docs(global-jobs): complete GJ-00 research and architecture plan
This commit is contained in:
cesnimda
@@ -0,0 +1,61 @@
|
||||
# Jobjakt — INT-GLOBAL-JOBS-01 — MASTER CODEX / ASTRA PROMPT
|
||||
## International, multilingual, cross-industry job discovery
|
||||
|
||||
### Mission
|
||||
Build Jobjakt into a trustworthy, professional job-discovery and application-tracking experience for **everyone**: educators, chefs, cleaners, nurses, drivers, retail workers, construction trades, engineers, office staff, IT professionals and every other occupation. Start with Norway, Sweden and the United Kingdom, using an extensible, provider-aware foundation that can add countries without rebuilding search. Make users' preferred countries and languages persistent rather than requiring repeated filtering.
|
||||
|
||||
**All agreed product requirements are in scope:**
|
||||
1. During onboarding/Settings ask country of residence and separately one or more countries to search; never equate nationality, home country, residence and desired work countries. Save preferred regions/cities, occupation interests, skills, work arrangement and ad languages; apply defaults automatically at discovery; allow temporary overrides without modifying the user's profile. Support multiple named saved search profiles.
|
||||
2. Provide country-aware interface language choices: **English plus the selected country's local official language(s)** prominently, with all other actually-supported UI languages under More Languages. Countries with several official languages and region-specific languages must be handled properly. Store interface locale, ad language filters and each CV/cover-letter language separately; never imply all translations already exist.
|
||||
3. Universal occupational title autocomplete: multilingual title aliases and related occupations across **all sectors**, not developer-centric heuristics; optional skills-based suggestions; exact-title vs related roles vs open keyword; preserve local terms and original advert text. Use qualified ESCO and appropriate national classifications with explicit versioning and licences; support unknown/free-text occupations.
|
||||
4. Accurate hierarchical locations: country → appropriate region/county → municipality/district → town/locality. Use provider-specific geographical adapters and authoritative canonical IDs/geometries, not substring matching. For example Warwickshire selected searches whole county; then selecting Warwick refines **that branch** to Warwick only while parent remains visibly selected; selecting Leamington Spa too searches both towns, not the rest of county. Other selected branches combine as OR. No automatic child-checkbox selection. Add optional radius/commute filtering around a location with explicit semantics for multiple selections, remote roles and missing coordinates.
|
||||
5. Responsive results with persistent filters and three-column desktop design (filter rail, job list, in-app detail panel), and mobile full-screen detail; optionally expand panel to full Job Details page. Show as much **authorised** source information as available: full or truncated original description, employer, location, requirements, responsibilities, qualifications, salary with period/currency and predicted/estimated distinction, shift/hour schedule, working arrangements, contract, deadlines, original source, posted/updated time, and apply link. Sanitise content; show source completeness and provenance. Link original application method directly; do not fabricate anything.
|
||||
6. Source adapters with capability flags: direct search, event feed + compliant local indexing, authorised details, URL bookmark/manual import, external search link; provider rules for licensing, caching, update, removal, attribution and click-through. Norway: NAV feed and manual FINN URL workflows; Sweden: JobTech sources; UK: investigate official and licensed aggregators such as Adzuna, job boards, public sector sources. No forbidden scraping. Providers may be disabled independently without preventing other countries from working.
|
||||
7. Cross-provider deduplication (conservative confidence, separate source records, source labels), saved vacancies, application-tracker integration, job-specific CV and cover letter links, job expiry handling, saved searches, new-job alerts, optional commute radius, occupation/skills/qualification matching with reasoned evidence and no invented claims.
|
||||
8. Admin source health, sync/index queues, API quotas, failures and job import events integrated where practical with Jobjakt's processing monitor; admin-only redacted diagnostics. Keep external advertisements separate from user applications.
|
||||
9. Commercial product standards: scalable feed processing, accessible design, English and local languages, localisation coverage, strict multi-tenant security, privacy, GDPR-conscious data handling, good empty/disabled/failure UX, comprehensive cross-sector and cross-country test suites, metrics, rollback strategy.
|
||||
|
||||
### Architecture and boundaries
|
||||
Inspect the actual React, .NET, MariaDB and sidecar code and reuse existing auth, settings, dashboard, application tracker, Career Profile, CV Builder, documents, alerts, admin processing, multilingual framework, concurrency and migration patterns. Do not create a second job tracker or duplicate profile master. Build an explicit provider capability/rights manifest and canonical data contracts; separate job-ad inventory from user-owned saved/job-application records. Do not invent an unlimited global index or require AI for basic features.
|
||||
|
||||
### Sequence (run one stage at a time)
|
||||
- **GJ-00 Discovery, access and architecture** → `01_GJ_00_DISCOVERY.md` (planning only)
|
||||
- **GJ-01 Country, language and search preferences** → `02_GJ_01_PREFERENCES_I18N.md`
|
||||
- **GJ-02 Geographic hierarchy, selection semantics and radius** → `03_GJ_02_GEOGRAPHY.md`
|
||||
- **GJ-03 Cross-sector occupation suggestions and queries** → `04_GJ_03_OCCUPATIONS.md`
|
||||
- **GJ-04 Provider adapters, rights and ingestion** → `05_GJ_04_PROVIDERS.md`
|
||||
- **GJ-05 Unified search UI and in-app listing details** → `06_GJ_05_SEARCH_UI.md`
|
||||
- **GJ-06 Saved searches, alerts, matches and tracking** → `07_GJ_06_ALERTS_MATCHING.md`
|
||||
- **GJ-07 Admin operations, hardening and resilience** → `08_GJ_07_ADMIN_SECURITY.md`
|
||||
- **GJ-08 Full QA and release qualification** → `09_GJ_08_ACCEPTANCE.md`
|
||||
|
||||
For each stage, read its full prompt, respect the shared rules, begin from the accepted predecessor baseline, implement safe checkpoints, commit/push each, provide actual acceptance verdict and **stop without starting the next stage automatically**. Stage 00 may run before Phase 10 only as non-mutating research. Later stages require the documented Phase 10 and product-review handoff and owner-approved scope. If an API requires commercial permission, generate exact operator steps and leave its connector blocked; do not misrepresent external links or sample data as full integration.
