jobtrackingapp/docs/application-discovery-report.md

Jobjakt — Application Discovery Report

Date: 2026-07-17 Method: read-only audit. Every claim below verified against code at the cited path, not against documentation. Scope: full application (backend, frontend, AI sidecar, infra, docs, competitor research).

---

1. Executive summary

Jobjakt is a substantially more complete product than its documentation suggests, built around a genuinely differentiated core: a self-hosted, local-AI job tracker with Gmail correspondence import and a human review queue. That combination is ahead of the paid market (Teal, Huntr, Jobscan all lack inbox auto-tracking). The backend is mature — 19 controllers, ~9.3k lines of controller code, ~7.5k lines of services, 36 test classes including dedicated authorization and SSRF-guard suites, real multi-tenancy via EF global query filters, 2FA, trusted devices, session management, and a working CI/CD pipeline to production.

The gap is not capability. It is three structural mismatches between what the product says it is and what the code models:

1. There is no Job entity. The only entity is JobApplication, and the pipeline's first stage is Applied (JobTrackerApi/Services/JobPipeline.cs:24). The glossary states "A Job may exist before an application is submitted" and the target workflow is Add Job → prepare CV → prepare cover letter → submit → track. The data model cannot represent a job you have not yet applied to. This single fact blocks the top-priority workflow in docs/MASTER_IMPLEMENTATION_GUIDE.md.
2. The CV Builder does not exist. CareerWorkspacePage renders a "CV Builder" tab that passes a careerView prop to ProfilePage — and that prop is destructured and never read (job-tracker-ui/src/views/ProfilePage.tsx:231). Both tabs render identical content. CV "themes" are five hardcoded C# string-interpolated HTML functions (JobTrackerApi/Services/CvTemplateRenderer.cs:22), which cannot express any of the content/design separation the guide requires.
3. The documentation is a scaffold, not a description. 139 active doc files; the median is ~480 bytes — a title and one generic sentence. docs/research/flowcv-analysis.md opens with "TODO: Complete documentation." The four ADRs in docs/_archive/decisions/ are 0 bytes. Meanwhile docs/_archive/SYSTEM_OVERVIEW.md (20 KB) and docs/_archive/PRODUCT_RESEARCH.md (13 KB) are excellent, evidence-based, and mostly still accurate. The real documentation was archived and replaced with stubs.

Nothing here needs a rewrite. The build order that follows is: fix the data model so the core workflow is representable, then delete the fake CV Builder and build a real one on a data-driven theme system.

Severity-ranked headline issues

#	Issue	Impact	Evidence
1	No pre-application Job state; pipeline starts at Applied	Blocks the guide's #2 priority workflow entirely	Services/JobPipeline.cs:24
2	CV Builder tab is inert — careerView prop never read	Ships a visible feature that does nothing	views/ProfilePage.tsx:231
3	AI sidecar has zero auth, port 8001 published to host	Unauthenticated LLM access; burns Gemini/Groq API key	docker-compose.yml, tools/summarizer/app.py
4	DataProtection keys remain in git history	Untracked in 519c32e but recoverable; rotation still open	git log --all -- JobTrackerApi/keys
5	Active docs are stubs; real docs archived	Every future AI session starts from fiction	wc -c docs/**/*.md
6	Two god controllers (2313 + 2249 lines)	Violates the guide's own "avoid massive controllers" rule	Controllers/JobApplications*.cs, ProfileCv*.cs

---

2. Current product understanding

2.1 What it actually is

A self-hosted, multi-user job application tracker with a local-AI career assistant bolted on correctly — the AI is grounded in the user's real parsed CV rather than free-floating, which is the architecturally right answer to the "AI slop" complaint that dominates competitor reviews.

Production deployment: https://jobs.cesnimda.uk via Gitea Actions → SSH → Docker Compose.

2.2 Target users

Matches the documented personas, with one caveat: the app currently serves exactly one persona — the owner. Auth:AllowRegistration defaults to false (Controllers/AuthController.cs:135), so registration returns HTTP 403 unless explicitly enabled. Multi-tenancy is implemented (every entity carries OwnerUserId, enforced by global query filters); it is simply not open.

The job-import plugins are Norwegian-market specific: Finn, NAV, Jobbnorge, LinkedIn (Services/JobImport/Plugins/). This is a real, unstated product decision — Jobjakt is currently a Norway-focused tracker.

2.3 Current feature reality vs the stated hierarchy

The guide's hierarchy is CORE: Job Tracking → Applications → Workflow → Follow-ups → Communication, then SUPPORTING: Career Profile → Master CV → CV Builder → Cover Letters → Portfolio → Interview Prep, then ENHANCEMENT: Job Discovery.

Measured against the code:

Layer	State
Job Tracking	✅ Strong — but starts at "Applied", so the pre-application half is missing
Applications	✅ Strong — 38 endpoints, rich lifecycle
Application Workflow	🟡 The add-job wizard exists; the pipeline it feeds cannot hold a not-yet-applied job
Follow-ups	✅ Strong — reminders, rules engine, auto-ghosting, AI drafts, send
Communication Tracking	✅ Best-in-class — Gmail OAuth + review queue, IMAP, MS Graph
Career Profile	🟡 Exists as a JSON blob, not a queryable model
Master CV	✅ Upload → OCR → parse → structured profile works
CV Builder	❌ Does not exist (inert tab)
Cover Letters	✅ AI generation + drafts exist
Portfolio	❌ Attachment slot only; no portfolio model
Interview Preparation	✅ Endpoint exists (/interview-prep)
Job Discovery	❌ Zero code

The inversion risk the guide warns about has not happened. Job tracking is decisively the strongest part of the app. The CV system is the weakest. If anything, the docs over-invest in CV builder prose relative to what the product needs.

2.4 Current user journey (as actually coded)

Owner logs in (registration off)
  ↓
Dashboard — stats + dismissible 2-item checklist
  ↓
Add Job wizard: URL → preview/extract → verify → CV → cover letter → portfolio → files
  ↓
Job saved directly as "Applied"        ← the workflow's premise is broken here
  ↓
Track: status / follow-ups / correspondence / AI assists

---

3. User journey analysis

3.1 New user journey

Current:

• Landing — views/LandingPage.tsx (265 lines), redirects authenticated users.
• Registration — endpoint exists (POST /api/auth/register) but is 403 by default, and there is no /register route in the router. Sign-up is folded into LoginPage.tsx.
• Login — solid: email/password, Google, Microsoft, 2FA challenge, trusted devices.
• First setup — OnboardingChecklist.tsx: two items (upload CV, add a job), dismissible to localStorage, auto-hides when both are done.

