claude-resume-kit/CLAUDE.md

# claude-resume-kit — Project Instructions

> This file is auto-loaded by Claude Code. It provides project-wide rules for all skills.

---

## File Map

```
.agents/skills/
├── setup-extract/SKILL.md       # Extract from papers/files into structured extractions
├── setup-build-kb/SKILL.md      # Build experience files, bundles, taxonomy from extractions
├── make-resume/SKILL.md         # Phase 0-2: JD research → bullet plan → resume/CV generation
├── make-cl/SKILL.md             # Cover letter generation from session file
├── edit-resume/SKILL.md         # Edit resume/CV from critique or user feedback
└── critique/SKILL.md            # 8-dimension critique of full package

resume_builder/
├── canonical/
│   ├── claims.json              # Highest-authority career facts and claim controls
│   └── historical_outputs.json  # Reuse safety for prior application packages
├── reference/
│   ├── shared_ops.md            # Session startup, derivation, workflow — ALL skills
│   ├── resume_reference.md      # Resume/CV rules — /make-resume, /edit-resume
│   ├── cl_reference.md          # CL rules — /make-cl, /edit-resume (CL edits)
│   ├── critical_rules.md        # Compact re-read — /make-resume Phase 2
│   ├── session_file_template.md # Session file format
│   ├── critique_framework.md    # Separate fit, document, and channel assessment
│   └── application_strategy.md  # Targeting and cohort strategy
├── templates/                   # LaTeX .cls + .tex templates
├── helpers/                     # Validators, diagnostics, and cohort tracker
├── examples/                    # Example KB for a fictional researcher
├── experience/                  # /setup-build-kb outputs: one file per position
├── bundles/                     # /setup-build-kb outputs: one per target role type
└── support/                     # /setup-build-kb outputs: skills taxonomy, pub metadata, etc.

knowledge_base/                  # User's raw materials
├── extractions/                 # /setup-extract outputs here
├── papers/                      # Drop your PDFs / .tex source here
└── notes/                       # Any other reference material

config.md                        # User configuration (email, provenance, role types)
```

---

## Your Role

You are simultaneously:
1. **Expert Resume Strategist** — STAR bullets, ATS optimization, strategic framing
2. **Senior Hiring Manager** (resumes) / **Senior Scientist** (CVs) — evaluate from the reader's chair

You write as the strategist but critique as the reader.

**Rule hierarchy.** When two instructions conflict, the higher level wins. State which level
you are applying when you deviate.

1. **Evidence rules (immutable).** Anti-fabrication, Scope Discipline, provenance, verb discipline,
   `claims.json` as highest authority. These are never overridden by a JD, a market convention or a
   user styling preference. **Accuracy > Relevance > Impact > ATS > Brevity.**
2. **Standing user preferences.** Recorded in `config.md` and the KB Corrections Log — e.g. Capgemini
   is omitted from every document and the resulting gap is intentional. Changed only by the user.
3. **Market and employer presentation.** Profile choice (International Tech vs Swiss/DACH), section
   order, language, cover-letter convention. Adapt these per target; they never license a level-1 or
   level-2 breach.

**Deliverables vs QA — these are different things and were previously conflated:**
- **The `.tex` is the deliverable and the source of truth.** Never hand over a PDF as the artefact of
  record, and never edit a PDF in place.
- **You still compile.** Run `validate_resume_system.py`, compile with the local LaTeX distribution,
  and inspect the rendered pages before calling anything finished — a clean box count is not a
  visual check.
- **Compile into the application's own `output/` folder**, not a temp directory, so the user can
  review what he is approving (`config.md` Output Rules; rule added after a package shipped with no
  reviewable PDF on 2026-08-27). "Output .tex only" means the .tex is authoritative, **not** that the
  user should be handed nothing to look at.
- Refresh any submission-named copy on every recompile; it is a copy, not a build target.
- Read `config.md` for email, provenance flags, and output preferences.

## Evidence-First Workflow

- `resume_builder/canonical/claims.json` is the highest-authority source for career facts, ownership scope, skill evidence, and allowed wording.
- Files under `output/` are generated artifacts, never evidence sources. Check `resume_builder/canonical/historical_outputs.json` before reusing any historical package.
- Verify the JD and assess hard gates before writing. Record Evidence Fit, Document Quality, and Channel Strength separately; never collapse them into one optimistic score.
- Default to the International Tech profile for US-tech/FAANG roles in Europe. Use the Swiss/DACH profile only when the audience calls for it.
- Natural bullet length and relevance govern selection. There are no character targets, forced line variants, or page-fill quotas.
- A cover letter is conditional. Generate one only when required or when it adds specific evidence or motivation that the resume cannot show.
- Run `resume_builder/helpers/validate_resume_system.py` on generated documents, compile the LaTeX, and inspect the rendered output before finalization.

---

## User Focus Directives

- **"Emphasize X"** — prioritize X-related achievements
- **"Downplay Y"** — reduce or omit Y-related bullets
- **"Include Z"** — force-include achievement Z
- **"Lead with A"** — make A the first bullet in its position
- **"Keep B concise"** — shorten without deleting material evidence

If no directives, use bundle's Priority Matrix defaults.

---

## Anti-Fabrication Rules

**CRITICAL: These rules override everything else.**

### Accuracy Priority
**Accuracy > Relevance > Impact > ATS > Brevity**

When in doubt between a more impressive but less accurate claim and a less impressive but accurate claim, ALWAYS choose accuracy.

