceable except the Ubuntu token |
 | Mechanics and readability | 10 | **9** | Compiles clean, 0 over/underfull boxes, cadence validator passes, good length spread (18–36 words). One wording slip |
 Truth/provenance is well above the 20/25 automatic-failure threshold.
 ---
 ## 3. Claim audit
 | Claim | Canonical | Direct/Adjacent | Safe? | Fix |
 |---|---|---|---|---|
 | "over ten years" (summary) | Visible record Generali 2015-05 → today = 11y4m | Direct | **Yes** | — Correctly avoided the template's unsupported "12+ years" |
 | "Ansible-driven Linux server automation" (summary) | `BS-6` | Direct | Yes, but **undated** | See Tier 2 #1 |
 | "Integrated containerized ML inference into a continuously operating semiconductor fab" | `BS-1` | Direct | Yes | — |
 | "owns business-critical pipeline components on call" | `SW-2` | Direct | Yes | — |
 | **"Linux administration (Debian/Ubuntu)"** | `PP-3` = **Debian only**. Ubuntu: **0 canonical** | — | **NO** | **Tier 1 #1** |
 | "security hardening" (Operations line) | `PP-3`; canonical note says hardening evidence *"leans on the personal side; say so"* | Adjacent | **Borderline** | **Tier 1 #2** |
 | "Ansible including custom plugins" | `BS-6` credential plugin | Direct | Yes | — |
 | "ELK … Grafana, Prometheus, Loki — proof-of-concept work" | `BS-4` | Direct | Yes | PoC scope preserved; `forbidden` "observability platform" avoided |
 | "Migrated the Fulfillment and Product Analysis domains' … contributing to the wider migration programme" | `SW-1` | Direct | Yes | Scope-locked exactly as `forbidden` requires |
 | "governed data products … inside Swisscom's company-wide Data Mesh" | `SW-7` | Direct | Yes | Builds *inside* the mesh; no ownership implied |
 | "Security Champion for 2025/2026" | `SW-5` | Direct | Yes | Correct years, team role, not an award |
 | "Linux server estate behind fab analytics and ML workloads" | `BS-6` | Direct | Yes | Not "the fab's infrastructure" or "the datacenter" |
 | "self-hosted Debian server … around ten years" | `PP-3` | Direct | Yes | Labelled personal; header date now `Ongoing`, matching the self-reported quantity |
 | Bosch/Swisscom promotion lines | `title_history` | Direct | Yes | — |
 | Vizrt "Test Automation / DevOps Engineer" | `display_title` | Direct | Yes | Full display title retained deliberately |
 | CL: every claim | `FC-1`,`BS-6`,`BS-1`,`SW-3`,`SW-2`,`PP-3`,`SW-1` | — | Yes | No claim in the letter is absent from the resume |
 Validators: **resume PASS (0 warnings) · cover letter PASS (0 warnings).**
 ---
 ## 4. Tier 1 fixes — truth and fit
 **#1 — `Ubuntu` is not canonical evidence. Remove it.**
 `\skillline{Infrastructure and automation}` reads *"Linux administration (Debian/Ubuntu)"*. `claims.json`
 has **Debian ×2, Ubuntu ×0**; `PP-3` is a Debian server. The reasoning that Debian→Ubuntu transfers
 almost exactly is sound — but that belongs in an **interview answer**, not a skills line, which asserts
 experience. The JD names "CentOS, Ubuntu, RedHat", which is exactly why the token slipped in.
 **Fix:** `Linux administration (Debian)`. Self-inflicted during generation; caught here.
 **#2 — Say that hardening is personal-side.**
 `claims.json` note on Linux administration: *"Hardening and security configuration evidence leans on
 the personal side; **say so** rather than implying an employer mandate."* The Operations skills line
 lists *"security hardening"* beside on-call, SLO definition and component ownership — all employer
 evidence — with no marker. `PP-3` is labelled a personal project on page 2, so it is traceable, but
 the canonical file gives an explicit instruction that is not being followed.
 **Fix:** `security hardening (personal server)` or move it onto the Monitoring/personal line.
 *No other Tier 1 findings. No forbidden term appears anywhere: HPC, GPU, bare metal, switches,
 QEMU/KVM, RHEL/CentOS, Groovy, Terraform, GitOps, GitHub Actions, Azure, LangChain, Capgemini,
 "12+ years", "observability platform" — all absent, verified by sweep.*
 ---
 ## 5. Tier 2 improvements — presentation
 **#1 — The headline advertises currency the evidence does not have.**
 Headline: *"Staff Engineer | Linux, Ansible & Kubernetes | CI/CD and Infrastructure Automation"*.
 Summary: *"Ansible-driven Linux server automation"*. Both undated. The employer evidence for Linux and
 Ansible is **Feb 2020 – Dec 2022**, and the only current Linux practice is a personal project at the
 foot of page 2. Nothing is false and the bullets are correctly dated — but the technical reviewer will
 form an expectation from the headline and find it three years stale. **The cover letter now names this
 explicitly, which is the right place for it.** Optional resume-side softening: reorder the headline to
 lead with Kubernetes and CI/CD (both current) and let Ansible follow.
 **#2 — Four honest ATS terms are missing and all four are writable.**
 Coverage is 19/38. The absent terms split cleanly:
 - **Correctly absent — never add:** HPC, bare metal, VMs, QEMU/KVM, virtualization, Groovy, GitHub.
  These are the real gaps and adding them would be fabrication.
 - **Writable from existing evidence:** **"configuration management"** (Q5a's exact phrase — `BS-6`
  *is* configuration management; the resume says only "Ansible"), **"reliability"** (the JD's second
  named focus; `SW-2` on-call and `BS-3` SLOs support it), **"observability"** (`BS-4`; the skills line
  says only "Monitoring" — the word itself is not forbidden, only "observability platform"), and
  **"orchestration"** (`BS-1`'s `allowed_verbs` include "orchestrated"; Kubernetes is an orchestrator
  and the JD says "orchestrators like Kubernetes").
 **#3 — Summary wording slip.** *"the automation and delivery layer that engineering and research teams
 work on"* — the teams do not work *on* the delivery layer, they ship *through* it. In the most-read
 sentence of the document. **Fix:** "rely on" or "ship through".
 **#4 — Bullet 6 is at the density threshold.** 36 words, the longest in the document
 (`resume_reference.md` §7 flags ~35+). It is also the single most JD-central bullet and its three-part
 scope clause is doing real work. **Leave it** unless something else must be added to that position.
 ---
 ## 6. Reader sequence
 - **Parser/ATS —** extracts cleanly; text order verified (employer → dates → title → location → bullets).
  Ranking is the risk, not extraction: at 50% term coverage, with the misses concentrated in the
  HPC / networking / virtualization cluster, a strict keyword screen down-ranks him. Tier 2 #2 lifts
  this a few points honestly; it cannot fix the cluster that is genuinely absent.
 - **Recruiter glance — Borderline.** The headline reads on-title for a DevOps role. The risk is two
  inches below: the formal Swisscom title is *Staff Data, Analytics & AI Engineer*, which a
  non-technical screener may read as "data person applying to infrastructure". This is the intended
  positioning trade and it is defensible — the formal title must stay — but it is the 10-second risk.
 - **Hiring manager — Maybe.** R3 (CI/CD for R&D teams) and R4 (automated testing into deployment
  workflows) are answered with unusually direct evidence — Fraunhofer and Vizrt map almost verbatim.
  R2 and R5 (networking, hardware, bare metal) are not answered at all, and the letter says so.
 - **Technical reviewer — credible, and the letter helps.** Naming the networking gap pre-empts the
  discovery. First challenge: *"Walk me through your on-prem networking."* Second: *"Ansible was three
  years ago — what is current?"* Third: *"Which distributions?"* Prepared answers exist for all three
  in the session file's Critique Context.
 ---
 ## 7. Competitive read
 The obvious-fit candidate is a Linux/HPC systems engineer from CSCS, ETH/EPFL, a Swiss hosting or
 colocation provider, or a hardware vendor — someone who has racked servers, configured switches and run
 Slurm. **Their advantage is precisely the half he lacks, and it is named in a required line.**
 **His real advantage** is not "also does Linux". It is a decade-long, five-employer CI/CD and automation
 thread that a pure sysadmin usually lacks, Ansible depth beyond use (he wrote extensions), current
 production Kubernetes, and `BS-1` — putting containerized inference into a fab that cannot stop. That
 last one is the closest thing in his record to the operational discipline an AI-infrastructure site
 needs, and it is genuinely uncommon.
 **Do not over-value the bridge.** Debian→Ubuntu is close to free; RHEL/CentOS is a real unknown;
 networking is not a bridge at all.
 ---
 ## 8. Cover letter assessment
 **The letter earns its place.** Under `cl_reference.md`'s decision gate it qualifies on two counts:
 a credible domain transition needs explaining (data/platform engineer → DevOps infrastructure), and
 work authorization materially helps. **Deleting it would weaken the application** — it is the only
 place the networking gap and the recency split can be stated in the candidate's own voice rather than
 discovered by a reviewer.
 - **Anti-patterns:** none. No generic opener, no credential dump, no copied resume bullet, no
  press-release paraphrase. The gap paragraph is factual rather than apologetic — it states the limit
  and what he does have, in two sentences.
 - **Hooks — first-party verified.** The one hook used is NVIDIA's own live Zurich posting **JR2022878**
  (*"building the next generation of scalable AI infrastructure … distributed training, real-time
  inference, and communication efficiency across large systems"*), scraped directly 2026-09-04.
  **A hook was dropped at verification:** the Phase 0 plan carried "Alps / Swiss AI Initiative with ETH
  Zurich and EPFL", but the first-party NVIDIA newsroom release mentions **neither EPFL nor a Swiss AI
  Initiative** — that framing came from secondary coverage. Corrected in the session file, and Alps was
  omitted from the letter regardless as being about CSCS rather than NVIDIA Zurich.
