ResuMaxxing — An AI career operating system

ResuMaxxing is a career operating system built for high-velocity resume tailoring, job application tracking, and AI-driven document review. It's a decoupled, client-server architecture designed to move fast without sacrificing the guardrails that matter when AI is touching someone's actual resume. Engineered and shipped end-to-end, solo.

Architecture Overview

The system follows a clean client-server split. The frontend and backend are fully decoupled — they share nothing except an HTTP contract and a JWT token. This means the backend can be scaled, replaced, or load-balanced without touching a line of frontend code, and vice versa.

AI Prompt Engineering & Guardrail Pipeline

Generative AI on a user's resume is a high-stakes operation. A hallucinated skill or fabricated metric on a resume someone submits to an employer is not a minor bug — it's a trust violation. Every model invocation in ResuMaxxing is constrained by a four-layer guardrail system:

• Strict JSON schema enforcement: All generative endpoints use response_format={"type":"json_object"} to guarantee deterministic, parseable responses. The model cannot return freeform text.
• Exact 1-to-1 bullet matching: Bullet customization algorithms extract individual sentences from the raw resume and enforce that the output count matches exactly — no merging bullets, no splitting bullets.
• Anti-hallucination vocabulary constraints: System prompts explicitly prohibit introducing technologies, skills, or metrics not present in the input. Synonym replacement is bound strictly to exact action-verb matches in the target job description.
• Domain isolation: Prompts forbid converting domain-specific achievements across disciplines. Frontend wins stay frontend wins. Backend achievements are not reframed as infrastructure wins.

Enterprise Billing Architecture

The billing system is event-driven and non-blocking by design. Lemon Squeezy sends signed webhook events on subscription changes. The architecture has three hard requirements: instant acknowledgment, idempotency, and no dead-session bugs.

• Instant acknowledgment (<50ms): The webhook endpoint returns HTTP 200 immediately after HMAC-SHA256 signature verification using hmac.compare_digest — constant-time comparison to prevent timing attacks. The actual tier upgrade runs in a FastAPI BackgroundTask to avoid Lemon Squeezy retry timeouts.
• Independent session lifecycle: Background tasks create their own AsyncSessionLocal() database sessions. The HTTP request context is already closed by the time the background task runs — using the request session would cause a dead-session exception.
• Idempotency guard: Event IDs are logged before any tier upgrade. Duplicate webhooks from network retries are detected and silently skipped — no double-crediting of user quotas.

Security & Privacy

• GDPR right-to-be-forgotten: Listens for Clerk user.deleted webhooks verified via Svix cryptographic signatures. On receipt, the system triggers a cascade deletion across all database tables — resume versions, vault snapshots, tracked jobs, activity telemetry — automatically.
• IDOR prevention: Every database query filters by both the record ID and the authenticated user's ID. A malicious user querying another user's resume version or tracked job receives HTTP 404, not 403 — no information leakage about resource existence.
• Content Security Policy: CSP middleware accommodates capacitor://localhost (iOS) and http://localhost (Android) origins with strict frame-ancestors: DENY shielding.

Performance Design

• Decoupled JWKS verification: Auth overhead is eliminated by caching RSA public keys once at boot. Token verification is local and runs in microseconds.
• Non-blocking telemetry: Activity logs (TARGET_ACQUIRED, ZAP_GENERATED) are dispatched asynchronously, preventing database lock contention from slowing primary API responses.
• Async database connections: SQLAlchemy 2.0 with aiomysql uses non-blocking connection pools. Under concurrent load, requests yield to the event loop rather than blocking threads.
• Optimized PDF parsing: Text extraction during resume roasts avoids expensive vector-layout parsing steps that can freeze on complex PDFs.

Rate Limiting Matrix

Feature → Endpoint Mapping

Technology Stack

Notes

The hardest part of this project wasn't the AI integration — it was making the AI integration trustworthy. Anyone can wire up an OpenAI call and get a plausible-looking resume out. Getting it to never fabricate, never merge bullets, never shift a frontend achievement into backend territory — that required treating prompt engineering as a specification problem, not a prompt-tweeking problem. Every guardrail was written before the endpoint was, not after.

The billing architecture also taught me something worth keeping: the moment a webhook returns 200, you've acknowledged receipt. What happens after that is your responsibility, not the payment gateway's. Designing for that separation — instant ack, async work, idempotency at every retry — is what separates a payment integration from a payment incident waiting to happen.