21 changed files with 124 additions and 565 deletions
--- a/.env.example
+++ b/.env.example
@ -1,7 +1,6 @@
 # ---- Database ----
 # Used by apps/api to connect to the postgres service defined in docker-compose.yml.
-# Postgres is not published to the host; all services run inside the compose network.
-DATABASE_URL=postgresql://jobhunt:***@postgres:5432/jobhunt
+DATABASE_URL=postgresql://jobhunt:***@localhost:5433/jobhunt

 # ---- LLM Gateway ----
 # Primary provider (default: GLM-5.2 via ollama-cloud).
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@ -11,12 +11,7 @@ jobs:
  api-tests:
    runs-on: ubuntu-latest
    steps:
-      - name: Checkout repository
-        run: |
-          git init
-          git remote add origin https://x-access-token:${FORGEJO_TOKEN}@srvr.nu/git/hermes/jobhunt-platform.git
-          git fetch --depth 1 origin ${GITHUB_SHA}
-          git checkout FETCH_HEAD
+      - uses: actions/checkout@v4
      - name: Set up Docker
        run: |
          docker --version
@ -29,12 +24,7 @@ jobs:
  package-tests:
    runs-on: ubuntu-latest
    steps:
-      - name: Checkout repository
-        run: |
-          git init
-          git remote add origin https://x-access-token:${FORGEJO_TOKEN}@srvr.nu/git/hermes/jobhunt-platform.git
-          git fetch --depth 1 origin ${GITHUB_SHA}
-          git checkout FETCH_HEAD
+      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
@ -63,27 +53,17 @@ jobs:
          . .venv/bin/activate
          uv pip install -e ".[dev]"
          pytest -q
-      - name: Run matching tests
-        run: |
-          cd packages/matching
-          uv venv
-          . .venv/bin/activate
-          uv pip install -e ".[dev]"
-          pytest -q

