You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is a small, review-only emergency hotfix branched from public main (689354e), independently of pending security draft #33 and broader portfolio draft #34.
The current public origin returns HTTP 404 for all three expected résumé paths. The main branch had neither those files nor visible résumé download controls.
Add three byte-identical, previously reviewed Sept 22 PDF candidates under public/resume/: general AI/full-stack, developer experience, and forward-deployed roles.
Put three labeled, keyboard-accessible, bilingual résumé download links in the top of Hire (EN/KO).
Add scripts/check-resume-assets.mjs to the existing mandatory GitHub CI, checking existence, magic header, nontrivial length, SHA-256, and each filename's Hire-page source reference. No dependency changes, audit suppression, or configuration changes.
Two pages per PDF, unencrypted, rendered/visually checked. See docs/reviews/2026-10-13-resume-hotfix-editorial-gate.md for exact SHA-256 and claims awaiting confirmation.
Locally verified (Oct 13 PT)
Clean npm ci in isolated MAIN worktree, 197 unit tests / 21 files, TypeScript, ESLint, Prettier, EN/KO translation parity, optimized Next build passed.
Browser preview (both locales × desktop/mobile): 3 visible/downloadable résumé links, no JS errors. Static preview: all 3 PDFs returned HTTP 200, application/pdf, exactly matching SHA-256.
Public https://writingdeveloper.blog/resume/Sihyeong-Lee-Resume.pdf remained HTTP 404. This PR is not deployed.
BLOCKING REVIEW: do not auto-merge
Explicit editorial acceptance of the three exact public PDF contents is still needed. They include job history, claimed nine-person engineering team and endpoints, founder dates and historical DevDeck test counts; npm test cannot certify those claims. The files have a public contact email, but no residential address, SSN, date of birth, EIN or unrelated financial identifiers.
Additionally, public main still carries Next.js 16.3.3 with a Critical next/og advisory, along with other dependency findings. This hotfix does not fix those vulnerabilities and is not authorization to deploy the vulnerable baseline. Security draft #33 and FOLIO-45 remain active.
The release should use a reviewed security-patched base, confirm the exact documents, then verify public PDF MIME/SHA, Hire CTAs, locale/mobile behavior, CI and rollback. FOLIO-51 (link health) and FOLIO-36 (actual Vercel production) remain open.
No production change or risk exception has been made.
CI/editorial gate update (2026-10-13 PT): Linux CI run 38499957677 passed clean npm ci, TS/ESLint/Prettier, 197 Vitest tests, the new mandatory 3-PDF SHA/magic/size/Hire filename check, EN/KO parity and Next production build; only old-main npm audit FAILED. Windows production-mode localhost preview successfully served all 3 PDF files with correct application/pdf and identical SHA, and EN/KO desktop/mobile displayed all 3 Hire download links. Vercel draft PR preview succeeded, but all public production résumé paths still HTTP 404. DO NOT merge/deploy standalone: based on old public Next16.3.3 with GitHub Critical next/og advisory. Coordinate with more comprehensive stacked draft #34 and security #33. Exact résumé factual/editorial approval is still pending; two-page PDFs include work claims and contact details. FOLIO-36/51.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope — isolated résumé 404 repair
This is a small, review-only emergency hotfix branched from public
main(689354e), independently of pending security draft #33 and broader portfolio draft #34.The current public origin returns HTTP 404 for all three expected résumé paths. The main branch had neither those files nor visible résumé download controls.
public/resume/: general AI/full-stack, developer experience, and forward-deployed roles.scripts/check-resume-assets.mjsto the existing mandatory GitHub CI, checking existence, magic header, nontrivial length, SHA-256, and each filename's Hire-page source reference. No dependency changes, audit suppression, or configuration changes.docs/reviews/2026-10-13-resume-hotfix-editorial-gate.mdfor exact SHA-256 and claims awaiting confirmation.Locally verified (Oct 13 PT)
npm ciin isolated MAIN worktree, 197 unit tests / 21 files, TypeScript, ESLint, Prettier, EN/KO translation parity, optimized Next build passed.application/pdf, exactly matching SHA-256.https://writingdeveloper.blog/resume/Sihyeong-Lee-Resume.pdfremained HTTP 404. This PR is not deployed.BLOCKING REVIEW: do not auto-merge
Explicit editorial acceptance of the three exact public PDF contents is still needed. They include job history, claimed nine-person engineering team and endpoints, founder dates and historical DevDeck test counts;
npm testcannot certify those claims. The files have a public contact email, but no residential address, SSN, date of birth, EIN or unrelated financial identifiers.Additionally, public main still carries Next.js 16.3.3 with a Critical
next/ogadvisory, along with other dependency findings. This hotfix does not fix those vulnerabilities and is not authorization to deploy the vulnerable baseline. Security draft #33 and FOLIO-45 remain active.The release should use a reviewed security-patched base, confirm the exact documents, then verify public PDF MIME/SHA, Hire CTAs, locale/mobile behavior, CI and rollback. FOLIO-51 (link health) and FOLIO-36 (actual Vercel production) remain open.
No production change or risk exception has been made.