### Provenance Discipline
- Read `config.md` Provenance Flags before every generation
- NEVER claim unpublished work is published
- NEVER claim internal tools are peer-reviewed
- NEVER inflate author position (contributing does not equal first author)
- NEVER claim results from collaborators' experiments as the user's own

### Verb Discipline
- **Full-ownership verbs** (Developed, Built, Engineered, Designed) ONLY for work the user performed independently
- **Hedged verbs** (Contributed, Provided, Supported) for shared or contributing-author work
- When in doubt, hedge

### Scope Discipline (big-corp ownership — RECURRING ERROR, enforce hard)
Dennis works in large enterprises (Swisscom, Bosch, etc.). He does **not** solo-own company-wide platforms, migrations, or systems. Repeated past error: "Built a Data Mesh", "I own the data platform", "Migrated the warehouse" written as if he did it alone.
- **NEVER** pair a full-ownership verb with a company-wide/organization-scale object (a Data Mesh, the data platform, the company warehouse, the observability platform). That reads as a false solo claim.
- He **owns what is genuinely his**: his components/domains (Component Owner, Application Owner), the data products he modelled/built/onboarded, the pipelines and services he delivered, the migration work *within his scope*.
- **Fix pattern:** scope the object or hedge the verb.
  - ✗ "Built a decentralized Data Mesh" → ✓ "Built governed data products within \<Company\>'s company-wide Data Mesh"
  - ✗ "I own the cloud-native data platform" → ✓ "I build and own data pipelines and products on \<Company\>'s platform"
  - ✗ "Migrated the legacy warehouse to AWS" → ✓ "Migrated my domains' ETL stack to AWS" / "Contributed to the warehouse migration"
- Titles he legitimately held (Component Owner, Application Owner) ARE his — state them plainly. The ban is on implying he single-handedly built/owns shared org-scale infrastructure.
- See `[[feedback_bigcorp_ownership_scope]]` in memory.

---

## Generation Rules

### Rule 1: No code folder names as package names
NEVER use internal code folder names as if they are software packages. Always describe the tool/method instead (e.g., "custom FEM solver" not "FEM_project/").

### Rule 2: No LOC counts or test counts in output
NEVER include lines-of-code counts or test counts in resume, CV, or cover letter output. Focus on what the tool does, its impact, and adoption.

### Rule 3: Publication status accuracy
Only list papers as "Under Review" if they are actually under review. Check `config.md` Provenance Flags.

### Rule 4: Publication format — use et al.
Use et al. format. Show authors up to and including the user's position, then "et al." When total authors <= 4, show all names.

### Rule 5: Funding is not a personal award
Institutional project funding (grants, internal R&D programs) is NOT a personal fellowship or award. Never list funding sources under Fellowships & Honors.

---

## LaTeX Scientific Notation (MANDATORY)

All templates load `mhchem` (`\usepackage[version=4]{mhchem}`). Use these conventions:

| Item | Correct LaTeX | Wrong | Rendered |
|------|--------------|-------|----------|
| Chemical formulas | `\ce{H2O}`, `\ce{TiO2}` | `H2O`, `H$_2$O` | H₂O |
| Superscripts | `$^2$`, `$^\circ$C` | `^2`, `°C` | ², °C |
| Greek letters | `$\beta$`, `$\alpha$` | `beta`, `alpha` | β, α |
| Approximately | `$\sim$64` | `~64` (LaTeX non-breaking space!) | ~64 |

**CRITICAL:** `~` in LaTeX is a non-breaking space, NOT a tilde. Use `$\sim$` for "approximately."

Character counts are diagnostic only; they must never drive page filling or equal-length bullets.

---

## Active Sessions

Read [current applications](resume_builder/reference/current_applications.md), generated from `job_scout/state/applications.json`. Update the registry through the tracker, then regenerate views. Do not maintain another status table here. Historical notes are preserved under `job_scout/state/history/`.

---

## KB Corrections Log

_See `config.md` for user-specific corrections. Add verified errors here as you find them._

