Feature Strategy

Overview

• Total features: 11

Core Features

Resume PDF Upload

• ID: feature-1
• Priority: high
• Category: core
• Description: Allow users to upload a single resume PDF without requiring signup.
• User impact: Users can easily upload their resume without friction or account creation.

Requirements:

• Provide a single landing page for uploading one resume PDF.
• Accept only PDF files with MIME type application/pdf.
• Enforce a maximum PDF size of 4MB.
• No user account or login required.

Technical requirements:

• Support asynchronous upload handling.
• Validate file type and size before processing.

Asynchronous Resume Processing with Status

• ID: feature-2
• Priority: high
• Category: core
• Description: Process uploaded PDF asynchronously to extract structured portfolio data with visible processing status.
• User impact: Users receive feedback on processing progress and errors, ensuring transparency and trust.

Requirements:

• Parse PDF asynchronously after upload to extract summary, experience, skills, education, and projects.
• Show visible processing status on UI using polling (no long blocking requests).
• Return clear error messages if parsing fails.
• Reject portfolio publishing if parsing fails.

Technical requirements:

• Support async processing pipeline with status updates.
• Handle parse failures gracefully with user feedback.

Public Portfolio Page Generation

• ID: feature-3
• Priority: high
• Category: core
• Description: Generate a polished, mobile-friendly public portfolio page at a unique URL after successful parsing.
• User impact: Users get a shareable, professional portfolio page without exposing private contact details.

Requirements:

• Publish portfolio at URL pattern /p/{slug}.
• Strip email, phone, and address from public page at parse time to protect privacy.
• Return 404 when portfolio is unpublished.
• Ensure portfolio is mobile-friendly and visually polished.

Technical requirements:

• Generate unique slugs for portfolio URLs.
• Enforce privacy by removing PII from public pages.

Private Edit Link with Signed Token

• ID: feature-4
• Priority: high
• Category: core
• Description: Provide users a private edit URL secured by a signed token to update portfolio content without login.
• User impact: Users can easily refine and manage their portfolio securely without creating accounts.

Requirements:

• Return a private edit link after successful upload and parse.
• Allow editing of text fields extracted from resume.
• Allow optional photo upload to enhance portfolio.
• Allow unpublishing or deleting the portfolio via edit link.
• No user login or account required; access controlled solely by signed token.

Technical requirements:

• Implement secure token-based access for editing.
• Support editing UI for text and photo updates.

SEO and Visibility Controls

• ID: feature-5
• Priority: high
• Category: core
• Description: Allow portfolio owners to control search engine indexing and visibility of their portfolio pages.
• User impact: Users control whether their portfolio is discoverable by search engines, protecting privacy or enabling visibility.

Requirements:

• By default, set public portfolio pages to noindex via robots meta tag and HTTP header.
• Provide toggle in edit UI to allow search engines to index the portfolio.
• Implement two flags: is_published (controls 404 visibility) and allow_search_indexing (controls SEO).

Technical requirements:

• Support dynamic meta tags and headers based on flags.
• Enforce 404 response when is_published is false.

Infrastructure Features

SaaS Web Deployment

• ID: infra-1
• Priority: high
• Category: infrastructure
• Description: Deploy the application as a SaaS web app accessible via browser without signup.
• User impact: Users access the service easily via web without installation or signup.

Requirements:

• Support single monolith deployment combining UI and API route handlers.
• Support asynchronous backend processing pipelines.
• Support storage for uploaded PDFs and optional photos.
• Support a small relational database (~3 tables) for portfolio data and tokens.

Non-Functional Requirements

Upload Rate Limiting

• ID: nfr-1
• Priority: high
• Category: nfr
• Description: Limit the number of uploads per IP address to prevent abuse.
• User impact: Prevents service abuse and ensures fair usage for all users.

Requirements:

• Enforce a maximum of 5 uploads per hour per IP address.

File Size and MIME Validation

• ID: nfr-2
• Priority: high
• Category: nfr
• Description: Validate uploaded files to ensure they are PDFs and within size limits.
• User impact: Users receive immediate feedback on invalid uploads, improving experience and security.

Requirements:

• Reject files larger than 4MB.
• Accept only files with MIME type application/pdf.

Privacy by Default

• ID: nfr-3
• Priority: high
• Category: nfr
• Description: Ensure user privacy by stripping contact details from public pages and defaulting to noindex.
• User impact: Users' private contact information is protected by default, increasing trust.

Requirements:

• Remove email, phone, and address from public portfolio pages at parse time.
• Default portfolio pages to noindex for search engines.

Error Handling and User Feedback

• ID: nfr-4
• Priority: high
• Category: nfr
• Description: Provide clear error messages and UX feedback when parsing or publishing fails.
• User impact: Users understand issues and can correct them, improving satisfaction.

Requirements:

• Show clear error messages if PDF parsing fails.
• Prevent publishing of portfolios if parsing is unsuccessful.

Performance - Fast End-to-End Processing

• ID: nfr-5
• Priority: high
• Category: nfr
• Description: Ensure median processing time from upload to live URL is under 2 minutes.
• User impact: Users receive quick results, enhancing usability and engagement.

Requirements:

• Complete upload, parse, and portfolio generation in less than 2 minutes median time.

Date: Wednesday, July 15, 2026 Research as of: Wednesday, July 15, 2026 (2026-07-15) Version: 1.0.0 Technology research confidence: medium

Technology research sources:

• https://nextjs.org/docs/pages/guides/upgrading/version-13?utm_source=openai
• https://nextjs.org/docs?utm_source=openai
• https://wiki.postgresql.org/wiki/2026-02_Regression_Fixes?utm_source=openai
• https://www.postgresql.org/docs/?utm_source=openai

ResumeWeb Portfolio Builder — Enterprise-Grade Technical Architecture

1. SYSTEM OVERVIEW

1.1 High-Level System Design

ResumeWeb is a privacy-centric, no-signup SaaS web application that enables users to upload a resume PDF and receive a live, mobile-friendly portfolio page at a unique URL, with a private edit link for future modifications. The system is built for rapid demo delivery and minimal operational overhead, optimized for a solo developer deployment, and leverages modern serverless paradigms for both scalability and maintainability.

Key architectural decisions:

• Monolithic Next.js App Router (16.2.7): Both UI and API Route Handlers live in a single codebase, deployed as a monolith on Vercel.
• Async PDF Parsing Pipeline: Upload triggers an async job for PDF parsing and LLM-powered extraction, with status polling.
• Magic Edit Token (JWT, signed): No user authentication; edit link is a signed, time-unlimited token.
• Vercel Blob Storage: For uploaded resumes and optional portfolio photos.
• PostgreSQL 18.4 (Supabase managed): For structured portfolio records, status tracking, and token management.
• Strict Privacy Controls: PII stripped on parse, noindex by default, SEO opt-in.

High-Level Data Flow

1. User uploads PDF → File validated and stored, async parse job created.
2. Async parser extracts data → Data stored in DB, public slug generated, edit token minted.
3. User polls for status → Receives edit link and public URL upon success.
4. User can edit or delete portfolio using edit link → Optional photo upload, visibility and SEO toggles.
5. Public page served at unique slug → PII always stripped, 404 if unpublished, SEO meta toggled by owner.

System Boundaries

• Frontend (UI & SSR pages): Next.js App Router pages, client-side React, Tailwind CSS.
• API Route Handlers: Next.js API routes (serverless functions) for all backend logic.
• Async Task Orchestrator: Serverless background jobs (Vercel Cron/Edge Functions or queue simulation).
• Database: Supabase Postgres (18.4).
• Blob Storage: Vercel Blob for PDFs/photos.

High-Level System Architecture Diagram

flowchart TD
 A["User Browser"]
 B["Next.js App Router (UI & SSR)"]
 C["API Route Handlers (Next.js 16.2.7)"]
 D["Async PDF Parser (Serverless Function)"]
 E["Supabase Postgres 18.4"]
 F["Vercel Blob Storage"]

 A -- Upload Resume PDF --> B
 B -- POST /api/upload --> C
 C -- Store PDF --> F
 C -- Create Parse Job & Status --> E
 C -- Trigger Async Parse --> D
 D -- Fetch PDF from F --> D
 D -- Parse & Extract Data --> D
 D -- Store Structured Data, Update Status, Generate Slug/Token --> E
 A -- Poll /api/status/:jobId --> C
 C -- Query Status --> E
 A -- Receives Edit Link & Public URL --> B
 A -- Access /p/:slug (public) or /edit/:token (private) --> B
 B -- Fetch Portfolio Data --> C
 C -- Query Portfolio --> E
 A -- Optional Photo Upload --> C
 C -- Store Photo --> F

2. TECHNOLOGY STACK

2.1 Stack Selection & Rationale

Alternatives: Supabase Storage (if Vercel Blob unavailable/insufficient).

2.2 Version Pins (Web Research Evidence)

• Next.js: 16.2.7 (nextjs.org)
• PostgreSQL: 18.4 (postgresql.org)
• Node.js: >=16.14.0 (Next.js 13+ requirement)
• Vercel: latest (platform, no version pin)
• Tailwind CSS: latest stable (2026)

3. ARCHITECTURE PATTERNS

3.1 Pattern Selection

• Modular Monolith (Serverless): Single Next.js App Router codebase with all UI and APIs. No microservices, no split repos. Rationale:

• Solo developer, minimal ops.

• Serverless deployment on Vercel.

• API Route Handlers support async jobs and status polling.

• Event-Driven Async Processing: PDF parsing and LLM extraction handled via async job (simulated queue or Vercel background function), with job status in DB.

• Token-Based Auth: Magic edit link using JWT, no user accounts, tokens scoped to portfolio.

3.2 Best Practices

• Strict input validation (file type/size, rate limiting).
• PII scrubbing at parse time.
• Error boundaries and user-centric error UX.
• Noindex by default, SEO opt-in toggle.
• Mobile-first/responsive UI (Tailwind CSS).

4. DATABASE DESIGN

4.1 Feature-to-Table Mapping

4.2 Complete Schema

Table 1: portfolios

Table 2: parse_jobs

Table 3: upload_limits

4.3 Relationships

• portfolios (1) ←→ (1) parse_jobs: Each portfolio has one parse job.
• upload_limits: Standalone, keyed by hashed IP.

4.4 Indexing

• portfolios.slug: unique, for fast public page lookup.
• portfolios.edit_token_jwt: unique, for edit link lookup.
• portfolios.is_published: for SEO/public lookup.
• portfolios.uploader_ip_hash: for rate limiting.
• parse_jobs.portfolio_id: for status polling.

4.5 Partitioning & Sharding

• Phase 1: No sharding or partitioning required (volume low).
• Phase 2+: Partition portfolios by created_at month if volume grows.

4.6 Backup & Recovery

• Supabase automated daily backups.
• Manual export before major schema changes.

4.7 ER Diagram

erDiagram
 portfolios {
 UUID id PK
 VARCHAR(32) slug
 TEXT edit_token_jwt
 TEXT pdf_blob_url
 TEXT photo_blob_url
 ENUM parse_status
 TEXT parse_error_message
 TEXT summary
 JSONB experience_json
 JSONB skills_json
 JSONB education_json
 JSONB projects_json
 BOOLEAN is_published
 BOOLEAN allow_search_indexing
 TIMESTAMP created_at
 TIMESTAMP updated_at
 TIMESTAMP deleted_at
 CHAR(64) uploader_ip_hash
 }
 parse_jobs {
 UUID id PK
 UUID portfolio_id FK
 ENUM status
 TEXT error_message
 TIMESTAMP started_at
 TIMESTAMP finished_at
 }
 upload_limits {
 CHAR(64) ip_hash PK
 INTEGER uploads_last_hour
 TIMESTAMP last_upload_at
 }

 portfolios ||--o| parse_jobs: "has"

5. API DESIGN

5.1 API Structure

• All endpoints are Next.js Route Handlers under /api/, not /api/v1/.
• Minimum 8 endpoints, as required; designed for clarity and minimal surface.

5.2 Feature-to-Endpoint Mapping

5.3 Complete Endpoints & Schemas

1. POST /api/upload

• Purpose: Accept a resume PDF, validate, store, create portfolio + parse job.
• Request: multipart/form-data
• file: PDF (max 4MB, MIME application/pdf)
• Response:
• 202 Accepted { jobId: string }
• Errors:
• 400 Bad Request (invalid file type/size)
• 429 Too Many Requests (rate limit)
• 500 Internal Server Error
• Rate Limit: 5 uploads/hour/IP

2. GET /api/status/:jobId

• Purpose: Poll parse job status.
• Response:
• 200 OK { status: 'pending'|'processing'|'success'|'error', errorMessage?: string, publicUrl?: string, editUrl?: string }
• Errors:
• 404 Not Found (unknown jobId)

3. GET /api/portfolio/:slug

• Purpose: Serve public portfolio page data.
• Response:
• 200 OK { slug: string, summary: string, experience: [...], skills: [...], education: [...], projects: [...], photoUrl?: string, allowSearchIndexing: boolean }
• 404 Not Found (unpublished or deleted)
• SEO: Sets X-Robots-Tag and meta tags based on allow_search_indexing.

4. GET /api/edit/:token

• Purpose: Fetch full portfolio data for editing (including PII if present).
• Auth: JWT in URL path (edit token).
• Response:
• 200 OK { slug: string, summary: string, experience: [...], skills: [...], education: [...], projects: [...], photoUrl?: string, isPublished: boolean, allowSearchIndexing: boolean }
• 401 Unauthorized (invalid/expired token)
• 404 Not Found (deleted)

5. PATCH /api/edit/:token

• Purpose: Update portfolio fields (summary, experience, etc.).
• Auth: JWT in URL path.
• Request:
• { summary?: string, experience?: [...], skills?: [...], education?: [...], projects?: [...] }
• Response:
• 200 OK { success: true }
• 401 Unauthorized
• 400 Bad Request (validation error)

6. POST /api/edit/:token/photo

• Purpose: Upload optional photo for portfolio.
• Auth: JWT in URL path.
• Request: multipart/form-data
• file: image/jpeg or image/png (max 2MB)
• Response:
• 200 OK { photoUrl: string }
• 401 Unauthorized
• 400 Bad Request (invalid file)

7. PATCH /api/edit/:token/visibility

• Purpose: Toggle publish/unpublish.
• Request: { isPublished: boolean }
• Response: 200 OK { isPublished: boolean }

8. PATCH /api/edit/:token/seo

• Purpose: Toggle SEO indexing.
• Request: { allowSearchIndexing: boolean }
• Response: 200 OK { allowSearchIndexing: boolean }

9. DELETE /api/edit/:token

• Purpose: Soft-delete portfolio.
• Response: 204 No Content

5.4 API Versioning

• Flat /api/ namespace per requirements; no /api/v1/ sprawl.

5.5 Authentication

• Edit endpoints: JWT token in URL path (/api/edit/:token).
• Public endpoints: No auth.

5.6 Rate Limiting

• POST /api/upload: 5/hour/IP, enforced via upload_limits table.

5.7 Error Handling

• Consistent error codes (400, 401, 404, 429, 500).
• User-facing error messages for parse failures, validation, and auth.

