docs(roadmap): track every planned workstream and gate

docs/direct-roadmap/NEXT_ACTIONS.md

@@ -8,4 +8,4 @@
 4. Continue launch audit inputs and prepare four desktop/mobile concept pairs from `98483b80`. Continue eligible offline security/recovery work on the existing branches. RR-11 is fixed and tested offline. Preserve launch design/claims decisions, integrated security scope, and approved recovery environment requirements.
 5. Keep Product Review findings provisional until Phase 10 acceptance. Reuse the published GJ-00 pack. GJ-01 awaits the accepted predecessors, implementation scope and provider rights.
 
-Use [the latest checkpoint](LATEST_CHECKPOINT.md) and branch-specific handoffs to resume. The orchestrator remains paused. Keep pre-p10-ux and unrelated work intact. Publication belongs on the relevant development branch.
+Use [the complete roadmap TODO](ROADMAP_TODO.md), [the latest checkpoint](LATEST_CHECKPOINT.md) and branch-specific handoffs to resume. The orchestrator remains paused. Keep pre-p10-ux and unrelated work intact. Publication belongs on the relevant development branch.

docs/direct-roadmap/ROADMAP_TODO.md

@@ -0,0 +1,129 @@
+# Jobjakt roadmap TODO
+
+Updated 10 November 2026. This is the cross-phase work list. The source prompts, linked registers and acceptance criteria remain authoritative. Update the relevant row and [latest checkpoint](LATEST_CHECKPOINT.md) after each verified increment. A checked item means its stated scope is complete. **Partial** means evidence or implementation exists. **Gated** means the named predecessor, permission or environment is required. Earlier test evidence is source-bound.
+
+## Phase 10 · Cleanup and acceptance
+
+- [x] **P10-00** Audit legacy UI, routes, CV/document paths, services, configuration and dependencies. Nominate only proven obsolete code.
+- [x] **P10-01** Remove the approved unimported `App.css` under CLEAN-20 and publish its targeted verification. Any additional removal needs its own evidence and approval.
+- [x] **P10-02/03** Review compatibility and backend/configuration retention. Keep legacy/frozen documents, import/export, renderers, old links, migrations and SQLite where still required.
+- [ ] **P10-04** Finish applicable data and document integrity, historical CV/letter revision compatibility, MariaDB and migration/recovery evidence. **Partial**. Keep SQLite retirement separate.
+- [ ] **P10-05** Independently reconcile 34 routes and 57 preservation groups, browser and browser contracts, EN/NB, accessibility, sidecar, security, accepted PDF evidence and applicable environments. Local full regression passed 1,448 backend and 1,031 frontend cases. Reuse valid evidence from unchanged sources.
+- [ ] Record Phase 10, redesign development and Product Review readiness decisions with the post-redesign handoff. Track production separately. See [P10-05](../redesign/phase-10/P10-05.md).
+
+## PRODUCT-REVIEW-01 · Independent product review
+
+- [ ] **Gated by accepted Phase 10**. Review real end-to-end use across jobseekers, occupations, desktop and mobile. Audit onboarding, discoverability, friction, accessibility, account/trust, workflow gaps, reliability and release blockers before assessing planned features.
+- [ ] Evaluate LinkedIn permission, career-history/application import and user-export fallback. Keep Career Profile canonical and require review before applying imports.
+- [ ] Evaluate FINN URL import and official API rights, NAV feed, saved search, alerts and tracker integration. Coordinate with Global Jobs.
+- [ ] Evaluate AI-P5-13 grounded CV rewriting and user accept/reject controls. Compare local model/engine and specialised pipeline feasibility for EN/NB, accuracy, latency, cost/licence and existing hardware. Live inference and production cutover stay gated.
+- [ ] Rank Android options for login, dashboard, applications, Kanban/timeline, CV/PDF, EN/NB and themes against web/mobile benefit and cost.
+- [ ] Rank Prometheus/Grafana and host/container, disk, DB, API, AI/GPU, availability and backup monitoring separately from product analytics.
+- [ ] Rank onboarding, trial, pricing, subscriptions, retention, education, feedback, privacy, export and deletion. Determine what belongs in each release.
+- [ ] Deliver independent findings, evidence and ranked TODO with effort, impact, risk, dependencies, phased delivery, production gaps and machine-readable backlog. Record executive recommendations and owner decisions before implementing protected product scope.
