2026 Product Systems Case Study

CareerFit RCR Job Discovery & Document Generation System

A FastAPI-based career support system that validates official job sources, matches profile facts against job requirements, and generates fact-grounded resume and portfolio drafts.

2 modesPublic stateless runtime separated from local SQLite stateful runtime
32 routesAPI boundaries for public lookup, local state, collection, documents, and security admin
83 testsCoverage for security, source policy, scoring, document generation, and stateless persistence rules
Rust sidecarrobots, redirect, official ATS URL verification, and source-refresh support

Live Public Service

A free job page built to help job seekers

https://cleat-hassle-cone.ngrok-free.dev/

CareerFit RCR is a free public webpage for discovering job postings and drafting application materials. The public origin runs in a stateless mode designed so user-entered information is not stored in the server database.

The live server currently reports disabled user-data and document storage through its stateless health check.

FREE ACCESS

Built for job seekers

The service is free to use and focuses on helping applicants find openings faster and organize their experience against job requirements.

VERIFIED SOURCES

Public APIs and reviewed official paths

Job data comes only from public recruitment APIs, Seoul/Busan public jobs OpenAPI, and company career pages individually checked for robots.txt, public URL access, and source status.

NO USER DATA USE

No use of entered user data

Profiles, answers, selected jobs, and generated documents are not collected, processed, sold, or shared with third parties, and are not stored in the server database.

NO BYPASS

No unauthorized or illegal collection path

The system does not use login bypass, CAPTCHA bypass, WAF bypass, paywall bypass, private APIs, proxy rotation, or reused accounts and tokens.

FAIL CLOSED

Unclear sources are excluded

If terms, robots policy, public access, or automated-collection permission is unclear, the source stays in review or fail-closed status and is excluded from recommendation evidence.

TRANSPARENT BOUNDARY

Public-mode API blocking

In public mode, profile, jobs, collect, documents, and admin-like settings APIs are blocked so local operations stay separate from the public demo.

Recommendation Flow Built Around Storage Boundaries

The public demo avoids server-side storage of user profiles, answers, and generated documents. SQLite state and Cloudflare Workers AI settings only open in local stateful mode.

01 · SOURCE Official Job Sources Public recruitment APIs, Seoul/Busan OpenAPI, Greenhouse, Lever, Amazon, NVIDIA, and Korean game-company candidates
02 · POLICY Collection Eligibility robots.txt, public HTTP/HTTPS checks, private-host rejection, and original URL status validation
03 · SCORING Requirement Fit Role, skills, experience, location, education, and credentials scored with profile/job fact references
04 · DOCUMENT Fact-Grounded Drafts Question answers become sentence-state annotated Markdown and export artifacts
05 · SECURITY Public Origin Controls noindex, disabled docs, rate limits, crawler blocks, and admin blocklist controls

Core Work

PRODUCT / RUNTIME

Separated Public and Local Modes

  • Split server-storage-free public flow from local SQLite flow with CAREERFIT_PUBLIC_STATELESS_MODE.
  • Blocked profile, jobs, collect, documents, Cloudflare settings, and Rust collector control APIs in public mode.
  • Reduced the personal-data footprint with browser-state inputs and user-side downloads.
SOURCE / COLLECTOR

Official-Source Collection Policy

  • Unified public recruitment, Seoul/Busan jobs APIs, Greenhouse, Lever, Amazon, and NVIDIA source lookup.
  • Promoted Korean game-company candidates to active targets only after manifest and source-registry validation.
  • Separated URL verification, ATS adapters, and async source-refresh jobs into a Rust sidecar.
SCORING / MATCHING

Requirement-Based Fit Scoring

  • Scored role, skills, experience, location, salary, education, credentials, and company values with input-aware normalization.
  • Exposed required credentials, experience ranges, education, and role-family conflicts as gate reasons.
  • Attached profile/job fact references to score breakdowns and atomic requirements.
DOCUMENT / AI

Fact-Grounded Document Generation

  • Generated resume and portfolio questions from job skills and required conditions.
  • Classified sentences as fact_based, rewritten, needs_confirmation, or improvement_suggestion.
  • Treated Cloudflare Workers AI as optional style assistance behind PII redaction and local fact validation.
SECURITY / OPS

Public-Origin Security Boundaries

  • Disabled /docs, /redoc, and /openapi.json, and served a deny-all robots.txt.
  • Configured CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers.
  • Implemented sliding-window rate limits, heavy-endpoint limits, auto-blocking, and admin-token blocklist APIs.
TEST / ARCHITECTURE

Verifiable Code Boundaries

  • Split HTTP, source, scoring, document, and security ownership across 9 router groups and 28 service modules.
  • Used 83 test functions to verify stateless persistence rules, fail-closed source policy, role taxonomy, and document fact metadata.
  • Kept current-system snapshots and code-boundary docs so implementation state stays distinct from target architecture.

Work Results

Reduced Personal-Data Risk

The public origin can be shared for demos without persisting profile data, answers, or generated document text on the server.

Explainable Recommendations

Scores, gate reasons, evidence coverage, and requirement-match summaries show why a job is recommended or held for review.

Controlled Collection

Official APIs and robots validation come first; private hosts, unclear source evidence, and automated-collection blocks fail closed.

Fact-Safe Drafting

The system avoids inventing experience or metrics and moves weak claims into excluded suggestions or follow-up questions.

Operational Expansion Path

FastAPI keeps product policy and scoring authority while the Rust collector handles network-heavy validation and collection work.

Reproducible Validation

Docker Compose, pytest, ruff, mypy, and stateless health checks define the development and operations verification loop.

Technology & Deliverables

The work includes not only implementation, but also public-demo storage policy, source-verification policy, document evidence, and operations validation commands.

Python FastAPI SQLite Docker Compose Rust Axum Source Registry Requirement Matching Fact Validation Cloudflare Workers AI Security Middleware Pytest
View Full Career →