|
||||
|
||||
### Provider research to verify anew at execution
|
||||
- NAV feed and terms: https://navikt.github.io/pam-stilling-feed/ and https://arbeidsplassen.nav.no/vilkar-api
|
||||
- FINN API eligibility: https://www.finn.no/api/
|
||||
- Sweden JobAd Links: https://links.api.jobtechdev.se/ and JobTech official APIs (verify current names/availability)
|
||||
- Adzuna search/terms: https://developer.adzuna.com/docs/search and https://developer.adzuna.com/docs/terms_of_service
|
||||
- ESCO multilingual occupations: https://esco.ec.europa.eu/en/use-esco/use-esco-services-api
|
||||
- UK geographic datasets: https://geoportal.statistics.gov.uk/
|
||||
|
||||
### Cross-industry benchmark
|
||||
Every major behaviour must be tested with examples spanning teacher/teaching assistant, chef/kitchen assistant, nurse/care worker, electrician/plumber/carpenter, driver/warehouse operator, shop assistant, cleaner, accountant/administrator, farm worker, and software developer. Include English, Bokmål, Swedish and other supported source terms; qualifications, shifts and multiple employment modes; do not optimise relevance exclusively for tech roles.
|
||||
|
||||
### Final output
|
||||
Report completed stage list, exact Git ancestry/commits, live-vs-fixture provider coverage by country, current user-facing capabilities, translation completeness, geography correctness, occupation coverage, data provenance/expiry, alerts and dedupe, performance, security and accessibility, all remaining external approvals/human tests, independent GO decisions and **production withholding status**. Never merge main or deploy. Stop after the approved stage.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,38 @@
|
||||
# GJ-00 — Product and Provider Discovery / Architecture Sign-off
|
||||
**Suggested branch:** `planning/int-global-jobs-00` | **Mode: planning/research ONLY**
|
||||
|
||||
## Objective
|
||||
Establish an evidence-backed implementation plan for international, multilingual, cross-industry job discovery, integrating with the real Jobjakt code and accepted roadmap, without changing application behaviour. You may perform this planning stage before Phase 10 completion, but code implementation requires later confirmed development entry.
|
||||
|
||||
## Mandatory investigations
|
||||
1. Verify current Git baseline and latest Phase 10 / PRODUCT-REVIEW-01 handoff. Inspect code for existing job imports, Kanban, Career Profile, search, preferences, geolocation, translations, notifications, dashboard, admin monitor, user/tenant authorization and MariaDB entities.
|
||||
2. Map user journeys for new resident, multi-country mover, returning jobseeker, jobseeker with no formal occupation, and mixed jobs/shift work. Distinguish country of residence, nationality, desired search countries, ad language(s), UI language and document language.
|
||||
3. Review current official API terms and capabilities for Norway (NAV feed including tombstones and consumer token; FINN partner-restricted), Sweden (JobTech JobSearch and JobAd Links, including truncation/attribution and classification), UK (Adzuna commercial agreement and description snippets; government/public-sector APIs where legitimately available); optionally Denmark/Germany/France/Netherlands as future prospects. Cite URL/access date. No claiming API access without proof.
|
||||
4. Review authoritative geography: Norway county/municipality and locality; UK country/county/unitary authority/district/built-up area/town and overlap issues; Swedish län/kommun/tätort. Include immutable IDs, dataset version, ancestry, geometry/licence, alias/local names, postal code mapping where licensed, and provider data quality. Explicitly verify Warwickshire/Warwick/Leamington Spa, Vestfold/Tønsberg, Vestland/Bergen and Oslo edge cases.
|
||||
5. Research ESCO multilingual occupation taxonomy, mappings to Swedish SSYK and UK SOC where viable; distinction among occupation, keyword, industry, required credential, skill, employer title and free text. Do not limit taxonomy to IT.
|
||||
6. Determine options and costs for local index vs live provider queries, data updates/deletes and cache limits, rate limiting and search technology compatible with actual stack. Avoid adding Elasticsearch/third-party SaaS automatically.
|
||||
7. Model source-rights metadata and per-provider capability gating. Document what can be fully displayed in-app vs preview-only vs external-link-only. Detail redirects/apply links, licences, price, approval needs.
|
||||
8. Define privacy, PII retention, alert frequency and anti-spam, admin diagnostics, multi-tenant threats, disabled-source fallback and data lineage.
|
||||
|
||||
## Produce
|
||||
`docs/global-jobs/00/PRODUCT_REQUIREMENTS.md`, `PROVIDER_RIGHTS_MATRIX.md`, `CROSS_INDUSTRY_TAXONOMY.md`, `GEOGRAPHY_DECISIONS.md`, `ARCHITECTURE_ADRS.md`, `DEPENDENCIES_AND_GATES.md`, `IMPLEMENTATION_CHECKPOINTS.md`, `ACCEPTANCE_MATRIX.md`, `OWNER_ACTIONS.md`.
|
||||
|
||||
Architecture must include canonical `SearchPreference`, `LocationNode`, `LocationScope`, `OccupationConcept`, `ProviderCapability`, `SourceAdvertisement`, `SourceLifecycleEvent`, `SavedJob`, `SavedSearch`, and `SearchAlert` concepts, reconciled against existing names—not a mandate to create all those tables. Define data contracts and safe migration strategy, not code changes.
