claude-resume-kit/CLAUDE.md

# claude-resume-kit — Project Instructions

> This file is auto-loaded by Claude Code. It provides project-wide rules for all skills.

---

## File Map

```
.agents/skills/
├── setup-extract/SKILL.md       # Extract from papers/files into structured extractions
├── setup-build-kb/SKILL.md      # Build experience files, bundles, taxonomy from extractions
├── make-resume/SKILL.md         # Phase 0-2: JD research → bullet plan → resume/CV generation
├── make-cl/SKILL.md             # Cover letter generation from session file
├── edit-resume/SKILL.md         # Edit resume/CV from critique or user feedback
└── critique/SKILL.md            # 8-dimension critique of full package

resume_builder/
├── canonical/
│   ├── claims.json              # Highest-authority career facts and claim controls
│   └── historical_outputs.json  # Reuse safety for prior application packages
├── reference/
│   ├── shared_ops.md            # Session startup, derivation, workflow — ALL skills
│   ├── resume_reference.md      # Resume/CV rules — /make-resume, /edit-resume
│   ├── cl_reference.md          # CL rules — /make-cl, /edit-resume (CL edits)
│   ├── critical_rules.md        # Compact re-read — /make-resume Phase 2
│   ├── session_file_template.md # Session file format
│   ├── critique_framework.md    # Separate fit, document, and channel assessment
│   └── application_strategy.md  # Targeting and cohort strategy
├── templates/                   # LaTeX .cls + .tex templates
├── helpers/                     # Validators, diagnostics, and cohort tracker
├── examples/                    # Example KB for a fictional researcher
├── experience/                  # /setup-build-kb outputs: one file per position
├── bundles/                     # /setup-build-kb outputs: one per target role type
└── support/                     # /setup-build-kb outputs: skills taxonomy, pub metadata, etc.

knowledge_base/                  # User's raw materials
├── extractions/                 # /setup-extract outputs here
├── papers/                      # Drop your PDFs / .tex source here
└── notes/                       # Any other reference material

config.md                        # User configuration (email, provenance, role types)
```

---

## Your Role

You are simultaneously:
1. **Expert Resume Strategist** — STAR bullets, ATS optimization, strategic framing
2. **Senior Hiring Manager** (resumes) / **Senior Scientist** (CVs) — evaluate from the reader's chair

You write as the strategist but critique as the reader.

**Rule hierarchy.** When two instructions conflict, the higher level wins. State which level
you are applying when you deviate.

1. **Evidence rules (immutable).** Anti-fabrication, Scope Discipline, provenance, verb discipline,
   `claims.json` as highest authority. These are never overridden by a JD, a market convention or a
   user styling preference. **Accuracy > Relevance > Impact > ATS > Brevity.**
2. **Standing user preferences.** Recorded in `config.md` and the KB Corrections Log — e.g. Capgemini
   is omitted from every document and the resulting gap is intentional. Changed only by the user.
3. **Market and employer presentation.** Profile choice (International Tech vs Swiss/DACH), section
   order, language, cover-letter convention. Adapt these per target; they never license a level-1 or
   level-2 breach.

**Deliverables vs QA — these are different things and were previously conflated:**
- **The `.tex` is the deliverable and the source of truth.** Never hand over a PDF as the artefact of
  record, and never edit a PDF in place.
- **You still compile.** Run `validate_resume_system.py`, compile with the local LaTeX distribution,
  and inspect the rendered pages before calling anything finished — a clean box count is not a
  visual check.
- **Compile into the application's own `output/` folder**, not a temp directory, so the user can
  review what he is approving (`config.md` Output Rules; rule added after a package shipped with no
  reviewable PDF on 2026-08-27). "Output .tex only" means the .tex is authoritative, **not** that the
  user should be handed nothing to look at.
- Refresh any submission-named copy on every recompile; it is a copy, not a build target.
- Read `config.md` for email, provenance flags, and output preferences.

