docs(sbb): add total-comp break-even worksheet

The deciding question on 2026-09-09 is a number nobody has, so the worksheet is a frame to complete before the call rather than a filled-in answer: Anforderungsniveau K is not public, which is why Q1 exists. Records the three things that make a Swiss base-to-base comparison lie: the free GA, Regionalzulage and employer pension share are real money invisible in a base figure, while a Swisscom bonus is real money SBB will not match; the GA is a taxable Lohnausweis benefit so its net value sits below list price; and the GA and the "commute saving" are the same franken, so counting both flatters SBB by four figures. K is a capped GAV band with no negotiation lever at the top, so this is a yes/no against a fixed number, not an opening position. User's read is that it will not clear. Taking the call regardless: the questions are worth asking, it is interview practice while NATO JWC, BIS and Microsoft Principal are still live, and the K figure is the first real data point on what the entire Bern/Thun local tier pays - RUAG, Swissgrid, BKW and BFH sit in comparable band structures. Worth recording whatever the outcome. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JMcHCsTKWvVzqyLChF5ckk
feat(sbb): interview invitation 2026-09-09, write interview brief
2026-08-28 17:01:14 +02:00 · 2026-08-28 16:41:55 +02:00 · 2026-08-27 23:20:17 +02:00 · 2026-08-27 14:45:09 +02:00 · 2026-08-26 09:56:34 +02:00 · 2026-08-26 09:53:55 +02:00
39 changed files with 3652 additions and 96 deletions
@@ -24,8 +24,11 @@ __pycache__/
 job_scout/.venv/
 job_scout/reports/
 job_scout/state/*
-# ...but track the decision log (job application history), not the churny seen-state
+# ...but track the durable application records, not the churny seen-state:
+#   decisions.json         — per-posting decision log (applied/skip/shortlist/closed)
+#   application_cohort.json — cohort slot tracker (core/adjacent/stretch mix)
 !job_scout/state/decisions.json
+!job_scout/state/application_cohort.json

 # One-off job-board data pulls (debug artifacts)
 *_jd.json
@@ -157,6 +157,9 @@ _Update this section when starting/finishing a JD._

 | Session | Status | Next Command |
 |---------|--------|-------------|
+| SBB - **Data Engineer (m/w/d)**, Asset Management Infrastrukturanlagen, **Bern** (Job ID 103755) | ⭐ **INTERVIEW INVITED 2026-08-28 - 9. September 2026, 08:30, 45 Min, MS Teams. The only live interview in the log.** Stage **2 of 4** per the posting: *"Virtuelles Kennenlernen mit HR und Fuehrungskraft"*, so **HR together with Andri Wienandts**, not a pure HR screen. Brief: `output/SBB_DataEngineer_AssetMgmt/interview_brief_sbb_2026-09-09.md`. **First conversion of the evidence-first cohort** (6 applications, 2 rejections) and it came from a **COLD submit** - the warm contact printed on the posting was never called. The resume never contained **Snowflake, dbt or Power BI**, the literals an ATS screen would key on, and it still got through: a human read it and the honest-substitution framing held. One data point, do not over-read it. Submitted 2026-08-25, Core, Evidence Fit **79/100**, hard gate PASS, Document Quality **92/100**, no cover letter (SBB waives it). Best practical fit in the log: Bern, German-language, no relocation, EU + B permit. **Four unresolved items, now live call topics:** Anforderungsniveau **K** band (capped GAV, not public, likely below the 180k bar); the seat reads **lateral or below** current Staff + Component Owner scope (the declined-BKW shape); **RAMSI** Java/Spring Boot/Angular is a full responsibility line on a historical/absent stack; Kidz Care scales on gross household income. Gaps to answer honestly: Snowflake, dbt, Argo, Helm, Power BI, Spring Boot, Angular - survivable only because the JD says "z. B.". Thesis stays a **methods prototype**: no operational data, no accuracy figures, PSO surveyed only. | **Decide before 9.9.:** what he does if K lands at 130-150k, if architecture is set elsewhere, or if RAMSI is heavily Angular. Any one can be a no - better decided in advance than improvised on camera. |
+| RUAG C5I - **AI Engineer C5I**, **Thun** (application ID 18027) | **SUBMITTED 2026-08-27** via jobs.ruag.ch (portal only). Evidence Fit **74/100**, fit class **Stretch**, hard gate **FAIL** (R1/R2, the title-defining responsibilities, are Adjacent not Direct), Document Quality **93/100** after a critique-and-fix round, channel **Weak/cold**. German CV 2 pages/13 bullets + motivation letter 1 page/295 words; validators PASS, 0 boxes, visual QA clean. **Cohort now 6/10 and the sole Stretch slot is CONSUMED (Stretch 1/1).** Positioning is his canonical title Staff Data, Analytics & AI Engineer; `PP-3` carries current Linux/hardening evidence and `SW-5` ties DevSecOps to C5I's stated model. The letter names the AI-platform gap in one sentence. Honest gaps: no AI/LLM platform, no compute/GPU cluster, no RAG/retrieval, ML/AI frameworks certification-context only. **Compensation, PSP/project eligibility and level were never resolved and are now live screening topics.** Marco Heinzen's published direct line was never used. **If rejected, do not drop RUAG** - Senior DevOps Engineer C5I and Data Lakehouse / Senior Data Platform Engineer are shortlisted and fit better. | Await response; optional calls to Marco Heinzen (scope/level) and Frank Haugwitz (comp/PSP). |
+| Schweizer Armee - **Kommando Cyber (Kdo Cy)**, DevOps Engineer III (Data Platform), **Zimmerwald** (Ref JRQ$540-19848) | **SUBMITTED 2026-08-27.** Evidence Fit **79/Core**, hard gate **PASS**, Document Quality **92/100**, channel **Weak**. German 2-page CV plus 1-page motivation letter; validators PASS, 0 boxes, visual QA clean. BW-1 surfaces the six-year Bundeswehr officer career. User explicitly accepted the critique's remaining BS-1 wording issue (*„ohne manuellen Eingriff“*) as good enough and submitted unchanged. Cohort evidence-first-2026-01 is now 5/10, Core 3/7. | Await response; optional post-submit call to Marcel Matthey-Doret about Lohnklasse, Engineer-III level and development path. |
 | Google - Software Engineer III, Business Home, Zurich (req 93922217108087494) | **CLOSED - NOT PROCEEDING 2026-07-28** (submitted 2026-07-27; Core, Evidence Fit 89/100, Document Quality 94/100; no interview). Rapid early-screen disposition; known risks were Mid-level versus current Staff scope, data/platform versus product-SWE positioning, preferred algorithms/accessibility gaps, and a cold channel. | Done - cohort rejection recorded; do not treat this outcome alone as a document-quality failure |
 | Microsoft — Principal Forward Deployed Engineer, SWE (German Speaking), Zürich (req 200043897) | **SUBMITTED 2026-07-27** (84.2/100 Pass 2; finalized 2-page resume + 1-page cover letter). Strong native-German, Staff progression, production ownership and enterprise-data-readiness case; honest gaps remain in end-to-end LLM delivery, Azure AI and strategic-account FDE experience. | Done — await response |
 | BIS Basel — Senior Data & Analytics Engineer, AI (jr100429, 3-yr term) | **SENT 2026-07-10** (80.5/100; deadline 2026-07-24; hybrid Basel, English-working intl org). Critique flags LLM-depth probe (integration/config vs. ownership) as the screening risk — prep honest answer before any call | Prep interview brief when screening lands |
@@ -157,11 +157,14 @@ _Update this section when starting/finishing a JD._

 | Session | Status | Next Command |
 |---------|--------|-------------|
-| SBB — Data Engineer (m/w/d), Asset Management Infrastrukturanlagen, **Bern** (Job ID 103755) | **SUBMITTED 2026-08-25.** Cohort slot: **Core (evidence-first-2026-01)**. 2pp English resume (13 bullets, validator PASS) + critique: **Document Quality 92/100** (90 at critique, +2 after Edit 1), hard gate PASS, no Tier 1 truth findings, **no outstanding fixes**. No cover letter — SBB waives it. Evidence Fit **79/100 (Core, lower end)**, hard gate **PASS** — the title-defining capability (build/operate cloud data pipelines and governed data products) is Direct and current, unlike the AWS FDE NO-GO. Best practical fit in the log: **Bern-based, German-language, no relocation, EU citizen + B permit**. Real strength cluster for the *vorausschauende Wartung* purpose — Bosch fab sensor/process data, ELK/Kafka anomaly detection, containerized ML inference, plus the condition-monitoring thesis. **Two open risks, both level/comp not fit:** (1) **Anforderungsniveau K** is a capped GAV band and the figures are not public — must be asked, not researched; (2) the seat reads **lateral or below** current Staff + Component Owner scope (same shape as the declined BKW). Named gaps: Snowflake, dbt, Argo Workflows, Helm, Power BI, Spring Boot, Angular — all non-canonical, survivable only because the JD prefixes the stack list with "z. B.". **Cover letter: NO — SBB explicitly waives it.** Channel: posting names **Andri Wienandts, People Leader, +41 79 364 62 53** — the first published warm entry point in the entire log. **The comp question was NOT resolved before submitting**, so the K band is now a live screening topic rather than a pre-cleared one; the same applies to Kidz Care childcare support (up to 90% of Betreuungskosten but scaled on *gross household* income, so realistically far less at this level — bracket table is intranet-only). | Prep an interview brief before any screening call: (1) Anforderungsniveau K band figures, (2) design/architecture scope vs current Staff + Component Owner level, (3) Kidz Care actual rate at this band. Named gaps to have honest answers for: Snowflake, dbt, Argo Workflows, Helm, Power BI |
+| RUAG C5I - **AI Engineer C5I**, **Thun** (application ID 18027) | **SUBMITTED 2026-08-27** via jobs.ruag.ch (portal only; email and post refused). Evidence Fit **74/100**, fit class **Stretch**, hard gate **FAIL** (R1 and R2, the two title-defining responsibilities, are Adjacent not Direct), Document Quality **93/100** after a full critique-and-fix round (85 pre-edit), truth and provenance 24/25, **0 Tier 1 findings at Round 2**, channel **Weak/cold**. Submitted: German CV **2 pages, 13 bullets** + German motivation letter **1 page, 295 words**; both validators PASS, 0 boxes, text-order and visual QA clean, submission PDFs MD5-verified before sending. **Cohort evidence-first-2026-01 is now 6/10 and the sole Stretch slot is CONSUMED (Core 3/7, Adjacent 2/2, Stretch 1/1)** - any further application must clear Core or Adjacent on its own merits. Positioning is his canonical title **Staff Data, Analytics & AI Engineer**, carried by `BS-1` production ML-inference integration, `BS-6` Linux/Ansible, `SW-3`/`SW-7`/`SW-2` current Kubernetes and data-product work, `PP-3` current self-hosted Linux and hardening, `SW-5` DevSecOps tied to C5I's stated operating model, and the canonical `BW-1` officer career. The letter **names the AI-platform gap in one sentence** and pivots to the operations/platform side. **Honest gaps that travel with it:** no AI/LLM platform built or operated, no compute/GPU cluster, no RAG/retrieval implementation, no formal LLM evaluation; ML/AI-framework depth is certification-context only. **Compensation, PSP/project eligibility and role level were NEVER resolved before sending, so all three are now live screening topics rather than pre-cleared ones.** ⚠ **Marco Heinzen's published direct line (+41 79 568 14 96) was never used** - this went in as a pure cold submit, the sixth consecutive one. **If rejected, that is NOT a signal to drop RUAG:** five other RUAG C5I reqs sit in the scout log, and **Senior DevOps Engineer C5I** and **Data Lakehouse / Senior Data Platform Engineer** are both already shortlisted and are **materially better fits than this one**, sitting on the lane where his evidence is Direct rather than Adjacent. | Await response. Optional but still worthwhile: call **Marco Heinzen** about technical scope and level, and **Frank Haugwitz** about compensation and PSP/project eligibility. Do not react to a single outcome with positioning changes (`application_strategy.md` §38/§74). |
+| Schweizer Armee - **Kommando Cyber (Kdo Cy)**, DevOps Engineer III (Data Platform), **Zimmerwald** (Ref JRQ$540-19848) | **SUBMITTED 2026-08-27.** Evidence Fit **79/Core**, hard gate **PASS**, Document Quality **92/100**, channel **Weak**. Submitted package: German 2-page CV with **15 bullets** and 1-page motivation letter with **300 body words**; validators PASS, 0 boxes, text order and visual QA clean. Canonical **BW-1** records the six-year Bundeswehr officer career and anchors the letter's military/public-service motivation. User explicitly accepted the critique's remaining BS-1 wording issue (*„ohne manuellen Eingriff“*) as good enough and submitted unchanged. Honest gaps remain physical datacenter work, GPGPU, ClickHouse and named Pull-GitOps practice. Cohort evidence-first-2026-01 is now **5/10, Core 3/7**. | Await response; optional post-submit call to Marcel Matthey-Doret about Lohnklasse, Engineer-III level and development path. |
+| Citadel Securities — Platform Engineer, Research Platform Engineering, **Zürich** (also NY/Miami) | **SUBMITTED 2026-08-26.** Cohort slot: **Adjacent 2/2** (cohort now 4/10). ⚠️ **KEY FINDING — the application form's preferred-work-location selector offered NO Zurich**, despite the JD saying "Miami, Zurich or New York" and the site's own Zurich filter returning this req. Careers site is operated by **Citadel Enterprise Americas LLC**; the apply flow is likely US-entity, or the Zurich seat is closed while the posting stands. **This partly supersedes the working-model risk** — if no Zurich seat is reachable through that form, hybrid-vs-onsite is moot and the application may sit against a US req, a hard NO on relocation. **Rule for any future Citadel application: check the form's location selector BEFORE building a package** — the posting's stated locations and the site filter both proved unreliable. User applied with low expectation; cold channel, evergreen standing req. 2pp resume (13 bullets) + 1pp CL (270 words), both validator **PASS, 0 warnings**; JD term coverage 51%→68% after Tier 1 fixes. Critique **STALE by design** (86/100 pre-edit; user chose to submit as-is over re-critiquing; est. ~91 post-edit, never quote as a score). **Cohort entry and decision-log entry deliberately NOT written — no confirmed send date.** Commands ready in the session file. **The working-model question is still open and travels with the application:** Evidence Fit **71/100 (Adjacent, mid-band; revised down from 74)**, qualifications gate PASS but **a practical constraint is UNRESOLVED**, which `critique_framework.md` treats as a NO-GO trigger. **The JD is silent on hybrid vs onsite (0 grep matches), and Ken Griffin is on record that Citadel returned to the office 5 days a week and calls it his most important leadership decision.** If that holds for Zurich, it means ~2–2.5h daily commuting from Bern or relocating — breaking the Bern-based / 2–3 day hybrid bar. Only contrary evidence is a stale 2022 anonymous Fishbowl post about Operations. **Must be asked, not researched** — same class as the SBB K band. Practical constraints scored 5/5 in Phase 0 on an unexamined assumption; corrected to 2/5. **Zero Gaps among the 7 minimum quals**, and all five preferred technologies (Kafka, Kubernetes, Spark, Airflow, distributed DBs) are Direct — **the strongest raw stack alignment in the log**. Title-defining function **splits**: R2 (ingestion/transformation/storage/lifecycle of large datasets) is Direct and describes SW-1/SW-7 exactly; **R1 (design and build the research platform itself) is Adjacent** — the Aker BP authoring-vs-building shape again, and unwritable-around under Scope Discipline. **Classification caveat:** `application_strategy.md`'s "a defining responsibility is only Adjacent → Stretch" would strictly class this Stretch; recorded Adjacent per the Aker BP precedent. Both cohort slots free either way. Gaps: platform authoring at firm scale, no professional quant/finance (now partly mitigated by new **PP-1/PP-2**), SDKs (0 evidence), low-latency/HFT (0 evidence — thesis throughput figure is explicitly barred by `thesis_limits`). **Go is NOT a gap** — Q3 is disjunctive and Python satisfies it. **$175–350k in the posting is a US/NY pay-transparency disclosure, NOT the Zurich number — must be asked.** Channel **Weak/cold** — would be the 5th consecutive cold application, in an office visibly staffed from Google and ETH (platform research head Costas Bekas; Nicolai Meinshausen leads principal research). Cover letter: **YES** if it proceeds — the PP-1 domain story is the main differentiator and needs prose. | **Ask Citadel Securities recruiting whether the Zurich seat is hybrid or 5-day onsite BEFORE building the package.** If 5-day onsite → likely NO-GO on the Bern constraint. If hybrid 2–3 days → resume Phase 2 (plan is written and budget PASSes at 11–14 bullets; two open items: Vizrt VZ-1 C++/distributed bullet, and adding a Projects section for PP-1) |
+| SBB - **Data Engineer (m/w/d)**, Asset Management Infrastrukturanlagen, **Bern** (Job ID 103755) | **INTERVIEW INVITED 2026-08-28 - 9. September 2026, 08:30, 45 Min, MS Teams.** Per the posting's own process this is **stage 2 of 4**, *"Virtuelles Kennenlernen mit HR und Fuehrungskraft"* - **HR together with Andri Wienandts**, not a pure HR screen. Brief written to `output/SBB_DataEngineer_AssetMgmt/interview_brief_sbb_2026-09-09.md`. **This is the FIRST interview of the evidence-first cohort** (6 applications, 2 rejections, 1 conversion) and it converted from a **COLD submit** - the channel plan called for phoning Wienandts first and that never happened. **The resume never contained Snowflake, dbt or Power BI**, the three literals an ATS keyword screen would have keyed on; the session had recorded that risk as "accepted, not solvable". It did not filter him out, so a human read the dossier and the honest-substitution framing survived first contact. **One data point, do not over-read it** - but it is evidence against assuming honest omissions are fatal at the screen. Submitted 2026-08-25: 2pp English resume, 13 bullets, no cover letter (SBB waives it), Evidence Fit **79/100 Core**, hard gate **PASS**, Document Quality **92/100**, channel **Weak/cold**. Best practical fit in the log - Bern-based, German-language, no relocation, EU citizen + B permit. **Four things unresolved before submitting and now live call topics:** (1) **Anforderungsniveau K** is a capped GAV band, figures not public, very likely below the 180k bar; (2) the seat reads **lateral or below** current Staff + Component Owner scope, the same shape as the declined BKW, and the JD's only architecture language is a personal skill not an ownership mandate; (3) **RAMSI** Java/Spring Boot/Angular is a whole responsibility line on a stack that is historical or absent - ask its share, do not oversell; (4) Kidz Care scales on gross household income, so far below 90% at this band. Named gaps to answer honestly: Snowflake, dbt, Argo Workflows, Helm, Power BI, Spring Boot, Angular - all non-canonical, all survivable only because the JD prefixes the stack with "z. B.". Thesis stays a **methods prototype**: no real operational data, no accuracy figures, PSO surveyed only, throughput figure barred. | **Prep before 9.9.:** decide in advance what he does if K lands at 130-150k, if architecture is set elsewhere, or if RAMSI is heavily Angular - any one can be a no, and it is better decided before the call than improvised on camera. |
 | AWS (AWS EMEA SARL, Switzerland Branch) — Senior Forward Deployed Engineer, Zürich (job 10504263) | **CLOSED — NO-GO 2026-08-18** at the Phase 0 gate. Evidence Fit **69/100** (Adjacent). Minimum-qual gate passed (all 4 Basic Quals Direct) but the *title-defining* capability — customer embedding — is a Gap that `claims.json` globally forbids claiming, and R2 multi-agent/retrieval is a second Gap. User declined: **69 is below the fit bar worth spending a package on.** Consistent with revealed behaviour — every application actually submitted scored **77.5–89**; nothing below 75 has ever been sent. **No cohort slot consumed (Adjacent stays 1/2).** Phase 0 analysis retained in the session file for reuse if a better-fitting AWS req appears. | Done — no package built |
 | Google — Forward Deployed Engineer III, Google Cloud GTM (French, German), Zürich (req 78350205438567110) | **CLOSED — NOT PROCEEDING 2026-08-18.** Phase 0 was done (Evidence Fit 67/100, hard gate PASS) but user declined to proceed after **two Google rejections** (Merchant Data Science, Business Home): the bar is now that a Google req must fit *very* well to be worth a third attempt, and this one was Adjacent with an agent-orchestration Gap. **Frees the Adjacent cohort slot (back to 1/2).** Phase 1 never started. | Done — do not reopen without a materially stronger Google req |
 | SDU Center for Energy Informatics, Odense DK — PhD, Theme 2 Predictive Maintenance & Asset Management of Smart Energy Networks (job 4159) | **CLOSED — NOT PROCEEDING 2026-08-18.** Enquiry email to Prof. Bo Nørregaard Jørgensen (sent 2026-08-02) went unanswered for 16 days; user dismissed the idea. Genuine thesis fit (vibration condition monitoring, RBR+ANN hybrid) but the blockers were never the documents — 2 letters of recommendation 13 years out of academia, and DKK 37,075/mo ≈ CHF 56k against a 180k bar. Deadline was 2026-08-20. | Done — no further action |
-| Aker BP ASA — Data Product Architect, AI-ready Data Products (FINN 469067315) | **SUBMITTED 2026-07-30** (ahead of the 2026-08-02 deadline; Adjacent, **Evidence Fit 79/100**, Document Quality 93/100, hard gate PASS, Channel Weak; Stavanger/Oslo/Trondheim, English working language, no Norwegian and no clearance required, EEA work rights). 2pp resume + 1pp CL, both validator PASS. Honest practitioner framing: builds governed data products *inside* Swisscom's Data Mesh; role *authors* an enterprise framework — real level stretch, never fabricate authorship. **Atlassian Compass closed the catalogue-tool gap** (74→79). Remaining gaps: framework authorship, no energy domain, AWS vs their Microsoft/Cognite stack, **zero verified metrics**. | Done — await response; optional follow-up email to Per Olav Marthinsen |
+| Aker BP ASA — Data Product Architect, AI-ready Data Products (FINN 469067315) | **CLOSED — REJECTED 2026-08-27** (submitted 2026-07-30, ~28 days to disposition, no interview; the session file and cohort record record the submission as 2026-07-29 — a one-day inconsistency, never reconciled). Adjacent, **Evidence Fit 79/100**, Document Quality 93/100, hard gate PASS, **Channel Weak/cold** — the optional follow-up email to Per Olav Marthinsen was left unsent, so this went in as a pure cold submit. Stavanger/Oslo/Trondheim, English working language, no Norwegian and no clearance required, EEA work rights. 2pp resume + 1pp CL, both validator PASS, no Tier 1 truth findings — **a cold-channel no-interview rejection does not implicate document quality on its own** (same disposition class as Microsoft ISE and Google Business Home). Honest practitioner framing: builds governed data products *inside* Swisscom's Data Mesh; role *authored* an enterprise framework — real level stretch, never fabricated authorship. **Atlassian Compass closed the catalogue-tool gap** (74→79). Standing gaps if a similar req appears: framework authorship, no energy domain, AWS vs their Microsoft/Cognite stack, **zero verified metrics**. **Cohort slot stays consumed** (evidence-first-2026-01, Adjacent 1/2 — a rejection does not free a slot; cohort remains 4/10). **The Norway lane stays OPEN and selective** — NATO JWC Stavanger is still live, and Equinor/Telenor and other strong Norwegian employers remain in scope per the user's standing instruction. Never frame this lane as closed. | Done — cohort rejection recorded; do not react to this single outcome with positioning changes (`application_strategy.md` §38/§74) |
 | Google - Software Engineer III, Business Home, Zurich (req 93922217108087494) | **CLOSED - NOT PROCEEDING 2026-07-28** (submitted 2026-07-27; Core, Evidence Fit 89/100, Document Quality 94/100; no interview). Rapid early-screen disposition; known risks were Mid-level versus current Staff scope, data/platform versus product-SWE positioning, preferred algorithms/accessibility gaps, and a cold channel. | Done - cohort rejection recorded; do not treat this outcome alone as a document-quality failure |
 | Microsoft — Principal Forward Deployed Engineer, SWE (German Speaking), Zürich (req 200043897) | **SUBMITTED 2026-07-27** (84.2/100 Pass 2; finalized 2-page resume + 1-page cover letter). Strong native-German, Staff progression, production ownership and enterprise-data-readiness case; honest gaps remain in end-to-end LLM delivery, Azure AI and strategic-account FDE experience. | Done — await response |
 | BIS Basel — Senior Data & Analytics Engineer, AI (jr100429, 3-yr term) | **SENT 2026-07-10** (80.5/100; deadline 2026-07-24; hybrid Basel, English-working intl org). Critique flags LLM-depth probe (integration/config vs. ownership) as the screening risk — prep honest answer before any call | Prep interview brief when screening lands |
@@ -188,10 +191,22 @@ _See `config.md` for user-specific corrections. Add verified errors here as you

 | Date | Correction | Files fixed |
 |------|-----------|-------------|
+| 2026-08-27 | **A German-language resume was being typeset with English hyphenation patterns, and had been for every German package built from this template.** The RUAG resume loaded `lmodern` but **never `babel`** - the cover letter did (`\usepackage[ngerman]{babel}`), the resume did not. The compiled PDF broke words as `Hal-bleiterfertigung`, `Tran-skription`, `automa-tisierte` and `Foun-dation`: all wrong in German, and exactly the kind of thing a native-German Swiss reader notices without being able to name. It survived an earlier full visual QA because nothing *looks* broken - the lines are justified and the page is clean. Adding `\usepackage[ngerman]{babel}` produced correct breaks (`Halb-leiterfertigung`, `automati-sierte`) and **also cleared an overfull box** introduced when the headline grew. ngerman still breaks `Transkription` after `Tran`, so `\hyphenation{Trans-krip-ti-on}` was added. **Rule: any German-language document must load `babel[ngerman]`, and hyphenation must be checked in the compiled PDF, not assumed from a clean box count.** `resume_template.tex` should be checked for the same omission. | RUAG resume (fixed); `resume_template.tex` (OPEN) |
+| 2026-08-27 | **`IBM AI Engineering` was on resumes for months with no primary-source record, and `PyTorch` was under-recorded as a result.** The `/critique` flagged it as the only line a canonical preflight could not confirm: the other three certifications sit in `thiessen_certifications.md` with issuer, date and certificate number, while this one existed only in `bundle_ml_ai_engineer.md`. The user supplied the PDF (`C:\myCloud\Bewerbungsunterlagen\Zeugnisse\Zertifikate\cert_IBM_AI_Engineering.pdf`) and it was read directly: **IBM via Coursera, 4 Jun 2020**, no expiry, verify code `3ZBZFVAL6A34`, six courses, name on the certificate `Dennis Thiessen` (sz variant, as on ITIL and iSAQB). Recorded as entry **#8**. It also proves **PyTorch**, which `claims.json` had as `coursework-or-personal-unverified`; upgraded to `evidence: certification` with `output` unchanged at `certification-context-only`. The certificate is explicitly **non-credit** and confers no grade or degree - never present it as an academic qualification. **Same shape as the Ansible/Linux/Bosch-promotion gaps: the claim was true, the KB simply had no record of it.** | `thiessen_certifications.md` (entry 8); `claims.json` (PyTorch evidence) |
+| 2026-08-27 | **`claims.json` had no Bosch promotion date, so a Swisscom-style title line was unwritable from the canonical file.** Asked to render Bosch like Swisscom ("Senior Data Engineer, Data Analysis (Beförderung xy)"), the canonical file offered only a combined `official_title` "Engineer / Senior Engineer, Data Analysis" with **no `title_history` and no date** - while SWISSCOM has a full `title_history`. The data existed one layer down: `experience_bosch.md` records it LinkedIn-confirmed as Data Engineer **Feb 2020 - Jan 2021** and **Senior** Data Engineer **Jan 2021 - Dez 2022**. Added to `claims.json` as `title_history`, with `display_title` set to the user's own preferred wording **"Senior Data Engineer, Data Analysis"** and `official_title` left untouched as the formal Zeugnis string. **Systemic lesson, the same shape as the Ansible/Linux gaps: `claims.json` is the declared highest authority but is not always the most complete file - when it is silent, check the `experience/` files before telling the user something is unwritable.** Edit note: the file uses compact inline JSON and CRLF; a `json.dumps(indent=2)` rewrite reformats all ~700 lines. Patch it as text. | `claims.json` (BOSCH title_history, display_title); RUAG resume |
+| 2026-08-27 | **Vizrt shown as "DevOps Engineer" alone, on user instruction.** Canonical `official_title` is **"Test Automation Engineer"**; `display_title` is "Test Automation / DevOps Engineer". The user asked to drop "Test Automation" for the RUAG C5I package. Bullet content (CI/CD quality gates, Python backend for distributed transcoding) supports the DevOps framing and the user is the authority on his own role - but **this is the one title on that document that will not match a Zeugnis word-for-word**, so flag it rather than silently propagate it. Not written into `claims.json`: it is a per-package display choice, not a canonical correction. | RUAG resume (session file records the flag) |
+| 2026-08-27 | **A finished package had no reviewable PDF, and the only PDF that existed was a stale pre-fix build.** The RUAG C5I resume was recorded as complete, but the previous session had compiled only into a scratch folder (`.tmp_ruag_ai_resume/`), so `output/RUAG_AI_Engineer_C5I/` held just the `.tex`. The user could not approve what he could not open. Worse, that scratch folder still contained a **pre-correction PDF that included Capgemini**, named with the deliverable's stem - one grab away from being submitted. The folder also held a stale 3-page text extraction, which is why the prior session's "both pages visually inspected" claim had been made against a different document than the final one. **Rule: compile the PDF into the application's own `output/` folder** (as the Kdo Cy package does), and never leave a superseded PDF beside a deliverable. "Output .tex only" means the .tex is the source of truth, **not** that the user should be handed nothing to look at. | RUAG output folder (PDF added, stale temp folder deleted); `config.md` (Output Rules) |
+| 2026-08-27 | **Capgemini reappeared in a generated resume, breaking a standing omit preference.** The RUAG C5I draft carried `Capgemini Deutschland GmbH, Nov. 2014 - Mai 2015` as a compact chronology entry. The user does **not** want Capgemini on any document (six months only; short-stay impression in Germany). A corpus check found it was the **only** generated `.tex` under `output/` containing the name, so this was a one-off regression, not a systemic drift. **Root cause: the preference had no first-class home.** It lived in memory and in a parenthetical inside the unrelated "12+ years" entry below, so a fresh model reading `CLAUDE.md` and `config.md` alone would not see it - `config.md` does not mention Capgemini at all. Recorded here as its own rule: **Capgemini is omitted from every resume, CV and cover letter. The resulting Nov. 2014 - Mai 2015 gap is intentional and must never be "fixed".** The visible chronology starts at Generali, Mai 2015 - which is also what the "over ten years" profile wording is measured against. | RUAG resume (fixed); this log (rule recorded) |
+| 2026-08-27 | **The English resume template asserts "12+ years of production software experience" and that does not hold against `claims.json`.** Canonical `employment` starts at **Capgemini 2014-11** → ~11 years 9 months as of Aug 2026; and Capgemini is omitted from documents by standing user preference, so the *visible* record on any generated resume starts **Generali 2015-05** → ~11 years 3 months. Either reading falls short of twelve. Inherited unexamined into the Kdo Cy draft's opening sentence and caught at final review; corrected there to **"über zehn Jahren"**, which is true under both readings. **`resume_builder/templates/resume_template.tex` still carries the 12+ claim and will re-infect the next package.** Possible innocent explanation: officer service after the 2013 M.Eng. (he is a Universität-der-Bundeswehr graduate) may be counted and is not in `employment` — **ask before editing the template**, and if it counts, record it in `claims.json` so the number has a source. Lesson: a number inherited from a template is still a claim and needs a canonical source like any other. | Kdo Cy resume (fixed); `resume_template.tex` (OPEN) |
+| 2026-08-27 | **Linux administration was missing from `claims.json` entirely — the second infrastructure blind spot found the same day, and the more consequential one.** User-confirmed: at **Bosch (2020–2022) Linux servers carried everything** — ML platform hosts, Docker hosts, backend services, the Ansible control path — and he administered and automated them; he also **wrote Ansible extensions**, including a credential plugin pulling secrets from a password keystore with local caching to cut lookup volume (scalability/performance). Recorded as new claim **BS-6**. Separately, he has run a **self-hosted Debian server for ~10 years** — nginx, mail, Nextcloud, VPN, Docker services, Bitwarden — which he administers *and hardens*; recorded as **PP-3** with a PP-1-style forbidden list (never enterprise/production/multi-user, no uptime or scale figures, never employer work, never evidence of physical-datacenter experience). **Hardening evidence leans on the personal side — always say so.** **GitOps question resolved and the answer is NO:** playbooks were in Git but execution was **push-based from Jenkins/GitLab**, no reconciliation agent. The word stays `forbidden`; the substance is writable as *"versionskontrollierte Infrastrukturautomatisierung mit Ansible aus Git, ausgeführt über Jenkins-/GitLab-Pipelines"*. **Systemic lesson: the KB is data-engineering shaped and under-records infrastructure and operations work.** Two canonical gaps (Ansible, Linux) cost the Kdo Cy assessment ~15 points and produced an initial NO-GO that reflected the KB, not the candidate. Before scoring any DevOps/platform/SRE-flavoured JD, ask about ops evidence explicitly rather than trusting `claims.json` to be complete. | `claims.json` (skills Linux administration + GitOps note, new claims BS-6 and PP-3) |
+| 2026-08-27 | **Ansible was missing from `claims.json` entirely — a real, currently-relevant skill that could not legitimately be listed.** It already appeared in `experience_bosch.md` BS-1 bullet variants ("Docker, Kubernetes, Ansible"), but the canonical file had **zero** mentions in either `skills` or any claim, so by the evidence-first rule it was unwritable. User confirmed 2026-08-27 that Ansible work at Bosch (2020–2022) was **intensive** and went beyond the BS-1 ML-inference orchestration into configuration management and infrastructure automation. Added as `production-historical`, `output: allowed`, and BS-1's scope now records it. **This is genuine IaC evidence** alongside CloudFormation and it materially improves any DevOps/platform JD — it does **not** license Terraform, which stays unverified. **`GitOps` added as a separate, explicitly `forbidden` skill pending clarification:** the user described the Ansible work as GitOps, but Ansible is configuration management while GitOps is narrower (declarative desired state in Git, reconciled by an agent such as Argo CD or Flux). Until it is established whether playbooks lived in Git and were applied from there, and whether a reconciliation agent was involved, the word must not appear in any document. The Kdo Cy JD names **"Pull-GitOps"** explicitly, so that is the one audience guaranteed to probe the distinction. | `claims.json` (skills Ansible + GitOps, BS-1 scope) |
 | 2026-08-21 | **The data-engineer bundle carried the SW-1 scope violation it was supposed to prevent.** `bundle_data_engineer.md` §S5's cover-letter opening hook read "*while simultaneously leading the migration of our legacy stack to a cloud-native AWS architecture*" — a full-ownership verb on a company-scale object, directly contradicting `claims.json` SW-1 `forbidden` **and** point 2 of the narrative thread three lines below it. Live trap for every future data-eng cover letter. Rewritten to the scoped form plus an inline scope warning. **Check the other four bundles for the same pattern.** | `bundle_data_engineer.md` (§S5 hook + new warning) |
 | 2026-07-27 | **SW-1 was not solo.** Swisscom AWS migration was written as "sole technical lead" / "Led migration of legacy stack." Dennis was primary engineer for **his own domains'** pipelines and a contributor to the wider programme. | `experience_swisscom.md` (role line + all 3 bullet variants + overclaiming warning), `config.md` |
 | 2026-07-27 | **Security Champion is 2025/2026 only, and is a team role — not an award.** Source files claimed "3 consecutive years (2023/24–2025/26)." User has now corrected this twice. **Default is OMIT** unless the JD explicitly requires security/DevSecOps. | `experience_swisscom.md` SW-5, `achievement_reframing_guide.md`, `skills_taxonomy.md` (3 rows) |
 | 2026-07-29 | **Atlassian Compass is the metadata/lineage platform for Swisscom data products** (user-supplied). Previously the KB named no catalogue/lineage product at all, which read as a hard gap against data-governance JDs. Practitioner use only — never claim admin, rollout or ownership. Does NOT license claiming Purview/Collibra/Alation. | `claims.json` (SW-7 scope + skills entry), `experience_swisscom.md` SW-7 |
 | 2026-08-02 | **Master's thesis verified against the PDF.** Vibration-based condition monitoring of CNC machine tools; hybrid **rule-based reasoning + 7-10-3 ANN**; throughput/latency evaluation (~500 SPS pipeline vs 72.9 kSPS sensors). **PSO was surveyed but NOT implemented** — an earlier note in this session wrongly listed it as an applied method. No real operational data and no accuracy figures: it is a methods prototype, not a validated system. Also recorded: ECTS relative grade **B (top 35%)**, English-language transcripts exist. | `claims.json` EDU-MENG |
+| 2026-08-26 | **Degree final grades were missing from the KB entirely.** A Citadel application form asked for GPA and neither degree's *Abschlussnote* was recorded anywhere in `claims.json` — only the M.Eng. **thesis** grade (1.0). The only lead was `knowledge_base/extractions/thiessen_cv_master_profile.md`, whose own provenance note says it is not authoritative and which already carries a known error (lists PSO as an applied thesis method, corrected 2026-08-02). User confirmed both grades directly: **M.Eng. 1.6, B.Eng. 2.4** (German scale, 1.0 best / 4.0 lowest pass). US 4.0 equivalents added via the modified Bavarian formula (`5.0 − G`): **3.4** and **2.6**. ECTS percentile **settled the same day**: B is formally the next 25% after the top 10%, i.e. the **10–35% band, so "top 35%" is the correct phrasing** — the record's original value was right and the briefly-considered "top 30%" was the error. **Never narrow B to a point estimate** (top 30%/25%); it is a band. New `grade_output_rule`: grades stay off the resume and cover letter by default; these fields exist for form questions and credential checks. | `claims.json` (EDU-MENG, EDU-BENG) |
+| 2026-08-25 | **Trading-domain evidence was entirely missing from the KB.** `claims.json` had 0 hits for trading, finance or quant, so a genuine capability was unusable in any document. Added **PP-1** (self-built, self-hosted single-user investing/signal platform: US-equity price/fundamental/sentiment ingestion, LLM-assisted sentiment, long-only cross-sectional residual 12-1 momentum book with ATR stop/trail and max 15 names, scheduled scan/backtest pipelines, web dashboard + Telegram alerts) and **PP-2** (Udacity *AI for Trading* nanodegree), plus two `allowed-with-context` skills. Both carry hard `forbidden` lists: **no PnL/Sharpe/return/backtest figure may ever be quoted**, never call PP-1 distributed/production/multi-user, never imply professional quant or finance experience, never present the nanodegree as a quant credential. PP-1 is the one place full-ownership verbs are correct — it is genuinely solo, unlike the employer work governed by Scope Discipline. | `claims.json` (claims PP-1, PP-2; skills "quantitative/systematic trading concepts", "backtesting") |
 | 2026-08-02 | **Bosch data types named.** Fab sensor/process data: defect-management records, wafer inspection images, PCM electrical parameters (user-confirmed). Previously the KB named no concrete sensor-data types for Bosch. | `claims.json` BS-2 |
 | 2026-07-27 | **Bullet density.** Fixed 1L/2L/3L and character-band rules made bullets uniform and encouraged page filling. | Replaced globally with natural-length, evidence-led bullets; character counts are diagnostic only. |
+| 2026-08-25 | **Cadence monoculture across every generated package.** Audit of all 18 packages in `output/` (368 bullets) found **45% used the same "X, Y and Z" triple**; the SBB package hit **85% — 11 of 13 bullets, every Swisscom and Bosch line** — plus two adjacent bullets both opening "Build and…". Not a truth defect: every bullet was accurate and the corpus is clean on AI vocabulary (0 cliché hits in 35 documents) and prose em-dashes (0.08/bullet). It is a *rhythm* tell — uniform three-beat cadence reads as machine-written. PDF metadata is clean (MiKTeX pdfTeX, empty Author/Title, no AI tokens in 69 PDFs, no generator-term leakage). | New `resume_reference.md` §7a + verification step 7; `critical_rules.md` rule 7a; `critique_framework.md` mechanics row now scores cadence (max 1 pt, style only) |
@@ -0,0 +1,59 @@
+SOURCE URL: https://www.citadelsecurities.com/careers/details/platform-engineer/
+RETRIEVED: 2026-08-25 via job_scout/.venv Playwright (chromium, headless)
+METHOD NOTE: WebFetch returns HTTP 403 on this host; Playwright required.
+VERBATIM: yes - full visible posting body, unedited except removal of site
+  navigation chrome (menu, footer, cookie/legal links).
+========================================================================
+
+Platform Engineer
+
+New York, Miami, Zurich
+
+Job Description
+Role Overview:
+Citadel Securities is seeking an exceptional Platform Engineer to join our Research Platform Engineering team in Miami, Zurich or New York. Our Research Platform teams are at the forefront of designing and developing the distributed systems, data platforms, and research infrastructure that power large-scale simulations, analytics, and model development across the firm. These systems are critical in allowing researchers to transform data into actionable insights and alpha-generating trading strategies.
+Opportunities may be available from time to time in any location in which the business is based for suitable candidates. If you are interested in a career with Citadel, please share your details and we will contact you if there is a vacancy available.
+Responsibilities:
+Design and build distributed platforms and services that support quantitative research, simulations, AI-powered applications, and large-scale analytics workflows
+Develop scalable platform services and data systems for ingestion, transformation, storage, and lifecycle management of large datasets
+Build and maintain backend services, APIs, and SDKs that improve researcher productivity and self-service capabilities
+Improve performance, reliability, and scalability of critical research systems operating in high-throughput environments
+Collaborate closely with researchers and engineers to translate research requirements into production-read systems
+Qualifications:
+Bachelor’s degree in Computer Science or a related field
+3+ years of professional software engineering experience
+Strong programming skills in Python, Go, or C++, or similar systems-oriented languages
+Experience building and operating distributed systems in production environments
+Experience designing scalable backend services, APIs, and data-intensive applications
+Strong understanding of distributed systems, data-intensive applications, and system design fundamentals
+Experience with cloud platforms (AWS, GCP, Azure) and modern infrastructure technologies
+Experience with technologies such as Kafka, Kubernetes, Spark, Airflow, distributed databases, or similar systems is a plus
+
+
+In accordance with applicable law, the base salary range for this role is $175,000 to $350,000.
+
+In addition, the employee who fills this role will be eligible to participate in a discretionary incentive compensation program, as well as a wide array of benefit programs, such as medical and life insurance, retirement and tax-free savings plans, and access to other healthcare programs.
+
+About Citadel Securities
+
+Citadel Securities is a technology-driven, next-generation global market maker. We provide institutional and retail investors with world-class liquidity, competitive pricing and seamless front-to-back execution in a broad array of financial products. Our teams of engineers, traders and researchers harness leading-edge quantitative research and the accelerating power of compute, machine learning and AI to power our analytics and tackle the market’s and our clients’ most critical challenges. Together, we are forging the future of capital markets. For more information, visit citadelsecurities.com.
+
+About Citadel Securities
+
+Citadel Securities is a technology-driven, next-generation global market maker. We provide institutional and retail investors with world-class liquidity, competitive pricing and seamless front-to-back execution in a broad array of financial products. Our teams of engineers, traders and researchers harness leading-edge quantitative research and the accelerating power of compute, machine learning and AI to power our analytics and tackle the market’s and our clients’ most critical challenges. Together, we are forging the future of capital markets. For more information, visit citadelsecurities.com.
+
+Start Application
+Citadel Securities
+Counterparty Login
+Who We Are
+What We Do
+News & Insights
+Careers
+Privacy
+Terms of Use
+Fraud Notice
+Disclosures
+
+Copyright © Citadel Enterprise Americas LLC or one of its affiliates. All rights reserved.
+
+Citadel Securities is an equal opportunity employer. We provide all individuals consideration for employment and advancement opportunities without regard to race, religion, color, gender, pregnancy, national origin, age, disability, military or veteran status, sexual orientation, genetic information and any other classification protected by applicable federal, state and local laws.
@@ -10,7 +10,7 @@
 - **Degree suffix:** M.Eng.
 - **Email:** dennis@thiessen.io
 - **Phone:** +41 795 955 585
- **Location:** Bern, Switzerland
+- **Location (contact line):** **Bern, Switzerland** by default. Use **Thun, Switzerland / Thun, Schweiz** for roles in **Thun or its immediate surroundings** - the user lives in Thun, and local residency at the employer's own location is a real screening signal for traditional Swiss employers (user-decided 2026-08-27). This applies to the **contact line only**; a position's own location stays factual, e.g. the Swisscom entry keeps Bern.
 - **LinkedIn:** linkedin.com/in/dennis-thiessen
 - **Google Scholar:** [leave blank — not applicable]
 - **ORCID:** [leave blank — not applicable]
@@ -52,6 +52,7 @@ Verified errors to never re-introduce. Add entries as you catch mistakes.