 - **Package cohesion:** every letter claim traces to a resume bullet. No new skill, metric, tool or
  ownership claim. No contradictions.
 - **Length:** 279 body words, inside the 250–300 industry target. One page, well filled.
 ---
 ## 9. Mechanical verification
 | Check | Result |
 |---|---|
 | Canonical validator — resume | **PASS, 0 warnings** |
 | Canonical validator — cover letter | **PASS, 0 warnings** |
 | Compile | Clean, two passes, both documents |
 | Over/underfull boxes | **0** |
 | Page count | Resume 2, letter 1 — matches `config.md` |
 | Text extraction order | Verified: heading → employer → dates → title → location → bullets |
 | Visual inspection | Both resume pages and the letter inspected at normal size. No orphans, no clipping, no header wrapping. Positions intact across the page break |
 | Cadence (§7a) | PASS after remediation — the first build hit **10/12 bullets (83%)**, the SBB failure mode; five sentences reshaped without touching a claim, scope or verb |
 | Bullet length spread | 18–36 words. Good variation within and across positions |
 | Email | `dennis@thiessen.io` in both, matches `config.md` |
 | Forbidden-term sweep | Clean — 22 terms checked, 0 hits |
 | Stale artifacts | None. No superseded PDF beside either deliverable |
 **Tool caveat — `char_count.py` output for this document is unreliable and should be ignored.** Its
 parser takes everything between `\item` markers, so it absorbs following section markup *and LaTeX
 comments* into the preceding bullet: it reported bullet 13 as "90 words / 3 clauses" when the real
 bullet is 23 words. Every "potentially dense" flag it raised is an artifact. The provenance comments in
 this `.tex` (recording why Ubuntu, the PP-3 date and the thesis grade were handled as they were) make
 the effect worse, but they are worth keeping — the tool should be fixed instead. Bullet metrics in this
 critique were measured independently.
 ---
 ## 10. Verdict
 **Document Quality 82/100 · Evidence Fit 64/100 (Stretch) · Channel Weak · Hard gate FAIL ×2.**
 The documents are honest, well-scoped and specific, and the two Tier 1 fixes are small. **They are not
 what is holding this application.** What holds it is the unresolved working-model question, which is a
 NO-GO trigger under the project's own framework and cannot be answered by research.
 **Order of operations:** ask NVIDIA recruiting about hybrid vs onsite → if the answer is compatible,
 apply Tier 1 #1 and #2 and optionally Tier 2 #2 and #3 via `/edit-resume` → then submit. If the seat is
 5-day onsite, the correct outcome is a documented NO-GO on the Bern/Thun constraint, and the package
 is shelved intact for a future NVIDIA req.
@@ -0,0 +1,52 @@
 % NVIDIA — Senior DevOps Engineer (Zurich, req JR2024256)
 % Cover Letter Decision: YES (session_nvidia_sr_devops.md).
 % Every claim traceable to the resume and to resume_builder/canonical/claims.json.
 % Hook: NVIDIA's own live Zurich posting JR2022878, scraped first-party 2026-09-04.
 \documentclass[11pt,a4paper]{article}
 \usepackage[utf8]{inputenc}
 \usepackage[T1]{fontenc}
 \usepackage{lmodern}
 \usepackage[a4paper,left=0.85in,right=0.85in,top=0.7in,bottom=0.7in]{geometry}
 \usepackage{parskip}
 \usepackage{xcolor}
 \usepackage{hyperref}
 \hypersetup{hidelinks}
 \pagestyle{empty}
 \setlength{\parindent}{0pt}
 \begin{document}
 {\Large\bfseries Dennis Thiessen, M.Eng.}\par
 Bern, Switzerland $\vert$
 \href{mailto:dennis@thiessen.io}{dennis@thiessen.io} $\vert$ +41 795 955 585 $\vert$
 \href{https://linkedin.com/in/dennis-thiessen}{LinkedIn}
 \vspace{1.5em}
 Hiring Team\\
 NVIDIA\\
 Zurich, Switzerland
 \vspace{1em}
 \today
 \vspace{1em}
 \textbf{Application for Senior DevOps Engineer (JR2024256)}
 \vspace{0.8em}
 Dear Hiring Team,
 Your Zurich team builds software for distributed AI training and inference at cluster scale. Researchers and engineers doing that kind of work need their infrastructure and their build pipelines to be dependable and to stay out of the way, and that is the side of the job I have spent most of my career on. At Fraunhofer CML I set up the research team's first Jenkins CI/CD pipeline. At Bosch I administered and automated the Linux servers carrying a semiconductor fab's analytics and ML workloads.
 The Bosch work is the closest thing in my record to this role. That estate ran on Ansible playbooks kept in Git and applied from Jenkins and GitLab pipelines; when repeated credential lookups became a drag, I wrote an Ansible plugin that pulled secrets from our keystore and cached them locally. It is also where I integrated containerized ML inference into a production line that could not be stopped for a deployment --- the constraint that taught me most about doing infrastructure work carefully. At Swisscom I now build and operate Python services on Kubernetes with GitLab CI/CD, and I carry on-call duty for the components I own.
 Two things are worth saying plainly. My Linux and Ansible work as an employee ran through 2022; since then my day job has been Kubernetes and AWS, and my hands-on Linux practice has been the Debian server I have run and hardened myself for about ten years. And I have not worked in on-premises networking --- I have automated and operated the compute side, and switches and fabric would be new to me. I am an EU citizen with a Swiss B permit, already living and working in Switzerland.
 I would welcome the chance to talk about how this experience could support your Zurich engineering team.
 Kind regards,
 \vspace{1.5em}
 Dennis Thiessen
 \end{document}
@@ -0,0 +1,104 @@
 % NVIDIA — Senior DevOps Engineer (Zurich, req JR2024256)
 % International Tech profile. Generated 2026-09-04 from resume_builder/canonical/claims.json
 % plus normalized experience files. Session: session_nvidia_sr_devops.md
 \documentclass{resume}
 \usepackage[utf8]{inputenc}
 \usepackage[T1]{fontenc}
 \usepackage{lmodern}
 % English-language document: TeX's default hyphenation patterns are correct here.
 % A German package would need \usepackage[ngerman]{babel} — see the template's language note.
 \usepackage[a4paper,left=0.65in,right=0.65in,top=0.55in,bottom=0.55in]{geometry}
 \usepackage{xcolor}
 \usepackage{hyperref}
 \hypersetup{hidelinks}
 \usepackage[version=4]{mhchem}
 \usepackage{fancyhdr}
 \pagestyle{fancy}
 \fancyhf{}
 \renewcommand{\headrulewidth}{0pt}
 \fancyfoot[R]{\small \thepage/\pageref{LastPage}}
 \name{Dennis Thiessen, M.Eng.}
 \headline{Staff Engineer $\vert$ Linux, Ansible \& Kubernetes $\vert$ CI/CD and Infrastructure Automation}
 \contactline{Bern, Switzerland $\vert$ \href{mailto:dennis@thiessen.io}{dennis@thiessen.io} $\vert$ +41 795 955 585 $\vert$ \href{https://linkedin.com/in/dennis-thiessen}{LinkedIn} $\vert$ EU citizen, Swiss B permit}
 \begin{document}
 \begin{rSection}{Summary}
 Engineer with over ten years building the automation and delivery layer that engineering and research teams rely on: Jenkins and GitLab CI/CD, containerized delivery on Kubernetes, and Ansible-driven Linux server automation. Integrated containerized ML inference into a continuously operating semiconductor fab, and today owns business-critical pipeline components on call at Swisscom.
 \end{rSection}
 \begin{rSection}{Technical Skills}
 % Debian only: claims.json has Debian x2, Ubuntu x0 (PP-3 is a Debian server). The
 % Debian-to-Ubuntu transfer argument is an interview answer, not a skills-line claim.
 \skillline{Infrastructure and automation}{Linux administration (Debian), Ansible configuration management including custom plugins, Kubernetes container orchestration, Docker, infrastructure as code (CloudFormation)}
 \skillline{CI/CD and delivery}{GitLab CI/CD, Jenkins, containerized build and deployment, automated testing and quality gates}
 % Hardening is marked personal-side per the explicit claims.json instruction on Linux
 % administration: the evidence "leans on the personal side; say so".
 \skillline{Operations}{On-call and incident response, SLO definition and service reliability, application and component ownership, DevSecOps; security hardening (personal server)}
 \skillline{Monitoring and observability}{ELK Stack (Elasticsearch, Logstash, Kibana), Grafana, Prometheus, Loki --- proof-of-concept work}
 \skillline{Cloud and data}{AWS (S3, Glue, Athena/Iceberg, Redshift, Airflow), Apache Kafka, PySpark, Oracle, Teradata, Hadoop/Impala}
 % Bash added 2026-09-05 after the user confirmed it; now canonical in claims.json
 % (production-historical-and-personal-current, same evidence basis as Linux administration).
 % Groovy stays out - still unverified and forbidden.
 \skillline{Languages and certifications}{Python, Bash, SQL; Java and C\# (professional, historical); C++ (limited historical use). AWS Solutions Architect -- Associate; Data Engineering with AWS; iSAQB CPSA-F; ITIL Foundation}
 \end{rSection}
 \begin{rSection}{Professional Experience}
 \begin{rSubsection}{Swisscom (Schweiz) AG}{Oct 2023 -- Present}{Staff Data, Analytics \& AI Engineer (promoted from Senior, Apr 2025)}{Bern, Switzerland}
 \item Build and operate Python data applications on Kubernetes with GitLab CI/CD, covering containerized delivery from test through production operation in an agile team.
 \item Own business-critical Fulfillment ETL components as Component Owner with on-call duty for their production operation and data quality.
 \item Migrated the Fulfillment and Product Analysis domains' legacy Teradata and Oracle ETL onto Swisscom's AWS platform using Glue, Athena/Iceberg, Redshift, Airflow and CloudFormation, contributing to the wider migration programme.