  web-tests:
    runs-on: ubuntu-latest
    steps:
-      - name: Checkout repository
-        run: |
-          git init
-          git remote add origin https://x-access-token:${FORGEJO_TOKEN}@srvr.nu/git/hermes/jobhunt-platform.git
-          git fetch --depth 1 origin ${GITHUB_SHA}
-          git checkout FETCH_HEAD
+      - uses: actions/checkout@v4
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "22"
+          cache: npm
+          cache-dependency-path: apps/web/package-lock.json
      - name: Install dependencies
        run: |
          cd apps/web
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@ -1,145 +0,0 @@
-name: Deploy to Production
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Leave as "auto" to bump from latest git tag, or enter a specific version (e.g. v0.1.2)'
-        required: false
-        default: 'auto'
-        type: string
-
-jobs:
-  deploy:
-    name: Build and deploy
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        run: |
-          git init
-          git remote add origin https://x-access-token:${FORGEJO_TOKEN}@srvr.nu/git/hermes/jobhunt-platform.git
-          git fetch --depth 1 origin ${GITHUB_SHA}
-          git checkout FETCH_HEAD
-
-      - name: Resolve version
-        run: |
-          INPUT_VERSION="${{ github.event.inputs.version }}"
-          if [ -z "$INPUT_VERSION" ] || [ "$INPUT_VERSION" = "auto" ]; then
-            git fetch --tags origin
-            LATEST=$(git tag --list 'v*' --sort=-v:refname | head -1)
-            if [ -z "$LATEST" ]; then LATEST="v0.0.0"; fi
-            BASE="${LATEST#v}"
-            MAJOR=$(echo "$BASE" | cut -d. -f1)
-            MINOR=$(echo "$BASE" | cut -d. -f2)
-            PATCH=$(echo "$BASE" | cut -d. -f3)
-            PATCH=$(( ${PATCH:-0} + 1 ))
-            VERSION="v${MAJOR:-0}.${MINOR:-0}.${PATCH}"
-            echo "Latest tag: $LATEST → auto-bumped to $VERSION"
-          else
-            VERSION="$INPUT_VERSION"
-            echo "Using manual version: $VERSION"
-          fi
-          if ! echo "$VERSION" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "ERROR: resolved version '$VERSION' is not valid semver (expected vX.Y.Z)"
-            exit 1
-          fi
-          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
-
-      - name: Tag version
-        run: |
-          git tag -d ${{ env.VERSION }} 2>/dev/null || true
-          git push origin --delete ${{ env.VERSION }} 2>/dev/null || true
-          git tag ${{ env.VERSION }}
-          git push origin ${{ env.VERSION }}
-
-      - name: Write production .env
-        env:
-          LLM_PRIMARY_KEY: ${{ secrets.LLM_PRIMARY_KEY }}
-        run: |
-          {
-            printf 'DATABASE_URL=%s\n' 'postgresql://jobhunt:jobhunt@postgres:5432/jobhunt'
-            printf 'LLM_PRIMARY_BASE_URL=%s\n' 'https://ollama.com/v1'
-            printf 'LLM_PRIMARY_KEY=%s\n' "$LLM_PRIMARY_KEY"
-            printf 'LLM_PRIMARY_MODEL=%s\n' 'glm-5.2'
-            printf 'LLM_CHEAP_MODEL=%s\n' 'glm-5.2'
-            printf 'LLM_STRONG_MODEL=%s\n' 'glm-5.2'
-            printf 'VITE_API_BASE=%s\n' '/api'
-          } > .env
-
-      - name: Build and start production stack
-        run: |
-          docker compose -p jobhunt -f docker-compose.prod.yml down
-          docker compose -p jobhunt -f docker-compose.prod.yml up --build -d
-
-      - name: Health checks with rollback
-        run: |
-          echo "Waiting for services to start..."
-          sleep 15
-
-          API_OK=false
-          for i in 1 2 3 4 5 6 7 8 9 10; do
-            if docker run --rm --network jobhunt_default curlimages/curl:8.5.0 \
-               -sf http://jobhunt-api:8000/api/health > /dev/null; then
-              echo "API is healthy"
-              API_OK=true
-              break
-            fi
-            echo "API check attempt $i failed, retrying in 5s..."
-            sleep 5
-          done
-
-          WEB_OK=false
-          for i in 1 2 3 4 5; do
-            if docker run --rm --network jobhunt_default curlimages/curl:8.5.0 \
-               -sf http://jobhunt-web/ > /dev/null; then
-              echo "Frontend is serving"
-              WEB_OK=true
-              break
-            fi
-            echo "Frontend check attempt $i failed, retrying in 5s..."
-            sleep 5
-          done
-
-          if [ "$API_OK" != "true" ] || [ "$WEB_OK" != "true" ]; then
-            echo ""
-            echo "═══════════════════════════════════════════════════"
-            echo "  HEALTH CHECK FAILED — DIAGNOSTICS"
-            echo "═══════════════════════════════════════════════════"
-            echo ""
-            docker compose -p jobhunt -f docker-compose.prod.yml ps
-            echo ""
-            echo "--- API logs ---"
-            docker logs jobhunt-api 2>&1 | tail -80 || true
-            echo ""
-            echo "--- Postgres logs ---"
-            docker logs jobhunt-postgres 2>&1 | tail -30 || true
-            echo ""
-            echo "═══════════════════════════════════════════════════"
-            echo "  ROLLING BACK DEPLOYMENT"
-            echo "═══════════════════════════════════════════════════"
-            echo ""
-            docker compose -p jobhunt -f docker-compose.prod.yml down
-            echo ""
-            echo "Rolled back. Containers stopped. DB volume preserved."
-            echo "Read API logs above to find the root cause before redeploying."
-            exit 1
-          fi
-
-      - name: Seed demo data (idempotent)
-        run: |
-          docker run --rm --network jobhunt_default curlimages/curl:8.5.0 \
-            -sf -X POST http://jobhunt-api:8000/api/concierge/seed-demo || \
-            echo "WARN: demo seed failed (non-fatal)"
-
-      - name: Print deploy status
-        run: |
-          echo ""
-          echo "═══════════════════════════════════════════════════"
-          echo "  Deployed ${{ env.VERSION }} to production"
-          echo "═══════════════════════════════════════════════════"
-          echo ""
-          docker compose -p jobhunt -f docker-compose.prod.yml ps
-          echo ""
-          echo "Web UI: http://tocke:8085"
-          echo "API:    http://tocke:8000/api/health"
-          echo ""
--- a/apps/api/app/llm.py
+++ b/apps/api/app/llm.py
@ -161,30 +161,6 @@ MOCK_OUTPUTS: dict[str, dict[str, Any]] = {
 }


-def _mock_cv_tailor(prompt: str) -> dict[str, Any]:
-    """Prompt-aware mock tailor: extracts source bullets from the prompt and
-    rephrases them deterministically, so the result always passes the
-    hallucination guard (which requires traceable source overlap)."""
-    import re
-
-    bullets = re.findall(r'"([A-ZÅÄÖ][^"]{20,300})"', prompt)
-    bullets = [b for b in bullets if "{" not in b and ":" not in b][:4]
-    if not bullets:
-        bullets = ["Experienced backend developer focused on reliability"]
-    tailored = []
-    change_log = []
-    for b in bullets[:2]:
-        tailored.append(f"{b} (tailored for this posting)")
-        change_log.append({"action": "rephrased", "detail": f"Emphasized relevance of {b[:60]}"})
-    for b in bullets[2:]:
-        tailored.append(b)
-        change_log.append({"action": "kept", "detail": f"Retained as-is {b[:60]}"})
-    return {
-        "tailored_cv": {"summary": bullets[0][:160], "bullets": tailored},
-        "change_log": change_log,
-    }
-
-
 def run_task(
    task: str,
    prompt: str,
@ -202,8 +178,6 @@ def run_task(
    # Mock mode
    time.sleep(0.01)  # simulate latency
    result = MOCK_OUTPUTS.get(task, {"result": "mock"})
-    if task == "cv_tailor":
-        result = _mock_cv_tailor(prompt)

    # Validate against schema if provided (basic check)
    # In real gateway this would be jsonschema validation
--- a/apps/api/app/main.py
+++ b/apps/api/app/main.py
@ -87,18 +87,6 @@ except ImportError:

 app = FastAPI(title="Jobhunt API", version="0.2.0")