5.8 API Structure Diagram

flowchart TD
 A["User Browser"]
 B["POST /api/upload"]
 C["GET /api/status/:jobId"]
 D["GET /api/portfolio/:slug"]
 E["GET /api/edit/:token"]
 F["PATCH /api/edit/:token"]
 G["POST /api/edit/:token/photo"]
 H["PATCH /api/edit/:token/visibility"]
 I["PATCH /api/edit/:token/seo"]
 J["DELETE /api/edit/:token"]

 A --> B
 A --> C
 A --> D
 A --> E
 A --> F
 A --> G
 A --> H
 A --> I
 A --> J

6. COMPONENT ARCHITECTURE

6.1 Feature-Specific Components

1. Resume PDF Upload

• UploadPage: UI for file upload, pre-validation.
• UploadHandler: API Route Handler (/api/upload), validates file, stores PDF, creates portfolio record, triggers parse job.
• RateLimiter: Middleware in UploadHandler, checks upload_limits.

2. Asynchronous Resume Processing with Status

• ParseJobOrchestrator: Creates parse_jobs entry, triggers async PDF parsing.
• AsyncPDFParser: Serverless function, fetches PDF, parses/extracts data, strips PII, updates portfolio and parse_jobs.
• StatusHandler: API Route Handler (/api/status/:jobId), polls parse_jobs.

3. Public Portfolio Page Generation

• PortfolioPage: SSR page at /p/:slug, fetches sanitized portfolio data.
• PortfolioHandler: API Route Handler (/api/portfolio/:slug), applies privacy logic, SEO headers/meta.

4. Private Edit Link with Signed Token

• EditPage: UI for editing portfolio, uploading photo, toggling publish/SEO.
• EditHandler: API Route Handler (/api/edit/:token), validates JWT, fetches full portfolio.
• EditUpdateHandler: API Route Handler (PATCH /api/edit/:token), applies changes.
• PhotoUploadHandler: API Route Handler (POST /api/edit/:token/photo), validates and stores photo.
• VisibilityHandler: API Route Handler (PATCH /api/edit/:token/visibility)
• SEOHandler: API Route Handler (PATCH /api/edit/:token/seo)
• DeleteHandler: API Route Handler (DELETE /api/edit/:token), soft-deletes.

5. SEO and Visibility Controls

• SEOControlsComponent: UI in EditPage for toggling allow_search_indexing.
• SEOHandler: API Route Handler as above.

6. Rate Limiting

• RateLimiter: Shared middleware for UploadHandler, checks and updates upload_limits table.

6.2 Data Flow Diagrams

Upload and Parse Flow

sequenceDiagram
 participant User
 participant UploadPage
 participant UploadHandler
 participant BlobStorage
 participant DB
 participant ParseJobOrchestrator
 participant AsyncPDFParser

 User->>UploadPage: Select PDF, Click Upload
 UploadPage->>UploadHandler: POST /api/upload (PDF)
 UploadHandler->>RateLimiter: Check IP quota
 alt Under limit
 UploadHandler->>BlobStorage: Store PDF
 UploadHandler->>DB: Create portfolios row (pending)
 UploadHandler->>ParseJobOrchestrator: Create parse_jobs row, trigger parser
 UploadHandler->>User: jobId
 AsyncPDFParser->>BlobStorage: Fetch PDF
 AsyncPDFParser->>AsyncPDFParser: Parse, extract, strip PII
 AsyncPDFParser->>DB: Update portfolio (fields, is_published), parse_jobs (status)
 else Over limit
 UploadHandler->>User: 429 Too Many Requests
 end

Edit Flow

sequenceDiagram
 participant User
 participant EditPage
 participant EditHandler
 participant DB

 User->>EditPage: Visit /edit/:token
 EditPage->>EditHandler: GET /api/edit/:token
 EditHandler->>DB: Fetch portfolio by token
 DB-->>EditHandler: Portfolio data
 EditHandler-->>EditPage: Portfolio data
 User->>EditPage: Update fields, photo, toggles
 loop For each update
 EditPage->>EditUpdateHandler: PATCH /api/edit/:token (fields)
 EditUpdateHandler->>DB: Update portfolio
 DB-->>EditUpdateHandler: OK
 EditUpdateHandler-->>EditPage: Success
 end

6.3 Component Diagram

flowchart TD
 A["UploadPage (UI)"]
 B["UploadHandler (/api/upload)"]
 C["RateLimiter"]
 D["ParseJobOrchestrator"]
 E["AsyncPDFParser (Serverless)"]
 F["BlobStorage (Vercel Blob)"]
 G["DB (Supabase Postgres)"]
 H["StatusHandler (/api/status/:jobId)"]
 I["PortfolioPage (/p/:slug)"]
 J["PortfolioHandler (/api/portfolio/:slug)"]
 K["EditPage (UI)"]
 L["EditHandler (/api/edit/:token)"]
 M["EditUpdateHandler, PhotoUploadHandler, VisibilityHandler, SEOHandler, DeleteHandler"]

 A --> B
 B --> C
 B --> F
 B --> G
 B --> D
 D --> E
 E --> F
 E --> G
 H --> G
 I --> J
 J --> G
 K --> L
 L --> G
 K --> M
 M --> G

7. INTEGRATION ARCHITECTURE

• No third-party integrations required beyond managed storage (Vercel Blob) and managed database (Supabase Postgres).
• LLM for PDF extraction: If used, must be fully server-side (Node.js wrapper or local LLM, not external API).
• Authentication: JWTs signed and verified server-side; no integration with external auth providers.

Protocols:

• Blob Storage: HTTPS REST API (Vercel Blob SDK).
• Database: Postgres (Supabase SDK/driver).
• All communication internal/serverless; no external API dependencies.

Error Handling:

• All storage/db/network errors are caught and surfaced to user with user-friendly messages.
• PDF parsing failures are logged and surfaced to user.

8. SECURITY CONSIDERATIONS

8.1 Authentication & Authorization

• No user accounts; access via magic edit link (JWT).
• JWTs: HS256, signed with strong random secret, include portfolio id, expiry (optional), and purpose.
• Edit endpoints: Only accessible with valid JWT matching portfolio.

8.2 Data Protection & Encryption

• At rest: Supabase Postgres and Vercel Blob encrypt data at rest.
• In transit: All traffic HTTPS only.
• PII Handling: Email, phone, address scrubbed at parse time, never stored in public fields.

8.3 Privacy & Compliance

• Noindex by default: All public pages have robots meta and header set to noindex unless owner toggles.
• Uploader IP: Only SHA-256 hash stored for rate limiting; never used for tracking or analytics.
• Soft deletes: Portfolios can be deleted by owner at any time.

8.4 Threat Modeling

• Abuse/Spam: Upload rate limited by IP.
• Token leakage: Edit tokens are long, unguessable, and never shown publicly.
• XSS/Injection: All user-editable fields sanitized before rendering.
• File Validation: Only PDFs (MIME and magic bytes), max 4MB, validated before parse.

8.5 Security Monitoring

• Vercel Analytics: Basic monitoring.
• Sentry (optional): For error/exception tracking.

9. SCALABILITY PLAN

9.1 Scaling Strategies

• Frontend/API: Serverless functions auto-scale on Vercel.
• Database: Supabase Postgres can be vertically scaled; Phase 2+ can partition if needed.
• Storage: Vercel Blob is serverless and auto-scales.
• Async Jobs: Serverless background functions can scale out.

9.2 Load Balancing

• Handled by Vercel edge network (global CDN, auto load-balancing).

9.3 Caching

• Static assets: CDN-cached via Vercel.
• SSR pages: Short-lived cache for public portfolios.
• Database: No separate cache layer; Phase 2+ may add Redis for job status if needed.

9.4 Performance Optimization

• PDF parsing: Async to avoid timeouts.
• Polling intervals: Tuned to minimize load.
• Payloads: Only essential data returned per endpoint.

9.5 Auto-Scaling

• Phase 1: Handled by Vercel.
• Phase 2+: Monitor DB/storage usage and upgrade as needed.

10. DEPLOYMENT STRATEGY

10.1 Infrastructure Setup

• Platform: Vercel (mono-repo, serverless, instant deploys).
• Database: Supabase Postgres 18.4, managed, provisioned via Supabase dashboard.
• Blob Storage: Vercel Blob, provisioned via Vercel dashboard.
• CI/CD: GitHub Actions (runs lint/typecheck/tests, triggers Vercel deploy).
• Secrets: All secrets (JWT secret, DB creds, Blob credentials) stored in Vercel/Supabase environment variables.

10.2 Monitoring & Observability

• Vercel Analytics: Built-in.
• Sentry (optional): JavaScript/Node SDK for error monitoring.

10.3 DevOps Practices

• Branch-based deploys: PR previews enabled.
• Automated tests: Run on push.
• Zero-downtime deploys: Vercel handles routing.

10.4 Disaster Recovery

• DB backups: Automated by Supabase.
• Storage: Vercel Blob managed, with redundancy.

10a. PHASE 1 DEPLOYMENT — Minimum Viable Infrastructure

Deployment Platform: Vercel (mono-repo, serverless, zero manual ops)

Steps:

1. Repo Setup: Single Next.js 16.2.7 + TypeScript codebase, includes all UI, API Route Handlers, and shared logic.
2. Database: Provision Supabase Postgres 18.4 instance. Set connection env vars in Vercel dashboard.
3. Storage: Enable Vercel Blob Storage. Set creds in Vercel env vars.
4. Secrets: Generate strong JWT secret, set as env var in both Vercel and local dev.
5. Env Vars:

• SUPABASE_URL, SUPABASE_SERVICE_KEY
• VERCEL_BLOB_TOKEN (if needed)
• JWT_SECRET

6. Docker: Optional for local dev only; not required for Vercel deploy.

• Dockerfile for local Next.js dev/testing.

7. CI/CD: GitHub Actions workflow to lint, typecheck, test, and deploy to Vercel.
8. Monitoring: Enable Vercel Analytics, optionally add Sentry DSN as env var.

Deferred to Phase 2+:

• Multi-region DB, CDN config, Redis, full monitoring stack, WAF, advanced auto-scaling, custom domain support.

Estimated Phase 1 Infra Setup Time: 4–8 hours

Deployment Topology Diagram

flowchart TD
 A["Vercel (Next.js 16.2.7 Monolith)"]
 B["Supabase Postgres 18.4 (Managed)"]
 C["Vercel Blob Storage"]
 D["GitHub Actions (CI/CD)"]
 E["Developer Laptop (local Docker, optional)"]

 D --> A
 E --> A
 A --> B
 A --> C

11. TRADE-OFFS

• Monolith vs. Microservices: Chose monolith for simplicity and speed; microservices add ops overhead not justified by current scale.
• Serverless: Chosen for auto-scaling and zero maintenance, but cold starts and timeouts mean async tasks must be short and robust.
• JWT Edit Links: Simpler than user accounts, but token leakage = total compromise of portfolio edit rights.
• Supabase Postgres: Managed, easy, but vendor lock-in for some features.
• Vercel Blob: Zero ops but less control than S3; migration possible if needed.
• No Caching Layer: Acceptable for v0; Phase 2+ can add Redis for job status if polling becomes a bottleneck.
• Rate Limiting by IP Hash: Good for MVP; Phase 2+ may need more sophisticated abuse detection.

12. ALTERNATIVES CONSIDERED

• Dedicated Async Queue (e.g., Redis+BullMQ, Celery): Not chosen due to Vercel serverless constraints and MVP simplicity.
• User Accounts/Auth: Explicitly out of scope per requirements.
• Python-based PDF Parsing: Not chosen; Node.js-based parsing avoids cross-runtime complexity and fits with Next.js serverless.
• Supabase Storage: Considered, but Vercel Blob is first-party and lower ops for the main deploy target.
• Multi-repo/Microfrontends: Rejected for solo developer and MVP needs.
• Edge Functions for All APIs: Not required; standard serverless Route Handlers suffice.

Alternatives may be reconsidered if:

• Parsing jobs exceed Vercel serverless timeouts (then: external queue/service).
• Storage/DB scale needs surpass Vercel/Supabase limits (then: migrate to S3/Aurora/other).
• User feedback demands accounts, analytics, or additional features.

VALIDATION

• ✅ All features from the Feature List are covered with specific components, endpoints, and tables.
• ✅ No generic placeholders; all schemas and APIs are fully specified.
• ✅ Database schema is complete for all features.
• ✅ API endpoints are exhaustively defined (9+ endpoints, all features mapped).
• ✅ Components are named and responsibilities clear.
• ✅ Technology versions are pinned from web research.
• ✅ All requirements and constraints from input are addressed.
• ✅ Phase 1 deployment is actionable, with deferred items annotated.
• ✅ Diagrams are provided per requirements.

This architecture provides a complete, production-ready blueprint for ResumeWeb, optimized for rapid delivery, privacy, and solo developer maintainability.

Product Requirements Document (PRD): ResumeWeb

1. Executive Summary

ResumeWeb is a privacy-centric, no-signup SaaS web application that enables users—job seekers, students, freelancers, and professionals—to instantly convert a resume PDF into a polished, mobile-friendly portfolio page. The product addresses the widespread friction and privacy risks of traditional resume sharing by providing a one-click, asynchronous upload-to-portfolio flow, stripping all personal contact information from public pages, and offering unique edit and public URLs for user control without requiring accounts. ResumeWeb’s key objectives are to deliver a live portfolio in under a minute, guarantee user privacy by default, and maximize accessibility for non-technical users globally. The initial demo targets a credible, production-quality MVP within 10 days, optimized for solo developer delivery and mass-market reach.

2. Problem Statement

Traditional methods of sharing resumes online are fraught with friction and privacy risks. Many job seekers, students, and professionals lack the technical skills or time to build personal websites, while existing solutions often require account creation, expose personal contact information, or are slow and cumbersome. This is a significant barrier for anyone needing a quick, professional online presence for networking, job applications, or sharing credentials—especially in a market where digital portfolios are increasingly expected. Current workarounds, such as generic website builders, LinkedIn, or manual conversion, are either too technical, expose sensitive information, or are time-consuming. There is a clear market gap for a tool that enables instant, private, and professional online portfolios from any resume PDF, with zero signup or technical barriers.

3. Solution Overview

ResumeWeb provides a frictionless, no-signup web app that instantly converts a resume PDF into a structured, visually appealing, and mobile-friendly portfolio page. The process is asynchronous for speed and reliability, and privacy is prioritized by stripping contact details (email, phone, address) from public pages at parse time. Users receive both a unique public URL and a private edit link (magic token) to manage their portfolio—edit content, upload a photo, or control visibility and SEO—without ever creating an account. The platform leverages AI-powered parsing to extract and structure resume content, ensuring a professional presentation. By eliminating account barriers, manual data entry, and privacy concerns, ResumeWeb uniquely combines instant onboarding, privacy-by-design, and mass accessibility.

4. Stakeholder Analysis

5. User Personas

Persona 1: "Alex" – Recent Graduate

• Demographics: Age 22, Computer Science graduate, based in the US, applying for entry-level tech roles. No personal website.
• Goals/Objectives: Instantly create a professional, shareable portfolio for job applications and networking.
• Pain Points: Lacks web development skills; concerned about privacy; finds LinkedIn too public and generic.
• Use Cases/Scenarios: Uploads PDF resume, receives a portfolio link to include in job applications; edits content to add a photo and hide details as needed.
• Technology Comfort Level: Moderate; comfortable with web apps, not with coding or web hosting.
• Behavioral Patterns: Seeks fast, low-friction solutions; values privacy and control.