 | Correction | Details |
 |-----------|---------|
+| Capgemini omitted from all documents | **Standing user preference.** Capgemini Deutschland GmbH (Nov. 2014 - Mai 2015) must **never** appear on a resume, CV or cover letter - only six months, and the user does not want the short-stay impression. The visible chronology starts at **Generali, Mai 2015**. **The resulting Nov. 2014 - Mai 2015 gap is intentional and must never be "fixed" or explained away.** Any tenure claim in a summary line ("over ten years") is measured against the visible record from Mai 2015. Regressed once into the RUAG C5I draft on 2026-08-27 because this rule lived only in memory. |
 | Degree name | B.Eng. official name: "Information and Telecommunication Technologies". M.Eng. official name: "Computer Aided Engineering" with focus in Software Design and Software Engineering. Use "Software Design & Engineering" as the focus description on resumes — more recognizable than the official programme name. |
 | Education dates | B.Eng. **Oct 2009 – Oct 2012** (start 10/2009, finished 01.10.2012). M.Eng. **Apr 2012 – Oct 2013** (01.04.2012 – 01.10.2013). Programmes overlap by design — do NOT "fix" the overlap. Both at Universität der Bundeswehr München. |
 | Swisscom title | Senior: Oct 2023 – Apr 2025. Staff (Engineer IV): Apr 2025 – Present. Use "Staff Data, Analytics & AI Engineer" for current role; note promotion if space allows. |
@@ -114,4 +115,6 @@ These are copied verbatim from your template every time.
 - **Local alternative:** 2-page Swiss/DACH profile
 - **Cover letter:** Generate only when required or when it adds information not visible in the resume
 - **Academic CV:** Not a default target. Generate only for an explicitly academic/research application
- **Output .tex files ONLY** — user compiles locally
+- **The `.tex` is the deliverable and the source of truth** - never hand-edit a PDF, and always regenerate from the source
+- **Compile the PDF into the application's own `output/` folder** so the user can review and approve it. A `.tex` alone is not reviewable for him. Never leave the only PDF in a temp directory, and never leave a stale pre-edit PDF next to the deliverable (user-reported 2026-08-27).
+- **If a submission-named copy exists** (e.g. `Dennis_Thiessen_Lebenslauf.pdf`), **refresh it on every recompile.** It is a copy, not a build target, so it silently goes stale under exactly the filename that gets attached to an application.
@@ -289,8 +289,28 @@ COMPANIES = [
    # Telenor Norge (Teamtailor) — Nordic telco; Swisscom is the direct domain analogue
    # and Dennis worked in Norway before (Vizrt, Bergen). NOTE: the old Workday tenant
    # telenorgroup.wd3.myworkdayjobs.com is dead (HTTP 422 on /wday/cxs, 2026-07-29) —
-    # Telenor migrated to Teamtailor. Slug telenorgroup is a near-empty group-HQ board;
-    # telenornorway is the real Norway board (redirects to careers.telenor.no).
+    # Telenor migrated to Teamtailor. telenornorway is the real Norway board (redirects
+    # to careers.telenor.no).
+    # TRAP — slug telenorgroup is NOT a "near-empty group-HQ board" as this comment used
+    # to claim (corrected 2026-08-27): it is a claimed board titled "Sandbox: Telenor
+    # Shared Services" serving 18 phantom listings whose newest is 2024-11-11, including
+    # plausible-looking "Lead Software Engineer" / "Frontend Developer - Oslo" roles. None
+    # of its titles hit the DEMO_TITLES fingerprint in fetch_teamtailor(), so that guard
+    # would NOT catch it — do not widen DEMO_TITLES to cover this. That guard is for
+    # *unclaimed* slugs served Teamtailor's demo seed set; this is a claimed board serving
+    # years-stale data, a different failure mode (a newest-item age threshold is the fix,
+    # if one is ever wanted). Never point this entry at telenorgroup.
+    # Sibling Telenor boards probed 2026-08-27, all rejected, do not re-probe:
+    # telenorcyberdefence (3 roles, newest 2025-10-06 — dormant), telenordenmark (4 roles:
+    # retail sales, praktikant, legal student — zero engineering, and it would run under
+    # the default CH/DK policy rather than norway_only, so it is pure noise),
+    # telenoramp / telenormaritime / telenorsatellite / telenorsverige / telenorkystradio /
+    # telenorbusiness (all HTTP 404 — no such board).
+    # THROUGHPUT (measured 2026-08-27): the live board carries 4-5 roles at a time and is
+    # mostly Norwegian-language ops/security. Exactly one relevant role has surfaced —
+    # Platform Engineer, Core Automation (job 7829423, posted 2026-06-01, score 5), first
+    # reported 2026-08-18 and HTTP 410 Gone by 2026-08-27. The feed did NOT silently drop
+    # it; it genuinely closed. Expect roughly one tailorable role per quarter here.
    # CAVEAT: most Telenor Norge postings require Norwegian ("norsk og engelsk") and are
    # Oslo/Trondheim onsite-hybrid — verify both per role before tailoring.
    # Norwegian-language titles/descriptions score ~0 under the English eng keyword
@@ -0,0 +1,90 @@
+{
+  "cohort_id": "evidence-first-2026-01",
+  "status": "active",
+  "started": "2026-07-27",
+  "target_mix": {
+    "core": 7,
+    "adjacent": 2,
+    "stretch": 1
+  },
+  "definitions": {
+    "core": "Evidence Fit 75+ and no hard-gate failure",
+    "adjacent": "Evidence Fit 60-74, no required Gap, normally at most one serious preferred gap",
+    "stretch": "Evidence Fit below 60 or a defining responsibility is only Adjacent"
+  },
+  "applications": [
+    {
+      "company": "Google",
+      "role": "Software Engineer III, Business Home",
+      "application_date": "2026-07-27",
+      "fit_class": "core",
+      "evidence_fit": 89.0,
+      "hard_gate": "pass",
+      "channel": "weak",
+      "outcome": "rejected_no_interview"
+    },
+    {
+      "company": "Aker BP ASA",
+      "role": "Data Product Architect - AI-ready Data Products",
+      "application_date": "2026-07-29",
+      "fit_class": "adjacent",
+      "evidence_fit": 79.0,
+      "hard_gate": "pass",
+      "channel": "weak",
+      "outcome": "rejected_no_interview",
+      "submitted": "2026-07-29",
+      "rejection_date": "2026-08-27"
+    },
+    {
+      "company": "SBB",
+      "role": "Data Engineer (m/w/d), Asset Management Infrastrukturanlagen, Bern",
+      "job_id": "103755",
+      "application_date": "2026-08-25",
+      "fit_class": "core",
+      "evidence_fit": 79.0,
+      "hard_gate": "pass",
+      "channel": "weak",
+      "outcome": "interview_invited",
+      "submitted": "2026-08-25",
+      "open_risk": "Anforderungsniveau K is a capped GAV band, figures not public; seat may read lateral or below current Staff + Component Owner scope.",
+      "interview": {
+        "stage": "Stage 2 of 4 - Virtuelles Kennenlernen mit HR und Fuehrungskraft",
+        "invited": "2026-08-28",
+        "scheduled": "2026-09-09 08:30",
+        "duration_min": 45,
+        "format": "Microsoft Teams"
+      },
+      "note": "FIRST interview invitation in the evidence-first cohort. Converted from a COLD submit - the published warm contact (Andri Wienandts, +41 79 364 62 53) was never called. The resume never contained Snowflake, dbt or Power BI, the three literals an ATS keyword screen would have keyed on, so a human read the dossier."
+    },
+    {
+      "company": "Citadel Securities",
+      "role": "Platform Engineer, Research Platform Engineering (Zurich/NY/Miami)",
+      "application_date": "2026-08-26",
+      "fit_class": "adjacent",
+      "evidence_fit": 71.0,
+      "hard_gate": "pass",
+      "channel": "weak",
+      "outcome": "applied"
+    },
+    {
+      "company": "Schweizer Armee - Kommando Cyber",
+      "role": "DevOps Engineer III (Data Platform)",
+      "application_date": "2026-08-27",
+      "fit_class": "core",
+      "evidence_fit": 79.0,
+      "hard_gate": "pass",
+      "channel": "weak",
+      "outcome": "applied"
+    },
+    {
+      "company": "RUAG MRO Holding AG (Business Area C5I)",
+      "role": "AI Engineer C5I (w/m/d), Thun",
+      "application_date": "2026-08-27",
+      "fit_class": "stretch",
+      "evidence_fit": 74.0,
+      "hard_gate": "fail",
+      "channel": "weak",
+      "outcome": "applied"
+    }
+  ]
+}
@@ -1701,11 +1701,11 @@
    "date": "2026-07-28"
  },
  "https://www.finn.no/job/fulltime/ad.html?finnkode=469067315": {
-    "company": "",
-    "title": "",
-    "decision": "applied",
-    "note": "Aker BP ASA - Data Product Architect, AI-ready Data Products (FINN 469067315). SUBMITTED 2026-07-30, ahead of 2026-08-02 deadline. Evidence Fit 79/100, Document Quality 93/100, hard gate PASS, channel weak. Stavanger/Oslo/Trondheim, English working language.",
-    "date": "2026-07-31"
+    "company": "Aker BP ASA",
+    "title": "Data Product Architect, AI-ready Data Products",
+    "decision": "rejected",
+    "note": "Aker BP ASA - Data Product Architect, AI-ready Data Products (FINN 469067315). SUBMITTED 2026-07-30, ahead of 2026-08-02 deadline. Evidence Fit 79/100, Document Quality 93/100, hard gate PASS, channel weak. Stavanger/Oslo/Trondheim, English working language. REJECTED 2026-08-27, no interview - ~28 days to disposition (records differ on the submission date: session file and cohort say 2026-07-29, this note and CLAUDE.md say 2026-07-30). Cold channel; the optional follow-up email to Per Olav Marthinsen stayed an open action with no record of it being sent. Cohort evidence-first-2026-01 slot stays consumed (adjacent 1 of 2); the rejection does not free it. Norway remains an active, selective lane - NATO JWC Stavanger is still open, and the user has said Equinor and other strong Norwegian employers stay in scope.",
+    "date": "2026-08-27"
  },
  "https://www.google.com/about/careers/applications/jobs/results/93922217108087494-software-engineer-iii-business-home?location=Switzerland": {
    "company": "Google",
@@ -1785,9 +1785,9 @@
  "https://jobs.sbb.ch/v2/offene-stellen/data-engineer-m-w-d-asset-management-infrastrukturanlagen/45fa2411-31dc-4520-827e-1c93a527534c": {
    "company": "",
    "title": "",
-    "decision": "applied",
-    "note": "Submitted 2026-08-25. Core, Evidence Fit 79, Document Quality 92, hard gate PASS. 2pp English resume, no CL (SBB waives); Tier 1 query-performance fix was already applied 2026-08-21. Anforderungsniveau K band status at submission: unconfirmed.",
-    "date": "2026-08-25"
+    "decision": "interview",
+    "note": "INTERVIEW INVITED 2026-08-28 for 2026-09-09 08:30, 45 min Teams. Stage 2 of 4 per the posting: \"Virtuelles Kennenlernen mit HR und Fuehrungskraft\" - so HR and Andri Wienandts together, not a pure HR screen. Submitted 2026-08-25, Core, Evidence Fit 79/100, Document Quality 92/100, cold channel. First interview of the evidence-first cohort. Unresolved and now live: Anforderungsniveau K band, design/architecture scope vs current Staff + Component Owner level, RAMSI Java/Spring Boot/Angular share of the role, Kidz Care actual rate.",
+    "date": "2026-08-28"
  },
  "https://jobs.ashbyhq.com/snowflake/3eea87fa-73c8-46dc-b69b-7beb438b48d8": {
    "company": "Snowflake",
@@ -1802,5 +1802,47 @@
    "decision": "maybe",
    "note": "UNPAUSED 2026-08-25: the blocking reason is gone - the Enterprise/Observe application it was stacked behind was closed no-response at 80 days. Strong Observe metrics/data-platform overlap, CHF 176-253k band, Zurich-commutable. Caveat: the prior cold submit to this org drew zero response despite an ~86/100 package, so do not simply cold-apply again - route via recruiter or a warm contact.",
    "date": "2026-08-25"
+  },
+  "https://www.citadelsecurities.com/careers/details/platform-engineer/": {
+    "company": "",
+    "title": "",
+    "decision": "applied",
+    "note": "Submitted 2026-08-26. Adjacent, Evidence Fit 71, Document Quality ~91 est (critique scored 86 pre-Tier-1). 2pp resume + 1pp CL, both validator PASS. IMPORTANT FINDING: the application form's preferred-work-location dropdown offered NO Zurich option, despite the JD body saying 'Miami, Zurich or New York' and the site's own Zurich filter returning this req. Careers site is operated by Citadel Enterprise Americas LLC. Treat the Zurich seat as unconfirmed for any future Citadel application - check the form before investing. Working-model question (5-day onsite?) never resolved and may now be moot. Channel cold; user applied with low expectation.",
+    "date": "2026-08-26"
+  },
+  "https://careers.axpo.com/jobs/8263436-staff-plattform-engineer-w-m-d": {
+    "company": "",
+    "title": "",
+    "decision": "skip",
+    "note": "User decision 2026-08-27: not of interest. Baden is a 90min commute from Thun and Axpo is unlikely to pay materially above his current ~140k. RULE: for a commute that long the package must be much better - BIS-style tax-free or FAANG-like comp. Azure + Terraform are also named requirements with 0 canonical evidence, but that was NOT the deciding factor.",
+    "date": "2026-08-27"
+  },
+  "https://jobs.ruag.ch/offene-stellen/ai-engineer-c5i/4afaa9aa-74c1-4b4d-9232-cf65651ce8ec": {
+    "company": "RUAG C5I",
+    "title": "AI Engineer C5I (Thun)",
+    "decision": "applied",
+    "note": "SUBMITTED 2026-08-27 via jobs.ruag.ch (portal only; email and post are refused). Application ID 18027. Cohort evidence-first-2026-01 now 6/10 and the sole Stretch slot is CONSUMED (stretch 1/1). Evidence Fit 74/100, strategic Stretch, strict title-capability hard gate FAIL - all knowingly accepted under the user's explicit Phase 0 override; R1 (build/operate an internal AI-/LLM platform incl. compute cluster) and R2 (in-house LLM solutions, connectors, retrieval/document solutions) are Adjacent, not Direct. Document Quality 93/100 after a full critique-and-fix round (85 pre-edit), truth and provenance 24/25, zero Tier 1 findings at Round 2. Submitted package: German Swiss/DACH resume, 2 pages, 13 bullets, plus a German motivation letter, 1 page, 295 words. Both validators PASS with 0 warnings, 0 boxes, clean two-pass compiles, text-order checks and visual QA of every page. Positioning: Staff Data, Analytics & AI Engineer (his canonical title) with production ML-inference integration, Kubernetes/Linux/Ansible automation, current LLM application configuration and the canonical BW-1 officer career. PP-3 (private self-hosted Debian server, hardening) carries the current Linux/ops evidence since BS-6 ended Dec 2022. The letter names the AI-platform gap in one sentence and pivots to the operations/platform side, and connects SW-5 (Security Champion 2025/2026) to C5I's stated DevSecOps model. No RAG, retrieval, compute-cluster, GPU, model-training or LLM-platform ownership claim anywhere. Channel WEAK - cold portal submit; Marco Heinzen's published direct line (+41 79 568 14 96) was never used. STILL UNRESOLVED and now live screening topics: compensation (no band published; external samples suggest downside risk against the 180k bar), PSP/project eligibility for a German citizen with a Swiss B permit, and whether the role is lateral or a down-level move against current Staff + Component Owner scope.",
+    "date": "2026-08-27"
+  },
+  "https://nvidia.wd5.myworkdayjobs.com/job/Switzerland-Zurich/Senior-Site-Reliability-Engineer--DGX-Cloud_JR2021427-1": {
+    "company": "",
+    "title": "",
+    "decision": "shortlist",
+    "note": "User flagged interesting 2026-08-27. NVIDIA JR2021427, posted 2026-08-20. KEY: Workday additionalLocations lists 'Switzerland, Remote' alongside Zurich - the commute constraint that killed Axpo does not apply, which re-ranks this level with RUAG on practical grounds. Comp is the FAANG-like shape he named as worth a trip anyway. Fit: K8s at scale, Python, observability (Prometheus/Grafana/ELK) Direct; GPU cluster ops across AWS/GCP/Azure/OCI. GAPS, both named requirements with 0 canonical evidence: (a) infrastructure automation - Terraform/Ansible/Chef/Puppet, Terraform is a recorded hard gap and the Kraken SRE rejection was exactly this shape; (b) SRE practice as a discipline - SLO/SLI/error budgets, on-call rotation, incident command, no SRE title. Also '10+ years operating production services'. NOTE: the scout's constructed URL 404s - the real apply link needs the NVIDIAExternalCareerSite segment: https://nvidia.wd5.myworkdayjobs.com/NVIDIAExternalCareerSite/job/Switzerland-Zurich/Senior-Site-Reliability-Engineer--DGX-Cloud_JR2021427-1",
+    "date": "2026-08-27"
+  },
+  "https://www.bis.org/careers/vacancies/jr100420.htm": {
+    "company": "",
+    "title": "",
+    "decision": "maybe",
+    "note": "User flagged interesting 2026-08-27; NOT recorded as shortlist because the JD read is worse than the title suggested. BIS Basel, Platforms team in ITS, 3-year fixed term, deadline 17 Sept 2026, hires all nationalities with relocation support, English corporate language - all fine and consistent with jr100429. PROBLEM: the title-defining capability is DBA, not platform data engineering. Purpose line is enterprise database platforms - Microsoft SQL Server, PostgreSQL, Oracle - with 'deep domain expertise in database technologies', DB administration/availability/lifecycle, and DB certifications as an advantage. That is a Gap, not a stretch. Same shape as the AWS Senior FDE NO-GO on 2026-08-18: minimum quals largely pass (K8s, IaC, CI/CD, observability, cloud all Direct) but the capability the title is built on is unsupported. Secondary issue: jr100429 has been open at BIS since 2026-07-10, so this would stack a second application at one org - the Snowflake precedent. Deadline is 3 weeks out, no urgency pressure.",
+    "date": "2026-08-27"
+  },
+  "https://jobs.admin.ch/offene-stellen/devops-engineer-iii-data-platform/752ded37-1753-4ac8-946a-b0c958d4424a": {
+    "company": "Schweizer Armee - Kommando Cyber",
+    "title": "DevOps Engineer III (Data Platform)",
+    "decision": "applied",
+    "note": "Submitted 2026-08-27. Ref JRQ$540-19848, Zimmerwald. Core, Evidence Fit 79, Document Quality 92, hard gate PASS, channel weak. German 2-page CV plus 1-page motivation letter; the six-year Bundeswehr officer career is included as military-context and motivation evidence. User explicitly accepted the critique's remaining BS-1 wording issue ('ohne manuellen Eingriff') as good enough and submitted without the proposed correction. Honest gaps at submission: physical datacenter work, Pull-GitOps as a named practice, GPGPU, ClickHouse and second Swiss official language. Lohnklasse and Engineer-III level were not recorded as clarified.",
+    "date": "2026-08-27"
  }
 }
@@ -1,7 +1,7 @@
 # Dennis Thiessen — Certifications Extraction

 > One file for all cert PDFs. Added as each cert is processed.
-> Last updated: 2026-03-28
+> Last updated: 2026-08-27

 ---

@@ -16,6 +16,7 @@
 | 5 | Projektleiter Baustein A/IT — Das IT-Projektmanagement (seminar) | Integrata AG | 1–5 Sep 2014 | N/A | Seminar-Nr. 2113 | 5-day attendance (Teilnahmebestätigung). NOT a cert — do not list on resume/CV. Topics: IT project planning, control, risk analysis. Context: during Bundeswehr period. |
 | 6 | AI for Trading Nanodegree | Udacity (co-created with WorldQuant) | 13 May 2021 | N/A | confirm.udacity.com/DJ9QTAH9 | Quantitative finance + ML for trading; completed during Bosch period. Relevant for quant/fintech roles; niche signal for blockchain/crypto interest. |
 | 7 | AWS Certified Solutions Architect – Associate | Amazon Web Services (via Alpine Testing / CertMetrics) | 26 Sep 2024 | 26 Sep 2027 (active) | cp.certmetrics.com/amazon — verified 2026-03-27 | ACTIVE. High-value cert for Data Platform / Infra and Staff Data Engineer roles. Pairs well with Udacity DataEng AWS nanodegree. |
+| 8 | IBM AI Engineering (Professional Certificate, 6 courses) | IBM via Coursera | 4 Jun 2020 | N/A (no expiry) | coursera.org/verify/professional-cert/3ZBZFVAL6A34 | Name: "Dennis Thießen" (ß variant). **Verified against the certificate PDF 2026-08-27** (`C:\myCloud\Bewerbungsunterlagen\Zeugnisse\Zertifikate\cert_IBM_AI_Engineering.pdf`). Courses: Machine Learning with Python; Scalable ML on Big Data with Apache Spark; Intro to Deep Learning & Neural Networks with Keras; Deep Neural Networks with **PyTorch**; Building Deep Learning Models with **TensorFlow**; AI Capstone Project with Deep Learning. This is the source of the `TensorFlow/Keras` **and** `PyTorch` entries in `claims.json` — both stay `certification-context-only`. Explicitly non-credit: the certificate states it confers no grade, course credit or degree, so never present it as an academic qualification. |