Target: Signup → Create profile → Add/import CV → Add first job → Prepare application

Missing steps:

• Signup is off and has no dedicated screen.
• No "create profile" step — the profile is a side-effect of CV upload.
• No email-verification gate in the flow (POST /auth/verify-email exists; nothing forces it).
• No "connect email" step, despite Gmail import being the strongest differentiator — it is buried in /settings/connected-accounts.
• No "prepare application" step — the wizard ends at save.

Confusing areas:

• The onboarding checklist infers "has CV" from profileCvText being non-empty (OnboardingChecklist.tsx:31) — a text field, not the structured profile. A user with a parsed profile but empty text would be told to upload a CV again.
• Dismissal is permanent per-user in localStorage; there is no way back.
• /profile and /career both render ProfilePage, differing only by a careerOnly boolean. Two nav destinations, one component, overlapping content — this is precisely the "everything should have one obvious place" rule being broken.

UX problems: onboarding is a checkbox list, not a guided flow. The guide asks users to always know "what happens next"; the checklist answers that twice and then never again.

3.2 Job workflow

Current — genuinely good, and better than the docs claim:

• Adding jobs — AddJobModal.tsx (618 lines) implements a 6-step wizard: ["Add job", "Review details", "CV", "Cover letter", "Portfolio", "Additional files"] with skippable optional steps (AddJobModal.tsx:368). Landed in commit aa3567d.
• Importing — POST /api/jobimport/preview → UniversalJobParser + per-site plugins + JSON-LD fallback, language detection, skill tagging.
• Editing — EditJobDialog.tsx, JobDetailsDialog.tsx (1400 lines).
• Stages — free-text Status canonicalized by JobPipeline.Normalize, preserving unknown values (a good, non-destructive design).
• Follow-ups — FollowUpReminderHostedService, RulesEngine (auto-ghosting), AI drafts, send.
• Communication — Correspondence per application; Gmail/IMAP/Graph import with review queue.

Target: Add Job → Import from URL → Extract → Verify → Choose/Create company → Add CV → Generate CV → Cover letter → Portfolio/files → Application tracking

Gap analysis — the wizard already matches the target almost exactly. Two things are missing, and one is fatal:

1. Fatal: the destination stage does not exist. The wizard walks the user through preparing an application, then must save it as Applied. There is no Saved / Interested / Preparing stage (JobPipeline.cs:24-31 — stages are Applied, Waiting, Interview, Offer, Rejected, Ghosted). The wizard's whole premise — prepare before applying — has nowhere to land. Users must either lie about having applied or not use the wizard as intended.
2. "Generate CV if needed" is absent from the wizard. Generation exists (POST /jobapplications/{id}/generate-tailored-cv-draft) but only after the job exists, from the job detail view. The wizard's CV step is an upload field only.
3. Import is preview-only. JobImportController exposes exactly one endpoint (/preview). Persistence goes through the generic create path. This is fine, but it means no import history, no re-import, no dedup at import time (dedup exists separately at /duplicate-check).

Company selection is handled — CompaniesController + reusable Company entity, matching the documented Company → Job → Application intent at the company level.

3.3 Career workflow

Current:

• Profile — ProfilePage.tsx (1368 lines): personal details, avatar with cropping, CV upload, structured profile editing, 2FA/session cards.
• CV — upload → CvUploadArtifact → CvExtractionRun (OCR/parse, versioned with parser/normalizer/prompt versions — a genuinely good audit design) → StructuredCvProfile JSON → applied to ApplicationUser.ProfileCvStructureJson.
• AI — rewrite-section, rewrite-preview, improve, parse, reprocess, rebuild, export-pdf.

Target: Profile → Master Career Profile → Master CV → CV Builder → Tailored CVs → Cover Letters

Gaps:

• Master Career Profile is a JSON blob on the Identity user (Models/ApplicationUser.cs:9). It works and is defensible for a single-writer app, but: skills are not queryable, there is no per-section version history at the DB level, and two concurrent editors clobber each other wholesale. The StructuredCvProfile shape covers Summary, Jobs, Education, Certifications, Projects, Skills, Languages, Interests, OtherSections — the guide additionally names Achievements/Awards, Publications, Organisations, References, which have no home beyond generic OtherSections.
• Master CV vs Career Profile are conflated. The glossary is explicit that "The career profile is NOT a CV" and Master CV is a generated representation. In code there is one blob and no generated-master concept.
• CV Builder — missing entirely (§10).
• Tailored CVs — this part works well. TailoredCvDraft is a separate entity per application, and the master is never auto-overwritten. The single most important documented invariant is correctly implemented.
• CV Variants (Software Engineer CV / Management CV) — not modelled. Only per-application tailored drafts exist.

---

4. Architecture overview

4.1 Backend

• Framework: ASP.NET Core net9.0, EF Core 9, ASP.NET Identity.
• Projects — the layout is unusual and must be understood before touching it:

Project	Role
JobTrackerApi/	Web host only — Program.cs, appsettings, migrations, Dockerfile. Its csproj excludes its own Controllers/** and Services/**.
JobTrackerBackend/	"Transitional shared-backend" library that link-compiles ../Data, ../Models, ../JobTrackerApi/Controllers, ../JobTrackerApi/Services via <Compile Include>. Exists so tests can reference controllers without the web host.
JobTrackerApi.Tests/	xUnit, 36 test classes.
Models/, Data/ (repo root)	The real EF models and JobTrackerContext.

The files live in one place and compile from another. Any tooling that assumes csproj-adjacent source will mislead you.

• Controllers (19): god-object problem is real and violates the guide's own rule —

  Controller	Lines
  JobApplicationsController	2313
  ProfileCvController	2249
  GmailController	1023
  AuthController	879

  JobApplicationsController alone exposes 38 endpoints.

• Services (~40): notable — StartupInitializationExtensions (1356 lines, a second god object), SummarizerService (671), GmailOAuthService (655), JobApplicationHelpers (622), MicrosoftGraphOAuthService (507), CvTemplateRenderer (448).