|
||||
|
||||
## Sign-off
|
||||
Identify GO / CONDITIONAL GO / NO-GO for design completeness and each proposed provider. Separate paid/approval/deployment gates. Commit and push planning docs. Do not implement features, register consumers on behalf of the user, or start GJ-01.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,43 @@
|
||||
# GJ-01 — Country Preferences, Multilingual UI and Search Defaults
|
||||
**Suggested branch:** `feature/gj01-country-language-preferences`
|
||||
|
||||
## Objective
|
||||
Give every user an easy first-run and Settings experience that saves where they live, where they want to work, what roles they seek and in which languages. Automatically prefill job discovery from persisted preferences without locking the search page to a single country.
|
||||
|
||||
## Implement
|
||||
1. Audit auth/onboarding/Settings, localization and existing preference persistence. Add migration-safe per-user search preferences using established MariaDB and revision semantics; retain backwards compatibility.
|
||||
2. Model **country of residence** separately from nationality/home country, **desired work countries** (0..N), preferred regions/places (0..N), advertised-job languages (0..N), interface locale (single), each CV/cover letter's language (document-specific), occupations/skills, work arrangements and saved profiles. Defaults should be understandable and editable; no forced demographic collection.
|
||||
3. Provide country selector with ISO country identifiers, display names localized where supported, searchable options, multi-select for job-search countries, optional city/region suggestions and clear default/override semantics. A user can live in Norway and search Sweden + UK.
|
||||
4. **Language menu:** show `English` and official/local language(s) relevant to residence/selected region at the top, rendered as native label + English label (e.g. `Norsk bokmål — Norwegian Bokmål`, `Svenska — Swedish`, `Deutsch — German`). Account for multilingual countries, region-specific Welsh in Wales, Bokmål vs Nynorsk in Norway, and user-chosen overrides. Do NOT equate ESCO translations with complete Jobjakt UI support. Unsupported UI locales may appear under Coming Later, not as functional toggles.
|
||||
5. Use BCP 47 language tags and explicit fallback rules (e.g. `en-GB`, `nb-NO`, `nn-NO`, `sv-SE`; verify support). Keep UI locale independent of ad-language filtering and document language. Persist across sessions/devices; initial suggestion may use browser locale but never lock it.
|
||||
6. Localise all new Settings, onboarding, search-preference controls, validation, empty/error/help text in the actually approved interface languages; avoid machine-translated legal/professional terminology without review. Provide translation completeness report and automated missing-key checks.
|
||||
7. Search page loads saved defaults; user can override for one query, save overrides to a named search profile, or explicitly Update defaults. Never silently overwrite permanent settings from temporary filter changes.
|
||||
|
||||
## Acceptance examples
|
||||
- Norwegian-resident user, English UI, Norwegian + English ad languages, searches both Norway and UK.
|
||||
- Swedish-resident user with Swedish UI and English ad results; switch UI English without changing query language.
|
||||
- Welsh user sees Welsh and English prominently if Welsh UI is supported; non-Wales UK user isn't forced into Welsh.
|
||||
- Reopen account on another device and recover default countries, occupations, languages and regions.
|
||||
- Empty preference fallback: usable search with explicit country-choice invitation rather than empty broken state.
|
||||
- Tenant isolation, concurrent editing, revision conflict, account deletion/data export, migration and reset.
|
||||
|
||||
## Checkpoints
|
||||
`GJ01-A` schema/compatibility, `GJ01-B` onboarding/Settings, `GJ01-C` selector/localisation, `GJ01-D` search defaults/overrides, `GJ01-E` full regression and handoff. Commit/push validated checkpoints.
|
||||
|
||||
## Deliverables
|
||||
`docs/global-jobs/01/` for preference schema, screen states, local-language mapping, supported-vs-planned locales, localisation checks, permissions, regressions and acceptance. End with GO/CONDITIONAL GO/NO-GO and GJ-02 readiness; stop.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,48 @@
|
||||
# GJ-02 — Hierarchical Geographic Filters, Scopes and Optional Radius
|
||||
**Suggested branch:** `feature/gj02-geographic-search`
|
||||
|
||||
## Objective
|
||||
Implement accurate, discoverable and accessible country/region/county/municipality/town filtering across Norway, Sweden and UK without relying on false flat hierarchies or substring matching.
|
||||
|
||||
## User interaction contract (must not be changed silently)
|
||||
- Selecting **Warwickshire** alone: query the **whole Warwickshire scope**; all child checkboxes remain visually unchecked.
|
||||
- Expanding and selecting **Warwick** under selected Warwickshire: query **Warwick only** in that branch, not every other town in Warwickshire. Warwickshire remains shown as the selected *scope being refined*, with a clear summary `Warwick only`.
|
||||
- Add **Royal Leamington Spa**: query Warwick **OR** Royal Leamington Spa, excluding other Warwickshire areas.
|
||||
- Remove both towns while leaving Warwickshire selected: revert to the **whole Warwickshire** scope.
|
||||
- Separate selected branches (e.g. Warwick plus Bergen) combine as **OR**. Different filter dimensions (e.g. location + profession + languages) normally combine as **AND**.
|
||||
- Deselect a parent: remove or resolve its descendant filters visibly, with accessible announcement, never leave invisible active child selections.
|
||||
- A checked parent with refinements is **not** the conventional 'all descendants checked' tri-state checkbox. Design accessible controls as **scope checkbox/selection plus separate refinement state**; avoid misleading mixed-state semantics. Include explicit `Whole area` / `Specific places` options and a clear effective-filter summary if needed.
|
||||
|
||||
## Engineering requirements
|
||||
1. Inspect genuine geography sources and licences/versions. For Norway use authoritative county/municipality and locality datasets; Sweden län/kommun/settlements; UK ONS geography and appropriate settlement data. Handle UK county vs district vs built-up area accurately and atypical administrative cases (Oslo both county/municipality, UK unitary authority, etc.). Store canonical identifiers, types, country, parent relations, names/aliases, optional polygons/centroids/coordinates with provenance/version.