 \item Serve as the team's Security Champion for 2025/2026 with responsibility for security compliance and deviation tracking across its pipelines, after 100 hours of DevSecOps training.
 \item Model and build governed data products with active metadata management inside Swisscom's company-wide Data Mesh on AWS, using Glue, Athena and CloudFormation.
 \end{rSubsection}
 \end{rSection}
 % Forced break kept: letting LaTeX flow naturally split the Bosch position across pages with no
 % continuation header, which costs more in information hierarchy than page-1 white space does.
 \newpage
 \begin{rSection}{Professional Experience (continued)}
 \begin{rSubsection}{Robert Bosch Semiconductor Manufacturing Dresden GmbH}{Feb 2020 -- Dec 2022}{Senior Data Engineer, Data Analysis (promoted from Data Engineer, Jan 2021)}{Dresden, Germany}
 \item Administered and automated the Linux server estate behind fab analytics and ML workloads --- ML platform hosts, Docker hosts and backend services --- with Ansible playbooks version-controlled in Git and applied from Jenkins and GitLab pipelines.
 \item Extended Ansible with a custom credential plugin that retrieved secrets from a password keystore and cached them locally, cutting repeated lookups.
 \item Integrated containerized ML inference into a continuously operating semiconductor fab using Docker, Kubernetes and Ansible, automating image-based defect classification and reducing manual inspection work for line engineers.
 \item Built an anomaly-detection proof of concept on ELK and Kafka in Docker, with Grafana, Prometheus and Loki monitoring, to validate centralized logging and alerting for 24/7 production systems.
 \end{rSubsection}
 \begin{rSubsection}{Fraunhofer CML}{Sep 2018 -- Oct 2019}{Research Software Engineer}{Hamburg, Germany}
 \item Set up the research team's first Jenkins CI/CD pipeline with quality gates while developing C\#/.NET software and containerized microservices for maritime research platforms.
 \end{rSubsection}
 \begin{rSubsection}{Vizrt}{Jul 2017 -- May 2018}{Test Automation / DevOps Engineer}{Bergen, Norway}
 \item Automated audio and video integration testing in Python for broadcast software, then wired the suite into CI/CD quality gates to shorten the feedback loop on new features.
 \end{rSubsection}
 \begin{rSubsection}{Generali Deutschland Informatik Services GmbH}{May 2015 -- Jun 2017}{IT Consultant}{Hamburg, Germany}
 \item Introduced BDD test automation through a proof of concept and held technical responsibility for the suite and its Jenkins jobs, training colleagues across the internal Java community.
 \end{rSubsection}
 \end{rSection}
 \begin{rSection}{Personal Projects}
 % No date range: claims.json PP-3 records only a self-reported "~10 years", so a precise
 % start year would assert more than the KB supports. The bullet carries the approximation.
 \begin{rSubsection}{Self-hosted Linux server}{Ongoing}{Personal project}{}
 \item Run and harden a self-hosted Debian server in continuous operation for around ten years, serving nginx, mail, Nextcloud, a VPN and Docker services.
 \end{rSubsection}
 \end{rSection}
 \begin{rSection}{Education}
 \compactentry{M.Eng. Computer Aided Engineering (Software Design \& Engineering), Universität der Bundeswehr München}{Apr 2012 -- Oct 2013}
 % Thesis grade omitted: claims.json grade_output_rule allows the 1.0 only "where academic
 % performance is genuinely valued". A 10+-years hands-on infrastructure role is not that.
 Thesis at Tongji University, Shanghai: \textit{Development of a Web-Based Remote Fault Diagnosis System}.
 \compactentry{B.Eng. Information and Telecommunication Technologies, Universität der Bundeswehr München}{Oct 2009 -- Oct 2012}
 \end{rSection}
 \end{document}
@@ -0,0 +1,59 @@
 \ProvidesClass{resume}[2026/07/27 Evidence-first professional resume]
 \LoadClass[11pt,a4paper]{article}
 \RequirePackage{enumitem}
 \RequirePackage{ifthen}
 \RequirePackage{lastpage}
 \RequirePackage{parskip}
 \RequirePackage{needspace}
 \pagestyle{empty}
 \setlength{\parindent}{0pt}
 \def\@resumename{}
 \def\@resumeheadline{}
 \def\@resumecontact{}
 \newcommand{\name}[1]{\def\@resumename{#1}}
 \newcommand{\headline}[1]{\def\@resumeheadline{#1}}
 \newcommand{\contactline}[1]{\def\@resumecontact{#1}}
 \newcommand{\printresumeheader}{%
  {\LARGE\bfseries \@resumename}\par
  \vspace{0.15em}
  \ifthenelse{\equal{\@resumeheadline}{}}{}{\@resumeheadline\par}
  \vspace{0.1em}
  {\small \@resumecontact}\par
  \vspace{0.45em}
 }
 \AtBeginDocument{\printresumeheader}
 \newenvironment{rSection}[1]{%
  \vspace{0.35em}
  {\bfseries #1}\par
  \vspace{0.1em}\hrule\vspace{0.35em}
 }{%
  \vspace{0.2em}
 }
 % Arguments: employer, dates, formal title, location.
 \newenvironment{rSubsection}[4]{%
  \Needspace{6\baselineskip}%
  {\bfseries #1}\hfill{\small #2}\par
  {\itshape #3}\hfill{\itshape #4}\par
  \vspace{0.1em}
  \begin{itemize}[leftmargin=1.25em,label=\textbullet,itemsep=0.18em,topsep=0.15em,parsep=0pt,partopsep=0pt]
 }{%
  \end{itemize}
  \vspace{0.25em}
 }
 \newcommand{\skillline}[2]{%
  \textbf{#1:} #2\par
  \vspace{0.08em}
 }
 \newcommand{\compactentry}[2]{%
  \textbf{#1}\hfill #2\par
 }
@@ -0,0 +1,472 @@
 # Session: NVIDIA — Senior DevOps Engineer (Switzerland, Zurich)
 ## JD Integrity
 - **File/source:** `output/NVIDIA_SrDevOps_Zurich/JD_nvidia_sr_devops_jr2024256.txt` — req **JR2024256**
 - **Retrieval method and date:** headless Playwright render via `job_scout/.venv` (the board is a Workday SPA; WebFetch is JS-blind), **2026-09-04**. HTTP 200.
 - **Verbatim posting:** YES — saved unedited, not retyped from memory.
 - **Posting status:** LIVE. JD states *"Posted 3 Days Ago"* → posted ~2026-09-01. Very fresh.
 - **URL note:** the canonical URL requires the tenant path
  `…/en-US/NVIDIAExternalCareerSite/job/Switzerland-Zurich/Senior-DevOps-Engineer_JR2024256`.
  The scout's short form 404s (fixed 2026-09-04; see KB Corrections Log).
 ## Application Decision
 - **Audience profile:** International Tech (US-tech conventions, English). NVIDIA is US-tech in Europe.
 - **Evidence Fit: 64/100**
 - **Fit class: Stretch** — the *score* lands Adjacent (60–74), but `application_strategy.md` requires
  Adjacent to have **no required Gap**, and Q5b is one. Defining-responsibility logic pushes it to Stretch.
 - **Hard gate: FAIL — on two counts.**
  1. A required qualification is a Gap: *"Strong expertise in on-premises networking and compute
     infrastructure"* (Q5b). Canonical networking evidence is **zero**.
  2. A practical constraint is **unresolved**: the JD is silent on hybrid vs onsite, and Thun→Zurich is
     ~1h50 each way. `critique_framework.md` §1 treats an unresolved location constraint as a NO-GO trigger.
 - **Channel Strength: Weak** — cold portal application. Would be the **7th consecutive cold submit**.
 - **Channel plan:** cold by default. No named contact in the posting. NVIDIA Zurich is a small HPC/AI
  infrastructure-software site; a targeted recruiter note is the realistic warm action.
 - **Cohort slot:** evidence-first-2026-01 is **6/10 — Core 3/7 (4 free), Adjacent 2/2 CONSUMED,
  Stretch 1/1 CONSUMED.** There is **no free slot of the right class.**
 - **Decision: PROCEED — under explicit user override, 2026-09-04.**
  This is the same shape as RUAG AI Engineer C5I (Evidence Fit 74, hard gate FAIL, user override).
  Recorded as an override, not as a passing gate.
 ### ⚠ One thing to resolve before Phase 2
 **Ask NVIDIA recruiting whether the Zurich seat is hybrid or 5-day onsite.** This is the Citadel
 lesson, recorded verbatim in `CLAUDE.md`: an unresolved working model is a NO-GO trigger and **must be
 asked, not researched**. From Thun the round trip is ~3.5h; the standing bar is hybrid, max 2–3 days.
 Comp is *not* the blocker here — see Company Context — so the working model is the whole question.
 ### Correction to the 2026-09-04 scout triage
 That triage called **two** required lines Gaps. On canonical review only **one** is: Q5b networking.
 **Q2 (10+ years of DevOps processes) is Adjacent and defensible, not a Gap** — a continuous CI/CD,
 automation and production-operation thread runs Generali 2015 → today across five employers (~10 years
 of role-time containing genuine DevOps content). The honest weakness is that those roles were *titled*
 data/test/research engineer, not DevOps. That is an interview answer, not a disqualifier.
