Tasks

Provision JWT_SECRET as a Kubernetes Secret

Add a validated env config module and remove the hardcoded JWT secret

Add zod request validation to job create, update and list

Add helmet, a JSON body size limit and a stricter CORS setup

Add rate limiting to authentication and write endpoints

Make job acceptance atomic

Harden upload handling with magic-byte validation and random filenames

Add cursor pagination and a hard result cap to the job listing

Add an idempotent index bootstrap using $runCommandRaw

Wrap job completion in an interactive transaction

Log the user out automatically on 401 and route AuthContext through apiFetch

Add route-level code splitting

Set up the i18n layer with a Swedish message catalogue

Build the frontend as static assets instead of shipping the dev server

Harden the backend Dockerfile

Add resource requests, limits and securityContext to all workloads

Enable MongoDB authentication

Add helm lint, manifest validation and image scanning to CI

Capture displayName and a reserved-word-checked handle at registration

Add public profile and profile-update endpoints

Add an avatar upload endpoint

Build the public profile page at /u/:handle

Build the profile edit page

Add the skill resolution service

Add skill autocomplete and user-skill management endpoints

Add the people search endpoint

Build the skill editor on the profile edit page

Build the people search page

Add the HelpRequest model alongside Job

Implement the /api/help-requests endpoints

Write the Job to HelpRequest backfill script

Reduce /api/jobs to a deprecation shim

Cut the frontend over to /api/help-requests

Delete the Job and Transaction models and the /api/jobs shim

Add the Purpose, PurposeItem and PurposeApproval models

Implement purpose creation with an atomic help-request compare-and-set

Implement purpose item add and remove with approval invalidation

Implement dual approval and completion

Rework messaging onto conversations

Build the purpose detail page

Show completed purposes on the public profile

Add geo fields and 2dsphere index creation

Implement the nearby endpoint using $geoNear

Build the standalone map page

Add the Store and Product models

Implement store endpoints

Implement product endpoints with image upload

Support GOODS purposes from products

Build the public store page and the store management UI

Add wallet fields and signature-based wallet linking

Add the Payment model and payment-request creation

Add on-chain verification of submitted transactions

Add wallet connection to the frontend

Build the tip and pay flow on the purpose page

Make price optional end to end

Implement the deterministic signal collector

Implement the rules-based evaluator and event-driven recomputation

Add an LLM evaluator behind a feature flag

Build the trust badge and its explanation

Add reporting and blocking

Add in-app notifications

Add account deletion, data export and an audit log

Publish an OpenAPI specification and update the project docs

Decision: support lending and borrowing items, not only selling

Add a unified search across people, help requests and products

Decision: choose the supported chains and tokens for payments

Snap browser-geolocation coordinates to city precision before storing

Add ESLint and Prettier to backend and frontend

Add .dockerignore files and correct the stale documentation

Add lint and test jobs to the build workflow

Replace the failing default CRA test and rename the frontend package

Enforce participant authorization on message endpoints

Add zod request validation to auth routes

Replace job hard delete with soft delete

Introduce shared user selectors so hashes and emails never leak

Upgrade multer from the EOL 1.x line to 2.x

Add /health and /ready endpoints

Add a global error handler and a 404 handler

Add structured request logging with a request id

Add graceful shutdown on SIGTERM

Harden apiFetch for empty bodies, non-JSON responses and timeouts

Make useAuth throw when used outside its provider

Add ProtectedRoute, a 404 route and an error boundary

Fix the location field bug in CreateJob

Debounce FindJob filtering and move it onto apiFetch

Replace the WorkApp branding and introduce design tokens

Add liveness and readiness probes to both deployments

Stop the deploy workflow from firing on pull-request builds

Document the uploads PVC scaling constraint

Extend the User model with profile fields

Add the Skill and UserSkill models with a seeded starter taxonomy

Add the TrustSnapshot model and trust fields on User