• Authentication: "smart" policy scheme routes by token issuer — Google ID tokens → google handler, else → local JWT (symmetric key, issuer/audience validated). Cookie sessions (jobtracker_auth, HttpOnly, SameSite=Lax) with CSRF double-submit enforcement on mutating requests. Auth:Require=true in prod sets authorize-all fallback. Local tokens must carry a subject claim — hardened after finding M013-2.

• Database: SQLite default; MariaDB/MySQL switchable via Database:Provider. 10 migrations.

• Background jobs: RulesHostedService, FollowUpReminderHostedService, DailyExportHostedService, JobEnrichmentHostedService, DatabaseBackupHostedService, CvProcessingQueue, SummarizerProbeHostedService.

• External integrations: Google OAuth/Gmail API, Microsoft Graph, IMAP, SMTP, LibreTranslate (optional), job sites (Finn/NAV/LinkedIn/Jobbnorge), Playwright (PDF).

• AI integration: not in-process. The backend HTTP-calls a FastAPI sidecar (tools/summarizer/app.py, 866 lines) exposing /health, /cv/normalize, /cv/classify-block, /cv/rewrite, /summarize, /extract-text. The sidecar picks a provider from a process-wide env var AI_PROVIDER ∈ {ollama, gemini, groq}.

  The documented AI architecture does not exist. docs/00-ai-context.md describes a provider interface fanning out to OpenAI / Gemini / Claude / Ollama, admin-controlled, with users never locked to one model. Reality: one env var, one provider per deployment, no OpenAI, no Claude, no admin control, no per-user selection.

4.2 Frontend

• Framework: Next.js 16 + React 19 + TypeScript 5.9 + MUI 7.
• Routing — three stacks coexist. Next.js App Router (app/layout.tsx, app/page.tsx) is a shell that mounts a client-side react-router-dom v6 app. App.tsx uses both createBrowserRouter (public routes) and a nested <Routes> inside a catch-all Shell (authenticated routes). Meanwhile react-scripts 5.0.1 is still a dependency, used solely as the test runner ("test": "react-scripts test"). This is a CSR lift-and-shift: none of Next's SSR/routing/data value is realized, and the app pays for three toolchains. A known dev-only 404 on deep links follows directly from this.
• Components (~34): largest are JobDetailsDialog (1400), JobTable (786), Correspondence (732), DashboardView (666), AddJobModal (618).
• State management: none. No Redux/Zustand/React Query. Local useState + axios per component, with a hand-rolled refreshToken counter threaded through props. Two workspace-cache hooks exist (components/job-workspace/useWorkspaceTabCache.ts, useJobWorkspaceBaseData.ts). For an app of this size, the absence of a server-cache layer is the main driver of the large components.
• Styling: MUI sx + a custom theme.ts (439 lines), light/dark. Consistent, but design tokens live in component-level sx props (e.g. the identical boxShadow: "0px 8px 24px -12px rgba(15,23,42,0.12)" is repeated inline across pages).
• Major pages: Dashboard, Jobs, Kanban, Reminders, Companies, Correspondence (+review), Profile, Career, Settings (+connected accounts), Admin (audit/users/system), Trash.
• i18n: custom provider, EN + NB, 2130-line translation file.
• Design system: exists as a theme, not as a component library. There is no Storybook, no primitives layer.

4.3 Database

Entities (16 DbSets + Identity): Company, JobApplication, Correspondence, GmailConnection, GmailReviewDecision, MicrosoftGraphConnection, ImapConnection, Attachment, RuleSettings, UserRuleSettings, SystemEmailSettings, JobEvent, CvUploadArtifact, CvExtractionRun, TailoredCvDraft, TwoFactorRecoveryCode, TrustedDevice, UserSession.

Relationships: Company 1—* JobApplication 1—* {Correspondence, Attachment, JobEvent}, JobApplication 1—1 TailoredCvDraft, ApplicationUser 1—* {CvUploadArtifact, CvExtractionRun}.

Data duplication / debt:

• JobApplication conflates Job and Application — 43 members mixing opportunity data (JobTitle, Description, JobUrl, Salary*, Deadline, Tags) with application data (Status, DateApplied, ResponseReceived, FollowUpAt). Applying twice to the same reposted role duplicates the whole description. This is issue #1.
• Has* denormalized flags (HasResume, HasCoverLetter, HasPortfolio, HasOtherAttachment) duplicate what Attachments already says; there is a dedicated AttachmentFlagsRecomputeTests suite to keep them honest — a test that exists only because of the duplication.
• Tags is a JSON array in a string column — not queryable; /tags and /tag-trends must scan.
• CV text stored three times: CvExtractionRun.RawExtractedText, .NormalizedText, .StructuredProfileJson, plus ApplicationUser.ProfileCvText and .ProfileCvStructureJson. Deliberate (audit trail), but unbounded — no retention policy on extraction runs.
• AvatarImageDataUrl — base64 image in a DB column on the hot /auth/me path.
• Status is free-text — canonicalization is application-layer only; the DB accepts anything.

Migrations: only 10, with a SyncModelSnapshot migration — indicating the model drifted from migrations and was reconciled in bulk rather than incrementally.

4.4 Infrastructure

• Docker: 4 services — backend, frontend (nginx), ai-service, ollama (opt-in via bundled-ollama profile, GPU). External jobtracker_shared network.
• Deployment: Gitea Actions → SSH → deploy/deploy.sh → Docker Compose on the prod host.
• CI/CD: .gitea/workflows/ci-deploy.yml. Builds backend, runs all backend tests, runs the whole frontend suite, builds frontend. Notably the file carries a comment forbidding re-introducing the old test whitelist ("the previous whitelist silently skipped new suites and let two regressions reach main") — that debt is paid. The workflow is heavily defended with retries against a flaky self-hosted runner (dotnet install, npm ci SIGSEGV, build OOM). There is no GitHub Actions workflow — do not look in .github/.
• Environment variables: extensive, .env correctly gitignored, .env.example present.
• External services: Google, Microsoft, Ollama/Gemini/Groq, SMTP, LibreTranslate.