 ## Requirements
 ### Required — "What We Need to See"
 | # | Requirement | Req/Pref | Class | Canonical evidence | Gate? |
 |---|---|---|---|---|---|
 | Q1 | Bachelor's or Master's in CS, Data Science, Engineering or related | Required | **Direct** | `EDU-MENG` M.Eng. Computer Aided Engineering (Software Design & Engineering); `EDU-BENG` B.Eng. Information and Telecommunication Technologies. Both Univ. der Bundeswehr München | — |
 | Q2 | 10+ years building and maintaining DevOps processes, strong focus on automation and reliability | Required | **Adjacent** (defensible) | Continuous thread: `GN-1` Jenkins jobs + test-automation ownership (2015–17) → `VZ-2` quality gates wired into CI/CD (2017–18) → `FC-1` set up Jenkins CI/CD (2018–19) → `BS-6` Linux estate + Ansible, playbooks run from Jenkins/GitLab (2020–22) → `SW-3`/`SW-5` Kubernetes + GitLab CI/CD, `SW-2` on-call and incidents (2023–now). ~10 yrs of role-time with real DevOps content; **0 yrs of DevOps-titled work except Vizrt** | Watch |
 | Q3 | Solid experience with major Linux distributions (CentOS, Ubuntu, RedHat); proficient scripting in Bash, Python or Groovy | Required | **Adjacent** (near-Direct) | Linux administration `production-historical-and-personal`: `BS-6` Bosch server estate, `PP-3` self-hosted Debian ~10 yrs and **current**. Python `production-current` = Direct. **Named distros are 0 canonical** — Debian→Ubuntu transfers almost exactly, RHEL/CentOS is the real delta. Bash not canonically listed; **Groovy 0 — do not claim** | — |
 | Q4 | Deep understanding of Linux virtualization (QEMU/KVM, Docker) and orchestrators like Kubernetes | Required | **Adjacent** | Docker `production-current-and-historical` = Direct. Kubernetes `production-current-and-historical` = Direct (`SW-3`, `SW-7`, `BS-1`). **QEMU/KVM 0 canonical** — the hypervisor half is a Gap; the container half is strong | — |
 | Q5a | Hands-on experience with configuration management tools (e.g., Ansible) | Required | **Direct** | `BS-6` — intensive Ansible for config management *and* infrastructure automation, plus **he wrote Ansible extensions** (credential plugin pulling from a keystore with local caching). Above-average depth. Caveat: `production-historical`, ended Dec 2022 | — |
 | **Q5b** | **"Strong expertise in on-premises networking and compute infrastructure"** | **Required** | **GAP** | **Networking: 0 canonical.** On-prem *compute* is partly real (`BS-6` Bosch server estate), but `PP-3` **explicitly forbids** using the home server as datacenter/physical-infrastructure evidence. No switches, no fabric, no network engineering anywhere in the record | **FAIL** |
 | Q6 | Familiarity with CI/CD tools such as Jenkins, GitHub/GitLab, Kubernetes, GitHub Actions; excellent written and verbal English | Required | **Direct** | Jenkins `FC-1`/`GN-1`/`BS-6`; GitLab `SW-3`/`SW-5`/`BS-6`; Kubernetes `SW-3`/`SW-7`. The list is illustrative ("such as"), so GitHub Actions at 0 does not gate. English fluent | — |
 **Required tally: 3 Direct · 3 Adjacent · 1 Gap.**
 ### Core responsibilities
 | # | Responsibility | Class | Canonical evidence |
 |---|---|---|---|
 | R1 | Design, build, maintain robust **HPC and cloud** infrastructure | **Adjacent (split)** | Cloud is Direct — AWS + CloudFormation `production-current`, `SW-1`/`SW-3`/`SW-7`. **HPC is 0 canonical** |
 | R2 | Automate deployment/config/management of network and compute — **bare metal servers, network switches, VMs** | **Adjacent → Gap on the objects** | The *automation* is Direct (`BS-6` Ansible). The *objects* are not: bare metal thin, **switches 0**, VMs 0 |
 | R3 | Develop and streamline **CI/CD pipelines for R&D engineering teams** | **DIRECT — strongest match in the JD** | `FC-1` Jenkins CI/CD at a **research institute**; `BS-6` playbooks from Jenkins/GitLab for fab analytics/ML teams; `VZ-2`; `GN-1`; `SW-3`/`SW-5`. Serving R&D/engineering teams specifically is his actual career shape |
 | R4 | Optimize for availability, performance, observability, security, scalability, cost; **integrate automated testing and QA into deployment workflows** | **Direct on the testing half; Adjacent on optimization** | `VZ-2` is literally "connected quality gates to CI/CD"; `GN-1` BDD + test-automation ownership. Observability `BS-4` (ELK/Kafka, **PoC-scoped — never call it a platform**). Security `SW-5` + `PP-3` hardening. **No metric is quotable — all `metrics: unverified`** |
 | R5 | Troubleshoot across infrastructure, networking, hardware, software | **Adjacent** | Infra/software Direct (`SW-2` Component Owner: incidents, on-call, data quality). **Networking and hardware: Gap** |
 ### Preferred — "Ways To Stand Out"
 | # | Item | Class | Note |
 |---|---|---|---|
 | P1 | Agile DevOps teams, complex technical environments; proven ability to achieve/exceed security, reliability, scalability, availability goals | **Adjacent** | Enterprise agile is real; `SW-2` on-call, `SW-5` security. But "proven ability to *achieve or exceed goals*" implies numbers and **every canonical claim is `metrics: unverified`** — the standing weakness in every package |
 | P2 | In-depth understanding of modern **HPC** and infrastructure architectures | **Gap** | HPC 0 canonical. The M.Eng. thesis has a throughput/latency evaluation but it is a **methods prototype** and the throughput figure is **explicitly barred** by `thesis_limits` |
 | P3 | Passion for emerging technologies and best practices | **Direct** | `PP-3` (10 yrs self-hosted, self-hardened), `PP-1`, current LLM tooling. Genuine and demonstrable |
 ### Constraints
 | Item | Status |
 |---|---|
 | Work authorization | **Direct** — German citizen (EU), Swiss B permit, no sponsorship needed |
 | Language | **Direct** — English fluent; JD requires English only |
 | Location / working model | **UNRESOLVED — must be asked.** Zurich seat; Thun→Zurich ~1h50 each way. JD silent on hybrid vs onsite |
 | Compensation | **Clears the bar** — see Company Context. Not the blocker |
 ## ATS Keywords
 - **Direct, safe to use:** DevOps, CI/CD, Jenkins, GitLab CI/CD, Kubernetes, Docker, Ansible,
  configuration management, Linux, infrastructure automation, Infrastructure as Code, Python, AWS,
  CloudFormation, containerization, automated testing, quality gates, observability, on-call,
  incident response, availability, security, agile, R&D engineering teams, English.
 - **Use only with honest scoping:** on-premises compute (Bosch server estate only), Debian/Ubuntu
  (Debian is the canonical one), hardening (personal-project evidence — always say so), monitoring
  (`BS-4` is a PoC).
 - **NEVER use — 0 canonical / forbidden:** HPC, GPU, CUDA, Slurm, InfiniBand, network switches,
  bare metal, datacenter, QEMU, KVM, hypervisor, RedHat, CentOS, Groovy, Terraform, GitOps,
  GitHub Actions, SRE (as a title), any uptime/SLA/server-count/scale figure.
 ## Gap Assessment
 1. **On-premises networking — the one required Gap.** Zero evidence, not substitutable from
   data-platform work. Do not paper over it; name it once, honestly, in the cover letter.
 2. **HPC — preferred, and the site's whole reason for existing.** Zurich is NVIDIA's HPC/AI
   infrastructure-software hub. This gap is more visible here than the "preferred" label suggests.
 3. **Bare metal, switches, VMs, QEMU/KVM** — the physical/virtualization layer is absent. `PP-3`
   forbids using the home server as physical-infrastructure evidence, and that ban must hold.
 4. **Recency split.** The two most JD-central employer skills — **Ansible and Linux administration** —
   ended at Bosch in **Dec 2022**. Currency is carried by `PP-3`, a personal server. Say so plainly.
 5. **No metrics anywhere.** P1 asks for goals achieved; nothing is quotable.
 6. **RHEL/CentOS.** Debian→Ubuntu is nearly free; the Red Hat family is a genuine unknown.
 ## Company Context
 - **What Zurich actually does.** NVIDIA's Zurich site is an **HPC and AI infrastructure-software R&D
  hub** — distributed training, real-time inference, and communication/networking optimization across
  large-scale systems (the site also posts Senior HPC & AI *Network* Software Architect and HPC & AI
  Software Architect roles). This role is the **infrastructure and CI/CD backbone underneath those R&D
  teams** — which is exactly what R3 says, and exactly the shape of his Fraunhofer and Bosch work.
 - **Swiss anchor.** NVIDIA + HPE + **CSCS** built **Alps**, the Grace Hopper–based supercomputer at
  Lugano that anchors the **Swiss AI Initiative** with ETH Zürich and EPFL, hydropower-cooled. A
  credible, verifiable local hook — and it explains why "on-premises" and "bare metal" are literal here.
 - **Compensation — the finding that changes the commute math.** levels.fyi Greater Zurich: **IC3
  median ≈ CHF 204k, IC4 ≈ CHF 379k**, and it names NVIDIA the highest-paying SWE employer in Zurich.
  Even the bottom rung clears the **180k all-in bar** decisively. ⚠ Caveat: levels.fyi is self-reported
  and these totals are **equity-heavy after an extraordinary NVDA run** — treat the *base* as the
  reliable part and confirm the split. But this is the first role in the log where comp is a reason to
  accept a long commute rather than a reason to decline.
 - **Culture signals from the JD:** "fast-paced", "distributed teams", "creative problem-solving",
  "collaborate closely with software development teams". Reads as a small, senior, hands-on site team.
 ## Competitive Read
 - **Obvious-fit candidate:** a Linux/HPC systems engineer from CSCS, ETH/EPFL, a Swiss hosting or
  colocation provider, or a hardware vendor — someone who has physically racked servers, configured
  switches, and run Slurm on a real cluster.
 - **Dennis's advantage:** a **decade-long, five-employer CI/CD and automation thread** that is deeper
  and broader than a pure sysadmin's; **Ansible depth beyond use** (he wrote extensions); current
  Kubernetes in production; and `BS-1` — integrating containerized ML inference into a **24/7
  semiconductor fab**, which is genuinely rare evidence of putting automation into an environment that
  cannot stop. Plus `SW-2` Component Owner accountability: on-call, incidents, data quality.
