fix(F07): propagate recorded corrections into active writing sources

The review's key point is that the error ran BOTH ways.

Overstatement, narrowed to canonical scope:
- BS-1 variants claimed "eliminated manual wafer inspection", "no manual
  intervention" and "unattended quality monitoring". Canonical BS-1 supports a
  qualitative reduction whose size is unverified. Reworded; the scope limit is
  now stated inline where the variants are written.
- bundle_data_platform called BS-1 a "zero-downtime constrained deployment".
  Integration into a fab that runs continuously is not a measured zero-downtime
  property.
- experience_swisscom carried "grounded retrieval" as a skill and ATS keyword
  while SW-8 records retrieval implementation as explicitly unknown, and its
  reframing note invited "evaluation discipline" although formal model
  evaluation is a globally forbidden pattern. Both removed.
- PyTorch sat in bundle_ml_ai_engineer as a bold tool and an ATS must-include
  with no certification context - the exact way the context gets lost.

Undervaluation, the half that quietly costs him roles:
- BS-6 (Linux administration, intensive Ansible incl. self-written extensions)
  has been canonical since 2026-08-27 but appeared in NO bundle, so the normal
  selection paths could not see it. Added to the data-platform and data-engineer
  bundles with its currency limit (employer-side ended Dec 2022; PP-3 is
  personal) and the standing GitOps prohibition.
- Linux, Ansible and Bash were missing from skills_taxonomy entirely.
- skills_taxonomy still said the IBM certification year was "not recorded" and
  that PyTorch needed verification; both were settled on 2026-08-27.

Not rewritten, deliberately: the NVIDIA and RUAG cover letters state the
production line could not be stopped. That exceeds the canonical record but is
plausible and both are already submitted. Recorded as an OPEN ITEM in
experience_bosch.md to be confirmed with the user before any reuse.

Validator PASS, 31/31 tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qej5SBvhcbGXHwLqNWiskM

resume_builder/bundles/bundle_data_engineer.md

@@ -122,3 +122,13 @@ Python, Kafka, AWS (S3 · Glue · Athena · Redshift · Airflow · CloudFormatio
 - Listing all tools in paragraph form
 - Mentioning Bundeswehr unless specifically relevant (leadership angle for management-adjacent roles)
 - Overplaying test automation background
+
+## Infrastructure and Linux operations (BS-6) — added 2026-09-11, review F07
+
+BS-6 was absent from every bundle although it has been canonical since 2026-08-27, so genuine strengths never reached the selection paths.
+
+- **Linux administration and automation at Bosch (2020–2022):** Linux servers carried the ML platform, Docker hosts, backend services and the Ansible control path.
+- **Ansible beyond a single project:** configuration management and infrastructure automation, including self-written extensions (a credential plugin with local caching).
+- **Use it when** the JD names Linux, Ansible, configuration management, IaC or platform operations — exactly the DevOps/SRE-flavoured reqs where this profile reads thin without it.
+- **Currency limit, always state it:** employer-side Linux/Ansible ended Dec 2022; `PP-3` carries the current half and is a **personal** self-hosted Debian server. Never present PP-3 as employer work or as physical-datacenter evidence.
+- **GitOps remains forbidden:** playbooks lived in Git but ran push-based from Jenkins/GitLab with no reconciliation agent. The substance is writable as “version-controlled infrastructure automation with Ansible from Git, executed through Jenkins/GitLab pipelines”.