 ---

@@ -152,6 +152,6 @@ All hooks verified against first-party or canonical sources. **No unverified cla
 - Critique: **CURRENT** — Evidence Fit 79/100 Adjacent, Document Quality 93/100, hard gate PASS, Channel Weak. 3 Tier 1 findings applied (architecture vocabulary, Languages line, catalogue/adoption terms). See `critique_akerbp_data_product_architect.md`.
 - Finalized: **YES 2026-07-29** — `Dennis_Thiessen_Resume.pdf`, `Dennis_Thiessen_Cover_Letter.pdf`; cohort entry added (evidence-first-2026-01, adjacent 1/2)
 - Pre-submission actions outstanding: **attach diploma/grade transcript** (required by posting); optional cold email to Per Olav Marthinsen
- Application/outcome: **SUBMITTED 2026-07-29** (4 days before the 2026-08-02 deadline). Cohort outcome set to `applied`. Awaiting response.
+- Application/outcome: **SUBMITTED 2026-07-29** (4 days before the 2026-08-02 deadline). **CLOSED — REJECTED 2026-08-27, no interview, ~28 days to disposition.** Cohort outcome set to `rejected_no_interview` (evidence-first-2026-01, Adjacent slot stays consumed — a rejection does not free it); decision log updated. Cold channel: the optional follow-up email to Per Olav Marthinsen was never actioned, so this went in as a pure cold submit. Package was validator PASS with no Tier 1 truth findings — **this outcome does not implicate document quality on its own**, and per `application_strategy.md` §38/§74 no positioning change follows from a single rejection. Note: `CLAUDE.md` and the decision log record the submission as 2026-07-30 — a one-day inconsistency with this file, left unreconciled.
 - Next: `/make-cl output/AkerBP_Data_Product_Architect/session_akerbp_data_product_architect.md`
 - Then: `/critique output/AkerBP_Data_Product_Architect/session_akerbp_data_product_architect.md`
@@ -0,0 +1,59 @@
+SOURCE URL: https://www.citadelsecurities.com/careers/details/platform-engineer/
+RETRIEVED: 2026-08-25 via job_scout/.venv Playwright (chromium, headless)
+METHOD NOTE: WebFetch returns HTTP 403 on this host; Playwright required.
+VERBATIM: yes - full visible posting body, unedited except removal of site
+  navigation chrome (menu, footer, cookie/legal links).
+========================================================================
+
+Platform Engineer
+
+New York, Miami, Zurich
+
+Job Description
+Role Overview:
+Citadel Securities is seeking an exceptional Platform Engineer to join our Research Platform Engineering team in Miami, Zurich or New York. Our Research Platform teams are at the forefront of designing and developing the distributed systems, data platforms, and research infrastructure that power large-scale simulations, analytics, and model development across the firm. These systems are critical in allowing researchers to transform data into actionable insights and alpha-generating trading strategies.
+Opportunities may be available from time to time in any location in which the business is based for suitable candidates. If you are interested in a career with Citadel, please share your details and we will contact you if there is a vacancy available.
+Responsibilities:
+Design and build distributed platforms and services that support quantitative research, simulations, AI-powered applications, and large-scale analytics workflows
+Develop scalable platform services and data systems for ingestion, transformation, storage, and lifecycle management of large datasets
+Build and maintain backend services, APIs, and SDKs that improve researcher productivity and self-service capabilities
+Improve performance, reliability, and scalability of critical research systems operating in high-throughput environments
+Collaborate closely with researchers and engineers to translate research requirements into production-read systems
+Qualifications:
+Bachelor’s degree in Computer Science or a related field
+3+ years of professional software engineering experience
+Strong programming skills in Python, Go, or C++, or similar systems-oriented languages
+Experience building and operating distributed systems in production environments
+Experience designing scalable backend services, APIs, and data-intensive applications
+Strong understanding of distributed systems, data-intensive applications, and system design fundamentals
+Experience with cloud platforms (AWS, GCP, Azure) and modern infrastructure technologies
+Experience with technologies such as Kafka, Kubernetes, Spark, Airflow, distributed databases, or similar systems is a plus
+
+
+In accordance with applicable law, the base salary range for this role is $175,000 to $350,000.
+
+In addition, the employee who fills this role will be eligible to participate in a discretionary incentive compensation program, as well as a wide array of benefit programs, such as medical and life insurance, retirement and tax-free savings plans, and access to other healthcare programs.
+
+About Citadel Securities
+
+Citadel Securities is a technology-driven, next-generation global market maker. We provide institutional and retail investors with world-class liquidity, competitive pricing and seamless front-to-back execution in a broad array of financial products. Our teams of engineers, traders and researchers harness leading-edge quantitative research and the accelerating power of compute, machine learning and AI to power our analytics and tackle the market’s and our clients’ most critical challenges. Together, we are forging the future of capital markets. For more information, visit citadelsecurities.com.
+
+About Citadel Securities
+
+Citadel Securities is a technology-driven, next-generation global market maker. We provide institutional and retail investors with world-class liquidity, competitive pricing and seamless front-to-back execution in a broad array of financial products. Our teams of engineers, traders and researchers harness leading-edge quantitative research and the accelerating power of compute, machine learning and AI to power our analytics and tackle the market’s and our clients’ most critical challenges. Together, we are forging the future of capital markets. For more information, visit citadelsecurities.com.
+
+Start Application
+Citadel Securities
+Counterparty Login
+Who We Are
+What We Do
+News & Insights
+Careers
+Privacy
+Terms of Use
+Fraud Notice
+Disclosures
+
+Copyright © Citadel Enterprise Americas LLC or one of its affiliates. All rights reserved.
+
+Citadel Securities is an equal opportunity employer. We provide all individuals consideration for employment and advancement opportunities without regard to race, religion, color, gender, pregnancy, national origin, age, disability, military or veteran status, sexual orientation, genetic information and any other classification protected by applicable federal, state and local laws.
@@ -0,0 +1,190 @@
+# Critique — Citadel Securities, Platform Engineer (Research Platform Engineering)
+
+**Date:** 2026-08-26 · **Package:** 2-page English resume, 13 bullets · **Cover letter:** not yet generated
+**Framework:** `critique_framework.md` §9 (6-dimension Document Quality). The SKILL.md 8-dimension
+table with "Publications 10%" is a stale CV-era scheme and was not used — same conflict class as its
+"all bullets 2L" line, which `resume_reference.md` §7 superseded on 2026-07-27.
+
+---
+
+## 1. Fit Verdict and Hard Gates
+
+**Qualifications gate: PASS.** All seven minimum quals are Direct or Adjacent; none is a Gap; nothing
+required is `forbidden` in `claims.json`.
+
+**Practical gate: FAIL — UNRESOLVED.** The Zurich working model is unknown. Ken Griffin is on record
+that Citadel returned to the office five days a week and calls it his most important leadership
+decision. If that holds for Zurich, the seat needs ~2–2.5h daily commuting from Bern or relocation,
+against a standing Bern-based / 2–3 day hybrid constraint. `critique_framework.md` §1 treats an
+unresolved location constraint as a NO-GO trigger.
+
+> **This document is finished. The application is not cleared.** Do not submit until the working
+> model is answered. The resume was built at user direction with this open.
+
+## 2. Evidence Fit — 71/100 (Adjacent, mid-band) — unchanged
+
+| Dimension | Weight | Score |
+|---|---:|---:|
+| Required qualifications | 35 | 29 |
+| Core responsibilities | 25 | 16 |
+| Level and ownership | 15 | 10 |
+| Recency and depth | 10 | 9 |
+| Domain/tool transfer | 10 | 6 |
+| Practical constraints | 5 | **2** |
+
+Evidence Fit describes the pairing, not the document; writing cannot move it. R1 (design and build
+the research platform) stays Adjacent regardless of prose quality.
+
+## 3. Document Quality — 86/100
+
+| Dimension | Weight | Score | Note |
+|---|---:|---:|---|
+| Truth and provenance | 25 | **23** | No fabrication, no invented metric, no forbidden tool. Scope discipline held in every bullet. PP-1 labelled three ways with zero performance figures. One borderline item in the headline (below). |
+| Information hierarchy | 20 | **18** | Conventional employer/title/date hierarchy; strongest evidence on page 1; Personal Project correctly placed after experience and before education. Page 1 carries visible bottom whitespace from the deliberate page break. |
+| Bullet evidence and impact | 20 | **16** | Specific and well-scoped, but several bullets describe duties rather than demonstrate outcome (SW-2, BS-3), and the document contains **zero verified metrics** — a standing profile issue, not a writing failure. |
+| Relevance and terminology | 15 | **10** | **The weakest dimension. See Tier 1.** 19/37 JD terms present (51%). |
+| Skills evidence | 10 | **10** | Six lines, every entry canonical, C++ and the trading domain both correctly caveated, no self-ratings, nothing listed merely because the JD says it. |
+| Mechanics/readability | 10 | **9** | Compiles to exactly 2 pages, PDF clean. −1 for cadence per §7a cap. |
+| **Total** | **100** | **86** | |
+
+Truth/provenance 23/25 is far above the 8/10 automatic-failure line.
+
+## 4. Channel Strength — **Weak**
+
+Cold application, no named contact on the posting, no known connection. This would be the fifth
+consecutive cold-channel application. Tailoring does not upgrade a cold channel.
+
+## 5. Competitive Read
+
+**The obvious-fit competitor:** an ex-FAANG infrastructure or distributed-systems engineer, likely
+already in Zurich, who has *designed* platform components rather than owned pipelines on one. The
+Zurich office is visibly staffed from Google and ETH.
+
+| | Dennis | Competitor |
+|---|---|---|
+| Direct function | Owns pipelines and data products **on** a platform | Builds the platform itself |
+| Tool ecosystem | **Advantage** — exact stack match, production-current | Likely comparable or narrower |
+| Domain | Self-directed only (PP-1, PP-2) | Usually none either — **near-parity** |
+| Level/scope | Staff + Component Owner, above the stated bar | Varies |
+| Access | Cold | Often referred |
+
+**Dennis's real advantage:** production ownership with on-call — he has carried the pager for
+revenue-adjacent systems, which most platform candidates have not. Plus genuine domain interest.
+**Competitor's real advantage:** they have done R1, the title-defining half he has not.
+
+## 6. Reader Sequence
+
+- **Parser/ATS:** extracts cleanly. Standard LaTeX, conventional headers, no tables or columns to
+  break parsing. Term coverage 51% — passable, improvable (Tier 1).
+- **Recruiter glance:** **Forward.** Staff title, Zurich-adjacent location, and the exact stack in the
+  headline and first skills line.
+- **Hiring manager:** **Maybe.** R2 evidence is unmistakable; R1 evidence is absent and they will
+  notice. The Personal Project is the line most likely to earn a conversation.
+- **Technical reviewer:** credible. **Likely first challenge: "Which parts of the platform did you
+  design, versus consume?"** The document does not pre-empt this, and it cannot honestly — but the
+  candidate must have a crisp scoped answer ready.
+
+## 7. Claim Audit
+
+| Claim | Canonical | Direct/Adjacent | Safe? | Fix |
+|---|---|---|---|---|
+| Summary: builds/runs pipelines + governed data products | SW-2, SW-3, SW-7 | Direct | ✅ | — |
+| Summary: Component Ownership incl. on-call | SW-2 | Direct | ✅ | — |
+| Summary: Bosch query-performance tuning | BS-2 | Direct | ✅ | — |
+| Summary: containerized ML inference into operating fab | BS-1 | Direct | ✅ | — |
+| **Headline: "Production Data Platforms on AWS"** | SW-1/SW-3/SW-7 | Adjacent | ⚠️ | **Tier 2** — no ownership verb, so not a violation, but it is the most prominent line in the document and leans toward the platform framing R1 is a gap on |
+| Data products "within Swisscom's company-wide Data Mesh" | SW-7 | Direct | ✅ | Correctly scoped — the object carries "company-wide", the verb does not claim it |
+| "Migrated owned … pipelines … contributing to the wider company migration programme" | SW-1 | Direct | ✅ | Correctly scoped and hedged |
+| Component Owner, Fulfillment ETL | SW-2 | Direct | ✅ | — |
+| Bosch data services + query tuning + fab data types | BS-2 | Direct | ✅ | — |
+| ELK/Kafka anomaly-detection **proof of concept** | BS-4 | Direct | ✅ | "proof of concept" retained — good |
+| Application Owner, SLOs, vendors, training | BS-3 | Direct | ✅ | — |
+| Vizrt: "Contributed Python and C++ … distributed video-transcoding backend" | VZ-1 | Direct | ✅ | Hedged verb correct; no broadcaster names |
+| PP-1 Personal Project block | PP-1 | Direct | ✅ | Labelled 3×; **no PnL/Sharpe/return/backtest figure** — compliant |
+| PP-2 as "Supporting coursework" | PP-2 | Direct | ✅ | Not presented as degree or credential |
+| Trading skills line, "personal project and coursework only, no professional experience" | PP-1/PP-2 skills | Direct | ✅ | Exactly the caveat `claims.json` requires |
+
+`validate_resume_system.py --document` → **PASS** (1 cadence warning). **No Tier 1 truth findings.**
+
+## 8. Tiered Improvements
+
+### Tier 1 (≥1 pt) — Relevance and terminology
+
+**1. The strongest matching responsibility is the least vocabularised.** R2 — *"ingestion,
+transformation, storage, and lifecycle management of large datasets"* — is the one core
+responsibility scored **Direct**, and it is the closest thing to a plain description of SW-1/SW-7.
+Yet **"ingestion", "transformation", "storage" and "lifecycle" are all absent** from the resume body.
+The document proves R2 in substance while missing it in the JD's own words, which is exactly what an
+ATS and a skimming reviewer key on. All four are honestly available: onboarding source systems *is*
+ingestion; ETL *is* transformation; S3/Redshift/Iceberg *are* storage. **Worth ~2 pts.**
+
+**2. "distributed systems" never appears as a phrase.** Q4 is a *required* qualification and Phase 0
+scored it Direct — a production Kafka/Kubernetes/Spark/Airflow estate is a distributed system. The
+resume says "Distributed data systems" (skills header) and "distributed video-transcoding backend"
+(Vizrt, 2018), so the nearest exact match sits on an eight-year-old bullet rather than current work.
+**Worth ~1 pt.** Fix by naming the current estate as distributed — without claiming to have *designed*
+distributed systems, which remains a Gap.
+
+**3. "distributed databases" is claimed as a Direct preferred hit but never written.** Phase 0 called
+all five preferred technologies Direct. Four are named explicitly; the fifth appears only as product
+names (Teradata, Redshift, Athena/Iceberg). Teradata is MPP and Redshift is distributed, so the term
+is honest — it is simply missing. **Worth ~1 pt.**
+
+### Tier 2 (0.3–0.9 pt)
+
+4. **Tighten the headline.** "Production Data Platforms on AWS" → something like "Production Data
+   Pipelines & Data Products on AWS". More precisely his scope, still JD-relevant, and removes the
+   one line a technical reviewer could open by challenging.
+5. **"infrastructure"** is absent; CloudFormation, Kubernetes and Ansible support it honestly.
+6. **Page 1 bottom whitespace.** Do not pad (§9 forbids it), but Tier 1 fixes 1–3 will naturally
+   absorb some of it.
+
+### Tier 3 (<0.3)
+
+7. "system design" — supportable via iSAQB CPSA-F but risky next to an R1 gap; probably leave.
+8. Cadence 58% vs the ~50% guide. **Do not chase this.** The residual flags are legitimate technology
+   enumerations, and the §7a checker cannot distinguish those from rhetorical tricolons.
+
+### Deliberately NOT to be added
+
+- **"scalable"** — an unverified scale claim. `ai_fingerprint_rules.md` forbids converting scale into
+  personal impact, and `claims.json` marks all metrics unverified.
+- **SDK, high-throughput, data-intensive, simulation, model development, self-service** — zero
+  canonical evidence. Their absence is correct, not a defect.
+
+## 9. Cover Letter
+
+**Not generated.** Session decision is **YES**, and that still stands: the resume can carry PP-1 only
+as a compact block, and cannot explain *why* a Swisscom data engineer credibly wants a research-platform
+seat at a market maker. Against an ex-FAANG field that motivation is the main differentiator and it
+needs prose.
+
+**Does the resume stand alone?** Partly. It earns a Forward from a recruiter and a Maybe from a hiring
+manager on stack alignment. What it cannot do alone is answer "why us, and why would you leave a Staff
+seat for this" — which, given a cold channel, is the question that decides the screen.
+
+## 10. Mechanical Verification
+
+- ✅ `validate_resume_system.py --document` → PASS (1 cadence WARN)
+- ✅ Compiles, MiKTeX pdflatex, **exactly 2 pages**
+- ✅ Rendered PDF inspected: no clipping, overlap, orphaned heading or bad page break
+- ✅ Umlauts, `C\#`, `C++`, en-dashes all render correctly
+- ✅ Email matches `config.md` (`dennis@thiessen.io`)
+- ✅ No LOC counts, no test counts, no Security Champion, no forbidden tools
+- ✅ FIXED sections (Education, header block) untouched
+- ⚠️ `char_count.py` output unusable for bullets 9–12: its parser does not respect `rSubsection`
+  boundaries and bleeds following-section text into each position's last bullet. Pre-existing tool
+  limitation; rendered PDF used as authority instead.
+
+---
+
+## Verdict
+
+**Document Quality 86/100 · Evidence Fit 71/100 · Channel Weak · Practical gate UNRESOLVED.**
+
+The document is honest, clean and well-scoped, with no truth findings. Its one real weakness is that
+it under-uses the JD's own language for the very responsibility it matches best — three Tier 1 fixes,
+all honestly available, worth roughly +4.
+
+None of that changes the decision. **Document quality is not the constraint here; the working model
+and the cold channel are.** Do not treat 86 as submit-ready.
@@ -0,0 +1,57 @@
+% Citadel Securities — Platform Engineer, Research Platform Engineering (Zurich)
+% Cover Letter Decision: YES — domain transition needs explaining; the resume can carry PP-1
+% only as a compact block and cannot show why a Swisscom data engineer wants this seat.
+% Industry format per cl_reference.md: 3 short paragraphs, 200--300 words.
+% Hooks: JD text only (first-party, scraped verbatim). No named executives — cl_reference.md
+% says omit an unnecessary hook rather than spend words proving company familiarity.
+% Every claim traceable to the resume. PP-1: no performance figure, labelled personal.
+
+\documentclass[11pt,a4paper]{article}
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage{lmodern}
+\usepackage[a4paper,left=0.85in,right=0.85in,top=0.7in,bottom=0.7in]{geometry}
+\usepackage{parskip}
+\usepackage{xcolor}
+\usepackage{hyperref}
+\hypersetup{hidelinks}
+\pagestyle{empty}
+\setlength{\parindent}{0pt}
+
+\begin{document}
+
+{\Large\bfseries Dennis Thiessen, M.Eng.}\par
+Bern, Switzerland $\vert$
+\href{mailto:dennis@thiessen.io}{dennis@thiessen.io} $\vert$ +41 795 955 585 $\vert$
+\href{https://linkedin.com/in/dennis-thiessen}{LinkedIn}
+
+\vspace{1.5em}
+Research Platform Engineering\\
+Citadel Securities\\
+Zurich, Switzerland
+
+\vspace{1em}
+26 August 2026
+
+\vspace{1em}
+\textbf{Application for Platform Engineer, Research Platform Engineering}
+
+\vspace{0.8em}
+Dear Hiring Team,
+
+The posting describes data systems for ingestion, transformation, storage and lifecycle management of large datasets, built so that researchers can work without fighting their infrastructure. That is my day job. At Swisscom I am Component Owner for business-critical Fulfillment ETL -- a distributed system across Oracle, Kafka, Python and Teradata -- and I build the governed data products that analytics and AI teams consume. I carry the data quality and the on-call pager for that estate, which is a different relationship to a system than having built it and moved on.
+
+What draws me to research platform work specifically is that I already build this kind of system for myself. Outside work I built a self-hosted equity signal platform: it ingests daily prices, fundamentals and sentiment, runs a long-only cross-sectional momentum book through scheduled scan and backtest pipelines, and surfaces the gated setups to a dashboard. It is a personal system, not a production service, and I make no claims for its results. But it is the reason I understand what a researcher actually needs from a platform -- fast iteration, reproducible runs, and trust that the data underneath is right -- rather than knowing it only as a requirements document.
+
+I should be straightforward about the shape of my experience: I have built and operated data products and pipelines on a platform, not authored a research platform at firm scale. That step is the reason the role interests me, and the operational judgement I would bring to it is real. I am based in Bern, hold EU citizenship and a Swiss B permit, and need no sponsorship.
+
+\vspace{0.8em}
+I would welcome the chance to talk.
+
+\vspace{1em}
+Kind regards,
+
+\vspace{1.5em}
+Dennis Thiessen
+
+\end{document}
@@ -0,0 +1,92 @@
+% Citadel Securities — Platform Engineer, Research Platform Engineering (New York, Miami, Zurich)
+% Profile: International Tech, English, 2 pages. Generated 2026-08-26.
+% Generated from resume_builder/canonical/claims.json + normalized experience files.
+% Several tools named in the JD are non-canonical and are deliberately absent from this
+% document; they are listed and bridged in the session file's Gap Assessment. Do not
+% reintroduce them here, not even in a comment -- the validator scans raw file text.
+% JD qualifications 3 and 7 are disjunctive, so Python and AWS satisfy them alone.
+% PP-1 appears only under an explicitly labelled Personal Project heading; claims.json
+% forbids calling it distributed/production/multi-user or quoting ANY performance figure.
+
+\documentclass{resume}
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage{lmodern}
+\usepackage[a4paper,left=0.65in,right=0.65in,top=0.55in,bottom=0.55in]{geometry}
+\usepackage{xcolor}
+\usepackage{hyperref}
+\hypersetup{hidelinks}
+\usepackage[version=4]{mhchem}
+\usepackage{fancyhdr}
+\pagestyle{fancy}
+\fancyhf{}
+\renewcommand{\headrulewidth}{0pt}
+\fancyfoot[R]{\small \thepage/\pageref{LastPage}}
+
+\name{Dennis Thiessen, M.Eng.}
+\headline{Staff Data Engineer $\vert$ Production Data Platforms on AWS $\vert$ Kafka $\cdot$ Kubernetes $\cdot$ Spark}
+\contactline{Bern, Switzerland $\vert$ \href{mailto:dennis@thiessen.io}{dennis@thiessen.io} $\vert$ +41 795 955 585 $\vert$ \href{https://linkedin.com/in/dennis-thiessen}{LinkedIn}}
+
+\begin{document}
+
+\begin{rSection}{Summary}
+Staff data engineer who builds and runs the pipelines and governed data products that analytics and AI consumers depend on, on AWS and Kubernetes at Swisscom, with Component Ownership covering data quality, incidents and on-call duty. Earlier work at Bosch tuned query performance over Oracle and Hadoop/Impala for semiconductor analysis teams and moved containerized ML inference into a continuously operating fab.
+\end{rSection}
+
+\begin{rSection}{Technical Skills}
+\skillline{Programming}{Python, SQL, PySpark; Java and C\# (professional, historical); C++ (limited historical use)}
+\skillline{Distributed systems}{Apache Kafka, Apache Airflow, Spark/PySpark, distributed databases (Teradata, Redshift, Athena/Iceberg), ETL/ELT, data modelling, query performance tuning, Oracle, Hadoop/Impala}
+\skillline{Cloud and platform}{AWS (S3, Glue, Athena/Iceberg, Redshift, Lambda, Step Functions), CloudFormation, Kubernetes, Docker, GitLab CI/CD, Ansible}
+\skillline{Reliability and operations}{Production operation and on-call, SLOs, incident and root-cause analysis; Grafana, Prometheus, ELK (proof of concept)}
+\skillline{Trading domain (self-directed)}{Systematic/quantitative trading concepts, factor construction, backtesting -- personal project and coursework only, no professional experience}
+\skillline{Certifications}{AWS Solutions Architect -- Associate; Data Engineering with AWS; iSAQB CPSA-F; ITIL Foundation}
+\end{rSection}
+
+\begin{rSection}{Professional Experience}
+
+\begin{rSubsection}{Swisscom (Schweiz) AG}{Oct 2023 -- Present}{Staff Data, Analytics \& AI Engineer (promoted from Senior, Apr 2025)}{Bern, Switzerland}
+\item Build and model governed data products within Swisscom's company-wide Data Mesh, from source-system ingestion through to the metadata and lineage in Atlassian Compass that keep each product discoverable across its lifecycle.
+\item Component Owner for business-critical Fulfillment ETL -- a distributed system spanning Oracle, Kafka, Python and Teradata -- accountable for its data quality, governance and on-call operation.
+\item Migrated owned Fulfillment and Product Analysis pipelines onto Swisscom's AWS platform -- transformation and storage on Glue, Athena with Apache Iceberg and Redshift, orchestration in Airflow -- contributing to the wider company migration programme.
+\item Develop and operate Python data applications on Kubernetes, delivered through GitLab CI/CD from automated test to production support.
+\item Translate stakeholder and product-owner requirements into delivered data products; run root-cause analysis in 2nd- and 3rd-level support.
+\end{rSubsection}
+\end{rSection}
+
+\newpage
+
+\begin{rSection}{Professional Experience (continued)}
+\begin{rSubsection}{Robert Bosch Semiconductor Manufacturing Dresden GmbH}{Feb 2020 -- Dec 2022}{Senior Engineer, Data Analysis (Data Engineering)}{Dresden, Germany}
+\item Developed data services in Python, Java and C\# over Oracle and Hadoop/Impala, tuning query performance for analysis teams working with semiconductor defect records, wafer inspection images and process-control electrical parameters.
+\item Integrated containerized ML inference with Docker, Kubernetes and Ansible into a continuously operating semiconductor fab, replacing manual image-based defect classification.
+\item Built an anomaly-detection proof of concept on Elasticsearch, Logstash, Kibana and Kafka, with Grafana and Prometheus monitoring for continuously running manufacturing systems.
+\item Served as Application Owner for analytics applications and their upstream pipelines, defining SLOs and coordinating vendors, user training and documentation.
+\end{rSubsection}
+
+\begin{rSubsection}{Fraunhofer CML}{Sep 2018 -- Oct 2019}{Research Software Engineer}{Hamburg, Germany}
+\item Developed containerized microservices for the MISSION maritime research data-exchange platform.
+\end{rSubsection}
+
+\begin{rSubsection}{Vizrt}{Jul 2017 -- May 2018}{Test Automation / DevOps Engineer}{Bergen, Norway}
+\item Contributed Python and C++ engineering to a distributed video-transcoding backend.
+\end{rSubsection}
+
+\begin{rSubsection}{Generali Deutschland Informatik Services GmbH}{May 2015 -- Jun 2017}{IT Consultant}{Hamburg, Germany}
+\item Introduced BDD test automation through a proof of concept and held technical responsibility for the suite and its Jenkins jobs.
+\end{rSubsection}
+
+\end{rSection}
+
+\begin{rSection}{Personal Project}
+\compactentry{Equity Signal Platform -- self-hosted, single-user}{Personal project}
+Ingests daily US-equity prices, fundamentals and LLM-assisted sentiment; runs one long-only cross-sectional momentum book (residual 12-1 momentum, ATR stop and trail, at most 15 concurrent positions) through scheduled scan and backtest pipelines; surfaces the gated setups in a web dashboard and Telegram alerts. Built end to end as a personal system, not a production or multi-user service. Supporting coursework: Udacity \textit{AI for Trading} nanodegree (factor construction, alpha signals, backtesting).
+\end{rSection}
+
+\begin{rSection}{Education}
+\compactentry{M.Eng. Computer Aided Engineering (Software Design \& Engineering), Universität der Bundeswehr München}{Apr 2012 -- Oct 2013}
+Thesis at Tongji University, Shanghai: \textit{Development of a Web-Based Remote Fault Diagnosis System}; grade 1.0.
+
+\compactentry{B.Eng. Information and Telecommunication Technologies, Universität der Bundeswehr München}{Oct 2009 -- Oct 2012}
+\end{rSection}
+
+\end{document}
@@ -0,0 +1,59 @@
+\ProvidesClass{resume}[2026/07/27 Evidence-first professional resume]
+\LoadClass[11pt,a4paper]{article}
+
+\RequirePackage{enumitem}
+\RequirePackage{ifthen}
+\RequirePackage{lastpage}
+\RequirePackage{parskip}
+\RequirePackage{needspace}
+
+\pagestyle{empty}
+\setlength{\parindent}{0pt}
+
+\def\@resumename{}
+\def\@resumeheadline{}
+\def\@resumecontact{}
+
+\newcommand{\name}[1]{\def\@resumename{#1}}
+\newcommand{\headline}[1]{\def\@resumeheadline{#1}}
+\newcommand{\contactline}[1]{\def\@resumecontact{#1}}
+
+\newcommand{\printresumeheader}{%
+  {\LARGE\bfseries \@resumename}\par
+  \vspace{0.15em}
+  \ifthenelse{\equal{\@resumeheadline}{}}{}{\@resumeheadline\par}
+  \vspace{0.1em}
+  {\small \@resumecontact}\par
+  \vspace{0.45em}
+}
+
+\AtBeginDocument{\printresumeheader}
+
+\newenvironment{rSection}[1]{%
+  \vspace{0.35em}
+  {\bfseries #1}\par
+  \vspace{0.1em}\hrule\vspace{0.35em}
+}{%
+  \vspace{0.2em}
+}
+
+% Arguments: employer, dates, formal title, location.
+\newenvironment{rSubsection}[4]{%
+  \Needspace{6\baselineskip}%
+  {\bfseries #1}\hfill{\small #2}\par
+  {\itshape #3}\hfill{\itshape #4}\par
+  \vspace{0.1em}
+  \begin{itemize}[leftmargin=1.25em,label=\textbullet,itemsep=0.18em,topsep=0.15em,parsep=0pt,partopsep=0pt]
+}{%
+  \end{itemize}
+  \vspace{0.25em}
+}
+
+\newcommand{\skillline}[2]{%
+  \textbf{#1:} #2\par
+  \vspace{0.08em}
+}
+
+\newcommand{\compactentry}[2]{%
+  \textbf{#1}\hfill #2\par
+}
@@ -0,0 +1,395 @@
+# Session: Citadel Securities — Platform Engineer, Research Platform Engineering
+
+## JD Integrity
+
+- File/source: `JD_CitadelSecurities_PlatformEngineer.txt` (this folder) — copied from `JDs/JD_CitadelSecurities_PlatformEngineer.txt`
+- Source URL: https://www.citadelsecurities.com/careers/details/platform-engineer/
+- Retrieval method and date: Playwright headless (chromium) via `job_scout/.venv`, 2026-08-25. **WebFetch returns HTTP 403 on this host** — Cloudflare-protected; do not use WebFetch here.
+- Verbatim posting: YES — full visible posting body, unedited except removal of site navigation chrome.
+- Posting status: **LIVE as of 2026-08-25.** Verified independently of the detail page: the role appears in the site's Zurich location filter, which returns 10 open Zurich roles. Board total 81 open roles.
+- Locations: **New York, Miami, Zurich** (JD body: "in Miami, Zurich or New York")
+- Team: Research Platform Engineering
+- **Evergreen caveat:** the posting carries standing-req boilerplate — *"Opportunities may be available from time to time in any location in which the business is based for suitable candidates… we will contact you if there is a vacancy available."* Most likely a continuously-open multi-location req. Less deadline pressure; higher chance of landing in a resume pool rather than against a named opening.
+- **Sibling reqs are dead — do not chase them.** Web results surfaced "Research Platform – Data Platform Engineer" (a closer title match) and "Research Platform Infrastructure Engineer" via Built In. Checked 2026-08-25: the first returns **HTTP 404**, the second is Cloudflare-blocked and absent from the live board. Those Built In listings are stale. **Platform Engineer is the live req.**
+
+## Application Decision
+
+- Audience profile: **International Tech, English** (config default). US market maker, English working language, ex-Google Zurich office. No Swiss/DACH conventions, no photo.
+- Evidence Fit: **71/100** (revised down from 74 on 2026-08-26 — see Working Model below)
+- Fit class: **Adjacent (mid-band)**
+- Hard gate: **QUALIFICATIONS PASS, but a PRACTICAL CONSTRAINT IS UNRESOLVED** — `critique_framework.md` flags a NO-GO when "location… or mandatory relocation is unresolved." The Zurich working model is unknown and the evidence points to 5-day onsite. **Resolve before Phase 2.**
+- Channel Strength: **Weak (cold)** — no named contact on the posting, no known connection. Would be the 5th consecutive cold-channel application.
+- Cohort slot: Adjacent would be **2/2** (Aker BP holds 1/2). Note: a strict reading of `application_strategy.md` would class this **Stretch** (0/1 free) — see Gap Assessment.
+- Decision: **PENDING USER** — Phase 0 only, per user instruction. Phase 1 not started.
+
+## Requirements
+
+### Minimum qualifications — zero Gaps
+
+| # | JD requirement | Class | Evidence |
+|---|---|---|---|
+| Q1 | Bachelor's in CS or related field | **Direct** | B.Eng. Information & Telecommunication Technologies + M.Eng. Computer Aided Engineering (Software Design & Engineering), UniBw München |
+| Q2 | 3+ years professional software engineering | **Direct** | ~11 years (2015–present) |
+| Q3 | Strong programming in Python, **or** Go, **or** C++, or similar systems-oriented languages | **Direct** | Python `production-current`. Disjunctive requirement — Python alone satisfies it. C++ is `production-historical-limited` / `allowed-with-context`; usable as secondary colour only, never headlined |
+| Q4 | Building **and operating** distributed systems in production | **Direct** | Kafka, Kubernetes, Spark, Airflow carrying production traffic at Swisscom; Component Owner with data quality, incident handling and on-call (SW-1) |
+| Q5 | Designing scalable backend services, APIs, and data-intensive applications | **Adjacent** | Data-intensive applications Direct (BS-2 data services over Oracle/Hadoop; SW-4 Python data apps on K8s). Backend services/APIs partial. **SDKs: no evidence** |
+| Q6 | Strong understanding of distributed systems, data-intensive applications, system design fundamentals | **Adjacent** | iSAQB CPSA-F (software architecture) + AWS SA-Associate + production operation. But "distributed systems" as a *design discipline* has no canonical entry — 0 hits in `claims.json` |
+| Q7 | Cloud platforms (AWS, GCP, Azure) and modern infrastructure | **Direct** | AWS `production-current`. Disjunctive — AWS alone satisfies. (GCP and Azure are `forbidden` in `claims.json`; never list them) |
+
+### Preferred ("is a plus") — complete hit
+
+| JD | Class | Evidence |
+|---|---|---|
+| Kafka | **Direct** | `production-current` |
+| Kubernetes | **Direct** | `production-current-and-historical` |
+| Spark | **Direct** | PySpark `production-current` |
+| Airflow | **Direct** | `production-current` |
+| Distributed databases | **Direct** | Teradata, Redshift, Athena/Iceberg |
+
+**All five preferred technologies are Direct.** This is the strongest raw stack alignment in the application log.
+
+### Core responsibilities
+
+| # | JD responsibility | Class | Note |
+|---|---|---|---|
+| R1 | **Design and build distributed platforms and services** supporting quantitative research, simulations, AI-powered applications | **Adjacent** | Title-defining. He builds governed data products and pipelines *on* Swisscom's platform; authoring research-platform infrastructure at firm scale is a genuine stretch. **This is the risk.** |
+| R2 | Develop scalable platform services and **data systems for ingestion, transformation, storage and lifecycle management of large datasets** | **Direct** | Also title-defining, and a plain description of SW-1 / SW-7 |
+| R3 | Backend services, APIs and **SDKs** for researcher productivity and self-service | **Adjacent** | Data products for downstream self-service is adjacent; SDKs are a Gap |
+| R4 | Improve **performance, reliability, scalability** of critical research systems in **high-throughput** environments | **Adjacent** | Query performance tuning (BS-2), SLOs (BS-3), on-call reliability (SW-1). "High-throughput" in the HFT sense is not evidenced |
+| R5 | Collaborate with researchers to translate requirements into production-ready systems | **Direct** | SW-8 stakeholder requirements; Bosch delivery to analysis teams |
+
+## ATS Keywords
+
+- **Languages:** Python, C++ (context only), SQL
+- **Distributed/infra:** distributed systems, Kubernetes, Kafka, Spark, Airflow, containerization, CI/CD
+- **Data:** data platform, ingestion, transformation, storage, lifecycle management, large datasets, data-intensive applications, distributed databases, ETL/ELT, data modelling, query performance
+- **Cloud:** AWS, S3, Glue, Athena, Iceberg, Redshift, Lambda, Step Functions, CloudFormation
+- **Systems:** scalability, reliability, performance, backend services, APIs, production operation, on-call
+- **Domain:** quantitative research, simulations, backtesting, analytics workflows, model development
+- **Deliberately absent (no evidence):** Go, SDK authoring, low-latency/HFT, GCP, Azure, Terraform
+
+## Gap Assessment
+
+**Four real gaps, in severity order:**
+
+1. **Platform authoring at firm scale (R1) — the decisive one.** The JD wants someone to *design and build the platform researchers use*. Dennis owns components, pipelines and data products *within* Swisscom's company-wide Data Mesh. `CLAUDE.md` Scope Discipline forbids pairing a full-ownership verb with an org-scale object, so this gap **cannot be written around** — it can only be honestly bridged. Same shape as the Aker BP framework-authorship stretch (which scored 79 and still went out as Adjacent).
+2. **No professional quantitative/finance domain.** Now partially mitigated by **PP-1** (self-built momentum/signal platform) and **PP-2** (Udacity AI for Trading nanodegree), added to `claims.json` 2026-08-25. These are genuine self-directed depth — "residual 12-1 momentum, ATR stop/trail, quintile gating" is not JD-scraped vocabulary. But PP-1 is single-user and self-hosted: **never call it distributed, production or multi-user, and never quote a PnL, Sharpe, return or backtest figure.**
+3. **SDKs — no evidence at all.** 0 hits in `claims.json`. Appears in R3 only, not in the minimum quals, so it is not a gate.
+4. **Low-latency / high-throughput systems.** 0 canonical hits. The only throughput reference is the M.Eng. thesis, which `claims.json` `thesis_limits` explicitly flags as a methods prototype with no operational data — **not usable as high-throughput evidence.**
+
+**Non-gaps — do not score these as gaps:**
+- **Go.** Q3 is disjunctive ("Python, Go, **or** C++"). Python satisfies it. The "systems-oriented languages" phrasing is a cultural signal about the room, not a requirement.
+- **Distributed systems experience (Q4).** A production Kafka/K8s/Spark/Airflow estate *is* a distributed system. Do not undersell this.
+
+**Hard-gate verdict: PASS, with a flagged risk.** No minimum qualification is a Gap. This is materially cleaner than the AWS FDE NO-GO, where the title-defining capability was a flat Gap that `claims.json` globally forbids claiming. Here the title-defining function **splits**: R2 Direct, R1 Adjacent.
+
+**Classification caveat, stated plainly:** `application_strategy.md` says *"Stretch: below 60 **or a defining responsibility is only Adjacent**."* R1 is a defining responsibility and is Adjacent, so a strict reading classes this **Stretch**, not Adjacent. It is recorded as Adjacent because R2 — equally title-defining — is Direct, and because the Aker BP precedent (identical authoring-vs-building shape) was recorded as Adjacent at 79. **Both cohort slots are free either way**, so the label does not block the decision. Flagging it so the choice is deliberate, not accidental.
+
+## Working Model — UNRESOLVED, decision-blocking (raised by user 2026-08-26)
+
+**The JD is silent.** Grep of the verbatim posting for hybrid / remote / onsite / in-office /
+days per week / office returns **zero matches**. Phase 0 scored practical constraints 5/5 by
+assuming Zurich was workable; that assumption was unexamined and is now withdrawn.
+
+**Evidence, and its quality:**
+
+| Source | Says | Reliability |
+|---|---|---|
+| Ken Griffin, on record (Fortune 2023, repeated since) | Brought Citadel back **5 days a week**, early and against the grain; calls it his most important leadership decision; all employees in office full-time; remote work "hinders innovation" and costs early-career development | **High** — founder/CEO, on record, repeated, framed as core culture not policy |
+| Fishbowl post, Nov 2022 | "usually 3 days minimum… depends on your manager" | **Low** — anonymous, 4 years stale, Operations not Engineering, contradicted by the CEO |
+| Citadel Securities Zurich official policy | Not found | — |
+
+**Consequence if 5-day onsite is correct:** Bern → Zurich is ~1h each way, so ~2–2.5h commuting
+per day, five days a week — or relocation to Zurich. That breaks the standing constraint
+(`user_comp_bar`: Bern-based, hybrid max 2–3 days) and `user_international_mobility` ("keep a
+Swiss home base", no relocation).
+
+**Scoring impact:** Practical constraints **5/5 → 2/5** (language and authorization remain clean:
+English working language, EU citizen + Swiss B permit). Evidence Fit **74 → 71**. Still Adjacent,
+now mid-band rather than one point below Core.
+
+**This must be ASKED, not researched** — same class of question as the SBB Anforderungsniveau K
+band. No amount of further searching produces an authoritative answer for the Zurich office
+specifically, and the cost of guessing wrong is a full package plus a process built on a
+commute the user has already declined elsewhere.
+
+**Recommended sequence: resolve this BEFORE Phase 2, not after.** The SBB package was submitted
+with its equivalent question still open, and that question is now a live screening topic instead
+of a settled fact. Repeating that pattern here would be a deliberate choice, not an oversight.
+
+## Company Context
+
+- **Citadel Securities** — technology-driven global market maker (equities, options, fixed income). Distinct from Citadel LLC, the hedge fund. Institutional and retail liquidity provision.
+- **Zurich office:** Klausstrasse 4, 8008 Zurich. Founded 2019. **Heavily ex-Google.** Platform research is led by **Costas Bekas**, former IBM distinguished researcher. **Ferenc Tóth joined June 2026** as a software engineer on the platform research team, from seven years as a Google staff engineer. Principal research is headed by **Nicolai Meinshausen**, the ETH statistician (returned August 2025).
+- **What the Zurich office actually is:** of 10 open Zurich roles, the large majority are quant researchers, ML researchers and quant interns — mostly PhD-gated. Platform Engineer is one of only ~3 experienced non-quant engineering seats there. It is a research-first office, and platform engineering exists to serve researchers.
+- **Role purpose (JD's own words):** systems that "power large-scale simulations, analytics, and model development" and let researchers "transform data into actionable insights and alpha-generating trading strategies." Platform work here is directly revenue-attached, which is unusual and worth understanding before an interview.
+- **Why them angle:** research-serving data platform work, at a firm where the platform's quality visibly determines research throughput — a sharper version of what he does at Swisscom, in a domain he already follows privately.
+
+## Framing Strategy
+
+- **Lead narrative:** *A production data-platform engineer who builds and operates the ingestion, transformation and storage systems analytical consumers depend on — and who independently built an end-to-end equity signal platform because the domain genuinely interests him.*
+- **Reframing map:**
+  - SW-1 / SW-7 → R2 (ingestion/transformation/storage/lifecycle at scale). **Strongest single mapping; lead with it.**
+  - SW-4 (Python apps on K8s + GitLab CI/CD) + Kafka/Spark/Airflow → Q4 distributed systems in production.
+  - BS-2 (data services over Oracle/Hadoop, query performance tuning) → Q5 data-intensive applications + R4 performance.
+  - BS-3 (Application Owner, SLOs, vendor coordination, training) → R4 reliability + R5 collaboration.
+  - PP-1 + PP-2 → domain credibility for R1's *"quantitative research, simulations"* and R3's self-service surfaces.
+- **Emphasize:** production ownership and on-call (they run revenue systems); the exact Kafka/K8s/Spark/Airflow/AWS stack; self-service data products for downstream consumers; genuine domain interest via PP-1.
+- **Downplay:** Data Mesh governance vocabulary (enterprise-flavoured, not their register); Spotfire/BI; ITIL; anything reading as enterprise-IT process.
+- **Never claim:** authoring/owning a company-wide platform; distributed-systems *design* at firm scale; SDK authoring; low-latency/HFT experience; professional quant work; any PP-1 performance number.
+- **Level note:** JD states "Bachelor's, 3+ years" — he is *above* the stated bar at Staff + Component Owner. Do not down-level the framing to match the JD's floor; the $175k–350k base band is wide enough to span several levels.
+
+## Critique Context
+
+- **Reviewer persona:** a platform engineer or eng manager on Research Platform Engineering — likely ex-Google/ex-big-tech, systems-oriented, in a research-first office. Reads for distributed-systems depth and production instinct, not for enterprise process maturity.
+- **Competitive landscape:** brutal. Citadel Securities' engineering bar is among the highest in the market, and the Zurich office is visibly staffed from Google and academia. Realistic competition is ex-FAANG infrastructure engineers and systems specialists. Dennis's differentiator is not raw systems pedigree — it is production data-platform ownership plus real domain interest.
+- **Domain vocabulary to get right:** alpha, signal, backtest, simulation, cross-sectional momentum, factor, research throughput, market making. Using these correctly is credibility; using them loosely is worse than not using them.
+- **Likely probes:** (1) "Describe a distributed system you designed" — the weakest ground, prepare an honest scoped answer about pipeline architecture rather than claiming platform authorship; (2) "What's your throughput/latency experience?" — genuinely thin, do not bluff; (3) PP-1 — expect real interest and real scrutiny, and expect to be asked about results, which must be answered honestly as "not a validated track record".
+- **Compensation caution:** the **$175,000–350,000 base range in the posting is a US pay-transparency disclosure** (NY law) and says nothing about the Zurich figure. Do not plan against it. Citadel Securities Zurich very likely clears the CHF 180k all-in bar, but that is inference, not evidence — ask.
+
+## Cover Letter Decision
+
+- **Decision: YES (recommended), if Phase 1 proceeds.**
+- Rationale: this is the rare case where a letter carries information the resume structurally cannot. The resume can list PP-1 only as a compact project line; it cannot convey *why* a Swisscom data engineer credibly wants a research-platform seat at a market maker. The domain-interest story is the single strongest differentiator against an ex-FAANG competitive field, and it needs prose.
+- Institution type: US market maker, research-first office. Register: direct, technical, unsentimental. No enterprise formality, no Swiss/DACH conventions.
+- Structure: (1) what he builds now, mapped to R2 in their words; (2) production ownership and on-call as the reason he thinks about reliability the way a revenue-system team does; (3) PP-1/PP-2 as honest self-directed domain grounding — explicitly labelled a personal project, no numbers; (4) short close on Zurich, no relocation needed, EU citizen + Swiss B permit.
+- Length: 1 page, 4 short paragraphs.
+- **Hard constraints:** never imply professional quant experience; never quote a PP-1 result; never claim platform authorship; check `bundle_data_engineer.md` §S5 before reuse — its opening hook contained an SW-1 scope violation (fixed 2026-08-21, but verify).
+
+## Resume Plan (Phase 1 — proposed 2026-08-26, awaiting confirmation)
+
+Bundle: **`bundle_data_platform.md`** primary (Tier 3), `bundle_data_engineer.md` secondary.
+Format: 2-page resume, International Tech, English.
+Bullet lengths: **natural** per `resume_reference.md` §7 — the SKILL.md "all bullets 2L" line is stale,
+superseded by the 2026-07-27 global correction. §7a cadence variety applies.
+
+### Swisscom — Staff Data, Analytics & AI Engineer (5 bullets)
+
+| | ID | Achievement | JD match |
+|---|---|---|---|
+| * | SW-7 | Governed data products in the company-wide Data Mesh; onboard sources; metadata + lineage in Atlassian Compass | **R2 Direct** — lifecycle mgmt; R3 self-service |
+| * | SW-1 | Migrated owned Fulfillment/Product Analysis pipelines onto AWS (Glue, Athena/Iceberg, Redshift, Airflow, CloudFormation) | **R2 Direct**, Q7 cloud |
+| * | SW-2 | Component Owner, business-critical Fulfillment ETL (Oracle/Kafka → Teradata): data quality, governance, incidents, on-call | **Q4 Direct**, R4 reliability |
+| * | SW-3 | Build and operate Python data applications on Kubernetes with GitLab CI/CD | **Q4 Direct**, Q5 backend services |
+| o | SW-4 | Deliver data products and analyses with internal stakeholders; translate requirements | R5 Bridge |
+
+### Bosch Semiconductor Dresden — Senior Engineer, Data Analysis (4 bullets)
+
+| | ID | Achievement | JD match |
+|---|---|---|---|
+| * | BS-2 | Data services in Python/Java/C# over Oracle and Hadoop/Impala; **query performance tuning**; fab sensor/process data | **Q5 Direct**, R4 performance |
+| * | BS-1 | Integrated containerized ML inference (Docker/K8s/Ansible) into a 24/7 fab | **Q4 Direct**, R1 "AI-powered applications" |
+| * | BS-4 | ELK/Kafka anomaly-detection PoC with Grafana/Prometheus/Loki monitoring | Kafka Direct, R4 reliability |
+| o | BS-3 | Application Owner: SLOs, vendor coordination, training and documentation | R4 + R5 Bridge |
+
+### Vizrt — Test Automation / DevOps Engineer (1 bullet) — **user decision needed**
+
+| | ID | Achievement | JD match |
+|---|---|---|---|
+| ? | VZ-1 | Contributed **Python and C++** engineering to a **distributed video-transcoding backend** | **Q3 C++ bonus + Q4/Q6 distributed** |
+| x | VZ-2 | Automated A/V integration tests as CI/CD quality gates | Weak for this JD |
+
+**VZ-1 is unusually well-matched to this specific JD** — it is the only canonical evidence that pairs
+C++ with a genuinely distributed backend, which is exactly Q3's bonus clause plus Q6. **But the user
+explicitly skipped the Vizrt low-latency angle on the Snowflake package.** Raising it rather than
+assuming. Verb must stay hedged ("contributed"); broadcaster names are `forbidden`.
+
+### Fraunhofer CML — Research Software Engineer (1 bullet)
+
+| | ID | Achievement | JD match |
+|---|---|---|---|
+| * | FC-3 | Developed containerized microservices for the MISSION **research** data-exchange platform | R1/R3 Bridge — closest canonical analogue to "research platform" |
+| o | FC-1 | Jenkins CI/CD setup | Weaker here than FC-3 |
+
+### Generali (0–1 bullets)
+
+| | ID | Achievement | JD match |
+|---|---|---|---|
+| x | GN-1 | BDD test automation PoC, Jenkins ownership, training | Weak — recommend omit |
+
+### Selected Project — PP-1 (1–2 bullets) — **new section, structural decision needed**
+
+| | ID | Achievement | JD match |
+|---|---|---|---|
+| * | PP-1 | Self-built equity signal platform: price/fundamental/sentiment ingestion, cross-sectional momentum book, scheduled scan + backtest pipelines, dashboard + alerts | **Domain credibility for R1 "quantitative research, simulations"** |
+| o | PP-2 | Udacity *AI for Trading* nanodegree | Certification-context only |
+
+The current 2-page template has **no Projects section**. Adding one is a Phase 2 structural change.
+PP-1 is the main differentiator against an ex-FAANG field, so it should appear — but it must be
+labelled a personal project, and `claims.json` forbids calling it distributed/production/multi-user
+or quoting any PnL, Sharpe, return or backtest figure.
+
+### Budget
+
+| Set | Bullets |
+|---|---|
+| Recommended (`*`) | **11** |
+| With `o` options (SW-4, BS-3, PP-2) | 14 |
+| Target (`resume_reference.md` §4) | 11–14 |
+
+**Budget: PASS** at both ends.
+
+### Forced exclusions (provenance)
+
+- **SW-5 Security Champion** — omit by default; JD has no security requirement.
+- **SW-8 LLM work** — configuration-level only; `forbidden` to imply built/deployed LLM systems. LLM
+  sentiment in PP-1 is fine as personal-project scope.
+- **GCP / Azure / Terraform / TypeScript / FastAPI** — `forbidden` in `claims.json`; never list even
+  though the JD names GCP and Azure (Q7 is disjunctive; AWS satisfies it).
+- **M.Eng. thesis throughput figure** — barred by `thesis_limits`; not usable as high-throughput evidence.
+
+## Output Files
+
+- `e2e_citadel_securities_platform_engineer_resume.tex` / `.pdf` — 2 pages, 13 bullets
+- `e2e_citadel_securities_platform_engineer_cover_letter.tex` / `.pdf` — 1 page, 270 words, 3 paragraphs
+- `resume.cls` (copied from templates)
+- `JD_CitadelSecurities_PlatformEngineer.txt` — verbatim posting
+
+**Phase 2 decisions taken (user said "lets build the resume" without answering the two open items):**
+- **VZ-1 included.** Only canonical evidence pairing C++ with a distributed backend; this JD names
+  both explicitly. Hedged verb "Contributed" per `claims.json`; no broadcaster names. Reversible.
+- **Personal Project section added** for PP-1, labelled three ways (heading, right-aligned
+  "Personal project", and "not a production or multi-user service" in the body). No performance
+  figure of any kind. PP-2 appears as "Supporting coursework", never as a credential.
+- **Generali kept** with one bullet, against the Phase 1 "omit" recommendation — omitting it left an
+  unexplained May 2015–Jun 2017 employment gap, which costs more than the weak bullet does.
+
+**Verification:**
+- `validate_resume_system.py --document` → **PASS**, 1 warning (cadence, see below)
+- Compiled with MiKTeX pdflatex, **exactly 2 pages**, rendered PDF inspected: no clipping, orphans,
+  header wrapping or bad breaks; umlauts, `C\#` and `C++` all render correctly
+- Page 2 fills well; page 1 has bottom whitespace from the deliberate `\newpage`. Not padded —
+  `resume_reference.md` §9: "Do not add content merely to reduce bottom whitespace."
+
+**Known residual — cadence 7/12 (58%), above the §7a ~50% guide.** Reduced from 75% by reshaping two
+bullets. The remaining flags are almost all legitimate technology enumerations ("Oracle, Kafka,
+Python and Teradata"; "Elasticsearch, Logstash, Kibana and Kafka"). **The §7a checker cannot
+distinguish a rhetorical rule-of-three from a list of tools actually used** — a real limitation of
+the pattern. Cutting these would mean deleting accurate, ATS-relevant technology names, which §7a
+itself forbids ("never trade accuracy… to fix cadence"). Left as-is deliberately.
+
+**Trap hit and fixed during generation:** the first draft named the non-canonical tools in a header
+comment explaining why they were excluded. The validator scans **raw file text**, so it errored on
+all three. This is the exact failure the SBB `.tex` header warns about. Comment rewritten without
+naming them.
+
+## Edit History
+
+### Edit 1 (2026-08-26): Tier 1 relevance fixes
+
+- **Source:** `critique_citadel_securities_platform_engineer.md` Tier 1 items 1-3. User approved
+  "tier 1 fixes" only; the Tier 2 headline retitle was deliberately NOT applied.
+- **Changes (all MODIFY, no budget change):**
+  1. SW-7 bullet -> now carries **ingestion** and **lifecycle**: "from source-system ingestion
+     through to the metadata and lineage in Atlassian Compass that keep each product discoverable
+     across its lifecycle."
+  2. SW-1 bullet -> now carries **transformation** and **storage**: "transformation and storage on
+     Glue, Athena with Apache Iceberg and Redshift, orchestration in Airflow". Scope hedge
+     ("contributing to the wider company migration programme") retained.
+  3. SW-2 bullet -> names the estate a **distributed system** he operates, not designed.
+  4. Skills line 2 relabelled **"Distributed systems"** and now names **distributed databases
+     (Teradata, Redshift, Athena/Iceberg)** - closes the fifth preferred-technology hit that Phase 0
+     claimed as Direct but the document never wrote.
+- **Not added, deliberately:** scalable (unverified scale claim), SDK / high-throughput /
+  data-intensive / simulation / model development / self-service (zero canonical evidence).
+  Verified still absent after the edit.
+- **Verification:** validator **PASS, 0 warnings** (the cadence warning cleared as a side effect -
+  restructuring SW-1/SW-2 with em-dashes broke the comma-list pattern). Compiles to exactly
+  **2 pages**, zero overfull/underfull boxes, PDF re-inspected clean.
+
+| Metric | Before | After | Delta |
+|---|---|---|---|
+| Pages | 2 | 2 | 0 |
+| Validator errors | 0 | 0 | 0 |
+| Validator warnings | 1 (cadence 58%) | **0** | -1 |
+| Bullets | 13 | 13 | 0 |
+| JD term coverage | 19/37 (51%) | **25/37 (68%)** | +6 |
+
+**Estimated Document Quality ~91/100** (relevance 10 -> ~14, mechanics 9 -> 10). Estimate only -
+not a re-scored critique.
+
+## Status
+
+- Phase 0: **DONE** (2026-08-25)
+- Phase 1: **DONE** (2026-08-26) — 13 bullets confirmed
+- Phase 2: **DONE** (2026-08-26) — resume compiled and verified
+- Cover Letter: **DONE** (2026-08-26) — 1 page, 270 words, 3 paragraphs, validator PASS.
+  No external hooks by design (`cl_reference.md`: omit an unnecessary hook); the only hook is the
+  JD's own first-party language. States the R1 gap plainly rather than hiding it. PP-1 labelled
+  personal with an explicit "I make no claims for its results".
+- Critique: **STALE by design** — scored 86/100 on the pre-Edit-1 resume and before the cover
+  letter existed. User elected to submit as-is rather than re-critique (2026-08-26). Estimated
+  post-edit Document Quality ~91; not re-scored, and that estimate must not be quoted as a score. — **Document Quality 86/100**, Evidence Fit 71, Channel Weak.
+  No Tier 1 truth findings; validator PASS. Three Tier 1 relevance fixes (~+4), all honestly
+  available: (1) R2's own vocabulary — ingestion/transformation/storage/lifecycle — is absent
+  despite R2 being the single Direct core responsibility; (2) "distributed systems" never appears
+  as a phrase though Q4 is a required qual scored Direct; (3) "distributed databases" claimed as a
+  Direct preferred hit but never written. File: `critique_citadel_securities_platform_engineer.md`
+- **STILL BLOCKED on the working-model question** — resume built at user direction with that
+  question open. If Zurich is 5-day onsite, this package does not get submitted.
+## SUBMITTED 2026-08-26 — and a finding that outranks the working-model question
+
+**Application sent.** Cohort entry and decision log both recorded.
+
+### The form had no Zurich option
+
+The user reports that the application form's **preferred-work-location selector offered no Zurich**,
+despite:
+
+- the JD body reading "in Miami, **Zurich** or New York";
+- the posting header listing "New York, Miami, **Zurich**";
+- the site's own **Zurich location filter returning this exact req** (verified 2026-08-25, 10 Zurich roles).
+
+The careers site footer reads **"Citadel Enterprise Americas LLC"**, so the most likely explanation is
+that the apply flow is a US-entity form and European seats route elsewhere — or that the Zurich seat
+is closed while the multi-location posting has not been updated. A form bug is possible but least likely.
+
+**Consequence.** This partly supersedes the working-model risk. If there is no Zurich seat reachable
+through this form, whether Zurich is hybrid or 5-day onsite is moot — the application may be sitting
+against a US requisition, which is a hard NO on relocation (`user_international_mobility`: no
+relocation, keep a Swiss home base).
+
+**Carry-forward rule for any future Citadel Securities application: check the application form's
+location selector BEFORE investing in a package.** The posting's stated locations and the site's own
+filter both proved unreliable as evidence that a Zurich seat is actually reachable.
+
+### Expectation
+
+User submitted with low effort on the form fields and low expectation of a reply. That is a
+reasonable read: cold channel, an evergreen standing req, an ex-Google/ETH-staffed office, and now a
+location mismatch in the apply flow itself.
+
+### Package status
+
+Documents are finished and reusable. Nothing about the package is the weak point here — the resume
+and letter both cleared the validator with zero warnings and the Tier 1 fixes lifted JD coverage
+51% → 68%. If a better-matched Citadel or market-maker req appears, the package retargets cheaply.
+
+## Finalization (2026-08-26)
+
+Per `shared_ops.md` → Finalization:
+
+1. ✅ Session, resume `.tex`/`.pdf`, critique all present
+2. ✅ Cover letter `.tex`/`.pdf` present (session decision YES)
+3. ✅ Canonical validator re-run on **both** submitted documents → **PASS, 0 warnings each**
+4. ✅ Final PDFs copied to `Dennis_Thiessen_Resume.pdf` and `Dennis_Thiessen_Cover_Letter.pdf`
+5. ✅ **Submission recorded 2026-08-26** in `job_scout/state/decisions.json`
+6. ✅ **Cohort entry added** — Adjacent **2/2** (cohort now 4/10; channel weak ×3)
+
+**On confirmation of submission, run both:**
+
+```
+./job_scout/.venv/Scripts/python.exe resume_builder/helpers/cohort_tracker.py add   --company "Citadel Securities" --role "Platform Engineer, Research Platform Engineering (Zurich)"   --date <YYYY-MM-DD> --fit-class adjacent --evidence-fit 71 --channel weak   --hard-gate pass --outcome applied
+
+./job_scout/.venv/Scripts/python.exe job_scout/scout.py --decide   "https://www.citadelsecurities.com/careers/details/platform-engineer/" applied "<note>"
+```
+
+**Carry-forward risk — unchanged by submission.** The Zurich working model is still unknown and the
+evidence points to 5-day onsite. **Ask it in the first recruiter contact.** If it is 5 days, this is
+a decline on the Bern constraint regardless of how the process goes.
+
+- Next: ask the working-model question at first contact; record submission when sent
+- Resume: PENDING
+- Cover Letter: PENDING (decision YES)
+- Critique: PENDING
+- Next: user decision on whether to proceed
@@ -0,0 +1,130 @@
+https://jobs.admin.ch/offene-stellen/devops-engineer-iii-data-platform/752ded37-1753-4ac8-946a-b0c958d4424a
+
+DevOps Engineer III (Data Platform) - Schweizer Armee - Kommando Cyber Kdo Cy
+-->
+Übersicht
+Kontakt
+Über uns
+Benefits
+Ähnliche Stellen
+                            Stellen teilen
+                            Drucken    
+                            Job-Abo einrichten
+                            Später bewerben
+Interessiert?
+Möchten Sie sich bewerben? Dann senden Sie sich die Stelle per E-Mail zu und bewerben Sie sich bequem von zu Hause aus.
+E-Mail
+Link senden
+                                Der Link zu dieser Stelle wurde an die eingegebene E-Mail-Adresse verschickt.
+DevOps Engineer III (Data Platform)
+Die Schweiz mitgestalten
+DevOps Engineer III (Data Platform)
+Schweizer Armee - Kommando Cyber Kdo Cy
+Zimmerwald | 80-100% (Jobsharing möglich)
+Eintrittsdatum:
+nach Vereinbarung
+Anstellungsart:
+unbefristet
+Referenz-Nr.:
+JRQ$540-19848
+Arbeitsort:
+Eichacher, 3086 Wald
+Diesen Beitrag kannst du leisten
+Moderne IaC- und GitOps-Lösungen planen, implementieren und betreiben sowie den gesamten Deployment-Zyklus verantworten
+MLOps-Umgebungen für das Deployment, Monitoring und den zuverlässigen Betrieb von KI- und Machine-Learning-Modellen entlang ihres gesamten Lebenszyklus bis hin zur GPGPU-Hardware entwerfen, betreiben, automatisieren und weiterentwickeln
+Komplexe Linux-Systemlandschaften für den Ende-zu-Ende-Betrieb einer IKT-Schicht für eine Datenplattform administrieren, warten und kontinuierlich optimieren, um einen stabilen und performanten Betrieb sicherzustellen
+Linux-Systeme ganzheitlich administrieren, Performance optimieren sowie System-Hardening und Security-Konfigurationen umsetzen
+Monitoring-, Logging- und Observability-Lösungen betreiben, weiterentwickeln und optimieren, um einen zuverlässigen Systembetrieb sicherzustellen
+Die physische Infrastruktur im Rechenzentrum mit Server-, Netzwerk- und Datacenter-Komponenten betreuen sowie Installationen und Wartungsarbeiten unterstützen
+Das macht dich einzigartig
+Abgeschlossene Ausbildung im IT-Bereich HF/FH sowie mehrere Jahre Praxis im Engineering und im Betrieb von komplexen IT Systemen
+Fundierte DevOps-Kompetenz durch mehrjährige Erfahrung im Aufbau, Betrieb und in der Automatisierung moderner Linux-Infrastrukturen sowie umfassende Kenntnisse in Infrastructure-as-Code, GitOps und zugehörigen Prozessen
+Streben nach Exzellenz mit hoher Lernbereitschaft und Offenheit für ganzheitliche, elegante IKT-Lösungen sowie innovative Ansätze abseits des Mainstreams wie Dhall, Pull-GitOps und «Dew-» sowie «Fog-Computing»-Paradigmen
+Hands-on-Mentalität sowie eine selbstständige und teamorientierte Persönlichkeit mit Freude an der Arbeit über den gesamten Technologie-Stack hinweg – von der physischen Infrastruktur im Rechenzentrum bis hin zu automatisierten Plattform- und Big-Data-Umgebungen wie ClickHouse und Kafka
+Ein tadelloser Leumund sowie die Fähigkeit, sich in ein nachrichtendienstliches Umfeld zu integrieren und dabei jederzeit diskret zu handeln, werden vorausgesetzt
+Aktive Kenntnisse einer zweiten Amtssprache sowie gute Englischkenntnisse
+Auf den Punkt gebracht
+Du bist Teil eines Data-Science-Teams im Bereich der Verarbeitung von erfassten zivilen und militärischen Kommunikationsdaten. Die daraus gewonnenen nachrichtendienstlichen Erkenntnisse unterstützen den NDB und den MND und leisten damit einen wichtigen Beitrag zur Sicherheitspolitik der Schweiz. Als DevOps Engineer III bist du fachlich mitverantwortlich für den Entwurf, die Umsetzung und den Betrieb einer grossen, verteilten Dateninfrastruktur.
+Eintrittsdatum:
+nach Vereinbarung
+Anstellungsart:
+unbefristet
+Referenz-Nr.:
+JRQ$540-19848
+Arbeitsort:
+Eichacher, 3086 Wald
+Fragen zur Stelle
+Marcel Matthey-Doret
+                            Chef Centers of Excellence CEA
+                            +41 58 46 78409
+                                        Jetzt bewerben
+Sind Sie aktuell beim Bund angestellt? 
+                                                        Ja
+                                                    Nein
+Fragen zur Stelle
+Marcel Matthey-Doret
+Chef Centers of Excellence CEA
+41 58 46 78409
+Auf den Punkt gebracht
+Du bist Teil eines Data-Science-Teams im Bereich der Verarbeitung von erfassten zivilen und militärischen Kommunikationsdaten. Die daraus gewonnenen nachrichtendienstlichen Erkenntnisse unterstützen den NDB und den MND und leisten damit einen wichtigen Beitrag zur Sicherheitspolitik der Schweiz. Als DevOps Engineer III bist du fachlich mitverantwortlich für den Entwurf, die Umsetzung und den Betrieb einer grossen, verteilten Dateninfrastruktur.
+Dein Einsatz für Sicherheit und Freiheit
+Das Kommando Cyber (Kdo Cy) steht für Kompetenz in den Bereichen Cyber und Digitalisierung. Wir vereinen die Begeisterung für unsere Aufgabe mit Know-how, Innovation, modernsten Technologien und agilen Arbeitsweisen. Wir erbringen sichere, robuste und resiliente Informatikleistungen für die Schweizer Armee und unsere Partner im Sicherheitsverbund Schweiz. Damit ermöglicht das Kdo Cy der Schweizer Armee den notwendigen Wissens- und Entscheidvorsprung – für eine sichere Schweiz.
+Die Schweizer Armee beschäftigt über 9'000 Mitarbeitende in vier militärischen und rund 200 zivilen Berufen – und dies an 110 Standorten schweizweit. Auch für den Nachwuchs ist gesorgt: Die Schweizer Armee bildet in über 30 Berufen Lernende aus.
+Weiter
+Zurück
+                                Link zu mehr Informationen
+Das bieten wir
+#F7B4B8
+Arbeiten für die Schweiz
+Wir setzen uns für das Erfolgsmodell Schweiz ein und arbeiten zum Wohl der Bevölkerung.
+#F7B4B8
+Arbeiten für die Schweiz
+Wir setzen uns für das Erfolgsmodell Schweiz ein und arbeiten zum Wohl der Bevölkerung.
+#B8E1D8
+Gelebte Vielfalt
+Dank Chancengleichheit entfalten wir unsere Kompetenzen und bringen unterschiedliche Perspektiven ein.
+#B8E1D8
+Gelebte Vielfalt
+Dank Chancengleichheit entfalten wir unsere Kompetenzen und bringen unterschiedliche Perspektiven ein.
+#FFF0BB
+Gesund am Arbeitsplatz
+Wir unterstützen und beraten unsere Mitarbeitenden im Bereich der physischen und psychischen Gesundheit.
+#FFF0BB
+Gesund am Arbeitsplatz
+Wir unterstützen und beraten unsere Mitarbeitenden im Bereich der physischen und psychischen Gesundheit.
+ Alle Benefits
+Fragen zur Stelle
+Marcel Matthey-Doret
+Chef Centers of Excellence CEA
+41 58 46 78409
+                            Jetzt bewerben
+                                Jetzt bewerben
+Sind Sie aktuell beim Bund angestellt? 
+                                                        Ja
+                                                    Nein
+                    -->
+Zusätzliche Informationen
+Eine Anstellung bei der Schweizer Armee macht Sinn und bringt viele Vorteile mit sich. Überzeuge dich auf 
+armee.ch/vorteile
+.
+Interessiert an Jobsharing? Du kannst dich einzeln oder mit Partner/-in bewerben. Auch wenn ihr euch im Duo bewerbt: Reicht eure Bewerbungen einzeln ein und gebt den Namen der Partnerin/des Partners im Bewerbungskonto an.
+Angebote von Personalvermittlern werden nicht berücksichtigt.
+Die nächsten Schritte
+Frauen sind in unserer Verwaltungseinheit noch untervertreten. Ihre Bewerbungen sind daher besonders willkommen.
+Ähnliche Stellen
+Staatssekretariat für Wirtschaft SECO
+ICT DevOps Engineer Data & Analytics Senior
+Bern, Schweiz | 100-100% (Jobsharing möglich)
+Bundesamt für Informatik und Telekommunikation BIT
+ICT-System-Ingenieur/-in Senior Container Plattform
+Zollikofen, Schweiz (und Homeoffice) | 80-100%
+Bundesamt für Informatik und Telekommunikation BIT
+Datenbank-Administrator/-in Senior (1025)
+Zollikofen, Schweiz (und Homeoffice) | 80-100%
+Rechtliche Grundlagen
+                       Job-Abo einrichten
+Rechtliche Grundlagen
+                                    Jetzt bewerben
+Sind Sie aktuell beim Bund angestellt? 
+                                                            Ja
+                                                        Nein
@@ -0,0 +1,156 @@
+# Critique v3: Kdo Cy, DevOps Engineer III (Data Platform)
+
+**Stand:** 27. August 2026, nach Edit 2 mit Bundeswehr-Offizierslaufbahn und vollständigem Sprachpass.
+
+> **Submission note, 27. August 2026:** Der Nutzer hat die Bewerbung nach Prüfung dieser Critique als gut genug bewertet und unverändert eingereicht. Der Tier-1-Fund zu *„ohne manuellen Eingriff“* bleibt als bekannte, bewusst akzeptierte Abweichung dokumentiert; er wurde nicht nachträglich aus den eingereichten Dokumenten entfernt.
+
+| Achse | Aktuelles Ergebnis |
+|---|---|
+| Evidence Fit | **79/100, Core (unterer Bereich)** |
+| Hard Gate | **PASS** |
+| Document Quality | **92/100** |
+| Channel Strength | **Weak** |
+| Einreichungsstatus | **Noch nicht freigeben: ein Tier-1-Claim muss korrigiert werden** |
+
+Die Offizierslaufbahn ist ein echter Differenzierungsfaktor für diesen Arbeitgeber. Sie verbessert die Glaubwürdigkeit der Motivation und die militärische Anschlussfähigkeit, ersetzt aber keine technische Militär-, Nachrichtendienst- oder Clearance-Evidenz. Deshalb bleibt der Evidence-Fit-Score nach unabhängiger Neubewertung bei 79.
+
+## 1. Fit Verdict und Hard-Gate-Audit
+
+**Verdict: Core, Hard Gate PASS.** Dennis deckt den Titelkern inzwischen ausreichend ab: professionelle Linux-Administration und Ansible-Automatisierung bei Bosch, aktueller Datenplattformbetrieb bei Swisscom, Kubernetes/CI/CD, Kafka, Observability und containerisiertes ML-Deployment. Die einzelnen Belege liegen nicht alle in derselben aktuellen Rolle, ergeben zusammen aber ein belastbares DevOps-/Data-Platform-Profil.
+
+| Bereich | Einstufung | Begründung |
+|---|---|---|
+| IT-Abschluss und Betrieb komplexer Systeme | Direct | M.Eng.; langjährige Engineering- und Betriebspraxis |
+| Linux-Infrastruktur und IaC | Direct-to-Adjacent | Bosch Linux/Ansible sowie CloudFormation sind Direct; das vom JD genannte Pull-GitOps bleibt Gap |
+| MLOps und GPGPU | Adjacent | Produktive ML-Inferenzintegration ist stark; GPGPU und vollständiger ML-Lebenszyklus sind nicht belegt |
+| Data Platform und Big Data | Direct-to-Adjacent | Kafka, Datenstrecken, AWS, Hadoop/Impala und Data Products sind Direct; ClickHouse fehlt |
+| Physische Rechenzentrumsarbeit | Gap | Kein belegter Umgang mit Server-, Netzwerk- oder Datacenter-Hardware |
+| Nachrichtendienstliches Umfeld / PSP | Constraint, geklärt | Deutsche Staatsangehörigkeit und B-Bewilligung sind laut Nutzerangabe zulässig; eine PSP wird nicht behauptet |
+| Zweite Amtssprache | Soft Gap | Vom Nutzer als Wunschkriterium geklärt; bleibt ein Wettbewerbsvorteil anderer Kandidaten |
+| Militärischer Kontext | Adjacent | Sechsjährige Offizierslaufbahn ist Direct als Organisationskontext, aber kein Nachweis für Nachrichtendienst, Cyber, Einsatz oder Clearance |
+
+Der weiterhin offene physische Datacenter-Anteil ist ernst, aber nicht allein titeldefinierend. Die Dokumente behandeln ihn korrekt als Motivation und nicht als vorhandene Berufserfahrung.
+
+## 2. Evidence Fit
+
+| Dimension | Gewicht | Score | Begründung |
+|---|---:|---:|---|
+| Required qualifications | 35 | **30** | Abschluss, Engineering, Linux/IaC und Englisch sind stark; Pull-GitOps, physische Infrastruktur und zweite Amtssprache bleiben schwächer |
+| Core responsibilities | 25 | **19** | Betrieb, Automatisierung, MLOps, Datenplattform und Observability sind belegt; RZ-Hardware, GPGPU und vollständiges GitOps fehlen |
+| Level and ownership | 15 | **10** | Component Owner und Application Owner passen; Engineer III wirkt gegenüber aktuellem Staff-Scope lateral bis leicht darunter |
+| Recency and depth | 10 | **9** | Kubernetes, Kafka, Python, AWS und CI/CD sind aktuell; die tiefste Linux-/Ansible-Evidenz endet 2022 |
+| Domain/tool transfer | 10 | **7** | Impala/Oracle übertragen sich auf ClickHouse-Grundmuster; CI/CD ist kein Pull-GitOps. Die Offizierslaufbahn stärkt den Kontext, nicht die technische Funktionsdeckung |
+| Practical constraints | 5 | **4** | Kurzer Arbeitsweg, Arbeitserlaubnis und unbefristete Stelle passen; Lohnklasse und Level bleiben offen |
+| **Total** | **100** | **79** | **Core, unterer Bereich; Hard Gate PASS** |
+
+## 3. Document Quality
+
+| Dimension | Gewicht | Score | Begründung |
+|---|---:|---:|---|
+| Truth and provenance | 25 | **23** | Fast alle Claims sind sauber scoped. Ein absoluter Ergebnisclaim bei Bosch überschreitet die kanonische Evidenz und ist Tier 1 |
+| Information hierarchy | 20 | **19** | Zielprofil, Swisscom, Linux/Ansible und Bundeswehr-USP sind sofort sichtbar. Das Kurzprofil belegt allerdings fünf gerenderte Zeilen statt der vorgesehenen zwei bis drei |
+| Bullet evidence and impact | 20 | **17** | Technisch konkret und ownership-sicher; kaum verifizierte Kennzahlen. Einige Bullets sind listenlastig, der Bosch-Resultatclaim ist zu absolut |
+| Relevance and terminology | 15 | **14.5** | Sehr gute Deckung von Linux, IaC, MLOps, Deployment, Kafka, Observability und Betrieb; echte Gaps werden nicht mit Keywords kaschiert |
+| Skills evidence | 10 | **9.5** | Alle sichtbaren Skills sind belegbar und nach Quelle kontextualisiert; C++ und JavaScript wurden sinnvoll aus dem Skills-Block entfernt |
+| Mechanics and readability | 10 | **9** | Saubere PDFs, gute Extraktion, keine Box- oder Layoutfehler. Kleine Abzüge für eine unnatürliche IaC-Klammerung, listenreiche Kadenz und zwei aufeinanderfolgende `Entwickelte`-Einstiege |
+| **Total** | **100** | **92** | **Hohe Dokumentqualität, aber noch nicht freigabefähig wegen Tier 1** |
+
+## 4. Tier-1-Fund
+
+### Bosch: vollständige Eliminierung manueller Arbeit ist nicht belegt
+
+Aktuell steht:
+
+> „... ermöglichte damit die automatisierte bildbasierte Defektklassifikation **ohne manuellen Eingriff**.“
+
+`BS-1` belegt eine qualitative Reduktion manueller Klassifikation, ausdrücklich aber keinen genauen Umfang. „Ohne manuellen Eingriff“ behauptet eine vollständige Eliminierung und ist damit stärker als die kanonische Evidenz.
+
+**Sichere Korrekturrichtung:**
+
+> „... ermöglichte damit die automatisierte bildbasierte Defektklassifikation und reduzierte den manuellen Klassifikationsaufwand.“
+
+Das ist der einzige aktuelle Tier-1-Punkt. Nach der Korrektur müssen Validator, Kompilierung, Textextraktion und visuelle PDF-Prüfung erneut laufen.
+
+## 5. Competitive Read
+
+Der offensichtliche Konkurrenzkandidat ist ein Senior Linux-/DevOps-Engineer aus Bund, RUAG, armasuisse oder einem Schweizer ISP: aktuelle Linux-Fleet-Verantwortung, Pull-GitOps, Datacenter-Hardware, mögliche PSP-Erfahrung und Deutsch plus Französisch.
+
+Dennis gewinnt dagegen auf der Verbindung aus Data Platform, Kafka, produktivem Pipeline-Ownership, ML-Inferenzintegration, selbst entwickelten Ansible-Erweiterungen und echter militärischer Biografie. Die Offizierslaufbahn macht die Motivation für Kdo Cy deutlich glaubwürdiger als bei einem rein kommerziell geprägten Bewerber. Der Konkurrenzkandidat bleibt dennoch direkter auf den drei schwächsten Achsen: Datacenter, Pull-GitOps und zweite Amtssprache.
+
+## 6. Reader Sequence
+
+| Leser | Verdict | Wahrscheinlicher Eindruck |
+|---|---|---|
+| Parser / ATS | **Pass** | Arbeitgeber, Titel, Daten und Kernbegriffe werden sauber extrahiert |
+| Recruiter | **Forward** | Staff-Scope, lokale Verfügbarkeit, Deutsch, B-Bewilligung und Offizierslaufbahn ergeben eine plausible Kandidatur |
+| Hiring Manager | **Interview** | Bosch plus Swisscom decken den technischen Kern ausreichend; die Bundeswehr-Laufbahn stärkt Motivation und Umfeldfit |
+| Technical reviewer | **Interview mit Probeachsen** | Erste Fragen werden aktuelle Linux-Tiefe, Pull-GitOps-Abgrenzung, RZ-Hardware und die tatsächliche Wirkung der ML-Automatisierung betreffen |
+
+Die separate HR-Risikoachse bleibt **Borderline**: Lohnklasse, Engineer-III-Level und mögliche Überqualifikation sind nicht durch Textarbeit lösbar.
+
+## 7. Canonical Claim Audit
+
+| Claim im Paket | Evidenz | Einordnung | Sicher? | Massnahme |
+|---|---|---|---|---|
+| Über zehn Jahre technische Berufserfahrung | Employment history | Direct | Ja | Keine |
+| Sechsjährige Offizierslaufbahn, Lehrgang, Offizierschule, Leutnant | BW-1 | Direct | Ja | Keine Führung, Einsätze, Cyberarbeit oder Clearance ergänzen |
+| Swisscom Component Owner mit Betrieb, Datenqualität, Incidents und Pikett | SW-2 | Direct | Ja | Keine |
+| Python-Datenanwendungen auf Kubernetes mit GitLab CI/CD | SW-3 | Direct | Ja | Keine |
+| Migration der eigenen Domänenpipelines auf AWS | SW-1 | Direct, scoped | Ja | Objekt bleibt auf Fulfillment und Product Analysis begrenzt |
+| Data Products und Metadaten im unternehmensweiten Data Mesh | SW-7 | Direct, scoped | Ja | Keine Plattform-/Mesh-Ownership behaupten |
+| Linux-Administration und Ansible-Automatisierung bei Bosch | BS-6 | Direct | Ja | Keine Datacenter- oder Fleet-Scale-Zahl ergänzen |
+| Ansible-Credential-Plugin mit lokaler Zwischenspeicherung | BS-6 | Direct | Ja | Performance/Skalierbarkeit bleibt qualitativ |
+| ML-Inferenzintegration in laufender Halbleiterfertigung | BS-1 | Direct | Teilweise | **„ohne manuellen Eingriff“ entfernen** |
+| ELK/Kafka-PoC plus Monitoring/Logging/Alarmierung | BS-4 | Direct-to-Adjacent | Ja | PoC-Scope beibehalten |
+| Datenservices und Application-Owner-Verantwortung | BS-2, BS-3 | Direct | Ja | Keine |
+| Fraunhofer Microservices und Jenkins-CI/CD | FC-3, FC-1 | Direct | Ja | Keine |
+| Vizrt Backend-Komponenten und CI/CD-Quality-Gates | VZ-1, VZ-2 | Direct, komponentenspezifisch | Ja | Keine Kundenlieferung oder Gesamtsystem-Ownership ergänzen |
+| Generali BDD- und Jenkins-Verantwortung | GN-1 | Direct | Ja | Keine |
+| Privater Debian-Server, Härtung und Dienste | PP-3 | Direct, persönlich | Ja | Persönlichen, nicht betrieblichen Kontext beibehalten |
+| Motivation: Rückkehr in ein militärisches Umfeld und Beitrag zum Schutz der Schweiz | Nutzerintention plus BW-1 | Motivation, keine Leistungsbehauptung | Ja | Militärischen Kontext sprachlich präzisieren, siehe Tier 2 |
+
+## 8. Tiered Improvements
+
+### Tier 1
+
+1. Bosch-Bullet von der unbelegten vollständigen Automatisierung auf die belegte Reduktion manueller Klassifikation zurückstufen.
+
+### Tier 2
+
+1. **Kurzprofil komprimieren.** Die Sektorenliste ist weniger wertvoll als die bereits sichtbaren Arbeitgeber und macht aus dem Profil fünf gerenderte Zeilen. Ziel: drei bis vier Zeilen bei Erhalt von Swisscom, Bosch und Bundeswehr. Erwarteter Gewinn: **+0.5 DQ**.
+2. **IaC-Formulierung glätten.** „CloudFormation als Infrastructure as Code, IaC“ liest sich technisch korrekt, aber sprachlich konstruiert. Besser: „CloudFormation für Infrastructure as Code (IaC)“. Erwarteter Gewinn: **+0.2 DQ**.
+3. **Militärische Motivation präzisieren.** Im Brief „Rückkehr in ein vertrautes Umfeld“ zu „Rückkehr in ein mir vertrautes militärisches Umfeld“ ändern. Das verhindert, dass Bundeswehr und Schweizer Armee als dasselbe Umfeld gelesen werden. Erwarteter Gewinn: **+0.2 DQ**.
+
+### Tier 3
+
+1. Einen der unmittelbar aufeinanderfolgenden `Entwickelte`-Einstiege bei Fraunhofer/Vizrt variieren, ohne den Ownership-Grad zu erhöhen.
+2. Die Wiederholung von „wesentlicher Grund“ und „wesentlicher Reiz“ in zwei benachbarten Briefabsätzen glätten.
+3. Generali nur dann weiter kürzen, wenn zusätzlicher Platz benötigt wird. Der Eintrag hält die DACH-Chronologie nachvollziehbar und ist nicht schädlich.
+
