Jobjakt roadmap TODO

Updated 10 November 2026. This is the cross-phase work list. The source prompts, linked registers and acceptance criteria remain authoritative. Update the relevant row and latest checkpoint after each verified increment. A checked item means its stated scope is complete. Partial means evidence or implementation exists. Gated means the named predecessor, permission or environment is required. Earlier test evidence is source-bound.

Phase 10 · Cleanup and acceptance

P10-00 Audit legacy UI, routes, CV/document paths, services, configuration and dependencies. Nominate only proven obsolete code.
P10-01 Remove the approved unimported App.css under CLEAN-20 and publish its targeted verification. Any additional removal needs its own evidence and approval.
P10-02/03 Review compatibility and backend/configuration retention. Keep legacy/frozen documents, import/export, renderers, old links, migrations and SQLite where still required.
P10-04 Finish applicable data and document integrity, historical CV/letter revision compatibility, MariaDB and migration/recovery evidence. Partial. Keep SQLite retirement separate.
P10-05 Independently reconcile 34 routes and 57 preservation groups, browser and browser contracts, EN/NB, accessibility, sidecar, security, accepted PDF evidence and applicable environments. Local full regression passed 1,448 backend and 1,031 frontend cases. Reuse valid evidence from unchanged sources.
Record Phase 10, redesign development and Product Review readiness decisions with the post-redesign handoff. Track production separately. See P10-05.

PRODUCT-REVIEW-01 · Independent product review

Gated by accepted Phase 10. Review real end-to-end use across jobseekers, occupations, desktop and mobile. Audit onboarding, discoverability, friction, accessibility, account/trust, workflow gaps, reliability and release blockers before assessing planned features.
Evaluate LinkedIn permission, career-history/application import and user-export fallback. Keep Career Profile canonical and require review before applying imports.
Evaluate FINN URL import and official API rights, NAV feed, saved search, alerts and tracker integration. Coordinate with Global Jobs.
Evaluate AI-P5-13 grounded CV rewriting and user accept/reject controls. Compare local model/engine and specialised pipeline feasibility for EN/NB, accuracy, latency, cost/licence and existing hardware. Live inference and production cutover stay gated.
Rank Android options for login, dashboard, applications, Kanban/timeline, CV/PDF, EN/NB and themes against web/mobile benefit and cost.
Rank Prometheus/Grafana and host/container, disk, DB, API, AI/GPU, availability and backup monitoring separately from product analytics.
Rank onboarding, trial, pricing, subscriptions, retention, education, feedback, privacy, export and deletion. Determine what belongs in each release.
Deliver independent findings, evidence and ranked TODO with effort, impact, risk, dependencies, phased delivery, production gaps and machine-readable backlog. Record executive recommendations and owner decisions before implementing protected product scope.

A3 · Application modernisation and addendum

Complete five application concepts, A3 selection and design handoff. A1 dashboard, B1 tracking, D1 styling, hybrid mobile navigation, editor-left/preview-right and application context right.
IM01–09 milestone gates. Foundation/navigation, dashboard/onboarding, applications, discovery presentation, Career Profile/CV/letter, calendar/mail/documents, AI/settings and account/admin have scoped checkpoint evidence and progression approvals.
IM10. Review all 34 routes and 57 preservation groups, secondary routes and connected workflows against A3. Finish open discrepancies, flatter visual hierarchy, density, reusable interactions and loading/empty/error/success states on desktop/tablet/phone, EN/NB and light/dark. Run affected regression and collect real screenshots, keyboard, device, assistive technology and native language review. Obtain final owner visual acceptance.
Discover. Search-first layout shipped for existing NAV. Continue mobile filter drawer, results/detail usability, attribution and accessible disclosure. New search skills, radius, tree/map and provider capabilities belong to GJ/EUROPE with qualified data and rights.
Applications. Title-first rows, explicit selection and preparation wording shipped. Consolidate secondary actions without removing functions, finish table/board/detail states and check status, selection and follow-up.
Calendar. Recorded closing dates and follow-ups are covered. Resolve genuine interview scheduling, original precision/timezone and provider/ICS qualification as applicable. Preserve agenda/month toggle and preference.
Career, CV, letter and documents. Finish connected overview-to-document reuse and create/import-to-edit/preview/export evidence. Preserve revisions, null-as-inherit, canonical profile ownership, frozen packages, import review and RD21.
Correspondence. Improve inbox, mailbox state, relevant job context and review. Scope explicit consent, provider permissions, multi-mailbox storage and retention separately. Preserve conflict, attachment and confirmed-send flows.
Admin Users. Alignment and read-only 2FA shipped. Compact actions and creation/role/reset/deletion dialogue, error and keyboard coverage remain. Gated MFA recovery design approval and authorisation for factor changes.
Audit and privacy. Mail-subject redaction shipped. Add approved filters and safe record expansion, minimise exposed fields and verify isolation across remaining delivery paths. Gated private support access proposal, consent, expiry and revocation.
System Status. Last successful browser refresh shipped. Qualify actual worker/queue/task/provider/mail/enrichment/error/timing signals with honest stale/unavailable states. Design exists for isolated allowlisted diagnostics. Gated execution, audit and isolation approval. Retain CV benchmark evidence.
Settings and automation. Qualify individual rules and explanatory states, remaining recovery cases and per-user Ghosted pause contract. Keep model/provider execution and real mutations separately authorised.
Bookmarklet and terminology. Finish EN/NB terminology and display review. Retain bookmarklet until device parity for URL paste, extension and PWA sharing, then seek retirement approval.
Test full journeys: discovery→detail→save/track, CV create/import→edit→preview→export, application→status→follow-up, Career Profile→document reuse. Use route evidence and discrepancies on the A3 branch.