 - **Their advantage:** networking, bare metal, hypervisors, HPC schedulers, datacenter practice — the
  precise half he lacks, and it is named in both a required line and a responsibility.
 - **Level/scope:** NVIDIA "Senior" against his current **Staff** at Swisscom. By title that is
  lateral-to-below, but the NVIDIA bar is high and the comp is far above. Not a level problem; the
  `user_role_targeting_energy_trading` "no lateral same-tier moves" rule was about **comp/level
  upside**, and the comp upside here is unambiguous.
 ## Framing Strategy
 - **Professional identity:** *Staff-level engineer who builds and operates the CI/CD, container and
  configuration-automation layer that engineering and research teams depend on* — Kubernetes and
  GitLab CI/CD today, Ansible and Linux estate automation at Bosch, Jenkins pipelines at a Fraunhofer
  research institute. **Not** "infrastructure engineer" in the datacenter sense.
 - **Lead narrative:** *"I build the automation and delivery layer that R&D teams run on."* R3 is the
  bullseye and should lead.
 - **Strongest proof points (in order):** `BS-6` Linux estate + Ansible incl. extensions · `BS-1`
  containerized ML inference into a 24/7 fab · `SW-3` Kubernetes + GitLab CI/CD · `FC-1` Jenkins CI/CD
  for a research institute · `VZ-2` automated tests wired into quality gates · `SW-2` Component Owner
  on-call/incidents · `PP-3` current self-hosted Linux and hardening.
 - **Honest adjacent bridges:** Debian → Ubuntu (near-identical, defensible). Container virtualization →
  named alongside, never in place of, QEMU/KVM. On-prem *compute* via the Bosch estate — **never** via
  the home server.
 - **Explicit gaps to state, not hide:** on-premises **networking**; HPC; bare metal and switches.
 - **Scope Discipline watch (recurring error):** Bosch — "administered and automated **the Linux server
  estate underpinning fab analytics and ML workloads**", never "ran the fab's infrastructure" or "the
  datacenter". Swisscom — data products *within* the company-wide Data Mesh, never "built a Data Mesh".
  `BS-4` is a **PoC**, never "the observability platform".
 - **User directives:** none given beyond "let's try it".
 ## Critique Context
 - **Reviewer persona:** a hands-on senior infrastructure engineer at a small, elite site — someone who
  has run bare metal and will spot an inflated Linux or networking claim in one line. Not an HR screen.
 - **Domain vocabulary:** Ansible roles/playbooks/inventories, idempotence, CI runners, container
  registries, image builds, node pools, config drift, immutable infrastructure, artifact promotion.
 - **Screening risks to prep answers for, in likely order:**
  1. "Walk me through your on-prem networking experience." → **He has none. Say so.**
  2. "Where does the 10+ years come from?" → the 2015→now CI/CD thread, named role by role.
  3. "Which distros?" → Debian (personal, 10 yrs, current) + Bosch estate. RHEL/CentOS honestly unknown.
  4. "Ansible was three years ago — what's current?" → `PP-3` plus current Kubernetes/GitLab.
  5. "Any HPC?" → no. Pivot to 24/7 production constraints (`BS-1`), which is the transferable part.
 ## Resume Plan (provisional — Phase 1 confirms)
 - **Format:** 2-page **International Tech** resume, English.
 - **Contact line:** **Bern, Switzerland** (Zurich role — the Thun-local rule applies only to Thun-area employers).
 - **Summary:** 2–3 lines, DevOps/automation-forward. ⚠ **Do not inherit the template's "12+ years"** —
  it is unsupported (visible record from Generali 2015-05 ≈ 11y4m). Use "over ten years".
 - **Skills:** Linux, Ansible, Kubernetes, Docker, CI/CD (Jenkins, GitLab), Python, AWS/CloudFormation,
  observability/monitoring. **Omit** Terraform, GitOps, Azure, GCP, Groovy, HPC.
 - **Swisscom:** `SW-3`, `SW-2`, `SW-5`, and one of `SW-1`/`SW-7`.
 - **Bosch:** `BS-6` (lead — it is the closest thing in the record to this JD), `BS-1`, `BS-4`.
 - **Earlier:** Fraunhofer `FC-1` (Jenkins CI/CD for a research institute — thematically perfect),
  Vizrt `VZ-2` (quality gates into CI/CD), Generali `GN-1` optional.
 - **Projects:** consider a one-line `PP-3` entry — it is the **only current** Linux/hardening evidence,
  and it must be labelled a personal self-hosted project.
 - **Total bullets:** ~12–14.
 - **Capgemini:** OMIT (standing rule). The Nov 2014 – May 2015 gap is intentional.
 - **Impact evidence still needed:** everything — all canonical metrics are unverified.
 ## Cover Letter Decision
 - **YES** (provisional — confirm after the resume).
 - **Reason:** the networking gap needs one honest sentence that a resume cannot carry, and the
  "infrastructure for R&D teams" framing needs prose to land. Same pattern that worked for RUAG C5I.
 - **Information it adds beyond the resume:** why a data/platform engineer is applying for a DevOps
  infrastructure role; the Fraunhofer/Bosch "serving research and engineering teams" thread; the
  24/7-production constraint experience; one plain sentence naming the on-prem networking gap.
 - **Hook used (first-party, verified 2026-09-04):** NVIDIA's own live Zurich posting **JR2022878**
  (Senior HPC and AI Network Software Architect, posted the same week), scraped directly: the Zurich
  team is *"building the next generation of scalable AI infrastructure"* with emphasis on
  *"distributed training, real-time inference, and communication efficiency across large systems"*,
  alongside *"our distinguished team of researchers and engineers"*. This is the hook the letter uses.
 - **Hook DROPPED after verification -- Alps / Swiss AI Initiative.** The first-party NVIDIA newsroom
  release confirms Alps is HPE-built on Grace + HGX and operated by **CSCS, a unit of ETH Zurich, in
  Lugano** -- but it makes **no mention of EPFL or a "Swiss AI Initiative"**. That framing came from
  secondary coverage (HPCwire, Wikipedia) and is corrected here. Alps was left out of the letter
  anyway: it is about CSCS rather than NVIDIA's Zurich office, and `cl_reference.md` says to omit an
  unnecessary hook rather than spend a paragraph proving company familiarity.
 ## Phase 1 — Bullet Plan (proposed 2026-09-04)
 **Confirmed 2026-09-04:** bundle `bundle_data_platform.md` (Data Platform / Infra) · 2-page
 International Tech, English, Bern contact line · framing as stated in Framing Strategy · build now,
 working-model question asked in parallel, **nothing submitted until it is answered**.
 ### ⚠ Two KB findings that change the plan
 1. **`BS-6` and `PP-3` exist only in `claims.json`.** They were added 2026-08-27 and never propagated
   to `experience_bosch.md`, any bundle, or `skills_taxonomy.md`. So **`bundle_data_platform.md`'s
   Priority Matrix does not list BS-6 at all** — following the matrix mechanically would omit the
   single best-matching piece of evidence in the whole record for this JD. Bullets for both are
   written from canonical scope, which is the higher authority anyway.
 2. **Bundle scope violation found and fixed.** `bundle_data_platform.md` §S3 framed `BS-4` as
   *"Designed and delivered observability stack … full monitoring suite"* — a delivered-capability
   claim over what `claims.json` calls a **proof of concept**, whose `forbidden` list includes "built
   the observability platform". Same defect the 2026-08-21 log entry found in
   `bundle_data_engineer.md` §S5, which said to check the other four bundles. This was the one that
   had it. Fixed, with a scope warning added. The other three bundles are clean.
 ### Swisscom — Staff Data, Analytics & AI Engineer (Oct 2023 – present) · budget 4–5
 | | ID | Achievement | JD hook | Match |
 |---|---|---|---|---|
 | ★ | `SW-3` | **LEAD** — Python data applications on Kubernetes with GitLab CI/CD, agile DevOps team | Q4, Q6, R3 | **Direct** |
 | ★ | `SW-2` | Component Owner, business-critical Fulfillment ETL — availability, data quality, incidents, on-call | R4, R5, P1 | **Direct** |
 | ★ | `SW-5` | Security Champion 2025/26 + 100 h DevSecOps training | R4 "security", P1 | Direct (gate met: R4 and P1 both name security explicitly) |
 | ★ | `SW-1` | Migrated **his domains'** ETL to AWS (S3, Glue, Athena/Iceberg, Redshift, Airflow, **CloudFormation**) | R1 cloud half, IaC | Direct (scope-locked) |
 | o | `SW-7` | Governed data products in the company-wide Data Mesh | — | Available; weakest fit to a DevOps JD |
 | x | `SW-6` | PySpark | — | No JD hook |
 | x | `SW-4` | B2B data products and dashboards | — | No JD hook |
 | x | `SW-8` | LLM assistants | — | No JD hook — the JD has zero AI/ML content |
 ### Bosch — Senior Data Engineer, Data Analysis (Feb 2020 – Dec 2022) · budget 3–4
 | | ID | Achievement | JD hook | Match |
 |---|---|---|---|---|
 | ★★ | `BS-6` | **Administered and automated the Linux server estate** underpinning fab analytics/ML — ML platform hosts, Docker hosts, backend services; **intensive Ansible incl. a credential plugin he wrote**; Git-versioned playbooks executed from Jenkins/GitLab | **Q2, Q3, Q5a, R2** | **Direct — the closest bullet in the record to this JD.** Not in the bundle matrix; written from `claims.json` |
 | ★ | `BS-1` | Containerized ML inference (Docker, Kubernetes, Ansible) into **24/7 semiconductor production** | Q4, R1, P1 | **Direct** — and the "cannot stop" constraint is the transferable HPC-adjacent story |
 | ★ | `BS-4` | Anomaly-detection **PoC** on ELK + Kafka (Docker), Grafana/Prometheus/Loki monitoring | R4 observability | Direct, **PoC framing mandatory** |
 | ★ | `BS-3` | Application Owner — SLOs, vendor management, training, 24/7 reliability | R4, R5, level signal | Direct |
 | o | `BS-2` | Data services (Python/Java/C#) over Oracle and Hadoop/Impala | — | Available; data-flavoured |
 | x | `BS-5` | TIBCO Spotfire + TAF 2022 | — | No JD hook |
 ### Fraunhofer CML — Research Software Engineer (Sep 2018 – Oct 2019) · budget 0–1
 | | ID | Achievement | JD hook | Match |
 |---|---|---|---|---|
 | ★ | `FC-1` | **Independently established Jenkins CI/CD with quality gates** at a research institute | **R3 verbatim** — "CI/CD pipelines … for our R&D engineering teams" | **Direct.** Thematically the single best answer to R3 |
 | o | `FC-3` | Containerized microservices for the MISSION platform | Q4 | Available |
 | x | `FC-2` | ML/NLP components for ARTUS | — | No JD hook |
 ### Vizrt — Test Automation / DevOps Engineer (Jul 2017 – May 2018) · budget 0–1
 | | ID | Achievement | JD hook | Match |
 |---|---|---|---|---|
 | ★ | `VZ-2` | Automated A/V integration tests, **quality gates integrated into the CI/CD pipeline** | **R4 second half, near-verbatim** — "integrate automated testing and quality assurance into deployment workflows" | **Direct** |
 | o | `VZ-1` | Python/C++ distributed transcoding backend | — | Available; `feedback_cpp_emphasis` says do not oversell C++ |
 **Title note:** canonical `display_title` is **"Test Automation / DevOps Engineer"** (`official_title`
 is Test Automation Engineer). For RUAG the user asked to show DevOps alone. **Here I recommend keeping
 the full display title** — this JD requires exactly the test-automation-into-CI/CD skill, so the
 "Test Automation" half is an asset, not a liability. Flagging rather than deciding silently.
