README and CHANGELOG for phase 10

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -6,7 +6,7 @@ This repo is the rebuild of Packet Station as a server application: Docker Compo
 
 ## Status
 
-**Rebuild in progress. Phase 9 done: the Admin page completed (departments, profiles with the CSV import, checklists, security settings and alerts, the access log, who is in, the stamp check), the nightly AD reconcile and the 15-minute role refresh, the integrity job, notifications by email with rules per event, nightly database backups with a rehearsed restore, and dependency scanning in CI. SethD's changes C1 to C11 (Gitea, 2026-10-26 and 2026-10-28) were built on 2026-10-30.**
+**Rebuild built, go-live pending. Phase 10 done (2026-10-30): the regression bench, the final CSP and dependency scan, the build-version banner, the archive copy of every filing to the QNAP share, the native VM install kit, and the go-live, paper-fallback and security docs. Phase 9: the Admin page completed (departments, profiles with the CSV import, checklists, security settings and alerts, the access log, who is in, the stamp check), the nightly AD reconcile and the 15-minute role refresh, the integrity job, notifications by email with rules per event, nightly database backups with a rehearsed restore, and dependency scanning in CI. SethD's changes C1 to C11 (Gitea, 2026-10-26 and 2026-10-28) were built on 2026-10-30.**
 
 People can sign in, set up projects and units, make hand drafts, attach a drawing, and send a packet to the warehouse, a department or Q.C. The worker reads released work orders from VISUAL on a schedule, makes and updates drafts, opens change orders on packets already in the shop, looks drawings up in M-Files and attaches them at the rev VISUAL calls. Clerical sees it all on the From VISUAL panel and in the Flagged and Changes to approve columns; Admin sets the feed up on the Feed tab. Warehouse works its task board (waiting, being pulled, on hold, pulled, released), pulls parts line by line with heat numbers, shorts, receipts and MTRs (the department supervisor then approves each received short with a signature), and releases to the supervisor once every line is pulled or short and every pulled line has a heat. A supervisor assigns the packet to a station and a welder. The welder's Stall screen lists the packets assigned to them, each at the station the supervisor picked. The welder starts the clock, marks welds on the drawing, places the heat table, finishes the checklist and submits with a PIN signature, and the supervisor sends it to Q.C. or routes it to another department with the marks carried. Department supervisors verify change orders with a signature. Q.C. inspects the packet on its own tab (the check items, a visual result per weld, NDE, hardness, notes), accepts it to the data book, to Shipping or on to another department with a PIN signature, or rejects it back to the supervisor with a reason and, when there is one, an NCR number. A packet rejected without an NCR number needs one at the accept, and a packet with a short not yet approved cannot be accepted as complete. Q.C. keeps project folders of documents per project and unit (ITP, WPS / PQR, procedures, certificates) where a new revision supersedes the old one and nothing is deleted, adds reports to a packet for the data book and takes them out with a reason, and works each unit's digital ITP from the Q.C. template through line initials, N/A, rejects with NCR numbers, section block signatures and a sign-off. Open hold and witness points show as a warning on the unit's packets. The feed marks a VISUAL packet closed in VISUAL when it sees every work order closed, and the packet moves to Clerical's "Ready for data book" column by itself; Clerical confirms a hand packet by hand. Clerical files the packet with a signature once VISUAL is closed, the unit's ITP is complete and every short is approved. Filing seals the packet with an HMAC and builds the manufacturing data book on the server, stored on the seal. The data book goes to the customer and has no history pages; the history stays in Packet Station. IT can reopen a filed packet with a reason and a signature, which keeps the broken seal and its data book. Anyone who can open a packet can view or download the data book, the job traveler with the work order QR codes, the ITP PDF and the traceability CSV, and print a stamped copy of the traveler, the drawings with the heat or weld map, the drawings without markup, the VOID sheets, the data book or any document. A print goes straight to the browser's print dialog. Every copy carries a stamp signed with the seal key, and every print and export is logged. Admin, Q.C. and Clerical check a copy's stamp on the Stamp check screen. Project Management and Admin read the PM reports. The ITP sign-off files the signed ITP PDF. Each department supervisor edits their department's checklist on the Checklists screen; a stage keeps the list it started with. An Admin manages departments and stations, welder stamps and station limits (one at a time or from a CSV), any department's checklist, the session and lockout settings, and who gets which email. The worker reconciles users with AD every night, re-reads each signed-in person's groups every 15 minutes, checks seals, files and the audit chain every night, and checks that the nightly backup ran. Problems and events reach people by email through app-03. Every packet write goes through the server policy. The old build on `M:\Production\Packet Station` stays the live system until go-live. The new system starts empty; nothing is migrated from M:.
 
@@ -24,7 +24,7 @@ People can sign in, set up projects and units, make hand drafts, attach a drawin
 | Project Management screen (six tabs, periods, health, CSV and PDF reports), the find bar completed (search, filters, quick flags, Mine, Board and List, saved per browser), presence, motion, iPad layout | Yes (phase 8, verified in the CI stack on docker-1) |
 | Admin completion (departments, profiles, checklists, Security, access log, who is in, stamp check, Notifications), AD reconcile and role refresh, integrity job, email notifications, backups and restore, CI dependency scan | Yes (phase 9) |
 | SethD's changes C1 to C11: over target on VISUAL ticket hours, the Q.C. reject reason and the NCR on the accept, the ITP complete before filing, prints to the print dialog, filing blocked until VISUAL closes, no history pages in the data book, supervisor approval of received shorts, checklists per department (`/checklists`), the stamp check for Q.C. and Clerical (`/stamp-check`), PM reports for PM and Admin only, the Stall screen by assignment | Yes (2026-10-30) |
-| Regression bench and go-live | No (phase 10) |
+| Regression bench (the old build's 38 scenarios mapped in tests/e2e/BENCH.md), final CSP, version banner, archive location (Admin, Storage, File locations; `ARCHIVE_ROOT`; the `archive-copy` job), native VM install kit (`deploy/vm/`), backups and restore without Docker, GO-LIVE.md, PAPER-FALLBACK.md | Yes (phase 10). Go-live waits for the VMs and a date |
 
 ## Phases
 
@@ -52,9 +52,9 @@ docs/                  the brief, the plan, security, deploy, feed, policy, sche
 server/packetstation/  the Python package: app, worker, CLI, migrations, policy, domain, feed, drawings, PDFs
 frontend/              Vite + React + TypeScript client
 tests/                 server tests (pytest), e2e scenarios (Playwright), synthetic fixture generator
-deploy/                compose files (base, NPM overlay, CI overlay), PostgreSQL init, Samba AD for CI
+deploy/                vm/ (native VM install), compose files (base, NPM overlay, CI overlay), PostgreSQL init, Samba AD for CI
 docker/                the image entrypoint
-scripts/               host backup and restore scripts, systemd timer
+scripts/               backup and restore scripts for the VMs, systemd timer
 .gitea/workflows/      CI
 ```