The pipeline deployed whatever was on main without checking any of it. No
build, no tests, no lint. A frontend that failed to compile zipped and
uploaded exactly like a working one, and the first sign of trouble would have
been the running site.
The checks now gate the deploy. `deploy` needs a `checks` job, so a red main
never reaches the bucket. A second workflow runs the same script on branches
and pull requests, so the answer arrives before the merge rather than after
it. main is excluded there because the deploy workflow already covers it.
Both call scripts/ci-checks.sh rather than inlining the commands twice, which
is the only way the two cannot drift into disagreeing about what passing means.
What gates, and what deliberately does not:
- frontend: npm ci then npm run verify. All four suites are jsdom, so no
browser is needed on the runner. Node 22 matches frontend/Dockerfile.
- bulk-ats: ruff check, ruff format --check, mypy, pytest. Scoped to app and
tests. Repo-wide, ruff reports 926 errors and would reformat 126 files —
the backend is written to another style and demanding a rewrite of it is
not this change's business. The scoped set is clean today.
- backend/tests: passes and gates, minus test_candidate_forms.py and
test_employment_agent.py. Those nine failures predate this change and are
unrelated to it. They are named in the script, not silently skipped, so
the exclusion stays visible and someone can delete the two lines.
Two dead lines in the deploy, found while reading it:
- The step named "Configure AWS credentials" set three variables and then
only echoed a message. `env:` is scoped to its own step, so the values were
discarded before anything could use them. It did nothing while reading as
though credentials were configured globally. Removed; the upload step sets
them where they are actually used.
- `-x ".gitignore/*"` excludes a *directory* named .gitignore, which does not
exist, so the file was never excluded. Now `-x ".gitignore"`.
The zip still ships frontend/node_modules, about 90 MB and most of the
artifact. Left alone on purpose: nothing in this repo says what unpacks the
object — there is no appspec and no deploy script here — so if that side runs
without installing dependencies, dropping it would break the deploy. The
workflow now carries a comment saying so and the one-line change to make once
that is confirmed.
.gitattributes pins *.sh to LF. The script is bash on a Linux runner; committed
with CRLF from a machine with core.autocrlf=false it would fail on line one
with `$'\r': command not found`, which reads as a broken pipeline rather than a
line-ending problem.
Verified by running scripts/ci-checks.sh locally end to end, exit 0. Only the
npm ci line was skipped, because it would rewrite the 5,230 committed
node_modules files; frontend/Dockerfile already builds that way. Both workflow
files were parsed and their job graph inspected.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A CV goes through four steps before it is usable: the intake classifier
decides it is an application, the PDF text is extracted, an agent matches it
against job posts, and only then is an ATS score written. A PDF with no
readable text stops at step two. It is never matched and never scored.
The list said nothing about any of this. The parse badge existed only in the
detail pane, so a dead row looked exactly like a good one until you clicked
it. Across eleven hundred applications that is not discoverable, and the
candidate whose file happened not to open is simply lost.
The row now carries the badge, with two deliberate limits:
- Exceptions only. Parsing, Failed and Pending show; Parsed shows nothing.
A green chip on the overwhelming majority of rows is decoration that
buries the two states worth spotting, and no badge already reads as fine.
The detail pane still shows every state, Parsed included, because there
the row is the whole subject.
- Email only. Sheet Form applicants have no mailbox attachment to parse.
The guard is redundant against today's mapFormRow, which sets no
resumeStatus at all, and is kept as a tripwire rather than a load-bearing
check — the comment says so rather than overclaiming.
"Failed" on its own tells a recruiter nothing to do next, so each state got a
plain-language tooltip saying what happened and that the attachment is still
there to open by hand. That needed Badge to forward `title`, which it did not.
The colour rule was duplicated inline in the detail pane; it is now one
helper both halves call, so the same state cannot paint two colours.
Four assertions added to inbox-loading.test.mjs. Three are proven sensitive
by reverting the change: removing the badge fails the label and tooltip
checks, and badging every state fails the exceptions-only check. The fourth,
that form rows stay unlabelled, passes even without the guard and is marked
in the test as a tripwire, not proof.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Opening the Recruitment Inbox showed skeleton placeholders every time, and
on the combined All channel it showed them stacked ABOVE rows that had
already arrived — the channel ORs its two sources' pending flags together,
so the email rows sat under placeholders while the sheet fetch finished.
The queue is a local table, not a live feed. Rows only appear when the Sync
worker writes them, and that path already invalidates qk.mailbox.all(). So
refetching on every visit bought nothing and cost a full-width skeleton each
time — worse on the All channel, which fetches BOTH sources unpaged and so
re-downloaded thousands of rows to render ten.