+## 9. Cover-Letter Decision und Kritik
+
+**Decision: YES.** Das Motivationsschreiben erhöht den Wert des Pakets. Es ergänzt drei Dinge, die der Lebenslauf allein nicht leisten kann: die militärisch begründete Motivation, das persönliche Interesse am gesamten Stack und die praktische Passung mit Region Bern, B-Bewilligung und kurzem Arbeitsweg.
+
+Die technische Argumentation ist spezifisch für diese Stelle und bleibt evidenzsicher. Die Offizierslaufbahn wird weder zu Führungserfolgen noch zu Nachrichtendienst- oder Cybererfahrung aufgeblasen. Das Schreiben ist mit 300 Haupttextwörtern am oberen Rand der Normalspanne, aber auf einer gut lesbaren Seite. Löschen würde das Paket schwächen.
+
+Sprachlich ist der Brief deutlich natürlicher als vor Edit 2. Verbleibend sind nur die Tier-2-Präzisierung des „vertrauten Umfelds“ und kleine Wiederholungen. Keine Em-Dashes, kein generischer Unternehmenslob-Absatz und keine defensive Gap-Liste.
+
+## 10. Mechanical Verification
+
+- Kanonisches System und beide Dokumentvalidatoren: **PASS, 0 Warnungen**
+- LaTeX: Lebenslauf **2 Seiten**, Motivationsschreiben **1 Seite**
+- Logs: **0 overfull/underfull boxes**, keine LaTeX-Warnungen
+- PDF: A4, keine Überlappung, keine abgeschnittenen Zeilen, keine verwaisten Überschriften
+- Seitenzahlen: 1/2 und 2/2 vollständig innerhalb der Seitenkoordinaten
+- `pdftotext -layout`: Arbeitgeber, Titel, Orte und Zeiträume in korrekter Reihenfolge
+- Visuelle Prüfung: alle drei Seiten vollständig kontrolliert; Hierarchie, Abstände und Lesbarkeit sauber
+- Unicode-Prüfung: keine En-, Em- oder geschützten Dashes in den Quellen; LaTeX-Doppelhyphen nur für Datumsbereiche
+- AI-Fingerprint: keine auffälligen Gedankenstrichmuster oder generische Firmensprache; leichte Listen- und Verbkadenz bleibt ein kleiner Stilpunkt
+
+## Schlussurteil
+
+**Rollenfit:** 79/100, Core, Hard Gate PASS.  
+**Dokumentqualität:** 92/100.  
+**Channel:** Weak.
+
+Die inhaltliche Positionierung ist jetzt deutlich stärker: Die Bundeswehr-Laufbahn ist an den beiden richtigen Stellen sichtbar und bleibt zugleich beweissicher. Vor einer Einreichung ist genau ein inhaltlicher Fix erforderlich, danach sind nur noch optionale Tier-2-Politur und die telefonische Klärung von Lohnklasse und Level offen.
@@ -0,0 +1,55 @@
+% Kdo Cy: DevOps Engineer III (Data Platform). German-language Swiss/DACH letter.
+% Every claim traces to a resume bullet and a canonical ID. The second-Amtssprache point is
+% deliberately NOT raised: the user confirmed it is not a hard requirement, so naming it here
+% would hand the reader an objection, which was the Aker BP CL-A finding.
+
+\documentclass[11pt,a4paper]{article}
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage[ngerman]{babel}
+\usepackage{lmodern}
+\usepackage[a4paper,left=0.85in,right=0.85in,top=0.7in,bottom=0.7in]{geometry}
+\usepackage{parskip}
+\usepackage{xcolor}
+\usepackage{hyperref}
+\hypersetup{hidelinks}
+\pagestyle{empty}
+\setlength{\parindent}{0pt}
+
+\begin{document}
+
+{\Large\bfseries Dennis Thiessen, M.Eng.}\par
+Bern, Schweiz $\vert$
+\href{mailto:dennis@thiessen.io}{dennis@thiessen.io} $\vert$ +41 795 955 585 $\vert$
+\href{https://linkedin.com/in/dennis-thiessen}{LinkedIn}
+
+\vspace{1.5em}
+Schweizer Armee, Kommando Cyber\\
+Herr Marcel Matthey-Doret\\
+Eichacher, 3086 Wald
+
+\vspace{1em}
+\today
+
+\vspace{1em}
+\textbf{Bewerbung als DevOps Engineer III (Data Platform), Ref. JRQ\$540-19848}
+
+\vspace{0.8em}
+Sehr geehrter Herr Matthey-Doret
+
+Ihre Ausschreibung verbindet zwei Aufgaben, die mich fachlich besonders interessieren: den Betrieb einer Datenplattform mit MLOps-Umgebungen bis zur GPGPU-Hardware und die Administration der darunterliegenden Linux-Systeme. Bei Bosch arbeitete ich genau an dieser Schnittstelle. In der durchgehend laufenden Halbleiterfertigung waren robuste Automatisierung und klare Betriebsabläufe Voraussetzung. Dort integrierte ich containerisierte ML-Inferenz und administrierte die Linux-Systeme für die zugehörigen Workloads.
+
+Die Infrastrukturautomatisierung habe ich bei Bosch nicht nur eingesetzt, sondern erweitert. Die Ansible-Playbooks lagen in Git und wurden über Jenkins- und GitLab-Pipelines ausgeführt. Für wiederkehrende Engpässe entwickelte ich eigene Ansible-Erweiterungen, darunter ein Plugin, das Zugangsdaten aus einem Passwort-Keystore lokal zwischenspeichert und dadurch wiederholte Abrufe reduziert. Heute verantworte ich bei Swisscom als Component Owner geschäftskritische Datenstrecken mit Oracle, Kafka und Teradata, einschliesslich Pikettdienst und Datenqualität. Für mich gehört der Betrieb damit zur Entwicklung: Erst im laufenden Einsatz zeigt sich, ob eine Plattform trägt.
+
+Die Aufgabe hat für mich auch persönlich Gewicht. Ich diente sechs Jahre in der Bundeswehr, absolvierte den Offizieranwärterlehrgang und die Offizierschule und schied als Leutnant aus. Für die Schweizer Armee zu arbeiten wäre für mich eine Rückkehr in ein vertrautes Umfeld, nun mit meiner technischen Berufserfahrung. Zum Schutz der Schweiz und ihrer Bevölkerung beizutragen, ist ein wesentlicher Grund für meine Bewerbung.
+
+Die Arbeit über den gesamten Stack bis in den Serverraum ist für mich ein wesentlicher Reiz der Stelle. Seit rund zehn Jahren betreibe ich einen eigenen Debian-Server mit nginx, Mailserver, VPN und Docker-Diensten, samt Härtung und Updates, weil mich diese Arbeit interessiert. Ich bin deutscher Staatsangehöriger mit Schweizer B-Bewilligung. Deutsch ist meine Muttersprache, und ich lebe in der Region Bern. Zimmerwald wäre für mich ein kurzer Arbeitsweg und eine langfristige Perspektive.
+
+Ich freue mich auf die Gelegenheit zu einem Gespräch und darauf, mehr über die Rolle der Plattform im Zielbild Ihres Teams zu erfahren.
+
+Freundliche Grüsse
+
+\vspace{1.5em}
+Dennis Thiessen
+
+\end{document}
@@ -0,0 +1,93 @@
+% Kommando Cyber (Kdo Cy): DevOps Engineer III (Data Platform), Zimmerwald
+% German-language Swiss/DACH profile. Position titles stay English (user decision 2026-08-27).
+% Generated from claims.json only. New evidence this round: BS-6 (Linux estate + Ansible
+% extensions) and PP-3 (self-hosted Debian). The pull-reconciliation buzzword the JD uses is
+% forbidden by claims.json because execution was push-based from Jenkins/GitLab, so the Bosch bullet
+% states the mechanism literally instead.
+
+\documentclass{resume}
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage[ngerman]{babel}
+\usepackage{lmodern}
+\usepackage[a4paper,left=0.65in,right=0.65in,top=0.55in,bottom=0.55in]{geometry}
+\usepackage{xcolor}
+\usepackage{hyperref}
+\hypersetup{hidelinks}
+\usepackage[version=4]{mhchem}
+\usepackage{fancyhdr}
+\pagestyle{fancy}
+\fancyhf{}
+\renewcommand{\headrulewidth}{0pt}
+\fancyfoot[R]{\small \thepage/\pageref{LastPage}}
+
+\name{Dennis Thiessen, M.Eng.}
+\headline{Staff Data \& Platform Engineer $\vert$ Linux, Ansible, Kubernetes $\vert$ Datenplattformen, Produktionsbetrieb und ML-Deployment}
+\contactline{Bern, Schweiz $\vert$ \href{mailto:dennis@thiessen.io}{dennis@thiessen.io} $\vert$ +41 795 955 585 $\vert$ \href{https://linkedin.com/in/dennis-thiessen}{LinkedIn}}
+
+\begin{document}
+
+\begin{rSection}{Kurzprofil}
+Staff Engineer mit über zehn Jahren technischer Berufserfahrung in Telekommunikation, Halbleiterfertigung, Broadcast-Technologie und Versicherung sowie sechsjähriger Offizierslaufbahn bei der Bundeswehr. Verantwortet bei Swisscom geschäftskritische Datenstrecken und Kubernetes-Anwendungen im Produktivbetrieb. Administrierte und automatisierte zuvor bei Bosch Linux-Systeme für Analyse- und ML-Workloads und integrierte dort containerisierte ML-Inferenz in eine durchgehend laufende Halbleiterfertigung.
+\end{rSection}
+
+\begin{rSection}{Kenntnisse}
+\skillline{Programmiersprachen}{Python, SQL; Java und C\# aus früheren beruflichen Projekten}
+\skillline{Linux und Automatisierung}{Linux-Administration (Bosch), Systemhärtung (laufender Eigenbetrieb), Ansible einschliesslich eigener Erweiterungen, Jenkins, GitLab CI/CD, CloudFormation (IaC)}
+\skillline{Container, Cloud und MLOps}{Docker, Kubernetes, Microservices, MLOps (Deployment und Orchestrierung containerisierter ML-Inferenz), AWS (S3, Glue, Athena/Iceberg, Redshift)}
+\skillline{Daten und Observability}{Apache Kafka, Airflow, PySpark, Oracle, Teradata, Hadoop/Impala, Data Products und Metadaten; ELK, Grafana, Prometheus, Loki}
+\skillline{Zertifizierungen}{AWS Certified Solutions Architect (Associate); Data Engineering with AWS; iSAQB CPSA-F; ITIL Foundation}
+\skillline{Sprachen}{Deutsch (Muttersprache), Englisch (fliessend), Norwegisch und Russisch (Grundkenntnisse)}
+\end{rSection}
+
+\begin{rSection}{Berufserfahrung}
+
+\begin{rSubsection}{Swisscom (Schweiz) AG}{Okt. 2023 -- heute}{Staff Data, Analytics \& AI Engineer (seit Apr. 2025; zuvor Senior)}{Bern, Schweiz}
+\item Verantworte als Component Owner geschäftskritische ETL-Strecken der Fulfillment-Domäne mit Oracle, Kafka, Python und Teradata, einschliesslich Produktivbetrieb, Datenqualität, Governance, Störungsbearbeitung und Pikettdienst.
+\item Entwickle und betreibe Python-Datenanwendungen auf Kubernetes mit GitLab CI/CD, vom Container-Build über das Deployment bis zum laufenden Betrieb.
+\item Migrierte die Pipelines der Domänen Fulfillment und Product Analysis auf die AWS-Plattform (Glue, Athena mit Apache Iceberg, Redshift, Airflow und CloudFormation als Infrastructure as Code, IaC) und unterstützte damit das übergreifende Migrationsprogramm.
+\item Modelliere governance-konforme Data Products und pflege deren aktive Metadaten im unternehmensweiten Data Mesh, damit nachgelagerte Teams die Daten auffinden und einordnen können.
+\end{rSubsection}
+
+\begin{rSubsection}{Robert Bosch Semiconductor Manufacturing Dresden GmbH}{Feb. 2020 -- Dez. 2022}{Senior Engineer, Data Analysis (Data \& ML Engineering)}{Dresden, Deutschland}
+\item Integrierte containerisierte ML-Inferenz mit Docker, Kubernetes und Ansible in eine durchgehend laufende Halbleiterfertigung und ermöglichte damit die automatisierte bildbasierte Defektklassifikation ohne manuellen Eingriff.
+\item Administrierte und automatisierte die Linux-Serverlandschaft für Analyse- und ML-Workloads, darunter ML-Plattform, Docker-Hosts, Backend-Dienste und Ansible-Steuerung. Die Playbooks lagen in Git und wurden über Jenkins- und GitLab-Pipelines ausgeführt.
+\item Erweiterte Ansible unter anderem um ein Plugin für Zugangsdaten, das Secrets aus einem Passwort-Keystore abruft und lokal zwischenspeichert. Dies reduzierte wiederholte Keystore-Abfragen und verbesserte Performance und Skalierbarkeit.
+\item Implementierte einen Proof of Concept zur Anomalieerkennung mit ELK, Kafka und Docker sowie Monitoring, Logging und Alarmierung mit Grafana, Prometheus und Loki.
+\item Entwickelte Datenservices in Python, Java und C\# auf Basis von Oracle und Hadoop/Impala für Defect Management und Prozessanalyse.
+\item Verantwortete als Application Owner Analyseanwendungen und vorgelagerte Pipelines, einschliesslich SLOs, Anwenderschulung, technischer Dokumentation und Abstimmung mit Lieferanten.
+\end{rSubsection}
+
+\begin{rSubsection}{Fraunhofer CML}{Sep. 2018 -- Okt. 2019}{Research Software Engineer}{Hamburg, Deutschland}
+\item Entwickelte containerisierte Microservices für eine maritime Forschungsplattform und führte eigenständig eine Jenkins-CI/CD-Strecke mit Quality Gates ein.
+\end{rSubsection}
+
+\begin{rSubsection}{Vizrt}{Jul. 2017 -- Mai 2018}{Test Automation / DevOps Engineer}{Bergen, Norwegen}
+\item Entwickelte Python- und C++-Backend-Komponenten für ein verteiltes Video-Transcoding-System. Integrierte automatisierte Audio-/Video-Tests als Quality Gates in die CI/CD-Pipeline.
+\end{rSubsection}
+
+\begin{rSubsection}{Generali Deutschland Informatik Services GmbH}{Mai 2015 -- Jun. 2017}{IT Consultant}{Hamburg, Deutschland}
+\item Führte BDD-Testautomatisierung mit einem Proof of Concept ein und übernahm die technische Verantwortung für Testsuite und Jenkins-Jobs.
+\end{rSubsection}
+
+\begin{rSubsection}{Bundeswehr}{Juli 2008 -- Nov. 2014}{Offizieranwärter und Offizier (zuletzt Leutnant)}{Deutschland}
+\item Diente sechs Jahre in der Bundeswehr, absolvierte den Offizieranwärterlehrgang und die Offizierschule und schied als Leutnant aus.
+\end{rSubsection}
+
+\end{rSection}
+
+\begin{rSection}{Projekte}
+\begin{rSubsection}{Privater Debian-Server}{seit rund zehn Jahren}{Eigenbetrieb}{}
+\item Betreibe und administriere einen selbst gehosteten Debian-Server mit nginx, Mailserver, Nextcloud, VPN, Docker-Diensten und Bitwarden, inklusive Systemhärtung und Security-Konfiguration.
+\end{rSubsection}
+\end{rSection}
+
+\begin{rSection}{Ausbildung}
+\compactentry{M.Eng. Computer Aided Engineering}{Apr. 2012 -- Okt. 2013}
+Universität der Bundeswehr München, Schwerpunkt Software Design \& Engineering. Masterarbeit an der Tongji-Universität, Shanghai: \textit{Development of a Web-Based Remote Fault Diagnosis System}.
+
+\compactentry{B.Eng. Information and Telecommunication Technologies}{Okt. 2009 -- Okt. 2012}
+Universität der Bundeswehr München.
+\end{rSection}
+
+\end{document}
@@ -0,0 +1,59 @@
+\ProvidesClass{resume}[2026/07/27 Evidence-first professional resume]
+\LoadClass[11pt,a4paper]{article}
+
+\RequirePackage{enumitem}
+\RequirePackage{ifthen}
+\RequirePackage{lastpage}
+\RequirePackage{parskip}
+\RequirePackage{needspace}
+
+\pagestyle{empty}
+\setlength{\parindent}{0pt}
+
+\def\@resumename{}
+\def\@resumeheadline{}
+\def\@resumecontact{}
+
+\newcommand{\name}[1]{\def\@resumename{#1}}
+\newcommand{\headline}[1]{\def\@resumeheadline{#1}}
+\newcommand{\contactline}[1]{\def\@resumecontact{#1}}
+
+\newcommand{\printresumeheader}{%
+  {\LARGE\bfseries \@resumename}\par
+  \vspace{0.15em}
+  \ifthenelse{\equal{\@resumeheadline}{}}{}{\@resumeheadline\par}
+  \vspace{0.1em}
+  {\small \@resumecontact}\par
+  \vspace{0.45em}
+}
+
+\AtBeginDocument{\printresumeheader}
+
+\newenvironment{rSection}[1]{%
+  \vspace{0.35em}
+  {\bfseries #1}\par
+  \vspace{0.1em}\hrule\vspace{0.35em}
+}{%
+  \vspace{0.2em}
+}
+
+% Arguments: employer, dates, formal title, location.
+\newenvironment{rSubsection}[4]{%
+  \Needspace{6\baselineskip}%
+  {\bfseries #1}\hfill{\small #2}\par
+  {\itshape #3}\hfill{\itshape #4}\par
+  \vspace{0.1em}
+  \begin{itemize}[leftmargin=1.25em,label=\textbullet,itemsep=0.18em,topsep=0.15em,parsep=0pt,partopsep=0pt]
+}{%
+  \end{itemize}
+  \vspace{0.25em}
+}
+
+\newcommand{\skillline}[2]{%
+  \textbf{#1:} #2\par
+  \vspace{0.08em}
+}
+
+\newcommand{\compactentry}[2]{%
+  \textbf{#1}\hfill #2\par
+}
@@ -0,0 +1,278 @@
+# Session: Schweizer Armee — Kommando Cyber (Kdo Cy) — DevOps Engineer III (Data Platform)
+
+## JD Integrity
+- **File/source:** `JD_kdocy_devops_data_platform.txt` (this folder) — verbatim body of `https://jobs.admin.ch/offene-stellen/devops-engineer-iii-data-platform/752ded37-1753-4ac8-946a-b0c958d4424a`
+- **Retrieval method and date:** direct HTTP fetch of the Prospective-ATS detail page, HTML stripped, **2026-08-27**. Not reconstructed, not paraphrased.
+- **Verbatim posting:** YES
+- **Posting status:** LIVE 2026-08-27. Confirmed present in the portal's own `Kdo Cy` search result set the same day (11 Kdo Cy roles open).
+- **Source of the lead:** user, manually — `jobs.admin.ch` is **not** in the job_scout roster.
+
+## JD Info
+| Field | Value |
+|---|---|
+| Employer | Schweizer Armee — Kommando Cyber (Kdo Cy) |
+| Role | DevOps Engineer III (Data Platform) |
+| Reference | JRQ$540-19848 |
+| Arbeitsort | **Eichacher, 3086 Wald (Zimmerwald)** |
+| Pensum | 80–100%, Jobsharing möglich |
+| Anstellungsart | unbefristet |
+| Eintritt | nach Vereinbarung |
+| Deadline | none stated |
+| Contact | **Marcel Matthey-Doret, Chef Centers of Excellence CEA, +41 58 46 78409** |
+| Language of posting | German |
+
+## Application Decision
+- **Audience profile:** Swiss/DACH (German-language federal employer, German-language posting)
+- **Evidence Fit: 79/100 — Core (lower end)**. Trajectory, all on 2026-08-27: **55** as posted → **64** after the language/citizenship answers → **68** after the Ansible correction → **79** after the Linux-administration and Ansible-extension evidence. **The movement is KB repair, not re-framing** — two canonical blind spots (Ansible, Linux) were suppressing a real profile.
+- **Fit class: Core** (lower end, 75+)
+- **Hard gate: PASS.** All three original §1 triggers now cleared — see Gate Audit. Remaining honest weakness is **physical datacenter work (R6), a genuine Gap** that interest does not substitute for.
+- **Channel Strength:** Weak today; **upgradeable to Moderate** — the posting publishes a named contact with a direct number
+- **Channel plan:** phone Matthey-Doret **before** any document work — the same call resolves both gates
+- **Cohort slot:** recorded on submission in evidence-first-2026-01, now **5/10 applications and Core 3/7**. Adjacent remains 2/2 and Stretch 0/1.
+- **Decision: SUBMITTED 2026-08-27.** Evidence Fit 79/Core, hard gate PASS, Document Quality 92, channel Weak.
+
+## Gate Audit (`critique_framework.md` §1)
+**UPDATED 2026-08-27 — user-confirmed that neither the second Amtssprache nor Swiss citizenship is a hard requirement.** Two of three triggers cleared; one stands.
+
+- ✅ **CLEARED — second Amtssprache.** Confirmed a Wunschkriterium, not a filter. It stays a competitive disadvantage against a candidate who has French, and it is a plausible interview topic, but it no longer gates the application.
+- ✅ **CLEARED — citizenship.** A German citizen with a B permit is eligible. The PSP itself still happens; its level and timing are simply not disqualifying facts.
+- ✅ **CLEARED 2026-08-27 — the title-defining capability.** This was called a Gap on an incomplete KB. It was wrong. The role runs the Linux/IKT layer beneath a data platform, and the user in fact has: **~3 years of professional Linux estate administration and automation at Bosch** (ML platform hosts, Docker hosts, backend services, Ansible control — BS-6), **Ansible extension development** (a credential plugin with local caching to cut keystore lookups — infrastructure engineering, not tool usage), and **~10 years of continuous self-hosted Debian administration and hardening** (PP-3). The operating layer is **Adjacent-to-Direct**, not a Gap.
+- ⚠️ **REMAINING, and not to be papered over — R6 physical datacenter work.** Zero experience. The user states genuine interest, which honestly addresses the JD's *"Freude an der Arbeit über den gesamten Stack"* criterion — but interest is not experience, and the resume must not imply otherwise. This belongs in the cover letter as motivation, never in a bullet as evidence.
+
+### Original audit, retained for the record
+Three of the four NO-GO triggers fired as posted:
+
+1. **A required qualification is a Gap** — *"Aktive Kenntnisse einer zweiten Amtssprache"*. German is his native tongue and is itself an Amtssprache; the requirement is for a **second** one (French, Italian, Romansh). `claims.json` `identity.languages` = German native, English fluent, **Norwegian basic, Russian basic**. Neither is an Amtssprache. There is no bridge and nothing to write around. **Note:** `config.md` records that the Swisscom Zeugnis lists French and Italian as HR boilerplate and that this is **explicitly forbidden** on any document — so the one place those languages appear on paper is a known falsehood and must not be used here of all places.
+2. **The title-defining capability is not Direct** — the title is *DevOps Engineer (Data Platform)*, and the function as written is running the **IKT/Linux layer beneath** a data platform: whole-system Linux administration, performance tuning, hardening, plus physical datacenter duty. Dennis builds and owns **data products and pipelines on top of** managed platforms. Same authoring-vs-operating split as Aker BP, one layer lower.
+3. **Clearance is unresolved** — the posting requires the ability to integrate into a *nachrichtendienstliches Umfeld*, is silent on nationality, and he is a German citizen. Unresolved either way.
+
+## Requirements
+| # | Requirement (verbatim sense) | Req/Pref | Class | Canonical evidence | Gate? |
+|---|---|---|---|---|---|
+| Q1 | IT-Abschluss HF/FH + mehrere Jahre Praxis im Engineering und Betrieb komplexer IT-Systeme | Required | **Direct** | EDU-MENG (M.Eng., exceeds HF/FH); ~13 yrs across SWISSCOM/BOSCH/FRAUNHOFER/VIZRT | — |
+| Q2 | Fundierte DevOps-Kompetenz: Aufbau/Betrieb/Automatisierung **moderner Linux-Infrastrukturen**, umfassende Kenntnisse **IaC und GitOps** | Required | **Adjacent, upgraded 2026-08-27** | **IaC is Direct:** intensive Ansible work at Bosch plus production-current CloudFormation. **Linux administration is Direct via BS-6** and current personal hardening is PP-3. GitOps was clarified as Git-versioned, push-executed automation without a reconciliation agent; the named practice remains a Gap and the word stays forbidden. | ⚠ |
+| Q3 | Lernbereitschaft, Offenheit für Nicht-Mainstream-Ansätze (Dhall, Pull-GitOps, Dew-/Fog-Computing) | Required (attitude) | **Neutral** | Attitude criterion; the named technologies are exotic and no candidate will hold them | — |
+| Q4 | Hands-on über den ganzen Stack — **von physischer Infrastruktur im Rechenzentrum** bis Big-Data-Umgebungen **wie ClickHouse und Kafka** | Required | **Split** | **Kafka Direct** (production-current). ClickHouse: Gap but substitutable — BS-2 Oracle + Hadoop/Impala, SQL production-current. **Physical DC/server/network hardware: Gap, 0 evidence** | ⚠ |
+| Q5 | Tadelloser Leumund + Fähigkeit, sich in ein **nachrichtendienstliches Umfeld** zu integrieren — *"werden vorausgesetzt"* | Required | **Constraint — RESOLVED 2026-08-27** | Swiss citizenship confirmed not a hard requirement (user). German citizen + B permit is eligible; a PSP still runs | ✅ |
+| Q6 | **Aktive Kenntnisse einer zweiten Amtssprache** + gute Englischkenntnisse | Required | **Soft — RESOLVED 2026-08-27** | Confirmed not a hard requirement (user). English half Direct. Remains a competitive disadvantage and a likely interview question | ✅ |
+| R1 | IaC/GitOps planen, implementieren, betreiben; ganzen Deployment-Zyklus verantworten | Core resp. | **Adjacent** | SW-3, FC-1, VZ-2, CloudFormation and BS-6. The Ansible flow was version-controlled and CI-driven but push-based, not Pull-GitOps. | — |
+| R2 | **MLOps-Umgebungen** für Deployment, Monitoring, Betrieb von KI-/ML-Modellen **bis zur GPGPU-Hardware** | Core resp. | **Adjacent — strongest hook** | BS-1 (containerized ML inference integrated into a 24/7 semiconductor production environment) + SW-3. **GPGPU: Gap.** BS-1 forbids claiming model training or full-lifecycle ownership | — |
+| R3 | Komplexe **Linux-Systemlandschaften** für den E2E-Betrieb der IKT-Schicht einer **Datenplattform** | Core resp. | **Adjacent-to-Direct** | Data-platform operation is Direct through SW-1, SW-2 and SW-7; professional Linux-estate administration and automation is Direct through BS-6. The two layers are proven in different roles rather than as one current end-to-end platform. | — |
+| R4 | Linux ganzheitlich administrieren, Performance-Optimierung, **System-Hardening**, Security-Konfigurationen | Core resp. | **Adjacent-to-Direct — upgraded 2026-08-27** | **BS-6** (Bosch Linux estate: ML platform, Docker hosts, backend, Ansible control) + **PP-3** (~10 yrs self-hosted Debian: nginx, mail, Nextcloud, VPN, Docker, Bitwarden — administered and hardened). **Hardening evidence leans personal — state it as such**, never imply an employer mandate | — |
+| R5 | Monitoring-, Logging-, Observability-Lösungen betreiben und weiterentwickeln | Core resp. | **Direct-to-Adjacent** | BS-4 (ELK/Kafka anomaly-detection PoC + monitoring) — scoped as a PoC, **never** an enterprise observability platform | — |
+| R6 | Physische Infrastruktur im Rechenzentrum betreuen, Installationen und Wartung unterstützen | Core resp. | **Gap — remains** | 0 experience. User states genuine interest, which answers Q4's *Freude*-criterion honestly. **Cover letter as motivation; never a resume bullet** | ⚠ |
+
+## Evidence Fit Breakdown
+| Dimension | Weight | Score | Reasoning |
+|---|---:|---:|---|
+| Required qualifications | 35 | **30** | Q1 Direct, Q3 neutral, English Direct, **Q5 and Q6 resolved 2026-08-27**; Q4 remains split (physical DC absent); **Q2 improved — IaC is now Direct via Ansible + CloudFormation**, GitOps-as-practice and Linux depth still thin |
+| Core responsibilities | 25 | **19** | R2/R3/R4/R5 are Direct-to-Adjacent and R1 is Adjacent; **R6 physical datacenter work remains a Gap**. GPGPU and Pull-GitOps also remain unevidenced. |
+| Level and ownership | 15 | **10** | Engineer III vs current Staff/Engineer IV; Component Owner and Application Owner scope (SW-2, BS-3) comfortably covers the ownership asked. Reads lateral-to-slightly-below |
+| Recency and depth | 10 | **9** | Kubernetes, Kafka, Python, SQL, CI/CD all production-current. BS-1/BS-4 are the strongest role-specific proofs but date to Bosch, not today |
+| Domain/tool transfer | 10 | **7** | ClickHouse ← Impala/Oracle/SQL: yes. Git-versioned CI/CD automation transfers partly to GitOps concepts but is not Pull-GitOps. **Physical datacenter hardware and GPGPU are not substitutable.** Linux administration and hardening are now directly evidenced through BS-6 and PP-3. |
+| Practical constraints | 5 | **4** | Best commute in the entire log, unbefristet, 80–100%, language and citizenship both cleared. Held back only by **comp — the Lohnklasse is still unknown** |
+| **Total** | | **79** | **Core (lower end)** — 55 → 64 → 68 → **79**, every step a KB correction rather than a re-framing |
+
+**Current fit state after the full 2026-08-27 KB repair:** language and citizenship constraints are cleared, and Linux/IKT operation is now evidenced through BS-6 plus PP-3. The remaining evidence gaps are physical datacenter work, Pull-GitOps, GPGPU and ClickHouse by name. The resulting score is 79/Core.
+
+**Still open and unasked: compensation.** Bund Lohnklasse for a DevOps Engineer III is not public and must be asked, not researched — the same class as the SBB Anforderungsniveau K. Current comp is ~140k; the local tier permits near-current, not a steep cut.
+
+## ATS Keywords
+- **Direct, usable:** DevOps, CI/CD, GitLab CI/CD, Kubernetes, Docker, Container, Kafka, Python, SQL, Datenplattform, Data Platform, Data Pipelines, Monitoring, Logging, Observability, ELK, Automatisierung, Infrastructure as Code, CloudFormation, Deployment, AWS
+- **Bridge, use with care:** MLOps, ML-Inferenz im Produktivbetrieb, Betrieb 24/7, Datenqualität, Governance, On-Call, Incident
+- **Gap — do NOT seed:** GitOps, Dhall, Pull-GitOps, Dew-/Fog-Computing, ClickHouse, GPGPU, Rechenzentrumsbetrieb, Terraform, Zero Trust
+- **Forbidden here by `claims.json`/`config.md`:** French, Italian (Zeugnis boilerplate — a known falsehood), LangChain/LangGraph/LlamaIndex, Azure, GCP, Terraform, "built the observability platform", "own the data platform"
+
+## Gap Assessment
+1. **Physical datacenter work** — zero experience and a genuine downward-scope signal for someone at Staff level.
+2. **Pull-GitOps as a named practice** — the real flow was Git-versioned but push-executed from Jenkins/GitLab without a reconciliation agent.
+3. **ClickHouse and GPGPU** — Impala/Oracle/SQL and containerized inference provide honest bridges, not Direct evidence.
+4. **Second Amtssprache** — confirmed as a soft criterion rather than a hard gate; still a competitive disadvantage.
+5. **PSP** — eligibility is cleared, but no present or former clearance is claimed and the normal screening process remains.
+6. **Level and compensation** — Engineer III may be lateral or slightly below current Staff scope; Lohnklasse remains unknown.
+
+## Company Context
+- **Kommando Cyber (Kdo Cy)** — stood up **1 Jan 2024** as the Army's cyber/ICT command; ~9,000 civilian and military staff across the Army, Kdo Cy itself being the ICT and cyber-defence arm for the Army and the Sicherheitsverbund Schweiz.
+- **Neue Digitalisierungsplattform (NDP)** — Kdo Cy's flagship programme: a secure, robust, resilient platform as the technical foundation for digitising the Army, consolidating today's decentralised datacenter infrastructure; first services expected from **July 2026**. This role's "Datenplattform" sits in that world and is the single best-informed thing to raise on the call.
+- **Zimmerwald is the Zentrum elektronische Operationen (ZEO).** This is the Army's SIGINT evaluation site: intercepted satellite and cable communications collected elsewhere are evaluated there, and Comint reporting goes to the NDB. That is exactly what the JD's *"erfasste zivile und militärische Kommunikationsdaten … Erkenntnisse unterstützen den NDB und den MND"* describes.
+- **Material implication for the user, not just for the documents:** this is an intelligence job, not a corporate platform job. It carries a clearance process, standing public and parliamentary scrutiny of Funk-/Kabelaufklärung, and a career narrative that is harder to reverse than a normal move. Worth wanting deliberately.
+
+## Level Read — user raised overqualification 2026-08-27
+**Question:** the JD asks only for *"Abgeschlossene Ausbildung im IT-Bereich HF/FH"*, not a university degree — is the seat below his level?
+
+- **The education line is the weakest of the level signals.** Swiss postings state a *minimum*; exceeding it is routine and nobody is filtered out for holding an M.Eng. Do not read the band off this line.
+- **"III" is Senior, and that is primary-source, not inference.** The same unit's parallel posting on the same portal reads **"ICT-Architekt/-in III (Senior ICT Systems Architect)"** — Kdo Cy glosses its own roman numeral as Senior. So III is not a junior band.
+- **The responsibility language is nonetheless practitioner-level.** The role is *"fachlich mitverantwortlich"* — shared technical responsibility, not lead. No people leadership, no architecture ownership, and it carries **physical datacenter installation and maintenance support**. Against his current Staff/Engineer IV plus Component Owner (SW-2) and prior Application Owner (BS-3) scope, this reads **lateral at best, plausibly a half-step down**.
+- **Same shape as two known cases:** BKW was **declined** on exactly this (lateral, no upside), and SBB was flagged *"lateral or below"* and submitted anyway. `user_role_targeting_energy_trading` records the standing rule: no lateral same-tier moves. The Bern/Thun local tier is the deliberate exception, and it is what this role trades on.
+- **The sharper risk is the mirror image: being screened out as overqualified.** Public-sector HR does filter for this, particularly when a Lohnklasse cannot match current comp. That makes the pay question do double duty — it is both his decision input and their objection.
+- **The posting names no Lohnklasse** (0 hits). Federal pay classes exist publicly, but which class this seat sits in is not stated and must be asked, not assumed — same discipline as the SBB Anforderungsniveau K.
+- **No better-levelled technical seat exists at Kdo Cy today.** Of the 11 open roles, the alternatives are PM/portfolio track (Portfolio-Manager, Senior Projektleiter, Projektmanagement Officer — not his lane) or ICT-Architekt III, which is nominally higher but a worse content fit (network/security architecture) and carries a harder language bar (second Amtssprache *plus* a passive third).
+
+**Post-submission option:** a concise call to Matthey-Doret could still clarify Lohnklasse/band, how Engineer III is levelled and the development path for someone arriving at Staff scope. No such conversation is recorded, so channel strength remains Weak.
+
+## Competitive Read
+- **Obvious-fit candidate:** a Swiss-national senior Linux/DevOps engineer out of a Bund contractor, RUAG, armasuisse or a Swiss ISP — Linux fleet operations in the bones, IaC/GitOps daily, holds or has held a PSP, speaks German plus French, and is comfortable in a rack.
+- **Dennis's advantage:** the **data side**. Real Kafka in production, governed data products, pipeline ownership with SLOs and on-call (SW-2), containerized ML inference put into a 24/7 production environment (BS-1), ELK/Kafka anomaly detection (BS-4). A Linux/DevOps generalist will not have built the platform's *data* half. Plus native German, EU/B-permit work authorisation, and he lives ~a village away.
+- **Their advantage:** they are Direct on the exact axis the title names — Linux, hardening, GitOps, datacenter — they clear the language requirement without a conversation, and their clearance path is uncomplicated.
+- **Level/scope:** Engineer III against his Staff/Engineer IV. Not a step up.
+
+## Framing Strategy *(only if the call clears the gates)*
+- **Professional identity:** Staff Data & Platform Engineer who builds and operates production data platforms — containers, CI/CD, streaming, observability — and has taken ML inference into 24/7 production.
+- **Lead narrative:** the data platform's operating half, not the rack's.
+- **Strongest proof points:** SW-2 (Component Owner, business-critical ETL with data quality, governance, incidents, on-call), SW-3 (Python applications on Kubernetes with GitLab CI/CD), BS-1 (containerized ML inference into 24/7 semiconductor production — the honest MLOps hook), BS-4 (ELK/Kafka anomaly detection and monitoring), SW-7 (governed data products, scoped **inside** the company-wide Data Mesh — never as owner), Kafka.
+- **Honest bridges:** IaC via **CloudFormation**, never implied as Terraform. GitOps approached from GitLab CI/CD, named as adjacent rather than held. ClickHouse approached from Oracle/Impala/SQL.
+- **Explicit gaps to state rather than paper over:** physical datacenter work, Pull-GitOps as a practice, GPGPU and ClickHouse by name.
+- **Scope Discipline watch:** SW-1 must stay scoped to his own domains' pipelines; SW-7 must never read as owning the Mesh; BS-4 must never become "the observability platform".
+- **User directives:** include the Bundeswehr officer career as the defence-role USP; explain the motivation to return to a military environment and contribute to protecting Switzerland and its population; remove em-dash punctuation; remove awkward German; omit C++/JavaScript from the skills block.
+- **GitOps clarification resolved:** playbooks lived in Git and were applied push-style from Jenkins/GitLab. No reconciliation agent was present. The word stays forbidden; describe the mechanism literally.
+
+## Bullet Plan — Phase 1 (proposed 2026-08-27, awaiting confirmation)
+**Confirmed by user 2026-08-27:** documents in **German**; bundle **ML/MLOps primary + Data Engineer secondary**; format 2-page Swiss/DACH.
+Budget per `config.md`: **11–14 bullets**. Recommended set = **10**, leaving 1–4 discretionary slots.
+
+### Swisscom — Staff Data, Analytics & AI Engineer (Oct 2023 – heute)
+| | ID | Achievement | JD hook | Match |
+|---|---|---|---|---|
+| * | SW-3 | Python-Anwendungen auf Kubernetes, GitLab CI/CD, voller Deployment-Zyklus | R1 Deployment-Zyklus, Q2 DevOps | Direct |
+| * | SW-2 | Component Owner, Oracle/**Kafka** → Teradata, Pikett, SLA, Data Governance | Q4 Kafka, R3 Betrieb, "tadelloser" Betriebsnachweis | Direct |
+| * | SW-1 | Migration der eigenen Domänen auf AWS, **CloudFormation = IaC** (scope-corrected: seine Domänen, nie "die" Migration) | Q2 IaC | Direct (IaC) / Adjacent (rest) |
+| * | SW-7 | Governed Data Products + aktives Metadatenmanagement im unternehmensweiten Data Mesh | R3 Datenplattform | Adjacent |
+| o | SW-8 | Domänen-gegroundete LLM-Agenten (Modellauswahl + Wissensbasis) | R2 KI-Modelle — but configuration, not MLOps | Bridge |
+| o | SW-5 | Security Champion 2025/2026 | R4 System-Hardening/Security-Konfigurationen — the JD *does* name security, which is the `config.md` trigger. Rotating team role, weak signal | Weak |
+| x | SW-4 | B2B-Datenprodukte, Dashboards | wrong axis for an operating role | — |
+| — | SW-6 | PySpark | fold into Skills, not a bullet | — |
+
+### Bosch Halbleiterwerk Dresden — Data & ML Engineer (Feb 2020 – Dez 2022)
+| | ID | Achievement | JD hook | Match |
+|---|---|---|---|---|
+| * | BS-1 | Containerisierte ML-Inferenz (Docker, Kubernetes, **Ansible**) in 24/7-Halbleiterfertigung | **R2 MLOps — the anchor bullet**, plus Q2 IaC via Ansible | Direct-to-Adjacent, strongest |
+| * | BS-4 | Anomalieerkennung mit ELK + Kafka, Grafana/Prometheus/Loki | **R5 Observability — direct hit**; Kafka again | Direct |
+| * | BS-2 | Datenservices über OracleDB und Hadoop/ImpalaSQL | **Q4 ClickHouse bridge** (columnar/Big-Data analytics store) | Bridge |
+| * | BS-3 | Application Owner: SLOs, Schulung, Dokumentation, Vendor, 24/7-Betrieb | R3 E2E-Betrieb, Ownership at level | Direct |
+| * | **BS-6** | **Linux-Serverlandschaft administriert und automatisiert** (ML-Plattform, Docker-Hosts, Backend, Ansible-Control); **Ansible-Erweiterungen entwickelt** — u.a. Credential-Plugin mit lokalem Caching gegen Keystore-Abrufe | **Q2 + R3 + R4 — the bullet that turns the operating layer from Gap to evidence.** Ansible-Erweiterung ist Infrastruktur-Engineering, nicht Toolnutzung | **Direct** |
+| x | BS-5 | Spotfire + TAF 2022 | BI, wrong axis here | — |
+
+### Fraunhofer CML — (Feb 2017 – Jan 2020)
+| | ID | Achievement | JD hook | Match |
+|---|---|---|---|---|
+| * | FC-3 | Containerisierte Microservices (Docker) für die MISSION-Datenaustauschplattform | early Docker/microservice depth | Adjacent |
+| o | FC-1 | Jenkins-CI/CD eigenständig eingeführt | Q2 automation initiative | Adjacent |
+| x | FC-2 | ARTUS NLP/Spracherkennung | model work, not operations | — |
+
+### Vizrt — (2015 – 2017)
+| | ID | Achievement | JD hook | Match |
+|---|---|---|---|---|
+| * | VZ-1 | Python/C++ Backend für ein **verteiltes** Video-Transcoding-System | JD: *"grosse, verteilte Dateninfrastruktur"* — the only distributed-systems evidence outside data pipelines. Scope: contributed; broadcasters are product context, never delivery claims | Bridge |
+| o | VZ-2 | Automatisierte A/V-Testsuite + Quality Gates in CI/CD | CI/CD depth | Adjacent |
+
+### Projekte (neuer Abschnitt — empfohlen)
+| | ID | Achievement | JD hook | Match |
+|---|---|---|---|---|
+| * | **PP-3** | **Eigener Debian-Server, seit ~10 Jahren selbst betrieben, administriert und gehärtet** — nginx, Mailserver, Nextcloud, VPN, Docker-Dienste, Bitwarden | **R4 Hardening/Security-Konfiguration — the only *current* and *continuous* Linux evidence** (Bosch ended 2022). Belegt zugleich Q3/Q4: echtes Interesse am ganzen Stack, nicht behauptet sondern seit einem Jahrzehnt gelebt | Direct (personal) |
+| x | PP-1 | Investing-/Signal-Plattform | wrong domain here | — |
+
+**PP-3 wording discipline:** never enterprise/production/multi-user, no uptime or scale figures, always visibly a personal self-hosted system. Framed that way it is a strength for this employer — a candidate who runs and hardens his own mail and VPN server is exactly the profile a `Dhall`/`Pull-GitOps` team recognises.
+
+### Generali — omit entirely (LOW on every axis for this JD)
+
+**Recommended total: 12** — SW-3, SW-2, SW-1, SW-7, BS-1, **BS-6**, BS-4, BS-2, BS-3, FC-3, VZ-1, plus **PP-3** in a Projekte section. **Inside the 11–14 budget**, 2 discretionary slots left. Fill order if wanted: FC-1 (CI/CD-Initiative), SW-8 (aktuelles KI-Signal), VZ-2. SW-5 now unnecessary — BS-6 and PP-3 carry the security/hardening axis far better than a rotating Security-Champion role.
+
+**Not writable, by canonical rule:**
+- **The word GitOps** — resolved 2026-08-27 and the answer was no: Git-versioned, but push-executed from Jenkins/GitLab, no reconciliation agent. Write the substance instead: *"versionskontrollierte Infrastrukturautomatisierung mit Ansible aus Git, ausgeführt über Jenkins-/GitLab-Pipelines."* Against a team that names **Pull-GitOps** in its own posting, that precision reads better than the buzzword.
+- **Physical datacenter work** — no experience. Interest belongs in the cover letter, never in a bullet.
+- GPGPU; ClickHouse by name; Terraform. Hardening: writable, but visibly sourced to PP-3.
+
+**Phase 2 issues to settle before generation:**
+1. **German templates do not exist yet.** Every prior package is English, including SBB's German-language JD. Section headings, date formats and the skills block all need German equivalents in the `.tex`.
+2. **Position titles in a German document** — keep the official English titles, or render them in German? Bosch's own Zeugnis title is German.
+3. Bosch title variant: `experience_bosch.md` sanctions "Data & ML Engineer" for ML-leaning JDs; that fits the MLOps framing here.
+
+## Critique Context
+- **Reviewer persona:** a Bund technical lead in a security-cleared ICT unit, reading in German, who will check Linux depth and operating experience first and data-platform breadth second.
+- **Domain vocabulary:** Betrieb, IKT-Schicht, Systemlandschaft, Härtung, Verfügbarkeit, Lebenszyklus, Deployment-Zyklus, Datenplattform, Observability.
+- **Likely first technical challenge:** *"Beschreibe eine Linux-Systemlandschaft, die du selbst betrieben und gehärtet hast."* He can answer with the professionally administered Bosch estate (BS-6) and must separate it clearly from the current personal Debian hardening evidence (PP-3).
+- **Second challenge:** distinguish the Git-versioned, push-executed Ansible flow from Pull-GitOps; then address the physical-datacenter gap directly.
+
+## Cover Letter Plan
+- **Decision: YES — but only if the gates clear.** A Swiss federal application in German expects a Motivationsschreiben, and this role needs prose to do two things a resume cannot: explain why a data engineer is applying to an operating-layer role, and address the second-language question openly instead of letting the reader find it.
+- **Language: German.** Non-negotiable for this employer.
+- **Paragraph structure:** (1) NDP and the data platform, concretely — why this specific platform; (2) the data half he brings — Kafka, governed pipelines with on-call ownership, ML inference in 24/7 production; (3) honest positioning on the operating layer and the language, without a defensive gap list (`cl_reference.md` bans that — the Aker BP CL-A finding); (4) local, long-term, native German, EU/B permit.
+- **Verified hooks:** Neue Digitalisierungsplattform and the datacenter consolidation; Kdo Cy's founding in Jan 2024; Zimmerwald/ZEO as the site. All from first-party or press sources dated in the session, none inferred.
+- **Jargon level:** German technical, Bund register, no Anglicism padding.
+
+## Status
+- **Phase 0: DONE** — 2026-08-27
+- **Fit gate: PASS.** Evidence Fit **79/100 (Core, lower end)**, hard gate **PASS**. The original language and citizenship questions are resolved; the physical-datacenter gap remains explicit.
+- **Phase 1: DONE 2026-08-27** — plan confirmed by user. The original count was recorded incorrectly; the generated CV had 15 bullets, not 13.
+- **Phase 2: DONE after Edit 2, 2026-08-27** — German resume and motivation letter edited, compiled and visually inspected.
+  - Language **German**, position titles **English** (user decision). First German-language package in the log; headings, dates and the skills block were built for it (`ngerman` babel added).
+  - **15 bullets:** Swisscom 4 (SW-2, SW-3, SW-1, SW-7) · Bosch 6 (BS-1, **BS-6** ×2, BS-4, BS-2, BS-3) · Fraunhofer 1 (FC-3+FC-1) · Vizrt 1 (VZ-1+VZ-2) · Generali 1 (GN-1) · **Bundeswehr 1 (BW-1)** · **Projekte 1 (PP-3)**.
+  - **User-directed content change:** the weak SW-8 LLM-configuration bullet was removed and replaced with the role-specific USP, the six-year Bundeswehr officer career. BW-1 is now canonical and appears in the summary and as a separate experience entry.
+  - **Deviation from the proposed plan, deliberate: Generali was re-included.** The plan said omit, but a DACH-convention CV should not carry an unexplained 2015–2017 gap. Capgemini stays omitted per the standing user preference.
+  - **Verification:** canonical and document validators **PASS, 0 warnings**; MiKTeX pdflatex **2-page CV + 1-page letter, 0 overfull/underfull boxes**; `pdftotext` extraction order correct; visual review clean; forbidden/requested-term sweep **0 hits**.
+  - **Punctuation:** no Unicode en/em dash and no rendered narrative dash punctuation remain in either source. LaTeX double hyphens remain only for date ranges.
+  - **Critique v3 is CURRENT, 2026-08-27.** Evidence Fit **79/Core**, hard gate **PASS**, Document Quality **92/100**, Channel **Weak**. The Bundeswehr evidence strengthens the competitive and motivation narrative but does not add technical, intelligence or clearance fit points.
+  - **Known accepted deviation at submission:** the Bosch BS-1 bullet says the automated classification ran *„ohne manuellen Eingriff“*. Canonical BS-1 supports a qualitative reduction in manual classification, not complete elimination. The user reviewed the critique, judged the package good enough and submitted without this proposed fix.
+  - **Grades omitted** per the `grade_output_rule` of 2026-08-26 (thesis 1.0 stays off the document by default; say the word to include it).
+- **Package status: SUBMITTED 2026-08-27.** Await response.
+- **Next action:** no document work. Await screening; an optional post-submission call to **Marcel Matthey-Doret, +41 58 46 78409** could clarify Lohnklasse, Engineer-III level and development path and would upgrade the channel only if an actual conversation occurs.
+
+## Submission Record
+- **Submitted:** 2026-08-27, user-confirmed.
+- **Fit class / score:** Core, Evidence Fit 79/100.
+- **Hard gate:** PASS.
+- **Document Quality:** 92/100.
+- **Channel at submission:** Weak.
+- **Outcome:** applied / awaiting response.
+- **Documents:** German 2-page CV and German 1-page motivation letter.
+- **Known accepted deviation:** the user submitted without applying the critique v3 BS-1 wording correction from *„ohne manuellen Eingriff“* to a qualitative reduction claim.
+- **Cohort:** evidence-first-2026-01, application 5/10; Core 3/7, Adjacent 2/2, Stretch 0/1.
+
+## Output Files
+- Session: `output/KdoCy_DevOps_Data_Platform/session_kdocy_devops_data_platform.md`
+- Verbatim JD: `output/KdoCy_DevOps_Data_Platform/JD_kdocy_devops_data_platform.txt`
+- Resume source: `output/KdoCy_DevOps_Data_Platform/e2e_kdocy_devops_data_platform_resume.tex`
+- Resume PDF: `Dennis_Thiessen_Lebenslauf.pdf` (2 pages, German)
+- Cover letter source: `e2e_kdocy_devops_data_platform_cover_letter.tex`
+- Cover letter PDF: `Dennis_Thiessen_Motivationsschreiben.pdf` — **CURRENT after Edit 2**, German, 1 page, **300 body words**, validator PASS, 0 boxes. Addressed to Marcel Matthey-Doret by name.
+- Critique: **CURRENT v3, 2026-08-27**, `critique_kdocy_devops_data_platform.md`. Evidence Fit **79/Core**, Document Quality **92/100**, Channel **Weak**, hard gate **PASS**. The remaining BS-1 wording finding was knowingly accepted by the user at submission.
+
+## Cover Letter — decisions taken at write time (2026-08-27)
+- **Hooks are 100% first-party from the verbatim posting** (the JD's own MLOps/GPGPU + Linux-layer combination, the reference number, the named contact). No external claim needed verification because none was used.
+- **The NDP hook was dropped.** Kdo Cy's Neue Digitalisierungsplattform is verified as a real programme, but nothing establishes that *this* data platform is part of it. Asserting the link would have been an inference dressed as familiarity. `cl_reference.md`: omit a hook rather than spend a paragraph proving company familiarity.
+- **The second-Amtssprache question is deliberately NOT raised — a reversal of the Phase 0 plan.** That plan was written while the requirement still looked like a gate. The user then confirmed it is not a hard requirement, so naming it in the letter would hand the reader an objection they had already set aside. This is exactly the Aker BP **CL-A** finding ("I have not authored an enterprise governance framework myself"). The letter states the language assets positively instead; the topic belongs in the interview if it comes up.
+- **The physical-datacenter point is framed as motivation, never as evidence** — *"Dass die Stelle über den gesamten Stack geht, bis in den Serverraum, ist für mich ein Argument dafür"*, carried by PP-3, which is visibly personal.
+- **Overqualification is answered implicitly, not raised explicitly** — the closing asks about the platform's role in the team's Zielbild, which invites the level conversation without conceding anything.
+- Bundle §S5 of `bundle_ml_ai_engineer.md` was checked for the scope-violation pattern found in `bundle_data_engineer.md` on 2026-08-21. **Clean** — its hook matches BS-1's canonical scope.
+
+## Critique v3 (2026-08-27, after Edit 2)
+- **Evidence Fit:** 79/100, Core (lower end). **Hard gate:** PASS. The new BW-1 evidence materially improves military-context credibility and motivation but does not establish technical military work, intelligence experience or clearance, so the fit score remains unchanged.
+- **Document Quality:** 92/100. **Channel:** Weak.
+- **Tier 1:** BS-1 currently says the automated defect classification ran *„ohne manuellen Eingriff“*. Canonical BS-1 supports qualitative reduction of manual classification, not complete elimination. Safe direction: *„... ermöglichte damit die automatisierte bildbasierte Defektklassifikation und reduzierte den manuellen Klassifikationsaufwand.“*
+- **Tier 2:** compress the five-line summary; change *„CloudFormation als Infrastructure as Code, IaC“* to *„CloudFormation für Infrastructure as Code (IaC)“*; specify *„mir vertrautes militärisches Umfeld“* in the letter.
+- **Mechanical re-check:** validators PASS with 0 warnings; CV 2 pages, letter 1 page; 0 box warnings; A4; extraction order correct; all three pages visually clean; footer 2/2 inside page bounds; no Unicode dash punctuation in either source.
+
+
+## Edit History
+
+### Edit 1 (2026-08-27): three Tier 1 relevance fixes
+- **Source:** `critique_kdocy_devops_data_platform.md`, Tier 1 items 1–3. User approved with "apply tier 1 fixes".
+- **Changes, all MODIFY — no bullet added, removed or swapped, no claim, scope or hedged verb touched:**
+  1. SW-3: "von der containerisierten Auslieferung" → **"vom Container-Build über das Deployment"**. The JD's own phrase is *"den gesamten Deployment-Zyklus verantworten"*. Deliberately descriptive — *verantworte* was **not** used, because SW-3's canonical scope is "within the team environment" and an ownership verb here would have been an escalation.
+  2. BS-4: "für Monitoring und Alarmierung" → **"für Monitoring, Logging und Alarmierung"**. Logstash and Loki are the logging half; the bullet had been under-describing work already done.
+  3. Skills: "Container und Cloud" → **"Container, Cloud und MLOps"**, with "Deployment und Betrieb containerisierter ML-Inferenz (MLOps)". Labelled as the demonstrated work (BS-1 + BS-6), never as a generic MLOps toolchain.
+- **Result:** JD-term coverage **64% → 69%** (27/39). *Deployment* and *Logging* now present; *MLOps* now in the CV, not only the letter.
+- **Verification:** validator **PASS, 0 warnings** · **2 pages** · **0 overfull/underfull boxes** · forbidden-term sweep over the rendered PDF **0 hits** · visual check clean, no new orphan or header wrap.
+- **Delta vs baseline:** pages 2→2, boxes 0→0, char violations 0→0, bullets 13→13, coverage 64%→69%.
+- **Estimated post-edit Document Quality ~92/100** (Relevance 11→14.5 of 15). **This is an estimate, not a scored critique — never quote it as a score.** Re-run `/critique` if a current number is needed.
+- **Not applied:** Tier 2 items 4–7 and Tier 3 items 8–10 remain open, including the Performance/Skalierbarkeit rationale on the Ansible-plugin bullet (Tier 2 #5) and the near-verbatim CV sentence in the cover letter (Tier 2 #7).
+
+### Edit 2 (2026-08-27): German language pass, Tier 2 fixes and Bundeswehr USP
+- **Source:** direct user feedback in this session.
+- **User-requested language edits:** removed C++/JavaScript and the word *begrenzt* from Skills; changed *Baue und betreibe* to *Entwickle und betreibe*; rewrote the Vizrt bullet in technical language; removed awkward constructions throughout the CV and letter.
+- **Dash punctuation:** removed all Unicode en/em dashes and all narrative LaTeX dash punctuation from both `.tex` files. LaTeX double hyphens remain only where they correctly render date ranges.
+- **Tier 2:** spelled out *Infrastructure as Code* beside IaC; added the canonically supported Performance/Skalierbarkeit outcome to BS-6; named Swisscom in the summary; fully paraphrased the Bosch cover-letter evidence around the operating constraint.
+- **Content selection:** added canonical employment record `BUNDESWEHR` and claim **BW-1** from the existing structured extraction and experience file. Replaced SW-8 with a dedicated Bundeswehr entry; surfaced the six-year officer career in the summary and in the letter's motivation. No clearance, NATO, combat, command-scope or technical military claim was added.
+- **Cover letter:** now 300 body words and uses the officer career as the personal motivation for returning to a military environment and contributing to the protection of Switzerland and its population.
+- **Verification:** canonical system PASS, 0 warnings; both document validators PASS; CV 2 pages, letter 1 page; 0 overfull/underfull boxes; `pdftotext` order correct; visual inspection clean; 15 bullets before and after content swap.
+- **Critique status:** v2 is stale after this material edit. Evidence Fit remains 79/Core; Document Quality was not re-scored.
@@ -0,0 +1,70 @@
+Source URL: https://jobs.ruag.ch/offene-stellen/ai-engineer-c5i/4afaa9aa-74c1-4b4d-9232-cf65651ce8ec
+Apply URL: https://jobs.ruag.ch/umantis/2514/de/apply/18027
+Retrieved: 2026-08-27
+Status at retrieval: LIVE; application form reachable
+Official portal listing: Berufserfahrene, Thun, Schweiz, 80-100%
+
+AI Engineer C5I (w/m/d)
+
+Rund 3000 Mitarbeitende von RUAG und RUAG Real Estate leisten jeden Tag einen wesentlichen Beitrag zur Sicherheit der Schweiz. Sie sorgen dafür, dass die Schweizer Armee sowie andere Einsatz- und Sicherheitsorganisationen ihre Aufgaben jederzeit umfassend wahrnehmen können.
+
+Das kannst du bewegen
+
+* Aufbau, Weiterentwicklung und Betrieb einer internen AI-/LLM-Plattform inkl. Compute Cluster
+* Implementierung von Inhouse LLM-Lösungen inkl. Connectors, Tools und Retrieval-/Dokumentenlösungen
+* Entwicklung von Datenpipelines, Data Preprocessing und Schnittstellen zu internen Systemen
+* Umsetzung von Proof of Concepts (POCs), MVPs und Pilotlösungen im Bereich AI / R&D
+* Containerisierung, Deployment und Automatisierung von AI-Workloads
+* Technische Dokumentation sowie Wissenstransfer innerhalb des Teams
+
+Das bringst du mit
+
+* Hochschulabschluss (BSc/MSc) in Informatik, Computer Science, Data Science oder vergleichbar
+* Mehrjährige Berufserfahrung in ML- Engineering, Data Engineering, Software Engineering oder DevOps
+* Sehr gute Python-Kenntnisse sowie Erfahrung mit modernen ML-/AI- Frameworks
+* Erfahrung mit Linux, Docker, Kubernetes oder vergleichbaren Plattformen
+* Kenntnisse in LLMs, RAG, APIs, Data Pipelines oder Search-Technologien von Vorteil
+* Strukturierte, selbständige und pragmatische Arbeitsweise mit hoher Umsetzungskompetenz
+* Sehr gute Deutschkenntnisse in Wort und Schrift; Englischkenntnisse von Vorteil
+* Militärische Karriere als höherer Unteroffizier oder Offizier von Vorteil
+
+Erfüllst du nicht alle Voraussetzungen hundertprozentig? Bewirb dich trotzdem. Wir sind stets auf der Suche nach talentierten und motivierten Personen, die unser Team bereichern möchten. Wir legen grossen Wert auf Vielfalt und Chancengleichheit und unser Ziel ist es, ein vielfältiges Team aufzubauen, in dem alle ihre persönlichen Stärken voll entfalten können.
+
+Wir ermutigen insbesondere alle Personen, unabhängig von ihrem Geschlecht, die möglicherweise Bedenken haben, eine Stelle in einem armeenahen Umfeld anzunehmen, sich zu bewerben.
+
+Deine Ansprechperson
+
+Frank Haugwitz
+recruiting-c5i@ruag.ch
+
+Arbeitsort
+
+C5I, Uttigenstrasse 36, 3600 Thun
+
+Über den Bereich
+
+Die Business Area C5I der RUAG MRO Holding AG unterstützt die Schweizer Armee bei der Realisierung von IKT-Projekten mit spezifischem Fokus auf das Kommando Cyber. Dies ist deine Chance, einen Beitrag zu hochsicheren und souveränen IT-Systemen zu leisten. Wir sind in den letzten acht Jahren von einem kleinen «Start-up» mit null Mitarbeitenden auf über 260 Mitarbeitende gewachsen und bieten ein einmaliges, dynamisches Umfeld.
+
+Hier kannst du an vorderster Front bei der Digitalisierung der Schweizer Armee mitarbeiten. Willst du einen Beitrag zum sicherheitspolitischen Umfeld leisten? Dann bist du bei uns genau richtig. Wir arbeiten agil und richten uns konsequent nach dem DevSecOps-Modell aus. Mit dem C5I-Campus haben wir einen Innovationsraum für hochsichere IT-Systeme geschaffen und bieten attraktivste Arbeitsplätze. Für fachliche Auskunft steht dir Marco Heinzen, Principal GIS Engineering C5I, gerne zur Verfügung: Tel. +41 79 568 14 96 | Mail marco.heinzen@ruag.ch
+
+Deine Vorteile
+
+Lohn und Nebenleistungen
+
+Wir bieten dir ein leistungsorientiertes- und marktgerechtes Salär, 13 Monatslöhne sowie grosszügige Prämien- und Zulagen. Zusammen mit weiteren Nebenleistungen ergibt sich daraus ein attraktives Gesamtpaket.
+
+Flexibles Arbeiten
+
+Wir legen grossen Wert darauf, dass unsere Mitarbeitenden ein gesundes Gleichgewicht zwischen Beruf und Privatleben finden. Darum bieten wir unter anderem flexible Arbeitszeiten und Homeoffice-Optionen an.
+
+Aufstiegs- und Weiterbildungsmöglichkeiten
+
+Das Potenzial unserer Mitarbeitenden zu fördern und zu entfalten ist uns wichtig. Durch Schulungen, Kurse und Weiterbildungen unterstützen wir sie dabei, ihre Fähigkeiten kontinuierlich auszubauen um ihre beruflichen Ziele zu erreichen.
+
+Wichtige Hinweise zum Bewerbungsprozess
+
+* Vor Anstellungsbeginn wirst du darum gebeten, einen Straf- und Betreibungsregisterauszug vorzuweisen.
+* Bewerbungen nehmen wir ausschliesslich über unser Stellenportal jobs.ruag.ch entgegen. E-Mail- wie auch Briefbewerbungen können wir leider nicht akzeptieren.
+
+Zusätzliche offizielle RUAG-Karriereinformation, nicht Teil des obigen Stelleninserats:
+RUAG führt bei allen neu eintretenden Mitarbeitenden eine Personensicherheitsprüfung durch.
@@ -0,0 +1,200 @@
+# Critique: RUAG C5I — AI Engineer C5I (w/m/d) — Round 2
+
+**Date:** 2026-08-27 (Round 2, after Edit 1)
+**Round 1:** same day, pre-edit. Evidence Fit 74 · Document Quality **85** · Channel Weak · 3 Tier 1 fixes.
+**Documents:** `e2e_ruag_ai_engineer_c5i_resume.tex` (2 pp, **13 bullets**), `e2e_ruag_ai_engineer_c5i_cover_letter.tex` (1 p, **295 body words**, 5 short paragraphs + close)
+**JD:** `JD_ruag_ai_engineer_c5i.txt` — verbatim live posting, retrieved 2026-08-27. **JD integrity: PASS.**
+
+> Scored per `critique_framework.md`, which governs over `SKILL.md` §9.3/§9.4: separate Evidence Fit and Document Quality, verdicts rather than invented probabilities, no single overall score. Documents were re-read from disk, not scored from the Round 1 record.
+
+---
+
+## 1. Round 1 findings — resolution status
+
+| # | Finding | Status |
+|---|---|---|
+| **T1-1** | Cover letter never connected to DevSecOps, C5I or the Army | **CLOSED.** New standalone paragraph carries `SW-5` and names the DevSecOps model and C5I |
+| **T1-2** | `PP-3` missing — the only *current* Linux/ops evidence | **CLOSED.** New `Projekte` section; audited clean against PP-3's full forbidden list |
+| **T1-3** | `governte Datenprodukte` is not a German word | **CLOSED.** Now `governance-konforme Datenprodukte` |
+| **T2-2** | Headline dropped "AI" from a req titled AI Engineer | **CLOSED.** Now his canonical title, `Staff Data, Analytics & AI Engineer` |
+| **T2-3** | Four honestly closeable JD terms absent | **CLOSED.** `Wissenstransfer`, `Datenaufbereitung`, `AI-/ML-Workloads`, `Containerisierung` |
+| **T2-4** | IBM AI Engineering had no primary-source record | **CLOSED.** Certificate read directly: IBM via Coursera, 4 Jun 2020, verify `3ZBZFVAL6A34`. Recorded as entry #8 in `thiessen_certifications.md` |
+| **T2-5** | CL paragraph 2 re-told resume bullets | **CLOSED.** Compressed; the working-style sentence survives |
+| **T2-6** | Post-gap pivot conceded without evidence | **CLOSED.** Now anchored: *"wie zuvor bei der ML-Inferenz in Dresden"* |
+| **T2-7** | Citizenship volunteered in the letter | **CLOSED by user decision** — cut. Resume header still carries it |
+| **T3** | Bullets 9–10 both opened `Implementierte` | **CLOSED.** Bullet 9 now opens `Baute`; 0 consecutive identical openers |
+| **T2-1(a)** | Vizrt title vs canonical `official_title` | **OPEN by user decision**, logged. Unchanged |
+
+**Plus one defect Round 1 did not catch, found during the edit and fixed:** the resume **never loaded `babel`**, so a German document was hyphenated with English patterns (`Hal-bleiterfertigung`, `Tran-skription`, `automa-tisierte`). This was present at baseline and had survived a full visual QA, because nothing *looks* broken — the lines justify and the page is clean. Fixed with `\usepackage[ngerman]{babel}` plus a `\hyphenation{Trans-krip-ti-on}` exception, which also cleared an overfull box the longer headline had introduced.
+
+---
+
+## 2. Fit Verdict and Hard Gates — unchanged, and unchangeable by editing
+
+| Gate | Result |
+|---|---|
+| Title-defining capability Direct? | **FAIL.** R1 (build/operate an internal AI-/LLM platform incl. compute cluster) and R2 (in-house LLM solutions, connectors, retrieval/document solutions) remain **Adjacent** |
+| Minimum qualification a Gap? | **PASS.** None of the eight `Das bringst du mit` items is a Gap |
+| Level requires absent scope? | **PASS** |
+| Location / authorization | **PASS.** Thun role, Thun resident, German native, EU citizen with Swiss B permit |
+| Clearance (PSP) | **UNRESOLVED** |
+| Compensation / level | **UNRESOLVED** |
+
+No document change touches any of this. The user overrode this gate on 2026-08-27 with all of it in view; recorded, not re-litigated.
+
+---
+
+## 3. Evidence Fit — 74/100 (unchanged)
+
+| Dimension | Weight | Score | Reasoning |
+|---|---:|---:|---|
+| Required qualifications | 35 | 29 | Degree, years, Python, Linux/Docker/Kubernetes, German/English Direct. ML/AI-framework half of Q3 Adjacent |
+| Core responsibilities | 25 | 17 | R3/R5/R6 Direct, R4 Direct-to-Adjacent; R1 and R2 Adjacent |
+| Level and ownership | 15 | 11 | Staff plus Component/Application Owner exceeds "Berufserfahrene"; may be lateral or down-level |
+| Recency and depth | 10 | 8 | Python/Kubernetes/data current; production-ML integration ended 2022; LLM evidence configuration-level |
+| Domain/tool transfer | 10 | 6 | Compute cluster, GPU, RAG and search are not substitutable by wording |
+| Practical constraints | 5 | 3 | Location/language/authorization excellent; PSP and compensation unresolved |
+| **Total** | **100** | **74** | Numerically top-of-Adjacent; strategically **Stretch** |
+
+**`PP-3` does not move this score.** It strengthens the *document's* evidence for the operating half of the role, but it is a personal project and cannot convert an Adjacent title-capability into a Direct one. Treating it as fit-moving would be exactly the "bridge valued as highly as direct evidence" error §5 warns against.
+
+---
+
+## 4. Document Quality — 93/100 (was 85)
+
+| Dimension | Weight | R1 | R2 | Reasoning for the change |
+|---|---:|---:|---:|---|
+| Truth and provenance | 25 | 23 | **24** | IBM AI Engineering now has a primary source, closing the one line a canonical preflight could not confirm. New `PP-3` and `SW-5` content audited clean against their full forbidden lists. The headline is now *more* accurate than before — his real title, not a positioning label he never held. Remaining deduction: the Vizrt title, user-authorized and logged, is still the one line that will not match a Zeugnis |
+| Information hierarchy | 20 | 17 | **19** | Headline now carries the req's own word above the fold. `Projekte` is cleanly placed and parses correctly. Remaining: the officer career, an explicit JD advantage, still sits on page 2 |
+| Bullet evidence and impact | 20 | 16 | **16** | **Unchanged and still the weakest dimension.** 12 of 13 bullets are activity descriptions with no outcome clause; only `BS-1` carries a result. This is the honest consequence of `metrics: unverified` across the KB, not a writing failure — but it is real, and it is what a hiring manager notices |
+| Relevance and terminology | 15 | 12 | **15** | Both Round 1 deductions closed. **22/22 claimable JD terms now present**, and all six gap terms (RAG, Retrieval, Compute Cluster, AI-/LLM-Plattform, Connectors, Dokumentenlösungen) remain correctly absent. `MVP/Pilotlösung` and `R&D` stay uncovered because the evidence supports "Proof of Concept" and nothing more — declining to stretch is correct behaviour, not a deduction |
+| Skills evidence | 10 | 9 | **9** | All tokens still traced. `Datenaufbereitung` and `AI-/ML-Workloads` are claim-backed. TensorFlow/Keras now rests on a verified certificate. Unchanged deduction: `MLOps` in the headline is an umbrella term with no canonical `skills[]` entry, claim-backed only via BS-1 |
+| Mechanics/readability | 10 | 8 | **10** | `governte` fixed. German hyphenation fixed. Cadence: list-terminated bullets **50% → 31%**, consecutive identical openers **1 → 0**. 0 boxes, 0 warnings, correct parse, consistent Swiss orthography |
+| **Total** | **100** | **85** | **93** | |
+
+**Truth and provenance 24/25 (9.6/10)** — well clear of the 8/10 automatic-failure floor.
+
+The 8-point rise is almost entirely the closure of named Round 1 deductions plus a defect Round 1 missed. The one dimension that did **not** move is bullet impact, and it is the one that would most change a hiring manager's read — see Tier 2.
+
+---
+
+## 5. Channel Strength — **Weak** (unchanged)
+
+Cold portal application; `jobs.ruag.ch` refuses email and post. **Marco Heinzen's direct mobile (+41 79 568 14 96) is published in the posting and still unused.** Nothing in Edit 1 changed this, and no further document work can. This remains the single highest-value action on the application: one call upgrades the channel to Moderate *and* answers whether C5I is hiring someone who has built an AI platform or someone who can operate one and grow into building it — the question the whole application turns on.
+
+---
+
+## 6. Reader Sequence — Verdicts
+
+**Parser / ATS (Umantis). PASS.** `pdftotext -layout` extracts employer, title, dates, location and section order correctly on both pages; the new `Projekte` block parses cleanly; footers read 1/2 and 2/2. No tables, text boxes or multi-column body.
+
+**Recruiter glance (10 s) — Frank Haugwitz. FORWARD.** *The Round 1 friction point is gone.* He is filling a req titled **AI Engineer**, and the headline now reads `Staff Data, Analytics & AI Engineer` — the candidate's real title, containing the word, above the fold, alongside Thun, citizenship, permit and native German. Every box he owns is answered before he scrolls.
+
+**HR / dossier completeness (30 s). COMPLETE.** Two pages, no photo, clean chronology, education, languages, work authorization, `Militärischer Werdegang`, and now a `Projekte` section — which reads as a fuller local dossier, appropriate for a traditional Swiss employer. The Nov 2014 – Mai 2015 gap remains intentional and unremarkable.
+
+**Hiring manager (2 min) — Marco Heinzen. Still MAYBE, but a stronger MAYBE.** The underlying split is unchanged: if his brief is "build our RAG stack", this is a no; if it is "run the platform and the pipelines while we grow the AI layer", it is a strong yes. What changed is that the letter now argues the second case more completely — it names his DevSecOps practice against C5I's stated operating model, and the pivot after the gap admission is anchored in something he has actually done rather than in an intention. The resume now also shows *current* hands-on infrastructure, not only work that stopped in 2022.
+
+**Technical reviewer (10 min). CREDIBLE.** No claim collapses. Likely probes, in order: (1) "You configured the assistants — who built the platform underneath?" (2) "Compute cluster — what is the largest thing you have operated, and have you scheduled GPU workloads?" (3) **new:** "Your private server — what have you actually hardened, and how do you patch it?" This is a probe the document now *invites*, and it is a good one to invite. (4) The 2008–2014 / 2009–2013 officer-track overlap. (5) Ansible vs Pull-GitOps — the word is still correctly absent and the substance is answerable.
+
+---
+
+## 7. Claim Audit — new and changed content only
+
+| Claim | Canonical | Safe? | Note |
+|---|---|---|---|
+| Headline `Staff Data, Analytics & AI Engineer` | `claims.json` SWISSCOM `title_history` / current title | ✓ | Now his **actual** title. More accurate than the Round 1 headline |
+| Profil opener, same title | as above | ✓ | Consistent with headline and body |
+| `governance-konforme Datenprodukte innerhalb des unternehmensweiten AWS Data Mesh` | SW-7 | ✓ | Object still scoped; mesh still not claimed |
+| **`Projekte`: private Debian server** | **PP-3** | ✓ | Verbs `Betreibt`/`administriert`/`verantwortet Systemhärtung` all in `allowed_verbs`. "selbst gehostet" stated; section reads `Eigenbetrieb`. **No** enterprise/production/multi-user/business-critical wording, **no** uptime/availability/SLA/user-count/scale figure, **no** SRE or sysadmin implication, **no** datacenter claim. Audited against all five forbidden items |
+| `koordinierte Hersteller, technische Dokumentation und Wissenstransfer an die Nutzer` | BS-3 | ✓ | All four BS-3 elements retained (SLOs, vendors, documentation, training) in natural German |
+| `Baute einen ELK/Kafka-Proof-of-Concept` | BS-4 | ✓ | `built` is an allowed verb; PoC status still explicit |
+| Skills `Datenaufbereitung` | SW-1 / SW-2 / BS-2 | ✓ | Real work, previously unnamed |
+| Skills `Containerisierung und Deployment von AI-/ML-Workloads` | BS-1 / BS-6 | ✓ | No new claim; renames existing evidence in the JD's vocabulary |
+| Cert `IBM AI Engineering mit TensorFlow/Keras im Weiterbildungskontext` | `thiessen_certifications.md` #8 | ✓ | **Now primary-source verified.** Still correctly confined to certification context |
+| **CL:** `Für 2025/2026 bin ich Security Champion meines Teams, mit 100 Stunden Training…` | SW-5 | ✓ | Single year only. Team role, not an award. Does **not** claim DevSecOps compliance ownership |
+| **CL:** `Dass C5I konsequent nach dem DevSecOps-Modell arbeitet, entspricht damit meiner heutigen Praxis` | SW-5 + SW-3 | ✓ | A soft alignment claim, supported by the Security Champion role, 100 h training and GitLab CI/CD automation. See Tier 2 — expect it to be probed |
+| **CL:** `die Implementierungsseite erarbeite ich mir von dort aus, wie zuvor bei der ML-Inferenz in Dresden` | BS-1 | ✓ | Back-reference to real work; introduces no new claim |
+| Citizenship sentence removed from CL | — | ✓ | Resume header still carries `Deutscher Staatsbürger` / `Schweizer Aufenthaltsbewilligung B`, so nothing is concealed |
+
+**No Tier 1 truth finding.** Full sweep across both `.tex` sources and both extracted PDFs: **0 hits** for Capgemini, LangChain/LangGraph/LlamaIndex, Terraform, Azure, GCP, GitOps, TypeScript, FastAPI, Flask, Django, every `global_forbidden_output_patterns` entry, and the standalone acronym `RAG` (word-boundary count 0 — the only `rag` matches are inside *Fragen* and *Abfragen*). **0 em dashes.**
+
+---
+
+## 8. Tiered Improvements
+
+### Tier 1 — none.
+
+No truth, fit or relevance defect remains that is fixable by editing. This is the honest result of Round 1's fixes, not a courtesy.
+
+### Tier 2
+
+**T2-A · Bullet impact is now the document's weakest dimension, and it is a KB problem, not a writing problem.**
+12 of 13 bullets describe activity with no outcome. `BS-1` is the only bullet that says what changed. Every other claim in `claims.json` carries `metrics: unverified`, and inventing figures is barred — so the resume is correctly written but structurally flat where a hiring manager looks for consequence. **The fix is upstream:** if any verified outcome exists for `SW-2` (incident or SLA record), `SW-3` (deployment frequency, service count), `SW-7` (data products delivered, sources onboarded) or `BS-3` (applications owned), recording it in `claims.json` would raise this dimension across every future package, not just this one. Do not invent anything to close it here.
+
+**T2-B · The officer career still sits on page 2.**
+The JD names it explicitly as an advantage, and it is the one thing most competing software candidates cannot offer. It is mitigated by the profile sentence, and moving the section would break reverse chronology. Structural; accepted rather than fixed.
+
+**T2-C · The headline now duplicates the Swisscom title line verbatim.**
+Both read `Staff Data, Analytics & AI Engineer`. Accurate and defensible — it is his title — but the repetition is visible within the first fifteen lines. Optional: differentiate the headline's tail (it currently carries `Python · Kubernetes · MLOps`) or leave it. Cosmetic only.
+
+**T2-D · Prepare the DevSecOps sentence for a follow-up question.**
+*"…entspricht damit meiner heutigen Praxis"* is a soft alignment claim. It is supported — Security Champion, 100 h training, GitLab CI/CD — but a security-conscious reader may ask what DevSecOps actually looks like in his current team, and the honest answer is that he is the team's security point of contact, not the owner of a DevSecOps pipeline. Worth having ready; not worth rewording.
+
+### Tier 3
+
+- **Bosch bullet lengths cluster** at 19/22/17/18 words — a 5-word spread, just above §7a's flagged threshold of ≤4. The validator passes it. Diagnostic only; do not pad or trim to move it.
+- **`\today`** renders "27. August 2026". If the built PDF is submitted later, recompile so the date refreshes.
+- **`MLOps`** in the headline remains an umbrella term with no canonical `skills[]` entry. Claim-backed via BS-1; keep.
+
+---
+
+## 9. Cover Letter Critique
+
+**6A — Anti-patterns. PASS.** No generic opener, no company-history paraphrase, no adjective stack, no defensive gap list. Opens on the candidate-role connection in the first clause. 0 em dashes. The gap sentence — *"Eine AI-Plattform habe ich nicht aufgebaut"* — remains one sentence, immediately followed by what he does bring, and is now followed by evidence rather than intention.
+
+**6B — Tailoring. PASS (was Partial).** The Round 1 deduction is closed. The letter now engages the posting's own `Über den Bereich` framing by name — **C5I** and the **DevSecOps model** — and does so through evidence that was already on the resume rather than through company-research filler. The role thesis in paragraph 1 still derives directly from the JD's first two bullets.
+
+**6C — Context-specific. PASS.** Defence motivation correctly bounded: *"im Umfeld von Landesverteidigung und gesellschaftlicher Verantwortung"*, never rejoining the armed forces. *"ich wohne in Thun, also am Standort selbst"* remains the strongest practical line in the package.
+
+**6D — ATS.** Not a factor; the letter supplements the CV in a portal upload.
+
+**6E — Structural. PASS.** 295 body words (target 250–300). Six blocks with good variation — 50 / 52 / 77 / 35 / 63 / 18 words — and no paragraph dominating the page after the split. One page, 0 boxes. Swiss orthography consistent (*Grüsse*, *einschliesslich*). Salutation correctly without a comma. Addressed to the named Ansprechperson at the verbatim-verified legal entity and address. `cl_reference.md`'s "two or three short paragraphs" is the International-Tech default; line 49 explicitly permits an employer-appropriate motivation-statement format, and five short German paragraphs serve this reader better than three long ones.
+
+**6F — Package cohesion. PASS.** Every letter claim maps to a resume bullet and a canonical ID (BS-1, BS-6, SW-3, SW-2, SW-8, **SW-5**, BW-1). No new tool, metric, customer or ownership claim. The LLM boundary is stated identically in both documents. Contact block and location consistent. Citizenship now appears in exactly one place — the resume header — which is the right number.
+
+**Would deleting the letter improve the application? No.** It is now doing more work than in Round 1: it answers the question the resume structurally cannot — what this candidate thinks he is applying for, given what he has not done — and it connects his current security practice to the employer's stated operating model.
+
+---
+
+## 10. Mechanical Verification — re-run on the edited files
+
+| Check | Resume | Cover letter |
+|---|---|---|
+| `validate_resume_system.py --document` | **PASS, 0 warnings** | **PASS, 0 warnings** |
+| Canonical system validator | **PASS, 0 warnings** | — |
+| `claims.json` parses after the PyTorch patch | **valid JSON** | — |
+| MiKTeX, two passes | **PASS** | **PASS** |
+| Page count | **2** (exact) | **1** (exact) |
+| Overfull / Underfull boxes | **0** | **0** |
+| LaTeX warnings | **0** | **0** |
+| `pdftotext -layout` order | employer / title / date / location / sections correct incl. new `Projekte`; footers 1/2, 2/2 | correct |
+| German hyphenation | **ngerman** — `Halb-leiterfertigung`, `Trans-krip-tion`, `automati-sierte` | ngerman (was already loaded) |
+| Visual QA at 130 dpi | both pages re-rendered and inspected after every edit | re-rendered and inspected after the split |
+| Submission copy refreshed + MD5 match | **yes** | **yes** |
+| PDF newer than `.tex` | **yes** — no unbuilt edits pending | **yes** |
+
+**Content checks.** Email `dennis@thiessen.io` ✓. `Thun, Schweiz` on both; Swisscom entry keeps `Bern, Schweiz` ✓. Capgemini 0 ✓. All forbidden skills 0 ✓. All global-forbidden patterns 0 ✓. French/Italian absent ✓. No DOB, marital status, gender, children or photo ✓. No LOC or test counts ✓. Certifications appear exactly once ✓.
+
+**Structural.** 13 bullets (11–14 guide ✓). Six skills lines (4–6 guide, sixth is Zertifizierungen ✓). Profile 4 rendered lines, one over the 2–3 guide but carrying three distinct positioning claims; not flagged. Reverse chronology intact. `Militärischer Werdegang` and `Projekte` correctly separated from `Berufserfahrung`.
+
+---
+
+## 11. Summary
+
+**Evidence Fit 74/100 · Stretch · title-capability gate FAIL · PSP and compensation UNRESOLVED — all unchanged.**
+**Document Quality 93/100 (was 85) · truth and provenance 24/25 · no Tier 1 findings of any kind.**
+**Channel Weak — unchanged, and the published direct line is still unused.**
+
+The documents are now as good as this evidence base allows. Every Round 1 finding is closed except the Vizrt title, which is a conscious user decision, and bullet impact, which is a `claims.json` limitation rather than a writing one.
+
+Per `critique_framework.md`, a high Document Quality score does not make this package submit-ready, and 93 does not mean 93% likely to interview. The gate still reads FAIL. What decides this application is not the documents — it is whether C5I wants the platform's AI layer or its operating layer, and that is answered by a phone call, not by another edit.
@@ -0,0 +1,69 @@
+% RUAG C5I: AI Engineer C5I (w/m/d). German-language Swiss/DACH letter.
+% Every claim traces to a resume bullet and a canonical ID.
+% Boundaries enforced here:
+%   - SW-8 stays configuration-level. No RAG, retrieval, orchestration, evaluation or fine-tuning.
+%   - No AI/LLM-platform ownership and no compute/GPU-cluster operation is implied anywhere.
+%   - BS-1 does not claim model training.
+%   - BW-1: no clearance, no command scope, no technical military work.
+%   - RUAG is a defence contractor, not the armed forces. The letter says "im Umfeld von
+%     Landesverteidigung", never "wieder Teil der Armee".
+%   - The LLM gap is named once, briefly and without apology. The JD invites applicants who do
+%     not meet every requirement, so an honest bridge reads as candour, not as a defensive list.
+%   - SW-5 (Security Champion 2025/2026, 100 h training) answers the JD's stated DevSecOps model.
+%     Team role only, never an award, never DevSecOps compliance ownership.
+%   - Citizenship is deliberately NOT restated here (user decision 2026-08-27); the resume header
+%     already carries "Deutscher Staatsbuerger" and "Schweizer Aufenthaltsbewilligung B".
+% Contact location is Thun, matching the resume and the Thun-area rule in config.md.
+
+\documentclass[11pt,a4paper]{article}
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage[ngerman]{babel}
+\usepackage{lmodern}
+\usepackage[a4paper,left=0.85in,right=0.85in,top=0.7in,bottom=0.7in]{geometry}
+\usepackage{parskip}
+\usepackage{xcolor}
+\usepackage{hyperref}
+\hypersetup{hidelinks}
+\pagestyle{empty}
+\setlength{\parindent}{0pt}
+
+\begin{document}
+
+{\Large\bfseries Dennis Thiessen, M.Eng.}\par
+Thun, Schweiz $\vert$
+\href{mailto:dennis@thiessen.io}{dennis@thiessen.io} $\vert$ +41 795 955 585 $\vert$
+\href{https://linkedin.com/in/dennis-thiessen}{LinkedIn}
+
+\vspace{1.5em}
+RUAG MRO Holding AG, Business Area C5I\\
+Herr Frank Haugwitz\\
+Uttigenstrasse 36, 3600 Thun
+
+\vspace{1em}
+\today
+
+\vspace{1em}
+\textbf{Bewerbung als AI Engineer C5I (w/m/d)}
+
+\vspace{0.8em}
+Sehr geehrter Herr Haugwitz
+
+Ihre Ausschreibung verbindet zwei Aufgaben, die in meiner Arbeit ohnehin zusammengehören: eine interne Plattform für AI-Workloads zu betreiben und die Datenpipelines und Schnittstellen zu bauen, von denen diese Workloads leben. An dieser Schnittstelle arbeite ich seit Jahren, zuerst in der Halbleiterfertigung bei Bosch, heute bei Swisscom auf Kubernetes und AWS.
+
+Bei Bosch in Dresden integrierte ich ML-Inferenz als Docker-Container mit Kubernetes und Ansible in die kontinuierlich laufende Fertigung; die Klassifikation von Defektbildern lief danach vollautomatisiert. Die Linux-Server darunter administrierte ich selbst und automatisierte ihre Konfiguration mit Ansible, inklusive eigener Erweiterungen. In einer Fertigung ohne Stillstandstoleranz zeigt sich früh, ob eine Automatisierung trägt.