Persona 2: "Priya" – Freelance Designer

• Demographics: Age 29, freelance graphic designer, based in India, works with global clients, no technical background.
• Goals/Objectives: Showcase work experience and skills online without building a website; maintain privacy.
• Pain Points: Existing portfolio builders require sign-up or payment; worried about exposing contact info; needs mobile-friendly presentation.
• Use Cases/Scenarios: Uploads resume PDF, customizes portfolio, toggles SEO to allow search engines, adds a profile photo.
• Technology Comfort Level: Basic to moderate; uses web apps, avoids technical setup.
• Behavioral Patterns: Prefers tools that are free, simple, and respect privacy.

Persona 3: "Miguel" – Career Switcher

• Demographics: Age 35, transitioning from finance to tech, based in Brazil, applying to coding bootcamps and tech jobs.
• Goals/Objectives: Present a modern, professional online profile quickly; control what is public.
• Pain Points: No time or skills to build a website; wants to keep personal info private; finds manual conversion tedious.
• Use Cases/Scenarios: Uploads resume, edits summary and experience, uses portfolio link for bootcamp applications.
• Technology Comfort Level: Moderate; uses SaaS tools, not a developer.
• Behavioral Patterns: Seeks instant results, values privacy and ability to update content.

Persona 4: "Fatima" – University Student

• Demographics: Age 20, undergraduate student in Egypt, seeking internships, no portfolio site.
• Goals/Objectives: Share credentials with recruiters and professors; avoid exposing email/phone.
• Pain Points: No technical skills; existing solutions require accounts or expose PII.
• Use Cases/Scenarios: Uploads resume for internship applications, toggles portfolio visibility on/off as needed.
• Technology Comfort Level: Basic; uses mobile devices primarily.
• Behavioral Patterns: Mobile-first, privacy-conscious, prefers no-signup experiences.

6. Technical Requirements

Architecture Alignment: All technical requirements strictly follow the approved Architecture v1.0.0.

Frontend

• Framework: Next.js 16.2.7 (App Router), TypeScript
• Styling/UI: Tailwind CSS (latest stable 2026), shadcn/ui (optional)
• Pages/Components:
  • UploadPage: Resume PDF upload, pre-validation
  • StatusPage: Polls parse status
  • PortfolioPage: SSR, public, mobile-friendly
  • EditPage: Edit content, upload photo, visibility/SEO toggles
  • SEOControlsComponent: Toggle allow_search_indexing
• Accessibility: WCAG 2.1 AA compliance
• Mobile-first: Responsive layouts

Backend

• API: Next.js 16.2.7 API Route Handlers (serverless functions)
• Business Logic:
  • UploadHandler: Validates file, stores PDF, creates portfolio, triggers parse job
  • RateLimiter: Middleware, enforces 5 uploads/hour/IP
  • ParseJobOrchestrator: Creates parse_jobs, triggers async PDF parsing
  • AsyncPDFParser: Node.js, pdf-parse + custom LLM wrapper, strips PII
  • EditHandler, EditUpdateHandler, PhotoUploadHandler, VisibilityHandler, SEOHandler, DeleteHandler: All edit operations via JWT token in URL
• Validation:
  • PDF: MIME application/pdf, max 4MB, magic bytes check
  • Photo: JPEG/PNG, max 2MB
• Security: JWT (HS256, signed), no user accounts

Infrastructure

• Deployment: Vercel (mono-repo, serverless, zero manual ops)
• Database: Supabase Postgres 18.4 (managed)
• Storage: Vercel Blob Storage (PDFs, photos)
• CI/CD: GitHub Actions (lint, typecheck, test, deploy)
• Monitoring: Vercel Analytics, Sentry (optional)

Security

• Data at rest: Encrypted (Supabase, Vercel Blob)
• Data in transit: HTTPS only
• PII Handling: Scrubbed at parse time, never stored in public fields
• Rate Limiting: Enforced on upload by IP hash

Integration

• No third-party integrations beyond managed storage and database
• LLM for PDF extraction: Node.js wrapper, no external API

7. Non-Functional Requirements

8. Success Metrics & KPIs

9. Risks

10. Assumptions

• Users have a resume PDF (max 4MB, valid MIME) ready for upload.
• Users value privacy and control over public information.
• No user accounts or login flows are required or expected.
• All edit operations are performed via magic edit link (JWT).
• Vercel and Supabase will provide sufficient uptime and scalability for initial launch.
• No third-party API integrations are required in Phase 1.
• LLM-powered parsing can be performed server-side within Vercel serverless timeouts.
• All storage and database operations are performed via managed services (zero-ops).
• Users will not require advanced customization (themes, custom domains) in Phase 1.
• GDPR and privacy best practices are expected by users, even if not legally required for all regions.
• Feature scope is limited to the validated list; additional features deferred to future phases.

11. Compliance & Regulatory Requirements

• GDPR-aligned practices: No public PII, right to delete portfolio, data minimization, no tracking cookies.
• Data residency: Supabase Postgres and Vercel Blob are managed in compliant regions (EU/US).
• Accessibility: WCAG 2.1 AA compliance for all user-facing pages.
• No user accounts: No need for CCPA/other account management requirements.
• Right to be forgotten: Users can delete portfolios at any time via edit link.

12. Security & Privacy Requirements

• Authentication: Magic edit link (JWT, HS256, signed with strong secret, time-unlimited).
• Authorization: All edit endpoints require valid JWT in URL path.
• Encryption: All data at rest (Supabase, Vercel Blob) and in transit (HTTPS).
• PII Handling: Email, phone, address scrubbed at parse time; never stored in public fields.
• Rate Limiting: 5 uploads/hour/IP, enforced via SHA-256 hash of IP.
• Soft Deletes: Portfolios can be deleted by owner at any time; deleted_at timestamp.
• Noindex by default: All public pages have robots meta and header set to noindex unless owner toggles.
• XSS/Injection Defense: All user-editable fields sanitized before rendering.
• File Validation: Only PDFs (MIME and magic bytes), max 4MB.
• Token Security: Edit tokens are long, unguessable, and never shown on public pages.
• Monitoring: Vercel Analytics, Sentry (optional) for error/exception tracking.
• No tracking cookies or analytics scripts beyond Vercel Analytics.

13. Integration Requirements

• Managed Storage: Vercel Blob Storage for resume PDFs and photos (SDK integration).
• Managed Database: Supabase Postgres 18.4 (SDK integration).
• No external APIs: All LLM/PDF parsing must be performed server-side; no external API calls.
• No third-party auth: Only JWT-based magic links.
• No external analytics: Vercel Analytics only.

14. Data Architecture

Database Schema (from Architecture)

Table: portfolios

Table: parse_jobs

Table: upload_limits

Relationships:

• portfolios (1) ←→ (1) parse_jobs
• upload_limits: standalone, keyed by hashed IP

ER Diagram:

erDiagram
 portfolios {
 UUID id PK
 VARCHAR(32) slug
 TEXT edit_token_jwt
 TEXT pdf_blob_url
 TEXT photo_blob_url
 ENUM parse_status
 TEXT parse_error_message
 TEXT summary
 JSONB experience_json
 JSONB skills_json
 JSONB education_json
 JSONB projects_json
 BOOLEAN is_published
 BOOLEAN allow_search_indexing
 TIMESTAMP created_at
 TIMESTAMP updated_at
 TIMESTAMP deleted_at
 CHAR(64) uploader_ip_hash
 }
 parse_jobs {
 UUID id PK
 UUID portfolio_id FK
 ENUM status
 TEXT error_message
 TIMESTAMP started_at
 TIMESTAMP finished_at
 }
 upload_limits {
 CHAR(64) ip_hash PK
 INTEGER uploads_last_hour
 TIMESTAMP last_upload_at
 }

 portfolios ||--o| parse_jobs: "has"

Storage Strategies:

• PDFs and photos stored in Vercel Blob Storage, URL referenced in DB.
• All structured data in Supabase Postgres.
• No sharding/partitioning required for Phase 1.

Data Processing:

• Async PDF parsing pipeline (Node.js, pdf-parse + LLM wrapper).
• PII stripped before storing structured data.
• Parse job status tracked in parse_jobs.

Data Flow:

• User uploads PDF → API stores file, creates DB records, triggers async parse job.
• User polls status → Receives edit/public URLs on success.
• User edits portfolio via edit link; changes saved to DB.

15. API Specifications

All endpoints are Next.js Route Handlers under /api/, not /api/v1/.
Minimum 8 endpoints, all mapped to features as per Architecture.

Endpoint Mapping

Endpoint Details

POST /api/upload

• Purpose: Accept a resume PDF, validate, store, create portfolio + parse job.
• Request: multipart/form-data
  • file: PDF (max 4MB, MIME application/pdf)
• Response:
  • 202 Accepted
    { "jobId": "string" }
• Errors:
  • 400 Bad Request (invalid file type/size)
  • 429 Too Many Requests (rate limit)
  • 500 Internal Server Error
• Rate Limit: 5 uploads/hour/IP

GET /api/status/:jobId

• Purpose: Poll parse job status.
• Response:
  • 200 OK
    { "status": "pending" | "processing" | "success" | "error", "errorMessage": "string (optional)", "publicUrl": "string (if success)", "editUrl": "string (if success)" }
• Errors:
  • 404 Not Found (unknown jobId)

GET /api/portfolio/:slug

• Purpose: Serve public portfolio page data.
• Response:
  • 200 OK
    { "slug": "string", "summary": "string", "experience": [ ... ], "skills": [ ... ], "education": [ ... ], "projects": [ ... ], "photoUrl": "string (optional)", "allowSearchIndexing": true | false }
  • 404 Not Found (unpublished or deleted)
• SEO: Sets X-Robots-Tag and meta tags based on allow_search_indexing.

GET /api/edit/:token

• Purpose: Fetch full portfolio data for editing (including PII if present).
• Auth: JWT in URL path (edit token).
• Response:
  • 200 OK
    { "slug": "string", "summary": "string", "experience": [ ... ], "skills": [ ... ], "education": [ ... ], "projects": [ ... ], "photoUrl": "string (optional)", "isPublished": true | false, "allowSearchIndexing": true | false }
  • 401 Unauthorized (invalid/expired token)
  • 404 Not Found (deleted)

PATCH /api/edit/:token

• Purpose: Update portfolio fields (summary, experience, etc.).
• Auth: JWT in URL path.
• Request:
  { "summary": "string (optional)", "experience": [ ... ], "skills": [ ... ], "education": [ ... ], "projects": [ ... ] }
• Response:
  • 200 OK { "success": true }
  • 401 Unauthorized
  • 400 Bad Request (validation error)

POST /api/edit/:token/photo

• Purpose: Upload optional photo for portfolio.
• Auth: JWT in URL path.
• Request: multipart/form-data
  • file: image/jpeg or image/png (max 2MB)
• Response:
  • 200 OK { "photoUrl": "string" }
  • 401 Unauthorized
  • 400 Bad Request (invalid file)

PATCH /api/edit/:token/visibility

• Purpose: Toggle publish/unpublish.
• Request:
  { "isPublished": true | false }
• Response:
  • 200 OK { "isPublished": true | false }

PATCH /api/edit/:token/seo

• Purpose: Toggle SEO indexing.
• Request:
  { "allowSearchIndexing": true | false }
• Response:
  • 200 OK { "allowSearchIndexing": true | false }

DELETE /api/edit/:token

• Purpose: Soft-delete portfolio.
• Response:
  • 204 No Content

Authentication/Authorization:

• All edit endpoints require valid JWT in URL path (edit token).
• Public endpoints require no auth.

API Versioning:

• Flat /api/ namespace per requirements; no /api/v1/ sprawl.

Rate Limiting:

• Enforced on POST /api/upload (5/hour/IP).

Error Handling:

• Consistent error codes (400, 401, 404, 429, 500).
• User-facing error messages for parse failures, validation, and auth.

16. Testing Strategy

• Unit Testing: All core business logic, file validation, PII stripping, JWT handling.
• Integration Testing: End-to-end upload → parse → status → portfolio → edit flows.
• E2E Testing: Cypress or Playwright for UI/UX flows (upload, edit, publish, delete).
• Performance Testing: Simulate concurrent uploads, parse jobs, and polling.
• Security Testing: JWT validation, XSS/injection, file upload sanitization.
• Manual QA: Edge cases (invalid PDFs, large files, token reuse, rate limit breach).
• Automated Regression: CI/CD pipeline runs all tests on push.
• Accessibility Testing: Axe or Lighthouse audits for WCAG 2.1 AA compliance.

17. Deployment Strategy

• Platform: Vercel (mono-repo, serverless, zero manual ops)
• Phases:
  1. Infra Setup: Provision Supabase Postgres, Vercel Blob, set env vars/secrets (4–8 hours)
  2. Core Feature Delivery: Sequential implementation (see Timeline & Phases)
  3. CI/CD: GitHub Actions for lint/typecheck/test/deploy
  4. Monitoring: Enable Vercel Analytics, optionally Sentry
  5. Rollback: Vercel supports instant rollback to previous deploy
  6. Zero-downtime Deploys: All via Vercel routing
• Blue-Green Deploy: Not required for Phase 1 (serverless, instant rollback)
• Branch-based Previews: Enabled for QA

18. Monitoring & Observability

• Metrics:
  • Upload-to-live URL time (median, 95th percentile)
  • Parse job success/error rates
  • API error rates (per endpoint)
  • Rate limit triggers
  • Portfolio publish/unpublish events
  • Mobile vs desktop usage
• Alerts:
  • Parse job failures > 5% in 1 hour
  • API 5xx errors > 1% in 1 hour
  • Upload error spikes
• Dashboards:
  • Vercel Analytics for traffic, performance
  • Sentry (optional) for error/exception tracking
• Logging:
  • Structured logs for all API endpoints
  • Parse job logs (success/failure, error messages)
  • Audit logs for edit/delete actions (internal only)

19. Timeline & Phases

Solo Developer Roadmap (Sequential, 10-day Demo Target)

Total Estimated Time: 10 days (±2)

20. Resource Requirements

• Solo Developer: Responsible for all implementation, infrastructure, QA, and product ownership.
• Role Consolidation: One person covers full stack, DevOps, QA, and PM duties.
• AI Tooling: Leverage LLMs for code generation, test writing, and PDF parsing pipeline.
• Scale-up Triggers:
  • Security Auditor: Engage before public launch to review privacy and token security.
  • First Hire: Justified if parse job queue exceeds Vercel serverless limits, or if support/feature backlog exceeds solo capacity.
  • Specialist Engagement: Accessibility expert if WCAG compliance issues found; DevOps if traffic exceeds Vercel/Supabase limits.
• Budget Considerations: All infra is managed/low-ops; minimal recurring costs for Vercel/Supabase at initial scale.

21. Change Management Plan

• User Adoption: Emphasize frictionless, no-signup onboarding in all messaging.
• Training: In-app tooltips, help links, and FAQ for common questions.
• Communication: Clear privacy and control messaging on landing page; footer credits (“Planned with FLOWiGANTT · Built with Cursor”).
• Feedback Loop: In-app feedback form for bug reports and suggestions.
• Release Notes: Publish updates and changes on landing page or via changelog link.
• Support: Email support for bug reports (solo developer capacity).