- LIST_CACHE / COUNT_CACHE: 10 min staleTime, 1 h gcTime, keepPreviousData.
A revisit inside the window paints rows immediately and issues no request.
- Placeholders now mean "nothing to show yet": gated on the list being
empty. A refetch over live rows is a 2px bar and the word "Updating…",
with the rows readable and clickable throughout.
- "Updated 4 min ago" + a Refresh button under the search box, because a
cached list that never admits its age reads as a broken list. Refresh
re-reads the DB; Sync pulls new mail from Outlook. Both tooltips now say
which is which — two circular arrows were indistinguishable.
- Search debounced to 300ms. Each keystroke used to mint a query key, a
request and a skeleton, so the list strobed while you typed.
- resume_text dropped from the list row mapping. serialize_application
ships the whole extracted CV on every row and the queue renders none of
it; caching a thousand of them for an hour is not a trade worth making.
The detail query fetches it for the one row actually open.
Trade-off: a sync run started elsewhere is now invisible here for up to ten
minutes. The age label and the Refresh button are the deliberate mitigation.
inbox-loading.test.mjs pins all of it, driving hand-gated fetches so the
frames a fast API flashes past become assertable: both sources pending, one
source home, and a second visit served from cache. Reverting the placeholder
rule reproduces the original defect as "skeleton=true rows=2". Wired into
npm run verify; needed a mountRoute export on the smoke harness, since
renderRoute tears the tree down before those intermediate frames can be read.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Migration 027 moves live members of the UI-created Manager role onto
the seeded hiring_manager (which has carried the same
manager_candidates bundle since 024) and soft-deletes it - guarded and
idempotent, the seeded role is never matched.
Access Control no longer lists candidate: it is the applicant account
type every candidate user sits on, managed nowhere near a permission
matrix. The row stays in the DB.
New lib/format.js formatRole renders snake_case role names and
ALL-CAPS status enums as Title Case everywhere users see them -
Access Control, Settings user badges and role picker, the topbar
profile, Candidates role column and export, and the inbox
application-status badges (INTERVIEW -> Interview).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The organisation runs four staff roles - system_administrator,
recruiter, hiring_manager, department_head. Migration 026 soft-deletes
hr_administrator, interviewer and ceo (listings filter on is_deleted,
so they vanish from Access Control and every role picker). candidate
stays: it is the applicant account type every candidate user sits on,
not a staff role. Guarded: a role that still has live members is left
untouched until they are reassigned, and the idempotent migration picks
it up on a later boot.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New shared lib/exportXlsx.js: every Export button now downloads a
dashboard-flavoured .xlsx - deep-green title band with lime text, mint
meta row (view, row count, date), ink-teal header row, zebra data rows,
frozen header and autofilter. exceljs is imported dynamically so its
~1MB chunk only downloads when an export is clicked.
- Inbox: exports the loaded view (DB-filtered; no extra request)
- Candidates: the Export button was a stub that only fired a toast -
it now really exports the filtered account list
- Talent Pool: upgraded from plain CSV to the same styled workbook
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Export downloads the current view - channel, tab and search respected,
fetched unpaged - as UTF-8 CSV (BOM for Excel) with both sources'
columns: name, contact, position, channel, source, received, status,
city, notice period, ATS score, assigned job.
All channel resilience: when exactly one source fails, the healthy
list stays with a one-line notice naming the gap; the full error state
now renders only when there are no rows at all (cached rows beat a
scary banner over a working list).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The stacked split nested two scroll wells (list and detail each carried
max-height + overflow-y auto) inside the page scroll - scrollbars within
scrollbars on small screens. At <=900px both panes now flow naturally in
the one page scroll, and selecting an application swaps the list out for
the detail pane with a Back to list button (standard master-detail
collapse); selection also scrolls to the top so the detail header is in
view. Desktop keeps the two-pane split unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Standard card language instead of the email-head strips: Contact &
application, Profile and Matching roles are now proper cards with
card-heads. The roles panel collapses three overlapping controls into
one flow - a single Browse roles action, with Assign appearing only
once a selection exists (a permanently disabled primary button read as
broken UI). Sheet provenance moves off the floating header corner into
the Imported from ... row N caption, and the action bar gains a
divider (email pane too, for consistency).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The stacked pager read as three loose rows with 'of N' printed twice.