INT-GLOBAL-JOBS-01 · International discovery

GJ-00 Publish feasibility, rights, architecture, taxonomy, geography and acceptance plan at 0ec9f98e. Reconfirm provider/legal evidence when entering implementation.
GJ-01 Country and independent language preferences, locale prominence, defaults, persistence and migration. Gated by Phase 10, Product Review and initiative approval.
GJ-02 Canonical location IDs, hierarchy, exact parent/child selection semantics, country switching, radius where supported and consistent map/tree state.
GJ-03 Universal occupations and skills, multilingual suggestions, aliases, mapping/ranking and cross-industry fixtures.
GJ-04 Authorised Norway, Sweden and UK providers, rights before fetch/display, attribution, source redirects, expiry/deletion, rate limits and provider reliability. Licence and permissions gate each capability.
GJ-05 Responsive search/filter/detail, truthful geographic and source coverage, deduplication, permitted descriptions and tracker integration.
GJ-06 Saved searches, matching, alerts, preferences and owner isolation. Qualify lifecycle and delivery.
GJ-07 Provider monitoring, admin operations, reliability, limits, security, privacy and operational playbooks.
GJ-08 Cross-provider integration, realistic EN/local-language and occupation journeys, accessibility, rollback, and final acceptance. No restricted scraping or invented results.

I18N-01 · European localisation

I18N-00 Close full surface and catalogue inventory and locale priorities. All 188 historical dynamic call reviews are accounted for. Full visible text and locale acceptance remain open.
I18N-01 Locale registry, locale aliases/legacy NB, persisted user choice, fallback/negotiation, formatting and migration. Keep UI, job and document languages independent.
I18N-02 All React copy, navigation, form/dialog/error/loading states, accessibility, responsive text expansion and language switch continuity.
I18N-03 API error codes, validation, mail, notifications, background/operational messages, locale persistence and fallbacks.
I18N-04 Career Profile, Docling/import review, CV and letter editors, generated content, templates and PDF. Preserve document language and revision fidelity.
I18N-05 Multilingual discovery, occupation names, aliases, matching, provider languages and regional formatting. Coordinate with GJ.
I18N-06 Locale catalogues, glossary, extraction/CI, missing/plural/placeholder validation, native reviews and per-locale release gate. Preserve established terminology.
I18N-07 Locale-aware public homepage, content and metadata, market/language URLs, canonical/hreflang and SEO with LAUNCH-SITE.
I18N-08 European QA, linguistic/native review, fallback, accessibility and document/export regressions. Publish locale-by-locale acceptance.

EUROPE-READY-01 · Mandatory market coverage

Define final geographic scope and qualify each of the 59 candidate codes in the existing coverage matrix. Track provider/data rights, catalogue, geography/map, native/device and release statuses separately.
Persist residence, search countries/regions, UI locale, job-ad languages and per-document languages independently. Preserve compatible saved searches and filters when switching countries.
Qualify licensed geographic data, canonical IDs/hierarchies, aliases, boundaries and attribution. Provide country-aware map and accessible tree with equivalent selection behaviour and keyboard alternatives. Parent covers area, descendants refine the branch, independent branches combine.
Qualify cross-country providers and occupations, supported radius, location coverage, multilingual search, regional copy, date/time/number/currency/address formats and Unicode/PDF output.
Translate the whole product and public experience. Validate layouts, selection, error/fallback behaviour and source availability across countries and languages. Publish country and cross-country test matrices and release decisions. Reuse GJ/I18N/A3/Launch owners.

