jobtrackingapp/docs/work-programmes/master-progress.md

JobTracker master programme progress

Updated: 2026-08-10

• Overall programme status: Active. Seven packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with ten committed implementation increments. Gitea run 608 confirms DEP-001 cleared the remote dependency audit; its later stale Career Workspace smoke assertion is corrected locally (4/4 Playwright) and awaits replacement CI.
• Current work package: MAIL-001 — consolidated job-email hub and explicit sending (IN PROGRESS); routing/reads/detail, ledger, Gmail/Graph delivery/re-consent, safe send API/UI, recovery, legacy SMTP retirement and content-free export/job-cascade coverage are committed. Local empty/disconnected and legacy-route browser smoke passes partially. Shared provider actions/capability behavior is next; full account deletion stays SEC-009.
• Completed work packages: None are DONE; all repository security/AI packages still have applicable browser, provider and/or production gates.
• Locally verified work: SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001, PROD-002 and DEP-001 (VERIFIED LOCALLY).
• Implemented, verification incomplete: SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002, QA-001, CAREER-001 and CAREER-002 (IMPLEMENTED — NOT VERIFIED). CAREER-002 now protects unsaved edits and provides tested structured custom-entry, profile-override and preview-error interactions; all automated/build gates pass.
• Production-verified work: None.
• Blocked work: SEC-006 parser upgrades remain outside the scoped frontend advisory permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Real provider, SMTP/MariaDB and production environments are unavailable; DEP-001 awaits replacement CI plus live verification. The in-app browser is available for local UI checks.
• Deferred work: None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages.
• Next five work packages: MAIL-001 consolidated email experience; JOBS-001 job-search/application redesign; HOME-001 homepage/Pro promotion; UX-003 authentication/profile polish; PRODUCT-001 homepage/Pro claims. SEC-006/007 resume after package-index permission.
• Status counts: 7 VERIFIED LOCALLY; 19 IMPLEMENTED — NOT VERIFIED; 1 IN PROGRESS; 8 NOT STARTED; 5 BLOCKED; 0 DONE; 0 DEFERRED.
• Test status: backend 622/622; frontend 49/49 suites and 190/190 tests; Playwright smoke 4/4; npm audit 0 vulnerabilities; DEP-001 focused router 24/24 and production build pass; MAIL-001 export/cascade 16/16, recovery/send 10/10, legacy follow-up/backend worker 10/10, legacy UI 2/2, composer 7/7, delivery/capability 18/18, provider/correspondence 5/5 and hub detail 5/5. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130/V-131/V-135.
• Deployment status: Gitea pull-request run 608 passed Audit frontend dependencies, then failed at the stale Career Workspace Playwright assertion. The assertion fix passes 4/4 locally and is being pushed for replacement CI. Deploy runs only on main, so live remains unchanged. No deployment was performed directly, no production migrations were run and the AI operation worker remains disabled by default.
• Production status: Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred.
• Known regressions: None found by automated/local browser checks. Jest still needs --forceExit and reports its existing open-handle notice. Email-provider/send tests are fake/local only; real delivery is not claimed. Current MAIL browser evidence is 1280×720 only because the browser surface could not resize or perform native Tab traversal. Interrupted attempts are aged after 15 minutes and notified without retry; the five-minute scan is unmeasured on a large ledger. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap.
• Outstanding security findings: JT-001 repository ownership remains High deployment risk until migration/inventory/provider checks; production portion of JT-002; JT-006/JT-009 and associated JT-011/JT-012/JT-022 prerequisites. JT-005 foundations are implemented; AI worker activation awaits controlled rollout. JT-007/JT-008/JT-010 lack browser/provider/production verification.

Current evidence

• docs/audits/audit-remediation-backlog.md
• docs/audits/verification-log.md
• docs/verification/sec-001-canonical-origin.md
• docs/verification/sec-002-ingress-compose.md
• docs/verification/sec-003-microsoft-tenant.md
• docs/verification/sec-004-microsoft-identity.md
• docs/verification/sec-005a-session-revocation.md
• docs/verification/sec-005b-email-ownership.md
• docs/verification/core-001-sqlite-provider-parity.md
• docs/verification/core-002-route-uniqueness.md
• docs/verification/sec-008-attachment-consistency.md
• docs/verification/bg-001-tenant-workers.md
• docs/verification/ops-001a-durable-operations.md
• docs/verification/ops-001b-notifications.md
• docs/verification/ops-001c-operation-ui.md
• docs/verification/pol-001-free-pro-entitlements.md
• docs/verification/pol-002-ai-privacy.md
• docs/verification/ai-001-durable-ai-queue.md
• docs/verification/ai-002-provider-routing.md
• docs/verification/ai-003-strategy-snapshot-queue.md
• docs/verification/ai-004-cv-processing-queue.md
• docs/verification/ux-001-unified-authentication.md
• docs/verification/ux-002-deterministic-theme-state.md
• docs/verification/qa-001-job-term-quality.md
• docs/verification/career-001-career-workspace.md
• docs/verification/career-002-cv-builder.md
• docs/verification/mail-001-job-email-hub.md
• docs/verification/prod-002-ai-evaluation.md
• docs/work-programmes/master-work-plan.md