jobtrackingapp/docs/work-programmes/master-progress.md

JobTracker master programme progress

Updated: 2026-08-29

2026-08-29 audit implementation programme

Completed

• Introduced shared application spacing tokens for 16px mobile gutters, 24px tablet/desktop gutters, 32px wide-screen gutters, 24px section rhythm, and 16–20px card padding. AppShell and the first redesigned surfaces consume these tokens.
• Reworked the Dashboard around today's prioritized actions. Empty accounts no longer render zero-value metrics, ten empty funnel stages, empty time-in-stage, company, skill, or activity panels. The activity SVG now scales to its container instead of requiring a clipped fixed-width mobile canvas.
• Made onboarding dismissible per account/browser while preserving the checklist until it is completed or dismissed.
• Made Settings use a compact section selector at mobile widths, kept tabs for larger screens, narrowed the content column, and removed its duplicate in-page title. Newly touched settings copy is localized in English and Norwegian Bokmål.
• Replaced the ordinary-user Google configuration variable instruction with a human-readable unavailable state.
• Made Playwright independent of nested npm calls and accidental system .NET ordering. The E2E launcher resolves DOTNET_HOST_PATH, DOTNET_ROOT, or the user-local SDK before falling back to PATH and invokes Next/Playwright through the current Node runtime.
• Made application CV matching language-aware. It detects/normalizes the advert and linked-CV languages, uses an already-saved English advert translation for an English CV when available, never starts a translation or mutates either document during a match read, and tells the user when a cross-language comparison is translated or limited.
• Expanded the shared deterministic keyword filter to remove Norwegian recruitment filler including både, del, dnbs, faglig, får, god, hos, and utvikling instead of presenting those words as CV gaps.
• Split the Career Workspace into Overview, Career Profile, and Import Review destinations. Navigation is URL-backed, uses tabs above mobile widths and a labelled select at 375px, and preserves unsaved editor state while changing sections. Import diagnostics no longer force users to scroll through the normal profile editor.
• Removed the duplicate Career Workspace title inside the Overview content; the shared application shell remains the single page-level heading.
• Forced local Next development and Playwright's non-export server onto webpack after reproducing a Next 16 Turbopack panic (Next.js package not found) with the bundled portable Node runtime.
• Localized the Job Workspace recruiter-status suggestion and strategy snapshot end to end, including status labels, action buttons, empty/loading outcomes, queued-operation feedback, and both English and Norwegian Bokmål copy.
• Improved the Job Workspace overview card grid so compact screens use one readable column, tablets use two, and wide screens use five without leaving a cramped orphan card.
• Moved the remaining shared shell navigation labels into the global locale catalogue so sidebar and mobile-navigation controls announce themselves in the selected language.
• Localized the application checklist from stable system keys rather than persisted English text. Categories, generated tasks, descriptions, progress, errors, tooltips, and accessible reorder/delete names now switch between English and Bokmål while user-authored task text remains untouched.
• Localized Cover Letter, CV attachment, application-draft, and Interview Prep failure states and document-language selectors. Interview categories now derive from stable category keys while user-authored questions and answers remain unchanged.