-# Self-hosted single-user app; SPA origin differs from API origin (e.g. web:80 -> api:8000).
-from fastapi.middleware.cors import CORSMiddleware
-
-_cors_origins = os.environ.get("CORS_ORIGINS", "*").split(",")
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=[o.strip() for o in _cors_origins if o.strip()],
-    allow_credentials=False,
-    allow_methods=["*"],
-    allow_headers=["*"],
-)
-

@app.on_event("startup")
 def _startup() -> None:
@ -870,13 +858,7 @@ def postings_fetch(body: PostingsFetchRequest) -> Any:
 # --- v1: Batch Scoring ---

 def _batch_score_internal(application_ids: list[str]) -> list[dict[str, Any]]:
-    """Internal: score multiple applications, return results with red_flags.
-
-    Safety rule (post-bug): batch scoring only touches applications in
-    'discovered' or 'scored' state. Anything further down the pipeline
-    (approved/sent/interviewing/...) keeps its state and stored scores;
-    those rows are returned unchanged with skipped=True.
-    """
+    """Internal: score multiple applications, return results with red_flags."""
    results: list[dict[str, Any]] = []
    for app_id in application_ids:
        app_row = repo_app.get_application(app_id)
@ -886,17 +868,6 @@ def _batch_score_internal(application_ids: list[str]) -> list[dict[str, Any]]:
        if posting is None:
            continue

-        if app_row["state"] not in ("discovered", "scored"):
-            existing = app_row.get("score_rationale") or {}
-            results.append({
-                "application_id": app_id,
-                "score": app_row.get("score"),
-                "rationale": existing,
-                "red_flags": existing.get("red_flags", []),
-                "skipped": True,
-            })
-            continue
-
        result = llm.run_task(
            "score",
            f"Score this posting: {posting['title']} at {posting['company']}",
@ -1151,9 +1122,9 @@ def seed_demo() -> Any:
    profile = repo_profile.update_profile({
        "full_name": "Demo Demosson",
        "email": "demo@example.com",
-        "location": "Malmö",
+        "location": "Malmo",
        "headline": "Software Developer",
-        "summary": "Experienced developer looking for opportunities in Skåne.",
+        "summary": "Experienced developer looking for opportunities in Skane.",
        "languages": [{"code": "sv", "level": "native"}, {"code": "en", "level": "fluent"}],
    })
    if profile is None:
@ -1161,7 +1132,7 @@ def seed_demo() -> Any:

    # Create demo CV sections
    demo_sections = [
-        {"kind": "experience", "title": "Backend Developer", "org": "TechSkåne AB", "bullets": ["Built REST APIs", "Improved performance by 30%"], "tags": ["python", "fastapi"]},
+        {"kind": "experience", "title": "Backend Developer", "org": "TechSkane AB", "bullets": ["Built REST APIs", "Improved performance by 30%"], "tags": ["python", "fastapi"]},
        {"kind": "experience", "title": "Junior Developer", "org": "Lund Software", "bullets": ["Maintained web apps"], "tags": ["javascript"]},
        {"kind": "education", "title": "MSc Computer Science", "org": "Lunds Universitet", "bullets": ["Distributed systems specialization"], "tags": ["algorithms"]},
        {"kind": "skills", "title": "Technical Skills", "bullets": ["Python", "PostgreSQL", "Docker", "FastAPI"], "tags": ["python", "docker"]},
@ -1176,12 +1147,12 @@ def seed_demo() -> Any:

    # -- Create 6 standalone demo postings with varied states --
    demo_postings = [
-        {"company": "Skåne Tech AB", "title": "Senior Python Developer", "location": "Malmö", "url": "https://example.com/af/1", "state": "scored", "score": 85},
+        {"company": "Skane Tech AB", "title": "Senior Python Developer", "location": "Malmo", "url": "https://example.com/af/1", "state": "scored", "score": 85},
        {"company": "Lund Systems", "title": "Fullstack Engineer", "location": "Lund", "url": "https://example.com/af/2", "state": "discovered", "score": None},
        {"company": "Copenhagen Digital", "title": "Backend Developer", "location": "Copenhagen", "url": "https://example.com/af/3", "state": "approved", "score": 70},
        {"company": "Helsingborg IT", "title": "DevOps Engineer", "location": "Helsingborg", "url": "https://example.com/af/4", "state": "sent", "score": 65},
-        {"company": "Malmö Startup", "title": "Software Engineer", "location": "Malmö", "url": "https://example.com/af/5", "state": "rejected", "score": 30},
-        {"company": "Ängelholm Tech", "title": "Data Engineer", "location": "Ängelholm", "url": "https://example.com/af/6", "state": "discovered", "score": None},
+        {"company": "Malmo Startup", "title": "Software Engineer", "location": "Malmo", "url": "https://example.com/af/5", "state": "rejected", "score": 30},
+        {"company": "Angelholm Tech", "title": "Data Engineer", "location": "Angelholm", "url": "https://example.com/af/6", "state": "discovered", "score": None},
    ]