 ### Generali GDIS — IT Consultant (May 2015 – Jun 2017) · budget 0–1
 | | ID | Achievement | JD hook | Match |
 |---|---|---|---|---|
 | ★ | `GN-1` | Introduced and held technical ownership of BDD test automation; **Jenkins CI/CD administration**, training, knowledge transfer | Q2 — this is where the ten-year DevOps thread **starts**, and it is the answer to "where do 10+ years come from?" | Direct |
 | x | `GN-2` / `GN-3` | RPA PoCs; Java/J2EE workflow features | — | No JD hook |
 ### Projects · budget 0–1
 | | ID | Achievement | JD hook | Match |
 |---|---|---|---|---|
 | ★ | `PP-3` | Self-hosted Debian server, ~10 years — administers **and hardens** (nginx, mail, Nextcloud, VPN, Docker services, Bitwarden) | **Q3 currency** and R4 security | Direct **but personal — must be labelled a personal self-hosted project.** `forbidden`: enterprise/production/multi-user, any uptime or scale figure, and **never as datacenter or physical-infrastructure evidence** |
 | x | `PP-1` / `PP-2` | Trading platform, AI-for-Trading nanodegree | — | No JD hook |
 ### Totals
 - **Recommended set: 12 bullets** — Swisscom 4 · Bosch 4 · Fraunhofer 1 · Vizrt 1 · Generali 1 · Projects 1
 - **Budget:** `resume_reference.md` §4 allows Swisscom 4–5, Bosch 3–4, the three earlier roles 0–1 each,
  typical total **11–14**. **PASS.**
 - **Remaining slots:** up to 2. Best fillers if the page needs them, in order: `FC-3` (containerized
  microservices, adds Q4 depth), `BS-2` (language breadth), `SW-7`.
 - **Forced exclusions:** **Capgemini — omitted entirely** (standing rule; the Nov 2014 – May 2015 gap is
  intentional). `SW-8`, `PP-1`, `PP-2` excluded — the JD contains no AI/ML content at all, and
  including them would dilute a pure infrastructure pitch.
 - **Bundeswehr:** omit. `BW-1` earned its place at RUAG and Kdo Cy because those JDs named military
  service as an advantage. **This JD does not**, and `BW-1` forbids implying technical military work.
 - **Cadence watch (`resume_reference.md` §7a):** at most ~half the bullets may carry an "X, Y and Z"
  triple; no two consecutive bullets may open with the same verb. `SW-3` and `BS-1` both naturally want
  to open with a containerization verb — vary them.
 - **Impact evidence still needed:** none is available. Every canonical claim is `metrics: unverified`,
  and P1 asks for goals achieved. This is the known standing weakness and it cannot be fixed here.
 ## Output Files
 - JD: `output/NVIDIA_SrDevOps_Zurich/JD_nvidia_sr_devops_jr2024256.txt`
 - Session: `output/NVIDIA_SrDevOps_Zurich/session_nvidia_sr_devops.md`
 - Resume source: `output/NVIDIA_SrDevOps_Zurich/e2e_nvidia_sr_devops_resume.tex`
 - Resume PDF: `output/NVIDIA_SrDevOps_Zurich/e2e_nvidia_sr_devops_resume.pdf` (2 pages)
 - Cover letter source: `output/NVIDIA_SrDevOps_Zurich/e2e_nvidia_sr_devops_cover_letter.tex`
 - Cover letter PDF: `output/NVIDIA_SrDevOps_Zurich/e2e_nvidia_sr_devops_cover_letter.pdf` (1 page, 279 body words)
 - Critique: `output/NVIDIA_SrDevOps_Zurich/critique_nvidia_sr_devops.md`
 ## Critique Summary (2026-09-04)
 - **Evidence Fit:** 64/100, Stretch - unchanged; documents do not move fit
 - **Hard gate:** FAIL x2 - required networking Gap, and the working model **still unresolved**
 - **Document Quality:** **82/100** (truth 22/25, hierarchy 17/20, bullets 15/20, relevance 11/15,
  skills 8/10, mechanics 9/10). Both validators PASS, 0 boxes, 0 forbidden terms
 - **Channel:** Weak
 - **Tier 1 fixes (2) - BOTH APPLIED 2026-09-05, see Edit History:** (1) **`Ubuntu` is 0 canonical** - the skills line reads "Linux administration
  (Debian/Ubuntu)" but `PP-3` is Debian only; the Debian→Ubuntu transfer argument belongs in an
  interview answer, not a skills line. Change to `(Debian)`. (2) **Hardening must be marked
  personal-side** - `claims.json` says the evidence "leans on the personal side; say so", and the
  Operations line lists "security hardening" beside employer-only evidence with no marker
 - **Tier 2:** headline advertises undated Linux/Ansible currency (named in the CL, optionally reorder
  to lead with Kubernetes); JD term coverage 19/38 = 50% with four honest additions available
  (configuration management, reliability, observability, orchestration); summary says teams "work on"
  the delivery layer where it should read "rely on"
 - **Blocking action is not a document fix:** resolve hybrid vs onsite with NVIDIA recruiting first
 ## Edit History
 ### Edit 1 (2026-09-05): critique Tier 1 + selected Tier 2
 **Source:** `critique_nvidia_sr_devops.md` Tier 1 #1/#2 and Tier 2 #2/#3, user-confirmed.
 **Scope:** Summary and Skills only. **No bullet was touched**, so the budget stayed at 13 and the
 cadence check could not regress.
 | # | Change | Class | Why |
 |---|---|---|---|
 | 1 | `Linux administration (Debian/Ubuntu)` -> `(Debian)` | MODIFY | **Tier 1.** Ubuntu is 0 canonical; `PP-3` is a Debian server. The Debian->Ubuntu transfer argument is an interview answer, not a skills-line claim |
 | 2 | `security hardening` -> `security hardening (personal server)`, moved after a semicolon | MODIFY | **Tier 1.** `claims.json` instructs that hardening evidence "leans on the personal side; say so" |
 | 3 | `Ansible including custom plugins` -> `Ansible configuration management including custom plugins` | MODIFY | Q5a's exact phrase; `BS-6` says "configuration management and infrastructure automation" verbatim |
 | 4 | `Kubernetes, Docker` -> `Kubernetes container orchestration, Docker` | MODIFY | JD says "orchestrators like Kubernetes"; keeps `BS-1`'s bullet verb intact |
 | 5 | `SLO definition` -> `SLO definition and service reliability`; `Monitoring` -> `Monitoring and observability` | MODIFY | "reliability" is the JD's second named focus (`SW-2`, `BS-3`); "observability" itself is not forbidden, only "observability platform" |
 | 6 | Summary `teams work on` -> `teams rely on` | MODIFY | Teams ship *through* the delivery layer, not *on* it. Wording defect in the most-read sentence |
 **Deliberately NOT applied — Tier 2 #1, headline reorder.** It is a positioning call for the user, and
 `\headline` sits in the header block, which `config.md` lists as a FIXED section. The recency concern
 it addresses is already stated explicitly in the cover letter.
 **Deliberately NOT added:** HPC, bare metal, VMs, QEMU/KVM, virtualization, Groovy, GitHub. These are
 the genuine gaps; adding them for ATS would be fabrication.
 | Metric | Before | After | Delta |
 |---|---|---|---|
 | Page count | 2 | 2 | 0 |
 | Over/underfull boxes | 0 | 0 | 0 |
 | Validator warnings | 0 | 0 | 0 |
 | Bullets | 13 | 13 | 0 |
 | JD term coverage (rendered text only) | 17/38 (45%) | **21/38 (55%)** | **+4** |
 | Tier 1 findings open | 2 | **0** | **-2** |
 | Page-1 white space | ~15% | ~12% | slightly better (skills grew one line) |
 **Measurement correction:** the coverage figures first reported (50% -> 61%) were counted over the raw
 `.tex` including LaTeX comments, and the provenance comments in this file contain terms like
 "configuration management", "observability" and "Ubuntu". Recomputed over rendered text only, the true
 figures are **45% -> 55%**. The +4 delta is unchanged; the baseline was inflated.
 Nothing worsened. Rendered PDF re-inspected: no "Ubuntu" anywhere in the output, all six changes
 present, page break and position integrity unchanged.