## Evidence-First Workflow

- `resume_builder/canonical/claims.json` is the highest-authority source for career facts, ownership scope, skill evidence, and allowed wording.
- Files under `output/` are generated artifacts, never evidence sources. Check `resume_builder/canonical/historical_outputs.json` before reusing any historical package.
- Verify the JD and assess hard gates before writing. Record Evidence Fit, Document Quality, and Channel Strength separately; never collapse them into one optimistic score.
- Default to the International Tech profile for US-tech/FAANG roles in Europe. Use the Swiss/DACH profile only when the audience calls for it.
- Natural bullet length and relevance govern selection. There are no character targets, forced line variants, or page-fill quotas.
- A cover letter is conditional. Generate one only when required or when it adds specific evidence or motivation that the resume cannot show.
- Run `resume_builder/helpers/validate_resume_system.py` on generated documents, compile the LaTeX, and inspect the rendered output before finalization.

---

## User Focus Directives

- **"Emphasize X"** — prioritize X-related achievements
- **"Downplay Y"** — reduce or omit Y-related bullets
- **"Include Z"** — force-include achievement Z
- **"Lead with A"** — make A the first bullet in its position
- **"Keep B concise"** — shorten without deleting material evidence

If no directives, use bundle's Priority Matrix defaults.

---

## Anti-Fabrication Rules

**CRITICAL: These rules override everything else.**

### Accuracy Priority
**Accuracy > Relevance > Impact > ATS > Brevity**

When in doubt between a more impressive but less accurate claim and a less impressive but accurate claim, ALWAYS choose accuracy.

### Provenance Discipline
- Read `config.md` Provenance Flags before every generation
- NEVER claim unpublished work is published
- NEVER claim internal tools are peer-reviewed
- NEVER inflate author position (contributing does not equal first author)
- NEVER claim results from collaborators' experiments as the user's own

### Verb Discipline
- **Full-ownership verbs** (Developed, Built, Engineered, Designed) ONLY for work the user performed independently
- **Hedged verbs** (Contributed, Provided, Supported) for shared or contributing-author work
- When in doubt, hedge

### Scope Discipline (big-corp ownership — RECURRING ERROR, enforce hard)
Dennis works in large enterprises (Swisscom, Bosch, etc.). He does **not** solo-own company-wide platforms, migrations, or systems. Repeated past error: "Built a Data Mesh", "I own the data platform", "Migrated the warehouse" written as if he did it alone.
- **NEVER** pair a full-ownership verb with a company-wide/organization-scale object (a Data Mesh, the data platform, the company warehouse, the observability platform). That reads as a false solo claim.
- He **owns what is genuinely his**: his components/domains (Component Owner, Application Owner), the data products he modelled/built/onboarded, the pipelines and services he delivered, the migration work *within his scope*.
- **Fix pattern:** scope the object or hedge the verb.
  - ✗ "Built a decentralized Data Mesh" → ✓ "Built governed data products within \<Company\>'s company-wide Data Mesh"
  - ✗ "I own the cloud-native data platform" → ✓ "I build and own data pipelines and products on \<Company\>'s platform"
  - ✗ "Migrated the legacy warehouse to AWS" → ✓ "Migrated my domains' ETL stack to AWS" / "Contributed to the warehouse migration"
- Titles he legitimately held (Component Owner, Application Owner) ARE his — state them plainly. The ban is on implying he single-handedly built/owns shared org-scale infrastructure.
- See `[[feedback_bigcorp_ownership_scope]]` in memory.

---

## Generation Rules

### Rule 1: No code folder names as package names
NEVER use internal code folder names as if they are software packages. Always describe the tool/method instead (e.g., "custom FEM solver" not "FEM_project/").

### Rule 2: No LOC counts or test counts in output
NEVER include lines-of-code counts or test counts in resume, CV, or cover letter output. Focus on what the tool does, its impact, and adoption.

### Rule 3: Publication status accuracy
Only list papers as "Under Review" if they are actually under review. Check `config.md` Provenance Flags.

### Rule 4: Publication format — use et al.
Use et al. format. Show authors up to and including the user's position, then "et al." When total authors <= 4, show all names.

### Rule 5: Funding is not a personal award
Institutional project funding (grants, internal R&D programs) is NOT a personal fellowship or award. Never list funding sources under Fellowships & Honors.