| Date | Correction | Files fixed |
|------|-----------|-------------|
| 2026-10-22 | **Current on-call was unrecorded, which made the KB look as if his production-operations evidence ended at ART B2B. This is the eighth gap of the recurring ops shape, surfaced by the NVIDIA *Senior Production Engineer, DGX Cloud* (JR2027105) fit check.** User-confirmed in his current team: **Opsgenie** alerting, a **rotating engineer-on-duty role** he takes part in, and bugs and alerts that automatically create Jira tickets the team assigns and fixes. Recorded as **SW-11**. A follow-up confirmed that **he writes the alert thresholds for his own pipelines**, data-quality thresholds being the named example. The Opsgenie/Jira integration is not his and "24/7" is not established. The follow-up also confirmed that the Bosch BS-4 PoC included **Grafana, Prometheus and Loki** (previously only in his earlier CV); registered as PoC-context skills with ELK Stack. **Same message:** (a) the Bosch ML inference (BS-1) **ran on NVIDIA GPUs with CUDA**, but he "never did much configuration there". The writable form is "GPU-backed inference on NVIDIA GPUs". **CUDA is registered `forbidden`** as a skill (it is system context only), and GPU tuning is forbidden on BS-1. (b) **Networking: no professional configuration.** Day-to-day work runs on automated AWS landing zones, and AWS networking is covered only by the Solutions Architect – Associate certificate. Recorded as `networking`, certification context only. **Lesson, the same as before: on an SRE/production JD, ask about the CURRENT on-call and alerting setup before scoring. The past SW-2 Rufbereitschaft had hidden the current one.** | `claims.json` (SW-11, BS-1, skills Opsgenie/CUDA/networking); `knowledge_base/extractions/2026-10-22_oncall_networking_gpu_clarification.md` |
| 2026-10-21 | **Software design and architecture was under-recorded: the seventh canonical gap of the recurring shape, surfaced by the Google *Staff SWE, Shopping Graph* minimum *"3 years of experience with software design and architecture."*** Before this, the only design evidence was SW-7 (current, undated, 2026-10-03) and a *contribution* at Generali (GN-3), so the line read as unproven. User-confirmed: **software design and architecture were part of his work at Bosch (ingestion and inference scripts, 2020-2022) and at Swisscom (data products)**, and both count toward the year requirement; together they exceed three years. Recorded on BS-1, BS-2 and SW-7, with `designed` added to the BS-1/BS-2 allowed verbs. **Scope kept tight:** at Bosch, "designed" covers the ingestion scripts and the inference integration only, not the data services in general (the first patch over-extended it and was trimmed the same session). Design never means an architect title, design authority or shared-platform architecture. The Swisscom start date stays undated. **Lesson, the same as 10-08 and 10-14: when a JD has a years-of-X minimum that the canonical file states without a duration, ask for the duration before scoring.** | `claims.json` (BS-1, BS-2, SW-7); `config.md` (data-product design row); `knowledge_base/extractions/2026-10-21_software_design_architecture_clarification.md` |
| 2026-10-22 | **Scout findings fixed in one pass; the biggest one is that Apple had been blind to Switzerland for about two months.** (a) **Apple:** the `location=switzerland-CHE` slug stopped resolving and Apple silently applied a US location ("Chesterfield, Missouri"). Every run from at least 2026-08-31 to 2026-10-22 returned the same 21 US/intern cards and **0 Swiss roles**, which read as "Apple has nothing" rather than as a failure. The code is now `CHEC` (from `/api/v1/refData/postlocation`); the card is the result list item, so the location is readable; and there is pagination, a settle delay and per-element timeouts (one run took 876s, the next 25s). Result: **24 Swiss roles**, Zurich AIML/infra included. (b) **BIS:** bis.org went behind a Cloudflare challenge (403, even for a headless browser), so the board moved to its Workday tenant `bis.wd3.myworkdayjobs.com/External`, which also gives the real office. A host alias plus a lower-cased jr-id keep all 9 `bis.org#jr…` decisions linked (applied jr100498 included). (c) **NAV:** the search API 429s after ~9 requests and then for hours. Discovery now stays at 8 searches, and posting text comes from NAV's official third-party feed (`pam-stilling-feed`, public rotating token), which tolerated bursts. The feed lacks ~2/3 of ads, so a small, slow website-page fallback covers those, and verdicts are cached. (d) **EMEA leak fixed:** a country allowlist without CH/DK plus a trailing "EMEA" tag is no longer Europe-remote (27 rows removed). Swiss/Danish segments in multi-location strings are checked per segment, so "PL-Poland-Remote \| CH-Zurich-MSO" stays Swiss. A regression over all *eligible* 2026-10-22 rows showed only the fenced rows changing (rows newly admitted by the per-segment check were not regression-tested). (e) **Reputation:** every board now has a dated verdict. Glassdoor and **kununu** are both primary sources, and whichever has more reviews decides (user tip: kununu is far better for Swiss employers). AVOID: **BIS** (Glassdoor 2.9/56, where an application is pending), **BFH** (kununu 3.3/132), **Kdo Cy** (federal-administration kununu 3.4/997, not unit-specific). **Lesson: a board that returns the same non-zero count with zero eligible rows for weeks is a silent failure, not an empty market. Check what filter the site actually applied.** | `scout.py` (Apple, BIS, NAV, location filter, reputation); `state/employer_reputation.json` |
| 2026-10-21 | **FIXED 2026-10-22 (Microsoft links; the EMEA leak below was fixed the same day, see the 2026-10-22 row).** Fix: `fetch_pcsx` now emits `apply.careers.microsoft.com<positionUrl>?jobId=<displayJobId>`, a `?jobId=` pattern precedes the `/job/` one in `_JOB_ID_PATTERNS`, and `_HOST_ALIASES` maps the new host to the old so `_decision_key` is unchanged. Verified: all 7 logged Microsoft decisions still resolve (applied 200043897 included), and a new-form link opened the real posting with the job number on the page. Reports before 2026-10-22 still carry the dead form. Original finding: **every Microsoft link the scout emits is dead, in every report**, found in the 2026-10-20 triage. `fetch_pcsx` builds `jobs.careers.microsoft.com/global/en/job/<displayJobId>`, which now redirects to a generic `apply.careers.microsoft.com/careers?...&pid=1970393557041551` search page. Verified on 200060867 and on the **pending application 200043897** (Principal FDE). The application itself is unaffected; only the link is. The working form is `https://apply.careers.microsoft.com/careers/job/<pcsx id>`, the API's `positionUrl`. **Deliberately NOT patched yet:** 6 logged Microsoft decisions (including 200043897) are keyed on `displayJobId` through the `careers\.microsoft\.com /job/(\d+)` pattern. Swapping the URL would re-key them on the pcsx id and orphan them, the same failure as the 09-04 RUAG/BIS de-linking. **Safe fixes:** (a) keep `url` and add a working `apply_url` field to the row, or (b) emit the new URL with the display id carried in it, plus a host-normalised key pattern. Either way, verify all 6 rows still resolve through `find_decision_url` afterwards. Same triage, also OPEN: an **"EMEA" region suffix lets country-fenced roles through the location filter** (GitLab FR/DE/NL/ES/UK, Grafana ×5, Fivetran Serbia: 7 of 109 new rows), which breaks the docstring rule against multi-country allowlists that omit CH. | not yet fixed: `scout.py` (`fetch_pcsx`, location filter); evidence in `reports/2026-10-20.triage.md` |
