docs: consolidate repository guides and preserve audit history

2026-09-11 14:22:41 +02:00
parent 115441a409
commit 682a3028bb
404 changed files with 3402 additions and 2621 deletions
@@ -9,7 +9,7 @@ using Microsoft.EntityFrameworkCore;
 namespace JobTrackerApi.Controllers;

 // Phase 5 — the AI Workspace for one job application. Every module runs through ISummarizerService and
-// is stored as append-only history; nothing is applied automatically. docs/architecture/ai-career-assistant.md.
+// is stored as append-only history; nothing is applied automatically. docs/ai/architecture.md.
 [ApiController]
 [Route("api/jobapplications/{jobId:int}/ai")]
 [Authorize(AuthenticationSchemes = "local")]
@@ -12,7 +12,7 @@ namespace JobTrackerApi.Controllers;
 // /api/cv (CvVariantController), and documents stay on /api/attachments. These routes only cover what
 // is genuinely application-scoped — which variant this application uses, what to tailor, and the
 // cover letter with its history. Every route is tenant-scoped and returns 404 for another user's
-// application. docs/architecture/application-workspace.md.
+// application. docs/architecture/overview.md.
 [ApiController]
 [Route("api/jobapplications/{jobId:int}")]
 [Authorize(AuthenticationSchemes = "local")]
@@ -8,7 +8,7 @@ namespace JobTrackerApi.Controllers;

 // Phase 5 Milestone 2 — the application checklist. System items seed themselves on first read from the
 // existing readiness signals; the user owns everything after that.
-// docs/architecture/application-workspace.md.
+// docs/architecture/overview.md.
 [ApiController]
 [Route("api/jobapplications/{jobId:int}/checklist")]
 [Authorize(AuthenticationSchemes = "local")]
@@ -11,7 +11,7 @@ namespace JobTrackerApi.Controllers;
 //
 // None of them write anything. The AI narrative for analysis and match stays on the existing
 // /api/jobapplications/{id}/ai routes, which are suggestion-only and versioned by AiInteraction.
-// docs/architecture/application-workspace.md.
+// docs/architecture/overview.md.
 [ApiController]
 [Route("api/jobapplications/{jobId:int}")]
 [Authorize(AuthenticationSchemes = "local")]
@@ -8,7 +8,7 @@ namespace JobTrackerApi.Controllers;

 // Phase 5 Milestone 1 — one aggregate read for the Application Workspace overview, so the page loads
 // from a single call instead of fanning out. Read-only; owns no data.
-// docs/architecture/application-workspace.md.
+// docs/architecture/overview.md.
 [ApiController]
 [Route("api/jobapplications/{jobId:int}/workspace")]
 [Authorize(AuthenticationSchemes = "local")]
@@ -11,7 +11,7 @@ namespace JobTrackerApi.Controllers;
 // here. The relational children (via CareerProfileService) are the source of truth; the
 // ApplicationUser.ProfileCvStructureJson blob is kept in sync as a derived projection so the legacy
 // read paths (CV rendering, tailoring, match-score) keep working. See
-// docs/architecture/career-profile-model.md.
+// docs/architecture/overview.md.
 [ApiController]
 [Route("api/career/profile")]
 [Authorize]
@@ -10,7 +10,7 @@ namespace JobTrackerApi.Controllers
    [ApiController]
    // Explicitly authorized. These endpoints are all tenant-scoped user data, so they must not
    // depend on the Auth:Require fallback policy being switched on: a deployment that lost that flag
-    // would otherwise serve them anonymously. docs/production-readiness-review.md.
+    // would otherwise serve them anonymously. docs/security/security-notes.md.
    [Route("api/companies")]
    [Authorize(AuthenticationSchemes = "local")]
    public class CompaniesController : ControllerBase
@@ -11,7 +11,7 @@ namespace JobTrackerApi.Controllers
    [ApiController]
    // Explicitly authorized. These endpoints are all tenant-scoped user data, so they must not
    // depend on the Auth:Require fallback policy being switched on: a deployment that lost that flag
-    // would otherwise serve them anonymously. docs/production-readiness-review.md.
+    // would otherwise serve them anonymously. docs/security/security-notes.md.
    [Route("api/correspondence")]
    [Authorize(AuthenticationSchemes = "local")]
    public class CorrespondenceController : ControllerBase
@@ -8,7 +8,7 @@ namespace JobTrackerApi.Controllers;