• Reused the checklist's stable system-key translation mapping for the Overview's recommended next action, preventing the English backend seed text from leaking into a Bokmål workspace.
• Corrected the CV Match source caption to interpolate the selected CV name once, localized known match bands, and made intelligence/timeline load failures and dates respect the selected UI locale.
• Finished the Career Profile import/review localization pass: queue, cancel, retry, diff, confidence, destructive, save-state, completeness, link-editor, language-selector, and version-history controls now use the global English/Bokmål catalogue while imported CV values remain unchanged.
• Localized backend-owned career completeness labels through one shared UI mapping so Overview and Profile display Bokmål without changing the API contract or stored profile data.
• Removed the remaining mojibake from the translation catalogue, including account email, Microsoft relink, account-deletion, and learning-path messages.
• Localized the Operations and Notifications activity page controls, dates, progress accessibility labels, empty/error/loading states, cancellation feedback, and retry/dismiss actions in English and Norwegian Bokmål.
• Localized Job Discovery across search, source guidance, retry/empty/loading states, result sorting, vacancy metadata, locale-aware dates, and save/view actions.
• Localized Connected Accounts and the shared email-provider connection controls, validation, OAuth/IMAP feedback, connection states, and accessible form labels without translating provider names or user email addresses.
• Localized the consolidated Job Email hub across provider status, search/filter controls, saved drafts, compose/reply flows, destructive confirmations, send safety states, message metadata, pagination, and failure handling. Persisted subjects, bodies, company names, roles, addresses, and provider names remain unchanged.
• Corrected the Job Email Direction and Link State controls so their visible labels are programmatically associated with the selects, and removed the remaining mojibake separators/loading text from the workflow.
• Localized the complete public landing experience—hero, previews, feature cards, workflow, plan capabilities, CTAs, accessibility text, and footer—while retaining the server-aligned Free/Pro plan structure and commercial-terms safeguards.
• Reused the shared EN/NO language control on the unauthenticated landing page, so language can be changed before sign-in and persists through the existing locale mechanism.
• Finished the remaining active CV Builder format labels: long-document page counts, US Letter naming, and localized long/short date examples now follow the selected UI language.
• Localized the Admin System runtime and CV benchmark diagnostics, including probe/email failures, model/Ollama state, parser findings, benchmark summaries, fallback guidance, and locale-aware timestamps while leaving runtime/provider/file values untouched.
• Consolidated active list/dashboard/Kanban/reminder loading and failure presentation through the shared resource notice. Retry/progress accessibility follows EN/NB, duplicate fallback text is suppressed, and Kanban drag/keyboard announcements are localized.
• Migrated Admin Audit to the shared retryable resource state so an unavailable API is no longer misreported as an empty log. Audit actions/dates, notification-setting feedback, profile-load fallbacks, and CV extraction run notifications now follow EN/NB while stored event/profile content remains unchanged.
• Localized the pre-authentication security-check label and the embedded Turnstile challenge language, so switching to Bokmål no longer leaves the verification widget in English.