+
+## A3 · Application modernisation and addendum
+
+- [x] Complete five application concepts, A3 selection and design handoff. A1 dashboard, B1 tracking, D1 styling, hybrid mobile navigation, editor-left/preview-right and application context right.
+- [x] **IM01–09 milestone gates**. Foundation/navigation, dashboard/onboarding, applications, discovery presentation, Career Profile/CV/letter, calendar/mail/documents, AI/settings and account/admin have scoped checkpoint evidence and progression approvals.
+- [ ] **IM10**. Review all 34 routes and 57 preservation groups, secondary routes and connected workflows against A3. Finish open discrepancies, flatter visual hierarchy, density, reusable interactions and loading/empty/error/success states on desktop/tablet/phone, EN/NB and light/dark. Run affected regression and collect real screenshots, keyboard, device, assistive technology and native language review. Obtain final owner visual acceptance.
+- [ ] **Discover**. Search-first layout shipped for existing NAV. Continue mobile filter drawer, results/detail usability, attribution and accessible disclosure. New search skills, radius, tree/map and provider capabilities belong to GJ/EUROPE with qualified data and rights.
+- [ ] **Applications**. Title-first rows, explicit selection and preparation wording shipped. Consolidate secondary actions without removing functions, finish table/board/detail states and check status, selection and follow-up.
+- [ ] **Calendar**. Recorded closing dates and follow-ups are covered. Resolve genuine interview scheduling, original precision/timezone and provider/ICS qualification as applicable. Preserve agenda/month toggle and preference.
+- [ ] **Career, CV, letter and documents**. Finish connected overview-to-document reuse and create/import-to-edit/preview/export evidence. Preserve revisions, null-as-inherit, canonical profile ownership, frozen packages, import review and RD21.
+- [ ] **Correspondence**. Improve inbox, mailbox state, relevant job context and review. Scope explicit consent, provider permissions, multi-mailbox storage and retention separately. Preserve conflict, attachment and confirmed-send flows.
+- [ ] **Admin Users**. Alignment and read-only 2FA shipped. Compact actions and creation/role/reset/deletion dialogue, error and keyboard coverage remain. **Gated** MFA recovery design approval and authorisation for factor changes.
+- [ ] **Audit and privacy**. Mail-subject redaction shipped. Add approved filters and safe record expansion, minimise exposed fields and verify isolation across remaining delivery paths. **Gated** private support access proposal, consent, expiry and revocation.
+- [ ] **System Status**. Last successful browser refresh shipped. Qualify actual worker/queue/task/provider/mail/enrichment/error/timing signals with honest stale/unavailable states. Design exists for isolated allowlisted diagnostics. **Gated** execution, audit and isolation approval. Retain CV benchmark evidence.
+- [ ] **Settings and automation**. Qualify individual rules and explanatory states, remaining recovery cases and per-user Ghosted pause contract. Keep model/provider execution and real mutations separately authorised.
+- [ ] **Bookmarklet and terminology**. Finish EN/NB terminology and display review. Retain bookmarklet until device parity for URL paste, extension and PWA sharing, then seek retirement approval.
+- [ ] Test full journeys: discovery→detail→save/track, CV create/import→edit→preview→export, application→status→follow-up, Career Profile→document reuse. Use [route evidence and discrepancies on the A3 branch](LATEST_CHECKPOINT.md).
+
+## INT-GLOBAL-JOBS-01 · International discovery
+
+- [x] **GJ-00** Publish feasibility, rights, architecture, taxonomy, geography and acceptance plan at `0ec9f98e`. Reconfirm provider/legal evidence when entering implementation.
+- [ ] **GJ-01** Country and independent language preferences, locale prominence, defaults, persistence and migration. **Gated by Phase 10, Product Review and initiative approval**.
+- [ ] **GJ-02** Canonical location IDs, hierarchy, exact parent/child selection semantics, country switching, radius where supported and consistent map/tree state.
+- [ ] **GJ-03** Universal occupations and skills, multilingual suggestions, aliases, mapping/ranking and cross-industry fixtures.
+- [ ] **GJ-04** Authorised Norway, Sweden and UK providers, rights before fetch/display, attribution, source redirects, expiry/deletion, rate limits and provider reliability. Licence and permissions gate each capability.
+- [ ] **GJ-05** Responsive search/filter/detail, truthful geographic and source coverage, deduplication, permitted descriptions and tracker integration.
+- [ ] **GJ-06** Saved searches, matching, alerts, preferences and owner isolation. Qualify lifecycle and delivery.