---

## LaTeX Scientific Notation (MANDATORY)

All templates load `mhchem` (`\usepackage[version=4]{mhchem}`). Use these conventions:

| Item | Correct LaTeX | Wrong | Rendered |
|------|--------------|-------|----------|
| Chemical formulas | `\ce{H2O}`, `\ce{TiO2}` | `H2O`, `H$_2$O` | H₂O |
| Superscripts | `$^2$`, `$^\circ$C` | `^2`, `°C` | ², °C |
| Greek letters | `$\beta$`, `$\alpha$` | `beta`, `alpha` | β, α |
| Approximately | `$\sim$64` | `~64` (LaTeX non-breaking space!) | ~64 |

**CRITICAL:** `~` in LaTeX is a non-breaking space, NOT a tilde. Use `$\sim$` for "approximately."

Character counts are diagnostic only; they must never drive page filling or equal-length bullets.

---

## Active Sessions

Read [current applications](resume_builder/reference/current_applications.md), generated from `job_scout/state/applications.json`. Update the registry through the tracker, then regenerate views. Do not maintain another status table here. Historical notes are preserved under `job_scout/state/history/`.

---

## KB Corrections Log

_See `config.md` for user-specific corrections. Add verified errors here as you find them._

| Date | Correction | Files fixed |
|------|-----------|-------------|
| 2026-09-05 | **The ten-application cohort's slot caps (7 Core / 2 Adjacent / 1 Stretch) were DROPPED by user decision.** Two reasons, both evidenced. **(a) The numbers were arbitrary and non-binding:** no derivation existed anywhere, and they were routed around whenever they bound - RUAG AI Engineer went in at Evidence Fit 74 with a hard-gate FAIL, and Citadel was recorded Adjacent when the strict reading said Stretch. **(b) The cohort was a confounded experiment:** it was built to test *fit class*, but the variable it silently held constant was *channel* - `cohort_tracker.py` reports **channel weak: 6, moderate: 0, strong: 0**. It therefore could not separate "Stretch does not convert" from "cold does not convert", and the evidence points away from fit class regardless: the highest-scoring package in the log (Snowflake, ~86) drew no reply in 80 days, while the single interview (SBB) came from a **cold Core submit whose resume was missing the three ATS literals** the session had flagged. **What was kept is the recording, not the rationing** - fit class, hard gate, channel, date, stage and outcome are still logged on every application, because that record is what makes patterns visible rather than re-derived. **Channel replaces the slot budget as the rationed variable: no application goes out cold when a named contact is published and reachable** - Marco Heinzen (RUAG), Andri Wienandts (SBB) and Per Olav Marthinsen (Aker BP) were all published, reachable and never used. **Fit class is now a preparation signal, not a spend limit:** 64/100 means know which two questions are coming, not do not apply. Hard gates and NO-GO triggers are unchanged. **Three real constraints survive independently and must not be dropped with the caps:** Google's 3-applications-per-rolling-30-days and 90-day same-role wait; not stacking a second cold application on one org while the first is pending; and the hours each package actually costs. Propagated to `application_strategy.md`, `shared_ops.md`, `session_file_template.md`, `cohort_tracker.py` (now prints counts, never counts-against-a-target) and `application_cohort.json`. | `application_strategy.md`; `shared_ops.md`; `session_file_template.md`; `cohort_tracker.py`; `application_cohort.json`; `CLAUDE.md` |
| 2026-09-05 | **`Bash` / shell scripting was missing from `claims.json` entirely - the third canonical gap of exactly this shape, after Ansible and Linux administration (both 2026-08-27).** It surfaced while building the NVIDIA Senior DevOps package: the JD names *"proficient scripting skills in Bash, Python, or Groovy"*, and ten years of Debian administration plus intensive Ansible work at Bosch plainly involve shell scripting - but the canonical file was silent, so under the evidence-first rule the skill was **unwritable** and was deliberately left off the resume. User-confirmed 2026-09-05 and added as `production-historical-and-personal-current`, `output: allowed`, with the same evidence basis as Linux administration (`BS-6` professional 2020-2022; `PP-3` personal and current). The note records two hard limits: it does **not** license **Groovy**, which stays unverified and forbidden, and it does **not** license systems-programming or kernel-level claims. **Systemic lesson, now three times over: the KB is data-engineering shaped and under-records ordinary infrastructure and operations skills. Before scoring any DevOps/platform/SRE JD, ask about ops evidence explicitly rather than trusting `claims.json` to be complete.** Edit note confirmed again: the file is compact inline JSON with CRLF - patch it as text; this change was 6 insertions with no reformatting. | `claims.json` (new skill); NVIDIA resume Languages line |
