Shortlist (working name)
Job matching and CV tailoring platform, built from Yuval's scheduled job scan and CV engine.
How this repo is built: gates
Every component arrives as one pull request, a "gate". Nothing moves on until the gate is approved.
| Gate | Component | Status |
|---|
| 0 | Foundation: schema, data isolation, login, repo layout | Approved (PR #1) |
| 1 | Profile from CV: upload, parsing, skills, proof bank, suggestions | Approved (PR #2) |
| 2 | Scoring rules per user, target titles and priorities | Not started |
| 3 | Job sources and validation | Not started |
| 4 | Job updates (digest) | Not started |
| 5 | CV tailoring on the template | Not started |
| 6 | Live dashboard | Not started |
Each gate has a report in docs/gates/ with what was built, the test results against the scheduled task's real output, and open questions.
Layout
apps/web/ Next.js app (Vercel). Uses only the publishable key; row level security protects data.
worker/ Python worker: sourcing, scoring, CV building, digests. Uses the secret key. Never runs in the browser.
supabase/migrations/ Database schema, security policies, storage buckets.
supabase/tests/ Embedded Postgres tests: proves users can never see each other's data.
docs/gates/ One report per gate.
docs/reference/ What the scheduled task does today: the spec each gate is measured against.
Run the checks
cd supabase/tests && npm ci && npm test # database: isolation, CV parsing, audit
cd apps/web && npm ci && npm test && npm run build # web app (needs the env vars from .env.example)
cd worker && pip install -e ".[dev]" && pytest -q
The same checks run on every pull request (.github/workflows/ci.yml).
Database changes
New files in supabase/migrations/ are applied to the live Supabase project automatically when they reach main (.github/workflows/migrate.yml). Merging the pull request is the approval; the same migrations have already passed the database tests in CI. The workflow needs two repository secrets, SUPABASE_ACCESS_TOKEN and SUPABASE_DB_PASSWORD; without them it skips with a warning.