In progress

• P0 deployment and production health revalidation. Commit 4d4af47 is pushed and Gitea Actions run 696 exists, but the run remained queued while the public health endpoint returned 502 during the first check.
• Shared UI foundation rollout to remaining screens and standardized loading/empty/error copy.
• Shared loading/empty/error-state consolidation is the next active UI package.

Remaining

• Finish production deployment/health verification and revalidate the production-only blockers.
• Continue shared hierarchy/responsive work across Career Workspace, Job Workspace, Profile, Admin, Jobs tables, Kanban, and CV Builder.
• Add a real frontend lint dependency/configuration once package-index access is explicitly authorized; the current lockfile contains no ESLint packages.
• Continue maintainability packages, accessibility automation, mobile regression coverage, and the prioritized product-value roadmap after the foundations are stable.

Blocked

• ESLint installation is blocked by the repository rule requiring explicit permission before package-index/internet access.
• Production rollout remains dependent on an online Gitea runner matching ubuntu-latest and the deployment host becoming healthy.
• Existing external/provider/retention decisions remain listed in BLOCKERS.md and are not silently reclassified here.

Discovered during implementation

• The prior E2E command relied on both dotnet and nested npm being discoverable through ambient PATH. This reproduced the audit's tooling failure on the current workstation.
• The 375px Settings regression test still expected desktop tabs. It now verifies the responsive section selector instead.
• The previous Dashboard rendered its time-in-stage empty state using the unrelated “No tags yet” copy. Empty analytical panels are now suppressed instead of presenting mismatched messages.
• The Application Analysis match previously ignored both JobApplication.DescriptionLanguage/TranslatedDescription and the linked CV's language setting. This could under-score an English CV against a Norwegian advert even when import had already stored a usable English translation.
• The bundled portable Node runtime starts Next 16 successfully, but Turbopack repeatedly panicked while emitting /page; the webpack development path serves the same route correctly and is now the documented/scripted default.
• Playwright exposed duplicate React keys in the long Code-template CV despite passing its assertions. Read-only inspection of the disposable SQLite database proved every relational Career Profile child had been inserted twice: a newly visible profile could be read and legacy-backfilled before its child replacement completed. Profile snapshot/children/history saves are now atomic, malformed duplicate item/order keys are normalized, and race-affected stored rows resolve once on reads without destructive cleanup.

Verification

• Focused frontend: 2 suites, 6 tests passed.

• Full frontend: 62 suites, 256 tests passed.

• Next production build and TypeScript: passed.

• Portable Playwright launcher: resolved the user-local .NET 9 SDK; backend Release build passed with 0 warnings/errors.

• Playwright: initial full run 9/10 exposed the intentional mobile Settings control change; updated focused rerun passed 1/1. A final complete browser rerun remains in the end-of-batch gate.

• Focused backend match/intelligence verification: 34/34 passed.

• Focused frontend application-intelligence verification: 11/11 passed.

• Career/Profile focused verification: 2 suites, 19/19 passed, including the final navigation/state-preservation regression; final full-suite/E2E gates remain pending.

• Job Workspace focused verification: 2 suites, 9/9 passed; TypeScript passed.

• Checklist localization verification: 7/7 passed, including a Bokmål regression that preserves user-authored content.

• Cover Letter/CV assets and Interview Prep focused verification: 2 suites, 27/27 passed, including Bokmål category rendering that preserves user content.

• Workspace/checklist integration verification: 2 suites, 14/14 passed, including localized system-derived next actions.

• Application intelligence focused verification: 11/11 passed; TypeScript passed after the creation-tab/localization batch.

• Career Profile and Operations focused verification: 2 suites, 16/16 passed, including Bokmål completeness/confidence and operations empty-state regressions.

• Full frontend after the Career/Operations localization batch: 62 suites, 260/260 tests passed.

• Next optimized production build and its integrated TypeScript check passed after the Career/Operations localization batch.

• Job Discovery and email-provider connections focused verification: 2 suites, 8/8 passed, including Bokmål workflow regressions; TypeScript passed.

• Job Email focused verification: 16/16 passed, including a Bokmål regression that preserves correspondence content; TypeScript passed.

• Full frontend after the Job Email localization batch: 62 suites, 263/263 tests passed.

• Next optimized production build and integrated TypeScript check passed after the Job Email localization batch.

• Public landing focused verification: 2 suites, 3/3 passed, including live switching to Bokmål and preservation of protected-route sign-in intent; TypeScript passed.

• CV Builder focused verification: 12/12 passed; TypeScript passed after the final format-label pass.

• Admin System focused verification: 3/3 passed, including Bokmål benchmark diagnostics that preserve runtime values; TypeScript passed.

• Job creation and Gmail workflow localization verification: 4 focused suites, 11/11 passed; TypeScript passed. The add-job stepper, Gmail continuity management, review queue, usage progress labels, errors and status copy now switch between English and Bokmål without translating user/job/email content.

• Shared active-surface localization/accessibility verification: Profile 13/13 and settings/auth/landing 18/18 passed; TypeScript passed. Tag entry, Pro notices, disabled registration, profile load recovery, dashboard totals, language selector semantics, job-selection checkboxes and locale-aware correspondence dates were aligned with the global EN/NB system.

• Final localization regression gate: all 62 frontend suites and 267/267 tests passed after correcting the isolated Pro-notice provider fallback; the optimized Next production build and integrated TypeScript check passed; the full .NET 9 backend suite passed 713/713.