---

5. Feature inventory

5.1 Working

Feature	Purpose	Location	Problems	Recommendation
Job/application CRUD	Core tracking	Controllers/JobApplicationsController.cs	2313 lines, 38 endpoints	Split by concern (CRUD / AI / analytics / drafts)
Status pipeline	Lifecycle	Services/JobPipeline.cs	Starts at Applied	Add pre-application stages — issue #1
Kanban board	Visual pipeline	components/KanbanBoard.tsx (285)	—	Keep
Job table + saved views	List/filter	components/JobTable.tsx (786)	Large	Keep; extract later
Companies	Reusable orgs	Controllers/CompaniesController.cs	No people/contacts entity	Add contacts (competitors have it)
Job import from URL	Reduce entry	Services/JobImport/ + 4 plugins	Preview-only; NO-market only	Keep; add browser extension later
Add-job wizard	Guided flow	components/AddJobModal.tsx	Lands in Applied	Fix once #1 lands
Gmail import + review queue	Auto-tracking	Controllers/GmailController.cs, views/GmailReviewPage.tsx	1023-line controller	Protect — best differentiator
IMAP / MS Graph mail	Auto-tracking	Services/ImapService.cs, MicrosoftGraphOAuthService.cs	—	Keep
Correspondence log	Comms tracking	Models/Correspondence.cs, components/Correspondence.tsx	—	Keep
Follow-up reminders	Never forget	Services/FollowUpReminderHostedService.cs	—	Keep
Rules engine (auto-ghost)	Automation	Services/RulesEngine.cs	—	Keep
Attachments	Files per app	Controllers/AttachmentsController.cs	Denormalized Has* flags	Keep; drop flags later
CV upload → OCR → parse	Master CV	Controllers/ProfileCvController.cs, sidecar	2249-line controller	Split
Structured CV profile	Source of truth	Models/StructuredCvProfile.cs	JSON blob; missing awards/publications/refs	Relational later
Extraction run audit	Traceability	Models/CvExtraction.cs	No retention policy	Add TTL
Tailored CV drafts	Per-job CV	Models/TailoredCvDraft.cs	—	Correct — master never overwritten
CV PDF export	Deliverable	Services/PlaywrightCvPdfExporter.cs	—	Keep
Match score / candidate fit	Job↔CV fit	Services/JobCvMatchService.cs	—	Keep — top paid feature elsewhere
Interview prep	Prep	/jobapplications/{id}/interview-prep	Not surfaced as a hub	Give it a screen
Focus plan / readiness	Guidance	JobApplicationsController	—	Keep
AI cover letters / follow-up drafts	Reduce effort	JobApplicationsController	—	Keep
Application package generation	Bundle	/generate-application-package	—	Keep
Analytics	Insight	Services/AnalyticsService.cs, StageAnalytics.cs	Basic	Expand (funnel, time-in-stage)
Auth: password/Google/MS	Access	Controllers/AuthController.cs	879 lines; registration off	Split; open signup for SaaS
2FA + recovery codes	Security	Controllers/TwoFactorController.cs	—	Keep
Trusted devices	UX	Services/TrustedDeviceService.cs	—	Keep
Session management	Security	Controllers/SessionsController.cs	—	Keep
Rate limiting	Abuse	Program.cs:373 (login 10, email 5, 2FA 5)	No captcha	Add captcha before public signup
Multi-tenancy	Isolation	Data/JobTrackerContext.cs global filters	—	Correct — deny-on-null
Admin (users/audit/system)	Ops	Controllers/Admin*.cs	—	Keep
DB backup + daily export	Durability	Services/DatabaseBackup*.cs	—	Keep
i18n EN/NB	Reach	src/i18n/	—	Keep
Dark mode	UX	src/theme.ts	—	Keep

5.2 Partial

Feature	State	Location	Problem	Recommendation
Career Workspace	Shell only	views/CareerWorkspacePage.tsx (36 lines)	Tab wrapper around ProfilePage	Make it a real workspace
CV Builder	Inert	views/ProfilePage.tsx:231	careerView never read — both tabs identical	Delete tab or build it
CV themes	5 hardcoded	Services/CvTemplateRenderer.cs:22	C# string HTML: ats-minimal, harvard, auckland, edinburgh, monarch, fjord. No user customisation	Data-driven theme model
Onboarding	2-item checklist	components/OnboardingChecklist.tsx	Not a flow; infers CV from text field	Real guided flow
Registration	Endpoint only	AuthController.cs:135	403 by default; no /register route	Needed for SaaS
Portfolio	Attachment slot	AddJobModal step 4	No model, no page	Model it
Analytics	Basic stats	AnalyticsService.cs	No funnel/response-rate/time-in-stage	Expand
Profile vs Career	Duplicated	/profile and /career → same component	Two doors, one room	Separate concerns

5.3 Planned (documented, zero code)

Feature	Documented in	Reality
Job Discovery / search	docs/jobs/job-search.md, guide Phase 4	No code. Grep for JobSearch|discovery in backend → nothing
Public CV (/cv/{guid})	docs/00-ai-context.md, docs/career/public-profile.md	No code. No route, no IsPublic, no slug
SaaS: billing/subscriptions/quotas	docs/product/business-model.md (52 bytes), guide	No code. No Stripe, no plan, no quota, no usage tracking
Multi-provider AI w/ admin control	docs/00-ai-context.md	Single env var; no OpenAI/Claude; no admin UI
CAPTCHA	docs/00-ai-context.md	No code
Passkeys	docs/00-ai-context.md	No code
CV variants (SWE CV / Mgmt CV)	docs/01-glossary.md	No code — only per-app drafts
Interview prep hub	Guide	Endpoint exists; no screen
Calendar / ICS	docs/_archive/PRODUCT_RESEARCH.md	No code
Awards / Publications / Organisations / References	docs/00-ai-context.md	Not in StructuredCvProfile; only generic OtherSections

---

6. UI/UX review

Note on mockups: the discovery brief says "compare against existing mockups". No mockups exist in this repo. Prior sessions recorded a mockup set at F:\Pictures\website\jobtracker\new — not verified in this audit (out of scope, drive not read). Any redesign work must confirm that source first.

