Case Study · 2026

AI-Powered Career Operating System

CommandFlowOS combines verified job intelligence, resume optimization, recruiter CRM workflows, outcome learning, and safe automation into one career operations platform — operated entirely under a manual-review workflow.

30+
Verified Companies
11-factor
Trust Scoring
25/day
AI Generation Cap
100%
Manual Review

Prefer a guided walkthrough? Use ←/→ to navigate, Esc to exit.

System Architecture

A layered, audit-friendly platform

A secure AI-powered recruiting operations platform combining ATS ingestion, company verification, resume intelligence, outcome learning, and executive analytics.

End-to-end flow

ATS Sources
Ingestion
Filtering
Trust Scoring
Resume Matching
Packet Generation
Review / Submit
Outcome Tracking
Learning Loop
Recommendations

Public Presentation Layer

Recruiter-facing, no auth, no production data

Public SandboxCase StudyRecruiter DemoPortfolio Website

Private Application Layer

Authenticated operator workspace

Authenticated DashboardSmart Apply Control CenterManual Review QueueSafe Auto-Submit DashboardExecutive Command Center

Intelligence Layer

Scoring, learning, and resume strategy

Resume Variant OptimizerOutcome Learning EngineInterview Probability ScoringCompany Trust ScoringSalary EnrichmentCareer Realism Scoring

Automation & Workflow Layer

Pipeline orchestration with human-in-the-loop

ATS IngestionApplication Packet BuilderRecruiter CRM PipelineFollow-Up SchedulerDry Run Auto-SubmitSafety Block Routing

Data & Security Layer

User-owned data with row-level isolation

Supabase AuthRow Level SecurityPostgreSQL TablesUser-Owned DataAudit LogsMonitoring Logs

AI + Notification Layer

Generative drafting and operator alerts

OpenAI Resume / Packet GenerationTwilio SMS AlertsMonitoring AlertsWeekly Recommendations

Safety & Compliance Layer

Hard-coded guardrails — never bypassed

No CAPTCHA bypassNo MFA bypassNo login-wall evasionNo stealth automationManual Review fallbackEmergency pauseDaily caps enforced

Built-in guardrails & metrics

11-factor trust scoring
14-day freshness filter
30-day duplicate guard
5/day Auto Review cap
3/day Safe Auto-Submit cap
25/day AI generation cap
Outcome-based recalibration

No private data, recruiter PII, or API keys are referenced in this diagram.

01

Executive Summary

Job seekers in 2026 face an asymmetric market: thousands of remote postings, opaque ATS filters, inconsistent salary disclosure, and a flood of low-trust listings. This platform inverts the workflow — instead of mass applying, it ingests verified roles from supported ATS platforms, scores company trust, generates tailored application packets, and surfaces only high-probability matches to a single operator for manual review.

Verified

Only roles from Greenhouse, Lever, Ashby, Breezy. No login-required, no Workday/Taleo/SAP.

AI-Assisted

Resume tailoring, cover letters, talking points — all human-reviewed before any submission.

Outcome-Driven

Learning loop tracks response rates by resume version, role category, and ATS.

02

Problem Statement

Signal-to-noise collapse

Job boards surface thousands of roles per day, most without salary, many from unverified or shell companies.

ATS opacity

Each ATS scores resumes differently. Generic resumes underperform without keyword alignment per posting.

Wasted preparation cost

Hours spent tailoring applications for low-trust or low-fit companies erodes interview-ready energy.

No feedback loop

Most applicants never learn which resume version, role category, or company type actually converts.

03

Solution Architecture

A modular intelligence pipeline. Every stage is observable, rate-limited, and ownership-checked.

Lovable Frontend
TanStack · React 19
Server Functions
Type-safe RPC
ATS Ingestion
GH · Lever · Ashby · Breezy
Packet Engine
Resume · CL · Talking points
Analytics Engine
Learning loop
Supabase Postgres
RLS on every table
OpenAI GPT-4o-mini
Capped + telemetered
Lovable Frontend

React + TanStack Start, SSR-ready routes, type-safe RPC.

Supabase Backend

Postgres with RLS on every table, auth, realtime, storage.

OpenAI Integration

GPT-4o-mini for generation, per-user daily caps, full usage telemetry.

ATS Ingestion Layer

Greenhouse / Lever / Ashby / Breezy adapters with platform detection.

Analytics Engine

Response-rate learning loop, cost tracking, recommendation surfacing.

Packet Generation

Resume + cover + talking points + portfolio match per role.

04

ATS Verification Engine

Every career URL is parsed and platform-detected before ingestion. Greenhouse, Lever, Ashby, and Breezy are supported. Workday, Taleo, SAP, iCIMS, login-required, CAPTCHA, and MFA-gated postings are rejected at the ingest layer — they never enter the queue.

Supported ATS platforms4
Auto-rejected platforms5+
URL-pattern verified100%
05

Company Trust Scoring System

An 11-factor model evaluates every company before its roles surface to review.

Domain age
ATS verified
Funding signal
Headcount range
Glassdoor presence
LinkedIn footprint
Press mentions
Salary disclosure
Remote policy
Hiring velocity
Repeat-posting pattern
06

Resume Intelligence Engine

Each high-probability role generates a tailored resume version, ATS keyword summary, and quality score. Daily limits protect both cost and decision quality. Every output is versioned so the analytics engine can attribute response rates back to specific resume variants.