End of PRD

User Stories & Epics

Epic: Non-Functional Requirements: Usability and Accessibility

This epic covers usability, accessibility, user experience, and error handling to ensure the application is easy and pleasant to use for all users.

Provide Clear Error Messages and User Feedback

As an end user, I want clear and helpful error messages during upload, parsing, and editing, so that I understand issues and can take corrective actions.

Priority: high

Dependencies: Validate Resume PDF File Type and Size on Upload (ce87d27a-c832-4996-899a-71b70e6b9469), Handle Parse Failures with Clear User Feedback (63ce28e8-ff27-4dcd-9a3c-3c2af195e385), Implement Edit Page UI for Portfolio Content Updates (fe6c18e4-f9af-45f3-be37-9d88c7c29eb2)

Acceptance Criteria:

• Functional: Upload errors (file type, size, rate limit) display clear messages.
• Functional: Parse failures show user-friendly error with retry options.
• Functional: Edit actions validate inputs and show validation errors.
• Technical: Error messages are consistent across UI and API responses.
• Technical: Errors are logged for monitoring and debugging.

Story Points: 3

Implement Mobile-First Responsive UI with Accessibility Compliance

As an end user, I want the application UI to be mobile-friendly and accessible (WCAG 2.1 AA), so that I can use it easily on any device.

Priority: high

Dependencies: Landing Page for Resume PDF Upload (e48d6f2a-2901-4aa1-93db-8fe75e8637a3), Serve Public Portfolio Page at /p/{slug} (efe27222-56ba-4992-b7ad-38d872319942), Implement Edit Page UI for Portfolio Content Updates (fe6c18e4-f9af-45f3-be37-9d88c7c29eb2)

Acceptance Criteria:

• Functional: All pages render correctly on mobile devices and various screen sizes.
• Functional: UI components meet WCAG 2.1 AA accessibility standards.
• Technical: Use Tailwind CSS responsive utilities and semantic HTML.
• Technical: Accessibility tested with Axe or Lighthouse tools.

Story Points: 5

Epic: Non-Functional Requirements: Monitoring and Reliability

This epic covers monitoring, logging, alerting, uptime, disaster recovery, and fault tolerance to ensure a reliable and maintainable service.

Ensure 99.9% Uptime and Zero-Downtime Deployments

As the platform, I want to maintain 99.9% uptime and support zero-downtime deployments, so that users experience high availability.

Priority: high

Dependencies: Provision Supabase Postgres Database and Setup Schema (ffe8e4b8-643d-4d06-bec5-1f11c45d2ca1), Setup Vercel Blob Storage for PDFs and Photos (a051b18f-3d2e-4623-8056-fe42e33a6069)

Acceptance Criteria:

• Functional: Deployments via Vercel support instant rollback and zero downtime.
• Technical: Monitor uptime metrics via Vercel and Supabase dashboards.
• Technical: Implement health checks and readiness probes.
• Technical: Document incident response procedures.

Story Points: 3

Implement Automated Daily Database Backups and Disaster Recovery

As the platform, I want automated daily backups of the database and a disaster recovery plan, so that data loss risks are minimized.

Priority: medium

Dependencies: Provision Supabase Postgres Database and Setup Schema (ffe8e4b8-643d-4d06-bec5-1f11c45d2ca1)

Acceptance Criteria:

• Functional: Supabase automated daily backups are enabled and verified.
• Technical: Backup retention and restore procedures documented.
• Technical: Disaster recovery plan includes steps for data restoration.
• Technical: Backup success and failure alerts configured.

Story Points: 3

Setup Monitoring and Logging with Vercel Analytics and Sentry

As the developer, I want to monitor application performance and errors using Vercel Analytics and optionally Sentry, so that issues can be detected and resolved quickly.

Priority: medium

Dependencies: Implement Async PDF Parsing Pipeline (06cf3e7c-9415-4253-8296-180d9b5c77e0), Implement Status Polling API for Parse Jobs (e1cf62fd-4fa4-4561-94c5-1bfe82c90ee5)

Acceptance Criteria:

• Functional: Vercel Analytics is enabled and tracks traffic and performance.
• Functional: Sentry is optionally integrated for error and exception tracking.
• Technical: Logs include structured data for API requests and parse jobs.
• Technical: Alerts configured for parse job failure rates and API errors.

Story Points: 3

Epic: Non-Functional Requirements: Security and Privacy

This epic covers security and privacy requirements including authentication, authorization, encryption, PII handling, and compliance.

Implement PII Stripping and Privacy by Default

As the system, I want to strip email, phone, and address from public portfolios and default to noindex, so that user privacy is protected by design.

Priority: high

Dependencies: Strip PII from Parsed Data at Parse Time (4f7a6947-fea6-4976-a5f4-7e8729b0e402), Set Default Noindex for Public Portfolio Pages (970155bc-244b-40f4-a54d-4d394ca8c27b)

Acceptance Criteria:

• Functional: PII is removed at parse time and never stored in public fields.
• Functional: Public pages default to noindex via meta tags and headers.
• Technical: Automated tests verify no PII leakage.
• Technical: Privacy flags stored in portfolios table and enforced.

Story Points: 5

Ensure HTTPS Everywhere and Data Encryption at Rest

As the platform, I want all data in transit to be encrypted with HTTPS and all data at rest to be encrypted, so that user data is protected.

Priority: high

Dependencies: Provision Supabase Postgres Database and Setup Schema (ffe8e4b8-643d-4d06-bec5-1f11c45d2ca1), Setup Vercel Blob Storage for PDFs and Photos (a051b18f-3d2e-4623-8056-fe42e33a6069)

Acceptance Criteria:

• Functional: All API and UI endpoints are accessible only via HTTPS.
• Technical: Vercel platform enforces HTTPS with TLS certificates.
• Technical: Supabase Postgres and Vercel Blob Storage encrypt data at rest.
• Technical: Verify encryption compliance with GDPR and best practices.

Story Points: 3

Implement JWT-Based Magic Edit Link Authentication

As the system, I want to authenticate edit requests using signed JWT tokens, so that no user accounts are needed and access is secure.

Priority: high

Dependencies: Generate and Return Private Edit Link with Signed JWT Token (6d1dd22e-3401-4e5c-bf95-ba55e6495793)

Acceptance Criteria:

• Functional: Edit endpoints require valid JWT token in URL path.
• Functional: Invalid or missing tokens return HTTP 401 Unauthorized.
• Technical: JWTs signed with HS256 and strong secret stored in env vars.
• Technical: Tokens include portfolio ID and are unguessable.

Story Points: 5

Epic: Non-Functional Requirements: Performance and Scalability

This epic covers performance and scalability requirements to ensure fast processing, low latency, and ability to handle concurrent users and data volume.

Support Auto-Scaling of Serverless Functions and Database

As the platform, I want serverless functions and database to auto-scale to handle concurrent users and data volume, so that the service remains reliable under load.

Priority: high

Dependencies: Provision Supabase Postgres Database and Setup Schema (ffe8e4b8-643d-4d06-bec5-1f11c45d2ca1)

Acceptance Criteria:

• Functional: Serverless functions scale automatically with traffic on Vercel.
• Functional: Database can handle expected load without performance degradation.
• Technical: Monitor resource usage and scale thresholds.
• Technical: No sharding required for initial volume.

Story Points: 5

Ensure Median Upload-to-Live URL Time Under 2 Minutes

As the system, I want the median time from resume upload to live portfolio URL to be under 2 minutes, so that users receive fast results.

Priority: high

Dependencies: Implement Async PDF Parsing Pipeline (06cf3e7c-9415-4253-8296-180d9b5c77e0)

Acceptance Criteria:

• Functional: Median processing time measured and reported is less than 2 minutes.
• Technical: Async parsing pipeline optimized for speed and reliability.
• Technical: Polling intervals tuned to minimize latency and server load.
• Technical: Performance metrics collected via Vercel Analytics.

Story Points: 8

Epic: SaaS Web Deployment Infrastructure

This epic covers infrastructure setup and deployment for the ResumeWeb SaaS application, including database, storage, CI/CD, and environment configuration.

Setup Development Environment and Local Docker for Next.js

As a developer, I want to setup a local development environment with Docker and Next.js, so that I can develop and test the application locally.

Priority: medium

Acceptance Criteria:

• Functional: Local development environment supports running Next.js app with hot reload.
• Technical: Dockerfile and docker-compose configured for local dev with environment variables.
• Technical: Local Supabase and Blob Storage emulators or mocks are configured.
• Technical: Documentation for setup is provided.

Story Points: 5

Configure CI/CD Pipeline with GitHub Actions and Vercel

As the developer, I want to setup automated CI/CD pipelines with GitHub Actions and Vercel, so that code is linted, tested, and deployed automatically.

Priority: high

Dependencies: Provision Supabase Postgres Database and Setup Schema (ffe8e4b8-643d-4d06-bec5-1f11c45d2ca1), Setup Vercel Blob Storage for PDFs and Photos (a051b18f-3d2e-4623-8056-fe42e33a6069)

Acceptance Criteria:

• Functional: GitHub Actions workflow runs lint, typecheck, tests on push.
• Functional: Successful builds trigger automatic deploys to Vercel.
• Technical: Environment variables and secrets are securely managed.
• Technical: Rollbacks and branch previews are enabled.

Story Points: 5

Setup Vercel Blob Storage for PDFs and Photos

As the platform administrator, I want to configure Vercel Blob Storage for storing uploaded PDFs and photos, so that files are managed securely and efficiently.

Priority: high

Acceptance Criteria:

• Functional: Vercel Blob Storage is enabled and accessible via SDK.
• Technical: Storage credentials and tokens are configured as environment variables.
• Technical: Upload and retrieval of files via Blob Storage SDK is tested successfully.
• Technical: Storage is configured for redundancy and security.

Story Points: 3

Provision Supabase Postgres Database and Setup Schema

As the platform administrator, I want to provision a Supabase Postgres instance and apply the database schema, so that the application has a reliable data store.

Priority: high

Acceptance Criteria:

• Functional: Supabase Postgres 18.4 instance is provisioned and accessible.
• Technical: Database schema with portfolios, parse_jobs, and upload_limits tables is applied.
• Technical: Indexes and constraints are created as per schema.
• Technical: Database connection environment variables are configured in Vercel.

Story Points: 3

Epic: SEO and Visibility Controls

This epic covers user controls for search engine indexing and portfolio visibility, including default noindex settings and toggles for SEO opt-in.

Return 404 for Unpublished Portfolios on Public Access

As the system, I want to return HTTP 404 Not Found for public portfolio pages when is_published is false, so that unpublished portfolios are not accessible.

Priority: high

Dependencies: Serve Public Portfolio Page at /p/{slug} (efe27222-56ba-4992-b7ad-38d872319942)

Acceptance Criteria:

• Functional: Public API /api/portfolio/:slug returns 404 if is_published is false or portfolio is soft deleted.
• Technical: Implement check in API handler before data retrieval.
• Technical: SSR page returns 404 status for unpublished portfolios.
• Technical: Automated tests verify 404 behavior.

Story Points: 3

Implement SEO Indexing Toggle in Edit UI

As an end user, I want to toggle search engine indexing of my portfolio via the edit page, so that I control my portfolio's discoverability.

Priority: high

Dependencies: Implement Edit Page UI for Portfolio Content Updates (fe6c18e4-f9af-45f3-be37-9d88c7c29eb2)

Acceptance Criteria:

• Functional: Edit page includes toggle to enable or disable allow_search_indexing flag.
• Functional: Toggle updates flag via PATCH /api/edit/:token/seo endpoint.
• Technical: Changes persist in portfolios table and reflect immediately on public page.
• Technical: Toggle state is fetched and displayed on edit page load.

Story Points: 3

Set Default Noindex for Public Portfolio Pages

As the system, I want to set public portfolio pages to noindex by default via robots meta tag and HTTP header, so that portfolios are not indexed unless opted-in.

Priority: high

Dependencies: Serve Public Portfolio Page at /p/{slug} (efe27222-56ba-4992-b7ad-38d872319942)

Acceptance Criteria:

• Functional: Public portfolio pages include robots meta tag with noindex by default.
• Functional: HTTP response header X-Robots-Tag is set to noindex by default.
• Technical: Meta tags and headers dynamically set based on allow_search_indexing flag.
• Technical: Implement in /api/portfolio/:slug API and SSR page.

Story Points: 3

Epic: Private Edit Link with Signed Token

This epic covers the secure edit functionality via magic edit links (JWT tokens) allowing users to update portfolio content, upload photos, and manage visibility without login.

Allow Unpublishing and Deleting Portfolio via Edit Link

As an end user, I want to unpublish or soft-delete my portfolio via the private edit link, so that I can control my portfolio's visibility or remove it.

Priority: high

Dependencies: Generate and Return Private Edit Link with Signed JWT Token (6d1dd22e-3401-4e5c-bf95-ba55e6495793)

Acceptance Criteria:

• Functional: User can toggle is_published flag via PATCH /api/edit/:token/visibility.
• Functional: User can soft-delete portfolio via DELETE /api/edit/:token endpoint.
• Functional: Unpublished portfolios return 404 on public access.
• Technical: Soft delete sets deleted_at timestamp without removing DB record.
• Technical: Authorization via JWT token required for all edit actions.

Story Points: 5

Implement Optional Photo Upload in Edit Flow

As an end user, I want to upload an optional photo to my portfolio via the edit page, so that I can personalize my portfolio.

Priority: high

Dependencies: Implement Edit Page UI for Portfolio Content Updates (fe6c18e4-f9af-45f3-be37-9d88c7c29eb2)

Acceptance Criteria:

• Functional: User can upload JPEG or PNG photo up to 2MB via edit page.
• Functional: Photo is stored in Vercel Blob Storage and URL saved in portfolios table.
• Technical: Photo upload handled by POST /api/edit/:token/photo endpoint.
• Technical: Validate file type and size server-side.
• Technical: Photo URL is returned and displayed in edit UI.

Story Points: 5

Implement Edit Page UI for Portfolio Content Updates

As an end user, I want to update text fields extracted from my resume via a private edit page, so that I can refine my portfolio content.

Priority: high

Dependencies: Generate and Return Private Edit Link with Signed JWT Token (6d1dd22e-3401-4e5c-bf95-ba55e6495793)

Acceptance Criteria:

• Functional: Edit page fetches full portfolio data including summary, experience, skills, education, projects.
• Functional: User can edit text fields inline and submit changes.
• Technical: Edit page uses React with Tailwind CSS and fetches data from /api/edit/:token.
• Technical: Input fields are sanitized to prevent XSS.
• Technical: Changes are saved via PATCH /api/edit/:token.

Story Points: 5

Generate and Return Private Edit Link with Signed JWT Token

As the system, I want to generate a secure, signed JWT edit token and return a private edit URL after successful upload and parse, so that users can manage their portfolio without accounts.

Priority: high

Dependencies: Create Portfolio and Parse Job Records on Upload (6d7cb2c4-2849-47cf-b45c-61118c196a2a), Implement Async PDF Parsing Pipeline (06cf3e7c-9415-4253-8296-180d9b5c77e0)

Acceptance Criteria:

• Functional: Edit link is returned to user after successful parse with unguessable JWT token.
• Technical: JWT is signed with HS256 using strong secret and includes portfolio ID.
• Technical: JWT is stored uniquely in portfolios table.
• Technical: Edit URL format is /edit/{token}.