| 2026-10-15 | **Two scout adapters were reporting wrong data without failing; both were found by the 2026-10-14 triage.** (a) **BIS:** the RSS adapter stamped `default_location: Basel, Switzerland` on every vacancy, so **jr100491 (Hong Kong, BIS Asia office)** passed the CH filter and reached a JD read. The feed carries no location, but each vacancy page has a static *Geographical location* field. `fetch_rss` now reads it per item (`location_page_regex`), falls back to a *"based in ..."* sentence in the feed description, and only then uses `default_location`, printing a warning when it does. Verified: Basel reqs still pass, and jr100491 now reads *8 Finance Street, Central, Hong Kong* and is excluded. (b) **Confluent:** IBM closed the acquisition on 2026-03-17, and the Ashby board went from 17 jobs (10-08) to `{"jobs":[]}` (10-14). careers.confluent.io sits behind a Vercel bot checkpoint. The roles are now IBM requisitions, served by the open IBM careers search API (`www-api.ibm.com/search/api/v2`, POST, `size` capped at 100, pages with `from`). New `ibm` adapter; Confluent keeps its id, so seen-state and decisions still link. First run: 84 roles, 0 in CH/Europe-remote scope. **HashiCorp was dropped on 2026-06-06 for having "no clean public ATS API" after IBM absorbed it. That API exists, so HashiCorp can come back through the same adapter if wanted.** **Rule: when an adapter must assume a field, the assumption has to be visible. A silent default looks exactly like real data.** | `scout.py` (`fetch_rss`, `_rss_item_location`, `fetch_ibm`, BIS and Confluent config) |
| 2026-10-14 | **Spotfire was the sixth evidenced-but-unregistered skill, and junior mentoring was unrecorded - both surfaced by the BIS Basel jr100498 *Senior/Lead Data & Analytics Engineer* (MED IT) triage.** (a) **TIBCO Spotfire** sat in the BS-5 and BS-8 scopes (co-owned environment, technical Application Owner, C# extensions, TAF 2022, spatial wafer-data map charts) but not in the `skills` array, so the JD line *"using database reporting and business intelligence tools"* had no citable skill; registered `production-historical`, `allowed` on user instruction. It does not license Power BI, Tableau or Qlik. (b) The JD requires *"Experience providing general supervision and task-specific guidance to junior colleagues"*, and the only canonical evidence was BS-7 (students, one thesis as Zweitpruefer). User-confirmed: he **onboarded and mentored junior developers at Bosch and at Swisscom** - recorded as **BS-9** and **SW-10**, one per employer. The Swisscom phase (ART B2B or ART DPT) is not recorded, so write it in past tense. Neither is people management. (c) **SDMX: user-confirmed never used**; registered `forbidden` so the scanner catches it. It is an accountability line in the JD, not a qualification. (d) The same audit found **Teradata, Oracle Database and Hadoop/Impala** evidenced only in the SW-2/BS-2/BS-8 scopes and absent from the `skills` array, although every past skills line listed them; registered `production-historical` from those scopes (Oracle explicitly does not establish DBA work). **Lesson, same as 10-08: when a JD has a supervision or mentoring line, ask about junior colleagues before falling back on BS-7. Student supervision is weaker evidence and the stronger evidence was simply unrecorded.** | `claims.json` (BS-9, SW-10; skills TIBCO Spotfire, SDMX, Teradata, Oracle Database, Hadoop / Impala); `knowledge_base/extractions/2026-10-14_mentoring_spotfire_sdmx_clarification.md` |
| 2026-10-08 | **Three more canonical gaps of the recurring shape, surfaced by the Kongsberg Seatex *Lead Engineer, DevOps and Test Infrastructure* (Trondheim) package.** (a) **Jenkins and GitLab CI/CD** were evidenced in claim scopes (GN-1, FC-1, BS-6, SW-3) but absent from the `skills` array, so no skills line could cite them; registered as `production-historical`, with GitLab keeping SW-3's "used, not built" limit. (b) **Embedded coursework** was unrecorded: user-confirmed an Embedded Systems course (C/C++ and VHDL with an ARM platform) and Robotics during his studies, and **no embedded work since** - recorded as **ED-1**, coursework-only, degree attribution not yet given. (c) **Current unit testing** was unrecorded: he writes unit tests today and knows pytest - recorded as **SW-9**; whether pytest is the Swisscom framework is not confirmed. The JD's required line *"Experience working with embedded SW and Linux"* stays a **half Gap** (hard-gate FAIL); the user overrode it knowingly. **Lesson, again: for any DevOps/test JD ask about current testing practice and about academic hardware work before scoring - neither lives in `claims.json` by default.** | `claims.json` (ED-1, SW-9, 7 skills); `knowledge_base/extractions/2026-10-08_embedded_coursework_testing_clarification.md`; Kongsberg package |
| 2026-09-15 | **Swisscom was recorded as one undifferentiated current role, so past work read as present.** The first Geo Platform build said *"Own the ETL pipeline components"* and *"Owns ... Teradata"* in the summary - wrong. User-supplied: the tenure has two phases. **ART B2B** (first part, PAST): the legacy Teradata DWH - Fulfillment ETL component ownership (SW-2), Python on Kubernetes with GitLab CI/CD (SW-3), dashboards and analyses (SW-4), Kafka. **ART DPT, Team Offering** (CURRENT): migration and implementation of AWS data products on AWS, ODP-Flow, PySpark/Python, Glue, Iceberg, Athena, Airflow (SW-1, SW-6, SW-7). **Kafka and Kubernetes downgraded to `production-historical`**; SW-2/SW-3/SW-4 allowed verbs are now past tense; Apache Iceberg added as a canonical skill. Official internal title recorded: `Data, Analytics & AI Engineer IV` (III before Apr 2025), per the Oct 2025 Zwischenzeugnis. **The switch date is deliberately not recorded (user: not relevant) - never date the two units.** Any already-submitted package that presents Swisscom Kubernetes, Kafka or Teradata ownership as current stays as submitted history, but expect the question in interviews. **Lesson: the Zwischenzeugnis gives the whole tenure as one duty list, and a duty list says nothing about which duties are current - ask which phase each belongs to.** Same session, same shape: the Zeugnis's *"automation of CI/CD processes in GitLab"* overstated his part - the user clarified he **worked with** automated GitLab CI/CD rather than building it, and SW-3 now forbids claiming the automation. | `claims.json` (SWISSCOM org/title history; SW-1/2/3/4/6/7; Kafka, Kubernetes, Apache Iceberg; SW-3 CI/CD scope); `experience_swisscom.md` SW-3; Geo Platform resume |