+
+Heute entwickle und betreibe ich bei Swisscom Python-Datenanwendungen auf Kubernetes und verantworte als Component Owner geschäftskritische ETL-Strecken von Oracle und Kafka ins Data Warehouse, einschliesslich Rufbereitschaft. Meine LLM-Erfahrung möchte ich klar einordnen: Ich konfiguriere domänengestützte Assistenten in einer Swisscom-eigenen Oberfläche und arbeite über LiteLLM mit Modell-APIs. Eine AI-Plattform habe ich nicht aufgebaut. Was ich mitbringe, ist die Betriebs- und Plattformseite dieser Rolle; die Implementierungsseite erarbeite ich mir von dort aus, wie zuvor bei der ML-Inferenz in Dresden.
+
+Sicherheit ist dabei kein Anhang: Für 2025/2026 bin ich Security Champion meines Teams, mit 100 Stunden Training zu Cloud Security, DevSecOps und Security by Design. Dass C5I konsequent nach dem DevSecOps-Modell arbeitet, entspricht damit meiner heutigen Praxis.
+
+Die Aufgabe hat für mich auch persönlich Gewicht. Ich diente sechs Jahre in der Bundeswehr, absolvierte den Offizieranwärterlehrgang und die Offizierschule und schied als Leutnant aus. Nach über zehn Jahren in der Industrie wieder im Umfeld von Landesverteidigung und gesellschaftlicher Verantwortung zu arbeiten, ist ein wesentlicher Grund für diese Bewerbung. Deutsch ist meine Muttersprache, und ich wohne in Thun, also am Standort selbst.
+
+Über ein Gespräch würde ich mich freuen, besonders darüber, wie Plattform und erste Inhouse-Lösungen bei Ihnen zusammenspielen sollen.
+
+Freundliche Grüsse
+
+\vspace{1.5em}
+Dennis Thiessen
+
+\end{document}
@@ -0,0 +1,92 @@
+\documentclass{resume}
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage[ngerman]{babel}
+\usepackage{lmodern}
+\usepackage[a4paper,left=0.65in,right=0.65in,top=0.55in,bottom=0.55in]{geometry}
+\usepackage{xcolor}
+\usepackage{hyperref}
+\hypersetup{hidelinks}
+\usepackage[version=4]{mhchem}
+\usepackage{fancyhdr}
+\pagestyle{fancy}
+\fancyhf{}
+\renewcommand{\headrulewidth}{0pt}
+\fancyfoot[R]{\small \thepage/\pageref{LastPage}}
+
+\hyphenation{Trans-krip-ti-on}
+
+\name{Dennis Thiessen, M.Eng.}
+\headline{Staff Data, Analytics \& AI Engineer $\vert$ Python · Kubernetes · MLOps}
+\contactline{Thun, Schweiz $\vert$ \href{mailto:dennis@thiessen.io}{dennis@thiessen.io} $\vert$ +41 795 955 585 $\vert$ \href{https://linkedin.com/in/dennis-thiessen}{LinkedIn}\\Deutscher Staatsbürger $\vert$ Schweizer Aufenthaltsbewilligung B\\Deutsch (Muttersprache) $\vert$ Englisch (fliessend)}
+
+\begin{document}
+
+\begin{rSection}{Profil}
+Staff Data, Analytics \& AI Engineer mit über zehn Jahren Erfahrung in produktiven Daten- und Softwaresystemen. Verbindet Python/Kubernetes und Linux-/Ansible-Automatisierung mit produktiver ML-Inferenz und der Konfiguration domänengestützter LLM-Assistenten; sechs Jahre Bundeswehr mit abgeschlossener Offizierausbildung ergänzen das Profil.
+\end{rSection}
+
+\begin{rSection}{Kenntnisse}
+\skillline{Programmierung \& Schnittstellen}{Python, SQL, REST APIs; LiteLLM in aktueller API-Nutzung}
+\skillline{AI/ML Engineering}{Containerisierung und Deployment von AI-/ML-Workloads, domänengestützte LLM-Assistenten, NLP/Spracherkennung im Forschungsprojekt}
+\skillline{Plattform \& Automation}{Linux, Docker, Kubernetes, Ansible, GitLab CI/CD, Jenkins}
+\skillline{Data Engineering}{Kafka, Airflow, PySpark, AWS (S3, Glue, Athena/Iceberg, Redshift), Datenpipelines, Datenaufbereitung}
+\skillline{IaC \& Betrieb}{CloudFormation, ELK, Grafana, Prometheus, On-Call-Betrieb, DevSecOps}
+\skillline{Zertifizierungen}{AWS Solutions Architect -- Associate, gültig bis Sep. 2027; Data Engineering with AWS, 2026; IBM AI Engineering mit TensorFlow/Keras im Weiterbildungskontext; iSAQB CPSA Foundation}
+\end{rSection}
+
+\begin{rSection}{Berufserfahrung}
+
+\begin{rSubsection}{Swisscom (Schweiz) AG}{Okt. 2023 -- heute}{Staff Data, Analytics \& AI Engineer (Engineer IV; Beförderung Apr. 2025)}{Bern, Schweiz}
+\item Konfiguriert domänengestützte LLM-Assistenten in einer Swisscom-eigenen Weboberfläche: Auswahl verfügbarer Modelle und kuratierte Wissensgrundlagen für Fragen, Migrationsunterstützung und Datenmapping.
+\item Entwickelt, deployt und betreibt Python-Datenanwendungen auf Kubernetes; automatisiert Build, Tests und Deployment mit GitLab CI/CD.
+\item Modelliert und implementiert governance-konforme Datenprodukte innerhalb des unternehmensweiten AWS Data Mesh von Swisscom. Onboardet Quellsysteme und dokumentiert Metadaten sowie Lineage in Atlassian Compass.
+\item Verantwortet als Component Owner geschäftskritische Fulfillment-ETL-Pipelines von Oracle und Kafka in das Teradata DWH, einschliesslich Data Governance, 2nd/3rd-Level-Support, Rufbereitschaft und SLA-Einhaltung.
+\item Übernimmt 2025/2026 die Teamrolle als Security Champion; absolvierte 100 Stunden Training zu Cloud Security, DevSecOps, Security by Design und Risikomanagement mit abschliessender Prüfung.
+\end{rSubsection}
+\end{rSection}
+
+\newpage
+
+\begin{rSection}{Berufserfahrung (Fortsetzung)}
+\begin{rSubsection}{Robert Bosch Semiconductor Manufacturing Dresden GmbH}{Feb. 2020 -- Dez. 2022}{Senior Data Engineer, Data Analysis (Beförderung Jan. 2021)}{Dresden, Deutschland}
+\item Integrierte ML-Inferenz als Docker-Container mit Kubernetes und Ansible in die kontinuierliche Halbleiterfertigung. Ermöglichte damit eine vollautomatisierte Klassifikation von Defektbildern.
+\item Administrierte Linux-Server für Analyse- und ML-Workloads und automatisierte deren Konfiguration mit Ansible. Entwickelte ein Plugin, das Zugangsdaten lokal zwischenspeicherte und Keystore-Abfragen reduzierte.
+\item Verantwortete als Application Owner Analyseanwendungen und vorgelagerte Pipelines; definierte SLOs und koordinierte Hersteller, technische Dokumentation und Wissenstransfer an die Nutzer.
+\item Baute einen ELK/Kafka-Proof-of-Concept für Anomalieerkennung und ergänzte das Monitoring um Grafana, Prometheus und Loki.
+\end{rSubsection}
+
+\begin{rSubsection}{Fraunhofer-Center für Maritime Logistik und Dienstleistungen CML}{Sep. 2018 -- Okt. 2019}{Wissenschaftlicher Mitarbeiter / Research Software Engineer}{Hamburg, Deutschland}
+\item Implementierte im ARTUS-Forschungsteam ML- und NLP-Komponenten für die automatische Transkription von Kommunikation bei Seenotrettungseinsätzen.
+\end{rSubsection}
+
+\begin{rSubsection}{Vizrt}{Juli 2017 -- Mai 2018}{DevOps Engineer}{Bergen, Norwegen}
+\item Entwickelte Python-Backend-Komponenten für verteiltes Video-Transcoding und integrierte automatisierte Audio-/Video-Tests als Quality Gates in die CI/CD-Pipeline.
+\end{rSubsection}
+
+\compactentry{Generali Deutschland Informatik Services GmbH}{Mai 2015 -- Juni 2017}
+\textit{IT Consultant}\hfill\textit{Hamburg, Deutschland}\par
+\end{rSection}
+
+\begin{rSection}{Militärischer Werdegang}
+\begin{rSubsection}{Bundeswehr}{Juli 2008 -- Nov. 2014}{Offizieranwärter / Offizier}{Deutschland}
+\item Absolvierte Offizieranwärterlehrgang und Offizierschule während sechsjähriger Dienstzeit; schied im Dienstgrad Leutnant aus der Bundeswehr aus.
+\end{rSubsection}
+\end{rSection}
+
+\begin{rSection}{Projekte}
+\begin{rSubsection}{Privater Debian-Server}{seit rund zehn Jahren}{Eigenbetrieb}{}
+\item Betreibt und administriert einen selbst gehosteten Debian-Server mit nginx, Mailserver, Nextcloud, VPN, Docker-Diensten und Bitwarden; verantwortet Systemhärtung und Security-Konfiguration selbst.
+\end{rSubsection}
+\end{rSection}
+
+\begin{rSection}{Ausbildung}
+\compactentry{M.Eng. Computer Aided Engineering}{Apr. 2012 -- Okt. 2013}
+Universität der Bundeswehr München, Vertiefung Software Design \& Engineering. Masterarbeit an der Tongji University, Shanghai: \textit{Development of a Web-Based Remote Fault Diagnosis System}; Note 1,0.
+
+\vspace{0.25em}
+\compactentry{B.Eng. Information and Telecommunication Technologies}{Okt. 2009 -- Okt. 2012}
+Universität der Bundeswehr München.
+\end{rSection}
+
+\end{document}
@@ -0,0 +1,58 @@
+\ProvidesClass{resume}[2026/07/27 Evidence-first professional resume]
+\LoadClass[11pt,a4paper]{article}
+
+\RequirePackage{enumitem}
+\RequirePackage{ifthen}
+\RequirePackage{lastpage}
+\RequirePackage{parskip}
+\RequirePackage{needspace}
+
+\pagestyle{empty}
+\setlength{\parindent}{0pt}
+
+\def\@resumename{}
+\def\@resumeheadline{}
+\def\@resumecontact{}
+
+\newcommand{\name}[1]{\def\@resumename{#1}}
+\newcommand{\headline}[1]{\def\@resumeheadline{#1}}
+\newcommand{\contactline}[1]{\def\@resumecontact{#1}}
+
+\newcommand{\printresumeheader}{%
+  {\LARGE\bfseries \@resumename}\par
+  \vspace{0.15em}
+  \ifthenelse{\equal{\@resumeheadline}{}}{}{\@resumeheadline\par}
+  \vspace{0.1em}
+  {\small \@resumecontact}\par
+  \vspace{0.45em}
+}
+
+\AtBeginDocument{\printresumeheader}
+
+\newenvironment{rSection}[1]{%
+  \vspace{0.35em}
+  {\bfseries #1}\par
+  \vspace{0.1em}\hrule\vspace{0.35em}
+}{%
+  \vspace{0.2em}
+}
+
+\newenvironment{rSubsection}[4]{%
+  \Needspace{6\baselineskip}%
+  {\bfseries #1}\hfill{\small #2}\par
+  {\itshape #3}\hfill{\itshape #4}\par
+  \vspace{0.1em}
+  \begin{itemize}[leftmargin=1.25em,label=\textbullet,itemsep=0.18em,topsep=0.15em,parsep=0pt,partopsep=0pt]
+}{%
+  \end{itemize}
+  \vspace{0.25em}
+}
+
+\newcommand{\skillline}[2]{%
+  \textbf{#1:} #2\par
+  \vspace{0.08em}
+}
+
+\newcommand{\compactentry}[2]{%
+  \textbf{#1}\hfill #2\par
+}
@@ -0,0 +1,474 @@
+# Session: RUAG C5I - AI Engineer C5I (w/m/d)
+
+## JD Integrity
+- **File/source:** `JD_ruag_ai_engineer_c5i.txt`; verbatim visible body from `https://jobs.ruag.ch/offene-stellen/ai-engineer-c5i/4afaa9aa-74c1-4b4d-9232-cf65651ce8ec`.
+- **Retrieval method and date:** direct web retrieval of the live RUAG posting and apply form, 2026-08-27.
+- **Verbatim posting:** YES.
+- **Posting status:** LIVE 2026-08-27; application form reachable. Internal application ID 18027, publish ID 10075372.
+- **Official portal listing:** Berufserfahrene, Thun, Switzerland, 80-100%.
+
+## Application Decision
+- **Audience profile:** Swiss/DACH. German-language posting, Swiss defence employer, local Thun role.
+- **Evidence Fit:** **74/100**.
+- **Fit class:** **Stretch under `application_strategy.md`**, although the numerical score is at the top of Adjacent. The title-defining AI-/LLM-platform build and in-house LLM implementation are only Adjacent.
+- **Hard gate:** **FAIL under the strict `critique_framework.md` title-capability rule.** Dennis has not built or operated an AI-/LLM platform or implemented a production retrieval/document solution. His evidence is real but one layer adjacent: Kubernetes/data-platform operation, professional Linux/Ansible, containerized ML inference integration, LiteLLM/API exposure and configuration of grounded LLM assistants.
+- **Channel Strength:** Weak today; upgradeable to Moderate only after an actual conversation.
+- **Channel plan:** contact Frank Haugwitz (`recruiting-c5i@ruag.ch`) for compensation/PSP screening and Marco Heinzen (`marco.heinzen@ruag.ch`, +41 79 568 14 96) for technical scope, especially whether the first six months centre on platform engineering or direct RAG/LLM implementation.
+- **Cohort slot:** evidence-first-2026-01 currently 5/10: Core 3/7, Adjacent 2/2, Stretch 0/1. Proceeding would consume the sole Stretch slot.
+- **Decision:** **PROCEED by explicit user override, 2026-08-27.** The user consciously accepts the title-capability gap, unresolved compensation/PSP questions and use of the cohort's sole Stretch slot. The Evidence Fit, Stretch classification and strict hard-gate result remain unchanged.
+
+## Role and Practical Context
+| Field | Current fact |
+|---|---|
+| Employer | RUAG, Business Area C5I |
+| Role | AI Engineer C5I (w/m/d) |
+| Location | C5I, Uttigenstrasse 36, 3600 Thun |
+| Pensum | 80-100% |
+| Target group | Berufserfahrene |
+| Technical contact | Marco Heinzen, Principal GIS Engineering C5I, +41 79 568 14 96, `marco.heinzen@ruag.ch` |
+| Recruiting contact | Frank Haugwitz, Director Sourcing C5I-Campus, `recruiting-c5i@ruag.ch` |
+| Application documents | CV / complete dossier required; motivation letter and certificates optional |
+| Work model | Flexible hours and home-office options stated; no cadence promised. Commute is immaterial because the role is in Thun |
+| Security process | RUAG states that all new employees undergo a Personensicherheitsprüfung; the JD also requests criminal- and debt-register extracts before employment |
+| Compensation | No band. RUAG states market-based pay, 13 monthly salaries and allowances. Small self-reported samples indicate a meaningful risk of a cut versus current approximately CHF 140k; exact role band must be asked |
+
+### PSP / citizenship read
+- The posting contains **no Swiss-citizenship requirement**.
+- RUAG's official careers page says all new employees undergo a PSP.
+- SEPOS states that people resident abroad can in principle undergo a PSP and that third-party/company employees are checked for security-sensitive work. This does not guarantee a positive result or this role's project eligibility.
+- German citizenship plus Swiss B work authorization is therefore **not an evidenced automatic disqualifier**, but the role-specific PSP/project-access position remains a practical question for RUAG.
+
+### Compensation read
+- Official posting: no salary band; only market-based pay, 13 salaries and benefits.
+- Kununu RUAG samples are small and non-authoritative: DevOps Engineer approximately CHF 96.6k (n=2), Data Scientist approximately CHF 106.2k (n=2), Software Developer approximately CHF 110.5k average with CHF 78.3k-138.4k range (n=6).
+- These numbers cannot price this vacancy, but they make a material pay cut versus current compensation plausible. The Thun-local exception permits near-current pay, not a large reduction.
+
+## Requirements
+| # | Requirement | Req/Pref | Class | Canonical evidence | Gate? |
+|---|---|---|---|---|---|
+| Q1 | BSc/MSc in Informatics, Computer Science, Data Science or comparable | Required | **Direct** | EDU-MENG (M.Eng. Computer Aided Engineering, Software Design & Engineering); EDU-BENG | - |
+| Q2 | Several years in ML Engineering, Data Engineering, Software Engineering or DevOps | Required, disjunctive | **Direct** | SWISSCOM employment + SW-1/SW-2/SW-3; BOSCH + BS-1/BS-2/BS-6; FRAUNHOFER; VIZRT | - |
+| Q3 | Very strong Python and experience with modern ML/AI frameworks | Required | **Split: Python Direct, frameworks Adjacent** | Python production-current; FC-2 ML/NLP contribution; BS-1 ML-inference integration; TensorFlow/Keras only certification-context evidence | ⚠ |
+| Q4 | Linux, Docker, Kubernetes or comparable platforms | Required, disjunctive | **Direct** | BS-6, PP-3, BS-1, SW-3 | - |
+| Q5 | LLM, RAG, APIs, data pipelines or search knowledge | Preferred, disjunctive | **Direct overall / partial** | SW-8 LLM configuration and LiteLLM API exposure; SW-1/SW-2/SW-3 data pipelines. RAG and search implementation remain Gaps | - |
+| Q6 | Structured, independent, pragmatic execution | Required behaviour | **Adjacent** | SW-2 Component Owner, BS-3 Application Owner, FC-1 independent CI/CD setup; do not turn these into unsupported personality claims | - |
+| Q7 | Very good German; English preferred | Required / preferred | **Direct** | German native, English fluent | - |
+| Q8 | Higher NCO or officer career | Preferred | **Direct and differentiating** | BW-1: six years Bundeswehr, officer training/school, left as Second Lieutenant | - |
+| C1 | Swiss work authorization | Practical | **Direct** | German citizen, Swiss B permit, no sponsorship required | - |
+| C2 | PSP and project access | Practical | **Constraint** | PSP applies to all RUAG entrants; no nationality gate stated; role-specific outcome unknown | ⚠ |
+| C3 | Compensation acceptable | Practical | **Constraint** | No published band; external samples suggest downside risk | ⚠ |
+
+## Core Responsibilities
+| # | Responsibility | Class | Canonical evidence | Gap boundary |
+|---|---|---|---|---|
+| R1 | Build, evolve and operate internal AI/LLM platform including compute cluster | **Adjacent, title-defining** | SW-3 Kubernetes/Python operations; BS-6 professional Linux/Ansible; BS-1 ML inference | No AI/LLM platform ownership, compute-cluster or GPU-cluster operation |
+| R2 | Implement in-house LLM solutions, connectors, tools, retrieval/document solutions | **Adjacent-to-Gap, title-defining** | SW-8 configured grounded assistants; LiteLLM API hands-on | No production LLM implementation, RAG/retrieval implementation, orchestration or formal evaluation |
+| R3 | Develop data pipelines, preprocessing and internal interfaces | **Direct** | SW-1, SW-2, SW-3, SW-6, SW-7, BS-2 | Scope must stay on owned pipelines/data products, not company platform ownership |
+| R4 | Deliver AI/R&D PoCs, MVPs and pilots | **Direct-to-Adjacent** | BS-4 anomaly-detection PoC; FC-2 ML/NLP contribution; GN-2 PoCs; academic prototype evidence | No claim of end-to-end ownership of shared research programmes |
+| R5 | Containerize, deploy and automate AI workloads | **Direct** | BS-1 Docker/Kubernetes/Ansible ML-inference integration; BS-6 automation | Do not claim model training or full ML lifecycle |
+| R6 | Technical documentation and team knowledge transfer | **Direct** | BS-3 documentation/training; GN-1 training and technical ownership | - |
+
+## Evidence Fit Breakdown
+| Dimension | Weight | Score | Reasoning |
+|---|---:|---:|---|
+| Required qualifications | 35 | **29** | Degree, years, Python, Linux/container stack and languages are Direct; modern ML/AI-framework depth is Adjacent |
+| Core responsibilities | 25 | **17** | Data pipelines, AI-workload deployment and documentation are Direct; the two leading AI/LLM-platform responsibilities are only Adjacent |
+| Level and ownership | 15 | **11** | Staff + Component Owner/Application Owner exceeds generic Berufserfahrene level; role may be lateral/down-level despite meaningful build scope |
+| Recency and depth | 10 | **8** | Data/Kubernetes/Python current; direct production-ML integration and deepest Linux automation date to Bosch, while current LLM evidence is configuration-level |
+| Domain/tool transfer | 10 | **6** | Strong transfer from Kubernetes, Linux, data platforms and inference deployment; compute cluster, GPU operations, RAG and search are not substitutable by wording |
+| Practical constraints | 5 | **3** | Thun, German, 80-100% and work authorization are excellent; compensation and project-specific PSP access remain unresolved |
+| **Total** | **100** | **74** | Numerical Adjacent; strategic **Stretch** because both title-leading AI/LLM responsibilities are not Direct |
+
+## Competitive Read
+- **Obvious-fit candidate:** an MLOps/LLM-platform engineer who has built a private RAG platform, operates GPU/compute clusters, implements retrieval/connectors in Python, and can pass RUAG's PSP; ideally also Swiss military officer/NCO background.
+- **Dennis's advantage:** unusually strong combination of production data engineering, Kubernetes delivery, professional Linux/Ansible automation, containerized ML inference in 24/7 manufacturing, current LLM configuration/API exposure, native German, exact Thun location and verified officer career.
+- **Their advantage:** direct ownership of the two things the title names: an AI/LLM platform and production retrieval/LLM solutions, plus likely GPU cluster depth.
+- **Level/scope:** Dennis is currently Staff/Engineer IV. This vacancy is labelled only Berufserfahrene, not Senior/Staff/Principal. The platform build could be substantive, but compensation and decision authority must be checked before treating it as lateral rather than a down-level move.
+
+## Framing Strategy if the user overrides the HOLD
+- **Professional identity:** Staff Data & Platform Engineer with production ML-inference integration, Kubernetes/Linux automation and a six-year officer career.
+- **Strongest proof points:** BS-1, BS-6, SW-3, SW-2, SW-1/SW-7, BW-1.
+- **Honest adjacent bridges:** SW-8 and LiteLLM/API exposure for LLM context; FC-2/BS-4 for AI/R&D PoCs.
+- **Explicit gaps:** no owned AI/LLM platform, no RAG/retrieval implementation, no compute/GPU cluster operation, no formal LLM evaluation, no model training ownership.
+- **User directives:** officer career should be visible because the JD explicitly lists it as advantageous; no invented clearance, command scope or military ICT work.
+
+## Cover Letter Decision
+- **Provisional decision: YES if proceeding.** The portal makes it optional, but the officer-career motivation and the honest transition from data/MLOps infrastructure into an AI/LLM-platform remit add information the resume cannot fully carry.
+- **Verified hooks:** only the live RUAG posting: C5I support to the Swiss Army/Kommando Cyber, DevSecOps model, sovereign/high-security systems and the Thun C5I campus.
+- **Do not write yet:** Phase 0 is on HOLD.
+
+## Questions that clear the HOLD
+1. **Technical scope to Marco Heinzen:** Is direct production experience implementing RAG/LLM platforms expected on day one, or is the team explicitly hiring a strong Python/Kubernetes/data-platform engineer to build that capability?
+2. **Compensation to Frank Haugwitz:** What is the target base-salary range for this vacancy, including how the 13th salary and variable allowances are quoted?
+3. **PSP/project access to Frank Haugwitz:** Is a German citizen with a Swiss B permit eligible for the required PSP and all intended C5I project assignments?
+4. **Level:** What decision authority and technical ownership distinguish this role from RUAG's Senior/Principal engineering roles?
+
+## Phase 2: Audience and Content Plan
+
+### Positioning and format
+- **Profile:** Swiss/DACH, German, two pages. RUAG is a traditional Swiss defence employer and the portal requests a complete dossier.
+- **Professional identity:** Staff Data & Platform Engineer with production ML-inference integration, Kubernetes/Linux automation, current hands-on LLM application configuration and a six-year Bundeswehr officer career.
+- **Accuracy boundary:** Do not present Dennis as an established AI/LLM-platform owner. Do not claim RAG, retrieval implementation, GPU/compute-cluster operation, model training, formal LLM evaluation or a security clearance.
+- **Headline direction:** `Staff Data & Platform Engineer | Python · Kubernetes · MLOps`
+- **Summary:** YES, two short sentences. Lead with current Staff-level data/platform ownership and production ML-inference deployment; add the officer career as defence-context differentiation. Describe LLM work as configuration of domain-grounded assistants, not production platform engineering.
+
+### Skills plan, five compact lines
+1. **Programming and interfaces:** Python, SQL, REST APIs; LiteLLM only as current hands-on API exposure.
+2. **AI/ML engineering:** ML-inference deployment, containerized AI workloads, domain-grounded LLM assistant configuration, applied NLP/speech-recognition contribution.
+3. **Platform and automation:** Linux, Docker, Kubernetes, Ansible, GitLab CI/CD, Jenkins.
+4. **Data engineering:** Kafka, Airflow, PySpark, AWS S3/Glue/Athena with Iceberg/Redshift.
+5. **IaC, operations and security:** CloudFormation, ELK, Grafana, Prometheus; DevSecOps tied to the 2025/2026 Security Champion assignment, not presented as a certification.
+
+TensorFlow/Keras remain certification-context only. C++, JavaScript, Terraform, RAG frameworks and named LLM orchestration libraries are omitted.
+
+### Planned resume bullets
+| Order | Role / claim | Evidence type | Scoped bullet direction | Why it belongs |
+|---:|---|---|---|---|
+| 1 | Swisscom, **SW-8** | Hands-on, current | Configured domain-grounded LLM assistants in a Swisscom-owned interface by selecting available models and supplying curated knowledge for Q&A, migration assistance and data mapping. | Closest current LLM evidence; directly relevant without implying RAG or deployment ownership. |
+| 2 | Swisscom, **SW-3** | Production, current; primary developer/operator | Develops, deploys and operates Python data applications on Kubernetes; automates build, test and deployment through GitLab CI/CD. | Direct match for Python, Kubernetes, containerization and automation. |
+| 3 | Swisscom, **SW-7** | Production, current; scoped data-product delivery | Models and implements governed data products and source onboarding within Swisscom's company-wide AWS Data Mesh; uses Compass for metadata and lineage as a practitioner. | Shows reliable data foundations for internal AI solutions while preserving shared-platform scope. |
+| 4 | Swisscom, **SW-2** | Production, current; Component Owner | Holds component responsibility for Fulfillment pipelines from Oracle/Kafka into Teradata, including governance, support, on-call duty and SLA accountability. | Strongest operations and ownership evidence. |
+| 5 | Swisscom, **SW-5** | Current bounded team assignment | Serves as team Security Champion for 2025/2026 after 100 hours of DevSecOps/security training and assessment. | C5I and the posting's DevSecOps context justify the otherwise optional signal. |
+| 6 | Bosch, **BS-1** | Production, historical; primary integration owner | Integrated containerized ML inference with Docker, Kubernetes and Ansible into 24/7 semiconductor production, enabling fully automated image classification. | Flagship direct evidence for deployment and automation of AI workloads. |
+| 7 | Bosch, **BS-6** | Production, historical; primary administrator/automation developer | Administered and automated Linux hosts for analytics and ML workloads; developed Ansible extensions and CI-triggered configuration workflows. | Closest evidence for the platform/compute side of the target role; no cluster scale is claimed. |
+| 8 | Bosch, **BS-3** | Production, historical; Application Owner | Owned lifecycle responsibilities for analytics applications and upstream pipelines, including SLOs, documentation, training and vendor coordination. | Direct operational ownership plus the JD's documentation and knowledge-transfer requirements. |
+| 9 | Bosch, **BS-4** | Proof of concept | Implemented an ELK/Kafka anomaly-detection PoC with Grafana, Prometheus and Loki monitoring. | Direct evidence for AI/R&D PoCs and observability; PoC status stays explicit. |
+| 10 | Fraunhofer, **FC-2** | Research-project contribution | Implemented ML/NLP components within the ARTUS research team for automatic transcription of sea-rescue communications. | Adds applied NLP and research-pilot evidence; team scope avoids sole-ownership implication. |
+| 11 | Vizrt, **VZ-1 + VZ-2** | Production, historical; primary developer | Developed Python backend components for distributed video transcoding and integrated automated A/V tests as CI/CD quality gates. | Concise software-engineering and DevOps depth; avoids irrelevant C++/JavaScript skill padding. |
+| 12 | Bundeswehr, **BW-1** | Verified completed service | Completed officer candidate training and officer school during six years of Bundeswehr service; left service as Second Lieutenant. | Explicit preferred qualification and the package's strongest defence-context differentiator. |
+
+Generali remains a compact chronology entry without bullets. **Capgemini is omitted entirely** by standing user preference (six months only; short-stay impression). The Bundeswehr receives a dedicated `Militärischer Werdegang` section rather than being hidden under additional information.
+
+### Certifications and education
+- M.Eng. Computer Aided Engineering and B.Eng. Information and Telecommunication Technologies remain visible.
+- Highlight AWS Certified Solutions Architect - Associate, Data Engineering with AWS and IBM AI Engineering. TensorFlow/Keras appear only within the IBM certification context.
+- iSAQB CPSA Foundation may be retained if layout permits; certifications appear exactly once.
+
+### Impact and verification
+- No unverified numeric metric is planned.
+- `BS-1` may use the source-backed qualitative outcome of fully automated image classification; no percentage, scale or exact workload reduction will be invented.
+- Optional enrichment, not required for generation: verified adoption/users or deployment status of the `SW-8` assistants. Without it, the bullet remains configuration-level.
+
+### Cover Letter Decision
+- **YES.** The optional letter adds two things the resume cannot fully explain: the deliberate, honest bridge from data/MLOps infrastructure into an AI/LLM-platform remit, and the motivation to contribute again in a defence-related environment after six years of Bundeswehr service.
+- **Narrative:** production-critical ML integration at Bosch; current Kubernetes/data/LLM-adjacent work at Swisscom; officer background and motivation to support sovereign, secure C5I capabilities in Thun.
+- **Boundary:** RUAG supports the Swiss Army; employment at RUAG must not be described as rejoining the armed forces. Use `erneut im Umfeld von Landesverteidigung und gesellschaftlicher Verantwortung wirken` rather than `wieder Teil der Armee sein`.
+
+## Phase 3/4: As-built Resume
+- **File:** `output/RUAG_AI_Engineer_C5I/e2e_ruag_ai_engineer_c5i_resume.tex`
+- **Format:** German Swiss/DACH profile, A4, 11 pt, two pages, no photo.
+- **As-built positioning:** `Staff Data & Platform Engineer | Python · Kubernetes · MLOps`.
+- **As-built selection:** 12 bullets using `SW-8`, `SW-3`, `SW-7`, `SW-2`, `SW-5`, `BS-1`, `BS-6`, `BS-3`, `BS-4`, `FC-2`, `VZ-1 + VZ-2` and `BW-1`. Generali remains an unbulleted chronology entry. Capgemini is omitted.
+- **Military evidence:** `BW-1` appears in the profile and in a dedicated `Militärischer Werdegang` section. No command responsibility, deployment, clearance or military ICT work is implied.
+- **LLM boundary:** current evidence is stated as configuration of domain-grounded assistants and LiteLLM API use. The document contains no RAG, retrieval, compute-cluster, GPU-cluster, model-training or LLM-platform ownership claim.
+- **Plan adjustment for layout:** certifications appear once inside `Kenntnisse`; German and English appear in the header. This preserves the information and gives page 2 a cleaner close. The Bosch title was shortened to the verified formal title to avoid a collision with the location.
+- **Language sweep:** no em dash, `Baue`, `Trug`, `begrenzt`, C++, JavaScript, Terraform, RAG or fabricated orchestration framework appears. Bullets use technical, scoped verbs.
+
+### Validation and rendering
+- Canonical system preflight: **PASS, 0 warnings**.
+- Document validator after final edit: **PASS, 0 warnings**.
+- MiKTeX compilation: **PASS**, two runs, exactly **2 pages**.
+- Log inspection: no Overfull/Underfull boxes and no LaTeX/package warnings.
+- `pdftotext -layout`: employer, title, date, location and section order parse correctly across both pages.
+- Visual QA: both final pages rendered to PNG at 150 dpi and inspected; no clipping, overlap, broken glyphs, isolated headings or awkward page transition.
+- The compiled PDF and PNGs were temporary QA artifacts only. The deliverable remains the `.tex` source as configured.
+
+## Post-Handover Fix and Re-Verification, 2026-08-27
+The package was inherited mid-session after a usage limit on the previous model. The recorded Phase 3/4 completion was audited independently and one defect was found and corrected.
+
+### Defect found and fixed
+- **Capgemini Deutschland GmbH was present as a chronology entry.** This violates a standing user preference recorded in `CLAUDE.md` and in memory: Capgemini is omitted from all documents because the six-month tenure reads as a short stay. A corpus check confirmed this resume was the **only** generated `.tex` under `output/` containing Capgemini. The entry and its separating vertical space were removed; the visible chronology now begins at Generali, Mai 2015.
+- **The Nov. 2014 to Mai 2015 gap this creates is intentional and stays.** The submitted Kdo Cy resume carries the identical gap.
+- **The profile claim "über zehn Jahren" survives unchanged.** The visible record now runs Generali Mai 2015 to Aug. 2026, about eleven years three months, so the wording remains true.
+
+### Re-verification after the fix
+- Document validator: **PASS, 0 warnings** (re-run after the Thun contact-line change).
+- MiKTeX compilation, two runs: **PASS**, exactly **2 pages**, **0 Overfull/Underfull boxes**, no LaTeX or package warnings. Re-run after the Thun change, this time **compiled into the output folder** rather than a temp directory.
+- Extracted text of the final PDF contains **0** occurrences of "Capgemini" and reads `Thun, Schweiz` in the contact line.
+- Text extraction: employer, title, date, location and section order parse correctly on both pages; footers read 1/2 and 2/2.
+- Visual QA: both pages re-rendered to PNG and inspected **after** the edit. No clipping, overlap, orphaned heading or broken page transition. Page 2 closes on Ausbildung with roughly two inches of trailing whitespace, which is accepted; `CLAUDE.md` forbids page-fill quotas.
+- **Note on the prior session's QA claim:** the temporary working folder still held a stale 3-page text extraction from an earlier draft, so the previously recorded visual check was made against a different document than the final one. The checks above were run against the current source.
+- **Page 2 was deliberately not backfilled.** `PP-3` (private Debian server) is available as additional Linux evidence and was used in the Kdo Cy package, but re-opening the approved 12-bullet plan to fill freed space would be page-filling, not relevance.
+
+### Contact location: RESOLVED 2026-08-27
+- **The contact line was changed from `Bern, Schweiz` to `Thun, Schweiz`.** The user decided on 2026-08-27 that for roles **in Thun and its immediate surroundings** the contact line may carry Thun. This vacancy is in Thun and the user lives in Thun, so local residency is now visible to a traditional Swiss defence employer - the session's Competitive Read already counted "exact Thun location" among his advantages, and the document had been hiding it.
+- **Scope of the change:** contact line only. The Swisscom position keeps `Bern, Schweiz`, because that is factually where that job is.
+- **Recorded as a standing rule** in memory and `config.md`: Thun for Thun-area roles, Bern as the default everywhere else. The earlier "always Bern, ask first" note is superseded.
+
+## User Review Round, 2026-08-27
+Three changes requested by the user on review of the compiled PDF. All three applied, then re-validated, re-compiled and both pages re-inspected.
+
+| # | Change | Basis |
+|---|---|---|
+| 1 | **Removed "Kein Sponsoring durch den Arbeitgeber erforderlich" from the contact line.** | User: it is common knowledge that EU citizens need no sponsorship, so the sentence adds nothing. The header still carries "Deutscher Staatsbürger" and "Schweizer Aufenthaltsbewilligung B", which resolve work authorization on their own. |
+| 2 | **Bosch title changed to `Senior Data Engineer, Data Analysis (Beförderung Jan. 2021)`**, matching the Swisscom line's shape. | The promotion is **not** in `claims.json`; it is recorded LinkedIn-confirmed in `experience_bosch.md`: Data Engineer Feb 2020 - Jan 2021, **Senior** Data Engineer Jan 2021 - Dez 2022. That file also explicitly sanctions "(Senior) Data Engineer" as a display form. `claims.json` has now been corrected so this is canonical going forward. |
+| 3 | **Vizrt title shortened to `DevOps Engineer`**, dropping "Test Automation /". | User request. ⚠ **Flagged accuracy note:** the canonical `official_title` for Vizrt is **"Test Automation Engineer"**; "DevOps Engineer" is half of the sanctioned `display_title` "Test Automation / DevOps Engineer". The bullet content (CI/CD quality gates, Python backend for distributed transcoding) supports the DevOps framing, and the user is the authority on his own role, but this is the one title line on the document that will not match a Zeugnis or reference check word-for-word. Recorded here so it is a conscious choice, not a drift. |
+
+### Re-verification after the review round
+- Document validator: **PASS, 0 warnings**.
+- MiKTeX, two runs: **PASS**, exactly **2 pages**, **0 Overfull/Underfull boxes**, no LaTeX or package warnings.
+- Both pages re-rendered and inspected. The longer Bosch title does **not** collide with `Dresden, Deutschland`; the earlier concern recorded in `CLAUDE.md` about a Bosch title/location collision does not apply at this length.
+- Header now reads three lines: contact, citizenship/permit, languages.
+- Build artifacts removed from the output folder; `Dennis_Thiessen_Lebenslauf.pdf` refreshed from the new build and verified identical to the `e2e_` PDF by checksum.
+
+## Phase 5: As-built Cover Letter, 2026-08-27
+- **File:** `output/RUAG_AI_Engineer_C5I/e2e_ruag_ai_engineer_c5i_cover_letter.tex`
+- **Format:** German Swiss/DACH motivation letter, A4, 11 pt, **1 page, 275 body words** (target 250-300).
+- **Addressee:** Frank Haugwitz, Director Sourcing C5I-Campus, at RUAG MRO Holding AG, Business Area C5I, Uttigenstrasse 36, 3600 Thun. Submission is portal-only; the letter is uploaded, not mailed.
+- **Contact location:** `Thun, Schweiz`, consistent with the resume and the new Thun-area rule.
+- **Structure:** four short paragraphs plus close. (1) Role thesis: the posting pairs operating an internal AI-workload platform with building the pipelines those workloads depend on, which is the seam he already works on. (2) Bosch `BS-1` and `BS-6`. (3) Swisscom `SW-3`, `SW-2`, then the LLM boundary. (4) `BW-1` and practical fit.
+
+### Deliberate decision: the LLM gap is named explicitly
+The letter states plainly *"Eine AI-Plattform habe ich nicht aufgebaut"*, then pivots immediately to the operations/platform side and to working toward the implementation side from there.
+
+This is a conscious departure from the Kdo Cy letter's approach, where the second-Amtssprache point was deliberately **not** raised so as not to hand the reader an objection (the Aker BP CL-A finding). The reasoning for treating this case differently:
+- The AI/LLM-platform build is **R1, the title-defining responsibility and the JD's first bullet**, not a peripheral requirement. The reader will assess it whether or not the letter mentions it, so silence does not remove the objection - it only removes his framing of it.
+- The session's own Cover Letter Decision names this bridge as the letter's reason to exist: the resume cannot carry it.
+- The JD explicitly invites applicants who do not meet every requirement, which makes candour read as judgement rather than as a defensive gap list.
+- It is one sentence, immediately followed by what he does bring. It is not a gap list.
+
+**Reversible.** If the user prefers the Kdo Cy posture, the sentence can be cut and the paragraph still stands on `SW-3`, `SW-2` and `SW-8`.
+
+### Claim traceability
+Every claim in the letter maps to a resume bullet and a canonical ID: `BS-1` (containerized ML inference into continuous semiconductor production), `BS-6` (Linux administration, Ansible extensions, credential-caching plugin), `SW-3` (Python data applications on Kubernetes), `SW-2` (Component Owner, Oracle/Kafka to Teradata, on-call), `SW-8` (configuring domain-grounded assistants; LiteLLM API use), `BW-1` (six years, officer training, Leutnant). No new skill, tool, metric, customer or ownership claim is introduced.
+
+### Boundaries verified in the body text
+Automated scan of the letter body (comments excluded) found **0** occurrences of RAG, Retrieval, GPU, Compute Cluster, GitOps, LangChain, Terraform, fine-tuning, model training, clearance/Sicherheitsfreigabe, or "wieder Teil der Armee". The only regex hit was the substring "rag" inside *Abfragen*. **0** em dashes.
+- RUAG is described as an environment of `Landesverteidigung und gesellschaftlicher Verantwortung`, never as rejoining the armed forces.
+- `SW-8` stays configuration-level; no platform ownership, orchestration or evaluation is implied.
+- `BS-1` claims integration, not model training.
+- `BW-1` carries no clearance, command scope or military technical work.
+- No unverified metric appears.
+
+### Hook verification, 2026-08-27
+All hooks are first-party, re-fetched live from the posting on the day of writing rather than trusted from the earlier retrieval.
+
+| Claim in the letter | Evidence | Source |
+|---|---|---|
+| Role title `AI Engineer C5I (w/m/d)` | Verbatim match | jobs.ruag.ch posting, live 2026-08-27 |
+| Legal entity `RUAG MRO Holding AG, Business Area C5I` | Verbatim match | same |
+| Address `Uttigenstrasse 36, 3600 Thun` | Verbatim match | same |
+| Addressee `Frank Haugwitz`, Director Sourcing C5I-Campus | Verbatim match, contact still listed | same |
+| The role pairs an internal AI/LLM platform with pipelines/interfaces | `Aufbau, Weiterentwicklung und Betrieb einer internen AI-/LLM-Plattform inkl. Compute Cluster` | same |
+| Posting status | LIVE, application form reachable | same |
+
+No company-news, product or executive-statement hook was used. `cl_reference.md` prefers omitting an unnecessary hook over spending a paragraph proving company familiarity.
+
+### Validation and rendering
+- Document validator: **PASS, 0 warnings**.
+- MiKTeX, two runs: **PASS**, exactly **1 page**, **0 Overfull/Underfull boxes**, no LaTeX or package warnings.
+- Page rendered to PNG and inspected: single well-filled page, no clipping or awkward break.
+- Build artifacts removed; `Dennis_Thiessen_Motivationsschreiben.pdf` created from the same build and verified identical by checksum.
+
+## Critique, 2026-08-27
+- **File:** `output/RUAG_AI_Engineer_C5I/critique_ruag_ai_engineer_c5i.md`
+- **Evidence Fit: 74/100** - re-verified against `claims.json`, unchanged. Strategic **Stretch**; title-capability gate **FAIL** (R1 and R2 both Adjacent). PSP project access and compensation remain **UNRESOLVED**, which is independently a NO-GO trigger under `critique_framework.md` section 1. All of this was in front of the user at the 2026-08-27 override and is recorded, not re-litigated.
+- **Document Quality: 85/100.** Truth and provenance **23/25** - well clear of the 8/10 automatic-failure floor.
+- **Channel: Weak.** Cold portal submit; `jobs.ruag.ch` refuses email and post. Marco Heinzen's direct mobile is published and unused.
+- **Scoring standard:** `critique_framework.md` governs over `SKILL.md` section 9.3/9.4 - dual score, verdicts instead of invented probabilities, no single overall score, no publications weight. `SKILL.md`'s additive coverage (domain lens, five-reader read, bridge points, 6A-6F) was kept in full.
+
+### Verified independently, not inherited from this session file
+Both documents re-validated (**PASS, 0 warnings**), recompiled twice in a scratch folder and found **byte-identical** to the shipped PDFs (133 673 B / 95 497 B), 2 pages / 1 page exactly, **0 boxes, 0 LaTeX warnings**, correct `pdftotext` order, both resume pages and the letter re-rendered at 130 dpi and inspected. Submission-named copies match their `e2e_` builds by **MD5**. `Capgemini` 0 hits; all global-forbidden patterns 0 hits.
+
+### Full skills-token audit - the check that had not been run
+Every token in the header, `Kenntnisse` block and letter was enumerated against `claims.json` `skills[].output`. **Zero `forbidden` skills on either document.** The two non-plain-`allowed` tokens present both carry their required context: **LiteLLM** (`allowed-with-context`) as "in aktueller API-Nutzung", **TensorFlow/Keras** (`certification-context-only`) only inside the Zertifizierungen line. Tokens absent from `skills[]` (Grafana, Prometheus, Loki, Jenkins, GitLab, ELK, Teradata, Oracle, Glue, Athena, Iceberg, Redshift, S3, MLOps) are all claim-backed or experience-file-backed - `skills[]` is a control list, not an inventory. **No Tier 1 truth finding anywhere in the package.**
+
+### Tier 1 fixes - 3, none reopens the bullet plan's truth boundaries
+(Tier 1 ranks by **submission impact**, not strictly by point value: T1-1 scores under cover-letter tailoring, which section 3 does not weight.)
+1. **The letter drops DevSecOps, C5I, Kommando Cyber and the Army.** The JD's `Ueber den Bereich` block leads with all four and states "konsequent nach dem DevSecOps-Modell". `SW-5` is on the resume - Security Champion 2025/2026 after 100 h of Cloud Security / DevSecOps / Security by Design training - and the letter never uses it. A first-party hook matched by current canonical evidence, left on the table. One sentence closes it. **Highest-value edit in the package.**
+2. **`PP-3` is missing and it is the only *current* evidence for the operating half of the role.** The letter's load-bearing sentence is *"Was ich mitbringe, ist die Betriebs- und Plattformseite dieser Rolle"*, and its resume proof is `BS-6`, which **ended Dec 2022**. `claims.json` calls PP-3 "the primary evidence for hands-on Linux administration, system hardening and security configuration, and it is current and continuous". For a defence employer screening every entrant, a decade of self-hosting *and hardening* is materially different, and it evidences Q6 better than any employer bullet. **This is a relevance argument, not page-filling** - section 7a's whitespace ban is not the basis. Kdo Cy used PP-3; this package dropped it.
+3. **`governte Datenprodukte` is not a German word** - the only outright language error in the package. German IT does form participles from English verbs (*gemanagt*, *gehostet*), but *governt* is not among them, and the reader is a native-German Swiss engineer. A corpus check confirms it is a **one-off**: it appears in no other generated document, and **the user's own submitted Kdo Cy CV already carries the fix** - "Modelliere **governance-konforme** Data Products". A one-word substitution, independent of the other two, **worth taking regardless of what is decided about them**. It carried a full point of the Mechanics deduction on its own, separate from cadence.
+
+### Tier 2 (6)
+- **The headline drops "AI" from a req titled AI Engineer**, while his canonical title "Staff Data, Analytics & **AI** Engineer" contains it. Deliberate session choice, not reversed; middle option `Staff Data, Analytics & AI Engineer | Python - Kubernetes - MLOps` uses his real title and promises no platform ownership. **User's call.**
+- **Four honestly closeable JD terms absent:** Data Preprocessing/Datenaufbereitung, Wissenstransfer, AI-Workloads, Containerisierung. Leave MVP/Pilotloesung - PoC is what the evidence supports.
+- **`IBM AI Engineering` has no primary-source record.** The other three certs are in `thiessen_certifications.md` with issuer, date, expiry and cert number; this one is only in `bundle_ml_ai_engineer.md`. Same class as the Ansible/Linux/Bosch-promotion gaps - **verify and record, do not remove**. It matters because TensorFlow/Keras is the *sole* answer to the JD's required "moderne ML-/AI-Frameworks".
+- **CL paragraph 2 is ~90 of 275 words re-telling BS-1 and BS-6**, redeemed by one genuinely new sentence. Compressing it frees the words the two Tier 1 fixes need.
+- **The pivot after the gap admission concedes without evidence** - *"die Implementierungsseite wuerde ich mir von dort aus erarbeiten"* promises to learn. The gap sentence itself is a sound call and should stay; anchor the pivot in BS-1/FC-2.
+- **Volunteering foreign citizenship in the letter at a PSP employer.** Already in the resume header. Lean keep (the sentence lands on "ich wohne in Thun, also am Standort selbst"), but a conscious choice.
+
+### Tier 3
+Cadence: 6/12 bullets end in a 3+ list, exactly at the section 7a ceiling, with consecutive triples at B1-B2 and B8-B9; **bullets 9 and 10 both open "Implementierte"**, a direct section 7a hit that the validator missed because its check does not cross position boundaries. `\today` in the letter - recompile if submitted after 2026-08-27. Bottom whitespace is **not** a finding (section 7a bans adding content for it). Thesis grade 1,0 is permitted; keep.
+
+### Reader verdicts
+ATS **PASS** - clean extraction. Recruiter (Haugwitz) **FORWARD** - every box he owns is above the fold. HR **COMPLETE**. Hiring manager (Heinzen) **MAYBE, and the letter decides it** - if the brief is "build our RAG stack" this is a no; if it is "run the platform while we grow the AI layer" it is a strong yes. Technical reviewer **CREDIBLE** - no claim collapses; first probes are the SW-8 boundary, compute-cluster scale, the 2008-2014 / 2009-2013 officer-track overlap, and Pull-GitOps.
+
+### Cover letter decision
+**KEEP.** The resume structurally cannot answer what this candidate thinks he is applying for given what he has not done; the letter does, in his own words, before Heinzen has to infer it. It needs T1-1 and T2-6.
+
+## Edit 1 Baseline, 2026-08-27
+- **Pages:** 2 (exact)
+- **Validator:** PASS, 0 warnings
+- **Overfull/Underfull boxes:** 0 | **LaTeX warnings:** 0
+- **Variable bullets:** 12 (Swisscom 5, Bosch 4, Fraunhofer 1, Vizrt 1, Bundeswehr 1)
+- **Skills lines:** 6 (incl. Zertifizierungen)
+- **Char violations:** none - `CLAUDE.md` and `resume_reference.md` sections 4/7 replaced fixed 1L/2L/3L bands with natural-length bullets; character counts are diagnostic only and there is no page-fill quota, so the skill's "all bullets must be 2L" and "<=3 lines white space" gates do **not** apply to this project.
+- **Orphan violations:** none observed in visual QA
+- **White space:** ~2 in at the foot of both pages, accepted per `resume_reference.md` section 7a ("Do not add content merely to reduce bottom whitespace")
+- **Cover letter:** 1 page, 275 body words, 4 paragraphs + close, validator PASS
+
+### Edit 1 (2026-08-27): critique Tier 1 + Tier 2, user-approved
+
+**Source:** `critique_ruag_ai_engineer_c5i.md`, user instruction 2026-08-27 ("apply 1-5, 6: use my official title, 7: cut").
+
+**Resume**
+| # | Change | Class | Source |
+|---|---|---|---|
+| 1 | `governte` -> `governance-konforme Datenprodukte` | MODIFY | T1-3 |
+| 2 | New `Projekte` section: `Privater Debian-Server / seit rund zehn Jahren / Eigenbetrieb`, one bullet (`PP-3`) | ADD | T1-2 |
+| 3 | Headline and profile opener -> **`Staff Data, Analytics & AI Engineer`**, his canonical title | MODIFY | T2-2, **user chose the official title** |
+| 4 | `Wissenstransfer`, `Datenaufbereitung`, `AI-/ML-Workloads` + `Containerisierung` added where the work is real | MODIFY | T2-3 |
+| 5 | Bullet 9 opener `Implementierte` -> `Baute` | MODIFY | Tier 3 (7a) |
+| 6 | BS-3 list reordered to natural German: `koordinierte Hersteller, technische Dokumentation und Wissenstransfer an die Nutzer` | MODIFY | found during visual QA |
+
+**Cover letter**
+| # | Change | Class | Source |
+|---|---|---|---|
+| 7 | New standalone paragraph naming **DevSecOps and C5I**, carried by `SW-5` (Security Champion 2025/2026, 100 h) | ADD | T1-1 |
+| 8 | Paragraph 2 compressed: the Ansible credential-plugin detail re-told resume bullet 7 | MODIFY | T2-5 |
+| 9 | Pivot anchored in evidence: `erarbeite ich mir von dort aus, wie zuvor bei der ML-Inferenz in Dresden` | MODIFY | T2-6 |
+| 10 | **Volunteered citizenship sentence cut** | REMOVE | T2-7, **user chose cut**. The resume header still carries `Deutscher Staatsburger` and `Schweizer Aufenthaltsbewilligung B` |
+| 11 | Paragraph 3 split so the DevSecOps beat stands alone | MODIFY | found during visual QA - the merged paragraph ran to nine lines and carried three jobs |
+
+### Two defects found during this edit that the critique had not caught
+
+1. **The resume never loaded `babel`, so a German document was being hyphenated with English patterns.** Visible in the compiled PDF as `Hal-bleiterfertigung`, `Tran-skription` and `automa-tisierte`. Present at baseline and inherited by every earlier build. Adding `\usepackage[ngerman]{babel}` fixed the hyphenation (`Halb-leiterfertigung`, `automati-sierte`) **and** cleared the one overfull box that the longer headline had introduced. A `\hyphenation{Trans-krip-ti-on}` exception was added because ngerman still broke `Transkription` after `Tran`. **Worth checking on every future German-language package.**
+2. **A one-box regression appeared and was caught by the gate, not by eye:** the longer official title reflowed the profile paragraph and overflowed by 33.6 pt. Fixed by the babel change above, not by rewording.
+
+### Verification after Edit 1
+| Gate | Resume | Cover letter |
+|---|---|---|
+| Canonical validator | **PASS, 0 warnings** | **PASS, 0 warnings** |
+| MiKTeX, two passes | **PASS** | **PASS** |
+| Pages | **2** (unchanged) | **1** (unchanged) |
+| Overfull/Underfull boxes | **0** | **0** |
+| LaTeX warnings | **0** | **0** |
+| Submission copy refreshed + MD5 match | **yes** | **yes** |
+| Visual QA at 130 dpi | both pages re-rendered and inspected | re-rendered and inspected |
+
+- **CL body words: 295** (target 250-300). Five short paragraphs plus close.
+- **Cadence improved:** list-terminated bullets **6/12 (50%) -> 4/13 (31%)**, comfortably under the 7a ceiling; **consecutive identical openers 1 -> 0**.
+- Forbidden sweep across both `.tex` files and both extracted PDFs: **0 hits** for Capgemini, LangChain/LangGraph/LlamaIndex, Terraform, Azure, GCP, GitOps, TypeScript, FastAPI, Flask, Django, every global-forbidden pattern, and the standalone acronym `RAG` (the only `rag` matches are inside *Fragen* and *Abfragen*). **0 em dashes.**
+
+### Baseline comparison
+| Metric | Before | After | Delta |
+|---|---:|---:|---|
+| Pages | 2 | 2 | 0 |
+| Bullets | 12 | 13 | +1 (`PP-3`, inside the 11-14 guide) |
+| Boxes | 0 | 0 | 0 |
+| Validator warnings | 0 | 0 | 0 |
+| List-terminated bullets | 50% | 31% | **-19 pts** |
+| Consecutive identical openers | 1 | 0 | **-1** |
+| CL body words | 275 | 295 | +20 (in range) |
+| German hyphenation | English patterns | **ngerman** | fixed |
+
+### KB corrections made during this edit
+- **`IBM AI Engineering` verified and recorded.** The user supplied the certificate; it was read directly. IBM via Coursera, **4 Jun 2020**, no expiry, verify code `3ZBZFVAL6A34`, name on certificate `Dennis Thiessen` (ss/sz variant, as on ITIL and iSAQB). Added as entry **#8** in `thiessen_certifications.md`. **T2-4 is closed** - the resume's `IBM AI Engineering mit TensorFlow/Keras` line is now backed by a primary source, which matters because it is the sole evidence for the JD's required *moderne ML-/AI-Frameworks*.
+- **`PyTorch` upgraded in `claims.json`** from `coursework-or-personal-unverified` to `evidence: certification`. The same certificate includes *Deep Neural Networks with PyTorch*. `output` stays `certification-context-only`, so this changes nothing on any current document - it just means PyTorch now has a real source if a JD ever asks. Patched as text, not re-serialized, per the CRLF/compact-JSON note in `CLAUDE.md`.
+- The certificate is explicitly **non-credit** and confers no grade or degree; never present it as an academic qualification.
+
+## Critique Round 2, 2026-08-27 (post-Edit 1)
+- **File:** `critique_ruag_ai_engineer_c5i.md`, rewritten as Round 2 with a Round 1 resolution table.
+- **Evidence Fit: 74/100 - unchanged.** Strategic Stretch, title-capability gate **FAIL**, PSP and compensation **UNRESOLVED**. Document edits cannot move candidate-role fit. **`PP-3` deliberately did not move it**: it is a personal project and cannot convert an Adjacent title-capability into a Direct one - counting it would be the "bridge valued as highly as direct evidence" error `critique_framework.md` section 5 warns against.
+- **Document Quality: 85 -> 93/100.** Truth and provenance **23 -> 24/25**.
+- **Channel: Weak - unchanged.** Heinzen's published direct line still unused.
+- **Tier 1 findings: NONE.** No truth, fit or relevance defect remains that editing can fix.
+
+### Dimension movement
+| Dimension | R1 | R2 | Why |
+|---|---:|---:|---|
+| Truth and provenance | 23 | **24** | IBM cert primary-source verified; new PP-3 and SW-5 content audited clean; headline now his real title, not a positioning label |
+| Information hierarchy | 17 | **19** | Headline carries the req's word above the fold; `Projekte` parses cleanly |
+| Bullet evidence and impact | 16 | **16** | **Unchanged - now the weakest dimension** |
+| Relevance and terminology | 12 | **15** | 22/22 claimable JD terms; all six gap terms still correctly absent |
+| Skills evidence | 9 | **9** | Unchanged; `MLOps` remains an umbrella term with no `skills[]` entry |
+| Mechanics/readability | 8 | **10** | `governte` fixed, German hyphenation fixed, cadence 50%->31%, consecutive openers 1->0 |
+
+### Reader verdicts
+ATS **PASS**. Recruiter **FORWARD** - the Round 1 friction point is gone, the headline now shows the req's own word. HR **COMPLETE**. Hiring manager **still MAYBE, but a stronger MAYBE** - the underlying R1/R2 split is unchanged; the letter now argues the operating-layer case more completely. Technical **CREDIBLE**, with a new and welcome probe invited by PP-3: "what have you actually hardened, and how do you patch it?"
+
+### The one dimension that did not move
+**Bullet impact: 12 of 13 bullets describe activity with no outcome clause; only `BS-1` says what changed.** Every other claim in `claims.json` carries `metrics: unverified`, and inventing figures is barred - so the resume is correctly written but flat where a hiring manager looks for consequence. **The fix is upstream, not in this package:** if any verified outcome exists for `SW-2` (incident/SLA record), `SW-3` (deployment frequency, service count), `SW-7` (data products delivered, sources onboarded) or `BS-3` (applications owned), recording it in `claims.json` would lift this dimension for **every** future package. Do not invent anything to close it here.
+
+### Remaining Tier 2 / Tier 3
+Officer career still on page 2 (structural; moving it breaks reverse chronology). Headline now duplicates the Swisscom title line verbatim (cosmetic). The CL's *"entspricht damit meiner heutigen Praxis"* is a soft alignment claim worth being ready to answer, not worth rewording. Bosch bullet lengths cluster at a 5-word spread (validator passes; diagnostic only). `\today` - recompile if submitted after 2026-08-27.
+
+## SUBMITTED 2026-08-27
+
+Application sent via `jobs.ruag.ch` (portal only - email and postal applications are explicitly refused).
+Application ID **18027**, publish ID 10075372.
+
+### As-submitted record
+| Field | Value |
+|---|---|
+| Employer | RUAG MRO Holding AG, Business Area C5I |
+| Role | AI Engineer C5I (w/m/d), Thun, 80-100% |
+| Submitted | **2026-08-27** |
+| Fit class | **Stretch** (numerically top-of-Adjacent at 74) |
+| Evidence Fit | **74/100** |
+| Hard gate | **FAIL** - R1 and R2, the two title-defining responsibilities, are Adjacent not Direct |
+| Document Quality | **93/100** (85 pre-edit), truth and provenance 24/25, **0 Tier 1 findings** |
+| Channel | **Weak** - cold portal submit |
+| Cohort | evidence-first-2026-01, now **6/10**; **the sole Stretch slot is CONSUMED (stretch 1/1)** |
+| Outcome | applied - awaiting response |
+
+**Submitted documents:** `Dennis_Thiessen_Lebenslauf.pdf` (2 pages, 13 bullets) and
+`Dennis_Thiessen_Motivationsschreiben.pdf` (1 page, 295 words, 5 short paragraphs). Both validators PASS with
+0 warnings, 0 boxes, clean two-pass compiles, correct text-order parse and visual QA of every page. Submission
+copies were MD5-verified identical to their `e2e_` builds before sending.
+
+### What went in, in one line
+Staff Data, Analytics & AI Engineer - his canonical title - with production ML-inference integration (`BS-1`),
+professional Linux/Ansible automation (`BS-6`), current Kubernetes and data-product work (`SW-3`, `SW-7`, `SW-2`),
+current self-hosted Linux and hardening (`PP-3`), DevSecOps practice tied to C5I's stated operating model (`SW-5`),
+and the canonical six-year Bundeswehr officer career (`BW-1`). The letter names the AI-platform gap in one sentence
+and pivots to the operations and platform side.
+
+### Live screening topics - none of these were resolved before sending
+1. **Compensation.** No band published. Kununu samples are small and non-authoritative but suggest a material cut
+   against the ~CHF 140k current and the 180k bar. The Thun-local exception permits near-current pay, not a large
+   reduction. **Ask Frank Haugwitz.**
+2. **PSP and project access.** RUAG screens every entrant. No citizenship requirement is stated and German
+   citizenship plus a Swiss B permit is not an evidenced disqualifier, but role-specific project eligibility is
+   unknown. **Ask Frank Haugwitz.**
+3. **Level.** The req is labelled only "Berufserfahrene" and may be lateral or a down-level move against current
+   Staff + Component Owner scope. **Ask what decision authority separates this from RUAG's Senior/Principal roles.**
+4. **The question the application actually turns on:** does C5I want someone who has *built* an AI/LLM platform, or
+   someone who can *operate* one and grow into building it? **Marco Heinzen, +41 79 568 14 96** - the published
+   direct line that was never used. A call now would still upgrade the channel from Weak to Moderate.
+
+### Honest gaps that travel with this application
+No AI/LLM platform built or operated; no compute or GPU cluster; no RAG, retrieval or document-solution
+implementation; no formal LLM evaluation; no model-training ownership. ML/AI-framework depth is certification-context
+only (IBM AI Engineering, now primary-source verified). These are real and were never written around.
+
+### Standing note for any future RUAG C5I application
+The KB now holds a verified, live JD and a full Phase 0 for this business area, and RUAG C5I has **five other reqs**
+already in the scout log (Senior DevOps Engineer C5I and Data Lakehouse / Senior Data Platform Engineer are both
+shortlisted and are **materially better fits than this one** - they sit on the DevOps/data-platform lane where his
+evidence is Direct rather than Adjacent). If this application is rejected, that is **not** a signal to drop RUAG;
+it is a signal to target the reqs that match the evidence. Note also that the cohort's Stretch slot is now full,
+so any further RUAG application must clear Core or Adjacent on its own merits.
+
+## Output Files
+- Verbatim JD: `output/RUAG_AI_Engineer_C5I/JD_ruag_ai_engineer_c5i.txt`
+- Session: `output/RUAG_AI_Engineer_C5I/session_ruag_ai_engineer_c5i.md`
+- Resume: `output/RUAG_AI_Engineer_C5I/e2e_ruag_ai_engineer_c5i_resume.tex`; finished, Capgemini defect corrected, re-validated and re-compiled 2026-08-27; awaiting user approval.
+- Compiled resume PDF: `output/RUAG_AI_Engineer_C5I/e2e_ruag_ai_engineer_c5i_resume.pdf` and a submission-named copy `output/RUAG_AI_Engineer_C5I/Dennis_Thiessen_Lebenslauf.pdf`, both built 2026-08-27 from the corrected source. ⚠ **`Dennis_Thiessen_Lebenslauf.pdf` is a copy, not a build target.** pdflatex only regenerates the `e2e_` file, so the submission-named copy must be **refreshed after every recompile** or it silently becomes the old version under the exact filename that would be attached to the application.
+- Cover letter: `output/RUAG_AI_Engineer_C5I/e2e_ruag_ai_engineer_c5i_cover_letter.tex`, with `e2e_ruag_ai_engineer_c5i_cover_letter.pdf` and the submission-named `Dennis_Thiessen_Motivationsschreiben.pdf`. Built 2026-08-27; awaiting user approval.
+- Critique: `output/RUAG_AI_Engineer_C5I/critique_ruag_ai_engineer_c5i.md` - **CURRENT**, written 2026-08-27. Evidence Fit 74, Document Quality 85, Channel Weak.
+
+## Status
+- **Phase 0:** COMPLETE 2026-08-27.
+- **Fit gate:** Explicitly overridden by the user on 2026-08-27; strict hard-gate FAIL, Evidence Fit 74 and strategic Stretch remain recorded.
+- **Phase 2:** COMPLETE; audience and 12-bullet content plan prepared.
+- **Phase 3/4:** COMPLETE; resume generated, validated, compiled and visually inspected. **Re-audited after handover 2026-08-27:** one standing-preference defect (Capgemini) found and fixed, then re-validated, re-compiled and re-inspected. See Post-Handover Fix and Re-Verification.
+- **Resume:** finished; awaiting user approval.
+- **Phase 5 (cover letter):** COMPLETE 2026-08-27; generated, hooks verified live, validated, compiled and inspected.
+- **Cover letter:** DONE; awaiting user approval.
+- **Application/outcome:** **SUBMITTED 2026-08-27** via jobs.ruag.ch, application ID 18027. Awaiting response. Cohort recorded: Stretch slot consumed, cohort 6/10.
+- **Contact location:** RESOLVED 2026-08-27 - `Thun, Schweiz`.
+- **Resume:** approved by the user 2026-08-27 (implicitly, by invoking `/make-cl`), after three review changes: sponsoring sentence removed, Bosch title with promotion date, Vizrt shortened to DevOps Engineer.
+- **Critique:** **CURRENT (Round 2, 2026-08-27, post-Edit 1)** - Evidence Fit **74/100**, Document Quality **93/100**, Channel **Weak**, **Tier 1 findings: none**. Round 1 (pre-edit) scored - Evidence Fit **74/100**, Document Quality **85/100**, Channel **Weak**, **no Tier 1 truth finding**, 3 Tier 1 fixes open (DevSecOps hook in the letter, PP-3 on the resume, `governte` -> `governance-konforme`).
+- **Edit 1:** COMPLETE 2026-08-27. All three Tier 1 fixes applied, plus Tier 2 items 3-5 and the two user decisions (official title; citizenship sentence cut). Both documents re-validated, recompiled, re-rendered and inspected; submission-named PDFs refreshed and MD5-matched.
+- **Next:** await response. Optional and still worthwhile: call **Marco Heinzen, +41 79 568 14 96** about technical scope and level, and **Frank Haugwitz** about compensation and PSP/project eligibility - all three are now live screening topics rather than pre-cleared ones. Do not react to a single rejection with positioning changes (`application_strategy.md` sections 38/74); the better-fitting RUAG C5I DevOps and Data Platform reqs are already shortlisted in the scout log. **Unchanged and unaffected by any edit:** Evidence Fit 74, Stretch, title-capability gate FAIL, and the open PSP / compensation / level questions. The highest-value remaining action is not a document change - it is the call to Marco Heinzen (+41 79 568 14 96). Compensation, PSP/project access and role level remain open practical questions and are unaffected by the documents. Because the cover-letter decision is YES, proceed with `/make-cl` after approval. Compensation, PSP/project access and level remain open practical questions.
@@ -0,0 +1,80 @@
+# Total-Comp Worksheet — SBB vs Swisscom
+
+**Purpose:** compute the break-even *before* the call on 2026-09-09, so that when they name a figure you know immediately whether it clears — instead of working it out afterwards.
+
+**Honesty note on this file:** I could not retrieve the Anforderungsniveau K figures — they are not public, which is exactly why Q1 exists. Anything below marked ⚠️ is an estimate or a recollection you should verify yourself rather than trust. The Swisscom column is mostly blank because I only hold the ~140k all-in headline; you know the split.
+
+---
+
+## 1. The Swisscom baseline (fill from your Lohnausweis / total-rewards statement)
+
+| Component | Amount CHF/yr | Notes |
+|---|---:|---|
+| Base salary (12×) | | |
+| 13th month | | in-band or on top? |
+| Bonus / variable (actual, not target) | | use a 3-year average, not the good year |
+| Employer pension contribution | | **from the Lohnausweis / PK statement, not the deduction you see on the payslip** |
+| Other (allowances, RSU, phone, insurance) | | |
+| **Total all-in** | **~140 000** | the figure of record in `config.md` |
+| Weekly hours | | |
+| Vacation days | | |
+| Commute cost Thun↔Bern (what you actually pay today) | | this becomes a *saving* on the SBB side |
+
+---
+
+## 2. The SBB side (fill live, on the call)
+
+| Component | Amount CHF/yr | How to get it |
+|---|---:|---|
+| Base, Anforderungsniveau **K** | | **Q1.** Ask for the band *and* the likely entry point for your profile |
+| Regionalzulage **Stufe 1** | | stated on the posting; ask for the franken amount |
+| 13th month | | ask explicitly whether it is inside or on top of the band figure |
+| Employer pension contribution (PK SBB) | | ask for the **employer** %, and which plan/Sparplan |
+| **Free GA** | ⚠️ ~4 000 (2nd cl.) / ~6 500 (1st cl.) | **verify the current list price yourself.** Ask which class, and how it is taxed — a staff GA is declared on the Lohnausweis, so the net benefit is below list |
+| Family international travel discount (FVP) | | worth something real if you travel; hard to price — estimate honestly or score it qualitatively |
+| Kidz Care childcare subsidy | | **Q4.** Scales on *gross household* income; bracket table is intranet-only. Assume well below the headline 90% |
+| Commute saving (from §1) | | the GA makes Thun↔Bern free — count it once, here or in the GA line, **not both** |
+| **Total all-in** | | |
+| Weekly hours | | |
+| Vacation days | | |
+| Pensum offered (60–100%) | | a 90% option changes the CHF/hour maths materially |
+
+---
+
+## 3. Break-even
+
+Compute this **before** the call and write the number here:
+
+> **Minimum acceptable SBB base = ______ CHF**
+>
+> derived so that: base + 13th + Regionalzulage + employer pension + GA (net of tax) + commute saving ≥ Swisscom all-in
+
+Then on the call you are comparing one number to one number.
+
+**Three traps that make this comparison lie:**
+
+1. **Base-to-base is meaningless here.** The GA, the Regionalzulage and the pension employer share are all real money that never appears in a base-salary comparison. Conversely a Swisscom bonus is real money SBB will not match.
+2. **Count the commute once.** Free GA and "commute saving" are the same franken. Double-counting flatters SBB by four figures.
+3. **The GA is taxed.** It goes on the Lohnausweis, so the net value is below list price. Don't book the sticker number.
+
+---
+
+## 4. What this is really deciding
+
+The band is capped and collectively bargained — **there is no negotiation lever at the top of K** the way there is on a private offer. So this is a yes/no against a fixed number, not an opening position.
+
+Set your own line before the call:
+
+- **Clears break-even** → the level question (Q2) becomes the deciding one, not the money.
+- **Below break-even but within ~10%** → this is the Bern/Thun WLB-exception trade you already defined: below-bar comp accepted for a local seat with a real mission. Worth it only if Q2 comes back with genuine design scope. It has never been worth it for a *below-level* seat — that is why BKW was declined.
+- **Well below** → decline cleanly, but still finish the call and ask everything. See §5.
+
+---
+
+## 5. Why the call is worth doing even if the number fails
+
+- **It is the first real data point on what the entire Bern/Thun local tier pays.** RUAG, Swissgrid, BKW and BFH all sit in comparable Swiss public-sector/parapublic band structures. Whatever K turns out to be, it calibrates that whole lane — which is otherwise pure guesswork.
+- **It is interview practice with nothing at stake.** NATO JWC (final interviews 2nd half of October), BIS Basel and Microsoft Principal FDE are all still live. You do not want one of those to be your first interview in years.
+- **Not wanting it makes you better at it.** You can ask the blunt questions — band, scope, RAMSI share — without hedging, which is exactly how they should be asked anyway.
+
+Record the K figure in this file afterwards regardless of outcome. It is reusable intelligence for the whole local tier.
@@ -0,0 +1,111 @@
+# Interview Brief — SBB, Data Engineer Asset Management Infrastrukturanlagen
+
+**When:** Mittwoch, 9. September 2026, 08:30 · 45 Minuten · Microsoft Teams
+**Stage:** **2 of 4.** The posting's own process is: Bewerbung → **Virtuelles Kennenlernen mit HR und Führungskraft** → Persönliches Kennenlernen → Finaler Entscheid.
+**Who is likely on the call:** HR **plus Andri Wienandts, People Leader** (+41 79 364 62 53). This is *not* a pure HR screen — the hiring manager is in the room.
+**Job ID:** 103755 · Bern / Work Smart · 60–100% · **Anforderungsniveau K, Regionalzulage Stufe 1**
+**Submitted:** 2026-08-25 · Core · Evidence Fit 79/100 · Document Quality 92/100 · **cold channel**
+
+> **45 minutes shared between two people is short.** Assume ~25 min of them asking, ~10 min of you asking, ~10 min logistics. You will not get a second cheap shot at the money and scope questions before the in-person round, so do not let them fall off the end.
+
+---
+
+## 1. The one thing to understand before you dial in
+
+**A cold submit converted.** You never called Andri Wienandts, despite his mobile being printed on the posting — the channel plan said to call first and it did not happen. It got an interview anyway.
+
+More telling: your resume **never contains the words Snowflake, dbt or Power BI**, and all three are named in the required-qualifications block. An ATS keyword screen configured on those literals would have dropped you. It didn't. **Someone read the dossier and made a judgement.** That means the honest substitution story (Teradata/Oracle/AWS → Snowflake; Airflow/PySpark → dbt; Spotfire → Power BI) already survived its first contact with a human — you are not walking in needing to apologise for it. Defend it the same way, calmly, as a tooling difference rather than a gap.
+
+This is also the **first interview in the evidence-first cohort** — 6 applications, 2 rejections, this is the first conversion.
+
+---
+
+## 2. Your genuine edge — lead with this
+
+For a role whose stated purpose includes **vorausschauende Wartung** on physical infrastructure assets, you have a combination most candidates on this req will not:
+
+- **Industrial sensor and asset data, in production.** Bosch fab: defect-management records, wafer inspection images, PCM electrical parameters (BS-2).
+- **Anomaly detection on streaming data.** The ELK/Kafka PoC with Grafana/Prometheus/Loki monitoring (BS-4).
+- **Containerised ML inference into a plant that cannot stop.** Docker/Kubernetes/Ansible into 24/7 semiconductor production, after which defect-image classification ran fully automated (BS-1).
+- **A master's thesis on vibration-based condition monitoring of machine tools** — rule-based reasoning plus a 7-10-3 ANN.
+- **The operational half of this job, today, at a peer Swiss enterprise in the same city.** Component Owner with on-call, data quality, governance and SLA accountability (SW-2) is precisely *"Betrieb"* and *"Verantwortung für die Qualität und Nachhaltigkeit technischer Lösungen"*.
+
+**Thesis caveat — hold this line:** it is a **methods prototype**, never a validated system. No real operational data (training data came from a cited thesis; test data was modified plus a random generator), **no accuracy figures exist**, and PSO was *surveyed only*, never implemented. The throughput figure (~500 samples/s against 72.9 kSPS sensors) is barred from external use. Describe it as genuine interest and method familiarity, not as a result.
+
+**Where they beat you:** named-product fluency on the exact stack, and rail domain — the asset taxonomy, EN 50126 RAMS vocabulary, the swissTAMP/RIS ecosystem.
+
+---
+
+## 3. The four questions you must not leave without asking
+
+These were never resolved before submitting. They are now live screening topics, and this call is the natural place for them.
+
+### Q1 — Anforderungsniveau K, the actual band
+> *"Die Stelle ist im Anforderungsniveau K mit Regionalzulage Stufe 1 ausgeschrieben. Könnt ihr mir die Bandbreite für dieses Niveau nennen, und wo eine Person mit meinem Profil typischerweise einsteigt?"*
+
+**Why it is fair game:** SBB publishes its pay system and campaigns publicly on Lohngleichheit and transparency. Asking about a collectively-bargained band is normal, not pushy. The figures are simply not public, so asking is the *only* way to get them.
+
+**Your bar:** Swisscom ~140k; you move at 180k+ all-in. **K is very likely below that.** The Bern/Thun WLB-exception tier deliberately accepts below-bar comp for a local seat with a real mission — but it has never accepted a below-*level* move (see Q2). Know before the call which trade you are actually willing to make, so you can react in the moment rather than going quiet.
+
+### Q2 — Level and design ownership *(the crux)*
+> *"Die Ausschreibung liest sich als Senior-IC-Rolle. Trägt sie Design-Verantwortung für die Pipelines und das semantische Modell, oder wird die Architektur an anderer Stelle gesetzt?"*
+
+**Why this decides it.** Every other application in your log was a stretch *upward*. This one reads *below* your current Staff (Engineer IV) + Component Owner scope: it asks you to *mentor* other data engineers but the only architecture language is *"Datenarchitekturen entwerfen"* as a personal skill, not an ownership mandate. **This is the same shape as BKW, which you declined as a lateral in this same Bern tier.** Ask it as diligence — it also surfaces whether the seat can grow.
+
+### Q3 — RAMSI, and how much of the job it really is
+> *"Was ist RAMSI genau, und welchen Anteil der Rolle macht die Weiterentwicklung der Webanwendung aus?"*
+
+One of six responsibility lines is web development in **Java Spring Boot / Angular**. Your Java is professional but historical, Spring Boot was a PoC contribution roughly a decade ago, and **Angular is absent entirely**. Do not oversell it — ask what share it is. It may be work you do not want, and that is worth knowing now.
+
+**Do not assert what RAMSI is.** It is not publicly documented; the RAMS/EN 50126 family is an *inference*. Ask.
+
+### Q4 — Kidz Care, if childcare matters to the decision
+SBB covers *"bis zu 90 %"* of Betreuungskosten but scales it on **gross household income**, and the bracket table is intranet-only. At this band, realistically far below 90%. Worth one question if it affects the maths.
+
+---
+
+## 4. Questions they will ask — and the honest answer
+
+| Their question | Your line |
+|---|---|
+| **Snowflake? dbt?** | "Not by name. I have run the same shape of work on Teradata and Oracle, then on AWS — Glue, Athena with Iceberg, Redshift — with Airflow for orchestration. The modelling, testing and lineage discipline transfers; the syntax is what I'd pick up." |
+| **Power BI?** | "I co-owned a BI platform rather than just consuming one — TIBCO Spotfire at Bosch, including C# extensions and wafer-map visualisations, which I co-presented at the TIBCO Analytics Forum 2022." |
+| **Argo Workflows / Helm?** | Airflow is a direct orchestrator substitution; Kubernetes is current and production. **Do not claim Helm** — it is not canonical. |
+| **Predictive maintenance experience?** | Lead with Bosch sensor/process data and the ELK/Kafka anomaly-detection PoC. Then the thesis, framed as a methods prototype. |
+| **Why leave Swisscom?** | **Make it about the work, not the band.** Physical infrastructure, asset condition data with a visible public consequence, a Bern seat, and a technical brief that sits on your actual thesis. Do not volunteer that you expect a pay cut. |
+| **Trade-offs between latency, consistency and cost?** | A named required skill and a real strength — Component Owner for business-critical Oracle/Kafka → Teradata ETL with on-call and SLAs. Have one concrete example where you chose batch over streaming, or accepted staleness for cost. |
+| **Mentoring / fachliche Entwicklung?** | Application Owner at Bosch: documentation, user training, vendor coordination; Swisscom Security Champion for the team. Real, but framed as team roles rather than line management. |
+
+**Two things to keep off the table:** don't claim Snowflake, dbt, Power BI, Helm, Argo, Spring Boot or Angular by name; and don't quote any unverified metric — nearly everything in your record is `metrics: unverified`, and inventing a number in an interview is the same error as putting one on the resume.
+
+---
+
+## 5. Company context worth showing you know
+
+- **swissTAMP** is SBB's central source for asset condition and behaviour data — inspection, measurement and operating data, trends and forecasts. SBB describes it explicitly as enabling the move *"from reactive through proactive to predictive maintenance."*
+- Alongside it: **RIS** (Räumliche Informationssysteme, incl. Datenbank feste Anlagen) and **Mess- und Diagnosetechnik (MUD)**, which runs automated condition monitoring of track, switches and power supply.
+- SBB operates a **Competence Center Predictive Maintenance**.
+- **Funded and growing, not a backwater:** there is an active EU-journal tender (235005-2026) for up to **three new-generation infrastructure diagnostic vehicles**. More diagnostic vehicles means more sensor volume — which is exactly what this pipeline seat exists to absorb. Good, specific thing to reference.
+- **Culture:** `#einfachDu` — informal *du* from first contact, so match that register. Work Smart hybrid. Cover letter deliberately waived. 60–100% explicitly welcome.
+
+---
+
+## 6. Practicalities
+
+- **08:30 start** — be on Teams early; test audio the night before.
+- Match the **du** register from the first sentence.
+- The posting is in German and the team is German-speaking; **your resume was submitted in English** with a Languages line naming German as mother tongue. Expect the call in German. Don't be thrown if they open in English.
+- Bern-based, German native, EU citizen with a Swiss B permit, no relocation, no sponsorship — **the cleanest practical fit in your whole log.** Say so if the topic opens.
+- Have ready: a concrete latency/consistency/cost trade-off story, and one example of mentoring or lifting another engineer.
+
+---
+
+## 7. What to decide *before* 08:30
+
+Not homework for them — homework for you:
+
+1. **If K comes in at, say, 130–150k all-in: is this still a yes?** The WLB-exception tier says a Bern seat with a real mission can go below the 180k bar. It has never said below-level scope is acceptable.
+2. **If Q2 comes back "architecture is set elsewhere": is it still a yes?** That is the BKW shape you already declined once.
+3. **If RAMSI turns out to be 40% Angular work: is it still a yes?**
+
+Any one of those can be a no, and it is much better to know your own answer before they say the number than to improvise it on camera at 08:40.
@@ -1,6 +1,16 @@
 # Session: SBB (Schweizerische Bundesbahnen) — Data Engineer (m/w/d), Asset Management Infrastrukturanlagen