Story Points: 3

Epic: Public Portfolio Page Generation

This epic covers generation and serving of polished, mobile-friendly public portfolio pages at unique URLs, enforcing privacy and SEO controls.

Enforce Privacy by Stripping PII from Public Pages

As the system, I want to ensure no email, phone, or address data appears on public portfolio pages, so that user privacy is protected.

Priority: high

Dependencies: Strip PII from Parsed Data at Parse Time (4f7a6947-fea6-4976-a5f4-7e8729b0e402)

Acceptance Criteria:

• Functional: Public API /api/portfolio/:slug excludes PII fields.
• Technical: PII stripped at parse time and verified at API response.
• Technical: Automated tests verify no PII leakage in public responses.
• Technical: Logs audit any PII exposure attempts.

Story Points: 3

Serve Public Portfolio Page at /p/{slug}

As an end user, I want to access a mobile-friendly, visually polished portfolio page at a unique URL, so that I can share my credentials professionally.

Priority: high

Dependencies: Generate Unique Slugs for Public Portfolio URLs (609da41c-d895-4142-9b9f-d72761116756), Strip PII from Parsed Data at Parse Time (4f7a6947-fea6-4976-a5f4-7e8729b0e402)

Acceptance Criteria:

• Functional: Public portfolio page is accessible at /p/{slug} URL.
• Functional: Page displays summary, experience, skills, education, projects, and optional photo.
• Functional: Contact details (email, phone, address) are not shown.
• Functional: Returns HTTP 404 if portfolio is unpublished or deleted.
• Technical: Page uses SSR with Next.js App Router for SEO and performance.
• Technical: Page includes responsive design with Tailwind CSS.

Story Points: 5

Generate Unique Slugs for Public Portfolio URLs

As the system, I want to generate unique, human-readable slugs for each portfolio, so that users have shareable public URLs.

Priority: high

Dependencies: Create Portfolio and Parse Job Records on Upload (6d7cb2c4-2849-47cf-b45c-61118c196a2a)

Acceptance Criteria:

• Functional: Each portfolio has a unique slug of max 32 characters.
• Technical: Slugs are generated on portfolio creation, checked for uniqueness in DB.
• Technical: Slugs are URL-safe and lowercase.
• Technical: Slugs are indexed for fast lookup.

Story Points: 3

Epic: Asynchronous Resume Processing with Status

This epic covers the asynchronous processing of uploaded resume PDFs to extract structured portfolio data, status tracking, error handling, and user feedback.

Handle Parse Failures with Clear User Feedback

As an end user, I want clear error messages if my resume parsing fails, so that I understand the problem and can retry or correct it.

Priority: high

Dependencies: Implement Async PDF Parsing Pipeline (06cf3e7c-9415-4253-8296-180d9b5c77e0), Implement Status Polling API for Parse Jobs (e1cf62fd-4fa4-4561-94c5-1bfe82c90ee5)

Acceptance Criteria:

• Functional: If parsing fails, status is set to 'error' and error message is stored.
• Functional: Polling API returns error message to user.
• Functional: UI displays user-friendly error with retry instructions.
• Technical: Parse failure triggers rejection of portfolio publishing.
• Technical: Errors are logged for monitoring.

Story Points: 3

Implement Status Polling API for Parse Jobs

As an end user, I want to poll the status of my resume parsing job asynchronously, so that I receive real-time feedback without blocking requests.

Priority: high

Dependencies: Create Portfolio and Parse Job Records on Upload (6d7cb2c4-2849-47cf-b45c-61118c196a2a)

Acceptance Criteria:

• Functional: API endpoint /api/status/:jobId returns parse job status: pending, processing, success, or error.
• Functional: On success, response includes public portfolio URL and private edit URL.
• Functional: On error, response includes clear error message.
• Technical: Implement efficient DB queries to parse_jobs table.
• Technical: Return HTTP 404 if jobId unknown.

Story Points: 3

Strip PII from Parsed Data at Parse Time

As the system, I want to remove email, phone, and address from parsed portfolio data before storing, so that user privacy is protected.

Priority: high

Dependencies: Implement Async PDF Parsing Pipeline (06cf3e7c-9415-4253-8296-180d9b5c77e0)

Acceptance Criteria:

• Functional: Parsed data stored in portfolios excludes email, phone, and address fields.
• Technical: Implement PII detection and removal logic in async parser before DB update.
• Technical: Validate no PII fields are present in public data queries.
• Technical: Log any PII detection events for audit.

Story Points: 5

Implement Async PDF Parsing Pipeline

As the system, I want to asynchronously parse uploaded PDFs using pdf-parse and LLM extraction, so that structured portfolio data can be extracted without blocking user requests.

Priority: high

Dependencies: Create Portfolio and Parse Job Records on Upload (6d7cb2c4-2849-47cf-b45c-61118c196a2a)

Acceptance Criteria:

• Functional: Async parser fetches PDF from Vercel Blob Storage and extracts summary, experience, skills, education, and projects.
• Technical: Use Node.js serverless function with pdf-parse and custom LLM wrapper.
• Technical: Parsing runs in background triggered by parse_jobs creation.
• Technical: Update parse_jobs status to 'processing' then 'success' or 'error'.

Story Points: 8

Epic: Resume PDF Upload

This epic covers all features related to the uploading of resume PDFs by users without requiring signup. It includes file validation, rate limiting, asynchronous handling, and user feedback during upload.

Create Portfolio and Parse Job Records on Upload

As the system, I want to create portfolio and parse job database records upon successful upload, so that the resume can be processed asynchronously.

Priority: high

Dependencies: Store Uploaded Resume PDF in Vercel Blob Storage (164a1190-8581-44e1-83be-08f6f8e7811c)

Acceptance Criteria:

• Functional: Create a new portfolio record with status 'pending' and store PDF blob URL and uploader IP hash.
• Functional: Create a corresponding parse_jobs record with status 'pending'.
• Technical: Use Supabase Postgres SDK to insert records transactionally.
• Technical: Generate unique slug and edit token JWT for portfolio.
• Technical: Return jobId to client for status polling.

Story Points: 5

Store Uploaded Resume PDF in Vercel Blob Storage

As the system, I want to store validated uploaded PDFs in Vercel Blob Storage, so that files are securely stored and accessible for parsing.

Priority: high

Dependencies: Validate Resume PDF File Type and Size on Upload (ce87d27a-c832-4996-899a-71b70e6b9469), Implement Upload Rate Limiting per IP Address (bf7b6ffc-1754-43b5-b2b0-170d211701de)

Acceptance Criteria:

• Functional: Successfully store uploaded PDF in Vercel Blob Storage with unique identifier.
• Technical: Use Vercel Blob Storage SDK in /api/upload handler to upload file.
• Technical: Store returned blob URL in portfolios table in database.
• Technical: Handle storage errors gracefully and return HTTP 500 with error message.

Story Points: 5

Implement Upload Rate Limiting per IP Address

As the system, I want to enforce a maximum of 5 uploads per hour per IP address, so that abuse and spam are prevented.

Priority: high

Dependencies: Landing Page for Resume PDF Upload (e48d6f2a-2901-4aa1-93db-8fe75e8637a3)

Acceptance Criteria:

• Functional: Reject uploads exceeding 5 per hour per IP with HTTP 429 Too Many Requests and user-friendly message.
• Technical: Store and update upload counts in upload_limits table keyed by SHA-256 hash of uploader IP.
• Technical: Middleware intercepts /api/upload requests to enforce rate limits.
• Technical: Rate limit resets after one hour from last upload timestamp.

Story Points: 5

Validate Resume PDF File Type and Size on Upload

As the system, I want to validate that uploaded files are PDFs with MIME type application/pdf and size <= 4MB, so that only valid resumes are processed.

Priority: high

Dependencies: Landing Page for Resume PDF Upload (e48d6f2a-2901-4aa1-93db-8fe75e8637a3)

Acceptance Criteria:

• Functional: Reject uploads with file types other than application/pdf with a clear error message.
• Functional: Reject uploads larger than 4MB with a clear error message.
• Technical: Validate MIME type and magic bytes server-side in /api/upload handler.
• Technical: Validate file size server-side before storing the file.
• Technical: Return HTTP 400 Bad Request on validation failure.

Story Points: 3

Landing Page for Resume PDF Upload

As an end user, I want a single landing page to upload my resume PDF, so that I can start creating my portfolio without signup.

Priority: high

Acceptance Criteria:

• Functional: User can access a landing page with a file upload form for a single PDF file.
• Functional: The upload form accepts only one file per submission.
• Technical: Implement frontend using Next.js App Router with React and Tailwind CSS.
• Technical: The upload form submits data asynchronously to the backend API endpoint /api/upload.
• Technical: The page is mobile-friendly and accessible (WCAG 2.1 AA).

Story Points: 3

Spike Stories (standalone)

Spike: Documentation Framework Setup

Spike

As the developer, I need to setup documentation tools and initial docs, so that project knowledge is captured and shared.

Priority: medium

Timebox: 0.5 day

Expected Outcomes:

• Documentation framework (e.g., Storybook, MDX, or Docusaurus) configured.
• Initial README and API docs created.
• Contribution guidelines and coding standards documented.

Acceptance Criteria:

• Documentation builds and is accessible.
• API endpoints and data models are documented.
• Docs are version controlled and updated regularly.

Story Points: 2

Spike: Database Migration Framework and Schema Setup

Spike

As the developer, I need to setup database migration tooling and apply initial schema, so that database changes are manageable and versioned.

Priority: high

Timebox: 0.5 day

Expected Outcomes:

• Migration framework (e.g., Prisma Migrate or Supabase CLI) configured.
• Initial schema scripts for portfolios, parse_jobs, and upload_limits applied.
• Migration scripts versioned and documented.

Acceptance Criteria:

• Database schema matches PRD and architecture design.
• Migrations can be applied and rolled back.
• Schema changes tracked in version control.

Story Points: 3

Spike: CI/CD Pipeline Setup with GitHub Actions and Vercel Integration

Spike

As the developer, I need to setup CI/CD pipelines for linting, testing, and deployment, so that code quality and delivery are automated.

Priority: high

Timebox: 1 day

Expected Outcomes:

• GitHub Actions workflows for lint, typecheck, test, and deploy created.
• Vercel integration enabled for automatic deployment on push.
• Branch previews and rollback capabilities verified.

Acceptance Criteria:

• CI runs successfully on pull requests and pushes.
• Deployments to Vercel occur automatically after successful CI.
• Rollback to previous deployment works without downtime.

Story Points: 5

Spike: Development Environment Setup with Docker and Local Testing

Spike

As the developer, I need to setup a local development environment with Docker and testing frameworks, so that I can develop and test reliably.

Priority: high

Timebox: 1 day

Expected Outcomes:

• Dockerfile and docker-compose configured for local Next.js development.
• Testing frameworks (Jest or Vitest) installed and configured.
• ESLint and Prettier configured for code quality.

Acceptance Criteria:

• Local environment supports hot reload and debugging.
• Tests can be run locally with coverage reports.
• Code linting and formatting work as expected.

Story Points: 5

Spike: Repository Initialization and Project Scaffolding

Spike

As the developer, I need to initialize the repository and scaffold the Next.js project with TypeScript and Tailwind CSS, so that development can start with a solid foundation.

Priority: high

Timebox: 1 day

Expected Outcomes:

• Initialized Git repository with Next.js 16.2.7 and TypeScript.
• Tailwind CSS configured with base styles.
• Basic folder structure for pages, components, and API routes.

Acceptance Criteria:

• Project builds and runs locally without errors.
• Tailwind styles are applied correctly.
• Codebase is pushed to GitHub repository.

Story Points: 3

Engineering Tasks

Execution order should follow dependencies; complete "Depends on" tasks before each task.

Setup Jest and React Testing Library for unit and integration tests

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Configure Jest with TypeScript support, add React Testing Library, create initial test setup files and sample tests for components and API routes.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.3h (1.5x factor)
• AI tools: Claude Code (Anthropic)
• AI category: test_generation (high confidence)

Acceptance Criteria:

• Tests run locally with coverage reports
• Sample unit and integration tests pass
• Test scripts integrated in package.json

Definition of Done:

• Test suite runs successfully
• Coverage reports generated
• Documentation updated with test instructions

Initialize GitHub repository and setup Next.js project with TypeScript

• Type: development | Priority: high | Status: done
• Critical path: No
• Description: Create a new GitHub repository for ResumeWeb, initialize with Next.js 16.2.7 using TypeScript template, and commit initial scaffold.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 1.5h (2x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Repository is created on GitHub and accessible
• Next.js project scaffolding with TypeScript compiles and runs without errors locally
• Initial commit pushed to main branch

Definition of Done:

• Project builds and runs locally without errors
• Code pushed to GitHub repository
• Basic README with project overview added

Create Dockerfile and docker-compose for local development environment

• Type: development | Priority: high | Status: done
• Critical path: No
• Description: Write Dockerfile for Next.js 16.2.7 with Node.js >=16.14.0, add docker-compose for local development with hot reload support and volume mounts.
• Estimate: 4 hours
• Story Points: 2
• Traditional estimate: 4h | AI-accelerated: 2.5h (1.6x factor)
• AI tools: Devin (Cognition)
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Dockerfile builds successfully and runs Next.js app
• docker-compose enables hot reload and debugging
• Local environment matches production Node.js version

Definition of Done:

• Docker container runs Next.js app with hot reload
• Documentation added for local Docker usage
• Docker images build without errors

Implement database indexes and constraints as per schema design

• Type: development | Priority: medium | Status: todo
• Depends on (complete these first): 33e87663-96eb-4b00-b630-ba227c2362c3
• Critical path: No
• Description: Add unique indexes on slug and edit_token_jwt, indexes on is_published and uploader_ip_hash columns, and foreign key constraints for parse_jobs.portfolio_id.
• Estimate: 2 hours
• Story Points: 1
• Traditional estimate: 2h | AI-accelerated: 1h (2x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Indexes created and verified on slug, edit_token_jwt, is_published, uploader_ip_hash
• Foreign key constraints enforce referential integrity
• Migration scripts include index creation

Definition of Done:

• Indexes and constraints applied without errors
• Performance tested for lookup queries
• Migration files committed and versioned

Integrate ESLint and Prettier with testing and Docker environment

• Type: development | Priority: medium | Status: todo
• Depends on (complete these first): dfe95477-2e31-4812-8cd7-33390f5caf68, 8a740e79-bcbf-41e4-8bfd-12cecdaf6d82
• Critical path: No
• Description: Extend ESLint and Prettier configurations to cover test files and Docker environment, ensure linting and formatting work with tests and Docker builds.
• Estimate: 2 hours
• Story Points: 1
• Traditional estimate: 2h | AI-accelerated: 1h (2x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Linting passes on test files and Docker configs
• Prettier formatting consistent across codebase
• No lint or format errors during CI runs

Definition of Done:

• Lint and format checks pass locally and in CI
• Documentation updated for linting rules
• Docker build scripts linted