| 2026-09-04 | **This file asserted a shortlist that the JD does not support, and the 2026-08-31 scout triage had already caught it — but nothing was written here, so it survived into the next session exactly as that triage predicted.** The RUAG session block called **Senior DevOps Engineer C5I** *and* **Data Lakehouse / Senior Data Platform Engineer** "both already shortlisted and materially better fits… where his evidence is Direct rather than Adjacent." Only the first half held. The Data Lakehouse claim was a **title-match prior**: the live JD is **on-prem, MSSQL, Talend, SAP S/4HANA**, and `claims.json` has **0** for all three. RUAG then settled it itself — between the 08-31 and 09-04 scrapes the req was pulled and reposted as **"Senior Data Engineer (MSSQL) mit Data Lakehouse Perspektive"**, with the disqualifier moved into the title; its sibling *Senior Data Analyst & Data Scientist* was likewise reposted as *Senior BI Specialist (Qlik Sense)*. Required line reads *"mehrjährige Erfahrung im Aufbau und Betrieb von **on premise** Data Warehouse Lösungen"* — his stack is AWS cloud-native. Senior DevOps C5I re-verified live on the board 2026-09-04 and stays rank 1. **Systemic lesson: a triage finding that is not written into this log does not exist. Close the loop in the same session that finds it.** | `CLAUDE.md` (RUAG session block); `reports/2026-09-04.triage.md` |
| 2026-09-04 | **The scout's decision log was silently de-linking decisions on two boards, so ruled-out roles kept resurfacing as undecided — this, not forgetfulness, is why the 08-31 RUAG rule-outs all came back `dec=None`.** `_decision_key` had no pattern for either board, so it fell back to the raw path. **RUAG** regenerates the UUID in `/offene-stellen/<slug>/<uuid>` on every repost (*DevOps Engineer C5I* moved `349979ee…` → `f48073a5…`), recovering **2** orphaned decisions. Fixed in `find_decision_url` as a **two-tier match** — exact key first, slug only as a fallback and only when unambiguous in the log — **not** as a slug key: that was tried and rejected because slugs collide (two live reqs shared `flugzeugmechanikerin-technician-mechanical-f-a-18` on the board that day, so one `skip` would have decided both, the exact cross-req failure `_decision_key`'s host-scoping was designed to prevent). **BIS** migrated `/careers/vacancies/jrNNNNNN.htm` → `/vacancy/jrNNNNNN`, orphaning **5** — including the **`applied` row for jr100429**, a live application; fixed with a `jr`-id pattern. Report rows carrying a decision went **49 → 65**, and **14 verified rule-outs were backfilled** with their quoted JD reasons. **NVIDIA Senior DevOps Engineer was deliberately left undecided** — it fails the cohort test as written but the override is the user's call, and a `skip` would foreclose it. ⚠ Surfaced by the BIS fix: **jr100429 is off the BIS board** (listed through 08-27, absent from both full runs since) — the req closed, so there is no open BIS application to stack against. **Rule: when a triage rules a role out, write it to `decisions.json` in the same session — and if a role you know was decided shows as undecided, suspect the key before assuming nobody recorded it.** | `scout.py` (`_JOB_ID_PATTERNS`); `state/decisions.json` (14 backfilled) |
| 2026-09-04 | **Every Workday job URL the scout has ever emitted was a 404, across three companies and every report in the archive.** `fetch_workday` built links as `https://{host}{externalPath}`, but `externalPath` is *site*-relative (`/job/<loc>/<slug>_<req>`) and needs the locale and site segments. Verified: **6/6 short-form URLs returned HTTP 404** across NVIDIA, Novartis and Equinor — including a `-1`-suffixed row and a `Switzerland-Remote` slug, ruling out per-row drift — while **3/3 `…/en-US/{site}/job/…` returned HTTP 200**. Patched in `scout.py:fetch_workday`; 49 URLs in `reports/2026-09-04.json` and 16 in the `.md` repaired in place. Seen-state keys on the Workday req id, not the URL, so nothing was falsely re-flagged as new. **Reports before 2026-09-04 still carry the broken form — any NVIDIA, Novartis or Equinor role previously dismissed as a dead link was mis-dismissed and deserves a re-check.** Roche is unaffected (it uses the `phenom` adapter). Caught only because a JD read was attempted; a keyword-scorer triage would never have surfaced it. | `scout.py` (`fetch_workday`); `reports/2026-09-04.json` + `.md` (URLs repaired) |