-## STATUS: SUBMITTED 2026-08-25
+## STATUS: INTERVIEW INVITED 2026-08-28 (submitted 2026-08-25)
+
+**Interview: Mittwoch 9. September 2026, 08:30, 45 Minuten, Microsoft Teams.**
+Per the posting's own process this is **stage 2 of 4** - *"Virtuelles Kennenlernen mit HR und Fuehrungskraft"* - so **HR together with Andri Wienandts**, not a pure HR screen. Brief written to `interview_brief_sbb_2026-09-09.md`.
+
+**Two facts worth recording.** (1) This is the **first interview of the evidence-first cohort** - 6 applications, 2 rejections, 1 conversion. (2) It converted from a **cold submit**: the channel plan called for phoning Andri Wienandts before applying and that never happened, so the published warm contact was never used. The resume also never contained **Snowflake, dbt or Power BI**, the three literals an ATS keyword screen would have keyed on - the session recorded that risk as "accepted, not solvable". It did not filter him out, which means a human read the dossier and the honest-substitution framing survived first contact. Do not over-read one data point, but it is evidence against the assumption that the honest omissions are fatal at the screen.
+
+**Comp worksheet:** `comp_worksheet_sbb.md` - break-even framework to complete **before** the call, so a named K figure can be judged on the spot. Key points recorded there: base-to-base is meaningless (free GA, Regionalzulage and the employer pension share are real money invisible in a base comparison, while the Swisscom bonus is real money SBB will not match); the GA is a taxable Lohnausweis benefit so its net value is below list; and the commute saving and the GA are the same franken - count once. **K is a capped GAV band with no negotiation lever at the top**, so this is a yes/no against a fixed number. **User's own read, 2026-08-28: he does not expect it to clear.** He is taking the call anyway for the questions, for interview practice with NATO JWC / BIS / Microsoft Principal still live, and because **the K figure is the first real data point on what the whole Bern/Thun local tier pays** - RUAG, Swissgrid, BKW and BFH sit in comparable band structures. Record the figure afterwards regardless of outcome.
+
+**Still unresolved, and now live call topics:** Anforderungsniveau K band, design/architecture scope vs current Staff + Component Owner level, the RAMSI Java/Spring Boot/Angular share of the role, and the Kidz Care actual rate at this band.
+