 // Phase 4 — Career Workspace Builder API. Every endpoint reads the master profile through
 // ICareerProfileService and renders through the data-driven theme engine; none of them store career
-// data. docs/architecture/cv-builder.md.
+// data. docs/architecture/overview.md.
 [ApiController]
 [Route("api/cv")]
 [Authorize(AuthenticationSchemes = "local")]
@@ -11,7 +11,7 @@ namespace JobTrackerApi.Controllers;
 // Prep content is the user's; AI suggestions come from the existing /api/jobapplications/{id}/ai
 // routes and only reach here once the user accepts one (POST with source "ai"). Communication stays
 // entirely on the existing Correspondence routes — there is no messaging endpoint here.
-// docs/architecture/application-workspace.md.
+// docs/architecture/overview.md.
 [ApiController]
 [Route("api/jobapplications/{jobId:int}")]
 [Authorize(AuthenticationSchemes = "local")]
@@ -20,7 +20,7 @@ namespace JobTrackerApi.Controllers
    [ApiController]
    // Explicitly authorized. These endpoints are all tenant-scoped user data, so they must not
    // depend on the Auth:Require fallback policy being switched on: a deployment that lost that flag
-    // would otherwise serve them anonymously. docs/production-readiness-review.md.
+    // would otherwise serve them anonymously. docs/security/security-notes.md.
    [Route("api/jobapplications")]
    [Authorize(AuthenticationSchemes = "local")]
    public class JobApplicationsController : ControllerBase
@@ -1356,7 +1356,7 @@ Candidate CV/profile:
            // application checklist is the one workflow surface; readiness projects it into the score /
            // completed / missing / reminders health view the dialog and dashboard already consume, so
            // the two can never disagree. The DTO shape is unchanged on purpose.
-            // docs/architecture/application-workspace.md.
+            // docs/architecture/overview.md.
            var checklist = job.OwnerUserId is null
                ? null
                : await _checklist.GetAsync(job.OwnerUserId, id, cancellationToken);
@@ -7,7 +7,7 @@ namespace JobTrackerApi.Controllers;
 [ApiController]
 // Explicitly authorized. These endpoints are all tenant-scoped user data, so they must not
 // depend on the Auth:Require fallback policy being switched on: a deployment that lost that flag
-// would otherwise serve them anonymously. docs/production-readiness-review.md.
+// would otherwise serve them anonymously. docs/security/security-notes.md.
 [Route("api/jobimport")]
 [Authorize(AuthenticationSchemes = "local")]
 public sealed class JobImportController : ControllerBase
@@ -29,4 +29,3 @@ public sealed class JobImportController : ControllerBase
        return Ok(result);
    }
 }
-
@@ -8,7 +8,7 @@ using Microsoft.AspNetCore.RateLimiting;
 namespace JobTrackerApi.Controllers;

 // Anonymous read-only surface for public CVs: /cv/{slug} in the SPA fetches this. Only variants the
-// owner has explicitly toggled public are served; noindex by default. docs/architecture/cv-builder.md.
+// owner has explicitly toggled public are served; noindex by default. docs/architecture/overview.md.
 [ApiController]
 [Route("api/public-cv")]
 [AllowAnonymous]
@@ -9,7 +9,7 @@ namespace JobTrackerApi.Controllers
    [ApiController]
    // Explicitly authorized. These endpoints are all tenant-scoped user data, so they must not
    // depend on the Auth:Require fallback policy being switched on: a deployment that lost that flag
-    // would otherwise serve them anonymously. docs/production-readiness-review.md.
+    // would otherwise serve them anonymously. docs/security/security-notes.md.
    [Route("api/rules")]
    [Authorize(AuthenticationSchemes = "local")]
    public class RulesController : ControllerBase