| 2026-08-27 | **A German-language resume was being typeset with English hyphenation patterns, and had been for every German package built from this template.** The RUAG resume loaded `lmodern` but **never `babel`** - the cover letter did (`\usepackage[ngerman]{babel}`), the resume did not. The compiled PDF broke words as `Hal-bleiterfertigung`, `Tran-skription`, `automa-tisierte` and `Foun-dation`: all wrong in German, and exactly the kind of thing a native-German Swiss reader notices without being able to name. It survived an earlier full visual QA because nothing *looks* broken - the lines are justified and the page is clean. Adding `\usepackage[ngerman]{babel}` produced correct breaks (`Halb-leiterfertigung`, `automati-sierte`) and **also cleared an overfull box** introduced when the headline grew. ngerman still breaks `Transkription` after `Tran`, so `\hyphenation{Trans-krip-ti-on}` was added. **Rule: any German-language document must load `babel[ngerman]`, and hyphenation must be checked in the compiled PDF, not assumed from a clean box count.** `resume_template.tex` should be checked for the same omission. **Checked 2026-09-04: the template loads no `babel` at all.** It is an English template, so it rides TeX's default English patterns and renders correctly as-is — loading `ngerman` unconditionally would be wrong. Fixed instead with a loud comment block at the package list carrying the ngerman + `\hyphenation` lines ready to uncomment, so the German case cannot be missed silently. No change to English output. | RUAG resume (fixed); `resume_template.tex` (fixed 2026-09-04 — comment-guarded) |
| 2026-08-27 | **`IBM AI Engineering` was on resumes for months with no primary-source record, and `PyTorch` was under-recorded as a result.** The `/critique` flagged it as the only line a canonical preflight could not confirm: the other three certifications sit in `thiessen_certifications.md` with issuer, date and certificate number, while this one existed only in `bundle_ml_ai_engineer.md`. The user supplied the PDF (`C:\myCloud\Bewerbungsunterlagen\Zeugnisse\Zertifikate\cert_IBM_AI_Engineering.pdf`) and it was read directly: **IBM via Coursera, 4 Jun 2020**, no expiry, verify code `3ZBZFVAL6A34`, six courses, name on the certificate `Dennis Thiessen` (sz variant, as on ITIL and iSAQB). Recorded as entry **#8**. It also proves **PyTorch**, which `claims.json` had as `coursework-or-personal-unverified`; upgraded to `evidence: certification` with `output` unchanged at `certification-context-only`. The certificate is explicitly **non-credit** and confers no grade or degree - never present it as an academic qualification. **Same shape as the Ansible/Linux/Bosch-promotion gaps: the claim was true, the KB simply had no record of it.** | `thiessen_certifications.md` (entry 8); `claims.json` (PyTorch evidence) |
| 2026-08-27 | **`claims.json` had no Bosch promotion date, so a Swisscom-style title line was unwritable from the canonical file.** Asked to render Bosch like Swisscom ("Senior Data Engineer, Data Analysis (Beförderung xy)"), the canonical file offered only a combined `official_title` "Engineer / Senior Engineer, Data Analysis" with **no `title_history` and no date** - while SWISSCOM has a full `title_history`. The data existed one layer down: `experience_bosch.md` records it LinkedIn-confirmed as Data Engineer **Feb 2020 - Jan 2021** and **Senior** Data Engineer **Jan 2021 - Dez 2022**. Added to `claims.json` as `title_history`, with `display_title` set to the user's own preferred wording **"Senior Data Engineer, Data Analysis"** and `official_title` left untouched as the formal Zeugnis string. **Systemic lesson, the same shape as the Ansible/Linux gaps: `claims.json` is the declared highest authority but is not always the most complete file - when it is silent, check the `experience/` files before telling the user something is unwritable.** Edit note: the file uses compact inline JSON and CRLF; a `json.dumps(indent=2)` rewrite reformats all ~700 lines. Patch it as text. | `claims.json` (BOSCH title_history, display_title); RUAG resume |