Document API endpoints and data models in OpenAPI format

• Type: documentation | Priority: medium | Status: todo
• Critical path: No
• Description: Create OpenAPI (Swagger) specification for all API endpoints and database schemas, include request/response schemas and authentication details.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 1.75h (1.7x factor)
• AI tools: Claude Code (Anthropic)
• AI category: documentation (high confidence)

Acceptance Criteria:

• OpenAPI spec includes all endpoints with schemas
• Authentication and error responses documented
• Spec validated with OpenAPI tools

Definition of Done:

• OpenAPI spec committed to repository
• Spec passes validation tools
• Docs site links to API spec

Setup documentation framework with Docusaurus and initial docs

• Type: documentation | Priority: medium | Status: done
• Critical path: No
• Description: Install and configure Docusaurus for project documentation, create initial docs covering project overview, API endpoints, and data models.
• Estimate: 4 hours
• Story Points: 2
• Traditional estimate: 4h | AI-accelerated: 2.35h (1.7x factor)
• AI tools: Claude Code (Anthropic)
• AI category: documentation (high confidence)

Acceptance Criteria:

• Documentation site builds without errors
• API endpoints and data models documented clearly
• Docs are version controlled and accessible

Definition of Done:

• Documentation site deployed locally
• Initial docs committed to repository
• README updated with docs link

Implement PDF Storage in Vercel Blob Storage in /api/upload

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Integrate Vercel Blob Storage SDK in /api/upload API Route Handler to upload validated PDF files. Generate unique blob names. Store returned blob URL in portfolios table. Handle storage errors gracefully and return HTTP 500 with error messages on failure.
• Estimate: 8 hours
• Story Points: 5
• Traditional estimate: 8h | AI-accelerated: 5.7h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Uploaded PDFs are stored successfully in Vercel Blob Storage
• Blob URLs are correctly saved in portfolios database records
• Storage errors are caught and return HTTP 500 with messages
• Unique blob names prevent collisions

Definition of Done:

• Blob storage integration implemented in /api/upload
• Unit and integration tests cover success and failure cases
• Code reviewed and merged

Setup GitHub Actions deployment integration with Vercel

• Type: devops | Priority: high | Status: todo
• Depends on (complete these first): dbb7eb4a-5fa3-4c3b-8570-4f186abb3152
• Critical path: No
• Description: Configure GitHub Actions to trigger Vercel deployments on successful CI, including environment variable setup and deployment status monitoring.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 1.9h (1.6x factor)
• AI tools: Devin (Cognition)
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Successful deployment to Vercel triggered after CI passes
• Deployment status reported in GitHub Actions
• Rollback to previous deployment possible without downtime

Definition of Done:

• Deployment workflow YAML committed
• Deployments verified on Vercel dashboard
• Rollback tested and documented

Implement PII Stripping Logic in Async Parser

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Add logic in the async PDF parser function to detect and remove email addresses, phone numbers, and physical addresses from parsed portfolio data before storing in the database. Validate that no PII fields are present in public data queries. Log any PII detection events for audit purposes.
• Estimate: 8 hours
• Story Points: 5
• Traditional estimate: 8h | AI-accelerated: 7.3h (1.1x factor)
• AI tools: Claude Code (Anthropic)
• AI category: complex_algorithm (medium confidence)

Acceptance Criteria:

• Parsed data stored excludes email, phone, and address fields
• PII detection and removal logic is tested and effective
• No PII fields are returned by public portfolio API
• PII detection events are logged for audit

Definition of Done:

• PII stripping implemented and integrated
• Unit tests cover PII detection and removal
• Integration tests verify public API data
• Code reviewed and merged

Implement Clear Parse Failure Handling and User Feedback

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Enhance async parser and status API to set parse_jobs status to 'error' with descriptive error messages on parse failure. Ensure /api/status/:jobId returns error messages to clients. Update frontend UploadPage and StatusPage to display user-friendly error messages with retry instructions. Log errors for monitoring and alerting.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.3h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Parse failures set parse_jobs status to 'error' with message
• Polling API returns error messages to frontend
• Frontend displays clear, user-friendly error and retry options
• Parse errors are logged for monitoring

Definition of Done:

• Parse failure handling implemented end-to-end
• Unit and integration tests cover error scenarios
• Frontend error UI tested for clarity and accessibility
• Code review and monitoring setup completed

Create Public Portfolio SSR Page at /p/[slug]

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Implement a Next.js App Router server-side rendered page at /p/[slug] that fetches portfolio data from the database and renders a mobile-friendly portfolio page with summary, experience, skills, education, projects, and optional photo. The page must return 404 for unpublished or deleted portfolios and include SEO meta tags.
• Estimate: 10 hours
• Story Points: 5
• Traditional estimate: 10h | AI-accelerated: 7.1h (1.4x factor)
• AI tools: Claude Code (Anthropic)
• AI category: implementation (high confidence)

Acceptance Criteria:

• Public portfolio page accessible at /p/{slug} with correct data
• Returns HTTP 404 if portfolio is unpublished or soft deleted
• Page is responsive and styled with Tailwind CSS

Definition of Done:

• SSR page implemented and deployed
• Integration tests verify 200 and 404 responses
• UI passes mobile responsiveness and accessibility checks
• Code reviewed and merged

Implement Photo Upload Endpoint and Edit UI Integration

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Develop POST /api/edit/:token/photo API Route Handler to accept JPEG/PNG images up to 2MB, validate file type and size, store photos in Vercel Blob Storage, and update portfolios.photo_blob_url. Integrate photo upload UI in EditPage to display uploaded photo and handle upload errors.
• Estimate: 10 hours
• Story Points: 5
• Traditional estimate: 10h | AI-accelerated: 7.1h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Photo upload endpoint accepts valid JPEG/PNG files up to 2MB
• Photos are stored in Vercel Blob Storage and URL saved in DB
• Edit UI displays uploaded photo and handles errors gracefully

Definition of Done:

• PhotoUploadHandler implemented and tested
• EditPage updated with photo upload UI
• Integration tests cover upload and display
• Code reviewed and merged

Implement Edit Page UI for Portfolio Content Updates

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Create a React component EditPage using Next.js and Tailwind CSS that fetches portfolio data from /api/edit/:token and allows inline editing of summary, experience, skills, education, and projects. Sanitize inputs to prevent XSS and submit changes via PATCH /api/edit/:token.
• Estimate: 12 hours
• Story Points: 5
• Traditional estimate: 12h | AI-accelerated: 8.6h (1.4x factor)
• AI tools: Claude Code (Anthropic)
• AI category: implementation (high confidence)

Acceptance Criteria:

• Edit page fetches full portfolio data securely with JWT token
• User can edit text fields inline and submit changes
• Input fields are sanitized to prevent XSS attacks

Definition of Done:

• EditPage component implemented and integrated
• Unit and integration tests cover data fetching, editing, and submission
• XSS sanitization verified
• Code reviewed and merged

Enable and Configure Vercel Blob Storage for Resume PDFs and Photos

• Type: devops | Priority: high | Status: todo
• Critical path: No
• Description: Enable Vercel Blob Storage on the project account. Configure storage containers/buckets for PDFs and photos. Generate and securely store access tokens or credentials in environment variables for SDK usage.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 2.7h (1.1x factor)
• AI tools: Amazon Q Developer
• AI category: implementation (medium confidence)

Acceptance Criteria:

• Vercel Blob Storage is enabled and accessible via SDK
• Storage credentials are stored securely in environment variables
• Storage containers for PDFs and photos are created and configured

Definition of Done:

• Blob storage accessible from local and deployed environments
• Credentials verified and documented
• Storage containers verified via SDK

Create Dockerfile for Next.js 16.2.7 with TypeScript and Tailwind CSS

• Type: development | Priority: medium | Status: todo
• Critical path: No
• Description: Write a Dockerfile to containerize the Next.js 16.2.7 app with TypeScript and Tailwind CSS. Include Node.js >=16.14.0 base image, install dependencies, build app, and expose port 3000 for local development.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 1.6h (1.9x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Dockerfile builds successfully without errors
• Container runs Next.js app with hot reload on port 3000
• Tailwind CSS styles are applied correctly in container

Definition of Done:

• Docker image builds and runs locally
• Next.js app accessible in browser via container
• Dockerfile committed to repo

Verify Serverless Functions Auto-Scaling on Vercel

• Type: testing | Priority: high | Status: todo
• Critical path: No
• Description: Test and confirm that Next.js API Route Handlers scale automatically under load on Vercel. Simulate concurrent requests to upload, parse, and edit endpoints. Monitor resource usage and response times.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.3h (1.5x factor)
• AI tools: Devin (Cognition)
• AI category: testing (medium confidence)

Acceptance Criteria:

• Serverless functions scale with increasing concurrent traffic
• Response times remain within acceptable limits under load
• No failures or throttling observed during tests

Definition of Done:

• Load tests executed and analyzed
• Scaling behavior documented
• Issues identified and reported if any

Verify HTTPS Enforcement and TLS Configuration on Vercel

• Type: testing | Priority: high | Status: todo
• Critical path: No
• Description: Confirm that all API and UI endpoints are accessible only via HTTPS. Validate that Vercel platform enforces HTTPS with valid TLS certificates. Document compliance with GDPR and security best practices.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 2.7h (1.1x factor)
• AI tools: Devin (Cognition)
• AI category: testing (medium confidence)

Acceptance Criteria:

• All endpoints redirect HTTP to HTTPS
• TLS certificates are valid and trusted
• Documentation confirms encryption compliance

Definition of Done:

• HTTPS verified on all endpoints
• TLS configuration documented
• No insecure endpoints detected

Verify Data Encryption at Rest in Supabase Postgres and Vercel Blob Storage

• Type: research | Priority: high | Status: todo
• Critical path: No
• Description: Confirm that Supabase Postgres and Vercel Blob Storage encrypt data at rest using industry standards. Review vendor documentation and conduct compliance checks. Document encryption status and configurations.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 3h (1x factor)
• AI tools: Claude Code (Anthropic)
• AI category: implementation (medium confidence)

Acceptance Criteria:

• Encryption at rest is confirmed for database and blob storage
• Encryption methods comply with GDPR and best practices
• Documentation clearly states encryption configurations

Definition of Done:

• Encryption verification report completed
• Documentation committed
• Recommendations for improvements noted if any

Write Automated Tests to Verify No PII Leakage and Privacy Flags Enforcement

• Type: testing | Priority: high | Status: todo
• Critical path: No
• Description: Develop unit and integration tests to verify that no email, phone, or address data is exposed in public API responses or pages. Test that is_published and allow_search_indexing flags are enforced correctly. Include edge cases and error scenarios.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4h (1.5x factor)
• AI tools: GitHub Copilot
• AI category: test_generation (high confidence)

Acceptance Criteria:

• Tests confirm no PII in public API responses
• Tests verify 404 returned for unpublished portfolios
• Tests verify SEO flags toggle indexing headers

Definition of Done:

• Test suite passes with coverage > 80%
• Tests committed and integrated in CI pipeline
• Documentation updated with test coverage reports

Monitor Uptime Metrics via Vercel and Supabase Dashboards

• Type: devops | Priority: high | Status: todo
• Critical path: No
• Description: Set up monitoring dashboards in Vercel and Supabase to track uptime and availability metrics for ResumeWeb. Configure alerts for downtime or degraded performance.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 2.73h (1.1x factor)
• AI tools: GitHub Copilot
• AI category: implementation (medium confidence)

Acceptance Criteria:

• Uptime metrics are visible and updated in dashboards
• Alerts trigger on downtime or performance degradation
• Monitoring setup documented

Definition of Done:

• Monitoring dashboards configured and verified
• Alerting tested
• Documentation updated

Enable and Verify Automated Daily Backups in Supabase

• Type: devops | Priority: medium | Status: todo
• Critical path: No
• Description: Confirm that Supabase automated daily backups are enabled for the ResumeWeb database. Verify backup schedules, retention policies, and test restoration of backups in a staging environment.
• Estimate: 4 hours
• Story Points: 3
• Traditional estimate: 4h | AI-accelerated: 3.64h (1.1x factor)
• AI tools: GitHub Copilot
• AI category: implementation (medium confidence)

Acceptance Criteria:

• Automated daily backups are active and documented in Supabase dashboard
• Backup retention period meets project requirements
• Test restore from backup succeeds without data loss

Definition of Done:

• Backup and restore procedures documented
• Restore test results logged
• Backup configuration committed in project documentation

Configure Backup Success and Failure Alerts

• Type: devops | Priority: medium | Status: todo
• Depends on (complete these first): 5a4474d1-1b51-46a9-baaa-8e8989c54215
• Critical path: No
• Description: Set up monitoring and alerting for backup job success and failure notifications using Supabase or external monitoring tools. Configure email or Slack alerts for failures or missed backups.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 2.73h (1.1x factor)
• AI tools: GitHub Copilot
• AI category: implementation (medium confidence)

Acceptance Criteria:

• Alerts trigger on backup failures or missed schedules
• Notifications are received by responsible parties
• Alert configuration documented for maintenance

Definition of Done:

• Alerting tested and verified
• Documentation updated
• Configurations committed

Log All User-Facing Errors for Monitoring and Debugging

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Implement centralized logging for all user-facing errors including upload validation failures, parse errors, and edit validation errors. Ensure logs are structured and sent to Sentry or Vercel logs for monitoring.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.57h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• All user-facing errors are logged with context and stack traces
• Logs are accessible in Sentry or Vercel dashboard
• Logging does not expose sensitive user data

Definition of Done:

• Error logging implemented and verified
• Logs reviewed for completeness and privacy
• Documentation updated with logging strategy

Configure Alerts for Parse Job Failure Rates and API Errors

• Type: devops | Priority: medium | Status: todo
• Depends on (complete these first): 23a45cd9-5624-41a8-b62d-7dbb0e925d82, 01dee65e-bc3c-4595-adeb-4f154c2464c8
• Critical path: No
• Description: Set up alerting rules in Vercel Analytics and Sentry to notify the developer when parse job failure rate exceeds 5% in 1 hour or when API 5xx errors exceed 1% in 1 hour. Configure email or Slack notifications.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 2.73h (1.1x factor)
• AI tools: GitHub Copilot
• AI category: implementation (medium confidence)

Acceptance Criteria:

• Alerts trigger on configured thresholds for parse job failures and API errors
• Notifications are received by developer via configured channels
• Alert configurations are documented for future maintenance

Definition of Done:

• Alerts tested and verified in staging environment
• Documentation updated with alerting setup
• Code and config committed

Implement PII Stripping Logic in Async PDF Parser

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Enhance the async PDF parser function to detect and remove email addresses, phone numbers, and physical addresses from parsed data before storing in the database. Use regex and heuristic checks. Log PII detection events for audit.
• Estimate: 8 hours
• Story Points: 5
• Traditional estimate: 8h | AI-accelerated: 7.2h (1.1x factor)
• AI tools: Claude Code (Anthropic)
• AI category: complex_algorithm (high confidence)

Acceptance Criteria:

• PII fields (email, phone, address) are removed before database storage
• No PII appears in public API responses or pages
• PII detection events are logged with timestamps

Definition of Done:

• PII stripping code implemented and tested
• Unit and integration tests verify no PII leakage
• Logging verified and documented