Queue-scoped: drop the duplicate page-size total (the Showing line
already carries it), wrap page-controls with even gaps, and slim the
page buttons so all nine nav controls (4 chevrons + up to 5 numbers)
fit the ~350px split column on one row.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The combined stream leads the channel pills (All / Email / Sheet Forms)
and is the channel the inbox opens on.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Third channel pill beside Email / Sheet Forms. Both sources are fetched
unpaged (their endpoints read a missing top/limit as no LIMIT), merged
newest-first, and paged client-side - per-source skip/top cannot compose
into a correct global page. Rows carry kind (email/form) so the detail
pane, mark-read (email rows only get checkboxes; sheet rows have no
mailbox read state) and the kind-aware state/duplicate mutations all
pick the right endpoint per row. Tabs collapse to the shared set (no
Unread), counts and totals sum both sources, and the sheet filter spans
every sheet tab on this channel.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The unpaged switch lived only in the bottom Per-page dropdown and went
unnoticed. The bulk bar now carries a Show all (N) / Show paged button
(hidden while rows are ticked, since the bar swaps to selection
actions); it drives the same pageSize state, so the dropdown stays in
sync. The bar wraps now - four controls no longer fit one line in the
34%-wide split column at laptop widths.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Integrates the Per-page dropdown (10/50/100) with the inbox All option:
All is now a fourth dropdown entry (opt-in via allowAll) instead of a
separate button. Restores what the stale-branch merges on main clobbered
from PR #46: mobile.test.mjs, the test:mobile script and the
puppeteer-core devDependency.
PageSizeField gains an opt-in All toggle beside the numeric input
(sentinel value all; the input disables while active). Only the
Recruitment Inbox opts in: with All active the fetch omits top/limit,
which /inbox/all-applications and /sheet/form-data/fetch already read
as unpaged (Query(None) -> no LIMIT), so the whole tab renders as one
page for both the Email and Sheet Forms channels. Every other table
keeps its existing paged-only control.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- .progress-stage-grid gets the same min-width:0 blowout guard as .grid,
and stacks to one column under 400px (two columns left ~56px for a
stage label at 320)
- mobile.test.mjs: add the new progress/requisitions routes (27 total)
- __smoke__/entry.jsx: main added the /progress route but never
registered the Progress screen in the harness map, so the smoke test
rendered h(undefined) and /progress failed on main itself
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Audited all 25 routes at 320/375/390/430/768 with browser automation.
Root cause of most overflows: grid items default min-width:auto, so one
wide intrinsic child (a select option, the 620px RBAC matrix) pushed
whole cards past the viewport.
- .grid > * / .rbac-layout > * min-width:0 (CV Import, Interviews,
Tasks, Access Control card blowouts)
- calendar: minmax(0,1fr) columns — SAT was clipped off-screen at 320
- .seg wraps (Tasks filters), .card-head wraps <=900
- sticky mobile table column: first column (identity), was nth-child(2)
- tooltips display:none until hover + .content overflow-x clip (killed
a 7px sideways wiggle from invisible tooltip boxes)
- Ask Analytics form: design-system input styling, stacks on phones
- bar/grouped-bar charts thin x labels by slot width (overlap on phones)
- Candidates sort label+select wrap as one unit
- new: mobile.test.mjs + npm run test:mobile (puppeteer-core devDep,
drives installed Chrome) — fails on sideways scroll or runtime errors
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Backend: new GET /analytics/applications-per-job/fetch (analytics.view) counting
inbox + manual-upload applications per job on the same basis as the funnel, with
zero-application open reqs included. Per-job group-bys added to Inbox_Messages,
Manual_UPLOAD_CANDIDATE; JobPosts.list_open_reqs for the zero-fill.
Frontend: Dashboard rewritten as a filterable summary (Week/Month/Quarter/Year +
department) - My Tasks, Today's Schedule and Quick Actions removed; 8 KPI tiles
(Hires and Offers Sent now shown); Applications per Job hero row-list; pipeline
card refed from /analytics/funnel so it obeys filters; Offer Book, Needs
Attention and Recent Activity cards added. ChartCard and time ranges extracted
to shared modules used by both Dashboard and Analytics.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- talent_runs.cost_usd records each run's actual charge (usageTotalUsd),
accumulated across the broadened re-run ladder (migration 018).
- GET /talent/account: live balance and cycle spend from Apify
/users/me/limits (nulls when Apify is unreachable) plus the observed
$/profile over recorded runs.
- Header shows Balance / Spent / $-per-profile chips that refresh with
every search; the run status line shows the last search's cost and the
confirm dialog estimates from the live average.
- Responsive: toolbar controls stack edge-to-edge and candidate card
footers wrap instead of clipping their buttons on phones.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Talha Ahmed
ahmed.mujtaba