docs(confidence-engine): checkpoint deployed product platform

docs/current-project-state.md

@@ -1,18 +1,34 @@
 # Current Project State — Confidence Engine
 
-## v0.62d Production Docker Packaging
+## v0.62d Production Docker Packaging — LIVE PROVEN
 
 - `Dockerfile` created: multi-stage Alpine build (Node 22), Next.js standalone output, configurable port 3000, health-check boundary via `/api/health`
 - `.dockerignore` created: excludes `node_modules`, `.next`, secrets (`env.*.local`), docs, IDE, OS artefacts
 - `next.config.mjs`: added `output: 'standalone'` for lean production container (only config change required)
 - `.env.example`: reorganized; Ollama variables now tracked as deployment-relevant env vars
 - npm production build: PASS ✓
-- Docker image build: blocked — no Docker runtime on development machine (apparatus limitation, not product defect)
-- Production container start / `/api/health` smoke test: pending Docker availability
-- No persistent application volume required
-- Supabase remains external; Ollama remains private and server-reachable
-- Public `NEXT_PUBLIC_*` variables may require build-time injection via `--build-arg` (baked into browser bundle)
-- **No deployment performed**
+- Docker image build on CT 112: **PROVEN** — builds successfully, standalone container starts successfully.
+- Production container `/api/health`: **PROVEN** — `{"healthy":true}`, no private Ollama model name / raw internal error exposed.
+- No persistent application volume required.
+- Supabase remains external; Ollama remains private and server-reachable from deployment host.
+- Public `NEXT_PUBLIC_*` variables may require build-time injection via `--build-arg` (baked into browser bundle).
+- **Deployment: LIVE PROVEN** — manual Jenkins pipeline succeeded end-to-end.
+
+### External Deployment (LIVE)
+
+Confidence Engine is externally reachable at **https://confidence.rdbcloud.co.uk**.
+
+Topology: Internet → HTTPS → Nginx Proxy Manager → CT 112 / Confidence Engine Docker container.
+
+CT 112: hostname `confidence-engine`, LAN `192.168.68.73`, repo `/opt/confidence-engine`, container `confidence-engine`, port `3000`.
+
+### External Magic-Link Login (LIVE)
+
+Magic-link authentication proven through deployed instance. Callback-origin defect corrected; login returns to external portfolio rather than `0.0.0.0:3000`. Email branding configured on external Supabase (sender name, subject, branded HTML body). SPF/DKIM/DMARC confirmed recipient-side.
+
+### Multi-user Boundary (LIVE)
+
+Application-level isolation proven on deployed instance — User A does not see User B investigations and vice versa.
 
 > Created by Experiment 27. This document is the starting point for any fresh session working on the Confidence Engine. Read this first, then follow the routing table below to task-specific references.
 
@@ -188,9 +204,9 @@ First document to read: **`docs/current-handoff.md`** (methodology continuity +
 
 Implementation status last checked against source: Experiment 43 + v0.61 apparatus (tsx helper, reconstruction-only seam, focused-deconstruction schema fix). Multi-investigation architecture verified at v0.60g2+ and structurally complete. The current-state document was verified as accurate by focused code inspection of API routes, orchestrator imports/calls, and cross-module traces for all passive classifiers. No corrections were required.
 
-## Deployment Automation
+## Deployment Automation — LIVE PROVEN
 
-A manual Jenkins deployment pipeline has been established and is now repository-owned.
+A manual Jenkins deployment pipeline has been established, version-controlled, and LIVE PROVEN end-to-end.
 
 - **Jenkinsfile** (root) — Declarative Pipeline with three stages: `Resolve` → `Deploy` → `Verify/result`.
 - **Parameter:** `GIT_REF` (string) — user-supplied Git ref (branch, tag, or SHA). Blank value fails clearly.
@@ -199,8 +215,15 @@ A manual Jenkins deployment pipeline has been established and is now repository-
 - **Docker image:** tagged `confidence-engine:<sha>`, built on CT 112, no registry required.
 - **Environment:** production values in `/opt/confidence-engine/deploy.env` on CT 112 (not in Git). `deploy.env.example` provided as reference.
 - **Health check:** polls `http://127.0.0.1:3000/api/health`; requires `{"healthy":true}` within 60s.
-- **Rollback:** one-step rollback to the previous container image on failure (if available).
-- **Not configured in this increment:** Jenkins job, deploy.env values, SSH credential, first deployment run.
+- **Rollback:** one-step rollback to the previous container image on failure (if available). **IMPLEMENTED, NOT LIVE PROVEN.**
+- **Jenkins job:** configured and operational. First successful deployment recorded with explicit "DEPLOYMENT SUCCEEDED" output.
+- **Jenkins SCM branch** used to load the Jenkinsfile is conceptually separate from the `GIT_REF` chosen for deployment.
+
+### Pipeline design notes
+
+- Manual trigger only — no automatic webhook deploy.
+- No Docker registry introduced; SHA-tagged images retained on CT 112 for rollback support.
+- No product behaviour changed by deployment automation.
 
 ## 10. Post-v0.8 Methodology Learning