 ### Edit 2 (2026-09-05): Bash added after user confirmation
 **Source:** user confirmation, closing the open KB question raised at the end of Phase 2.
 - **`claims.json`: new skill `Bash / shell scripting`**, `production-historical-and-personal-current`,
  `output: allowed`. Evidence basis mirrors Linux administration - professional at Bosch 2020-2022
  (`BS-6`, Linux estate and the Ansible control path) and personal/current on the `PP-3` Debian server.
  The note explicitly records that it does **not** license Groovy (still unverified and forbidden) and
  does **not** license systems-programming or kernel-level claims.
 - **Resume:** Languages line now reads `Python, Bash, SQL`.
 - **This is the third canonical gap of exactly this shape**, after Ansible and Linux administration
  (both 2026-08-27) - a real, currently relevant skill that was simply unrecorded, and therefore
  unwritable under the evidence-first rule.
 - Verification: `claims.json` valid, system validator PASS, document validator PASS, 2 pages, 0 boxes,
  13 bullets unchanged. JD term coverage **55% -> 58%** (rendered text only). `groovy` confirmed absent
  from both documents.
 ## SUBMITTED 2026-09-05
 User submitted the application. Recorded in `application_cohort.json` (record now 7 entries) and in the
 scout decision log as `applied`.
 **Carried into screening, unresolved by choice:** hybrid vs 5-day onsite was **never answered before
 sending**, so it is now a live screening topic rather than a pre-cleared one - the same pattern as
 RUAG's compensation and PSP eligibility. Thun-Zuerich is ~1h50 each way, so a 5-day-onsite answer is
 the main disqualifier to watch for. Comp is not a risk: levels.fyi Greater Zuerich IC3 median
 ~CHF 204k, IC4 ~CHF 379k.
 **Channel: Weak - the 7th consecutive cold submit.** Under the new channel rule
 (`application_strategy.md`, 2026-09-05) this posting published no named contact, so cold was the only
 option available here.
 ## Finalization (2026-09-05) - build record
 Ran `shared_ops.md` -> Finalization steps **1-4 only**. Steps 5 and 6 were deliberately **NOT** run:
 - **Step 5 (record submission date) - NOT DONE.** There is no submission date. The application is
  blocked on the working-model question.
 - **Step 6 (`cohort_tracker.py add`) - NOT DONE, and this is the important one.** Adding it would
  consume a cohort slot for an application that may still become a documented NO-GO, and **there is no
  free slot of the right class anyway** (6/10; Adjacent 2/2 and Stretch 1/1 both consumed; verified
  read-only via `cohort_tracker.py summary`). Precedent: the Citadel entry in `CLAUDE.md` records
  "Cohort entry and decision-log entry deliberately NOT written - no confirmed send date."
  **Add to the cohort only after it is actually sent.**
 | Check | Result |
 |---|---|
 | Session file | present |
 | Resume `.tex` + `.pdf` | present, 2 pages, 0 boxes |
 | Cover letter `.tex` + `.pdf` | present, 1 page, 0 boxes (Cover Letter Decision: YES) |
 | Critique | present (STALE BY DESIGN - its own findings were applied) |
 | Canonical system validator | PASS, 0 warnings |
 | Document validator - resume | PASS, 0 warnings |
 | Document validator - cover letter | PASS, 0 warnings |
 | Submission PDFs | `Dennis_Thiessen_Resume.pdf`, `Dennis_Thiessen_Cover_Letter.pdf` - **MD5-verified identical to source** |
 | Letter date | Recompiled; now reads **5 September 2026** |
 | Scout decision log | recorded as **`paused`**, not `applied` - keeps it out of re-triage without implying a submission |
 **⚠ Staleness warning, per `config.md` Output Rules.** The submission-named PDFs are copies, not build
 targets, and the letter carries `	oday`. **If this is sent on any day after 2026-09-05, recompile the
 cover letter and refresh both submission copies first** - otherwise the letter goes out with a stale
 date under exactly the filename that gets attached.
 ## Status
 - **Fit gate:** DONE — Evidence Fit 64/100, Stretch, hard gate FAIL ×2, proceeding on user override
 - **Phase 0:** DONE
 - **Phase 1:** DONE - confirmed 2026-09-04; 13 bullets after adding SW-7 for page-1 balance, budget PASS
 - **Resume:** DONE - 2 pages, 13 bullets, validator PASS 0 warnings, 0 over/underfull boxes, text order verified, both pages visually inspected
 - **Cover letter:** DONE -- 1 page, 279 body words, validator PASS 0 warnings, 0 boxes, hooks first-party verified, package cohesion checked
 - **Critique:** **STALE BY DESIGN** (was CURRENT 2026-09-04; Edit 1 on 2026-09-05 applied its own findings) - measured Document Quality was **82/100** pre-edit with 2 Tier 1 findings; **both are now closed** and term coverage rose 50%->61%, so the document is better than 82 but that number is **not re-measured - never quote a post-edit estimate as a score**. Evidence Fit 64 and hard gate FAIL x2 are unchanged: documents do not move fit
 - **Next:** `/critique output/NVIDIA_SrDevOps_Zurich/session_nvidia_sr_devops.md` — and **resolve the hybrid/onsite question before anything is submitted**
 ## Generation notes (2026-09-04)
 - **Bosch bullet swap vs the Phase 1 table:** `BS-3` (Application Owner) dropped in favour of splitting
  `BS-6` into two bullets — the Linux estate, and the custom Ansible credential plugin. The plugin is
  the most distinctive automation evidence in the record for this JD, and `BS-3`'s ownership signal is
  already carried by `SW-2` Component Owner. Bosch stays at 4, within the 3–4 budget.
 - **`SW-7` added as a 5th Swisscom bullet** (budget allows 4–5) to close page-1 white space with real
  evidence rather than padding.
 - **Forced page break kept.** Letting LaTeX flow naturally filled page 1 but split the Bosch position
  across pages with no continuation header — an information-hierarchy cost worse than white space.
  Tested both, reverted. Roughly 15% white space remains at the foot of page 1 and ~25% on page 2;
  `resume_reference.md` §4 explicitly permits this ("a strong shorter resume is better than a full page
  padded with weak evidence") and `critical_rules.md` §7 sets no page-fill quota.
 - **Cadence.** First build tripped the §7a warning at **10/12 bullets (83%)** — the SBB failure mode.
  Five bullets were reshaped (sentences only, no claim, scope or verb changed) and the validator now
  passes clean.
 - **Two template-inherited defects caught at final review**, the same class as the "12+ years" line:
  (a) `PP-3` carried a `2015 -- Present` header date, but `claims.json` records only a **self-reported
  "~10 years"** — a precise start year asserts more than the KB supports. Header date replaced with
  `Ongoing`; the bullet keeps the approximation. (b) The Education block carried **`grade 1.0`** from
  the template. `claims.json` `grade_output_rule` permits the thesis grade *"only where academic
  performance is genuinely valued"* — a 10+-years hands-on infrastructure role is not that. Removed;
  the thesis title stays.
 - **Carry into `/make-cl`: the recency split needs one sentence.** The headline leads with
  "Linux, Ansible & Kubernetes" and the summary says "Ansible-driven Linux server automation", both
  undated, while the employer evidence for both sits under **Feb 2020 – Dec 2022** and the only
  *current* Linux evidence is a personal project at the foot of page 2. The bullets are correctly
  dated so nothing is false, but the infra-engineer reviewer persona will form an expectation from the
  headline and find it three years stale. The CL plan already names the networking gap; **it must name
  this too.**
 - **Headline flag, not a fix.** The headline reads **"Staff Engineer"**, not his canonical
  **"Staff Data, Analytics & AI Engineer"**. Defensible — the Swisscom header carries the formal title
  two inches below, and a headline is positioning rather than a title claim — but it is the same shape
  as the Vizrt title decision, so it is flagged rather than silently propagated.
 - **Open KB question — Bash.** `claims.json` has no entry for shell scripting, so it is **not listed**
  in Skills even though the JD names it ("Bash, Python or Groovy") and ten years of Debian
  administration plus Ansible work plainly involve it. Same shape as the Ansible and Linux gaps found
  2026-08-27: probably true, simply unrecorded. **Worth confirming with the user and adding.** Groovy
  stays out regardless — there is no evidence for it.
@@ -40,7 +40,15 @@
 - "AWS IaC (CloudFormation)" — infrastructure-as-code signal
 - "AWS migration" — hands-on cloud platform experience
 - Security Champion is not a default positioning theme; use the 2025/2026 team role only when the JD explicitly requires security exposure
- "ELK + Grafana + Prometheus observability stack"
+- "ELK + Grafana + Prometheus monitoring" — **never** "delivered/built the observability stack" or
  "full monitoring suite": `claims.json` BS-4 is a **proof of concept** and forbids "built the
  observability platform" / "enterprise observability platform". Carry the PoC scope into any wording.
 > **Scope warning (corrected 2026-09-04).** The S3 row for BS-4 previously read "*Designed and
 > delivered observability stack … full monitoring suite for manufacturing infrastructure*" and was
 > labelled "Full observability stack implementation" — a delivered-capability claim over a PoC, and the
 > same defect the 2026-08-21 log entry found in `bundle_data_engineer.md` §S5. That entry said to check
 > the other four bundles; this is the one that had it. See CLAUDE.md → Scope Discipline.
 **Tone:** Infrastructure-minded engineer who thinks about reliability, observability, and security — not just data throughput. Platform thinking embedded in data work.