|
||||
2. Build geographic taxonomy ingestion/update routines and mapping from provider source location codes/free text; allow unresolved/approximate classifications (never silently attach a job to the wrong town).
|
||||
3. Support tree expansion without huge downloads, keyboard navigation, search-as-you-type town lookup, saved favourite locations and a compact filter summary/chips. Strictly preserve selected scopes when tree collapses.
|
||||
4. Define semantic query plan translating geographic selections to filter over canonical IDs/polygons and provider-supported area fields. If provider can't do exact region filtering, use compliant local filtering or clearly disclose approximation and missing data; do not claim full provider coverage.
|
||||
5. Optional town-centered radius (e.g. 10/25/50km), with geodesic distance, coordinates known/unknown rules, multi-origin OR semantics and units/localized display. Radius by distance is not a guaranteed travel-time commute. Keep a separate optional actual travel-time capability for later, only with a qualified routing provider.
|
||||
6. Define remote jobs explicitly: fully remote, remote limited to country/region, hybrid/on-site and unknown. Remote must not bypass legally specified work location constraints.
|
||||
7. Add indexes/performance checks for large country scopes, no 1,000-child checkbox DOM, data migration, stale taxonomy IDs and fallback on missing geographic data.
|
||||
|
||||
## Test corpus
|
||||
- Warwickshire > Warwick and Royal Leamington Spa, deselect/reselect/expand/collapse, selected parent + descendants, sibling mixing, multiple-country OR.
|
||||
- Vestfold > Tønsberg/Sandefjord; Vestland > Bergen; Oslo municipality/county dual identity; Sweden Stockholm län > Stockholm municipality/town.
|
||||
- A posting geocoded only at county level must not be misreported as located within Warwick town.
|
||||
- Radius from Warwick includes known nearby locations when within requested geometric distance, and doesn't claim driving time.
|
||||
- Keyboard/screen-reader semantics and mobile compact filtering; frozen profile roundtrips.
|
||||
|
||||
## Checkpoints/deliverables
|
||||
`GJ02-A` taxonomy/source decision; `GJ02-B` canonical model/import; `GJ02-C` refinement state & UI; `GJ02-D` query mapping/radius; `GJ02-E` precision/performance/acceptance. Document under `docs/global-jobs/02/`. Commit/push each. Report location precision and provider coverage honestly. Stop after acceptance.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,35 @@
|
||||
# GJ-03 — Universal Occupation Autocomplete, Skills and Cross-Language Queries
|
||||
**Suggested branch:** `feature/gj03-occupation-search`
|
||||
|
||||
## Objective
|
||||
Deliver fast, useful occupation and job-title suggestions for **every sector**, available in different languages, without coding a developer-only dictionary or requiring AI inference.
|
||||
|
||||
## Design and build
|
||||
1. Inspect search UI/backend and Career Profile, existing role categories and suggestions. Define distinction: occupation concept, advertised job title, related title, alias, skills, licence/qualification, free-text term and category. A text search like `weekend work` must remain possible.
|
||||
2. Integrate a verified version of ESCO occupational concepts/labels/aliases/skills using suitable licensed API/dataset/cache. Where helpful map to national classifications including Sweden SSYK and UK SOC; maintain ID provenance/version and explicit unmapped cases. Do not assume ESCO's `no` language pack provides fully distinguished Bokmål and Nynorsk translations.
|
||||
3. Build typeahead with debouncing/cancellation, typo tolerance, language-aware synonyms, ranked results, accessible keyboard selection, exact vs related query modes, optional skill chips. Present human-readable explanation for expansions across languages (e.g. `chef` ↔ `kokk`) and user control to turn them off.
|
||||
4. Source signals: user-chosen occupations, verified Career Profile entries (with consent/config), common local terms, prior searches, and role terms from supported providers. Do not mine raw private CVs globally or leak user data into other tenants.
|
||||
5. Support searches by job type and requirement not just formal title: part-time, evening shifts, weekend work, apprenticeships, no experience, teaching level, kitchen role, professional licensing. Filter capabilities must be source-aware, never fabricate unsupported advertised fields.
|
||||
6. Multi-lingual matching can expand keywords if justified; preserve original title and advert in results. Distinguish exact-match results from related recommendations and avoid conflating unrelated occupations.
|
||||
7. Generate a frozen multi-profession benchmark and evaluate suggestions for false positives, useful recall, language accuracy, query latency and index size. Include fallback to simple keyword on taxonomy outage.
|
||||
|
||||
## Acceptance matrix
|
||||
Explicit scenarios: teacher, teaching assistant, chef, kitchen assistant, cleaner, nurse, healthcare assistant, electrician, plumber, carpenter, delivery driver, warehouse worker, shop assistant, waiter, accountant, public administrator, mechanic, software developer, agricultural labourer. Include NO/SE/UK title variants and source text. Ensure broad roles do not swamp precise title searches; 'nurse' shouldn't blindly match uncredentialed carers as an exact title.
|
||||
|
||||
## Checkpoints
|
||||
`GJ03-A` taxonomy/licensing and mapping; `GJ03-B` search index/normalisation; `GJ03-C` suggestion UI; `GJ03-D` relevance controls and filters; `GJ03-E` benchmarks/accessibility/regression. Docs: `docs/global-jobs/03/`. Commit/push checkpoints. Report exact tested languages, source coverage and limitations. Stop.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,41 @@
|
||||
# GJ-04 — Country Provider Connectors, Rights Enforcement and Lifecycle
|
||||
**Suggested branch:** `feature/gj04-provider-connectors`
|
||||
|
||||
## Objective
|
||||
Implement a scalable source architecture that can serve Norway, Sweden and UK while accurately representing differing API permissions and content completeness. Provider blockers must not block already-authorised sources or manual user entry.
