From 3bd7b4b7e4e460aed8bda09386d6346cdbbdf586 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Fri, 3 Jul 2026 04:29:27 +0200 Subject: [PATCH] docs: add merge-request summary for review Co-Authored-By: Claude Fable 5 --- docs/MERGE_REQUEST.md | 78 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 docs/MERGE_REQUEST.md diff --git a/docs/MERGE_REQUEST.md b/docs/MERGE_REQUEST.md new file mode 100644 index 0000000..1240a76 --- /dev/null +++ b/docs/MERGE_REQUEST.md @@ -0,0 +1,78 @@ +# Merge Request — Wave 0 quick wins + Tier-1/Tier-2 features + +**Branch:** `chore/wave0-quick-wins` → `main` +**Scope:** 24 commits · 62 files · +3,165 / −489 +**Status:** all tests green (backend 135, frontend 23 suites / 54 tests), production build compiles. + +> Prepared for human review. Do **not** auto-merge. One operator action is required after merge +> (DataProtection key rotation — see *Known limitations*). + +--- + +## Summary + +Delivers the first two roadmap tiers plus the engineering-health groundwork, developed as small +conventional commits. Two design principles run through it: + +1. **Deterministic over "AI-guessy."** Match scoring, status suggestions, and pipeline logic are + pure/deterministic — instant, reproducible, and safe (the user confirms every state change). This + directly answers the market's most common complaint (hallucinated/generic AI output). +2. **One pathway, not two.** The bookmarklet and the PWA share-target feed a single `/?add=` capture + flow rather than parallel implementations. + +## What's included + +**Engineering health (Wave 0)** +- `security:` untracked committed DataProtection keys + daily exports; removed dead legacy controllers. +- `feat:` automated daily SQLite backups (`VACUUM INTO`, retention, startup catch-up) — prod previously + had **no** automated backup on Linux. +- `ci:` run the **entire** frontend suite (the old whitelist was hiding 3 broken suites, now fixed). +- `feat:` dev-only OpenAPI at `/openapi/v1.json`; `feat:` structured salary fields. + +**Tier-1 features** +- **Match score** (`GET /jobapplications/{id}/match-score`) — deterministic CV↔job keyword coverage + (0–100) + matched/missing keywords + section coverage. Instant panel on the Candidate Fit tab. +- **Canonical pipeline** — `JobPipeline` single source of truth; status normalized on write (custom + values preserved); UI deduped across 5 files; `GET .../pipeline`. +- **Analytics v2** — time-in-stage medians (from `StatusChanged` history) + funnel driven by the + pipeline (fixes a bug that omitted the Waiting stage). +- **Status suggestions** — deterministic email→status classifier surfaced as a human-confirmed banner. + +**Tier-2 features** +- **Bookmarklet** quick-capture (Settings) reusing `jobimport/preview`. +- **Installable PWA** with a mobile share-target into the same capture flow. + +**Quality** +- Phase-6 security review (`docs/SECURITY_REPORT.md`): tenant isolation on new endpoints verified + + regression-tested; no injection/ReDoS; dev-only OpenAPI. +- Bug fixes: `SkillTagger` C#/.NET regex (silently missed those skills everywhere), a React + stale-closure, a duplicated DB query, and 3 pre-existing hidden test failures. + +## Test coverage added + +New pure/unit-tested services: `JobCvMatchService` (7), `JobPipeline` (14), `StageAnalytics` (4), +`EmailStatusClassifier` (7). New endpoint integration + authorization tests (match-score, +status-suggestion). New frontend tests: match-score panel, status-suggestion banner, pipeline, +quick-capture, capture-url resolution. + +## Docs + +New: `docs/SYSTEM_OVERVIEW.md`, `docs/PRODUCT_RESEARCH.md`, `docs/ROADMAP.md`, +`docs/SECURITY_REPORT.md`. README updated with the new endpoints, backup/pipeline config, and +quick-capture/PWA notes. + +## Known limitations / follow-ups + +- **ACTION REQUIRED (security):** the removed DataProtection key XMLs remain in git **history**. + Rotate them on the production host after merge (see `SECURITY_REPORT.md` §6). +- **Per-user custom pipeline stages** were deliberately deferred (unproven demand; large surface). +- **No offline service worker** by design — the app deploys frequently and an aggressive cache would + risk serving stale builds. The PWA is installable and share-capable without it. +- Not yet done (future branches): interview hub (M3), contacts CRM (M4), god-controller decomposition, + performance pass, Vite migration. + +## Reviewer notes + +- Repo quirk: controllers/services compile via the `JobTrackerBackend` library, **not** the + `JobTrackerApi` host project (see `docs/SYSTEM_OVERVIEW.md` §2). +- All AI-adjacent features are deterministic and make no model calls.