resume_builder/bundles/bundle_data_platform.md

@@ -66,9 +66,10 @@
 | SW-3 | K8s + GitLab | **Lead bullet** — "Deployed and operated Python data applications on Kubernetes with GitLab CI/CD; drove infrastructure automation in agile DevOps team" | K8s + CI/CD ownership = core platform signal |
 | SW-1 | AWS migration | "Migrated pipelines in his owned domains from legacy Teradata/Oracle processing onto Swisscom's AWS platform (Glue, Athena/Iceberg, Redshift, Airflow, CloudFormation)" | Scoped migration delivery plus AWS breadth |
 | SW-2 | Component Owner | "Owned Fulfillment ETL pipelines (Oracle/Kafka → Teradata) — platform reliability, Data Governance compliance, 2nd/3rd-level support and on-call duty" | Platform SLA + on-call = reliability engineer signal |
-| BS-1 | ML inference | "Containerized and orchestrated ML inference (Docker, K8s, Ansible) into 24/7 semiconductor production — zero-downtime constrained deployment" | Production-grade containerization under hardest constraints |
+| BS-1 | ML inference | "Containerized and orchestrated ML inference (Docker, K8s, Ansible) into a continuously operating 24/7 semiconductor production environment" | Production-grade containerization in an environment that cannot be paused. **Do not write *zero-downtime*** — canonical BS-1 evidences integration into continuous production, not a measured zero-downtime deployment property |
 | BS-4 | ELK PoC | "Built an anomaly-detection **proof of concept** on ELK + Kafka (Docker) with Grafana, Prometheus and Loki monitoring, validating centralized logging and alerting for 24/7 semiconductor production" | PoC-scoped observability breadth — **the PoC framing is mandatory, not optional** |
 | SW-5 | Security Champion | "2025/2026 team Security Champion; include only if the JD explicitly requires security or DevSecOps exposure" | Secondary team-role evidence, not ownership or certification |
+| BS-6 | Linux/Ansible | "Administered and automated Linux servers carrying the ML platform, Docker hosts and backend services at Bosch; wrote Ansible extensions including a credential plugin with local caching" | **Infrastructure-as-Code and Linux operations evidence.** Added 2026-09-11 (review F07): BS-6 existed in `claims.json` and `experience_bosch.md` since 2026-08-27 but appeared in NO bundle, so the selection paths could not see it. Currency limit: employer-side Linux/Ansible ended Dec 2022; `PP-3` (personal Debian server) carries the current half and must be named as personal. GitOps stays forbidden — execution was push-based from Jenkins/GitLab, not agent-reconciled |
 | BS-2 | Data services | "Built multi-language data services (Python/Java/C#) over OracleDB and Hadoop/ImpalaSQL — platform-layer data access for semiconductor analysis teams" | Enterprise DB + Hadoop infrastructure |
 | BS-3 | App Owner | "Application Owner for semiconductor analytics platform — SLOs, reliability, vendor management, on-call coverage" | Platform SLA ownership |
 | FC-1 | CI/CD initiative | "Independently introduced Jenkins CI/CD pipeline with quality gates at Fraunhofer CML — first build automation adopted by the research team" | Initiative: built CI/CD from zero |

resume_builder/bundles/bundle_ml_ai_engineer.md

@@ -71,14 +71,16 @@
 ## S4: Skills Guide
 
 **Bold tools (resume Technical Skills section):**
-Python, Kubernetes, Docker, AWS (S3 · Glue · Athena · Airflow), Kafka, PyTorch · Scikit-learn
+Python, Kubernetes, Docker, AWS (S3 · Glue · Athena · Airflow), Kafka, Scikit-learn
+*(PyTorch and TensorFlow/Keras are **certification-context-only** in `claims.json` — list them only beside the IBM AI Engineering certificate, never as production tooling.)*
 
 **Must-include skills (ATS match):**
 - Python, MLOps, ML inference deployment
 - Docker, Kubernetes, Ansible
 - AWS (S3, Glue, Athena, Redshift, Airflow), Apache Iceberg
 - Apache Kafka
-- PyTorch, Scikit-learn, Pandas, NumPy
+- Scikit-learn, Pandas, NumPy
+- PyTorch / TensorFlow **only with certification context** — see the note above; a bare ATS listing is the exact way the context gets lost
 - CI/CD (GitLab, Jenkins)
 
 **Nice-to-have (include if JD mentions):**

resume_builder/experience/experience_bosch.md

@@ -26,7 +26,7 @@ Dennis worked across multiple data domains within the fab — these are domain s
 
 This domain expertise is rare in data engineering candidates and is a strong differentiator for semiconductor company JDs (ASML, Infineon, TSMC, GlobalFoundries, etc.). Flag this domain when targeting semi roles.
 