|
||||
|
||||
## Mandatory source strategy
|
||||
**Norway NAV:** Verify current `pam-stilling-feed` docs/terms. This is an authenticated change feed, not a free-text search endpoint; permitted local indexing/search requires consumer access and incremental updates. Verify JWT consumer registration (the public experimentation token is not a production solution), updates, tombstones/inactive masking, source application deep links, attribution and PII requirements. **FINN listings are not included in NAV's feed.**
|
||||
|
||||
**Norway FINN:** Official FINN API requires authorised advertiser/business relationship and ownership of accessible data; general third-party search is NOT available by default. Implement user-pasted URL recognition, deduplication, legitimate manual record entry, and original-site link. Do not silently fetch FINN pages, circumvent protection or call this 'full FINN integration'. Only implement full details if explicit suitable rights are established.
|
||||
|
||||
**Sweden:** Verify official JobTech JobSearch and JobAd Links capabilities and licence. JobAd Links provides truncated details/reference links, not guaranteed full vacancy content. Respect original-site link requirements, daily freshness and occupational-code mappings. If other JobTech APIs permit full descriptions, expose source-specific completeness and follow those actual terms.
|
||||
|
||||
**United Kingdom:** Evaluate Adzuna documented job search; results contain a **description snippet**, and ongoing commercial SaaS use requires licensing/written approval. Evaluate appropriate public-sector/other licensed sources and externally linked searches; don't assume Reed/Indeed/Totaljobs/CV-Library/Find a Job/NHS APIs allow third-party bulk search. For blocked providers, create operator instructions and a permitted fallback, not an invented API.
|
||||
|
||||
## Architecture
|
||||
1. Provider registry with immutable ID, geo/occupation search capabilities, feed vs query mode, allowed detail level, supported filters, source link policy, commercial rights, credential status, effective dates, retention, updates/deletes, quota and telemetry. Make unavailable/blocked sources visible to admins with actionable reason but do not expose keys.
|
||||
2. Typed interfaces: `Search`, `ReadDetails`, `IngestChanges`, `MapLocation`, `MapOccupation`, `Normalize`, `GetLifecycle`, `BuildApplyLink`, conditional on capabilities. Do not force every provider to implement methods it does not support.
|
||||
3. Canonical SourceAdvertisement plus ProviderSourceRecord with provider ID, source ID, canonical link, employer/title, structured location, pay amount/range/currency/period, shifts, occupation, qualification, languages, contract, description format/completeness, created/modified/expiry, original apply URL, source-restriction flags and provenance. Preserve unknown values; avoid inventing salaries/hours or dropping original titles.
|
||||
4. Safe ingestion/index queue with cursor/checkpoint, bounded pagination, backoff/rate limit, idempotency, incremental updates/deletes, stale-data policy, audit events, resumability, transactional MariaDB and provider-specific compliance. No infinite poll loops or API-key logs.
|
||||
5. Deterministic, conservative cross-provider duplicate detection (source IDs, canonical links and supporting content/time/location) with false-positive review. Do not merge distinct teaching vacancies at same school or identical restaurant positions automatically. Display multiple sources only when identity is sufficiently proven.
|
||||
6. Separate external ad cache from user-owned application tracking. Remove/mask inactive content per source terms; preserve user-owned notes/status legally and transparently, not secretly republish deleted ads.
|
||||
7. Provider fixture/contracts and authorised bounded live smoke tests. Do not run live provider tests without actual access.
|
||||
|
||||
## Checkpoints
|
||||
`GJ04-A` rights & provider registry; `GJ04-B` canonical/ad lifecycle; `GJ04-C` NAV connector if authorised; `GJ04-D` Swedish connectors; `GJ04-E` UK approved connector or external-link-only fallback; `GJ04-F` manual FINN URL workflow; `GJ04-G` dedupe, security, operational tests. Block unavailable subcheckpoint honestly; continue independent ones. Docs: `docs/global-jobs/04/`, source by source eligibility, test evidence, permissions, rate limits, update/delete compliance and owner actions. Commit/push each completed checkpoint. Stop.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,42 @@
|
||||
# GJ-05 — Unified Discover Jobs UI and In-App Vacancy Details
|
||||
**Suggested branch:** `feature/gj05-discovery-ui`
|
||||
|
||||
## Objective
|
||||
Make searching intuitive: saved defaults, smart suggestions, fast results, hierarchical location filter, and a full permitted vacancy-detail experience within Jobjakt—not forcing a new site for every listing.
|
||||
|
||||
## Design
|
||||
Desktop: responsive three-panel layout—collapsible filter sidebar, scrollable results list, vacancy detail. Tablet: two-pane or overlay; phone: list with full-screen detail. Offer `Expand details` route that deep-links to an individual permitted advert, with refresh, back button and pagination. Do not rely exclusively on huge modal overlays.
|
||||
|
||||
Use profile countries/occupation/ad languages automatically; allow temporary override and `Save this search`. Filters must be explainable and backed by provider data quality: location scopes (county→town), radius, roles/exact vs related, skills, advertised languages, contract type, full/part-time, shift/evening/weekend, apprenticeship/seasonal, remote/hybrid/on-site with country eligibility, salary currency/period and type (actual vs predicted), post date/deadline, source, and experience/licences where supplied. Mark unsupported fields as unavailable; no fabricated 'strict' enforcement.
|
||||
|
||||
Suggestions: accessible typeahead for any profession; recent/favourites but privacy-preserving; empty input suggestions where helpful. Provide query chips/effective selection summary including `Warwickshire: Warwick + Leamington only` without misleading parent checkbox semantics.
|
||||
|
||||
Results: title, employer, geographic accuracy label, source, work type, salary only where provided, last updated, active/expired status, original language, whether description is full or snippet, one canonical duplicate grouping with alternate sources when safe. Sorting/pagination/cursor; skeleton/empty/error/stale/partial-source and accessibility.