 Application sent by the user on 2026-08-25 (2pp English resume, no cover letter — SBB waives it;
 the Tier 1 query-performance fix was already applied on 2026-08-21, so the submitted document is
@@ -106,11 +106,18 @@ Kubernetes, Docker, AWS (S3 · Glue · Athena · Redshift · CloudFormation), Ka
 **Institution type:** Cloud-first tech company, scale-up with AWS-heavy stack, enterprise platform team, or data infrastructure consultancy

 **Opening hook pattern:**
-> "Across my career at Swisscom and Bosch, I've owned data infrastructure at two ends of the spectrum: migrating Swisscom's legacy ETL stack to a cloud-native AWS platform (CloudFormation, Glue, Athena with Iceberg, Airflow) while operating Kubernetes-deployed Python applications with GitLab CI/CD — and containerizing ML inference into a 24/7 semiconductor production line at Bosch using Docker, Kubernetes, and Ansible. In both cases, the infrastructure had to be production-grade with no tolerance for downtime. [Tie to their platform challenge]."
+> "Across my career at Swisscom and Bosch, I've owned data infrastructure at two ends of the spectrum: migrating my own domains' pipelines onto Swisscom's AWS platform (CloudFormation, Glue, Athena with Iceberg, Airflow) as part of its wider cloud programme, while operating Kubernetes-deployed Python applications with GitLab CI/CD — and containerizing ML inference into a 24/7 semiconductor production line at Bosch using Docker, Kubernetes, and Ansible. In both cases, the infrastructure had to be production-grade with no tolerance for downtime. [Tie to their platform challenge]."
+
+> **Scope warning (corrected 2026-08-26).** This hook previously read "*migrating Swisscom's legacy
+> ETL stack to a cloud-native AWS platform*" — a full-ownership framing on a company-scale object,
+> contradicting `claims.json` SW-1 (`forbidden`: "migrated the company warehouse", "led the migration
+> of the legacy warehouse"). Same defect fixed in `bundle_data_engineer.md` on 2026-08-21; this
+> bundle was missed by that sweep. Never pair a full-ownership verb with a company-scale object.
+> See CLAUDE.md → Scope Discipline.