• Career Profile atomicity/CV locale verification: focused backend 55/55 and frontend 10/10 passed; the targeted long Code-template Playwright/PDF flow passed 1/1 with no duplicate-key or out-of-range locale warning. Its fresh disposable database contained exactly 9 experiences, 1 education, 8 skills, 1 project, 1 certification and 2 languages, with zero duplicate experience ItemKeys.

• Post-fix complete regression: backend 716/716 and frontend 62 suites with 268/268 tests passed; the optimized Next production build and integrated TypeScript check passed.

• Shared view-state focused verification: 3 suites and 15/15 tests passed, including Bokmål loading/retry and Kanban interaction coverage; TypeScript passed.

• Admin Audit/settings/profile focused verification: 3 suites and 17/17 tests passed, including unavailable-versus-empty recovery and Bokmål audit actions that preserve stored event content; TypeScript passed.

• Turnstile/auth recovery focused verification: 4 suites and 18/18 tests passed; the provider widget receives the Bokmål language code and TypeScript passed.

• Final shared-state/localization regression: all 64 frontend suites and 272/272 tests passed; optimized Next build and integrated TypeScript passed; complete Playwright passed 10/10, including public PDF and the searchable multi-page Code template. Only the pre-existing Google Identity development logger warning remained.

• Backend matcher/intelligence focused verification: 35/35 passed, including detection of a manually created Norwegian advert with no saved translation.

• Full backend: 712/712 tests passed on .NET 9.

• Next optimized production build and TypeScript: passed after the Job Workspace/checklist batch.

• Playwright: 8/10 passed on the first complete run; both failures were ambiguous selectors in the newly responsive Career selector, not product failures. Both corrected focused regressions now pass (2/2); final full rerun remains in the end-of-batch gate.

• Manual desktop browser review: webpack development server rendered the new Career navigation and Overview correctly in dark mode; API-dependent profile status remained unavailable because the backend was not running for that isolated UI review.

• Overall programme status: Active but externally blocked. Eight packages are locally verified and twenty-five are implemented with verification incomplete. The prioritized admin-only version indicator, every immediate repository/browser item, SEC-009, the PROD-001 read-only inventory, and the PROD-003 safe benchmark harness are complete on the release branch.

• Current work package: None. Every remaining package now requires a user/operator decision, authorized production mutation/restore/provider action, or explicit package-index access.

• Completed work packages: None are DONE; all repository security/AI packages still have applicable browser, provider and/or production gates.

• Locally verified work: SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001, PROD-002, DEP-001 and VER-001 (VERIFIED LOCALLY).

• Implemented, verification incomplete: SEC-004, SEC-005B, SEC-008, SEC-009, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002/003, QA-001, CAREER-001/002, MAIL-001, JOBS-001/002 and PRODUCT-001 (IMPLEMENTED — NOT VERIFIED). Their safe repository/browser scope is implemented; production/native-device/provider/retention gates remain where recorded.

• Production-verified work: None.

• Blocked work: SEC-006 parser upgrades remain outside the scoped frontend advisory permission; PROD-001/003/004 and REL-001 require network/backup/model/deployment authority and unfinished dependencies. Real provider and live deletion/restore checks remain gated; DEP-001 awaits approved merge/live verification.

• Deferred work: None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages.

• Immediate order: all sixteen immediate repository items are complete locally, including the original UI/release queue plus SEC-009 cache/tombstone safety, worker restart clocks, universal AI accounting, email-token/Stripe lifecycle tests, exhaustive Job email selectors, the repaired migration chain, CV/public-edge hardening and measured admin/mail scaling. PROD-001 read-only evidence and the PROD-003 plan-only harness are also complete. The final audit is checking tooling/documentation before declaring only external blockers remain.

• Status counts: 8 VERIFIED LOCALLY; 25 IMPLEMENTED — NOT VERIFIED; 0 IN PROGRESS; 1 NOT STARTED; 5 BLOCKED; 0 DONE; 0 DEFERRED.