    for dp in demo_postings:
@ -1258,7 +1229,7 @@ def seed_demo() -> Any:
            url=f"https://example.com/af/deadline/{j+1}",
            company=f"Deadline Corp {j+1}",
            title=f"Urgent Developer Role {j+1}",
-            location="Göteborg",
+            location="Goteborg",
            description="Urgent hire for a developer with deadline approaching.",
            raw={},
        )
@ -1290,7 +1261,7 @@ def seed_demo() -> Any:
        url="https://example.com/af/interview/1",
        company="Festina Digital AB",
        title="Full Stack Developer",
-        location="Malmö",
+        location="Malmo",
        description="Full stack developer with React, Python, and cloud experience.",
        raw={},
    )
@ -1398,8 +1369,8 @@ def seed_demo() -> Any:
        create_email_suggestion(
            application_id=interviewing_app_id,
            mailbox_from="hr@festina-demo.se",
-            subject="Fråga om din erfarenhet",
-            snippet="Vi har några frågor om din bakgrund inom Python...",
+            subject="Fraga om din erfarenhet",
+            snippet="Vi har nagra fragor om din bakgrund inom Python...",
            classification="question",
            state_proposal=None,
            received_at=datetime.now(timezone.utc) - timedelta(hours=1),
--- a/apps/api/tests/test_v11b_wb1.py
+++ b/apps/api/tests/test_v11b_wb1.py
@ -398,35 +398,36 @@ class TestTailorCvHappyPath:
 # ========================================================================

 class TestTailorCvHallucinationGuard:
-    def test_hallucination_rejection_502(self, client, monkeypatch):
-        """When the tailor output has bullets with no source mapping, return 502."""
-        import app.llm as llm_mod
-
+    def test_hallucination_rejection_502(self, client):
+        """When mock returns bullet with no source mapping, return 502."""
        app_id = _create_app_with_profile_and_sections(client)
-        fabricated = {
-            "tailored_cv": {
-                "summary": "Developer",
-                "skills": ["Python"],
-                "experience": [
-                    {
-                        "company": "FakeCorp",
-                        "role": "Fake Role",
-                        "bullets": [
-                            "Completely fabricated achievement that has no overlap with any source bullet xyzqwerty",
-                        ],
-                    },
-                ],
-            },
-            "change_log": [{"action": "invented", "detail": "Made up a bullet"}],
-        }
-        monkeypatch.setattr(
-            llm_mod, "run_task",
-            lambda task, prompt, *a, **k: fabricated,
-        )
-        resp = client.post(f"/api/applications/{app_id}/tailor-cv")
-        assert resp.status_code == 502
-        detail = resp.json()["detail"]
-        assert "hallucination_guard" in str(detail)
+
+        # Patch the mock to return a fabricated bullet
+        import app.llm as llm_mod
+        original = llm_mod.MOCK_OUTPUTS.get("cv_tailor", {}).copy()
+        try:
+            llm_mod.MOCK_OUTPUTS["cv_tailor"] = {
+                "tailored_cv": {
+                    "summary": "Developer",
+                    "skills": ["Python"],
+                    "experience": [
+                        {
+                            "company": "FakeCorp",
+                            "role": "Fake Role",
+                            "bullets": [
+                                "Completely fabricated achievement that has no overlap with any source bullet xyzqwerty",
+                            ],
+                        },
+                    ],
+                },
+                "change_log": [{"action": "invented", "detail": "Made up a bullet"}],
+            }
+            resp = client.post(f"/api/applications/{app_id}/tailor-cv")
+            assert resp.status_code == 502
+            detail = resp.json()["detail"]
+            assert "hallucination_guard" in str(detail)
+        finally:
+            llm_mod.MOCK_OUTPUTS["cv_tailor"] = original

    def test_hallucination_rejection_with_empty_source_bullets(self, client):
        """When there are no source bullets, hallucination guard is not triggered (no source to map to)."""
@ -455,36 +456,37 @@ class TestTailorCvHallucinationGuard:
        # Should succeed since source_bullets is empty -> guard not triggered
        assert resp.status_code == 200

-    def test_hallucination_rejection_preserves_existing_output(self, client, monkeypatch):
+    def test_hallucination_rejection_preserves_existing_output(self, client):
        """After a 502 hallucination rejection, a subsequent valid call works."""
-        import app.llm as llm_mod
-
        app_id = _create_app_with_profile_and_sections(client)
-        fabricated = {
-            "tailored_cv": {
-                "summary": "Dev",
-                "skills": ["Python"],
-                "experience": [
-                    {
-                        "company": "X",
-                        "role": "X",
-                        "bullets": ["Fabricated xyzqwerty zzz new content"],
-                    },
-                ],
-            },
-            "change_log": [],
-        }
-        with monkeypatch.context() as mp:
-            mp.setattr(
-                llm_mod, "run_task",
-                lambda task, prompt, *a, **k: fabricated,
-            )
+
+        # First: trigger hallucination
+        import app.llm as llm_mod
+        original = llm_mod.MOCK_OUTPUTS.get("cv_tailor", {}).copy()
+        try:
+            llm_mod.MOCK_OUTPUTS["cv_tailor"] = {
+                "tailored_cv": {
+                    "summary": "Dev",
+                    "skills": ["Python"],
+                    "experience": [
+                        {
+                            "company": "X",
+                            "role": "X",
+                            "bullets": ["Fabricated xyzqwerty zzz new content"],
+                        },
+                    ],
+                },
+                "change_log": [],
+            }
            resp1 = client.post(f"/api/applications/{app_id}/tailor-cv")
            assert resp1.status_code == 502