Page-by-page

Page	Assessment
Dashboard (DashboardView.tsx, 666)	Matches vision reasonably. Stats + reminders + onboarding. Problem: 666 lines, no data layer.
Navigation (layout/AppShell.tsx, 499)	Mostly clean. Problem: /profile and /career are two entries rendering one component — violates "one obvious place".
Authentication (LoginPage.tsx, 260)	Solid and complete. Problem: no dedicated signup screen; sign-up hidden inside login.
Settings (SettingsView.tsx)	Recently improved — connected accounts split out (d7d7e70). Good.
Jobs (JobTable.tsx 786 / KanbanBoard.tsx 285)	Strong. Saved views, columns, tags. Matches vision.
Profile (ProfilePage.tsx, 1368)	Needs redesign. 1368 lines doing profile + CV + AI + 2FA + sessions, forked by careerOnly. This is the worst file in the frontend.
CV Builder (CareerWorkspacePage.tsx, 36)	Missing. Tab exists, gated on hasMasterCv, and does nothing when enabled.
Upload flows (ProfilePage, AddJobModal)	Work. Async CV processing via CvProcessingQueue is right.

Requiring redesign

1. ProfilePage — split profile / career / security.
2. CareerWorkspacePage — currently a facade.
3. Onboarding — checklist → guided flow.
4. JobDetailsDialog (1400) — a dialog carrying an entire workspace.

Matching current vision

Dashboard, Jobs table, Kanban, Settings, Correspondence inbox + Gmail review, Login.

Missing screens

Signup, CV Builder (content + customise + preview + export), Public CV, Job Discovery, Interview Prep hub, Portfolio, Billing/plan.

---

7. FlowCV comparison

Analysed the local downloads at D:\FlowCV (Resume _ FlowCV.html, _customize.html, _overview.html). Text extracted from markup; no code, markup, assets, or branding copied.

FlowCV's structure

• Top-level tabs: Overview | Content | Customize | AI Tools, with Download always present.

• Overview: "My Resumes" list. "Your first resume is free forever. Need more than one resume? Upgrade your plan" — the free/paid line is drawn at resume count.

• Content: section-based editor, drag-and-drop entries (with documented keyboard drag affordances — accessible), "Add Entry" / "Add Content".

• Customize: a deep, fully data-driven control panel:

  Group	Controls
  Document Settings	Language, Date Format, Page Format (A4)
  Templates	"Update your entire resume design with one click", browse
  Layout	Columns (One/Two/Mix), Header Position (Top/Left/Right), section order, page breaks, column width (44%/56%)
  Font Size	Base (10pt) + deltas: Full Name +14pt, Section Headings +2pt, Entry Header +0pt
  Spacing	Line height 1.3, space between elements, L/R margin 18mm, T/B margin 16mm
  Entries	Structure (Full Width/Columns), Date & Location position (Right/Below Title)
  Headings	Capitalization (Capitalize/Uppercase), icons (None/Outline/Filled)
  Font	Body font (e.g. Zilla Slab), Name font (same/different)
  Colors	Area (Full Page/Column/Border), mode (Single/Multi/Image), accent applied per-element (Name, Job title, Headings, Header icons, Dots/bars, Dates, Entry subtitle, Link icons)
  Header	Text alignment, details arrangement (Icon/Bullet/Bar), 7 icon styles
  Photo / Links / Footer / Sections	—

• Preview: live, continuous, beside the editor.

• Export: persistent Download button — never a mode you enter.

• Notably: FlowCV also ships a Job Tracker. It is not a pure CV tool; it is a direct competitor converging on Jobjakt's territory from the CV side.

Jobjakt vs FlowCV

Dimension	FlowCV	Jobjakt
Content/design separation	Total — content is data, design is config	None — design is C# code
Templates	Browse + one-click swap	6 IDs in a switch (CvTemplateRenderer.cs:22)
User customisation	~40 controls	Zero
Preview	Live, side-by-side	Server round-trip → HTML/PDF
Export	Always-available button	POST /export-pdf via Playwright
Multi-resume	Yes (paywalled at 2+)	No variants; only per-app drafts
Job tracking	Bolted on	Core, and far deeper
AI grounded in real career data	Generic "AI Tools"	Yes — structured profile
Self-hosted / private	No	Yes

What Jobjakt must adapt (not copy)

1. The theme system must become data, not code. This is the single highest-leverage lesson. CvTemplateRenderer renders by string-interpolating HTML inside a C# switch — it can never express "base font 10pt, headings +2pt, accent applies to Name and Dates but not Headings". Model themes as a CvTheme document (layout, columns, header position, font family/sizes as base+deltas, spacing, colour targets, icon style) and render one parameterized template from it. Five hardcoded renderers are five things to maintain and zero things a user can adjust.
2. Overview | Content | Customize | Preview/Export is the right tab spine — and it maps onto Jobjakt's stated Content Tab → Customise Tab → Preview → Export.
3. Live preview beside the editor, not behind a request.
4. Drag-and-drop section ordering with keyboard support — FlowCV's accessibility affordances are worth matching.

What Jobjakt must NOT copy

• The paywall shape. FlowCV gates at resume count — the exact "free tier caps at the point of seriousness" frustration documented in docs/_archive/PRODUCT_RESEARCH.md. Jobjakt's differentiator is privacy + self-hosting; gating CV count would surrender it.
• CV-first framing. FlowCV is a CV tool that added a tracker. Jobjakt is a tracker; the guide is explicit — "Do not transform Jobjakt into a CV generator."
• Control sprawl. ~40 customisation controls contradicts "avoid excessive configuration". Ship the ~12 that matter (template, columns, header position, accent, base font size, font family, spacing, margins, photo on/off, section order, date position, heading case).
• Any code, markup, asset, or branding.

---

8. Competitor alignment

⚠️ CORRECTION (2026-07-17, during Phase 0)

The claim below — that Novoresume/Reactive Resume/ElegantCV are not analysed in this repo — is WRONG. It was true of main and of docs/_archive/, which is all this audit searched. It is not true of the repository.

A feature/career-workspace branch exists (local and on origin, 10 commits, unmerged, last touched 2026-07-12) carrying:

• docs/cv-builder-competitor-deep-research.md (327 lines) — deep teardowns of Novoresume, Reactive Resume, FlowCV, Teal, Enhancv, Canva, Resume.io, Kickresume, with a feature matrix and a business-model analysis.
• docs/cv-builder-product-teardown.md (321 lines)
• docs/career-workspace-product-strategy.md (328 lines) — vision, positioning, four personas.
• docs/career-workspace-implementation-roadmap.md (124 lines) — an ADR-grade plan with phases F0–F5, F0–F2 marked shipped.

Its conclusions independently reach the same findings as §7 and §10 of this report — "the winning editor model is structured-form + live preview, not canvas", client-side preview is a hard requirement, and themes must be declarative data. That is corroboration, not duplication.

