build(confidence-engine): add manual Jenkins deployment

docs/current-handoff.md

@@ -75,6 +75,18 @@ Does the complete investigation process leave real people materially clearer abo
 - The full apply-proposal owner suite remains known-red in independent pre-existing 60B.43 tests, so the changed Done-for-now boundary was verified through exact isolated owner tests. Zero live calls occurred during closeout. Next boundary: reuse the existing investigation and click Done for now once, observing cases/update and subsequent synthesis.
 - Live UI proved Done for now briefly clarified the question, then server graph replacement reopened it: the client sends `preDoneGraph`, and the server previously had no deterministic closure owner. Episode-mode update now adds the selected `targetNodeId` to `resolvedNodeIds` only after successful semantic application; semantic no-ops and meaningful mutations remain valid, while failed episodes do not resolve the target and ordinary updates are unchanged. Zero live calls occurred during implementation. Next boundary: one live Done-for-now check on the existing investigation.
 
+## Deployment automation (new)
+
+- Manual Jenkins deployment pipeline established and version-controlled.
+- `Jenkinsfile` in repository root — Declarative Pipeline, three stages: Resolve → Deploy → Verify/result.
+- `scripts/deploy-production.sh` — executes on CT 112; validates SHA, fetches Git ref, checks out exact commit, builds Docker image tagged by SHA, replaces container, polls `/api/health`, one-step rollback to prior image on failure.
+- `deploy.env.example` — example of required runtime/build environment file (NOT tracked).
+- Production env owned by `/opt/confidence-engine/deploy.env` on CT 112 (not in Git).
+- `GIT_REF` is runtime-selectable (Jenkins parameter); resolves to immutable SHA before deployment.
+- No Docker registry introduced. SHA-tagged images retained for rollback support.
+- Jenkins job remains manually triggered — no automatic webhook deployment.
+- No product behaviour changed.
+
 ## Repository checkpoint
 
 - **Branch:** `feature/product-platform-foundation-v0.62`

docs/current-project-state.md

@@ -188,6 +188,20 @@ First document to read: **`docs/current-handoff.md`** (methodology continuity +
 
 Implementation status last checked against source: Experiment 43 + v0.61 apparatus (tsx helper, reconstruction-only seam, focused-deconstruction schema fix). Multi-investigation architecture verified at v0.60g2+ and structurally complete. The current-state document was verified as accurate by focused code inspection of API routes, orchestrator imports/calls, and cross-module traces for all passive classifiers. No corrections were required.
 
+## Deployment Automation
+
+A manual Jenkins deployment pipeline has been established and is now repository-owned.
+
+- **Jenkinsfile** (root) — Declarative Pipeline with three stages: `Resolve` → `Deploy` → `Verify/result`.
+- **Parameter:** `GIT_REF` (string) — user-supplied Git ref (branch, tag, or SHA). Blank value fails clearly.
+- **Resolution:** Jenkins resolves the ref to an exact commit SHA via `git ls-remote origin` before deployment. The SHA is deployed immutably.
+- **Target host:** CT 112 (`confidence-engine`, 192.168.68.73) at `/opt/confidence-engine`.
+- **Docker image:** tagged `confidence-engine:<sha>`, built on CT 112, no registry required.
+- **Environment:** production values in `/opt/confidence-engine/deploy.env` on CT 112 (not in Git). `deploy.env.example` provided as reference.
+- **Health check:** polls `http://127.0.0.1:3000/api/health`; requires `{"healthy":true}` within 60s.
+- **Rollback:** one-step rollback to the previous container image on failure (if available).
+- **Not configured in this increment:** Jenkins job, deploy.env values, SSH credential, first deployment run.
+
 ## 10. Post-v0.8 Methodology Learning
 
 ### Durable methodology principles (2026-08-19)