Improved application flow, assessment tools, and security across the platform
This release strengthens the application and hiring process with better candidate tracking, bilingual assessment instruments, and enhanced security. We've fixed critical issues in job posting, contract management, and data handling to ensure a smoother experience for both talent and clients.
Highlights
- Hiring Applications now include source tracking and confirmation emails, making it easier to understand where candidates come from and confirm their submissions
- Hiring Assessment tools now fully support both English and Spanish with bilingual personality profiles and skills tests ready to use
- Hiring Job posting and contract features are more reliable with fixes to confidentiality settings, offer builders, and data consistency
- Hiring Security hardening across authentication, data storage, and session management to protect candidate and client information
- Website Role pages are now more discoverable in search results with improved content layout and structured data
All 248 changes in v3.19.0
migrate Reddit Pixel + Google Ads conversions from GTM to first-party code
Task 9 — gate/notice/context/locale (4 sub-features)
Task 9 follow-up — structured signup-context + viewer-resolved client notice
honest meeting-connection state + real provider icons & row actions
render boolean flags as a toggle switch + clearer filter label
searchable, multi-column feature-flags panel
runtime kill-switch for notification emails
SenderResolver tiers 1+2 + brand the candidate email; remove dead career-branding
public reviews + double-blind reveal + reminders (Track C)
add client dashboard command center flag
add unified-apply-routing + notification-context-resolvers (default off)
user lifecycle attribution + deletion-request columns (migrations)
hide posting company by default (flip jobs.confidential_default)
admin syndicate action (modality A) with confidential guard
admin syndicate panel (modality A) + bilingual copy
Bluesky direct transport + adapter (facets, external image embed)
branded job-card asset generation via next/og → R2
durable Inngest posting worker (Task 10)
flag, channel/social.requested event, widened channelKind, cookie attribution fields
Mastodon direct transport + adapter
P2D — clicks→apply + engagement rollup report (admin surface)
Phase 2B — compose-&-approve data layer (drafts, edit, schedule)
Phase 2C compose-&-approve SocialComposer UI
stamp click→apply attribution on job applications
tracked-link generation + per-platform draft composition
transport resolver + tests for Phase 1 platforms
10x the LinkedIn prefill — proper casing, flat reveal, one button
catalog-aware skills in the LinkedIn review (matched vs custom)
failure-isolated buildResumeCandidate (degrade to LinkedIn-only)
failure-isolated buildResumeCandidate (degrade to LinkedIn-only)
forward resumeKey through the prefill hook + scan card
forward resumeKey through the prefill hook + scan card
let the user choose the photo instead of silently overwriting
P2b — combined résumé+LinkedIn analyze (flag-gated, off by default)
P2b — combined résumé+LinkedIn analyze (flag-gated, off by default)
persist the LinkedIn profile photo to R2 on apply
polish the LinkedIn scan loading state
restore the LinkedIn scan across a refresh (no re-scan)
résumé → IntermediateProfile merge-candidate adapter
résumé → IntermediateProfile merge-candidate adapter
runMergeChain accepts seedCandidates (résumé as a merge source)
runMergeChain accepts seedCandidates (résumé as a merge source)
seed the résumé as a candidate in the combined extraction merge
seed the résumé as a candidate in the combined extraction merge
show role + education dates in the LinkedIn review
startLinkedInPrefill threads resumeKey (skips cache when fusing)
startLinkedInPrefill threads resumeKey (skips cache when fusing)
step 5 as two equal paths — upload CV | scan LinkedIn
tag work-history rows with their source (LinkedIn vs AI)
talent onboarding fast-track (prefill-first short path)
consolidate route tree under Vercel's 2048 Build-Output cap, closes hi#cardinality
correct Reddit Pixel ID to a2_hbaapdt0410v
guard empty post_id in getApplyHref + correct stale branding doc
signup-context channel stores src (traffic source) per migration DDL
validate openExternal scheme (desktop) + gate cleartext to dev (mobile)
normalize imported-candidate columns (vendor-agnostic)
address adversarial review findings
reconcile feedback domain with post-rebuild schema
stamp account_type=talent at the DB level (drift catch-all)
remove redundant as-string casts, deepen route test, share admin client
scope admin review writes to the reviewed session
serve talent KYC/resume docs via auth-gated presigned route
store talent KYC/resume under private R2 keys (1.4 write-site)
narrow EXECUTE on admin governance functions
graceful formatCurrency, UUID Nango ids, drop talent_db alias