| 2026-08-27 | **Vizrt shown as "DevOps Engineer" alone, on user instruction.** Canonical `official_title` is **"Test Automation Engineer"**; `display_title` is "Test Automation / DevOps Engineer". The user asked to drop "Test Automation" for the RUAG C5I package. Bullet content (CI/CD quality gates, Python backend for distributed transcoding) supports the DevOps framing and the user is the authority on his own role - but **this is the one title on that document that will not match a Zeugnis word-for-word**, so flag it rather than silently propagate it. Not written into `claims.json`: it is a per-package display choice, not a canonical correction. | RUAG resume (session file records the flag) |
| 2026-08-27 | **A finished package had no reviewable PDF, and the only PDF that existed was a stale pre-fix build.** The RUAG C5I resume was recorded as complete, but the previous session had compiled only into a scratch folder (`.tmp_ruag_ai_resume/`), so `output/RUAG_AI_Engineer_C5I/` held just the `.tex`. The user could not approve what he could not open. Worse, that scratch folder still contained a **pre-correction PDF that included Capgemini**, named with the deliverable's stem - one grab away from being submitted. The folder also held a stale 3-page text extraction, which is why the prior session's "both pages visually inspected" claim had been made against a different document than the final one. **Rule: compile the PDF into the application's own `output/` folder** (as the Kdo Cy package does), and never leave a superseded PDF beside a deliverable. "Output .tex only" means the .tex is the source of truth, **not** that the user should be handed nothing to look at. | RUAG output folder (PDF added, stale temp folder deleted); `config.md` (Output Rules) |
| 2026-08-27 | **Capgemini reappeared in a generated resume, breaking a standing omit preference.** The RUAG C5I draft carried `Capgemini Deutschland GmbH, Nov. 2014 - Mai 2015` as a compact chronology entry. The user does **not** want Capgemini on any document (six months only; short-stay impression in Germany). A corpus check found it was the **only** generated `.tex` under `output/` containing the name, so this was a one-off regression, not a systemic drift. **Root cause: the preference had no first-class home.** It lived in memory and in a parenthetical inside the unrelated "12+ years" entry below, so a fresh model reading `CLAUDE.md` and `config.md` alone would not see it - `config.md` does not mention Capgemini at all. Recorded here as its own rule: **Capgemini is omitted from every resume, CV and cover letter. The resulting Nov. 2014 - Mai 2015 gap is intentional and must never be "fixed".** The visible chronology starts at Generali, Mai 2015 - which is also what the "over ten years" profile wording is measured against. | RUAG resume (fixed); this log (rule recorded) |
| 2026-08-27 | **The English resume template asserts "12+ years of production software experience" and that does not hold against `claims.json`.** Canonical `employment` starts at **Capgemini 2014-11** → ~11 years 9 months as of Aug 2026; and Capgemini is omitted from documents by standing user preference, so the *visible* record on any generated resume starts **Generali 2015-05** → ~11 years 3 months. Either reading falls short of twelve. Inherited unexamined into the Kdo Cy draft's opening sentence and caught at final review; corrected there to **"über zehn Jahren"**, which is true under both readings. **`resume_builder/templates/resume_template.tex` still carries the 12+ claim and will re-infect the next package.** Possible innocent explanation: officer service after the 2013 M.Eng. (he is a Universität-der-Bundeswehr graduate) may be counted and is not in `employment` — **ask before editing the template**, and if it counts, record it in `claims.json` so the number has a source. Lesson: a number inherited from a template is still a claim and needs a canonical source like any other. | Kdo Cy resume (fixed); `resume_template.tex` (OPEN) |