The audit's method was too narrow: I searched the working tree and docs/, never git branch -a. See §13 and the Phase 0 report for the full consequences. Roadmap task 4.9 ("research Reactive Resume") is therefore already done — on that branch.

docs/research/ on main is unusable for this step. Every file is a stub; flowcv-analysis.md literally begins "TODO: Complete documentation." The archived docs/_archive/09-research/*.md are 0 bytes. The only competitor research reachable from main is docs/_archive/PRODUCT_RESEARCH.md (13 KB, sourced, dated 2026-07-02) — which covers the tracker market (Teal, Huntr, Simplify, Jobscan, OSS self-hosted), not the CV-builder market the brief asks about.

Therefore: Novoresume, Reactive Resume, and ElegantCV are not analysed in this repo at all. Superseded — see the correction above. They are analysed, on feature/career-workspace.

From FlowCV (verified) + PRODUCT_RESEARCH.md (archived, spot-checked):

What they do better:

• Data-driven theme/customisation systems (FlowCV, Reactive Resume) — Jobjakt has none.
• Live side-by-side preview.
• Browser extension capture (Teal, Huntr, Simplify) — Jobjakt is server-side parse only.
• Deep analytics: funnel, response rate, time-in-stage (Teal/Huntr premium) — Jobjakt has basic stats.
• Contact/people CRM (Teal, Huntr) — Jobjakt is company-level only.
• Interview scheduling + calendar (emerging) — Jobjakt has none.

What Jobjakt does better (protect these):

• Inbox auto-tracking with a human review queue — Teal ❌, Huntr ❌, Simplify 🟡. This is ahead of the paid market.
• Local-AI tailored CVs grounded in the user's real structured CV — directly answers the #1 competitor complaint ("AI slop / hallucinated skills").
• Rules engine + auto-ghosting — richer than most.
• Self-hosted privacy — the stated moat; every OSS alternative (JobSync, CareerSync, career-ops) is far less complete.
• AI features free and local where competitors charge $29–50/mo.

What should not be copied: count-based paywalls; autofill-at-scale / auto-apply (LazyApply, LoopCV — spray-and-pray contradicts "apply to more suitable jobs"); job-board ambitions (explicit non-goal); generic AI chat (explicit non-goal).

---

9. Architecture assessment

9.1 Career Workspace — ❌ Not supported

Requirement	Verdict
Master career profile	🟡 Exists as a JSON blob on ApplicationUser. Works; not queryable; no section-level history; missing awards/publications/organisations/references
CV versions	❌ No variant model. TailoredCvDraft is per-application only. Nothing satisfies the glossary's "CV Variant"
CV themes	❌ Hardcoded C# renderers. No theme entity, no user customisation. Cannot be extended without a rewrite of CvTemplateRenderer
Public CV	❌ Zero code. No route, no IsPublic, no slug, no anonymous read path

Verdict: the current system does not support the Career Workspace as documented, and cannot be incrementally coaxed into it. The theme system in particular is a structural dead end — it is not a matter of adding templates.

9.2 AI — ✅ Largely supported

Requirement	Verdict
CV generation	✅ Parse → structure → tailor → render → PDF, all working
Job matching	✅ JobCvMatchService, /match-score, /candidate-fit
Cover letters	✅ Generation + drafts
Interview preparation	✅ Endpoint exists — but no UI surface

AI is the healthiest supporting area. Grounding in the structured profile is the right architecture, and "AI never has final control" is genuinely upheld (drafts are separate entities; the master is never auto-written).

Caveat: the provider layer does not match its documentation (§4.1) and has no cost control, quota, or per-user selection. docs/ai/cost-control.md is 380 bytes of nothing; with AI_PROVIDER=gemini and an unauthenticated sidecar, there is no ceiling on spend.

9.3 SaaS — ❌ Not supported

Requirement	Verdict
Multiple users	✅ Genuinely solid. OwnerUserId everywhere + deny-on-null global query filters + a dedicated authorization test suite. The hard part is done
Premium features	❌ No plan/tier/entitlement concept anywhere
Usage limits	❌ No quota, no usage tracking. AI is unmetered — the direct cost risk
Storage	❌ No limits. Attachments, CV artifacts, extraction runs, base64 avatars all unbounded

Also blocking: registration is off by default and has no UI; there is no CAPTCHA; there is no billing integration of any kind.

Verdict: multi-tenancy is ready; commercialisation is not started. That is the right order — but nothing should be built here until the core workflow (§9.1, issue #1) is fixed.

---

10. CV builder assessment

The CV Builder does not exist. This is the clearest finding in the audit.

Evidence:

1. views/CareerWorkspacePage.tsx:25 renders <Tab value="builder" label="CV Builder" disabled={!hasMasterCv} />.
2. :31 passes careerView={tab} into <ProfilePage careerOnly ... />.
3. views/ProfilePage.tsx:231 destructures careerView = "master", and :235 types it — and the identifier appears nowhere else in the codebase. Verified: grep -rn "careerView" job-tracker-ui/src/ returns exactly three lines — the call site and the two declarations.
4. Therefore selecting "CV Builder" re-renders identical content. The tab is a no-op that looks like a feature.

Both files (CareerWorkspacePage.tsx, ProfilePage.tsx) are uncommitted working-tree changes — this is in-progress work, not shipped deception. But as it stands the tab ships a promise the code does not keep.

What does exist: a template-driven renderer — POST /profile-cv/rewrite-preview, GET /profile-cv/templates, POST /profile-cv/export-pdf, and ProfilePage.tsx:970 ("Template-driven CV builder") / :1197 ("Choose a template and generate a live preview"). That is template selection plus a server round-trip, not a builder.

What is missing against docs/MASTER_IMPLEMENTATION_GUIDE.md:312 (Content Tab → Customise Tab → Preview → Export):

• No Content tab (section add/remove/reorder, entry-level editing).
• No Customise tab (nothing is customisable — no accent, no font, no layout, no photo toggle, no section config).
• No live preview (server request required).
• Export exists.

Structural blocker. CvTemplateRenderer.Render is:

templateId switch {
  "harvard"   => RenderHarvard(...),
  "auckland"  => RenderSidebar(..., roundedPhoto: false, curvedHeader: false),
  "edinburgh" => RenderSidebar(..., roundedPhoto: true,  curvedHeader: true),
  ...
}

Design decisions are C# method parameters and interpolated CSS strings. The guide requires themes supporting "Accent colours, Typography, Layout, Spacing, Photo options, Icons" — none of which can be expressed here without adding a boolean parameter per option and multiplying the switch. roundedPhoto/curvedHeader are already that pattern starting.