|
||||
|
||||
Vacancy detail: permitted original description (sanitised), duties, requirements, qualifications/licences, schedule/shifts, salary with period/currency, employer, locations, source citations/attribution, posted/updated, deadline, apply method and transparent gaps (`not provided by source`). **Never scrape the linked website to fill a provider's legally truncated excerpt.** Link to original listing and original application flow. Preserve original employer words; any translated summary must be clearly labelled and optional.
|
||||
|
||||
Actions: `Save Job`, `Track Application`, `Attach Existing CV`, `Create CV Variant`, `Prepare Cover Letter` (reuse current app; AI gated), original `Apply` link. Distinguish saved job from tracked application. Preserve source record vs user-owned notes.
|
||||
|
||||
## Testing
|
||||
- Listings from multiple permitted providers, full and snippet-only previews, unavailable sources, missing salaries, expired ads, unsafe HTML and malicious links, missing coordinates, Norway/Sweden/UK location hierarchies.
|
||||
- Occupations: teachers, chefs, carers, nurses, trades, transport, retail, office and IT; job details fit shift and hourly work as well as salaried roles.
|
||||
- Mobile portrait/landscape, keyboard, 200% zoom, screen reader, EN/Bokmål, responsive transitions, deep-link/back navigation, filters retaining context.
|
||||
- Correct URL/apply behavior; no external content loaded in an unsafe iframe by default; do not misreport full detail from snippet-only APIs.
|
||||
|
||||
## Checkpoints
|
||||
`GJ05-A` wireframes and routes; `GJ05-B` filters/responsive UI; `GJ05-C` results/query semantics; `GJ05-D` in-app detail and source rules; `GJ05-E` tracker/doc actions; `GJ05-F` accessibility/fidelity/regression. Docs: `docs/global-jobs/05/`. Commit/push per validated checkpoint. Stop.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,36 @@
|
||||
# GJ-06 — Saved Searches, Alerts, Skills Matching and Application Tracking
|
||||
**Suggested branch:** `feature/gj06-alerts-matching`
|
||||
|
||||
## Objective
|
||||
Help users act on relevant opportunities without overwhelming them: durable saved searches, reliable new-job alerts, explainable profession-neutral matching, and seamless use of Jobjakt's application tracker, Career Profile, CV Builder and cover letters.
|
||||
|
||||
## Features
|
||||
1. Save and name multiple search profiles, including countries, tree scopes (not flattened children), radius, roles/skills, languages, source filters, work type and disabled-source status. Load/duplicate/edit/delete/suspend/restore; update saved profiles only when explicitly requested, with revision-safe persistence.
|
||||
2. New matching jobs: scheduled bounded evaluation (according to each provider's data rights), idempotent matching by canonical provider ID + changed state, per-user subscriptions and timezone-friendly daily/weekly/in-app/email frequency; pause/unsubscribe, quiet hours where supported, anti-spam and delivery failure recovery. Don't notify about expired/deleted jobs or leak another user's preferences.
|
||||
3. Occupation/skills/qualification matching: use explicitly stored Career Profile facts, source advertised requirements, ESCO relations and supported match semantics; show evidence (`CV says`, `advert requests`, `not supplied`), reasons and gaps. Never infer qualifications/regulated professional authorisation, fluency, licences or job eligibility from general similarity. No black-box score claiming hiring probability.
|
||||
4. Cross-language matches: original job ad remains authoritative. Display translated title/summary only if supported, attributed and clearly labelled; distinguish exact vs related suggestions. Allow users to restrict results to ad languages they understand.
|
||||
5. Saved vs tracked: `Save job` doesn't imply application submitted; `Track Application` opens established workflow, avoids duplicates and links permitted source metadata and CV/letter. Expired ad content obeys provider source lifecycle; user's own notes and status remain separate.
|
||||
6. Optional relevance ranking and explanatory weights: location, title, skills, language, schedule, salary (if provided), remote eligibility and user preferences. Avoid geography bias, sensitive-class inference, nationality discrimination and misleading eligibility statements. No automatic external application submission.
|
||||
7. AI inference can be added later only after approved security/semantic qualification; core matching must work with transparent rules and catalogued data.
|
||||
|
||||
## QA scenarios
|
||||
- Teacher with pedagogy/subject preference, chef with evening shifts, nurse with mandatory authorisation, cleaner without formal qualifications, electrician with trade licence, part-time retail worker, remote English speaker, mixed-country mover and backend developer.
|
||||
- Same job from multiple providers, result withdrawn before alert, saved search changed mid-run, duplicate worker delivery, locale/timezone, overlapping searches, no results, disabled API source, invalid/missing salary/location and account deletion.
|
||||
|
||||
## Checkpoints
|
||||
`GJ06-A` saved-search storage; `GJ06-B` alert scheduling/dedupe; `GJ06-C` matching and explanations; `GJ06-D` tracker and documents; `GJ06-E` security/load/accessibility. Docs `docs/global-jobs/06/`. Commit/push checkpoints; final GO/CONDITIONAL GO/NO-GO and GJ-07 handoff. Stop.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,37 @@
|
||||
# GJ-07 — Provider Operations, Admin Monitoring, Privacy and Resilience
|
||||
**Suggested branch:** `feature/gj07-discovery-operations`
|
||||
|
||||
## Objective
|
||||
Make multi-country job discovery auditable and sustainable to operate without exposing user CVs, raw prompts or host internals. Integrate with existing administrator processing monitor where appropriate.
|
||||
|
||||
## Admin view
|
||||
- Provider registry: country, API eligibility/rights state, capability flags, feed/query mode, enabled status, last successful sync, health, API quotas/rate errors, source freshness, indexing backlog and next scheduled sync.
|
||||
- Processing jobs/events: provider, worker, job type, cursor/checkpoint, fetched/new/updated/deleted/ignored counts, duration, retry, error code, structured stage and correlation ID; user-submitted URL import tasks show the submitting user and linked saved job/application only to properly authorised admins. Provider-wide sync jobs normally have no submitting end-user—show 'system' rather than inventing one.
