# JobTracker full-application audit progress Audit started: 2026-08-02 Overall status: Complete to all safe/local evidence boundaries; blocked checks are explicitly recorded. Scope: repository-wide implementation, user-journey, security, privacy, supply-chain, reliability, testing, performance, and documentation audit. Application code and configuration are read-only for this audit. ## Phase 1 — Repository discovery Status: Complete ### Work completed - Captured initial Git status. - Located and read the repository `AGENTS.md`. - Began inventorying tracked source, documentation, configuration, generated output, archived material, vendor code, and auxiliary tools. - Read current README, architecture, roadmap, TODO/blocker, environment, deployment, backup, release, package, container, CI, and AI-sidecar material. - Traced executable entry points, authentication/authorization setup, EF ownership model, frontend routing, hosted workers, storage, integrations, and deployment topology. - Compared documentation with the current source and classified ignored/generated/vendored paths. - Searched production source for unfinished-code markers. ### Commands executed - `git status --short --branch` - `rg --files -g AGENTS.md -g '!**/node_modules/**' -g '!**/bin/**' -g '!**/obj/**'` - `Get-ChildItem -Force | Select-Object Mode,Length,LastWriteTime,Name` - `rg --files -g '!**/node_modules/**' -g '!**/bin/**' -g '!**/obj/**' -g '!**/.git/**' | Measure-Object | Select-Object -ExpandProperty Count` - `Get-Content -Raw -LiteralPath AGENTS.md` - Repository documentation, directory, CI-workflow, and tracked-file listings using `rg`, `Get-ChildItem`, and `git ls-files`. - `git status --short --ignored | Select-Object -First 250` - `rg -n -i ... '(TODO|FIXME|HACK|temporary|placeholder|\\bstub\\b|not implemented|NotImplementedException)' ...` - Targeted line-numbered inspection of `Program.cs`, `JobTrackerContext.cs`, controllers, services, models, frontend routes/auth/API client, package manifests, Dockerfiles, Compose, nginx, CI, and the AI sidecar. ### Evidence collected - Initial branch: `release-readiness` tracking `origin/release-readiness`. - Pre-existing worktree changes: deleted `.agent.md`; untracked `AGENTS.md`. - Initial top-level component and documentation listings. - `docs/audits/evidence/repository-inventory.md`. ### Findings recorded - Documentation drift identified; detailed finding IDs will be assigned after cross-phase validation. ### Checks that remain - Validate build/test/tooling baseline and confirm whether documentation claims still hold. ### Blockers and limitations - No Phase 1 blocker. Ignored local copies and generated output were excluded from handwritten-code review. ### Next phase - Phase 2 — build and verification baseline. ## Phase 2 — Build and verification baseline Status: Complete ### Work completed - Classified planned commands as non-destructive; builds/tests may update ignored build output and local package caches only. - Restored/validated declared dependencies without changing manifests or lockfiles. - Built the .NET solution and frontend production export. - Ran backend, frontend, AI-sidecar, and isolated Chromium suites. - Ran TypeScript and formatting checks without rewriting source. - Validated Compose, migration/model state, Dockerfiles, dependencies, and tracked-secret patterns. ### Commands executed - Exact commands and results are recorded in `docs/audits/verification-log.md` (V-001 through V-027). ### Evidence collected - Build/test outputs above plus the verification log. - Current tracked tree and reachable-history secret-pattern scans with values suppressed. ### Findings recorded - Standalone TypeScript check failure, formatting-baseline failure, npm advisories, Python advisory volume, tracked expired token artifact, and reproducibility gaps require cross-phase validation and finding IDs. ### Checks that remain - Container image CVE scanning was unavailable locally. - Advisory applicability and severity need source-path review. ### Blockers and limitations - `gitleaks`, `trivy`, and `hadolint` unavailable. - Production/remote CI status is outside this local audit; no production system was contacted. ### Next phase - Phase 3 — architecture, backend, frontend, and data review. ## Phase 3 — Architecture and code-quality audit Status: Complete ### Work completed - Traced controller/service/data paths for jobs, career profiles, CVs, application workspaces, correspondence, attachments, AI, identity, rules, exports, and backups. - Reviewed frontend routing, API-client use, state/error/empty flows, forms, persistence, rendering, responsiveness, and