-        # Default prompt-aware mock is guard-safe -> succeeds
-        resp2 = client.post(f"/api/applications/{app_id}/tailor-cv")
-        assert resp2.status_code == 200
+            # Restore and retry
+            llm_mod.MOCK_OUTPUTS["cv_tailor"] = original
+            resp2 = client.post(f"/api/applications/{app_id}/tailor-cv")
+            assert resp2.status_code == 200
+        finally:
+            llm_mod.MOCK_OUTPUTS["cv_tailor"] = original


 # ========================================================================
--- a/apps/web/Dockerfile
+++ b/apps/web/Dockerfile
@ -1,14 +0,0 @@
-# Web production image: build the SPA, serve via nginx with SPA fallback
-FROM node:22-alpine AS build
-WORKDIR /w
-ARG VITE_API_BASE=http://api:8000/api
-ENV VITE_API_BASE=$VITE_API_BASE
-COPY apps/web/package.json apps/web/package-lock.json ./
-RUN npm ci --no-audit --no-fund
-COPY apps/web ./
-RUN npm run build
-
-FROM nginx:1.27-alpine
-COPY apps/web/nginx.conf /etc/nginx/conf.d/default.conf
-COPY --from=build /w/dist /usr/share/nginx/html
-EXPOSE 80
--- a/apps/web/nginx.conf
+++ b/apps/web/nginx.conf
@ -1,15 +0,0 @@
-server {
-    listen 80;
-    server_name _;
-    root /usr/share/nginx/html;
-    index index.html;
-
-    location /api/ {
-        proxy_pass http://api:8000/api/;
-        proxy_set_header Host $host;
-    }
-
-    location / {
-        try_files $uri $uri/ /index.html;
-    }
-}
--- a/apps/web/src/types/index.ts
+++ b/apps/web/src/types/index.ts
@ -66,10 +66,8 @@ export interface Application {
  notes: string
  state_changed_at: string
  created_at: string
-  // joined posting info (flat fields from GET /applications)
-  company?: string | null
-  title?: string | null
-  location?: string | null
+  // joined posting info (from GET /applications)
+  posting?: JobPosting
 }

 export type ArtifactKind = 'cv' | 'cover_letter' | 'email' | 'other'
@ -264,21 +262,14 @@ export interface Cluster {
  postings: ClusterPosting[]
 }

-export interface TailorKeywordCoverage {
-  ratio: number
-  matched: string[]
-  missing: string[]
-}
-
 export interface TailorChangeLogEntry {
-  action?: string
-  section?: string
-  detail?: string
-  change?: string
+  section: string
+  change: string
+  bullet_id: string
 }

 export interface TailorCvResponse {
  artifact_id: string
  change_log: TailorChangeLogEntry[]
-  keyword_coverage: TailorKeywordCoverage
+  keyword_coverage: number
 }
--- a/apps/web/src/views/ApplicationDetail.tailor.test.ts
+++ b/apps/web/src/views/ApplicationDetail.tailor.test.ts
@ -34,9 +34,11 @@ function makeApp(): Application {
    notes: '',
    state_changed_at: '2026-01-01T00:00:00Z',
    created_at: '2026-01-01T00:00:00Z',
-    company: 'Acme',
-    title: 'Engineer',
-    location: 'Remote'
+    posting: {
+      id: 'j-1', source: 'manual_url', external_id: null, url: 'http://x',
+      company: 'Acme', title: 'Engineer', location: 'Remote', description: '',
+      raw: {}, fetched_at: '2026-01-01T00:00:00Z'
+    }
  }
 }

@ -58,10 +60,10 @@ function makeTailorResult(): TailorCvResponse {
  return {
    artifact_id: 'art-tailor-1',
    change_log: [
-      { action: 'experience', detail: 'Reordered to highlight Python backend work' },
-      { action: 'skills', detail: 'Moved Docker and Kubernetes higher' }
+      { section: 'experience', change: 'Reordered to highlight Python backend work', bullet_id: 'b-1' },
+      { section: 'skills', change: 'Moved Docker and Kubernetes higher', bullet_id: 'b-5' }
    ],
-    keyword_coverage: { ratio: 0.75, matched: ['python', 'docker'], missing: ['kubernetes'] }
+    keyword_coverage: 0.75
  }
 }