Recommendation: do not extend CvTemplateRenderer. Replace it with a CvTheme value object (layout, columns, header position, font family, base size + per-element deltas, spacing, margins, accent + application targets, icon style, photo settings) rendered by one parameterized template. Ship 3–5 themes as seeded theme documents, per the guide's "3-5 excellent themes". Delete the careerView prop or wire it — do not ship the inert tab.

---

11. Technical debt

Ranked by cost-to-carry:

1. JobApplication conflates Job and Application — blocks the primary workflow. Everything else on this list is cosmetic by comparison.
2. God controllers — JobApplicationsController 2313 / 38 endpoints; ProfileCvController 2249; GmailController 1023; AuthController 879; StartupInitializationExtensions 1356. The guide's own "Coding Philosophy" forbids exactly this.
3. Dead careerView prop — a shipped no-op tab.
4. Hardcoded CV templates — dead-end for the entire Phase 4.
5. Three frontend stacks — Next.js App Router shell + react-router v6 (×2 patterns: createBrowserRouter and nested <Routes>) + react-scripts as test runner. Pays three toolchain costs for one CSR app; causes the known dev-only deep-link 404.
6. No frontend data layer — no server-cache library; hand-rolled refreshToken counters threaded via props. Root cause of the 600–1400-line components.
7. ProfilePage at 1368 lines forked by a boolean, serving two routes.
8. Denormalized Has* flags — kept honest only by a dedicated test suite.
9. Tags as a JSON string column — unqueryable; forces scans in /tags, /tag-trends.
10. Unbounded CV text/artifact storage — no retention on CvExtractionRun; three copies of every CV.
11. AvatarImageDataUrl — base64 blob in a DB column on the /auth/me hot path.
12. Only 10 migrations + a SyncModelSnapshot — model drifted from migrations, reconciled in bulk.
13. JobTrackerBackend link-compilation — source lives in one place, compiles from another. Self-described as "transitional". Surprising to every new contributor and every tool.
14. Status free-text at the DB level — canonicalization is application-only.
15. Documentation debt (see §13) — 139 stub files masquerading as documentation; 4 zero-byte ADRs.

---

12. Security review

Prior work is real and good: docs/_archive/SECURITY_REPORT.md plus M013 (adversarial), M014 (remediation verification), M015 (authorization replay). Findings were fixed, not just filed — LocalAuthIdentity subject-claim enforcement and deny-on-null query filters both trace to M013-2.

Strong

• Multi-tenancy: global query filters CurrentUserId != null && OwnerUserId == CurrentUserId — deny-on-null, the correct default. Covered by JobApplicationsAuthorizationTests, OwnershipGuardTests.
• CSRF: double-submit cookie+header on mutating requests.
• Session cookie: HttpOnly, SameSite=Lax, Secure-configurable.
• Auth fails closed when required but unconfigured.
• Rate limiting: login 10/window, email 5, 2FA challenge 5.
• 2FA: TOTP, encrypted secrets, recovery codes, trusted devices.
• SSRF guard on IMAP — with a dedicated test (ImapServiceSsrfGuardTests).
• OpenAPI dev-only.
• Secrets: .env gitignored; DP keys and runtime exports untracked in 519c32e.

Open findings

Sev	Finding	Detail
High	AI sidecar unauthenticated + published	docker-compose.yml maps "8001:8001" to the host. tools/summarizer/app.py has no auth — no Depends, no API key, no token check (the only Authorization header in the file is outbound to Groq, line 480). Anyone reaching the host can call /cv/rewrite, /summarize, /extract-text — burning the Gemini/Groq key and running arbitrary text through the model. Recommendation: drop the host port mapping (expose: only — the backend reaches it on the compose network), and add a shared-secret header. Do not defer this if AI_PROVIDER=gemini or groq in production.
Medium	DataProtection keys in git history	Untracked in 519c32e, but git log --all -- JobTrackerApi/keys still returns commits — the keys remain recoverable from history. Flagged for rotation in the 2026-07-03 report; still open. Rotate.
Medium	No AI cost ceiling	No quota, no usage tracking, no per-user metering. Combined with the finding above, spend is unbounded.
Low	No CAPTCHA	Verified absent. Rate limiting only. Acceptable while registration is closed; required before opening signup.
Low	Unbounded storage	Attachments, CV artifacts, extraction runs, base64 avatars — no limits, no retention.
Low	SameSite=Lax	Appropriate for the OAuth redirect flows in use; noted, not a defect.

Not verified in this audit

Dependency CVEs (no npm audit / dotnet list package --vulnerable run — CI explicitly disables audit via npm_config_audit: 'false'). Recommend a scheduled scan.

---

13. Documentation assessment

This deserves its own section because it actively misleads.

Active docs (docs/, 139 files): the median file is ~480 bytes — a title and one generic sentence. Examples: docs/auth/login.md = 43 bytes. docs/product/business-model.md = 52 bytes. docs/cv-builder/themes.md = 44 bytes. docs/research/flowcv-analysis.md opens with "TODO: Complete documentation."

Archive (docs/_archive/, 344 KB): contains the genuinely good work — SYSTEM_OVERVIEW.md (20 KB, mermaid architecture, verified against a named commit), PRODUCT_RESEARCH.md (13 KB, sourced competitor analysis with links), SECURITY_REPORT.md, M013–M015 assessments, performance/memory-leak analyses.

The real documentation was archived and replaced with stubs. docs/AI_SESSION_START.md instructs every future AI session to read docs/product/, docs/architecture/, docs/security/, docs/technical/ — all stubs. An assistant following its own instructions learns nothing true and confidently builds on fiction. This is the highest-leverage cheap fix in the report.

The four ADRs are 0 bytes: ADR-001-master-career-profile, ADR-002-job-application-model, ADR-003-cv-rendering, ADR-004-ai-provider-system. Their titles name the four most consequential decisions in the system — and every one is undocumented. ADR-002 in particular would have recorded whether the Job/Application conflation was deliberate.