accessibility affordances. - Executed default-SQLite paths identified as risky by source inspection. ### Commands executed - Targeted `rg`, `Get-Content`, EF model/migration inspection, and disposable endpoint/worker checks V-031 through V-033. ### Evidence collected - `evidence/runtime-evidence.md`, `evidence/two-user-isolation.md`, and line-numbered source locations used in the main report. ### Findings recorded - Confirmed default-SQLite API failures, ambiguous routes, inert tenant-scoped workers, non-atomic attachment/file operations, and client-only notification preferences. ### Checks that remain - Manual browser-dependent UX/accessibility checks remain blocked. ### Blockers and limitations - No MariaDB server was available, so provider parity beyond source/migration inspection is unverified. ### Next phase - Phase 4 — hands-on user journeys. ## Phase 4 — Hands-on user journey audit Status: Complete to the available evidence boundary ### Work completed - Ran isolated Chromium coverage for login, manual saved-job creation, Career Workspace shell, and anonymous public-CV/PDF. - Used two synthetic accounts for empty-account, ownership, job, correspondence, CV, workspace, attachment, settings, and admin API checks. - Classified every discovered workflow in `user-journey-audit.md`. ### Commands executed - V-026 and V-030 through V-040 in `verification-log.md`. ### Evidence collected - `evidence/browser-evidence.md`, `evidence/runtime-evidence.md`, and `evidence/two-user-isolation.md`. ### Findings recorded - Core Career/Application Workspace failures and accessibility/browser-regression gaps. ### Checks that remain - Manual viewport, keyboard, console/network, slow-network, multi-tab, and failure-injection journeys. ### Blockers and limitations - Mandatory in-app browser client missing; no permitted fallback and no screenshots. - Real email/OAuth/AI/billing services intentionally not contacted. ### Next phase - Phase 5 — threat model and security audit. ## Phase 5 — Threat model and security audit Status: Complete ### Work completed - Modelled assets, roles, entry points, trust boundaries, flows, attacker capabilities, abuse cases, mitigations, and high-risk paths. - Reviewed authentication, authorization/IDOR, sessions, OAuth/OIDC, CSRF/XSS/SSRF, uploads, CORS/headers, secrets, rate limiting, containers, and AI boundaries. - Performed two-user direct-ID and live logout/verification lifecycle checks. ### Commands executed - V-031 and V-035 through V-037, secret scans, source searches, and official Microsoft identity-documentation lookup. ### Evidence collected - `security-threat-model.md`, two-user matrix, runtime evidence, and filenames-only secret evidence. ### Findings recorded - Microsoft identity binding, host-derived recovery links, verification/session gaps, parser advisories, and lower-severity SSRF/rendering hardening. ### Checks that remain - External-provider exploit reproduction was not safe/in scope; prerequisites remain explicit. ### Blockers and limitations - No aggressive testing, production contact, real provider tokens, or real email. ### Next phase - Phase 6 — technical privacy assessment. ## Phase 6 — Technical privacy assessment Status: Complete ### Work completed - Traced identity, profile/CV, job, correspondence, attachment, provider token, AI, document, log, backup, export, and deletion lifecycles. - Separated technical controls from legal-policy questions. ### Commands executed - Targeted owner/entity/file/export/delete/provider/AI source inspection. ### Evidence collected - Privacy sections in the main report and threat model. ### Findings recorded - Incomplete admin deletion/export and missing per-user global AI control/provider-recipient explanation. ### Checks that remain - Production retention, logs, backups, processor contracts, and legal basis require operator/legal evidence. ### Blockers and limitations - Technical assessment only; production/provider contracts not accessed. ### Next phase - Phase 7 — dependencies and supply chain. ## Phase 7 — Dependencies and supply chain Status: Complete ### Work completed - Audited advisories, deprecations, version drift, locks, Docker bases, CI actions, remote installers, and licence/SBOM controls. - Re-read advisory descriptions against actual upload/model paths. ### Commands executed - V-020 through V-025, V-028/V-029, V-041/V-042, and Dockerfile/CI inspection. ### Evidence collected - `evidence/dependency-evidence.md`. ### Findings recorded - Reachable document-parser denial of service, moderate React Router advisories, and reproducibility/provenance gaps. ### Checks that remain - Container package CVEs and full licence compatibility need dedicated scanners/legal review. ### Blockers and limitations - Trivy/gitleaks/hadolint unavailable; no dependency upgraded. ### Next phase - Phase 8 — reliability, deployment, and recovery. ## Phase 8 — Reliability, deployment, and recovery Status: Complete ### Work completed - Reviewed Compose/Dockerfiles, health/startup, shutdown, resources, migrations/reconciliation, deploy/rollback, logging, metrics, workers, partial failure, and backups. - Rehearsed SQLite database and full-data-root restoration with disposable data. ### Commands executed - V-016/V-017/V-023 through V-025/V-033/V-034 plus deployment-source inspection. ### Evidence collected - Restore results in `evidence/runtime-evidence.md`. ### Findings recorded - SQLite restore passes; files/keys/config are separate; MariaDB needs external backup; no RPO/RTO or routine restore proof; workers fail silently; startup reconciler is risky complexity. ### Checks that remain - MariaDB restore, production rollback, restart/resource pressure, and monitoring delivery. ### Blockers and limitations - No production deployment, registry, remote host, or MariaDB instance used. ### Next phase - Phase 9 — testing assessment. ## Phase 9 — Testing assessment Status: Complete ### Work completed - Mapped backend, frontend, Python, and browser tests to core journeys and observed defects. - Reviewed determinism, isolation, authorization, failure paths, accessibility, and CI gates. ### Commands executed - V-010/V-012/V-014/V-026 plus test-file and CI-workflow inventories. ### Evidence collected - Test mapping in the main and journey reports. ### Findings recorded - Missing route-table, default-SQLite HTTP, worker-context, account-lifecycle, accessibility, and Python CI gates. ### Checks that remain - Remote CI execution status was not queried. ### Blockers and limitations - Raw line coverage was not used as proof of quality. ### Next phase - Phase 10 — performance assessment. ## Phase 10 — Performance assessment Status: Complete to safe-local scope ### Work completed - Measured warm local API latency and aggregate export size; inspected pagination, query patterns, upload buffering, worker sequencing, and admin N+1 behaviour. - Separated measured results, clear inefficiencies, measurement-needed risks, and optional optimisation. ### Commands executed - V-038/V-039 and query-loop/pagination inspection. ### Evidence collected - `evidence/runtime-evidence.md` performance table. ### Findings recorded - Small-data timings healthy; pre-limit buffering clearly inefficient; larger-data/browser capacity unverified. ### Checks that remain - Production-like transfer, memory, query counts, AI latency, email throughput, and large datasets. ### Blockers and limitations - No load test; browser performance tooling blocked. ### Next phase - Phase 11 — documentation and developer experience. ## Phase 11 — Documentation and developer experience Status: Complete ### Work completed - Compared feature/setup/architecture/migration/test/deploy/API claims with source and runtime; evaluated clean onboarding. ### Commands executed - Phase 1 documentation inventory plus toolchain/build/runtime verification. ### Evidence collected - Repository inventory and main-report documentation section. ### Findings recorded - Obsolete CRA README, unsupported PostgreSQL advice, stale API architecture, no `global.json`, incomplete environment reference, and stale CI comments. ### Checks that remain - Operator-only documentation may exist outside the repository. ### Blockers and limitations - External documentation not accessed. ### Next phase - Phase 12 — sceptical validation. ## Phase 12 — Sceptical validation Status: Complete ### Work completed - Re-read every Critical/High candidate end to end, searched mitigations, repeated safe reproductions, checked prerequisites, and merged/downgraded overlap. - Separated parser reachability from fixed-model loader advisories. - Confirmed no cross-user disclosure in meaningful two-user results. ### Commands executed - V-031 through V-043, official Microsoft identity guidance lookup, source rereads, and final cleanup/status checks. ### Evidence collected - All deliverables and evidence under `docs/audits/`. ### Findings recorded - No Critical finding. High findings retain explicit prerequisites; unperformed external exploits remain labelled unverified. ### Checks that remain - Only blocked/production/external checks listed in the reports. ### Blockers and limitations - Missing browser client, no MariaDB, no container CVE scanner, no production/provider access. ### Next