11 KiB

Raw Blame History

Repository Inspection Evidence — verified facts

Working note. Every claim below was verified by direct inspection on 2026-07-29. Authoring agents MUST use these facts and cite these file paths. Do not re-derive or contradict them. Do not invent files, frameworks, or config that is not listed.

A. What the repository actually is

A static, browser-only frontend prototype. There is no backend of any kind.

Complete file inventory of the prototype as inspected on 2026-07-29 (excluding .git/, .backup-prebrand/). Files added afterwards by this design package are listed separately below, so the prototype's own line counts stay comparable:

index.html                 287 lines
css/styles.css            1269 lines   (design system, brand-tokenised)
js/  (22 files, ~4,780 lines total — `wc -l js/*.js` = 4,779)
  data.js      512   charts.js  347   candidates.js 441   inbox.js   332
  app.js       275   jobs.js    252   aiassistant.js 218  interviews.js 209
  misc.js      207   import.js  176   jobboard.js   172   pipeline.js 166
  dashboard.js 170   ui.js      252   offers.js     139   assessments.js 126
  recruiterhub.js 121  rbac.js  117   analytics.js  114   reports.js 109
  settings.js  193   tasks.js   131
devserver.py                36 lines   (no-cache static server, added for preview only)
docs/TalentFlow-ATS-Business-Requirements-v1.0.docx
.gitignore                  42 lines
.claude/launch.json
.audit.js                              (dev-only QA helper, gitignored)

Added after inspection by this design package, and not part of the prototype or of any line count quoted anywhere in these documents:

docs/architecture/                     this package
tools/check_evidence_citations.py      documentation gate: verifies every `path:line`
                                       citation in docs/architecture against the source

B. ABSENT — verified by `find` / direct check

None of the following exist anywhere in the repository:

package.json, any lockfile, node_modules/
requirements.txt, pyproject.toml, Pipfile
composer.json, go.mod, Gemfile, pom.xml, build.gradle
Dockerfile, docker-compose.yml, Makefile
.env, .env.example (none present; .gitignore anticipates them)
Any migration directory or migration tool
Any ORM, query builder, or database driver
Any test file, test runner, or CI configuration (.github/ absent)
Any build tooling (tsconfig.json, vite.config.js, webpack.config.js)
Any API route, controller, service, or server-side code
Any meeting transcript or recruitment document (searched repo and ~/Documents to depth 2 — only the BRD .docx this project produced)

Consequence: there is no backend stack to preserve. Operating Rule 9 ("do not replace the existing stack") therefore constrains only the frontend and design system, not the backend, which is a greenfield choice.

C. Frontend architecture — verified

Fact	Evidence
Zero network calls. `grep` for `fetch(`, `XMLHttpRequest`, `axios`, `$.ajax`, `WebSocket`, `EventSource` across `js/` and `index.html` returns nothing. The UI is fully self-contained.	repo-wide grep
All data is generated in-browser at load by a seeded LCG PRNG (`seed = 88123`), so the dataset is stable across reloads but exists only in memory. Nothing persists.	`js/data.js:8-10`
100 candidates, plus jobs/interviews/assessments/offers/inbox generated at load.	`js/data.js:110-131`
Hardcoded "today" — `new Date('2026-07-09')` used as the current date in multiple places.	`js/data.js:237`, `js/candidates.js:18`, `js/jobboard.js:167`
`localStorage` used only for the theme preference. No session or app state.	`js/app.js:64,193,198`
Client-side hash router over `location.hash`; views are functions returning HTML strings plus an `onMount` hook. 23 routes.	`js/app.js:20-57` (`Router.go`, `Router.render`), `ROUTES` map `js/app.js:7-16`
Global namespaces on `window`: `DB`, `UI`, `Charts`, `App`, `Router`, `Views`, plus per-module globals. No modules, no bundler, 22 `<script>` tags in order.	`index.html:264-285`

D. Authentication and authorization — verified ABSENT

Fact	Evidence
No authentication whatsoever. No login screen, no token, no session.	repo-wide grep
Security settings are inert UI chrome — 2FA, SSO, session timeout and password policy render as toggles/selects with no handlers and no persistence.	`js/settings.js:148-154`
The RBAC permission matrix is a display widget only. Clicking a cell mutates an in-memory array; nothing reads the matrix to gate behaviour. There is no `can()`, `hasPermission()`, or equivalent anywhere.	`js/rbac.js:78`, `js/rbac.js:83-85`, `js/rbac.js:111-112`
Roles/permissions are demo data: 8 roles, 13 modules, 8 permission types, matrix derived from a single `level` cutoff index.	`js/data.js:425-446` (`rbacModules`, `permTypes`, `rbacRoles`, `buildMatrix`)

E. SECURITY — P0 finding: systemic XSS exposure

Fact	Evidence
No HTML escaping exists anywhere. `grep` for `escapeHtml`, `sanitiz`, `DOMPurify` returns nothing.	repo-wide grep
34 `innerHTML` assignments across 14 files; every view builds HTML by template-string interpolation of data values.	`grep -c innerHTML js/*.js`
Candidate-controlled fields are interpolated raw into markup — e.g. `${c.name}`, `${c.currentTitle}`, `${c.location}`.	`js/candidates.js:68`
Inline event handlers with interpolated values, e.g. `onclick="Candidates.openProfile('${c.id}')"`.	`js/candidates.js:121`

Why this is P0 and not theoretical: today the data is synthetic and generated locally, so nothing is exploitable. The moment real data flows in — and the two primary Phase 1 sources are CV files and inbound email, both attacker-supplied — every screen becomes a stored-XSS sink. A CV containing <img src=x onerror=...> in its name field would execute in a recruiter's session with full application privileges. This must be fixed before any real data is rendered, and it is a rendering-layer change, not a backend one.

