v0.6.0 — Private resume import

Private resume import source release with shared private storage, bounded lifecycle capacity, durable write admission and 30-day recovery for revoked uploaded originals. Generated PDFs retain their existing storage configuration.

This release publishes the application and isolated extractor from the same reviewed source and lockfile. Use only the immutable pair attached by the successful release-image workflow. The pair initially records candidate-envelope-passed; production-integration-required.

Production activation is still gated on actual schema/upgrade/restore and permission review, namespace upload/cold OCR/network/resource/lifecycle qualification, and reviewed GitOps rollout. The existing production runtime is unchanged. Follow docs/resume-extractor-release.md, docs/private-resume-storage.md and the companion IaC rollout runbook before deploying.

Validation: full format/lint/TypeScript/test/build/SMRT checks; 4,617 server tests, 48 browser-component tests, 21 resume and 2 MCP tests; 100 native PostgreSQL checks; 89 browser scenarios; actual disposable Garage private storage/recovery/purge; migration idempotence and zero pending schema. Exact-commit candidate image, workspace and browser CI jobs passed for both push and PR. Opt-in skipped checks are not production proof.

Independent high-risk review plus targeted follow-up is clean. Residual dependency/image vulnerabilities are documented by feature in docs/releases/; this is not a whole-application clean vulnerability claim.

Source: 7c19047 (PR #228), with tree identity to merged main 9f4f428. The release workflow will append immutable image references and provenance.

Resume image candidates

Site: ghcr.io/willgriffin/iolaus/site@sha256:18a700f539ee2355c9b6db6a6818b592086cd497f25b622c8a5a35578aaf7b07

Extractor: ghcr.io/willgriffin/iolaus/resume-import-extraction@sha256:ad1fa6667f8fc87e109e37c92f32314882b24fe7d905c1f173d3099fd708fbcc

Source: 7c19047cf7c583c041801097812c7bf56e3d42e2;
lock SHA-256: 47fac937694f6a78a7166d8d8adcc91c92c05fec8168823c75beef2380d0eded.

Envelope tested. Production requires qualification:
docs/resume-extractor-release.md.