phase - Stop after delivery and await remediation approval. ## Post-audit programme execution — POL-002 Status: Implemented; browser/production verification incomplete (2026-08-03). ### Work completed - Revalidated AI privacy/provider paths and implemented server-persisted AI opt-out plus explicit external-processing consent. - Added independent backend/sidecar administrator gates and a deny-by-default permission header at the shared `/cv/*` boundary. - Added Settings UI, additive migration, architecture/verification documentation and synthetic-only tests. ### Commands and evidence - Verification-log entries V-089 through V-095. - `docs/verification/pol-002-ai-privacy.md` and `docs/audits/evidence/pol-002/README.md`. ### Findings / limitations - No production, paid provider, real private data or browser was used. - Historical EF-only clean SQLite migration remains blocked before the new migration; the new SQL/defaults and model snapshot pass inspection. - AI-001/002 must add durable policy snapshots, actual provider/reason recording and bounded local-first fallback before rollout. ### Next phase - AI-001 durable AI queue/worker admission, reusing OPS-001A/B/C. ## Post-audit programme execution — AI-001 Status: Implemented; real-handler/browser/production verification incomplete (2026-08-03). - **Work completed:** shared Pro/privacy admission, bounded capacity/priority, typed default-off worker, owner/policy recheck, heartbeat/timeout/retry/cancellation integration and configuration. - **Commands/evidence:** verification-log V-096/V-097; `docs/verification/ai-001-durable-ai-queue.md`. - **Findings:** no new schema/raw private queue payload; multi-replica capacity needs a future database reservation; actual 202 producers and provider controls remain AI-003/004 and AI-002. - **Blockers:** browser, MariaDB and production unavailable; worker intentionally off. - **Next phase:** AI-002 Ollama adapter and central local-first routing. ## Post-audit programme execution — AI-002 Status: Implemented; browser/model/provider/production verification incomplete (2026-08-09). - **Work completed:** revalidated every AI endpoint/caller; replaced direct configured-provider dispatch with one sequential local-first router; added task/consent/config/prompt-cost gates, bounded circuit/health state, typed sanitized failures and actual provider/model/route persistence for AI history and durable operations. - **Commands/evidence:** verification-log V-098–V-100; `docs/verification/ai-002-provider-routing.md`; `docs/audits/evidence/ai-002/README.md`. - **Findings:** no schema/dependency change and no provider race. New durable tasks fail safe to local until allowlisted. Per-request prompt ceiling exists, but complete monthly cross-feature accounting remains incomplete. Circuit state is process-local for the current single-sidecar design. - **Checks that remain:** real AI-003/004 handlers/producers; selected-model benchmark; browser disclosure; MariaDB; controlled synthetic external fallback; production health/restart/canary/rollback. - **Blockers and limitations:** no browser, production access, model benchmark or provider authority/configuration; no real/private input used. - **Next phase:** AI-003 Strategy Snapshot durable-operation migration. ## Post-audit programme execution — AI-003 Status: Implemented; browser/model/MariaDB/restart/production verification incomplete (2026-08-09). - **Work completed:** replaced synchronous Focus Plan generation with a typed `strategy.snapshot` producer/handler on the shared durable queue; GET is cache-only; added owner-scoped rehydration, one bounded structured model request, full-response validation, idempotent active work, resume lookup, provenance and explicit UI queue/cancel/retry/failure/completion states. - **Commands/evidence:** verification-log V-101–V-103; `docs/verification/ai-003-strategy-snapshot-queue.md`; `docs/audits/evidence/ai-003/README.md`; commit `a621226`. - **Findings:** root code path was four sequential model calls in an HTTP GET, sometimes alongside candidate fit. Authorization/tenant filters existed. No schema/dependency change was needed. Strategy remains local-only and the worker remains default-off. - **Checks that remain:** real browser responsive/theme/keyboard/refresh checks; selected-model timeout/quality; MariaDB; real restart recovery; production telemetry/canary/rollback; cross-feature usage accounting. - **Blockers and limitations:** browser policy, production access and model/MariaDB environments unavailable; fake model/synthetic data only. - **Next phase:** AI-004 CV-processing 504 durable-operation migration.