 **Key narrative thread:**
 1. **Production Kubernetes** — SW-3 + BS-1: K8s at two employers, in different contexts (data apps at Swisscom, ML inference at Bosch). Cross-employer K8s ownership is a strong signal.
-2. **Full AWS platform stack** — SW-1: Not just using one AWS service — migrating an entire ETL infrastructure to AWS with CloudFormation/IaC shows platform-level thinking.
+2. **AWS platform breadth** — SW-1: not just one AWS service — migrating his own domains' pipelines with CloudFormation/IaC, inside the wider company programme, shows platform-level thinking. **Never write "an entire ETL infrastructure" or any company-scale object here** (corrected 2026-08-26).
 3. **Observability initiative** — BS-4: Self-initiated ELK + Prometheus + Grafana PoC shows platform engineer mindset (monitoring is not optional).
 4. **Operational accountability** — use Component/Application Owner evidence. Security Champion is optional and never a substitute for production ownership.

@@ -59,7 +59,7 @@
 |----|----------------|--------------------|--------------------|
 | BS-1 | ML inference containerization | **LEAD bullet** — "Designed and deployed ML inference pipeline (Docker, K8s, Ansible) into 24/7 semiconductor fab; automated image-based defect classification" | Production ML in constrained 24/7 environment |
 | SW-3 | K8s + GitLab CI/CD | "Deployed and operated ML-ready Python applications on Kubernetes with GitLab CI/CD automation — production-grade containerized delivery" | K8s ownership = MLOps infrastructure |
-| SW-1 | AWS migration | "Built cloud-native data infrastructure on AWS (S3, Glue, Athena/Iceberg, Redshift, Airflow) — the scalable data layer that ML models depend on" | AWS data lake for ML workloads |
+| SW-1 | AWS migration | "Migrated his domains' pipelines onto Swisscom's AWS platform (S3, Glue, Athena/Iceberg, Redshift, Airflow) — the data layer ML workloads depend on" — **corrected 2026-08-26**, previously read "Built cloud-native data infrastructure… the scalable data layer", pairing a full-ownership verb with an org-scale object (SW-1 `forbidden`) and asserting unverified scale | AWS data lake for ML workloads |
 | SW-2 | Component Owner | "Owned business-critical ETL pipelines (Oracle/Kafka → Teradata) — reliable data supply for downstream ML and analytics" | Data reliability for ML input |
 | FC-2 | ARTUS NLP | "Contributed ML and speech recognition components to ARTUS — Fraunhofer research project targeting automatic sea rescue transcription" | Applied NLP in safety-critical domain |
 | BS-4 | ELK PoC | "Delivered anomaly detection PoC: ELK + Kafka pipeline with Grafana/Prometheus monitoring — ML-adjacent signal processing" | Anomaly detection / observability |
@@ -1,9 +1,15 @@
 {
  "schema_version": 1,
-  "last_verified": "2026-07-27",
+  "last_verified": "2026-08-27",
  "authority": {
    "description": "Machine-readable source of truth for all future application documents.",
-    "precedence": ["canonical claims", "config corrections", "verified references", "experience files", "bundles"],
+    "precedence": [
+      "canonical claims",
+      "config corrections",
+      "verified references",
+      "experience files",
+      "bundles"
+    ],
    "raw_extractions_are_immutable": true,
    "historical_outputs_are_never_sources": true
  },
@@ -19,8 +25,18 @@
    "swiss_work_authorization": "Authorized to work in Switzerland; no visa or employer sponsorship required",
    "work_authorization_source": "User-confirmed 2026-07-27",
    "resume_usage": "Work authorization is optional in the header; mention the B permit or no-sponsorship status when it resolves recruiter uncertainty or the application asks for it",
-    "languages": {"German": "native", "English": "fluent", "Norwegian": "basic", "Russian": "basic"},
-    "forbidden_personal_data": ["date of birth", "marital status", "gender", "children"]
+    "languages": {
+      "German": "native",
+      "English": "fluent",
+      "Norwegian": "basic",
+      "Russian": "basic"
+    },
+    "forbidden_personal_data": [
+      "date of birth",
+      "marital status",
+      "gender",
+      "children"
+    ]
  },
  "education": [
    {
@@ -32,8 +48,10 @@
      "end": "2013-10",
      "thesis_institution": "Tongji University, Shanghai",
      "thesis_title": "Development of a Web-Based Remote Fault Diagnosis System",
+      "final_grade": "1.6 (German scale, 1.0 best / 4.0 lowest pass) -- user-confirmed 2026-08-26",
+      "final_grade_us_4pt": "3.4 -- modified Bavarian formula, US = 1 + 3*(4.0-G)/(4.0-1.0), which simplifies to 5.0 - G. Use ONLY when a form demands a 4.0-scale GPA; always state the German scale alongside it. Never present as a natively-awarded GPA.",
      "thesis_grade": "1.0",
-      "thesis_relative_grade": "ECTS B (top 35%); official certificate on file",
+      "thesis_relative_grade": "ECTS grade B; official certificate on file. B is formally the next 25% after the top 10%, i.e. the 10-35% band -- so the correct and safe phrasing is 'top 35%' (user-confirmed 2026-08-26). Do NOT write 'top 30%' or 'top 25%': B is a band, not a point, and narrowing it overstates the standing. The original 'top 35%' in this record was correct; a briefly-considered 30% was the error.",
      "thesis_methods": "Verified against the thesis PDF 2026-08-02. Domain: vibration-based condition monitoring of CNC machine tools (piezoelectric accelerometers on spindle, tool rest, lathe body). Features: speed, load and the dimensionless waveform, peak, pulse, margin and kurtosis indices. Surveyed CBR, PSO, RBR and ANN; SELECTED a hybrid of rule-based reasoning (interpretable thresholds) plus a 7-10-3 feed-forward ANN (faultstates green/yellow/red) to handle noisy data that static rules cannot classify. Extensible plug-in architecture for swappable diagnosis methods and data collectors. Java/GWT client-server on MySQL. Evaluation measured throughput and latency, NOT model accuracy: the pipeline sustained ~500 samples/s against tri-axial vibration sensors delivering 72.9 kSPS, so the thesis concluded data reduction, filtering or batch scheduling is required for real-time use.",
      "thesis_limits": "PSO was SURVEYED ONLY and NOT used in the implementation -- never claim it as an applied method. No real operational data: training data came from a cited thesis, test data was modified plus a random generator. No model-accuracy figures exist. Back-propagation retraining was listed as future work, not implemented. Frame as a methods prototype/framework, never as a validated production predictive-maintenance system.",
      "transcripts_language": "English-language originals available for B.Eng. and M.Eng."
@@ -43,7 +61,10 @@
      "degree": "B.Eng. Information and Telecommunication Technologies",
      "institution": "Universitat der Bundeswehr Munchen",
      "start": "2009-10",
-      "end": "2012-10"
+      "end": "2012-10",
+      "final_grade": "2.4 (German scale, 1.0 best / 4.0 lowest pass) -- user-confirmed 2026-08-26",
+      "final_grade_us_4pt": "2.6 -- modified Bavarian formula (5.0 - G). Supply ONLY when a form requires a bachelor GPA; leave blank where optional. Always state the German scale alongside it, because the conversion makes German degrees read weaker to a US audience than they are: 2.4 is a solid 'gut'. Never present as a natively-awarded GPA.",
+      "grade_output_rule": "Neither degree grade goes on the resume or in a cover letter by default. Industry resumes omit grades; the M.Eng. thesis grade 1.0 is the only figure worth surfacing, and only where academic performance is genuinely valued. These fields exist for application-form GPA questions and credential checks."
    }
  ],
  "employment": [
@@ -55,8 +76,16 @@
      "start": "2023-10",
      "end": "present",
      "title_history": [
-        {"title": "Senior Data, Analytics & AI Engineer", "start": "2023-10", "end": "2025-04"},
-        {"title": "Staff Data, Analytics & AI Engineer", "start": "2025-04", "end": "present"}
+        {
+          "title": "Senior Data, Analytics & AI Engineer",
+          "start": "2023-10",
+          "end": "2025-04"
+        },
+        {
+          "title": "Staff Data, Analytics & AI Engineer",
+          "start": "2025-04",
+          "end": "present"
+        }
      ]
    },
    {
@@ -64,9 +93,15 @@
      "employer": "Robert Bosch Semiconductor Manufacturing Dresden GmbH",
      "location": "Dresden, Germany",
      "official_title": "Engineer / Senior Engineer, Data Analysis",
-      "display_title": "Senior Engineer, Data Analysis (Data & ML Engineering)",
+      "display_title": "Senior Data Engineer, Data Analysis",
+      "display_title_note": "experience_bosch.md sanctions title flexibility for this role: '(Senior) Data Engineer' or '(Senior) Data Analysis Engineer' depending on the JD. 'Senior Data Engineer, Data Analysis' is the user's own preferred wording, confirmed 2026-08-27. official_title stays the formal combined string on the Zeugnis.",
      "start": "2020-02",
-      "end": "2022-12"
+      "end": "2022-12",
+      "title_history": [
+        {"title": "Data Engineer, Data Analysis", "start": "2020-02", "end": "2021-01"},
+        {"title": "Senior Data Engineer, Data Analysis", "start": "2021-01", "end": "2022-12"}
+      ],
+      "title_history_source": "LinkedIn-confirmed, recorded in experience_bosch.md; user-confirmed 2026-08-27 while reviewing the RUAG C5I resume. Added because claims.json previously carried only the combined official_title with no promotion date, which made a Swisscom-style 'Beforderung <date>' line unwritable from the canonical file alone."
    },
    {
      "id": "FRAUNHOFER",
@@ -101,178 +136,567 @@
      "display_title": "Software Engineer",
      "start": "2014-11",
      "end": "2015-05"
+    },
+    {
+      "id": "BUNDESWEHR",
+      "employer": "Bundeswehr (German Armed Forces)",
+      "location": "Germany",
+      "display_title": "Officer Candidate / Officer (Second Lieutenant at separation)",
+      "start": "2008-07",
+      "end": "2014-11",
+      "source": "User confirmation 2026-07-10; thiessen_linkedin_profile.md",
+      "last_verified": "2026-08-27"
    }
  ],
  "claims": [
    {
      "id": "SW-1",
      "scope": "Primary engineer for pipelines in owned Fulfillment and Product Analysis domains; contributor to the wider company migration.",
-      "allowed_verbs": ["migrated", "implemented", "contributed"],
-      "forbidden": ["led the migration of the legacy warehouse", "sole technical lead", "migrated the company warehouse", "owned the full migration"],
+      "allowed_verbs": [
+        "migrated",
+        "implemented",
+        "contributed"
+      ],
+      "forbidden": [
+        "led the migration of the legacy warehouse",
+        "sole technical lead",
+        "migrated the company warehouse",
+        "owned the full migration"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "SW-2",
      "scope": "Component Owner for business-critical Fulfillment ETL pipelines, including operation, data quality, governance, incidents and on-call obligations.",
-      "allowed_verbs": ["own", "operate", "maintain", "serve"],
+      "allowed_verbs": [
+        "own",
+        "operate",
+        "maintain",
+        "serve"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "SW-3",
      "scope": "Build and operate Python data applications on Kubernetes with GitLab CI/CD within the team environment.",
-      "allowed_verbs": ["build", "deploy", "operate"],
+      "allowed_verbs": [
+        "build",
+        "deploy",
+        "operate"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "SW-4",
      "scope": "Deliver data products, dashboards and analyses with internal B2B stakeholders and product owners; not external consulting or strategic-account delivery.",
-      "allowed_verbs": ["deliver", "translate", "partner", "support"],
-      "forbidden": ["customer-embedded delivery", "strategic customer delivery", "C-suite advisor"],
+      "allowed_verbs": [
+        "deliver",
+        "translate",
+        "partner",
+        "support"
+      ],
+      "forbidden": [
+        "customer-embedded delivery",
+        "strategic customer delivery",
+        "C-suite advisor"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "SW-5",
      "scope": "Mandatory rotating team Security Champion role for 2025/2026 only; not an award, certification or multi-year distinction.",
-      "allowed_verbs": ["serve"],
-      "forbidden": ["3 consecutive years", "2023-2026", "Security Champion x3", "owning DevSecOps compliance"],
+      "allowed_verbs": [
+        "serve"
+      ],
+      "forbidden": [
+        "3 consecutive years",
+        "2023-2026",
+        "Security Champion x3",
+        "owning DevSecOps compliance"
+      ],
      "metrics": "100 hours of training and an assessment are source-backed; use only when relevant"
    },
    {
      "id": "SW-6",
      "scope": "Hands-on PySpark use at Swisscom; scale and performance metrics are not verified.",
-      "allowed_verbs": ["use", "develop", "process"],
+      "allowed_verbs": [
+        "use",
+        "develop",
+        "process"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "SW-7",
      "scope": "Build governed data products and onboard sources within Swisscom's company-wide Data Mesh; never claim ownership or construction of the shared mesh/platform. Atlassian Compass is the metadata/catalogue platform used for data-product metadata and lineage (user-confirmed 2026-07-29); Dennis uses it as a practitioner and does not administer or own the tooling.",
-      "allowed_verbs": ["build", "model", "onboard", "contribute", "document", "maintain"],
-      "forbidden": ["built a Data Mesh", "built the Data Mesh", "built AWS Data Mesh", "own the AWS data platform", "own the data platform", "own Atlassian Compass", "administered Compass", "rolled out Compass"],
+      "allowed_verbs": [
+        "build",
+        "model",
+        "onboard",
+        "contribute",
+        "document",
+        "maintain"
+      ],
+      "forbidden": [
+        "built a Data Mesh",
+        "built the Data Mesh",
+        "built AWS Data Mesh",
+        "own the AWS data platform",
+        "own the data platform",
+        "own Atlassian Compass",
+        "administered Compass",
+        "rolled out Compass"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "SW-8",
      "scope": "Configured domain-grounded LLM assistants in a Swisscom-owned web interface by selecting available models and supplying curated knowledge. Separate exposure includes LiteLLM API use, custom GPTs, Copilot and Kiro.",
-      "allowed_verbs": ["configured", "used", "integrated"],
-      "forbidden": ["built production LLM systems", "deployed LLM systems", "built LangChain", "agent orchestration", "formal LLM evaluation", "fine-tuned models"],
+      "allowed_verbs": [
+        "configured",
+        "used",
+        "integrated"
+      ],
+      "forbidden": [
+        "built production LLM systems",
+        "deployed LLM systems",
+        "built LangChain",
+        "agent orchestration",
+        "formal LLM evaluation",
+        "fine-tuned models"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "BS-1",
-      "scope": "Designed and executed integration of containerized ML inference into a 24/7 semiconductor production environment; model-development ownership is not established.",
-      "allowed_verbs": ["integrated", "containerized", "deployed", "orchestrated"],
-      "forbidden": ["trained the image classification model", "owned the full ML lifecycle"],
+      "scope": "Designed and executed integration of containerized ML inference into a 24/7 semiconductor production environment; model-development ownership is not established. Toolchain includes Docker, Kubernetes and Ansible - Ansible use at Bosch was intensive (user-confirmed 2026-08-27) and extended to configuration management and infrastructure automation beyond this single integration, making it standalone Infrastructure-as-Code evidence.",
+      "allowed_verbs": [
+        "integrated",
+        "containerized",
+        "deployed",
+        "orchestrated"
+      ],
+      "forbidden": [
+        "trained the image classification model",
+        "owned the full ML lifecycle"
+      ],
      "metrics": "qualitative reduction in manual classification is source-backed; exact amount unverified"
    },
    {
      "id": "BS-2",
      "scope": "Developed data services in Python, Java and C# over Oracle and Hadoop/Impala for internal analysis teams. Data types worked on (user-confirmed 2026-08-02): semiconductor fab sensor and process data -- defect management records, wafer inspection images, and electrical parameters from Process Control Monitoring (PCM). Relevant as genuine industrial sensor/asset-data experience.",
-      "allowed_verbs": ["developed", "built"],
+      "allowed_verbs": [
+        "developed",
+        "built"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "BS-3",
      "scope": "Confirmed Application Owner responsibilities for analytics applications and upstream pipelines, including SLOs, vendors, training and documentation.",
-      "allowed_verbs": ["served", "owned", "managed", "defined"],
+      "allowed_verbs": [
+        "served",
+        "owned",
+        "managed",
+        "defined"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "BS-4",
      "scope": "Built an ELK/Kafka anomaly-detection proof of concept and monitoring; not a company-wide observability platform.",
-      "allowed_verbs": ["built", "implemented", "validated"],
-      "forbidden": ["built the observability platform", "enterprise observability platform"],
+      "allowed_verbs": [
+        "built",
+        "implemented",
+        "validated"
+      ],
+      "forbidden": [
+        "built the observability platform",
+        "enterprise observability platform"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "BS-5",
      "scope": "Co-owned the TIBCO Spotfire environment, built C# extensions and co-presented at TIBCO Analytics Forum 2022.",
-      "allowed_verbs": ["co-owned", "built", "co-presented"],
+      "allowed_verbs": [
+        "co-owned",
+        "built",
+        "co-presented"
+      ],
      "metrics": "unverified"
    },
+    {
+      "id": "BS-6",
+      "scope": "Administered and automated the Linux server estate underpinning fab analytics and ML workloads at Bosch (2020-2022): ML platform hosts, Docker hosts, backend services and the Ansible control path. Developed Ansible extensions, including a credential plugin that retrieved secrets from a password keystore and cached them locally to cut lookup volume and improve scalability and performance. Playbooks were version-controlled in Git and executed push-style from Jenkins/GitLab pipelines. User-confirmed 2026-08-27.",
+      "allowed_verbs": [
+        "administered",
+        "automated",
+        "developed",
+        "extended",
+        "operated",
+        "built"
+      ],
+      "forbidden": [
+        "owned the fab's infrastructure",
+        "ran the datacenter",
+        "SRE role or title",
+        "GitOps",
+        "any server-count, uptime, SLA or scale figure - none is verified"
+      ],
+      "metrics": "none verified; the credential-caching plugin reduced keystore lookups, amount unquantified"
+    },
    {
      "id": "FC-1",
      "scope": "Set up Jenkins CI/CD and contributed to SCEDAS development and maintenance.",
-      "allowed_verbs": ["set up", "developed", "maintained"],
+      "allowed_verbs": [
+        "set up",
+        "developed",
+        "maintained"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "FC-2",
      "scope": "Contributed ML/NLP components to ARTUS; no publication or model-training ownership.",
-      "allowed_verbs": ["contributed", "implemented", "supported"],
-      "forbidden": ["led ARTUS", "trained the speech model"],
+      "allowed_verbs": [
+        "contributed",
+        "implemented",
+        "supported"
+      ],
+      "forbidden": [
+        "led ARTUS",
+        "trained the speech model"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "FC-3",
      "scope": "Developed containerized microservices for the MISSION research platform.",
-      "allowed_verbs": ["developed", "built"],
+      "allowed_verbs": [
+        "developed",
+        "built"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "VZ-1",
      "scope": "Contributed Python and C++ engineering to a distributed video-transcoding backend. Named broadcasters are product context, not direct delivery claims.",
-      "allowed_verbs": ["developed", "engineered", "contributed"],
-      "forbidden": ["for CNN, BBC and Al Jazeera", "delivered to CNN", "customer-embedded"],
+      "allowed_verbs": [
+        "developed",
+        "engineered",
+        "contributed"
+      ],
+      "forbidden": [
+        "for CNN, BBC and Al Jazeera",
+        "delivered to CNN",
+        "customer-embedded"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "VZ-2",
      "scope": "Developed automated audio/video integration tests and connected quality gates to CI/CD.",
-      "allowed_verbs": ["developed", "automated", "integrated"],
+      "allowed_verbs": [
+        "developed",
+        "automated",
+        "integrated"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "GN-1",
      "scope": "Introduced BDD through a proof of concept and held technical responsibility for test automation, training and Jenkins jobs.",
-      "allowed_verbs": ["introduced", "owned", "trained", "administered"],
+      "allowed_verbs": [
+        "introduced",
+        "owned",
+        "trained",
+        "administered"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "GN-2",
      "scope": "Developed UIPath RPA proofs of concept and acted as an internal contact.",
-      "allowed_verbs": ["developed", "served"],
+      "allowed_verbs": [
+        "developed",
+        "served"
+      ],
      "metrics": "unverified"
    },
    {
      "id": "GN-3",
      "scope": "Developed Java/J2EE workflow application features and contributed to integration proofs of concept.",
-      "allowed_verbs": ["developed", "contributed", "migrated"],
+      "allowed_verbs": [
+        "developed",
+        "contributed",
+        "migrated"
+      ],
      "metrics": "unverified"
+    },
+    {
+      "id": "BW-1",
+      "scope": "Completed officer candidate training and officer school during six years of service in the German Armed Forces (Bundeswehr), leaving service as Second Lieutenant. This establishes military and organisational context only; no technical military role, command scope, deployment, NATO service or clearance is established.",
+      "ownership": "Individual service and completed training.",
+      "allowed_verbs": [
+        "completed",
+        "served",
+        "left service"
+      ],
+      "forbidden": [
+        "current or former security clearance",
+        "NATO service",
+        "combat role or deployment",
+        "technical AI, ICT or cyber work for the military",
+        "command responsibility or leadership outcomes not explicitly verified"
+      ],
+      "metrics": "Six years of service and separation as Second Lieutenant are verified; no performance or command-scope metric is established.",
+      "source": "User confirmation 2026-07-10; thiessen_linkedin_profile.md",
+      "last_verified": "2026-08-27"
+    },
+    {
+      "id": "PP-1",
+      "scope": "PERSONAL PROJECT (user-supplied 2026-08-25), not professional work. A self-hosted, single-user investing/signal platform Dennis built for himself: ingests daily US-equity prices, fundamentals and sentiment (LLM-assisted); runs one long-only cross-sectional momentum book (top-quintile residual 12-1 momentum, ATR stop/trail, max 15 concurrent names) through scheduled scan and backtest pipelines; surfaces gated setups in a web dashboard plus Telegram alerts. Legitimate use: evidence of self-directed trading-domain fluency and of an end-to-end ingestion/backtest/alerting build outside work. Full-ownership verbs ARE correct here -- unlike his employer work, this is genuinely solo.",
+      "allowed_verbs": [
+        "built",
+        "developed",
+        "designed"
+      ],
+      "forbidden": [
+        "any trading track record, PnL, return, Sharpe or backtest performance figure -- none is verified and none may ever be quoted",
+        "calling it distributed, scalable, production or multi-user -- it is single-user and self-hosted",
+        "implying professional quantitative, trading, finance-domain or investment-management experience",
+        "presenting it as employer work or omitting that it is a personal project"
+      ],
+      "metrics": "unverified"
+    },
+    {
+      "id": "PP-2",
+      "scope": "Udacity 'AI for Trading' Nanodegree, completed self-study (user-supplied 2026-08-25). Covers quantitative trading fundamentals -- factor construction, alpha signals, backtesting. Pairs with PP-1 as the formal half of self-directed domain grounding.",
+      "allowed_verbs": [
+        "completed"
+      ],
+      "forbidden": [
+        "listing it as an academic degree, professional certification or quant credential",
+        "presenting it as equivalent to quantitative research or trading experience",
+        "using it to qualify for quant, trader, researcher or portfolio-management roles"
+      ],
+      "metrics": "unverified"
+    },
+    {
+      "id": "PP-3",
+      "scope": "PERSONAL PROJECT (user-supplied 2026-08-27), not employer work. A self-hosted Debian server Dennis has operated for ~10 years and administers and hardens himself, running nginx, a mail server, Nextcloud, a VPN server, Docker services and Bitwarden. This is the primary evidence for hands-on Linux administration, system hardening and security configuration, and it is current and continuous - unlike the Bosch Linux work, which ended in 2022. User states he genuinely enjoys this kind of work, including physical infrastructure.",
+      "allowed_verbs": [
+        "operate",
+        "administer",
+        "harden",
+        "run",
+        "maintain",
+        "self-host"
+      ],
+      "forbidden": [
+        "calling it enterprise, production, multi-user or business-critical infrastructure",
+        "implying professional SRE, sysadmin or hosting employment",
+        "any uptime, availability, SLA, user-count or scale figure - none is verified",
+        "presenting it as employer work or omitting that it is self-hosted and personal",
+        "using it as evidence of datacenter or physical-infrastructure experience"
+      ],
+      "metrics": "none; ~10 years of continuous operation is the only quantity, and it is self-reported"
    }
  ],
  "skills": [
-    {"name": "Python", "evidence": "production-current", "output": "allowed"},
-    {"name": "SQL", "evidence": "production-current", "output": "allowed"},
-    {"name": "PySpark", "evidence": "production-current", "output": "allowed"},
-    {"name": "Kafka", "evidence": "production-current", "output": "allowed"},
-    {"name": "Airflow", "evidence": "production-current", "output": "allowed"},
-    {"name": "AWS", "evidence": "production-current", "output": "allowed"},
-    {"name": "CloudFormation", "evidence": "production-current", "output": "allowed"},
-    {"name": "Atlassian Compass", "evidence": "production-current", "output": "allowed", "note": "Metadata/catalogue platform for data-product metadata and lineage at Swisscom (user-confirmed 2026-07-29). Practitioner use only — do not claim administration, rollout or ownership. Satisfies 'or similar metadata/catalogue platform' phrasing; is NOT a substitute claim for Purview, Collibra or Alation, which remain unevidenced."},
-    {"name": "Kubernetes", "evidence": "production-current-and-historical", "output": "allowed"},
-    {"name": "Docker", "evidence": "production-current-and-historical", "output": "allowed"},
-    {"name": "Java", "evidence": "production-historical", "output": "allowed-with-context"},
-    {"name": "C#", "evidence": "production-historical", "output": "allowed-with-context"},
-    {"name": "C++", "evidence": "production-historical-limited", "output": "allowed-with-context"},
-    {"name": "JavaScript", "evidence": "production-historical-limited", "output": "allowed-with-context"},
-    {"name": "LiteLLM", "evidence": "hands-on-current", "output": "allowed-with-context"},
-    {"name": "custom GPTs", "evidence": "hands-on-current", "output": "allowed-with-context"},
-    {"name": "Kiro", "evidence": "hands-on-current", "output": "allowed-with-context"},
-    {"name": "Copilot", "evidence": "hands-on-current", "output": "allowed-with-context"},
-    {"name": "TensorFlow/Keras", "evidence": "certification", "output": "certification-context-only"},
-    {"name": "PyTorch", "evidence": "coursework-or-personal-unverified", "output": "certification-context-only"},
-    {"name": "TypeScript", "evidence": "unverified", "output": "forbidden"},
-    {"name": "FastAPI", "evidence": "unverified", "output": "forbidden"},
-    {"name": "Flask", "evidence": "unverified", "output": "forbidden"},
-    {"name": "Django", "evidence": "unverified", "output": "forbidden"},
-    {"name": "LangChain", "evidence": "never-used", "output": "forbidden"},
-    {"name": "LangGraph", "evidence": "never-used", "output": "forbidden"},
-    {"name": "LlamaIndex", "evidence": "never-used", "output": "forbidden"},
-    {"name": "formal model evaluation", "evidence": "unverified", "output": "forbidden"},
-    {"name": "LLM fine-tuning", "evidence": "unverified", "output": "forbidden"},
-    {"name": "Azure", "evidence": "unverified", "output": "forbidden"},
-    {"name": "GCP", "evidence": "unverified", "output": "forbidden"},
-    {"name": "Terraform", "evidence": "unverified", "output": "forbidden"}
+    {
+      "name": "Python",
+      "evidence": "production-current",
+      "output": "allowed"
+    },
+    {
+      "name": "SQL",
+      "evidence": "production-current",
+      "output": "allowed"
+    },
+    {
+      "name": "PySpark",
+      "evidence": "production-current",
+      "output": "allowed"
+    },
+    {
+      "name": "Kafka",
+      "evidence": "production-current",
+      "output": "allowed"
+    },
+    {
+      "name": "Airflow",
+      "evidence": "production-current",
+      "output": "allowed"
+    },
+    {
+      "name": "AWS",
+      "evidence": "production-current",
+      "output": "allowed"
+    },
+    {
+      "name": "CloudFormation",
+      "evidence": "production-current",
+      "output": "allowed"
+    },
+    {
+      "name": "Atlassian Compass",
+      "evidence": "production-current",
+      "output": "allowed",
+      "note": "Metadata/catalogue platform for data-product metadata and lineage at Swisscom (user-confirmed 2026-07-29). Practitioner use only — do not claim administration, rollout or ownership. Satisfies 'or similar metadata/catalogue platform' phrasing; is NOT a substitute claim for Purview, Collibra or Alation, which remain unevidenced."
+    },
+    {
+      "name": "Kubernetes",
+      "evidence": "production-current-and-historical",
+      "output": "allowed"
+    },
+    {
+      "name": "Ansible",
+      "evidence": "production-historical",
+      "output": "allowed",
+      "note": "User-confirmed 2026-08-27: worked intensively with Ansible at Bosch (2020-2022) for configuration management and infrastructure automation, including the BS-1 ML-inference orchestration. Was absent from claims.json despite already appearing in experience_bosch.md BS-1 bullet variants. Counts as genuine Infrastructure-as-Code evidence alongside CloudFormation. Does NOT by itself license claiming Terraform (still unverified) or GitOps as a named practice (see gitops_pending)."
+    },
+    {
+      "name": "Linux administration",
+      "evidence": "production-historical-and-personal-current",
+      "output": "allowed",
+      "note": "User-confirmed 2026-08-27 and previously ABSENT from claims.json entirely. Professional: at Bosch (2020-2022) Linux servers carried everything - ML platform, Docker hosts, backend services, Ansible control - and he administered and automated them (see BS-6). Personal and current: a self-hosted Debian server he has run and hardened for ~10 years (see PP-3). Hardening and security configuration evidence leans on the personal side; say so rather than implying an employer mandate. Does NOT license claiming datacenter/physical infrastructure work, which remains a genuine gap."
+    },
+    {
+      "name": "Docker",
+      "evidence": "production-current-and-historical",
+      "output": "allowed"
+    },
+    {
+      "name": "Java",
+      "evidence": "production-historical",
+      "output": "allowed-with-context"
+    },
+    {
+      "name": "C#",
+      "evidence": "production-historical",
+      "output": "allowed-with-context"
+    },
+    {
+      "name": "C++",
+      "evidence": "production-historical-limited",
+      "output": "allowed-with-context"
+    },
+    {
+      "name": "JavaScript",
+      "evidence": "production-historical-limited",
+      "output": "allowed-with-context"
+    },
+    {
+      "name": "LiteLLM",
+      "evidence": "hands-on-current",
+      "output": "allowed-with-context"
+    },
+    {
+      "name": "custom GPTs",
+      "evidence": "hands-on-current",
+      "output": "allowed-with-context"
+    },
+    {
+      "name": "Kiro",
+      "evidence": "hands-on-current",
+      "output": "allowed-with-context"
+    },
+    {
+      "name": "Copilot",
+      "evidence": "hands-on-current",
+      "output": "allowed-with-context"
+    },
+    {
+      "name": "quantitative/systematic trading concepts",
+      "evidence": "coursework-and-personal-project",
+      "output": "allowed-with-context",
+      "note": "Udacity AI for Trading nanodegree (PP-2) plus the self-built momentum platform (PP-1): factor construction, cross-sectional/residual momentum, ATR stops, backtesting. Self-directed only — NO professional quant, trading or finance experience. Never list under a Professional Experience skills line without the personal-project context, and never as a quant qualification."
+    },
+    {
+      "name": "backtesting",
+      "evidence": "personal-project",
+      "output": "allowed-with-context",
+      "note": "PP-1 scheduled backtest pipelines, personal scale. Never quote a result or performance figure."
+    },
+    {
+      "name": "TensorFlow/Keras",
+      "evidence": "certification",
+      "output": "certification-context-only"
+    },
+    {
+      "name": "PyTorch",
+      "evidence": "certification",
+      "output": "certification-context-only",
+      "note": "IBM AI Engineering Professional Certificate (Coursera, 4 Jun 2020) includes the course \"Deep Neural Networks with PyTorch\"; certificate PDF verified 2026-08-27. Same footing as TensorFlow/Keras: certification context only, never presented as production or project experience."
+    },
+    {
+      "name": "TypeScript",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "FastAPI",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "Flask",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "Django",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "LangChain",
+      "evidence": "never-used",
+      "output": "forbidden"
+    },
+    {
+      "name": "LangGraph",
+      "evidence": "never-used",
+      "output": "forbidden"
+    },
+    {
+      "name": "LlamaIndex",
+      "evidence": "never-used",
+      "output": "forbidden"
+    },
+    {
+      "name": "formal model evaluation",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "LLM fine-tuning",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "Azure",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "GCP",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "Terraform",
+      "evidence": "unverified",
+      "output": "forbidden"
+    },
+    {
+      "name": "GitOps",
+      "evidence": "pending-user-clarification",
+      "output": "forbidden",
+      "note": "RESOLVED 2026-08-27, and the answer is NO. User confirmed: Ansible playbooks lived in Git, but execution was PUSH-based out of Jenkins/GitLab pipelines - there was no pull-based reconciliation agent (Argo CD, Flux). That is version-controlled, CI-driven infrastructure automation, not GitOps. The word stays forbidden in every document. The SUBSTANCE is writable and should be written: 'versionskontrollierte Infrastrukturautomatisierung mit Ansible aus Git, ausgefuehrt ueber Jenkins-/GitLab-Pipelines'. The Kdo Cy JD names 'Pull-GitOps' explicitly, so precision here is an asset, not a loss."
+    }
  ],
  "global_forbidden_output_patterns": [
    "petabyte scale",
@@ -9,14 +9,19 @@

 ### Achievement BW-1: Officer Training and Service

+**Canonical ID:** BW-1
+**Last verified:** 2026-08-27
 **User's role:** Officer candidate / officer
 **Status:** Completed service; resigned as Second Lieutenant
+**Ownership scope:** Individual service and completed training. No command scope, deployment or technical military responsibility is established.
+**Verified result / metric state:** Six years of service and separation as Second Lieutenant are verified; no performance metric is established.

 **Context:** Completed officer candidate training and officer school, then served in the German Armed Forces for six years.

 **Safe bullet direction:** Completed officer candidate training and officer school during six years in the German Armed Forces (Bundeswehr), leaving service as Second Lieutenant. Do not imply a current clearance, NATO service, combat role, technical AI work, or responsibilities not verified.

 **ATS keywords:** German Armed Forces, Bundeswehr, officer, multinational environment, operational context, structured leadership
+**Relevant role context:** Defence, military and public-security employers; organisational familiarity rather than technical evidence.

 **Reframing notes:**
 - Defence / NATO roles: Include as concise context for operational judgement and organisational familiarity.
@@ -137,6 +137,67 @@ def scan_document(path: Path, claims: dict) -> list[str]:
    return errors


+TRIPLE = re.compile(r"\w+, [^,]{3,45}, [^,]{3,45} and |\w+, [^,]{3,45} and ")
+
+
+def _bullet_blocks(text: str) -> list[list[str]]:
+    """Bullets grouped by rSubsection (one group per position)."""
+    body = re.search(r"\\begin\{document\}(.*)\\end\{document\}", text, re.S)
+    body_text = body.group(1) if body else text
+    blocks = re.split(r"\\begin\{rSubsection\}", body_text)[1:]
+    return [re.findall(r"\\item\s+(.+)", block) for block in blocks]
+
+
+def _visible_text(bullet: str) -> str:
+    """Bullet text with LaTeX markup removed, so \\textbf{Owned ...} reads as 'Owned ...'."""
+    text = re.sub(r"\\[a-zA-Z]+\*?(\[[^]]*\])?", " ", bullet)
+    return re.sub(r"[{}$\\]", " ", text)
+
+
+def _opening_word(bullet: str) -> str:
+    match = re.search(r"[A-Za-z]+", _visible_text(bullet))
+    return match.group(0).lower() if match else ""
+
+
+def cadence_checks(path: Path) -> list[str]:
+    """Bullet cadence diagnostics (resume_reference.md 7a).
+
+    Warnings only, never errors. Uniform rhythm is a style flaw, not a truth flaw:
+    no claim, scope or hedged verb may be bent to satisfy these. Reshape sentences.
+    """
+    blocks = _bullet_blocks(read_text(path))
+    bullets = [b for block in blocks for b in block]
+    if len(bullets) < 6:
+        return []
+
+    warnings: list[str] = []
+    triples = [b for b in bullets if TRIPLE.search(b)]
+    share = len(triples) / len(bullets)
+    if share > 0.5:
+        warnings.append(
+            f"{path}: {len(triples)}/{len(bullets)} bullets ({share:.0%}) use an "
+            f"'X, Y and Z' triple (reference 7a: under ~50%). Reshape sentences, not claims."
+        )
+
+    for position, block in enumerate(blocks, 1):
+        for index in range(1, len(block)):
+            previous, current = _opening_word(block[index - 1]), _opening_word(block[index])
+            if previous and previous == current:
+                warnings.append(
+                    f"{path}: position {position}, bullets {index}-{index + 1} both open "
+                    f"with '{previous}'"
+                )
+        # Threshold calibrated on the 50 multi-bullet positions in output/: spreads are
+        # bimodal (1-9, then 15-17). <=4 flags the tight tail (~28%), not the median.
+        lengths = [len(_visible_text(b).split()) for b in block]
+        if len(lengths) >= 4 and max(lengths) - min(lengths) <= 4:
+            warnings.append(
+                f"{path}: position {position} bullets cluster at {min(lengths)}-{max(lengths)} "
+                f"words; vary length within the position, not just across the document."
+            )
+    return warnings
+
+
 def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--document", action="append", default=[], help="Generated .tex file to validate")
@@ -154,6 +215,7 @@ def main() -> int:
            errors.append(f"document not found: {path}")
        else:
            errors.extend(scan_document(path, claims))
+            warnings.extend(cadence_checks(path))

    for warning in warnings:
        print(f"WARN: {warning}")
@@ -7,6 +7,9 @@
 5. Put employer, formal title and dates before any narrative framing.
 6. Use an optional 2--3 line summary, 4--6 skills lines and normally 11--14 evidence-led bullets.
 7. Mix natural bullet lengths. There is no character target and no page-fill quota.
+7a. Vary bullet cadence: keep "X, Y and Z" triples under about half the bullets, avoid two
+    adjacent bullets opening with the same verb, and vary length *within* each position.
+    Style only — never bend a claim, a scope or a hedged verb to fix rhythm (see §7a).
 8. Do not list unverified skills, metrics, customers, scale or causal impact.
 9. Scope Swisscom migration and Data Mesh claims to Dennis's domains, components and products.
 10. Security Champion means the 2025/2026 team role only; omit by default.
@@ -42,7 +42,7 @@ Score the candidate-role pairing before reading tailored prose.
 | Bullet evidence and impact | 20 | Are bullets specific and scoped without invention? |
 | Relevance and terminology | 15 | Does it cover the JD naturally? |
 | Skills evidence | 10 | Is every skill evidence-backed and interview-ready? |
-| Mechanics/readability | 10 | Does it compile, parse and read cleanly? |
+| Mechanics/readability | 10 | Does it compile, parse and read cleanly? Includes **cadence variety** — read the bullets in sequence and count "X, Y and Z" triples, repeated opening verbs and length clustering per position (`resume_reference.md` §7a). Deduct at most 1 pt; it is a style flaw, never a truth flaw. |

 Truth/provenance below 8/10 is an automatic document failure.

@@ -96,6 +96,36 @@ Natural one-, two- and three-line bullets may be mixed. There are no target char

 Use metrics only when verified. Company size, customer names, generic industry volumes and market economics are context, not personal impact.

+### 7a. Cadence variety (anti-monotony)
+
+Individually honest bullets can still read as machine-written when they all share one
+rhythm. Measured across the 18 packages in `output/` (368 bullets): **45 % used the same
+"X, Y and Z" triple**, and the SBB package reached **85 % — 11 of 13 bullets, every
+Swisscom and Bosch line**. Nothing in it was false; it simply had one cadence.
+
+This is a *style* problem, never a truth problem. Never trade accuracy, scope discipline
+or a hedged verb to fix cadence — an accurate monotonous bullet beats a varied inaccurate
+one. Fix it by reshaping sentences, not by changing what is claimed.
+
+Per document, aim for:
+
+- **At most about half the bullets carrying a three-part list.** The triple is normal resume
+  grammar and humans use it too; the tell is using little else.
+- **At least two or three bullets in a different shape** — a short declarative with a single
+  object; a bullet with one object rather than three; a bullet whose scope clause comes first.
+- **No two consecutive bullets opening with the same verb** (the SBB resume had "Build and
+  model…" directly followed by "Build and operate…").
+- **Visible length variation inside each position**, not just across the document. Five bullets
+  at 25–30 words read as generated even when the document's overall range looks fine.
+
+`validate_resume_system.py --document <file.tex>` measures all three and reports them as
+**WARN**, never ERROR — cadence can never fail a document. The length threshold is calibrated
+on the 50 multi-bullet positions in `output/`, whose spreads are bimodal (1–9 words, then
+15–17): it flags a spread of 4 words or less, the tight tail, not the median.
+
+Diagnostic only — like character counts, these are checks, never targets, and no bullet
+should be padded or trimmed to hit them.
+
 ## 8. Titles and Seniority

 - Preserve official titles when recognizable.
@@ -113,6 +143,8 @@ After generation:
 4. Extract text with `pdftotext` and confirm employer/title/date order.
 5. Inspect the rendered PDF: no clipping, overlap, tiny text, isolated headings or awkward page break.
 6. Check that experience begins comfortably on page 1 and certifications are not duplicated.
+7. Act on any cadence WARN from step 1 (§7a). These never fail the document; reshape the
+   offending sentences, never the claims behind them.

 Do not add content merely to reduce bottom whitespace.