|
||||
- Diagnostics: filter by provider, country, status, error type, time and correlation ID; redacted timeline/log excerpt from structured application events, with bounded retention, pagination and optional authenticated SSE stream/polling. No full job-applicant CV text, prompts, OAuth tokens, provider secrets, unsafe original HTML, raw Docker logs or arbitrary shell.
|
||||
- Correctness metrics: source lag, cursor age, licensing expiry/credential failure, stale/deleted advert content, dedupe rate and uncertain matches, alert queue outcomes and error clusters. Show true service health vs fixture mode.
|
||||
|
||||
## Security hardening
|
||||
- Server-side admin role checking on list, detail, streaming and data export; tenant boundaries even if admin scope is restricted; audit privileged access and source credentials changes.
|
||||
- SSRF-resistant URL import with scheme/host allowlist, DNS re-resolution/address validation and redirect policy; never fetch internal network endpoints. Treat source descriptions as untrusted HTML and avoid script execution/sandbox iframe leaks.
|
||||
- Bounds: API requests, ingestion concurrency, result pagination, auto-complete rate, local index size, alert fanout, log volume, timed-out jobs, model inference remains disabled if not qualified.
|
||||
- Provider lifecycle compliance tests including deletion/tombstone, changed ads, contact masking, and legal separation of external ad cache from user-owned application history.
|
||||
- Privacy: document what is stored (search preferences, skills references, personal saved jobs, employer contact information), why, and deletion/retention/export rights. Don't store source data past permission; no uncontrolled tracking/marketing analytics.
|
||||
- Reproducible migrations/CI, secret scanning and dependency audits, loss-of-provider/backoff/partial outage drills. Never alter production infra to get passing tests.
|
||||
|
||||
## Checkpoints
|
||||
`GJ07-A` operational telemetry & job models; `GJ07-B` admin UI/filters/logs; `GJ07-C` authorization/privacy/redaction; `GJ07-D` resilience/performance/audits. Docs: `docs/global-jobs/07/`. Commit/push every validated checkpoint. End GO/CONDITIONAL GO/NO-GO. Stop.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,51 @@
|
||||
# GJ-08 — Full Cross-Country, Cross-Industry Acceptance and Release Qualification
|
||||
**Suggested branch:** `test/gj08-global-discovery-acceptance`
|
||||
|
||||
## Objective
|
||||
Independently qualify the integrated feature set with full regression, licensing proof, real dataset fixtures and bounded live provider evidence. Fix bounded confirmed defects. Do not count separate passing stage suites as proof the combined product works. No production deployment.
|
||||
|
||||
## Verify lineage and prerequisites
|
||||
Confirm accepted GJ-01 through GJ-07 stage commits are present in one integration-complete development history. Read source-rights matrix, licensing/approval evidence, country-specific data integrity contracts, Phase10 preservation baseline, security model and operator actions. Distinguish implementation complete from authorised live source operational status. Report blocked provider connectors independently.
|
||||
|
||||
## Mandatory acceptance journeys
|
||||
1. New account chooses country of residence, multiple search countries and local/English UI; set preferred ad languages; log out, sign in on second browser, confirm defaults and no implicit preference overwrite.
|
||||
2. NO: Norwegian user filters Vestfold > Tønsberg, Vestland > Bergen and Oslo; searches teacher, cook, nurse, cleaner and developer; NAV feed fixtures reflect updates/deletes, permitted in-app details and original application links. FINN URL import is manually safe if no partner access.
|
||||
3. UK: Warwickshire selects whole area, Warwick then narrows to town, add Leamington gives union of two towns only, clearing children restores all Warwickshire, OR a Bergen branch; radius; county/town ambiguous source-location handling. Source snippet-only job shows honest original link, no unauthorized full content.
|
||||
4. SE: Swedish title autocomplete/classification, Swedish-English ad-language filters, source truncation and proper linked-to-origin details.
|
||||
5. General: teacher, chef, kitchen assistant, nurse, care worker, electrician, plumber, delivery driver, warehouse worker, shop assistant, cleaner, accountant, administrator, farmer, IT developer. Verify contract/hourly/shift/part-time, qualifications, licence and seniority not falsely inferred.
|
||||
6. Full desktop 3-panel and mobile details; direct URL to in-app detail, display source metadata, safe HTML, saved jobs and tracked application integration, create CV variant and cover letter without accidental AI enablement.
|
||||
7. Save search, receive deduped eligible alert, quiet/suspend/unsubscribe, provider offline/stale/deleted, delayed update, job source deduped without merging similar separate posts.
|
||||
8. Admin source health, source job correlation, stale/expired processing, secured redacted diagnostic logs, non-admin denial, correlation IDs and no personal content leakage.
|
||||
9. Security: SSRF/redirect/rate tests, tenant isolation, injection and malicious descriptions, PII deletion, unsafe image/link, incomplete permissions, corrupted feed states, retries, migrations and rollback.
|
||||
10. Accessibility and localisation: keyboard, screen reader where actually available, 200% zoom, real phone where available, English and each shipped local UI language, no missing keys, source original text preserved; do not claim manual sign-off not performed.
|
||||
|
||||
## End-to-end quantitative gates
|
||||
Set explicit measured gates with the owner-approved acceptance plan rather than fabricating universal numbers: critical data loss/security/misleading content = zero accepted, source terms proof for any live connector, consistent hierarchy query semantics, real provider fixtures coverage, benchmark title precision/recall across sectors, latency and index capacity with bounded load, notification dedupe and freshness, regression against preserved routes/document/PDF expectations. Document failures, skips, not run and human checks separately.
|
||||
|
||||
## Full suites
|
||||
Backend/frontend/browser/contract/MariaDB/sidecar as applicable; content/legal-policy assertions, provider contract fixtures, feed update/delete, location mapping, all industries, prefs, localisation, role title, suggestions, filters, dedupe, CV/app integration, admin, security, TypeScript/lint/build, accessible navigation, responsive visual screenshots. Use real provider calls only with approved credentials/rate/test terms. Recheck RD21 and previous CV/PDF regression scope, do not weaken historical tests.