| 2026-08-27 | **Linux administration was missing from `claims.json` entirely — the second infrastructure blind spot found the same day, and the more consequential one.** User-confirmed: at **Bosch (2020–2022) Linux servers carried everything** — ML platform hosts, Docker hosts, backend services, the Ansible control path — and he administered and automated them; he also **wrote Ansible extensions**, including a credential plugin pulling secrets from a password keystore with local caching to cut lookup volume (scalability/performance). Recorded as new claim **BS-6**. Separately, he has run a **self-hosted Debian server for ~10 years** — nginx, mail, Nextcloud, VPN, Docker services, Bitwarden — which he administers *and hardens*; recorded as **PP-3** with a PP-1-style forbidden list (never enterprise/production/multi-user, no uptime or scale figures, never employer work, never evidence of physical-datacenter experience). **Hardening evidence leans on the personal side — always say so.** **GitOps question resolved and the answer is NO:** playbooks were in Git but execution was **push-based from Jenkins/GitLab**, no reconciliation agent. The word stays `forbidden`; the substance is writable as *"versionskontrollierte Infrastrukturautomatisierung mit Ansible aus Git, ausgeführt über Jenkins-/GitLab-Pipelines"*. **Systemic lesson: the KB is data-engineering shaped and under-records infrastructure and operations work.** Two canonical gaps (Ansible, Linux) cost the Kdo Cy assessment ~15 points and produced an initial NO-GO that reflected the KB, not the candidate. Before scoring any DevOps/platform/SRE-flavoured JD, ask about ops evidence explicitly rather than trusting `claims.json` to be complete. | `claims.json` (skills Linux administration + GitOps note, new claims BS-6 and PP-3) |
| 2026-08-27 | **Ansible was missing from `claims.json` entirely — a real, currently-relevant skill that could not legitimately be listed.** It already appeared in `experience_bosch.md` BS-1 bullet variants ("Docker, Kubernetes, Ansible"), but the canonical file had **zero** mentions in either `skills` or any claim, so by the evidence-first rule it was unwritable. User confirmed 2026-08-27 that Ansible work at Bosch (2020–2022) was **intensive** and went beyond the BS-1 ML-inference orchestration into configuration management and infrastructure automation. Added as `production-historical`, `output: allowed`, and BS-1's scope now records it. **This is genuine IaC evidence** alongside CloudFormation and it materially improves any DevOps/platform JD — it does **not** license Terraform, which stays unverified. **`GitOps` added as a separate, explicitly `forbidden` skill pending clarification:** the user described the Ansible work as GitOps, but Ansible is configuration management while GitOps is narrower (declarative desired state in Git, reconciled by an agent such as Argo CD or Flux). Until it is established whether playbooks lived in Git and were applied from there, and whether a reconciliation agent was involved, the word must not appear in any document. The Kdo Cy JD names **"Pull-GitOps"** explicitly, so that is the one audience guaranteed to probe the distinction. | `claims.json` (skills Ansible + GitOps, BS-1 scope) |
| 2026-08-21 | **The data-engineer bundle carried the SW-1 scope violation it was supposed to prevent.** `bundle_data_engineer.md` §S5's cover-letter opening hook read "*while simultaneously leading the migration of our legacy stack to a cloud-native AWS architecture*" — a full-ownership verb on a company-scale object, directly contradicting `claims.json` SW-1 `forbidden` **and** point 2 of the narrative thread three lines below it. Live trap for every future data-eng cover letter. Rewritten to the scoped form plus an inline scope warning. **Check the other four bundles for the same pattern.** | `bundle_data_engineer.md` (§S5 hook + new warning) |
| 2026-07-27 | **SW-1 was not solo.** Swisscom AWS migration was written as "sole technical lead" / "Led migration of legacy stack." Dennis was primary engineer for **his own domains'** pipelines and a contributor to the wider programme. | `experience_swisscom.md` (role line + all 3 bullet variants + overclaiming warning), `config.md` |
| 2026-07-27 | **Security Champion is 2025/2026 only, and is a team role — not an award.** Source files claimed "3 consecutive years (2023/24–2025/26)." User has now corrected this twice. **Default is OMIT** unless the JD explicitly requires security/DevSecOps. | `experience_swisscom.md` SW-5, `achievement_reframing_guide.md`, `skills_taxonomy.md` (3 rows) |
| 2026-07-29 | **Atlassian Compass is the metadata/lineage platform for Swisscom data products** (user-supplied). Previously the KB named no catalogue/lineage product at all, which read as a hard gap against data-governance JDs. Practitioner use only — never claim admin, rollout or ownership. Does NOT license claiming Purview/Collibra/Alation. | `claims.json` (SW-7 scope + skills entry), `experience_swisscom.md` SW-7 |