Implement Server-Side Validation for Resume PDF Upload

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: In the /api/upload Next.js API Route Handler, implement server-side validation to reject files that are not PDFs (MIME type application/pdf) or exceed 4MB in size. Validate magic bytes to confirm PDF format. Return HTTP 400 Bad Request with clear error messages on validation failure.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.6h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Uploads with invalid MIME types are rejected with HTTP 400
• Uploads exceeding 4MB are rejected with HTTP 400
• PDF magic bytes are validated and invalid files rejected
• Error messages returned are clear and user-friendly

Definition of Done:

• Validation logic implemented and integrated in /api/upload
• Unit tests cover all validation cases
• Integration tests verify rejection of invalid uploads
• Code review completed

Create Status Polling API Endpoint /api/status/:jobId

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Implement GET /api/status/:jobId Next.js API Route Handler to return parse job status. Response includes status ('pending', 'processing', 'success', 'error'), optional errorMessage, and on success, publicUrl and editUrl. Return HTTP 404 if jobId is unknown. Use efficient DB queries to parse_jobs and portfolios tables.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.6h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• API returns correct parse job status for valid jobId
• On success, response includes public and edit URLs
• Returns HTTP 404 for unknown jobId
• Response times meet performance requirements

Definition of Done:

• Status API implemented and tested
• Unit and integration tests cover all response scenarios
• Performance tested to meet <200ms response time
• Code review completed

Optimize Async PDF Parsing Pipeline for Speed and Reliability

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Review and optimize the async PDF parsing pipeline implementation to ensure median processing time under 2 minutes. Improve concurrency, error handling, and resource usage. Implement logging and retry mechanisms.
• Estimate: 10 hours
• Story Points: 5
• Traditional estimate: 10h | AI-accelerated: 9.1h (1.1x factor)
• AI tools: Cursor
• AI category: complex_algorithm (medium confidence)

Acceptance Criteria:

• Median upload-to-live URL time is measured and under 2 minutes
• Async parsing pipeline handles concurrent jobs without failures
• Retries and error logging implemented for transient failures

Definition of Done:

• Pipeline performance benchmarks documented
• Code updated and tested for concurrency and error handling
• Monitoring alerts configured for parse failures

Implement PII Stripping and Verification in Public Portfolio API

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Enhance the /api/portfolio/:slug API handler to ensure email, phone, and address fields are stripped from the response. Implement verification tests to confirm no PII leaks in public API responses. Add logging for any detected PII exposure attempts.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.3h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Public API response excludes email, phone, and address fields
• PII stripping is performed at parse time and verified at response
• Logs capture any PII exposure attempts

Definition of Done:

• API handler updated and tested
• Automated tests pass verifying no PII leakage
• Logging integrated and verified
• Code reviewed and merged

Generate and Store Signed JWT Edit Token on Portfolio Creation

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Implement logic to generate a secure, HS256-signed JWT edit token containing portfolio ID upon portfolio creation. Store the token uniquely in the portfolios table and return the edit URL in the upload response.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.6h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• JWT edit token generated with HS256 and strong secret
• Token includes portfolio ID and is stored uniquely in DB
• Edit URL returned as /edit/{token} after upload

Definition of Done:

• JWT generation implemented and integrated
• Unit tests verify token contents and uniqueness
• Edit URL returned in API response
• Code reviewed and merged

Add SEO Indexing Toggle UI and API Integration in Edit Page

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Add a toggle control in the EditPage UI to enable or disable allow_search_indexing flag. Implement PATCH /api/edit/:token/seo endpoint to update this flag in the portfolios table. Ensure toggle state is fetched on edit page load and changes persist immediately on public page.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.3h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Edit page displays allow_search_indexing toggle with current state
• Toggle updates flag via PATCH /api/edit/:token/seo endpoint
• Changes persist in database and reflect on public portfolio page

Definition of Done:

• Toggle UI and API integration implemented
• Unit and integration tests verify toggle behavior and persistence
• Code reviewed and merged

Implement and Test File Upload and Retrieval Using Vercel Blob SDK

• Type: development | Priority: high | Status: todo
• Depends on (complete these first): d291a122-fe84-468e-8e4e-ac82efb2ef74
• Critical path: No
• Description: Develop test scripts or minimal API route handlers to upload sample PDF and image files to Vercel Blob Storage and retrieve them. Validate correct URLs and access permissions. Handle errors gracefully.
• Estimate: 4 hours
• Story Points: 3
• Traditional estimate: 4h | AI-accelerated: 2.8h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Files can be uploaded and retrieved successfully via SDK
• URLs are valid and accessible with correct permissions
• Error handling works for invalid uploads or access failures

Definition of Done:

• Upload and retrieval tested locally and in deployed environment
• Test scripts or API handlers committed
• Documentation updated with usage examples

Configure Automatic Deployment to Vercel on Successful CI

• Type: devops | Priority: high | Status: todo
• Depends on (complete these first): 043cd481-2ca7-4dba-9668-3b19b1310912
• Critical path: No
• Description: Integrate GitHub Actions workflow to trigger automatic deployment to Vercel on successful CI runs. Configure Vercel project to use environment variables and secrets. Enable branch previews and rollback capabilities.
• Estimate: 4 hours
• Story Points: 3
• Traditional estimate: 4h | AI-accelerated: 2.1h (1.9x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Successful CI triggers automatic deployment to Vercel
• Branch preview deployments are available for PRs
• Rollback to previous deployment is possible via Vercel dashboard

Definition of Done:

• Deployments occur automatically on main branch merges
• Preview URLs available for feature branches
• Rollback tested and documented

Tune Polling Intervals and Implement Performance Metrics Collection

• Type: development | Priority: high | Status: todo
• Depends on (complete these first): 900c135c-13c0-488f-98b4-345978ba39be
• Critical path: No
• Description: Adjust client-side polling intervals for /api/status/:jobId to balance latency and server load. Instrument Vercel Analytics to collect metrics on upload-to-live URL times and parse job durations.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.3h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Polling intervals reduce unnecessary server load while maintaining UI responsiveness
• Performance metrics are collected and visible in Vercel Analytics
• Alerts configured for median time exceeding thresholds

Definition of Done:

• Polling logic updated and tested in frontend
• Metrics dashboards created in Vercel Analytics
• Documentation updated with performance monitoring info

Monitor Database Performance and Confirm Scalability

• Type: testing | Priority: high | Status: todo
• Critical path: No
• Description: Monitor Supabase Postgres performance metrics under expected load. Verify that database queries for portfolios, parse_jobs, and upload_limits perform efficiently. Confirm no sharding or partitioning is needed for initial volume.
• Estimate: 4 hours
• Story Points: 3
• Traditional estimate: 4h | AI-accelerated: 2.7h (1.5x factor)
• AI tools: Devin (Cognition)
• AI category: testing (medium confidence)

Acceptance Criteria:

• Database queries execute within acceptable latency thresholds
• No deadlocks or connection issues under load
• Documentation confirms no sharding required for Phase 1

Definition of Done:

• Performance metrics collected and analyzed
• Recommendations documented
• No critical performance issues found

Implement JWT Authentication Middleware for Edit Endpoints

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Develop middleware for Next.js API Route Handlers under /api/edit/:token to validate JWT tokens signed with HS256. Verify token signature, extract portfolio ID, and reject requests with invalid or missing tokens with HTTP 401.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 5.4h (1.1x factor)
• AI tools: Claude Code (Anthropic)
• AI category: security (high confidence)

Acceptance Criteria:

• All edit endpoints require valid JWT token in URL path
• Invalid or missing tokens return HTTP 401 Unauthorized
• JWT tokens are verified using HS256 and strong secret from env vars

Definition of Done:

• Middleware implemented and integrated
• Unit and integration tests cover valid and invalid tokens
• Documentation updated with auth flow

Implement Health Checks and Readiness Probes

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Develop API endpoints or middleware to serve health check and readiness probe responses for ResumeWeb. Integrate with Vercel or external monitoring to verify service health.
• Estimate: 4 hours
• Story Points: 3
• Traditional estimate: 4h | AI-accelerated: 2.86h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Health check endpoint returns 200 OK with service status
• Readiness probe endpoint indicates service readiness for traffic
• Endpoints are secured and do not expose sensitive data

Definition of Done:

• Health and readiness endpoints implemented and tested
• Documentation updated with endpoint details
• Code merged and deployed

Document Backup Retention and Disaster Recovery Procedures

• Type: documentation | Priority: medium | Status: todo
• Depends on (complete these first): 5a4474d1-1b51-46a9-baaa-8e8989c54215
• Critical path: No
• Description: Write detailed documentation describing backup retention policies, restoration steps, and disaster recovery plans including roles, responsibilities, and escalation paths.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 2.94h (1.7x factor)
• AI tools: Claude Code (Anthropic)
• AI category: documentation (high confidence)

Acceptance Criteria:

• Backup retention and restore procedures are clearly documented
• Disaster recovery plan includes step-by-step restoration instructions
• Documentation reviewed and approved by team

Definition of Done:

• Documentation published in project wiki or docs folder
• Reviewed by at least one other developer
• Accessible to operations and support teams

Ensure UI Components Meet WCAG 2.1 AA Accessibility Standards

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Audit and update all UI components to comply with WCAG 2.1 AA guidelines including keyboard navigation, color contrast, ARIA roles, and semantic HTML usage. Fix accessibility issues identified by Axe and Lighthouse.
• Estimate: 12 hours
• Story Points: 5
• Traditional estimate: 12h | AI-accelerated: 8.57h (1.4x factor)
• AI tools: v0 by Vercel
• AI category: implementation (high confidence)

Acceptance Criteria:

• All pages pass automated accessibility audits with no critical errors
• Keyboard navigation and screen reader support verified
• Semantic HTML and ARIA attributes used appropriately

Definition of Done:

• Accessibility issues fixed and verified
• Accessibility test reports included in CI
• Documentation updated with accessibility best practices

Provision Supabase Postgres 18.4 Instance and Configure Access

• Type: devops | Priority: high | Status: todo
• Critical path: No
• Description: Provision a Supabase Postgres 18.4 managed instance via Supabase dashboard. Configure network access, database user credentials, and connection pools. Verify connectivity from local dev and Vercel deployment environments.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 2.7h (1.1x factor)
• AI tools: Amazon Q Developer
• AI category: implementation (medium confidence)

Acceptance Criteria:

• Supabase Postgres 18.4 instance is provisioned and accessible from dev and production environments
• Database credentials and connection details are securely stored in environment variables
• Connection tests succeed with no errors

Definition of Done:

• Provisioned database is accessible
• Connection details documented
• Environment variables configured in Vercel

Implement Unique Slug Generation Logic for Portfolios

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Develop a function to generate unique, URL-safe, lowercase slugs with a maximum length of 32 characters for each portfolio upon creation. Ensure slugs are checked against the database for uniqueness and regenerate if a collision occurs.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.3h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Slugs are generated automatically on portfolio creation
• Slugs are unique in the portfolios table and URL-safe lowercase
• Slugs do not exceed 32 characters in length

Definition of Done:

• Slug generation function implemented and integrated
• Unit tests cover uniqueness and format validation
• Code reviewed and merged

Create docker-compose.yml for Local Development with Supabase and Blob Storage Mocks

• Type: development | Priority: medium | Status: todo
• Depends on (complete these first): e5a8d7b7-fb9c-4ec6-93e4-6f268ff4c186
• Critical path: No
• Description: Write a docker-compose file to orchestrate Next.js app container, local Supabase Postgres emulator, and Vercel Blob Storage mock or stub. Configure environment variables and volume mounts for hot reload and persistent data.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 2.6h (1.9x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• docker-compose starts all services successfully
• Next.js app connects to local Supabase and Blob mocks
• Hot reload works with volume mounts

Definition of Done:

• Local dev environment runs with single docker-compose up
• Documentation for setup and usage provided
• docker-compose.yml committed

Enable and Configure Vercel Analytics for ResumeWeb

• Type: devops | Priority: medium | Status: todo
• Critical path: No
• Description: Set up Vercel Analytics in the Vercel project dashboard to track traffic, performance metrics, and user interactions. Integrate Vercel Analytics client-side SDK in the Next.js app to collect page views and API usage data.
• Estimate: 4 hours
• Story Points: 3
• Traditional estimate: 4h | AI-accelerated: 3.6h (1.1x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Vercel Analytics is enabled and configured in the project dashboard
• Page views and API request metrics are collected and visible in Vercel Analytics
• No significant performance overhead introduced by analytics integration

Definition of Done:

• Vercel Analytics dashboard shows live traffic and performance data
• Code changes merged and deployed
• Basic monitoring documentation updated

Setup ESLint, Prettier, and Husky for linting and formatting

• Type: development | Priority: medium | Status: todo
• Depends on (complete these first): 5d060f8a-1332-4d02-81ac-aa1a7843f6a3
• Critical path: No
• Description: Configure ESLint and Prettier with recommended settings for Next.js and TypeScript, add Husky pre-commit hooks to enforce lint and format on commit.
• Estimate: 2 hours
• Story Points: 1
• Traditional estimate: 2h | AI-accelerated: 1h (2x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• ESLint and Prettier configurations are present and valid
• Pre-commit hooks run lint and format checks
• Code fails commit if linting or formatting errors exist

Definition of Done:

• Lint and format run successfully locally
• Pre-commit hooks prevent bad commits
• Documentation updated with linting instructions

Document Local Development Environment Setup and Usage

• Type: documentation | Priority: medium | Status: todo
• Depends on (complete these first): e5a8d7b7-fb9c-4ec6-93e4-6f268ff4c186, 5ac7ea26-a221-4470-8d55-b2c5a71cc899
• Critical path: No
• Description: Write detailed documentation covering Docker and docker-compose setup, environment variable configuration, running the Next.js app locally with hot reload, and troubleshooting common issues.
• Estimate: 3 hours
• Story Points: 2
• Traditional estimate: 3h | AI-accelerated: 1.8h (1.7x factor)
• AI tools: Claude Code (Anthropic)
• AI category: documentation (high confidence)

Acceptance Criteria:

• Documentation clearly explains setup steps and commands
• Includes troubleshooting tips for common errors
• Reviewed and approved by developer

Definition of Done:

• Documentation committed and accessible
• Developer confirms successful local setup using docs

Integrate Tailwind CSS with Next.js and configure basic styles

• Type: development | Priority: high | Status: todo
• Depends on (complete these first): 5d060f8a-1332-4d02-81ac-aa1a7843f6a3
• Critical path: No
• Description: Install Tailwind CSS latest stable (2026), configure PostCSS and Tailwind config files, add base styles and verify styling works on sample components.
• Estimate: 2 hours
• Story Points: 1
• Traditional estimate: 2h | AI-accelerated: 1h (2x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Tailwind CSS is installed and configured correctly
• Sample styled component renders with Tailwind styles applied
• No build or runtime errors related to styling

Definition of Done:

• Tailwind CSS config files created
• Sample page styled with Tailwind
• Styles verified in local development

Implement Default Noindex SEO Headers and Meta Tags on Public Portfolio Pages

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Modify public portfolio API and SSR pages to include robots meta tag with noindex and X-Robots-Tag HTTP header set to noindex by default. Allow override via allow_search_indexing flag. Write tests to verify header and meta tag presence.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.6h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Public pages include noindex meta tag and X-Robots-Tag header by default
• Allow_search_indexing flag toggles SEO indexing on public pages
• Automated tests verify correct headers and meta tags