F. Data-model gaps in the prototype (all confirm the prompt's principles)

Gap	Evidence	Implication
No candidate/application separation. One flat `candidates` array carries `jobId`, `jobTitle`, `stage`, `aiScore`, `recruiter` directly on the candidate. One candidate cannot hold two applications.	`js/data.js:117-127`	Confirms prompt §5.2 — must be split.
ATS score is a random integer, `aiScore: int(52,98)`. No components, no evidence, no model, no version. A separate client-side "relevance" blend also exists.	`js/data.js:123`, `js/candidates.js:18`	Confirms prompt §5.6 — nothing reusable.
No raw intake layer. The inbox is a pre-resolved array already joined to candidate and job; there is no unresolved/failed state that cannot become a candidate.	`js/data.js:284-300` (`processingStatuses`, `inbox`)	Confirms prompt §5.1.
No versioning of jobs or requirements. Jobs are mutable single records.	`js/data.js:85-108`	Confirms prompt §5.3.
Recruiter assignment is a single scalar (`recruiter`, `recruiterId`) on the job/candidate. No history, no primary/supporting distinction.	`js/data.js:96`, `js/data.js:123`	Confirms prompt §5.4.
No history tables. Current values only — no stage history, assignment history, or status history.	`js/data.js` throughout	Confirms prompt §5.5.
Money is a bare integer. `salary: int(90,190)*1000`. No currency field anywhere in the dataset; offer validation only checks `> 0`.	`js/data.js:126`, `js/offers.js:129`	Needs decimal + ISO currency.
No timezone discipline. JS `Date` objects, `toLocaleDateString` for display, hardcoded "today". No UTC storage, no tz-aware scheduling.	`js/data.js:54,237`	Interview scheduling will need real tz handling.
No requisition concept at all. No director role scoping.	absent from `js/data.js`	Phase 2 greenfield.

G. Genuinely reusable assets (retain)

Asset	Why it is worth keeping	Evidence
Design system — 1269 lines of tokenised CSS: dual light/dark themes, Utopia brand palette and type hierarchy, responsive 320px→ultrawide, WCAG 2.1 AA verified across 23 routes × 2 themes (8,459 text nodes, 0 failures), 44px touch targets, safe-area/`dvh` handling.	Substantial, verified, brand-compliant work. Rebuilding it would be pure loss.	`css/styles.css`
`js/ui.js` primitives — `modal`, `toast`, `dataTable` (sort + paginate + render hooks), `badge`, `avatar`, `avatarStack`, `scoreChip`, `pbar`, `fieldError`, `clearErrors`, icon set.	A coherent component vocabulary already matching the design system.	`js/ui.js:251` (export list)
`js/charts.js` — dependency-free canvas chart engine (line/area, bar, grouped bar, doughnut, horizontal bar, sparkline) reading colours from CSS custom properties so it re-themes automatically.	Avoids adding a charting dependency; already theme-aware.	`js/charts.js:339`
23-route information architecture — the module breakdown, navigation grouping and screen inventory are a validated UX artefact even though the data layer behind them is fake.	Useful as the Phase 1+ screen backlog.	`js/app.js:7-16`

H. Frontend liabilities (refactor)

Liability	Evidence	Note
String-template `innerHTML` rendering with no escaping — see §E.	34 sites	P0 before real data.
No build step, no modules, 22 ordered `<script>` tags, everything on `window`. Complex forms (requisitions, offers, scorecards) in this pattern will not scale to 25 modules with two developers.	`index.html:264-285`	Real tension: retain the CSS/UX, reconsider the rendering layer.
No client-side validation library; ad-hoc per-form checks.	`js/offers.js:129`, `js/ui.js:241-249`
No tests of any kind.	absent
`.gitignore` contains a Python section and `.env` rules but no Node section. This postdates `devserver.py` (added for local preview), so it is weak/ambiguous evidence of stack intent and must not be presented as a decision input.	`.gitignore`	Do not over-read this.

I. Team

Talha Ahmed — senior; ATS scanning, candidate matching, AI workflows, architecture, integrations.
Ahmed Mujtaba — junior; capable coder. Must get small, modular, varied, independently demonstrable work across frontend, backend APIs, validation, testing, AI UX, dashboards and workflow logic. Explicitly not only repetitive CRUD or data cleaning. Every task needs a Talha review checkpoint.

J. Hard constraints for all authors

Internal Utopia Brands system. Not multi-tenant SaaS.
One platform, one master data model, one relational database. No regional databases.
Do not invent repository contents. If something does not exist, say so and cite §B.
Do not print or copy secret values (none exist to leak — no .env present).
No transcript exists; the assignment prompt is the authoritative requirements source. State this explicitly rather than implying a transcript was read.

11 KiB Raw Blame History Unescape Escape