--- a/apps/web/src/views/ApplicationDetail.test.ts
+++ b/apps/web/src/views/ApplicationDetail.test.ts
@ -34,9 +34,11 @@ function makeApp(): Application {
    notes: '',
    state_changed_at: '2026-01-01T00:00:00Z',
    created_at: '2026-01-01T00:00:00Z',
-    company: 'Acme',
-    title: 'Engineer',
-    location: 'Remote'
+    posting: {
+      id: 'j-1', source: 'manual_url', external_id: null, url: 'http://x',
+      company: 'Acme', title: 'Engineer', location: 'Remote', description: '',
+      raw: {}, fetched_at: '2026-01-01T00:00:00Z'
+    }
  }
 }

--- a/apps/web/src/views/ApplicationDetail.vue
+++ b/apps/web/src/views/ApplicationDetail.vue
@ -52,22 +52,17 @@ const severityClass: Record<string, string> = {
  low: 'bg-blue-50 border-blue-200'
 }

-const coverageRatio = computed(() => {
-  if (!tailorResult.value) return 0
-  const kc = tailorResult.value.keyword_coverage
-  return typeof kc === 'object' && kc !== null ? (kc.ratio ?? 0) : Number(kc) || 0
-})
-
 const coverageColor = computed(() => {
  if (!tailorResult.value) return 'bg-gray-300'
-  const c = coverageRatio.value
+  const c = tailorResult.value.keyword_coverage
  if (c >= 0.7) return 'bg-green-500'
  if (c >= 0.4) return 'bg-yellow-500'
  return 'bg-red-500'
 })

 const coveragePercent = computed(() => {
-  return Math.round(coverageRatio.value * 100)
+  if (!tailorResult.value) return 0
+  return Math.round(tailorResult.value.keyword_coverage * 100)
 })

 const downloadUrl = computed(() => {
@ -145,7 +140,7 @@ async function sendOutbox() {
  if (!approval.value || !canSend.value) return
  sending.value = true
  try {
-    await api.outboxSend(approval.value.id, { to: application.value?.company ?? '' })
+    await api.outboxSend(approval.value.id, { to: application.value?.posting?.company ?? '' })
    toast.push('Sent successfully', 'success')
  } catch (err) {
    let msg = 'Send failed'
@ -200,8 +195,8 @@ onMounted(loadData)
    <template v-if="!loading && application">
      <!-- Posting info -->
      <section class="bg-white rounded-lg border border-gray-200 p-4">
-        <div class="font-semibold text-lg">{{ application.company ?? 'Unknown' }}</div>
-        <div class="text-gray-600">{{ application.title ?? 'No title' }}</div>
+        <div class="font-semibold text-lg">{{ application.posting?.company ?? 'Unknown' }}</div>
+        <div class="text-gray-600">{{ application.posting?.title ?? 'No title' }}</div>
        <div class="text-sm text-gray-500 mt-1">
          State: <span class="capitalize font-medium">{{ application.state }}</span>
          <span v-if="application.score != null" class="ml-3">Score: {{ application.score }}</span>
@ -250,8 +245,8 @@ onMounted(loadData)
                :key="i"
                class="border-b border-gray-100 py-1"
              >
-                <span class="font-medium text-gray-700">{{ entry.action || entry.section || 'change' }}:</span>
-                <span class="text-gray-600 ml-1">{{ entry.detail || entry.change }}</span>
+                <span class="font-medium text-gray-700">{{ entry.section }}:</span>
+                <span class="text-gray-600 ml-1">{{ entry.change }}</span>
              </li>
            </ul>
          </div>
--- a/apps/web/src/views/Applications.badges.test.ts
+++ b/apps/web/src/views/Applications.badges.test.ts
@ -30,9 +30,11 @@ function makeApp(id: string, state: string, company: string): Application {
    notes: '',
    state_changed_at: '2026-01-01T00:00:00Z',
    created_at: '2026-01-01T00:00:00Z',
-    company,
-    title: 'Engineer',
-    location: 'Remote'
+    posting: {
+      id: 'j-' + id, source: 'manual_url', external_id: null, url: 'http://x',
+      company, title: 'Engineer', location: 'Remote', description: '',
+      raw: {}, fetched_at: '2026-01-01T00:00:00Z'
+    }
  }
 }

--- a/apps/web/src/views/Applications.test.ts
+++ b/apps/web/src/views/Applications.test.ts
@ -31,9 +31,11 @@ function fixture(): Application[] {
      notes: '',
      state_changed_at: '2026-01-01T00:00:00Z',
      created_at: '2026-01-01T00:00:00Z',
-      company: 'Acme',
-      title: 'Engineer',
-      location: 'Remote'
+      posting: {
+        id: 'j-1', source: 'manual_url', external_id: null, url: 'http://x',
+        company: 'Acme', title: 'Engineer', location: 'Remote', description: '',
+        raw: {}, fetched_at: '2026-01-01T00:00:00Z'
+      }
    },
    {
      id: 'app-2',
@ -44,9 +46,11 @@ function fixture(): Application[] {
      notes: '',
      state_changed_at: '2026-01-01T00:00:00Z',
      created_at: '2026-01-01T00:00:00Z',
-      company: 'Globex',
-      title: 'Manager',
-      location: 'Malmo'
+      posting: {
+        id: 'j-2', source: 'linkedin', external_id: null, url: 'http://y',
+        company: 'Globex', title: 'Manager', location: 'Malmo', description: '',
+        raw: {}, fetched_at: '2026-01-01T00:00:00Z'
+      }
    }
  ]
 }
--- a/apps/web/src/views/Applications.vue
+++ b/apps/web/src/views/Applications.vue
@ -41,10 +41,7 @@ function hasRedFlags(app: Application): boolean {
 }