| 2026-09-15 | **Geospatial evidence was missing from `claims.json` - the fifth canonical gap of the Ansible/Linux/Bash/Kotlin shape - and the first assessment compounded it with a wrong assumption about the domain.** Surfaced by the internal Swisscom posting *Data Engineer - Geo Platform* (R-0006447), which requires *"Fundierte Praxis mit ArcGIS und FME"*. User-confirmed: at Bosch he worked extensively with geospatial data in Oracle (**`SDO_GEOMETRY`**) and TIBCO Spotfire to visualize, locate and analyze wafer data, across **multiple coordinate reference systems** - normalizing and transforming between them was the main difficulty of the work, performance tuning the other. Recorded as **BS-8** plus two `allowed-with-context` skills. **The assessment first asserted that wafer coordinates carry no CRS and scored the geo lines on that basis; it was wrong and the user corrected it.** Boundary kept, not re-litigated: geographic/geodetic specifics (datums, map projections, EPSG, LV95) are not established. **ArcGIS, FME, QGIS, PostGIS, GeoServer and GDAL are user-confirmed never used** and are now registered `forbidden` so the scanner catches them. **Lesson: do not discount a domain bridge on an assumption about the domain - ask the discriminating question before scoring.** | `claims.json` (BS-8; 2 new skills; 6 forbidden skills) |
| 2026-09-05 | **The ten-application cohort's slot caps (7 Core / 2 Adjacent / 1 Stretch) were DROPPED by user decision.** Two reasons, both evidenced. **(a) The numbers were arbitrary and non-binding:** no derivation existed anywhere, and they were routed around whenever they bound - RUAG AI Engineer went in at Evidence Fit 74 with a hard-gate FAIL, and Citadel was recorded Adjacent when the strict reading said Stretch. **(b) The cohort was a confounded experiment:** it was built to test *fit class*, but the variable it silently held constant was *channel* - `cohort_tracker.py` reports **channel weak: 6, moderate: 0, strong: 0**. It therefore could not separate "Stretch does not convert" from "cold does not convert", and the evidence points away from fit class regardless: the highest-scoring package in the log (Snowflake, ~86) drew no reply in 80 days, while the single interview (SBB) came from a **cold Core submit whose resume was missing the three ATS literals** the session had flagged. **What was kept is the recording, not the rationing** - fit class, hard gate, channel, date, stage and outcome are still logged on every application, because that record is what makes patterns visible rather than re-derived. **Channel replaces the slot budget as the rationed variable: no application goes out cold when a named contact is published and reachable** - Marco Heinzen (RUAG), Andri Wienandts (SBB) and Per Olav Marthinsen (Aker BP) were all published, reachable and never used. **Fit class is now a preparation signal, not a spend limit:** 64/100 means know which two questions are coming, not do not apply. Hard gates and NO-GO triggers are unchanged. **Three real constraints survive independently and must not be dropped with the caps:** Google's 3-applications-per-rolling-30-days and 90-day same-role wait; not stacking a second cold application on one org while the first is pending; and the hours each package actually costs. Propagated to `application_strategy.md`, `shared_ops.md`, `session_file_template.md`, `cohort_tracker.py` (now prints counts, never counts-against-a-target) and `application_cohort.json`. | `application_strategy.md`; `shared_ops.md`; `session_file_template.md`; `cohort_tracker.py`; `application_cohort.json`; `CLAUDE.md` |
| 2026-09-05 | **`Bash` / shell scripting was missing from `claims.json` entirely - the third canonical gap of exactly this shape, after Ansible and Linux administration (both 2026-08-27).** It surfaced while building the NVIDIA Senior DevOps package: the JD names *"proficient scripting skills in Bash, Python, or Groovy"*, and ten years of Debian administration plus intensive Ansible work at Bosch plainly involve shell scripting - but the canonical file was silent, so under the evidence-first rule the skill was **unwritable** and was deliberately left off the resume. User-confirmed 2026-09-05 and added as `production-historical-and-personal-current`, `output: allowed`, with the same evidence basis as Linux administration (`BS-6` professional 2020-2022; `PP-3` personal and current). The note records two hard limits: it does **not** license **Groovy**, which stays unverified and forbidden, and it does **not** license systems-programming or kernel-level claims. **Systemic lesson, now three times over: the KB is data-engineering shaped and under-records ordinary infrastructure and operations skills. Before scoring any DevOps/platform/SRE JD, ask about ops evidence explicitly rather than trusting `claims.json` to be complete.** Edit note confirmed again: the file is compact inline JSON with CRLF - patch it as text; this change was 6 insertions with no reformatting. | `claims.json` (new skill); NVIDIA resume Languages line |
| 2026-09-04 | **This file asserted a shortlist that the JD does not support, and the 2026-08-31 scout triage had already caught it — but nothing was written here, so it survived into the next session exactly as that triage predicted.** The RUAG session block called **Senior DevOps Engineer C5I** *and* **Data Lakehouse / Senior Data Platform Engineer** "both already shortlisted and materially better fits… where his evidence is Direct rather than Adjacent." Only the first half held. The Data Lakehouse claim was a **title-match prior**: the live JD is **on-prem, MSSQL, Talend, SAP S/4HANA**, and `claims.json` has **0** for all three. RUAG then settled it itself — between the 08-31 and 09-04 scrapes the req was pulled and reposted as **"Senior Data Engineer (MSSQL) mit Data Lakehouse Perspektive"**, with the disqualifier moved into the title; its sibling *Senior Data Analyst & Data Scientist* was likewise reposted as *Senior BI Specialist (Qlik Sense)*. Required line reads *"mehrjährige Erfahrung im Aufbau und Betrieb von **on premise** Data Warehouse Lösungen"* — his stack is AWS cloud-native. Senior DevOps C5I re-verified live on the board 2026-09-04 and stays rank 1. **Systemic lesson: a triage finding that is not written into this log does not exist. Close the loop in the same session that finds it.** | `CLAUDE.md` (RUAG session block); `reports/2026-09-04.triage.md` |