+- [ ] **GJ-07** Provider monitoring, admin operations, reliability, limits, security, privacy and operational playbooks.
+- [ ] **GJ-08** Cross-provider integration, realistic EN/local-language and occupation journeys, accessibility, rollback, and final acceptance. No restricted scraping or invented results.
+
+## I18N-01 · European localisation
+
+- [ ] **I18N-00** Close full surface and catalogue inventory and locale priorities. All 188 historical dynamic call reviews are accounted for. Full visible text and locale acceptance remain open.
+- [ ] **I18N-01** Locale registry, locale aliases/legacy NB, persisted user choice, fallback/negotiation, formatting and migration. Keep UI, job and document languages independent.
+- [ ] **I18N-02** All React copy, navigation, form/dialog/error/loading states, accessibility, responsive text expansion and language switch continuity.
+- [ ] **I18N-03** API error codes, validation, mail, notifications, background/operational messages, locale persistence and fallbacks.
+- [ ] **I18N-04** Career Profile, Docling/import review, CV and letter editors, generated content, templates and PDF. Preserve document language and revision fidelity.
+- [ ] **I18N-05** Multilingual discovery, occupation names, aliases, matching, provider languages and regional formatting. Coordinate with GJ.
+- [ ] **I18N-06** Locale catalogues, glossary, extraction/CI, missing/plural/placeholder validation, native reviews and per-locale release gate. Preserve established terminology.
+- [ ] **I18N-07** Locale-aware public homepage, content and metadata, market/language URLs, canonical/hreflang and SEO with LAUNCH-SITE.
+- [ ] **I18N-08** European QA, linguistic/native review, fallback, accessibility and document/export regressions. Publish locale-by-locale acceptance.
+
+## EUROPE-READY-01 · Mandatory market coverage
+
+- [ ] Define final geographic scope and qualify each of the 59 candidate codes in the existing coverage matrix. Track provider/data rights, catalogue, geography/map, native/device and release statuses separately.
+- [ ] Persist residence, search countries/regions, UI locale, job-ad languages and per-document languages independently. Preserve compatible saved searches and filters when switching countries.
+- [ ] Qualify licensed geographic data, canonical IDs/hierarchies, aliases, boundaries and attribution. Provide country-aware map and accessible tree with equivalent selection behaviour and keyboard alternatives. Parent covers area, descendants refine the branch, independent branches combine.
+- [ ] Qualify cross-country providers and occupations, supported radius, location coverage, multilingual search, regional copy, date/time/number/currency/address formats and Unicode/PDF output.
+- [ ] Translate the whole product and public experience. Validate layouts, selection, error/fallback behaviour and source availability across countries and languages. Publish country and cross-country test matrices and release decisions. Reuse GJ/I18N/A3/Launch owners.
+
+## LAUNCH-SITE-01 · Public launch site
+
+- [ ] **LAUNCH-00** Close research, registration/degraded-auth, performance and asset-rights audit inputs. Existing 12 rendered states and raw SEO findings published at `98483b80`.
+- [ ] **LAUNCH-01** Produce four high-fidelity desktop/mobile concept pairs using genuine synthetic product captures and appropriate cleared imagery. Present minimalist, premium SaaS, friendly/human and editorial choices for owner selection.
+- [ ] **LAUNCH-02** Refine selected elements and obtain explicit final design approval. **Gated**.
+- [ ] **LAUNCH-03** Build public foundation and responsive accessible hero/navigation without disturbing auth/signup or protected return routes.
+- [ ] **LAUNCH-04** Validate product screenshots, photography rights and optimisation. Use synthetic data, truthful captions, responsive assets and alternatives.
+- [ ] **LAUNCH-05** Implement reviewed hero, workflow, feature, trust, plans, FAQ and conversion content. Confirm legal/privacy links, signup and honest feature/price claims.
+- [ ] **LAUNCH-06** Localised copy, language selection, persistence and fallback, independent from in-app job and document language.
+- [ ] **LAUNCH-07** Locale/market routing, country page readiness, modular content and market-specific provider claims.
+- [ ] **LAUNCH-08** Crawlable HTML, metadata, canonical/alternates, sitemap and index rules, performance, device/accessibility, conversion and privacy checks.
+- [ ] **LAUNCH-09** Integration, native-language, marketing claim, signup and release acceptance. Publish evidence, assets, SEO and handoff docs. Separate launch approval.