-**CL framing:** "At Bosch Semiconductor in Dresden, I worked at the intersection of data engineering and semiconductor manufacturing analytics — owning the data pipelines and applications that drove defect management, parameter testing analysis, and process optimization across 300mm wafer production. My most impactful project was containerizing ML inference for automated image-based defect classification, turning a manual quality inspection process into a fully automated, 24/7 production system."
+**CL framing:** "At Bosch Semiconductor in Dresden, I worked at the intersection of data engineering and semiconductor manufacturing analytics — owning the data pipelines and applications that drove defect management, parameter testing analysis, and process optimization across 300mm wafer production. My most impactful project was containerizing ML inference for automated image-based defect classification, substantially reducing a manual quality-inspection workload in a 24/7 production environment."  *(Do not write “fully automated” or “eliminated”: canonical BS-1 supports a qualitative reduction in manual classification, exact amount unverified.)*
 
 ---
 
@@ -36,11 +36,20 @@ This domain expertise is rare in data engineering candidates and is a strong dif
 **User's role:** Primary developer / strategy owner ("Erarbeitung und Durchführung" = designed AND executed)
 **Status:** Deployed to production
 
-**Context:** 300mm semiconductor fab runs continuously. Manual image classification for wafer defect detection created a bottleneck for line engineers in the Defect Management domain. Dennis designed and implemented the strategy to containerize and orchestrate ML inference into the live production pipeline — enabling fully automated defect classification with no manual intervention.
+> **OPEN ITEM — confirm before reusing (review F07, 2026-09-11).** The NVIDIA and RUAG cover
+> letters state that the production line could not be stopped for a deployment. That is a
+> *stronger* claim than the canonical record, which establishes a continuously operating 24/7 fab
+> but not a no-stop deployment constraint. **It is not declared false** — it is plausible and may
+> well be accurate. Both documents are already submitted and are NOT rewritten (F17: archives are
+> preserved). **Before any new package repeats this framing, ask the user to confirm it and record
+> the answer in `claims.json`.** Until then write the constraint as "integrated into a continuously
+> operating production environment".
+
+**Context:** 300mm semiconductor fab runs continuously. Manual image classification for wafer defect detection created a bottleneck for line engineers in the Defect Management domain. Dennis designed and implemented the strategy to containerize and orchestrate ML inference into the live production pipeline, automating image-based defect classification and substantially reducing manual inspection work. **Scope limit (canonical BS-1):** the reduction is source-backed but its size is unverified — do not claim elimination, “no manual intervention” or unattended operation, and never claim model development.
 
 **Bullet variants:**
-- **2L:** Containerized and orchestrated ML inference (Docker, Kubernetes, Ansible) into 24/7 semiconductor production pipelines, enabling fully automated image-based defect classification and significantly reducing manual inspection workload for line engineers.
+- **2L:** Containerized and orchestrated ML inference (Docker, Kubernetes, Ansible) into 24/7 semiconductor production pipelines, automating image-based defect classification and reducing manual inspection workload for line engineers.
-- **3L:** Designed and executed the ML inference integration strategy for Bosch's 24/7 semiconductor fab — containerizing defect-detection models with Docker, orchestrating via Kubernetes and Ansible, and embedding automated image classification into the Defect Management pipeline; eliminated manual wafer inspection bottleneck and enabled continuous, unattended quality monitoring across active 300mm production lines.
+- **3L:** Designed and executed the ML inference integration strategy for Bosch's 24/7 semiconductor fab — containerizing defect-detection models with Docker, orchestrating via Kubernetes and Ansible, and embedding automated image classification into the Defect Management pipeline; reduced the manual wafer-inspection bottleneck on active 300mm production lines. *(Earlier wording said “eliminated” and “unattended” — both exceed canonical BS-1.)*
 - **1L:** Containerized ML inference (Docker, K8s, Ansible) for automated image-based defect classification in 24/7 semiconductor fab.
 
 **Key skills:** Docker, Kubernetes, Ansible, ML deployment, ML inference, containerization, MLOps, image classification, defect detection, production ML, semiconductor manufacturing

resume_builder/experience/experience_swisscom.md

@@ -163,8 +163,9 @@
 
 **Metadata/catalogue platform (user-confirmed 2026-07-29):** Swisscom uses **Atlassian Compass** as the metadata platform for data products, including lineage. Dennis uses it as a practitioner to document data-product metadata and lineage. **Do NOT claim** he administers, rolled out or owns Compass. This is a genuine named catalogue/lineage tool and satisfies "or similar metadata/catalogue platform" JD phrasing — but it is **not** a substitute claim for Purview, Collibra or Alation, which remain unevidenced and forbidden.
 