| 2026-09-04 | **The scout's decision log was silently de-linking decisions on two boards, so ruled-out roles kept resurfacing as undecided — this, not forgetfulness, is why the 08-31 RUAG rule-outs all came back `dec=None`.** `_decision_key` had no pattern for either board, so it fell back to the raw path. **RUAG** regenerates the UUID in `/offene-stellen/<slug>/<uuid>` on every repost (*DevOps Engineer C5I* moved `349979ee…` → `f48073a5…`), recovering **2** orphaned decisions. Fixed in `find_decision_url` as a **two-tier match** — exact key first, slug only as a fallback and only when unambiguous in the log — **not** as a slug key: that was tried and rejected because slugs collide (two live reqs shared `flugzeugmechanikerin-technician-mechanical-f-a-18` on the board that day, so one `skip` would have decided both, the exact cross-req failure `_decision_key`'s host-scoping was designed to prevent). **BIS** migrated `/careers/vacancies/jrNNNNNN.htm` → `/vacancy/jrNNNNNN`, orphaning **5** — including the **`applied` row for jr100429**, a live application; fixed with a `jr`-id pattern. Report rows carrying a decision went **49 → 65**, and **14 verified rule-outs were backfilled** with their quoted JD reasons. **NVIDIA Senior DevOps Engineer was deliberately left undecided** — it fails the cohort test as written but the override is the user's call, and a `skip` would foreclose it. ⚠ Surfaced by the BIS fix: **jr100429 is off the BIS board** (listed through 08-27, absent from both full runs since) — the req closed, so there is no open BIS application to stack against. **Rule: when a triage rules a role out, write it to `decisions.json` in the same session — and if a role you know was decided shows as undecided, suspect the key before assuming nobody recorded it.** | `scout.py` (`_JOB_ID_PATTERNS`); `state/decisions.json` (14 backfilled) |
| 2026-09-04 | **Every Workday job URL the scout has ever emitted was a 404, across three companies and every report in the archive.** `fetch_workday` built links as `https://{host}{externalPath}`, but `externalPath` is *site*-relative (`/job/<loc>/<slug>_<req>`) and needs the locale and site segments. Verified: **6/6 short-form URLs returned HTTP 404** across NVIDIA, Novartis and Equinor — including a `-1`-suffixed row and a `Switzerland-Remote` slug, ruling out per-row drift — while **3/3 `…/en-US/{site}/job/…` returned HTTP 200**. Patched in `scout.py:fetch_workday`; 49 URLs in `reports/2026-09-04.json` and 16 in the `.md` repaired in place. Seen-state keys on the Workday req id, not the URL, so nothing was falsely re-flagged as new. **Reports before 2026-09-04 still carry the broken form — any NVIDIA, Novartis or Equinor role previously dismissed as a dead link was mis-dismissed and deserves a re-check.** Roche is unaffected (it uses the `phenom` adapter). Caught only because a JD read was attempted; a keyword-scorer triage would never have surfaced it. | `scout.py` (`fetch_workday`); `reports/2026-09-04.json` + `.md` (URLs repaired) |
| 2026-08-27 | **A German-language resume was being typeset with English hyphenation patterns, and had been for every German package built from this template.** The RUAG resume loaded `lmodern` but **never `babel`** - the cover letter did (`\usepackage[ngerman]{babel}`), the resume did not. The compiled PDF broke words as `Hal-bleiterfertigung`, `Tran-skription`, `automa-tisierte` and `Foun-dation`: all wrong in German, and exactly the kind of thing a native-German Swiss reader notices without being able to name. It survived an earlier full visual QA because nothing *looks* broken - the lines are justified and the page is clean. Adding `\usepackage[ngerman]{babel}` produced correct breaks (`Halb-leiterfertigung`, `automati-sierte`) and **also cleared an overfull box** introduced when the headline grew. ngerman still breaks `Transkription` after `Tran`, so `\hyphenation{Trans-krip-ti-on}` was added. **Rule: any German-language document must load `babel[ngerman]`, and hyphenation must be checked in the compiled PDF, not assumed from a clean box count.** `resume_template.tex` should be checked for the same omission. **Checked 2026-09-04: the template loads no `babel` at all.** It is an English template, so it rides TeX's default English patterns and renders correctly as-is — loading `ngerman` unconditionally would be wrong. Fixed instead with a loud comment block at the package list carrying the ngerman + `\hyphenation` lines ready to uncomment, so the German case cannot be missed silently. No change to English output. | RUAG resume (fixed); `resume_template.tex` (fixed 2026-09-04 — comment-guarded) |
| 2026-08-27 | **`IBM AI Engineering` was on resumes for months with no primary-source record, and `PyTorch` was under-recorded as a result.** The `/critique` flagged it as the only line a canonical preflight could not confirm: the other three certifications sit in `thiessen_certifications.md` with issuer, date and certificate number, while this one existed only in `bundle_ml_ai_engineer.md`. The user supplied the PDF (`C:\myCloud\Bewerbungsunterlagen\Zeugnisse\Zertifikate\cert_IBM_AI_Engineering.pdf`) and it was read directly: **IBM via Coursera, 4 Jun 2020**, no expiry, verify code `3ZBZFVAL6A34`, six courses, name on the certificate `Dennis Thiessen` (sz variant, as on ITIL and iSAQB). Recorded as entry **#8**. It also proves **PyTorch**, which `claims.json` had as `coursework-or-personal-unverified`; upgraded to `evidence: certification` with `output` unchanged at `certification-context-only`. The certificate is explicitly **non-credit** and confers no grade or degree - never present it as an academic qualification. **Same shape as the Ansible/Linux/Bosch-promotion gaps: the claim was true, the KB simply had no record of it.** | `thiessen_certifications.md` (entry 8); `claims.json` (PyTorch evidence) |
| 2026-08-27 | **`claims.json` had no Bosch promotion date, so a Swisscom-style title line was unwritable from the canonical file.** Asked to render Bosch like Swisscom ("Senior Data Engineer, Data Analysis (Beförderung xy)"), the canonical file offered only a combined `official_title` "Engineer / Senior Engineer, Data Analysis" with **no `title_history` and no date** - while SWISSCOM has a full `title_history`. The data existed one layer down: `experience_bosch.md` records it LinkedIn-confirmed as Data Engineer **Feb 2020 - Jan 2021** and **Senior** Data Engineer **Jan 2021 - Dez 2022**. Added to `claims.json` as `title_history`, with `display_title` set to the user's own preferred wording **"Senior Data Engineer, Data Analysis"** and `official_title` left untouched as the formal Zeugnis string. **Systemic lesson, the same shape as the Ansible/Linux gaps: `claims.json` is the declared highest authority but is not always the most complete file - when it is silent, check the `experience/` files before telling the user something is unwritable.** Edit note: the file uses compact inline JSON and CRLF; a `json.dumps(indent=2)` rewrite reformats all ~700 lines. Patch it as text. | `claims.json` (BOSCH title_history, display_title); RUAG resume |