+
+## SECURITY-AUDIT-01 · Offline work and formal security phases
+
+Bounded offline fixes and root security policy exist. Formal integrated scope, target, costs and staging activity remain gated.
+
+- [ ] **00** Authorisation, isolation, rules of engagement, baseline and evidence register.
+- [ ] **01** Asset inventory, threat model, trust boundaries and attack surface.
+- [ ] **02** Secret/credential, crypto and history review.
+- [ ] **03** Static code, dependency, framework, advisory and supply-chain baseline scans.
+- [ ] **04** Auth, session, MFA/recovery and OAuth. Review and approve protected recovery design separately.
+- [ ] **05** Authorisation, tenant and object-level isolation. Reuse bounded audit/notification/processing evidence where applicable.
+- [ ] **06** API abuse, business logic, rates, integrations and rights.
+- [ ] **07** CV upload, parsing, export and malicious document boundaries.
+- [ ] **08** Python/AI/Docling/Ollama, prompt injection, egress and sensitive content.
+- [ ] **09** Browser isolation, frontend XSS, CSP and CSRF.
+- [ ] **10** Database security, privacy, retention, integrity and backups.
+- [ ] **11** Nginx, Docker, Ubuntu, host and network configuration.
+- [ ] **12** CI/CD, Git, build provenance, credentials and supply chain.
+- [ ] **13** Controlled adversarial staging testing after explicit scope and isolation approval.
+- [ ] **14** Remediate verified findings with permanent regression tests. Record risk decisions and verify on the final affected baseline.
+- [ ] **15** Independent retest, release security gate and final report. No formal integrated scan credit for offline tests.
+- [ ] **16** Detection, incident response, owners, alert/runbook exercises and continuous security handoff.
+
+## RELEASE-READINESS-01 · Qualification and production decision
+
+- [ ] **Stage 1** Close discovery, inventory, prior blockers and baseline scope. Backup parser RR-11 published with 31 offline tests. RR-12 rollback and RR-13 recovery remain open.
+- [ ] **Stage 2** Freeze exact candidate, environment, image/digest, migration/config/dependency identities, CI and evidence provenance.
+- [ ] **Stage 3 · Functional** Accounts/auth, jobs/tracking, dashboard, career/CV/documents, AI, correspondence, integrations, notifications, admin, billing and exports. Qualify real browser, sidecar and MariaDB lanes separately.
+- [ ] **Stage 3 · UX** Responsive/visual and keyboard/AT/accessibility, EN/NB and launched locales, reflow/contrast, physical devices and representative workflows.
+- [ ] **Stage 3 · Data/PDF** Tenant and revision integrity, historical compatibility, migrations and data protection, source-bound PDF fidelity, physical print where required.
+- [ ] **Stage 3 · Security and infrastructure** Complete security gate, verify proxy/TLS, hosts, containers, networking, secrets, permissions, pinned reproducible builds and hosted CI.
+- [ ] **Stage 3 · Operations** Performance, load/failure recovery, health and metrics, alerts/runbooks, logging privacy, docs/compliance and support.
+- [ ] **Stage 4** Fix verified blockers, record impact and risk, add regressions and update the release acceptance matrix.
+- [ ] **Stage 5** Requalify the final candidate and affected suites, record actual results and unresolved risks.
+- [ ] **Stage 6** Rehearse isolated upgrade, image rollback and data rollback, database/files/keys/tombstones restore, encrypted off-host retrieval, validation, RPO/RTO and operational recovery.
+- [ ] **Stage 7** Publish final matrix, evidence, risk/owner decisions and GO/NO-GO. Production deployment requires a separate explicit decision.
+
+## Separately gated or excluded
+
+- [ ] SQLite retirement: qualified MariaDB parity, migration, rollback, restore and retention before any removal.
+- [ ] Live model, provider, mail, market claims, native/device, hosted CI, staging and production decisions stay separate.
+- [ ] Deferred CV-import engine overhaul and personal portfolio are outside this execution.
+
+Source index: Phase 10 and Product Review prompts 5–6, Global Jobs prompt 7 and `docs/planning/global-jobs-prompts/`, complete `I18N/` and `jobjakt-security/` packs, homepage prompt 10, release readiness prompt 11, the approved A3 implementation/visual requirements and `additional/# Jobjakt — A3 refinement+EUJOBS.txt`. The [status register](ROADMAP_STATUS.md) and [latest checkpoint](LATEST_CHECKPOINT.md) identify current evidence and branches.