• Test status: backend 683/683; frontend 58/58 suites and 239/239 tests; AI sidecar 23/23; Ollama benchmark harness 5/5 plus safe dry-run; optimized production build/TypeScript; EF model parity; SQLite/MariaDB migration scripts; blank/idempotent/populated SQLite migration-chain tests; disposable fresh/restarted MariaDB 11.8 application startup; Docker Compose config; safe-failure deployment preflight; and Playwright 9/9. npm audit 0 evidence remains current because the lockfile did not change. Jest's slow/open-handle behavior remains recorded.

• Deployment status: Gitea pull-request run 609 passed the complete CI job in 4m20s. Deploy was intentionally skipped because the workflow deploys only a push to main; live remains unchanged. No merge/deployment was performed directly, no production migrations were run and the AI operation worker remains disabled by default.

• Production status: State unchanged. Sanitized read-only SSH inventory was performed; no logs, prompts, private rows/content or secret values were read, and no provider/model call, model pull, service restart, file/config change, backup, restore, migration or deployment occurred. It confirmed all-interface Ollama/frontend listeners and stale database-only backups as rollout blockers.

• Known regressions: None found by automated/local browser checks. Jest still needs --forceExit and reports its existing open-handle notice. Email-provider/send tests are fake/local only; real delivery is not claimed. Current MAIL browser evidence is 1280×720 only because the browser surface could not resize or perform native Tab traversal. Interrupted attempts are aged after 15 minutes and notified without retry; the five-minute scan is unmeasured on a large ledger. The direct clean EF-only SQLite defect and synchronous AI accounting gap are closed; migration/reconciler dual ownership remains architectural debt.

• Outstanding security findings: JT-001 repository ownership remains High deployment risk until migration/inventory/provider checks; production portion of JT-002; JT-006 and SEC-009 production retention/restore plus JT-011/JT-012/JT-022 prerequisites. JT-005 foundations are implemented; AI worker activation awaits controlled rollout. Production still exposes ports contrary to the release-branch contract, and JT-007/JT-008/JT-010 lack provider/production verification.

Current evidence

• docs/audits/audit-remediation-backlog.md
• docs/audits/verification-log.md
• docs/verification/sec-001-canonical-origin.md
• docs/verification/sec-002-ingress-compose.md
• docs/verification/sec-003-microsoft-tenant.md
• docs/verification/sec-004-microsoft-identity.md
• docs/verification/sec-005a-session-revocation.md
• docs/verification/sec-005b-email-ownership.md
• docs/verification/core-001-sqlite-provider-parity.md
• docs/verification/core-002-route-uniqueness.md
• docs/verification/sec-008-attachment-consistency.md
• docs/verification/sec-009-account-lifecycle.md
• docs/verification/bg-001-tenant-workers.md
• docs/verification/ops-001a-durable-operations.md
• docs/verification/ops-001b-notifications.md
• docs/verification/ops-001c-operation-ui.md
• docs/verification/pol-001-free-pro-entitlements.md
• docs/verification/pol-002-ai-privacy.md
• docs/verification/ai-001-durable-ai-queue.md
• docs/verification/ai-002-provider-routing.md
• docs/verification/ai-003-strategy-snapshot-queue.md
• docs/verification/ai-004-cv-processing-queue.md
• docs/verification/ux-001-unified-authentication.md
• docs/verification/ux-002-deterministic-theme-state.md
• docs/verification/qa-001-job-term-quality.md
• docs/verification/career-001-career-workspace.md
• docs/verification/career-002-cv-builder.md
• docs/verification/mail-001-job-email-hub.md
• docs/verification/jobs-001-job-discovery.md
• docs/verification/ux-003-kanban-theme.md
• docs/verification/product-001-honest-plans.md
• docs/verification/ver-001-complete-regression.md
• docs/verification/prod-002-ai-evaluation.md
• docs/production/production-ai-hardware-assessment.md
• docs/production/production-ai-rollout-and-rollback.md
• docs/production/ollama-model-benchmark.md
• docs/work-programmes/master-work-plan.md