-**Key skills:** Data Mesh, data products, metadata management, data lineage, Atlassian Compass, data catalog, data governance, AWS, Glue, Athena, CloudFormation, AWS CLI, CI/CD, agentic data foundation, grounded retrieval
+**Key skills:** Data Mesh, data products, metadata management, data lineage, Atlassian Compass, data catalog, data governance, AWS, Glue, Athena, CloudFormation, AWS CLI, CI/CD, agentic data foundation
-**ATS keywords:** Data Mesh, data products, metadata management, AWS, Glue, Athena, CloudFormation, CI/CD, data governance, grounded retrieval, agentic AI foundation
+**NOT a skill here:** *grounded retrieval* was listed until 2026-09-11 but no retrieval implementation is evidenced — SW-8 records it as explicitly unknown. Describe the data side (governed, documented, lineage-tracked data that agents can consume), never retrieval work.
+**ATS keywords:** Data Mesh, data products, metadata management, AWS, Glue, Athena, CloudFormation, CI/CD, data governance, agentic AI foundation
 **Reframing notes:**
 - ML/AI: MED — evidence for data readiness and grounded enterprise data, not agent architecture or retrieval ownership
 - Data Platform/Infra: HIGH — Data Mesh + metadata + AWS IaC is core platform signal
@@ -186,7 +187,7 @@
 **Key skills:** LLM application configuration, model selection, AI agents, domain knowledge bases, question answering, migration assistance, data mapping
 **ATS keywords:** LLM-powered applications, AI agents, model selection, knowledge grounding, question answering, workflow automation, data mapping
 **Reframing notes:**
-- ML/AI: HIGH for LLM-specific roles; lead with applied LLM delivery, then connect reliable data foundations and evaluation discipline.
+- ML/AI: HIGH for LLM-specific roles; lead with applied LLM *configuration*, then connect reliable data foundations. **Do not invoke evaluation discipline** — no LLM evaluation responsibility is evidenced and *formal model evaluation* is a globally forbidden pattern.
 - Accuracy: Never say “trained an LLM” unless model weights were fine-tuned. Prefer “grounded,” “configured,” or “provided with a domain-specific knowledge base.”
 - Production: Use “internal” or “prototype” only if true; otherwise omit deployment-status language until verified.
 

resume_builder/support/skills_taxonomy.md

@@ -60,12 +60,16 @@ Do not use Expert/Proficient/Familiar labels in resumes. Evidence and recency ar
 | Domain-grounded assistants/custom GPTs | Hands-on — current | Configured with curated knowledge; no fine-tuning or formal evaluation |
 | Copilot, Kiro | Hands-on — current | AI-assisted engineering tools, not LLM product engineering |
 
+| Linux administration | Professional 2020–2022 (BS-6) + personal and current (PP-3) | Employer-side use ended Dec 2022; PP-3 is a personal Debian server and must be named as such. Not evidence of physical-datacenter work |
+| Ansible | Professional — intensive at Bosch (BS-6) | Configuration management and IaC, including self-written extensions. Does NOT license Terraform. **GitOps is forbidden** — push-based execution, no reconciliation agent |
+| Bash / shell scripting | Professional-historical + personal-current (BS-6, PP-3) | Added to `claims.json` 2026-09-05. Does NOT license Groovy, nor systems/kernel-level claims |
+
 ## Certification-Only Signals
 
 | Skill | Evidence |
 |---|---|
 | TensorFlow / Keras | IBM AI Engineering coursework |
-| PyTorch | Coursework/personal evidence only; verify before listing outside certification context |
+| PyTorch | **Certification-backed** (IBM AI Engineering, 4 Jun 2020, verify code 3ZBZFVAL6A34). `claims.json` output policy is `certification-context-only`: list only beside the certificate |
 | Spark ML | Coursework context only unless professional evidence is added |
 | AI for Trading / quantitative ML | Udacity/WorldQuant Nanodegree |
 
@@ -90,7 +94,7 @@ Do not use Expert/Proficient/Familiar labels in resumes. Evidence and recency ar
 | iSAQB CPSA — Foundation | iSAQB | 2016; no expiry |
 | ITIL Foundation | PEOPLECERT / AXELOS | 2016; no expiry |
 | AI for Trading Nanodegree | Udacity / WorldQuant | 2021 |
-| IBM AI Engineering Specialization | IBM / Coursera | Completion year not recorded |
+| IBM AI Engineering Specialization | IBM / Coursera | **Completed 4 Jun 2020**, no expiry, verify code 3ZBZFVAL6A34 (certificate read 2026-08-27). Explicitly non-credit — never present as an academic qualification |
 
 The Swisscom Security Champion assignment is not a certification and does not belong in this table.