| 2026-08-27 | **Vizrt shown as "DevOps Engineer" alone, on user instruction.** Canonical `official_title` is **"Test Automation Engineer"**; `display_title` is "Test Automation / DevOps Engineer". The user asked to drop "Test Automation" for the RUAG C5I package. Bullet content (CI/CD quality gates, Python backend for distributed transcoding) supports the DevOps framing and the user is the authority on his own role - but **this is the one title on that document that will not match a Zeugnis word-for-word**, so flag it rather than silently propagate it. Not written into `claims.json`: it is a per-package display choice, not a canonical correction. | RUAG resume (session file records the flag) |
| 2026-08-27 | **A finished package had no reviewable PDF, and the only PDF that existed was a stale pre-fix build.** The RUAG C5I resume was recorded as complete, but the previous session had compiled only into a scratch folder (`.tmp_ruag_ai_resume/`), so `output/RUAG_AI_Engineer_C5I/` held just the `.tex`. The user could not approve what he could not open. Worse, that scratch folder still contained a **pre-correction PDF that included Capgemini**, named with the deliverable's stem - one grab away from being submitted. The folder also held a stale 3-page text extraction, which is why the prior session's "both pages visually inspected" claim had been made against a different document than the final one. **Rule: compile the PDF into the application's own `output/` folder** (as the Kdo Cy package does), and never leave a superseded PDF beside a deliverable. "Output .tex only" means the .tex is the source of truth, **not** that the user should be handed nothing to look at. | RUAG output folder (PDF added, stale temp folder deleted); `config.md` (Output Rules) |
| 2026-08-27 | **Capgemini reappeared in a generated resume, breaking a standing omit preference.** The RUAG C5I draft carried `Capgemini Deutschland GmbH, Nov. 2014 - Mai 2015` as a compact chronology entry. The user does **not** want Capgemini on any document (six months only; short-stay impression in Germany). A corpus check found it was the **only** generated `.tex` under `output/` containing the name, so this was a one-off regression, not a systemic drift. **Root cause: the preference had no first-class home.** It lived in memory and in a parenthetical inside the unrelated "12+ years" entry below, so a fresh model reading `CLAUDE.md` and `config.md` alone would not see it - `config.md` does not mention Capgemini at all. Recorded here as its own rule: **Capgemini is omitted from every resume, CV and cover letter. The resulting Nov. 2014 - Mai 2015 gap is intentional and must never be "fixed".** The visible chronology starts at Generali, Mai 2015 - which is also what the "over ten years" profile wording is measured against. | RUAG resume (fixed); this log (rule recorded) |
| 2026-08-27 | **The English resume template asserts "12+ years of production software experience" and that does not hold against `claims.json`.** Canonical `employment` starts at **Capgemini 2014-11** → ~11 years 9 months as of Aug 2026; and Capgemini is omitted from documents by standing user preference, so the *visible* record on any generated resume starts **Generali 2015-05** → ~11 years 3 months. Either reading falls short of twelve. Inherited unexamined into the Kdo Cy draft's opening sentence and caught at final review; corrected there to **"über zehn Jahren"**, which is true under both readings. **`resume_builder/templates/resume_template.tex` still carries the 12+ claim and will re-infect the next package.** Possible innocent explanation: officer service after the 2013 M.Eng. (he is a Universität-der-Bundeswehr graduate) may be counted and is not in `employment` — **ask before editing the template**, and if it counts, record it in `claims.json` so the number has a source. Lesson: a number inherited from a template is still a claim and needs a canonical source like any other. | Kdo Cy resume (fixed); `resume_template.tex` (OPEN) |
| 2026-08-27 | **Linux administration was missing from `claims.json` entirely — the second infrastructure blind spot found the same day, and the more consequential one.** User-confirmed: at **Bosch (2020–2022) Linux servers carried everything** — ML platform hosts, Docker hosts, backend services, the Ansible control path — and he administered and automated them; he also **wrote Ansible extensions**, including a credential plugin pulling secrets from a password keystore with local caching to cut lookup volume (scalability/performance). Recorded as new claim **BS-6**. Separately, he has run a **self-hosted Debian server for ~10 years** — nginx, mail, Nextcloud, VPN, Docker services, Bitwarden — which he administers *and hardens*; recorded as **PP-3** with a PP-1-style forbidden list (never enterprise/production/multi-user, no uptime or scale figures, never employer work, never evidence of physical-datacenter experience). **Hardening evidence leans on the personal side — always say so.** **GitOps question resolved and the answer is NO:** playbooks were in Git but execution was **push-based from Jenkins/GitLab**, no reconciliation agent. The word stays `forbidden`; the substance is writable as *"versionskontrollierte Infrastrukturautomatisierung mit Ansible aus Git, ausgeführt über Jenkins-/GitLab-Pipelines"*. **Systemic lesson: the KB is data-engineering shaped and under-records infrastructure and operations work.** Two canonical gaps (Ansible, Linux) cost the Kdo Cy assessment ~15 points and produced an initial NO-GO that reflected the KB, not the candidate. Before scoring any DevOps/platform/SRE-flavoured JD, ask about ops evidence explicitly rather than trusting `claims.json` to be complete. | `claims.json` (skills Linux administration + GitOps note, new claims BS-6 and PP-3) |