 function redFlagsFor(app: Application): string[] {
-  const fromBatch = redFlagsMap.value[app.id]
-  if (fromBatch) return fromBatch
-  const stored = (app.score_rationale as { red_flags?: string[] } | null)?.red_flags
-  return stored ?? []
+  return redFlagsMap.value[app.id] ?? []
 }

 function hasNudge(app: Application): boolean {
@ -56,11 +53,7 @@ async function loadApplications() {
    applications.value = await api.getApplications()
    // Load red flags via batch scoring and nudges via today endpoint
    const [batchResult, todayResult] = await Promise.allSettled([
-      api.batchScore(
-        applications.value
-          .filter((a) => a.state === 'discovered' || a.state === 'scored')
-          .map((a) => a.id)
-      ),
+      api.batchScore(applications.value.map((a) => a.id)),
      api.getToday()
    ])
    if (batchResult.status === 'fulfilled') {
@ -171,9 +164,9 @@ onMounted(loadApplications)
                class="inline-block w-2 h-2 rounded-full bg-orange-500 flex-shrink-0"
                title="Follow-up nudge pending"
              ></span>
-              <div class="font-medium text-sm truncate">{{ app.company ?? 'Unknown' }}</div>
+              <div class="font-medium text-sm truncate">{{ app.posting?.company ?? 'Unknown' }}</div>
            </div>
-            <div class="text-xs text-gray-500 truncate">{{ app.title ?? 'No title' }}</div>
+            <div class="text-xs text-gray-500 truncate">{{ app.posting?.title ?? 'No title' }}</div>
            <div v-if="app.score != null" class="text-xs text-green-700 mt-1">
              Score: {{ app.score }}
            </div>
--- a/apps/web/src/views/Research.vue
+++ b/apps/web/src/views/Research.vue
@ -153,7 +153,7 @@ onMounted(loadPostings)

    <!-- Fetch form (Arbetsformedlingen connector) -->
    <section class="bg-white rounded-lg border border-gray-200 p-4 space-y-3">
-      <h2 class="font-semibold">Fetch from Arbetsförmedlingen</h2>
+      <h2 class="font-semibold">Fetch from Arbetsformedlingen</h2>
      <div class="flex gap-2">
        <input
          v-model="fetchQuery"
--- a/apps/web/src/views/Welcome.vue
+++ b/apps/web/src/views/Welcome.vue
@ -223,7 +223,7 @@ function prev() {
    <div v-if="step === 2" class="bg-white rounded-lg border border-gray-200 p-6 space-y-4">
      <h2 class="font-semibold text-lg">Fetch Job Postings</h2>
      <p class="text-sm text-gray-600">
-        Search for job postings from the Arbetsförmedlingen connector. New postings will be added to your applications.
+        Search for job postings from the Arbetsformedlingen connector. New postings will be added to your applications.
      </p>
      <div class="space-y-2">
        <label class="block">
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@ -1,57 +0,0 @@
-# Production stack for jobhunt-platform.
-# Built and started by .forgejo/workflows/deploy.yml on the host docker daemon.
-# Web UI is published on http://<host>:8085, API on :8000. Postgres is internal only.
-services:
-  postgres:
-    image: postgres:16
-    container_name: jobhunt-postgres
-    environment:
-      POSTGRES_USER: jobhunt
-      POSTGRES_PASSWORD: jobhunt
-      POSTGRES_DB: jobhunt
-    volumes:
-      - jobhunt_pgdata:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U jobhunt -d jobhunt"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    restart: unless-stopped
-
-  api:
-    build:
-      context: .
-      dockerfile: apps/api/Dockerfile.test
-    image: jobhunt-api
-    container_name: jobhunt-api
-    entrypoint: uvicorn app.main:app --host 0.0.0.0 --port 8000
-    env_file: .env
-    environment:
-      DATABASE_URL: postgresql://jobhunt:jobhunt@postgres:5432/jobhunt
-    working_dir: /app/apps/api
-    ports:
-      - "8000:8000"
-    depends_on:
-      postgres:
-        condition: service_healthy
-    restart: unless-stopped
-
-  web:
-    build:
-      context: .
-      dockerfile: apps/web/Dockerfile
-      args:
-        # Baked into the SPA at build time. Relative /api goes through the
-        # nginx proxy in apps/web/nginx.conf -> http://api:8000/api/
-        VITE_API_BASE: /api
-    image: jobhunt-web
-    container_name: jobhunt-web
-    ports:
-      - "8085:80"
-    depends_on:
-      - api
-    restart: unless-stopped
-
-volumes:
-  jobhunt_pgdata:
-    name: jobhunt_pgdata
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -8,8 +8,8 @@ services:
      POSTGRES_USER: jobhunt
      POSTGRES_PASSWORD: jobhunt
      POSTGRES_DB: jobhunt
-    # No host port publishing: CI/tests run inside the compose network, and on
-    # this host 5433 is already taken by bilhej-postgres-prod.
+    ports:
+      - "5433:5432"
    volumes:
      - jobhunt_pgdata:/var/lib/postgresql/data
    healthcheck:
@ -29,42 +29,6 @@ services:
        condition: service_healthy
    restart: "no"