LAUNCH-SITE-01 · Public launch site

LAUNCH-00 Close research, registration/degraded-auth, performance and asset-rights audit inputs. Existing 12 rendered states and raw SEO findings published at 98483b80.
LAUNCH-01 Produce four high-fidelity desktop/mobile concept pairs using genuine synthetic product captures and appropriate cleared imagery. Present minimalist, premium SaaS, friendly/human and editorial choices for owner selection.
LAUNCH-02 Refine selected elements and obtain explicit final design approval. Gated.
LAUNCH-03 Build public foundation and responsive accessible hero/navigation without disturbing auth/signup or protected return routes.
LAUNCH-04 Validate product screenshots, photography rights and optimisation. Use synthetic data, truthful captions, responsive assets and alternatives.
LAUNCH-05 Implement reviewed hero, workflow, feature, trust, plans, FAQ and conversion content. Confirm legal/privacy links, signup and honest feature/price claims.
LAUNCH-06 Localised copy, language selection, persistence and fallback, independent from in-app job and document language.
LAUNCH-07 Locale/market routing, country page readiness, modular content and market-specific provider claims.
LAUNCH-08 Crawlable HTML, metadata, canonical/alternates, sitemap and index rules, performance, device/accessibility, conversion and privacy checks.
LAUNCH-09 Integration, native-language, marketing claim, signup and release acceptance. Publish evidence, assets, SEO and handoff docs. Separate launch approval.

SECURITY-AUDIT-01 · Offline work and formal security phases

Bounded offline fixes and root security policy exist. Formal integrated scope, target, costs and staging activity remain gated.

00 Authorisation, isolation, rules of engagement, baseline and evidence register.
01 Asset inventory, threat model, trust boundaries and attack surface.
02 Secret/credential, crypto and history review.
03 Static code, dependency, framework, advisory and supply-chain baseline scans.
04 Auth, session, MFA/recovery and OAuth. Review and approve protected recovery design separately.
05 Authorisation, tenant and object-level isolation. Reuse bounded audit/notification/processing evidence where applicable.
06 API abuse, business logic, rates, integrations and rights.
07 CV upload, parsing, export and malicious document boundaries.
08 Python/AI/Docling/Ollama, prompt injection, egress and sensitive content.
09 Browser isolation, frontend XSS, CSP and CSRF.
10 Database security, privacy, retention, integrity and backups.
11 Nginx, Docker, Ubuntu, host and network configuration.
12 CI/CD, Git, build provenance, credentials and supply chain.
13 Controlled adversarial staging testing after explicit scope and isolation approval.
14 Remediate verified findings with permanent regression tests. Record risk decisions and verify on the final affected baseline.
15 Independent retest, release security gate and final report. No formal integrated scan credit for offline tests.
16 Detection, incident response, owners, alert/runbook exercises and continuous security handoff.

RELEASE-READINESS-01 · Qualification and production decision

Stage 1 Close discovery, inventory, prior blockers and baseline scope. Backup parser RR-11 published with 31 offline tests. RR-12 rollback and RR-13 recovery remain open.
Stage 2 Freeze exact candidate, environment, image/digest, migration/config/dependency identities, CI and evidence provenance.
Stage 3 · Functional Accounts/auth, jobs/tracking, dashboard, career/CV/documents, AI, correspondence, integrations, notifications, admin, billing and exports. Qualify real browser, sidecar and MariaDB lanes separately.
Stage 3 · UX Responsive/visual and keyboard/AT/accessibility, EN/NB and launched locales, reflow/contrast, physical devices and representative workflows.
Stage 3 · Data/PDF Tenant and revision integrity, historical compatibility, migrations and data protection, source-bound PDF fidelity, physical print where required.
Stage 3 · Security and infrastructure Complete security gate, verify proxy/TLS, hosts, containers, networking, secrets, permissions, pinned reproducible builds and hosted CI.
Stage 3 · Operations Performance, load/failure recovery, health and metrics, alerts/runbooks, logging privacy, docs/compliance and support.
Stage 4 Fix verified blockers, record impact and risk, add regressions and update the release acceptance matrix.
Stage 5 Requalify the final candidate and affected suites, record actual results and unresolved risks.
Stage 6 Rehearse isolated upgrade, image rollback and data rollback, database/files/keys/tombstones restore, encrypted off-host retrieval, validation, RPO/RTO and operational recovery.
Stage 7 Publish final matrix, evidence, risk/owner decisions and GO/NO-GO. Production deployment requires a separate explicit decision.

Separately gated or excluded

SQLite retirement: qualified MariaDB parity, migration, rollback, restore and retention before any removal.
Live model, provider, mail, market claims, native/device, hosted CI, staging and production decisions stay separate.
Deferred CV-import engine overhaul and personal portfolio are outside this execution.

Source index: Phase 10 and Product Review prompts 5–6, Global Jobs prompt 7 and docs/planning/global-jobs-prompts/, complete I18N/ and jobjakt-security/ packs, homepage prompt 10, release readiness prompt 11, the approved A3 implementation/visual requirements and additional/# Jobjakt — A3 refinement+EUJOBS.txt. The status register and latest checkpoint identify current evidence and branches.

17 KiB Raw Blame History Unescape Escape