@@ -59,7 +67,7 @@
 | SW-1 | AWS migration | "Migrated pipelines in his owned domains from legacy Teradata/Oracle processing onto Swisscom's AWS platform (Glue, Athena/Iceberg, Redshift, Airflow, CloudFormation)" | Scoped migration delivery plus AWS breadth |
 | SW-2 | Component Owner | "Owned Fulfillment ETL pipelines (Oracle/Kafka → Teradata) — platform reliability, Data Governance compliance, 2nd/3rd-level support and on-call duty" | Platform SLA + on-call = reliability engineer signal |
 | BS-1 | ML inference | "Containerized and orchestrated ML inference (Docker, K8s, Ansible) into 24/7 semiconductor production — zero-downtime constrained deployment" | Production-grade containerization under hardest constraints |
-| BS-4 | ELK PoC | "Designed and delivered observability stack: ELK + Kafka, Grafana dashboards, Prometheus metrics, Loki log aggregation — full monitoring suite for manufacturing infrastructure" | Full observability stack implementation |
+| BS-4 | ELK PoC | "Built an anomaly-detection **proof of concept** on ELK + Kafka (Docker) with Grafana, Prometheus and Loki monitoring, validating centralized logging and alerting for 24/7 semiconductor production" | PoC-scoped observability breadth — **the PoC framing is mandatory, not optional** |
 | SW-5 | Security Champion | "2025/2026 team Security Champion; include only if the JD explicitly requires security or DevSecOps exposure" | Secondary team-role evidence, not ownership or certification |
 | BS-2 | Data services | "Built multi-language data services (Python/Java/C#) over OracleDB and Hadoop/ImpalaSQL — platform-layer data access for semiconductor analysis teams" | Enterprise DB + Hadoop infrastructure |
 | BS-3 | App Owner | "Application Owner for semiconductor analytics platform — SLOs, reliability, vendor management, on-call coverage" | Platform SLA ownership |
@@ -563,6 +563,12 @@
      "output": "allowed",
      "note": "User-confirmed 2026-08-27 and previously ABSENT from claims.json entirely. Professional: at Bosch (2020-2022) Linux servers carried everything - ML platform, Docker hosts, backend services, Ansible control - and he administered and automated them (see BS-6). Personal and current: a self-hosted Debian server he has run and hardened for ~10 years (see PP-3). Hardening and security configuration evidence leans on the personal side; say so rather than implying an employer mandate. Does NOT license claiming datacenter/physical infrastructure work, which remains a genuine gap."
    },
    {
      "name": "Bash / shell scripting",
      "evidence": "production-historical-and-personal-current",
      "output": "allowed",
      "note": "User-confirmed 2026-09-05 and previously ABSENT from claims.json entirely - the third gap of this shape after Ansible and Linux administration (both 2026-08-27). Evidence basis is the same as Linux administration: professional at Bosch 2020-2022 administering and automating the Linux server estate and the Ansible control path (BS-6), and personal and current on the self-hosted Debian server run for ~10 years (PP-3). Scope is ordinary operational shell work - scripting, automation glue and system administration. Does NOT license Groovy, which stays unverified and forbidden, and does NOT license any claim of systems-programming or kernel-level work."
    },
    {
      "name": "Docker",
      "evidence": "production-current-and-historical",
@@ -24,11 +24,12 @@ def save(data: dict) -> None:
 def summary(data: dict) -> None:
    applications = data["applications"]
-    print(f"Cohort: {data['cohort_id']} ({len(applications)}/10 applications)")
+    # Slot caps were dropped 2026-09-05 (application_strategy.md). This is a record, not a
    # budget: report counts, never counts-against-a-target, so nothing reads as a remaining slot.
    print(f"Application record: {data['cohort_id']} ({len(applications)} applications)")
    for fit_class in FIT_CLASSES:
        count = sum(item["fit_class"] == fit_class for item in applications)
-        target = data["target_mix"][fit_class]
+        print(f"  {fit_class}: {count}")
        print(f"  {fit_class}: {count}/{target}")
    for channel in CHANNELS:
        count = sum(item["channel"] == channel for item in applications)
        print(f"  channel {channel}: {count}")
@@ -27,19 +27,56 @@ Before generating a resume, complete Evidence Fit from `critique_framework.md`.
 Do not spend a full resume/cover-letter cycle on a no-go role. Record the decision and move on.
-## Controlled Ten-Application Cohort
+## Application Record (no quotas)
-The next diagnostic cohort uses:
+**Policy change, 2026-09-05, user decision: the 7 Core / 2 Adjacent / 1 Stretch caps are DROPPED.**
- 7 Core applications.
+The caps were arbitrary -- no derivation existed for those numbers -- and they were routed around
- 2 Adjacent applications.
+whenever they bound (RUAG AI Engineer went in at Evidence Fit 74 with a hard-gate FAIL; Citadel was
- 1 Stretch application maximum.
+recorded Adjacent when the strict reading said Stretch). A rule that is overridden whenever it binds
 governs nothing and only adds friction.
-Track fit class, hard gates, channel, application date, stage and outcome. Evaluate the cohort only after ten applications or a meaningful screen/interview result; do not infer profile quality from a few high-variance FAANG outcomes.
+The cohort was also a confounded experiment. It was designed to test **fit class**, but the variable
 it silently held constant was **channel**: all six applications were Weak/cold. It therefore could not
 distinguish "Stretch does not convert" from "cold does not convert", and the results point away from
 fit class anyway -- the highest-scoring package in the log (Snowflake, ~86) drew no reply in 80 days,
 while the one interview (SBB) came from a cold Core submit whose resume was *missing* the three ATS
 literals the session had flagged as risky.
 **What is kept: the recording, not the rationing.** Every application still records fit class, hard
 gate, channel, date, stage and outcome. That record is what makes patterns visible instead of
 re-derived, and it produced every useful finding to date. `application_cohort.json` continues as a
 durable log; `cohort_tracker.py summary` remains a read-only view. There is no slot to consume and no
 application is blocked for lack of one.
 **Fit class is now a preparation signal, not a spend limit.** An Evidence Fit of 64 does not mean
 "do not apply" -- it means know which two questions you will be asked and have honest answers ready.
 Hard gates and NO-GO triggers are unchanged: a required Gap or an unresolved practical constraint is
 still a real finding that must be surfaced before the user decides.
 ### Real constraints that survive independently of any quota
 These are not cohort discipline and must not be dropped with it:
 - **Google: 3 applications per rolling 30 days**, and a 90-day wait before reapplying to the *same*
  role. An external, enforced limit.
 - **Do not stack a second cold application on one organisation while the first is pending** -- a
  judgment call, made deliberately before (Snowflake Metrics was paused for exactly this).
 - **Each package costs real hours.** Volume is limited by effort, not by policy.
 ## Channel Strategy
-For every Core application, attempt at least one warm action before or immediately after applying:
+**Channel is the rationed variable, replacing the old slot budget** (2026-09-05). It is the constraint
 with a plausible effect and an untested one: the record stands at **six consecutive cold submits, one
 interview**, with zero Strong or Moderate channels ever attempted.
 **Rule: no application goes out cold when a named contact is published and reachable.**
 This has been available and unused repeatedly -- Marco Heinzen at RUAG (published direct line), Andri
 Wienandts at SBB (published number, and it still converted), Per Olav Marthinsen at Aker BP. Making
 contact costs one phone call or one short email and is the cheapest experiment left.
 For every application, attempt at least one warm action before or immediately after applying:
 - credible internal referral;
 - targeted note to a relevant recruiter;
@@ -47,6 +84,7 @@ For every Core application, attempt at least one warm action before or immediate
 - former colleague/customer/vendor connection who can establish work quality.
 Record the channel as Strong, Moderate or Weak. Tailoring alone does not upgrade a cold channel.
 When no contact is published anywhere, a cold submit is fine -- record it as Weak and move on.
 ## Resume Strategy
@@ -63,10 +101,10 @@ Apply the decision gate in `cl_reference.md`. A letter is not a default package
 ## Feedback Loop
-After the ten-application cohort, compare:
+Review the record whenever a meaningful screen or interview result lands, and compare:
 - Warm vs cold progression -- **the primary question now, and still unanswered.**
 - Core vs Adjacent/Stretch progression.
 - Warm vs cold progression.
 - Recruiter rejection vs hiring-manager rejection.
 - Tool/domain patterns among successful and unsuccessful roles.
 - Whether resume changes affected outcomes.
@@ -18,7 +18,7 @@ Every JD gets `output/<Folder>/session_<name>.md`.
 - Hard gate: PASS / FAIL — [reason]
 - Channel Strength: Strong / Moderate / Weak
 - Channel plan: [referral/recruiter/hiring-team/cold]
- Cohort slot: Core [n]/7, Adjacent [n]/2, Stretch [n]/1
+- Named contact published? YES/NO -- [who, and whether contacted]  (no slot quotas; see application_strategy.md)
 - Decision: PROCEED / HOLD / NO-GO
 ## Requirements
@@ -28,7 +28,7 @@ Read `resume_builder/reference/application_strategy.md` and `critique_framework.
 - Core: proceed.
 - Adjacent: proceed selectively and state the serious gap.
- Stretch: confirm cohort capacity and user intent before full generation.
+- Stretch: confirm user intent before full generation and state the gap plainly. There is no cohort capacity to check -- the slot caps were dropped 2026-09-05 (`application_strategy.md`).
 - No-go: record the decision; do not generate a package unless the user explicitly overrides after seeing the gate.
 ## Audience and Cover-Letter Decisions
@@ -6,6 +6,13 @@
 \usepackage[utf8]{inputenc}
 \usepackage[T1]{fontenc}
 \usepackage{lmodern}
 % LANGUAGE — this template is English and relies on TeX's default (English) hyphenation.
 % For a GERMAN package you MUST add babel, or words break with English patterns
 % (`Hal-bleiterfertigung`, `automa-tisierte`) — a native reader notices, and no overfull
 % box warns you. See the 2026-08-27 KB Corrections Log entry.
 %   \usepackage[ngerman]{babel}
 %   \hyphenation{Trans-krip-ti-on}   % ngerman still breaks this one wrongly
 % Then check the breaks in the compiled PDF — a clean box count proves nothing here.
 \usepackage[a4paper,left=0.65in,right=0.65in,top=0.55in,bottom=0.55in]{geometry}
 \usepackage{xcolor}
 \usepackage{hyperref}