-  api:
-    build:
-      context: .
-      dockerfile: apps/api/Dockerfile.test
-    image: jobhunt-platform-api-test
-    entrypoint: uvicorn app.main:app --host 0.0.0.0 --port 8000
-    environment:
-      DATABASE_URL: postgresql://jobhunt:jobhunt@postgres:5432/jobhunt
-    working_dir: /app/apps/api
-    depends_on:
-      postgres:
-        condition: service_healthy
-    restart: "no"
-
-  web:
-    build:
-      context: .
-      dockerfile: apps/web/Dockerfile
-      args:
-        VITE_API_BASE: http://api:8000/api
-    depends_on:
-      - api
-    restart: "no"
-
-  shots:
-    build:
-      context: .
-      dockerfile: scripts/Dockerfile.shots
-    volumes:
-      - shots_out:/out
-    depends_on:
-      - api
-      - web
-    restart: "no"
-
 volumes:
  jobhunt_pgdata:
    name: jobhunt_pgdata
-  shots_out:
--- a/scripts/Dockerfile.shots
+++ b/scripts/Dockerfile.shots
@ -1,5 +0,0 @@
-FROM mcr.microsoft.com/playwright/python:v1.55.0-jammy
-WORKDIR /shots
-RUN pip install --no-cache-dir playwright==1.55.0
-COPY scripts/screenshots.py ./
-CMD ["python", "screenshots.py"]
--- a/scripts/screenshots.py
+++ b/scripts/screenshots.py
@ -1,84 +0,0 @@
-"""Screenshot runner: drives the seed demo UI and saves PNGs to /out.
-
-Runs inside the compose network; browser resolves 'web' and 'api' directly.
-"""
-import json
-import sys
-import time
-import urllib.request
-
-from playwright.sync_api import sync_playwright
-
-BASE = "http://web"
-API = "http://api:8000/api"
-OUT = "/out"
-
-
-def api(method, path, body=None):
-    req = urllib.request.Request(
-        API + path,
-        data=json.dumps(body).encode() if body else None,
-        method=method,
-        headers={"Content-Type": "application/json"},
-    )
-    with urllib.request.urlopen(req, timeout=30) as r:
-        return json.loads(r.read())
-
-
-def main():
-    # Idempotent: ensures full demo dataset exists
-    seed = api("POST", "/concierge/seed-demo")
-    print("seed:", json.dumps(seed)[:200])
-
-    apps = api("GET", "/applications")
-    interview = next((a for a in apps if a["state"] == "interviewing"), apps[0])
-    detail_id = interview["id"]
-    print("detail id:", detail_id)
-
-    shots = [
-        ("welcome", "/", {}),          # first-run wizard may redirect away; force below
-        ("welcome", "/welcome", {}),
-        ("today", "/today", {}),
-        ("cv", "/cv", {}),
-        ("research", "/research", {}),
-        ("applications", "/applications", {}),
-        ("detail", f"/applications/{detail_id}", {}),
-    ]
-
-    with sync_playwright() as p:
-        browser = p.chromium.launch(args=["--disable-dev-shm-usage"])
-        page = browser.new_page(viewport={"width": 1440, "height": 900},
-                                device_scale_factor=2)
-        for name, path, _opts in shots[1:]:  # skip the "/" duplicate
-            try:
-                page.goto(BASE + path, wait_until="networkidle", timeout=30000)
-                page.wait_for_timeout(1200)
-                # close possible wizard redirect back
-                if name != "welcome" and page.url.endswith("/welcome"):
-                    page.goto(BASE + path, wait_until="networkidle", timeout=30000)
-                    page.wait_for_timeout(800)
-                page.screenshot(path=f"{OUT}/{name}.png")
-                print("shot:", name, "<-", page.url)
-            except Exception as e:
-                print("FAILED:", name, type(e).__name__, str(e)[:150])
-
-        # Interaction shot: open the Tailor CV panel on an approved application
-        approved = next((a for a in apps if a["state"] in ("approved", "interviewing")), apps[0])
-        try:
-            page.goto(f"{BASE}/applications/{approved['id']}", wait_until="networkidle", timeout=30000)
-            page.wait_for_timeout(1000)
-            btn = page.locator('[data-testid="tailor-cv-btn"]')
-            btn.click(timeout=8000)
-            page.wait_for_selector('[data-testid="tailor-panel"]', timeout=20000)
-            page.wait_for_timeout(800)
-            page.screenshot(path=f"{OUT}/detail-tailor.png")
-            print("shot: detail-tailor")
-        except Exception as e:
-            print("FAILED: detail-tailor", type(e).__name__, str(e)[:150])
-
-        browser.close()
-    print("DONE")
-
-
-if __name__ == "__main__":
-    sys.exit(main())