Definition of Done:

• Code changes committed and tested
• Tests pass with coverage on SEO logic
• Documentation updated with SEO behavior

Verify Vercel Deployment Supports Zero-Downtime and Instant Rollback

• Type: devops | Priority: high | Status: todo
• Critical path: No
• Description: Test and confirm that deployments on Vercel for ResumeWeb support zero-downtime updates and instant rollback to previous versions. Document deployment process and rollback steps.
• Estimate: 4 hours
• Story Points: 3
• Traditional estimate: 4h | AI-accelerated: 3.64h (1.1x factor)
• AI tools: GitHub Copilot
• AI category: implementation (medium confidence)

Acceptance Criteria:

• Deployments do not cause downtime or service interruption
• Rollback to previous deployment version is instantaneous and verified
• Deployment and rollback procedures are documented

Definition of Done:

• Deployment and rollback tested successfully
• Documentation updated with deployment steps
• Code and config committed

Implement Responsive Layouts with Tailwind CSS for All Pages

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Refactor all UI pages (UploadPage, StatusPage, PortfolioPage, EditPage) to use Tailwind CSS responsive utilities ensuring mobile-first design and proper rendering on various screen sizes.
• Estimate: 10 hours
• Story Points: 5
• Traditional estimate: 10h | AI-accelerated: 7.14h (1.4x factor)
• AI tools: v0 by Vercel
• AI category: implementation (high confidence)

Acceptance Criteria:

• All pages render correctly on mobile devices and desktop with no layout breakage
• Responsive utilities from Tailwind CSS are used consistently
• UI passes manual testing on multiple device sizes

Definition of Done:

• Responsive UI implemented and tested
• Code reviewed and merged
• Documentation updated with responsive design guidelines

Display User-Friendly Parse Failure Messages with Retry Options

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Update StatusPage UI and /api/status/:jobId API to show clear, friendly error messages when parsing fails. Provide retry button or instructions for users to upload a new resume.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.57h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Parse failure status returns descriptive error messages via API
• StatusPage UI displays error messages clearly and accessibly
• Retry or upload new resume options are available and functional

Definition of Done:

• Parse failure handling implemented and tested
• UI error states verified on devices
• Documentation updated with error handling flow

Document Incident Response Procedures for ResumeWeb

• Type: documentation | Priority: high | Status: todo
• Critical path: No
• Description: Create detailed documentation outlining incident response steps, including detection, escalation, mitigation, communication, and post-incident review for ResumeWeb platform incidents.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 2.94h (1.7x factor)
• AI tools: Claude Code (Anthropic)
• AI category: documentation (high confidence)

Acceptance Criteria:

• Incident response plan covers detection, escalation, and mitigation steps
• Roles and responsibilities are clearly defined
• Plan is reviewed and approved by stakeholders

Definition of Done:

• Documentation published in project repository
• Reviewed by team and updated as needed
• Accessible to all relevant personnel

Implement Validation Error Messages and Feedback in Edit Page

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Enhance EditPage UI and PATCH /api/edit/:token API to validate user inputs and display clear validation error messages. Ensure consistent error message format and accessibility compliance.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.29h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Edit API returns HTTP 400 with detailed validation error messages
• EditPage UI displays validation errors inline and accessibly
• User cannot submit invalid data and receives immediate feedback

Definition of Done:

• Validation implemented and tested end-to-end
• UI error messages verified for accessibility
• Documentation updated with validation rules

Perform Accessibility Testing with Axe and Lighthouse

• Type: testing | Priority: high | Status: todo
• Depends on (complete these first): e80be497-3f83-4d22-add2-a99a70b2a349
• Critical path: No
• Description: Write automated accessibility tests using Axe-core for unit and integration tests. Run Lighthouse audits on key pages and fix issues. Integrate accessibility testing into CI pipeline.
• Estimate: 8 hours
• Story Points: 3
• Traditional estimate: 8h | AI-accelerated: 5.33h (1.5x factor)
• AI tools: GitHub Copilot
• AI category: test_generation (high confidence)

Acceptance Criteria:

• Automated accessibility tests cover all critical UI components
• Lighthouse audits show WCAG 2.1 AA compliance scores above 90
• Accessibility tests run and pass in CI pipeline

Definition of Done:

• Accessibility tests implemented and passing
• CI pipeline updated to include accessibility checks
• Test reports archived and accessible

Create Portfolio and Parse Job Records Transactionally on Upload

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Implement transactional creation of portfolio and parse_jobs records in Supabase Postgres when a resume upload succeeds. Generate unique slug (32 char max) and signed JWT edit token. Store PDF blob URL and uploader IP hash. Return parse job ID to client for status polling.
• Estimate: 8 hours
• Story Points: 5
• Traditional estimate: 8h | AI-accelerated: 5.7h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Portfolio record created with status 'pending' and required fields
• Parse job record created with status 'pending' linked to portfolio
• Slug is unique and stored in portfolios.slug
• Edit token JWT is signed, stored, and unique
• API returns jobId for client polling

Definition of Done:

• Transactional DB creation implemented and tested
• Unit tests cover slug uniqueness and JWT generation
• Integration tests verify API response and DB state
• Code review completed

Implement Consistent and Clear Error Messages for Upload Failures

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Enhance /api/upload and UploadPage UI to display clear, user-friendly error messages for invalid file type, file size exceeded, and rate limit exceeded errors. Ensure messages are consistent between frontend and backend.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.29h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Upload errors for invalid file type, size, and rate limit return HTTP 400 or 429 with descriptive messages
• UploadPage UI displays corresponding error messages clearly and accessibly
• Error messages are consistent and localized if applicable

Definition of Done:

• Error handling code implemented and tested
• UI error messages verified on multiple devices
• Documentation updated with error message specs

Implement Default Noindex SEO Headers and Meta Tags on Public Portfolio

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Enhance /api/portfolio/:slug API and SSR page to include robots meta tag with noindex and X-Robots-Tag HTTP header set to noindex by default. Dynamically toggle these based on allow_search_indexing flag in portfolio record.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.6h (1.4x factor)
• AI tools: Claude Code (Anthropic)
• AI category: implementation (high confidence)

Acceptance Criteria:

• Public portfolio pages include robots meta tag with noindex by default
• X-Robots-Tag HTTP header set to noindex by default
• Meta tags and headers dynamically reflect allow_search_indexing flag

Definition of Done:

• SEO meta tags and headers implemented and tested
• Integration tests verify header and meta tag presence
• Code reviewed and merged

Integrate Sentry for Optional Error and Exception Tracking

• Type: development | Priority: medium | Status: todo
• Depends on (complete these first): 23a45cd9-5624-41a8-b62d-7dbb0e925d82
• Critical path: No
• Description: Add Sentry SDK integration to the Next.js app and API Route Handlers to capture runtime errors and exceptions. Configure DSN and environment variables securely. Provide toggle to enable or disable Sentry in production.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.57h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Sentry SDK captures and reports errors from frontend and backend
• Errors are visible in Sentry dashboard with contextual metadata
• Sentry integration can be toggled via environment variables

Definition of Done:

• Sentry reports errors from deployed app
• Code reviewed and merged
• Documentation updated with Sentry setup and usage

Implement Structured Logging for API Requests and Parse Jobs

• Type: development | Priority: medium | Status: todo
• Depends on (complete these first): 01dee65e-bc3c-4595-adeb-4f154c2464c8
• Critical path: No
• Description: Enhance API Route Handlers and async parse job functions to log structured JSON data including request metadata, parse job status changes, and error details. Logs should be compatible with Vercel and Sentry ingestion.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.29h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• API request logs include method, path, status code, and timing
• Parse job status transitions are logged with timestamps and errors
• Logs are structured JSON and accessible in Vercel and Sentry

Definition of Done:

• Structured logs generated and verified in deployment environment
• Code merged and reviewed
• Logging configuration documented

Implement Upload Rate Limiting Middleware for /api/upload

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Create middleware for /api/upload API Route Handler that enforces a limit of 5 uploads per hour per IP address. Store and update upload counts in the upload_limits database table keyed by SHA-256 hash of uploader IP. Reset counts after one hour from last upload timestamp. Return HTTP 429 Too Many Requests with user-friendly message on limit exceeded.
• Estimate: 8 hours
• Story Points: 5
• Traditional estimate: 8h | AI-accelerated: 5.7h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Uploads exceeding 5 per hour per IP are rejected with HTTP 429
• Upload counts are stored and updated correctly in upload_limits table
• Rate limit resets correctly after one hour
• User-friendly error message is returned on rate limit breach

Definition of Done:

• Rate limiting middleware implemented and integrated
• Unit and integration tests cover limit enforcement and reset
• Code reviewed and merged

Apply Database Schema and Create Tables with Indexes and Constraints

• Type: development | Priority: high | Status: todo
• Depends on (complete these first): 27df936b-5390-42c1-8e9e-44a5bbe5f3f6
• Critical path: No
• Description: Write and apply SQL migration scripts to create portfolios, parse_jobs, and upload_limits tables with all specified columns, constraints, and indexes. Use Supabase CLI or dashboard migration tooling.
• Estimate: 4 hours
• Story Points: 3
• Traditional estimate: 4h | AI-accelerated: 2.1h (1.9x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• All tables created with correct columns, types, and constraints
• Unique indexes on slug and edit_token_jwt exist
• Foreign key constraints and indexes on parse_jobs.portfolio_id are enforced

Definition of Done:

• Migration scripts run successfully without errors
• Tables and indexes verified in Supabase dashboard
• Schema versioning tracked

Implement Visibility Toggle and Soft Delete API Endpoints

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Create PATCH /api/edit/:token/visibility to toggle is_published flag and DELETE /api/edit/:token to soft-delete portfolio by setting deleted_at timestamp. Ensure unpublished portfolios return 404 on public access. Enforce JWT authorization on all edit endpoints.
• Estimate: 8 hours
• Story Points: 5
• Traditional estimate: 8h | AI-accelerated: 5.7h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• PATCH endpoint updates is_published flag correctly
• DELETE endpoint sets deleted_at timestamp without removing record
• Public API returns 404 for unpublished or soft-deleted portfolios
• JWT authorization enforced on all edit endpoints

Definition of Done:

• VisibilityHandler and DeleteHandler implemented and tested
• Public API returns 404 for unpublished/deleted portfolios
• Unit and integration tests cover authorization and flag logic
• Code reviewed and merged

Implement Async PDF Parsing Pipeline with pdf-parse and LLM Wrapper

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Develop a serverless function triggered by parse_jobs creation that fetches the PDF from Vercel Blob Storage, parses it using pdf-parse, then extracts structured portfolio data (summary, experience, skills, education, projects) using a custom LLM wrapper. Update parse_jobs status to 'processing' during work, then 'success' or 'error' with error message. Store parsed data in portfolios table.
• Estimate: 12 hours
• Story Points: 8
• Traditional estimate: 12h | AI-accelerated: 10.9h (1.1x factor)
• AI tools: Claude Code (Anthropic)
• AI category: complex_algorithm (medium confidence)

Acceptance Criteria:

• Async parser fetches PDF from blob storage and processes it
• Extracted data includes summary, experience, skills, education, projects
• Parse job status updates correctly to 'processing' then 'success' or 'error'
• Errors are logged and stored in parse_jobs.error_message

Definition of Done:

• Async parser function implemented and deployed
• Unit and integration tests cover parsing and DB updates
• Error scenarios tested and logged
• Code reviewed and merged

Implement Landing Page UI for Resume PDF Upload

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Create a Next.js App Router page at /upload with a React component named UploadPage. The page includes a file input form accepting a single PDF file, styled with Tailwind CSS for mobile-first responsiveness and WCAG 2.1 AA accessibility compliance. The form submits asynchronously via fetch to POST /api/upload.
• Estimate: 6 hours
• Story Points: 3
• Traditional estimate: 6h | AI-accelerated: 4.3h (1.4x factor)
• AI tools: GitHub Copilot
• AI category: implementation (high confidence)

Acceptance Criteria:

• Landing page accessible at /upload and loads successfully
• File input accepts only one file per submission and restricts to PDFs
• Form submits asynchronously to /api/upload and handles responses
• Page is mobile-friendly and meets WCAG 2.1 AA accessibility standards

Definition of Done:

• UploadPage component implemented and integrated
• Manual accessibility audit passed
• Unit and integration tests cover form behavior
• Code reviewed and merged

Return 404 for Unpublished or Soft Deleted Portfolios in Public API and SSR

• Type: development | Priority: high | Status: todo
• Critical path: No
• Description: Modify /api/portfolio/:slug API handler and SSR page to check portfolios.is_published and deleted_at fields. Return HTTP 404 Not Found if portfolio is unpublished or soft deleted. Add automated tests to verify 404 behavior.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 3.6h (1.4x factor)
• AI tools: Claude Code (Anthropic)
• AI category: implementation (high confidence)

Acceptance Criteria:

• Public API returns 404 if is_published is false or deleted_at is set
• SSR page returns 404 status for unpublished or soft deleted portfolios
• Automated tests verify correct 404 responses

Definition of Done:

• 404 handling implemented in API and SSR
• Tests cover unpublished and soft deleted cases
• Code reviewed and merged

Setup database migration tooling using Supabase CLI and SQL migration scripts

• Type: development | Priority: high | Status: done
• Critical path: No
• Description: Install and configure Supabase CLI for local development, create initial migration scripts for portfolios, parse_jobs, and upload_limits tables as per schema design.
• Estimate: 4 hours
• Story Points: 2
• Traditional estimate: 4h | AI-accelerated: 2h (2x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Supabase CLI installed and configured
• Initial migration scripts created and applied successfully
• Migration files version controlled in repository

Definition of Done:

• Database schema matches PRD and architecture
• Migrations can be applied and rolled back locally
• Migration files committed to GitHub

Configure GitHub Actions workflow for CI with linting, type checking, and tests

• Type: devops | Priority: high | Status: done
• Critical path: No
• Description: Create GitHub Actions YAML workflow to run ESLint, TypeScript type checks, and Jest tests on pull requests and pushes to main branch.
• Estimate: 4 hours
• Story Points: 2
• Traditional estimate: 4h | AI-accelerated: 2.5h (1.6x factor)
• AI tools: Devin (Cognition)
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• CI workflow triggers on pull requests and pushes
• Lint, type check, and tests run and report results
• Failures block merges

Definition of Done:

• CI workflow YAML committed
• Successful runs on GitHub Actions
• Documentation for CI process added

Create GitHub Actions Workflow for Linting, Type Checking, and Testing

• Type: devops | Priority: high | Status: done
• Critical path: No
• Description: Develop a GitHub Actions YAML workflow that runs ESLint, TypeScript type checks, and Jest tests on every push and pull request. Configure caching for dependencies and node_modules to speed up runs.
• Estimate: 5 hours
• Story Points: 3
• Traditional estimate: 5h | AI-accelerated: 2.6h (1.9x factor)
• AI tools: GitHub Copilot
• AI category: boilerplate (high confidence)

Acceptance Criteria:

• Workflow triggers on push and PR events
• Lint, typecheck, and tests run successfully with no errors
• Workflow uses caching to optimize run times

Definition of Done:

• Workflow YAML committed and active
• Successful runs on main branch and PRs
• Documentation updated with CI process