| 2026-08-27 | **Ansible was missing from `claims.json` entirely — a real, currently-relevant skill that could not legitimately be listed.** It already appeared in `experience_bosch.md` BS-1 bullet variants ("Docker, Kubernetes, Ansible"), but the canonical file had **zero** mentions in either `skills` or any claim, so by the evidence-first rule it was unwritable. User confirmed 2026-08-27 that Ansible work at Bosch (2020–2022) was **intensive** and went beyond the BS-1 ML-inference orchestration into configuration management and infrastructure automation. Added as `production-historical`, `output: allowed`, and BS-1's scope now records it. **This is genuine IaC evidence** alongside CloudFormation and it materially improves any DevOps/platform JD — it does **not** license Terraform, which stays unverified. **`GitOps` added as a separate, explicitly `forbidden` skill pending clarification:** the user described the Ansible work as GitOps, but Ansible is configuration management while GitOps is narrower (declarative desired state in Git, reconciled by an agent such as Argo CD or Flux). Until it is established whether playbooks lived in Git and were applied from there, and whether a reconciliation agent was involved, the word must not appear in any document. The Kdo Cy JD names **"Pull-GitOps"** explicitly, so that is the one audience guaranteed to probe the distinction. | `claims.json` (skills Ansible + GitOps, BS-1 scope) |
| 2026-08-21 | **The data-engineer bundle carried the SW-1 scope violation it was supposed to prevent.** `bundle_data_engineer.md` §S5's cover-letter opening hook read "*while simultaneously leading the migration of our legacy stack to a cloud-native AWS architecture*" — a full-ownership verb on a company-scale object, directly contradicting `claims.json` SW-1 `forbidden` **and** point 2 of the narrative thread three lines below it. Live trap for every future data-eng cover letter. Rewritten to the scoped form plus an inline scope warning. **Check the other four bundles for the same pattern.** | `bundle_data_engineer.md` (§S5 hook + new warning) |
| 2026-07-27 | **SW-1 was not solo.** Swisscom AWS migration was written as "sole technical lead" / "Led migration of legacy stack." Dennis was primary engineer for **his own domains'** pipelines and a contributor to the wider programme. | `experience_swisscom.md` (role line + all 3 bullet variants + overclaiming warning), `config.md` |
| 2026-07-27 | **Security Champion is 2025/2026 only, and is a team role — not an award.** Source files claimed "3 consecutive years (2023/24–2025/26)." User has now corrected this twice. **Default is OMIT** unless the JD explicitly requires security/DevSecOps. | `experience_swisscom.md` SW-5, `achievement_reframing_guide.md`, `skills_taxonomy.md` (3 rows) |
| 2026-07-29 | **Atlassian Compass is the metadata/lineage platform for Swisscom data products** (user-supplied). Previously the KB named no catalogue/lineage product at all, which read as a hard gap against data-governance JDs. Practitioner use only — never claim admin, rollout or ownership. Does NOT license claiming Purview/Collibra/Alation. | `claims.json` (SW-7 scope + skills entry), `experience_swisscom.md` SW-7 |
| 2026-08-02 | **Master's thesis verified against the PDF.** Vibration-based condition monitoring of CNC machine tools; hybrid **rule-based reasoning + 7-10-3 ANN**; throughput/latency evaluation (~500 SPS pipeline vs 72.9 kSPS sensors). **PSO was surveyed but NOT implemented** — an earlier note in this session wrongly listed it as an applied method. No real operational data and no accuracy figures: it is a methods prototype, not a validated system. Also recorded: ECTS relative grade **B (top 35%)**, English-language transcripts exist. | `claims.json` EDU-MENG |
| 2026-08-26 | **Degree final grades were missing from the KB entirely.** A Citadel application form asked for GPA and neither degree's *Abschlussnote* was recorded anywhere in `claims.json` — only the M.Eng. **thesis** grade (1.0). The only lead was `knowledge_base/extractions/thiessen_cv_master_profile.md`, whose own provenance note says it is not authoritative and which already carries a known error (lists PSO as an applied thesis method, corrected 2026-08-02). User confirmed both grades directly: **M.Eng. 1.6, B.Eng. 2.4** (German scale, 1.0 best / 4.0 lowest pass). US 4.0 equivalents added via the modified Bavarian formula (`5.0 − G`): **3.4** and **2.6**. ECTS percentile **settled the same day**: B is formally the next 25% after the top 10%, i.e. the **10–35% band, so "top 35%" is the correct phrasing** — the record's original value was right and the briefly-considered "top 30%" was the error. **Never narrow B to a point estimate** (top 30%/25%); it is a band. New `grade_output_rule`: grades stay off the resume and cover letter by default; these fields exist for form questions and credential checks. | `claims.json` (EDU-MENG, EDU-BENG) |
| 2026-08-25 | **Trading-domain evidence was entirely missing from the KB.** `claims.json` had 0 hits for trading, finance or quant, so a genuine capability was unusable in any document. Added **PP-1** (self-built, self-hosted single-user investing/signal platform: US-equity price/fundamental/sentiment ingestion, LLM-assisted sentiment, long-only cross-sectional residual 12-1 momentum book with ATR stop/trail and max 15 names, scheduled scan/backtest pipelines, web dashboard + Telegram alerts) and **PP-2** (Udacity *AI for Trading* nanodegree), plus two `allowed-with-context` skills. Both carry hard `forbidden` lists: **no PnL/Sharpe/return/backtest figure may ever be quoted**, never call PP-1 distributed/production/multi-user, never imply professional quant or finance experience, never present the nanodegree as a quant credential. PP-1 is the one place full-ownership verbs are correct — it is genuinely solo, unlike the employer work governed by Scope Discipline. | `claims.json` (claims PP-1, PP-2; skills "quantitative/systematic trading concepts", "backtesting") |
| 2026-08-02 | **Bosch data types named.** Fab sensor/process data: defect-management records, wafer inspection images, PCM electrical parameters (user-confirmed). Previously the KB named no concrete sensor-data types for Bosch. | `claims.json` BS-2 |
| 2026-07-27 | **Bullet density.** Fixed 1L/2L/3L and character-band rules made bullets uniform and encouraged page filling. | Replaced globally with natural-length, evidence-led bullets; character counts are diagnostic only. |
| 2026-08-25 | **Cadence monoculture across every generated package.** Audit of all 18 packages in `output/` (368 bullets) found **45% used the same "X, Y and Z" triple**; the SBB package hit **85% — 11 of 13 bullets, every Swisscom and Bosch line** — plus two adjacent bullets both opening "Build and…". Not a truth defect: every bullet was accurate and the corpus is clean on AI vocabulary (0 cliché hits in 35 documents) and prose em-dashes (0.08/bullet). It is a *rhythm* tell — uniform three-beat cadence reads as machine-written. PDF metadata is clean (MiKTeX pdfTeX, empty Author/Title, no AI tokens in 69 PDFs, no generator-term leakage). | New `resume_reference.md` §7a + verification step 7; `critical_rules.md` rule 7a; `critique_framework.md` mechanics row now scores cadence (max 1 pt, style only) |

## Maintenance resume point

For the authorized project-review fixes, read [FIX_PROGRESS.md](FIX_PROGRESS.md) before continuing. Both agent skill directories route to the shared workflows in `resume_builder/reference/workflows/`.