GJ-07 — Provider Operations, Admin Monitoring, Privacy and Resilience

Suggested branch: feature/gj07-discovery-operations

Objective

Make multi-country job discovery auditable and sustainable to operate without exposing user CVs, raw prompts or host internals. Integrate with existing administrator processing monitor where appropriate.

Admin view

Provider registry: country, API eligibility/rights state, capability flags, feed/query mode, enabled status, last successful sync, health, API quotas/rate errors, source freshness, indexing backlog and next scheduled sync.
Processing jobs/events: provider, worker, job type, cursor/checkpoint, fetched/new/updated/deleted/ignored counts, duration, retry, error code, structured stage and correlation ID; user-submitted URL import tasks show the submitting user and linked saved job/application only to properly authorised admins. Provider-wide sync jobs normally have no submitting end-user—show 'system' rather than inventing one.
Diagnostics: filter by provider, country, status, error type, time and correlation ID; redacted timeline/log excerpt from structured application events, with bounded retention, pagination and optional authenticated SSE stream/polling. No full job-applicant CV text, prompts, OAuth tokens, provider secrets, unsafe original HTML, raw Docker logs or arbitrary shell.
Correctness metrics: source lag, cursor age, licensing expiry/credential failure, stale/deleted advert content, dedupe rate and uncertain matches, alert queue outcomes and error clusters. Show true service health vs fixture mode.

Security hardening

Server-side admin role checking on list, detail, streaming and data export; tenant boundaries even if admin scope is restricted; audit privileged access and source credentials changes.
SSRF-resistant URL import with scheme/host allowlist, DNS re-resolution/address validation and redirect policy; never fetch internal network endpoints. Treat source descriptions as untrusted HTML and avoid script execution/sandbox iframe leaks.
Bounds: API requests, ingestion concurrency, result pagination, auto-complete rate, local index size, alert fanout, log volume, timed-out jobs, model inference remains disabled if not qualified.
Provider lifecycle compliance tests including deletion/tombstone, changed ads, contact masking, and legal separation of external ad cache from user-owned application history.
Privacy: document what is stored (search preferences, skills references, personal saved jobs, employer contact information), why, and deletion/retention/export rights. Don't store source data past permission; no uncontrolled tracking/marketing analytics.
Reproducible migrations/CI, secret scanning and dependency audits, loss-of-provider/backoff/partial outage drills. Never alter production infra to get passing tests.

Checkpoints

GJ07-A operational telemetry & job models; GJ07-B admin UI/filters/logs; GJ07-C authorization/privacy/redaction; GJ07-D resilience/performance/audits. Docs: docs/global-jobs/07/. Commit/push every validated checkpoint. End GO/CONDITIONAL GO/NO-GO. Stop.

Shared rules for every INT-GLOBAL-JOBS-01 stage

Product: Jobjakt, a general-purpose, commercial job-search and career-management SaaS. It is not an IT-only product. Current architecture includes React/TypeScript, .NET backend, MariaDB, an AI sidecar, existing Career Profile/CV/document/application features, and an established EN/NO localisation approach. Verify actual repository reality before making assumptions.
Entry gates: Do not implement new global-job-discovery features until the authoritative Phase 10 and product-review/development-entry decisions permit this initiative. Planning-only reconnaissance may precede them. If an entry gate remains NO-GO, produce safe analysis and stop before code changes.
Baseline: Find the latest accepted, integration-complete development commit by reading Git history and the latest authoritative acceptance reports. Do not assume main is current. main deploys production: NEVER merge to main or trigger production. Never change live MariaDB, Docker, Ollama, storage, secrets or other production services.
Branches: Use the specified independent stage branch from the latest accepted development integration history including the preceding accepted stage. Verify ancestry, remote, clean tree and existing branch collisions. Use checkpoint commits; push each validated checkpoint; verify remote HEAD equals local HEAD. Do not force-push. Do not advance to another stage without its actual entry criteria.
Autonomy: Investigate, design, implement, add tests, document, commit and push safe work without pausing for routine decisions. Stop only for external API agreements, new paid resources, security-risk acceptance, destructive changes, privileged infrastructure actions and production operations. Continue independent work when one provider or model capability is blocked.
Sources: Integrate only documented, authorised sources. Verify current licensing, commercial eligibility, credentials, permitted display, storage, cache lifetime, update/delete/tombstone, attribution, user-click-through and rate-limit rules. No covert scraping, private APIs, stolen cookies, bypassing anti-bot controls or fetching protected listing content without authorisation. An external-link-only source is not a direct searchable provider.
Data trust: All provider data, job descriptions and user-provided URLs are untrusted. Guard SSRF, XSS/unsafe HTML, prompt injection, HTML injection, unsafe redirects, credential leakage, denial of service and cross-user/tenant access. Do not present missing facts, inferred salaries, regulated-profession eligibility, or AI-generated job details as verified employer facts.
Availability: Preserve offline/disabled provider states. Use realistic fixtures in automated tests; any live contract test needs authorised test credentials and bounded rates. Never claim unavailable external API functionality passed.
User-facing quality: Desktop/tablet/phone, keyboard and screen-reader access, light/dark, EN/Bokmål plus future qualified locales, loading/empty/error states, responsive design, sensible defaults, performance, source transparency, internationalisation and accessible non-drag alternatives.
Data integrity: Source advertisements and user-owned saved jobs/applications are separate records and lifecycles. Preserve existing Career Profile, historical CVs, cover letters, saved applications, revisions, RD21 protections and MariaDB compatibility. Follow source rules for removing or masking withdrawn advertisements, while handling user-owned records under a separately justified retention policy.
AI: Existing live-model inference and semantic quality must remain gated unless separately qualified. Rule-based/ESCO-backed title suggestions and auditable matching should function without a generative model. Do not invent user qualifications or automate application submissions.
Evidence: At every checkpoint provide exact tests (pass/fail/skip/not run), security/coverage evidence, dated docs, commit hashes, branch and remote verification. Report individual stage GO / CONDITIONAL GO / NO-GO; separate production NO-GO from development readiness.

7.2 KiB Raw Blame History