|
||||
|
||||
## Deliverables
|
||||
`docs/global-jobs/08/ACCEPTANCE.md`, `PROVIDER_GO_LIVE_MATRIX.md`, `TEST_EVIDENCE.md`, `MANUAL_QA.md`, `PERFORMANCE.md`, `SECURITY_AND_PRIVACY.md`, `RELEASE_AND_ROLLBACK.md`, `OPEN_GATES.md`, `FINAL_PRODUCT_CAPABILITIES.md`. Preserve previous reports.
|
||||
|
||||
## Independent verdicts
|
||||
- Preferences & localisation, geography, occupation taxonomy, NO, SE, UK (each connector separately), permitted full-detail viewing, source lifecycle, dedupe, saved searches/alerts, matching, admin monitor, security, multi-tenant integrity, accessibility/manual device, overall development, production.
|
||||
- Mark any country/provider BLOCKED if commercial agreement, API consumer registration or access missing. `External links available` is not `Live integrated search`.
|
||||
- Production GO only after independent host/backups/filesystem/ingress/CI/rollback/privacy/source-license/human acceptance criteria genuinely pass, plus explicit owner approval. No main merge or deployment here.
|
||||
|
||||
Commit/push verified QA checkpoints, report GO/CONDITIONAL GO/NO-GO with evidence and exact next owner actions, then stop.
|
||||
|
||||
## Shared rules for every INT-GLOBAL-JOBS-01 stage
|
||||
|
||||
- Product: **Jobjakt**, a general-purpose, commercial job-search and career-management SaaS. It is **not** an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
|
||||
- **Entry gates:** Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
|
||||
- **Baseline:** Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume `main` is current. `main` deploys production: NEVER merge to `main` or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
|
||||
- **Branches:** Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
|
||||
- **Autonomy:** Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
|
||||
- **Sources:** Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
|
||||
- **Data trust:** All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
|
||||
- **Availability:** Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
|
||||
- **User-facing quality:** Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
|
||||
- **Data integrity:** Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
|
||||
- **AI:** Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
|
||||
- **Evidence:** At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.
|
||||
@@ -0,0 +1,43 @@
|
||||
# Jobjakt — International Job Discovery Codex Prompt Pack
|
||||
|
||||
This package contains **one master prompt** and **nine standalone staged prompts** for `INT-GLOBAL-JOBS-01`. It is for a **cross-industry**, country-aware, multilingual discovery system for Norway, Sweden and the UK initially, with explicit extension paths.
|
||||
|
||||
## Recommended use
|
||||
|
||||
1. Use `00_MASTER_ORCHESTRATOR.md` when you want Codex/Astra to understand the full roadmap and overall constraints.
|
||||
2. Start with `01_GJ_00_DISCOVERY.md` for planning, architecture, provider-rights audit and source access checks. Planning can be done before Phase 10 completion; **do not implement** until Phase 10/Product Review entry gates actually permit it.
|
||||
3. Then run files `02` to `09` separately **in order**, only after the previous stage's acceptance and latest development baseline are verified. All implementation branches build on accepted predecessor development history, not on outdated `main`.
|
||||
4. Each stage's instruction to commit and push is restricted to its feature/planning/test branch. **No production/main merge or deployment.**
|
||||
|
||||
## Contents
|
||||
|
||||
| File | Purpose |
|
||||
| --- | --- |
|
||||
| 00_MASTER_ORCHESTRATOR.md | Overall master orchestration and universal requirements |
|
||||
| 01_GJ_00_DISCOVERY.md | Architecture, APIs, source rights, acceptance plan |
|
||||
| 02_GJ_01_PREFERENCES_I18N.md | Country, language and saved search defaults |
|
||||
| 03_GJ_02_GEOGRAPHY.md | Region/town refinements and optional radius |
|
||||
| 04_GJ_03_OCCUPATIONS.md | All-profession multilingual autocomplete and search |
|
||||
| 05_GJ_04_PROVIDERS.md | NAV/Swedish/UK sources, FINN manual fallback, rights |
|
||||
| 06_GJ_05_SEARCH_UI.md | Three-pane search, full permitted job description, actions |
|
||||
| 07_GJ_06_ALERTS_MATCHING.md | Saved searches, alerts, relevance and job-tracker integration |
|
||||
| 08_GJ_07_ADMIN_SECURITY.md | Provider/job sync monitoring, failures and secure logs |
|
||||
| 09_GJ_08_ACCEPTANCE.md | Final combined QA, source rights and rollout gating |
|
||||
|
||||
## What is deliberately not assumed
|
||||
|
||||
- No general FINN job-search API access without an approved business relationship.
|
||||
- No ongoing commercial Adzuna integration before approval/licensing.
|
||||
- No guaranteed full in-app descriptions from snippet-only providers.
|
||||
- No production-grade NAV consumer token unless the consumer has actually registered.
|
||||
- No new UI language shown as fully supported without complete translation and QA.
|
||||
- No automatically enabled live AI model, scraping, auto job applications, merge to main or production deployment.
|
||||
|
||||
## Official starting points (reverify when executing)
|
||||
|
||||
- NAV: https://navikt.github.io/pam-stilling-feed/ ; https://arbeidsplassen.nav.no/vilkar-api
|
||||
- FINN: https://www.finn.no/api/
|
||||
- Sweden JobAd Links: https://links.api.jobtechdev.se/
|
||||
- Adzuna: https://developer.adzuna.com/docs/search ; https://developer.adzuna.com/docs/terms_of_service
|
||||
- ESCO: https://esco.ec.europa.eu/en/use-esco/use-esco-services-api
|
||||
- UK ONS: https://geoportal.statistics.gov.uk/
|
||||
Reference in New Issue
Block a user