guard missing asset URL, clear stale error on retry, tighten test cast
Phase 2 review fixes — B1/B2/M1/M2/M4/M5
harden Phase 1 syndication — idempotent worker, /j rate-limit, caption/link fixes
Mastodon transport review findings — restore fetch, assert media_ids, header casing
Phase 2 review fixes — idempotent upserts, atomicity, type safety
Task 6 review — wordmark D+iii+rect, title wrap, test height assert
never default the R2 bucket folder to the production namespace
stop R2 logo/avatar uploads landing at a double-folder path
verify session via getUser() in channel route gate
guard asset-insert failure + review minor fixes
stop task-file R2 keys double-prefixing the env folder
case cached prefill results + keep résumé reachable mid-scan
de-AI the LinkedIn scan panel (button, copy, avatar)
drop revalidatePath from onboarding data-key writer (crashed v2)
isolate résumé extraction failure — degrade to LinkedIn-only
isolate résumé extraction failure — degrade to LinkedIn-only
make onboarding city optional (unblocks the location step)
stop mangling extracted skills + drop the work-history AI sparkle
whitelist webapp-linkedin-prefill as a client i18n namespace
Bright Data adapter (async snapshot, auto-skips until keyed)
canonical LinkedIn URL normalization
fallback orchestrator with soft/hard failure detection
flag-gate the browser-unverified UX (option B)
Inngest job + event for background enrichment
M0 DS floor + surface usedLlm/status for trust cues, closes #0A66C2
M1 multi-source merge + FieldProvenance spine
M1 wire merge chain into the Inngest job
M2 AI-derive skills from descriptions (span-verified)
M3 realtime streaming reveal (broadcast + progress)
M3 review trust cues + visible skill chips
M3 rich editable review (curate skills, drop roles/edu)
M3 wizard-collapse — skip the steps the import filled
M4 quality feedback signal (flywheel foundation)
M5 verified-from-LinkedIn trust signal at review
M6 self-tuning provider trust (safe design)
M7 enrichment-graph persistence (self-enrichment)
migration — attempt ledger + provider registry rows
normalize provider data into ResumeDataSchema
offer 'Scan your LinkedIn' on the résumé-upload step
onboarding consent + pre-fill + editable review UI
PeopleDataLabs adapter (live, dataset floor)
Piloterr adapter (live primary, auto-skips until keyed)
profile re-import surface
provider interface + usable-result predicate
provider registry, monthly quota, per-user rate limit
server actions (start / status / apply)
references, talent-discovery report, skills matching & onboarding polish
v2 Phase 6 — resurrect tax forms + talent Documents surface
localize role-snapshot duration & experience labels
correct Piloterr adapter to the live response schema
align account-deletion self-service to real schema
verify session via getUser() on talent page gates
reveal checks global graph before charging vendor (Phase 2)
vendor-agnostic ingest + global contact cache (Phase 1)
write source_records provenance from edge-fn + linkedin-prefill (Phase 3)
capture identityMe at sign-up/sign-in, not just Connect
capture identityMe snapshot in OAuth callback
captureLinkedInIdentity — R2 photo + service-role snapshot upsert
commit the connect/return-path/dev-recovery infrastructure
Connect-with-LinkedIn button on onboarding step (manual linking)
connection-only onboarding step + 10x redesign
identity read (snapshot + IDENTITY-verified) + on-read validation comparator
imported-identity card on onboarding connect step
parse identityMe headline, memberId, lastRefreshedAt, picture expiry
probe /identityMe for profileUrl on OAuth connect
Verified-via-LinkedIn badge on candidate record (client/admin)
phase 2 — live pacing engine + multi-channel + LinkedIn/WhatsApp
phase 3 — HITL console, dashboards, unified inbox
phase 4 — bilingual client surface + WhatsApp templates
phase-1 foundation — schema, contract, pure engine modules
phase-1 stage 2 — durable engine, stores, actions, webhook
phase-1 stage 3 — flag-gated admin operating UI
restore talent-api batch ingest as direct enrichment upserts
bump migration timestamp +1s to resolve merge collision
harden engine — adversarial-review fixes (12 confirmed bugs)
harden phases 2-4 — adversarial-review fixes (5 confirmed bugs)
bilingual i18n migration + bilingual Big Five keystone + 36 authored instrument seeds (English, pre-revision) + pgTAP
bilingualize 18 instrument seeds (EN+ES) + pgTAP i18n assertions
bilingualize the final 18 instrument seeds (EN+ES) — full catalog now bilingual
client library subtype tabs (skills tests vs personality profiles)
engine migrations — dimensions, results.profile_data, satisfied_by gating
G1 — response capture persistence (video/file/text)
G2 — analytics computation core (funnel, rates, distribution, item difficulty)
Likert taker renderer (bilingual scale) — profile instruments now takeable
profile DB-row adapter (buildProfileInputs/extractLikertValue) + tests (23 green)