| 2026-08-02 | **Master's thesis verified against the PDF.** Vibration-based condition monitoring of CNC machine tools; hybrid **rule-based reasoning + 7-10-3 ANN**; throughput/latency evaluation (~500 SPS pipeline vs 72.9 kSPS sensors). **PSO was surveyed but NOT implemented** — an earlier note in this session wrongly listed it as an applied method. No real operational data and no accuracy figures: it is a methods prototype, not a validated system. Also recorded: ECTS relative grade **B (top 35%)**, English-language transcripts exist. | `claims.json` EDU-MENG |
| 2026-08-26 | **Degree final grades were missing from the KB entirely.** A Citadel application form asked for GPA and neither degree's *Abschlussnote* was recorded anywhere in `claims.json` — only the M.Eng. **thesis** grade (1.0). The only lead was `knowledge_base/extractions/thiessen_cv_master_profile.md`, whose own provenance note says it is not authoritative and which already carries a known error (lists PSO as an applied thesis method, corrected 2026-08-02). User confirmed both grades directly: **M.Eng. 1.6, B.Eng. 2.4** (German scale, 1.0 best / 4.0 lowest pass). US 4.0 equivalents added via the modified Bavarian formula (`5.0 − G`): **3.4** and **2.6**. ECTS percentile **settled the same day**: B is formally the next 25% after the top 10%, i.e. the **10–35% band, so "top 35%" is the correct phrasing** — the record's original value was right and the briefly-considered "top 30%" was the error. **Never narrow B to a point estimate** (top 30%/25%); it is a band. New `grade_output_rule`: grades stay off the resume and cover letter by default; these fields exist for form questions and credential checks. | `claims.json` (EDU-MENG, EDU-BENG) |
| 2026-08-25 | **Trading-domain evidence was entirely missing from the KB.** `claims.json` had 0 hits for trading, finance or quant, so a genuine capability was unusable in any document. Added **PP-1** (self-built, self-hosted single-user investing/signal platform: US-equity price/fundamental/sentiment ingestion, LLM-assisted sentiment, long-only cross-sectional residual 12-1 momentum book with ATR stop/trail and max 15 names, scheduled scan/backtest pipelines, web dashboard + Telegram alerts) and **PP-2** (Udacity *AI for Trading* nanodegree), plus two `allowed-with-context` skills. Both carry hard `forbidden` lists: **no PnL/Sharpe/return/backtest figure may ever be quoted**, never call PP-1 distributed/production/multi-user, never imply professional quant or finance experience, never present the nanodegree as a quant credential. PP-1 is the one place full-ownership verbs are correct — it is genuinely solo, unlike the employer work governed by Scope Discipline. | `claims.json` (claims PP-1, PP-2; skills "quantitative/systematic trading concepts", "backtesting") |
| 2026-08-02 | **Bosch data types named.** Fab sensor/process data: defect-management records, wafer inspection images, PCM electrical parameters (user-confirmed). Previously the KB named no concrete sensor-data types for Bosch. | `claims.json` BS-2 |
| 2026-07-27 | **Bullet density.** Fixed 1L/2L/3L and character-band rules made bullets uniform and encouraged page filling. | Replaced globally with natural-length, evidence-led bullets; character counts are diagnostic only. |
| 2026-08-25 | **Cadence monoculture across every generated package.** Audit of all 18 packages in `output/` (368 bullets) found **45% used the same "X, Y and Z" triple**; the SBB package hit **85% — 11 of 13 bullets, every Swisscom and Bosch line** — plus two adjacent bullets both opening "Build and…". Not a truth defect: every bullet was accurate and the corpus is clean on AI vocabulary (0 cliché hits in 35 documents) and prose em-dashes (0.08/bullet). It is a *rhythm* tell — uniform three-beat cadence reads as machine-written. PDF metadata is clean (MiKTeX pdfTeX, empty Author/Title, no AI tokens in 69 PDFs, no generator-term leakage). | New `resume_reference.md` §7a + verification step 7; `critical_rules.md` rule 7a; `critique_framework.md` mechanics row now scores cadence (max 1 pt, style only) |

## Maintenance resume point

For the authorized project-review fixes, read [FIX_PROGRESS.md](FIX_PROGRESS.md) before continuing. Both agent skill directories route to the shared workflows in `resume_builder/reference/workflows/`.