Archive triage

Restore to active (verify first — noted deltas below):

File	Status	Deltas since 2026-07-02
SYSTEM_OVERVIEW.md	Excellent — restore as docs/architecture/current.md	Now stale on 5 points: (1) frontend is Next.js 16 + TS 5.9, not CRA + TS 4.9; (2) root Controller/ dead folder is removed; (3) CI runs the whole frontend suite — the whitelist is gone; (4) match-score now exists; (5) salary is now structured (SalaryMin/Max/Currency/Period). Everything else spot-checked accurate.
PRODUCT_RESEARCH.md	Excellent — restore as docs/research/competitors.md	Feature matrix stale on the same 2 points (match-score, salary). Covers the tracker market only — no Novoresume/Reactive Resume/ElegantCV.
SECURITY_REPORT.md + M013–M015	Restore as docs/security/assessments/	Findings verified fixed; DP-key rotation still open.

Keep archived: s06-acceptance-run.md, s07-uat.md, jobbjakt-next-session.md, jobbjakt-cleanup-tracker.md, MERGE_REQUEST.md, gmail-correspondence-phase1.md — point-in-time session artifacts, correctly archived.

Delete: the 0-byte files (decisions/ADR-00{1,2,3,4}, 09-research/*, 10-development/known-issues.md). They imply content that has never existed.

Historical decisions worth preserving (recovered from archive + code, currently recorded nowhere active):

1. JobTrackerBackend link-compilation exists so tests can reach controllers without the web host — deliberate, self-described "transitional".
2. Status is free-text and canonicalized in the application layer specifically so custom user values are never destroyed (JobPipeline.cs docstring). Good decision; undocumented outside the source file.
3. The CI test whitelist was removed after it "silently skipped new suites and let two regressions reach main". Recorded only as a code comment in the workflow.
4. Ollama is intentionally not bundled by default (bundled-ollama profile) so deploys reuse a shared instance.
5. AI_PROVIDER=gemini exists specifically "to offload a weak local GPU" in prod (compose comment).

---

14. Recommended roadmap

Full task breakdown in docs/implementation-roadmap.md. Ordering rationale:

1. Phase 1 — Critical fixes. The Job/Application split gates the guide's #2 priority workflow; nothing downstream is worth building first. The unauthenticated AI sidecar is a live security exposure. Documentation restoration is nearly free and prevents every future session from building on fiction.
2. Phase 2 — UX. Onboarding + the Profile/Career split. Cheap, high-visibility.
3. Phase 3 — Career Workspace. Requires the profile model to be real.
4. Phase 4 — CV Builder. Requires Phase 3 + a data-driven theme system. The largest single piece of work in the plan.
5. Phase 5 — AI. Mostly polish; the hard part is done.
6. Phase 6 — Job Discovery. Greenfield; explicitly an enhancement.
7. Phase 7 — SaaS. Last, per the guide's "do not over-engineer before needed".

---

15. Risks

Risk	Likelihood	Impact	Mitigation
Job/Application split touches everything	High	High	38 endpoints, the Kanban, the table, the rules engine, and the wizard all assume one entity. Do it behind a migration + additive stage first (add Saved/Preparing to JobPipeline), then split the entity. Do not big-bang it.
CV Builder is scoped as a "tab" but is a subsystem	High	High	Theme model + content editor + live preview + customise panel ≈ the largest item in the plan. The inert tab makes it look nearly done. It is not started.
Unauthenticated AI sidecar exploited / API key drained	Medium	High	Remove host port mapping + add shared secret. Cheap; do it in Phase 1.
DP keys recoverable from git history	Medium	Medium	Rotate. Open since 2026-07-03.
Docs mislead the next session into rebuilding what exists	Certain	High	The add-job wizard, match scoring, and interview-prep already exist but read as "missing" from the stub docs. Restore SYSTEM_OVERVIEW.md first.
Norway-only import plugins vs SaaS ambition	Medium	Medium	Finn/NAV/Jobbnorge are NO-specific. International SaaS needs a plugin strategy or extension-based capture. Unstated product decision.
Frontend rewrite temptation	Medium	High	Three stacks invite a "clean rewrite". The guide forbids it. Consolidate incrementally: retire react-scripts as test runner, pick one router.
Unbounded AI/storage cost under multi-user	Medium	High	No quota exists. Must land before opening registration.
Mockups unverified	Medium	Medium	F:\Pictures\website\jobtracker\new referenced by prior sessions but not read here. Confirm before any redesign.
God controllers slow every change	High	Medium	Split opportunistically while doing Phase 1, not as a standalone refactor.

---

Appendix — verification method

Known method gap (found 2026-07-17): this audit searched the working tree, main, and docs/_archive/. It never ran git branch -a. That missed feature/career-workspace — 10 unmerged commits containing the CV-builder competitor research, a Career Workspace product strategy, an F0–F5 roadmap, and working code (CareerProfileService, CvVariant/CvVersion/TailoredApplication, interview-prep persistence) with tests. Two conclusions in this report (§8 "not analysed in this repo", and the §5.3 "planned, zero code" rows for CV variants) are wrong as a result; both are corrected in place. Any future audit of this repo must enumerate branches before concluding a feature does not exist.

Every other claim traces to a read of the code. Key verifications:

• careerView dead: grep -rn "careerView" job-tracker-ui/src/ → 3 hits (1 call site, 2 declarations), 0 reads.
• Pipeline stages: Services/JobPipeline.cs:24-31.
• No job discovery: grep -rln "JobSearch\|discovery" JobTrackerApi/ --include=*.cs → 0.
• No SaaS: grep -rlin "stripe\|subscription\|billing\|quota\|PlanTier" JobTrackerApi/ Models/ Data/ → 0.
• No public CV: grep -rn "IsPublic\|PublicSlug\|public-cv" Controllers/ Models/ → 0.
• No CAPTCHA: grep -rli "captcha" JobTrackerApi/ --include=*.cs → 0.
• Sidecar auth: grep -n "Depends\|api_key\|Authorization" tools/summarizer/app.py → only outbound Groq header.
• DP keys in history: git log --oneline --all -- JobTrackerApi/keys → 519c32e, 955cae6.
• Registration default: Controllers/AuthController.cs:135 — _cfg.GetValue("Auth:AllowRegistration", false).
• Doc sizes: wc -c across docs/**/*.md.

Not verified (out of read-only scope): mockups on F:\, dependency CVEs, production runtime configuration.