Resume generation cap25/day
Cover letter cap25/day
Keyword alignmentPer-role
07

Interview Probability Engine

A multi-signal scorer projects interview likelihood per role. Confidence is surfaced as a label, not a false-precision number.

Strong Match
Good Match
Stretch
Low Probability
08

Analytics & Learning Loop

14-day Response Trend
Indexed Insights
Response rate by resume version
Response rate by role category
Response rate by company type
Interview rate by quality score
Avg days to first response
09

Security & Compliance

RLS-secured database

Row-level security on every table. Every query verifies user_id === auth.uid().

HIBP password protection

Leaked-password protection enabled at the auth layer.

Race-proof writes

Unique (user_id, dedupe_hash) index prevents duplicate generations under concurrency.

Per-user rate limits

Daily caps on AI generations, surfaced live in Settings and Resume Studio.

10

Manual Review Safety System

Every application requires explicit human approval.

  • No auto-submit. No browser automation. No headless agents.
  • 30-day reapply guard prevents duplicate outreach to the same role.
  • Manual submission logging powers the analytics learning loop.
  • Salary-missing roles route to Manual Review instead of auto-rejection.
11

Tech Stack

TanStack Start
React 19
Supabase Postgres
Supabase Auth + RLS
OpenAI GPT-4o-mini
TanStack Query
Tailwind v4
Server Functions
12

Product Screenshots

13

Key Metrics

25
AI generations / day
30+
Verified companies seeded
11
Trust scoring factors
14d
Response trend window
4
ATS platforms supported
30d
Reapply guard window
100%
RLS coverage
0
Auto-submitted apps
14

Challenges Solved · Product Decisions

How do you prevent duplicate AI generations under concurrency?

Unique index on (user_id, dedupe_hash) plus graceful duplicate-error handling at the server-function layer.

How do you keep AI cost predictable?

Hard daily caps per generation type (25 resumes, 25 cover letters), live remaining counters, and per-call cost telemetry in openai_usage.

Why manual review only?

Auto-submit erodes signal quality and risks ToS violations on every supported ATS. Manual approval keeps the operator in the loop and makes the learning loop trustworthy.

How do you handle missing salary data?

Mark salary_estimated = true and route to Manual Review rather than reject — many high-quality roles omit salary at the listing stage.

15

Lessons Learned

Constraints raise quality

Capping daily generations forced sharper triage and produced higher response rates than uncapped iteration.

Trust scoring beats volume

A small number of high-trust applications outperformed broad outreach across every measured cohort.

Versioning unlocks learning

Attributing responses to specific resume versions made the recommendations panel actually actionable.

Manual review is a feature

Operators valued the human checkpoint more than projected throughput gains from automation.

16

Future Roadmap

Next
Recruiter relationship CRM

Track conversations and warm intros tied to specific applications.

Q3
Portfolio-to-role matching v2

Embed-based similarity between portfolio projects and JD requirements.

Q4
Interview prep workspace

Per-company question libraries, recorded practice, recruiter-facing one-pagers.

Later
Multi-operator workspaces

Coach + candidate shared review with audit trail.

16

60-Second Demo Script

"This platform scans verified remote job sources, filters unsupported ATS systems, scores company trust and interview probability, generates tailored application packets, and tracks outcomes through a recruiter CRM pipeline."

Read aloud in ~25s. Pair with the /demo guided walkthrough for a full 60-second story.

17

Metrics Proof — Real Numbers From Testing

Operational thresholds from the live system, not aspirational targets.

1,441
Raw jobs tested
460
Jobs imported after filtering
5.4%
Conservative Auto Review pass rate
11-factor
Trust scoring model
14 days
Freshness filter window
30 days
Duplicate company guard
25/day
AI generation cap
5/day
Auto Review cap
18

Responsible Product Design — What This Platform Will Not Do

Many "apply automation" tools cut corners that violate ATS terms, expose users to bans, or harm the labor market. This platform intentionally refuses several patterns — these are product decisions, not missing features.

No CAPTCHA bypass

CAPTCHAs are an explicit consent signal from the employer. Bypassing them violates terms and degrades the trust signal the recruiter relies on.

No MFA bypass

Multi-factor authentication protects both candidate and employer accounts. The platform never solves, replays, or routes around MFA challenges.

No login-wall evasion

If a posting requires authentication to view, it is rejected at ingest. No cookie replay, session hijacking, or credential stuffing.

No stealth browser automation

No headless Chromium, no fingerprint spoofing, no anti-bot evasion. Every supported ATS is reached via documented public endpoints only.

No public access to production data

The dashboard, candidate data, applications, and recruiter notes are private. /demo and /case-study expose only mock data and explanatory text.

No auto-submit

Every packet requires explicit human approval before any application leaves the operator's hands. Automation accelerates triage, not the final action.

19

Decision Engine Flowchart

Ingest job posting
ATS adapter: GH · Lever · Ashby · Breezy
ATS platform supported?
Reject Workday / Taleo / SAP / iCIMS
yes
14-day freshness filter
30-day duplicate company guard
11-factor trust score
Trust ≥ 90
High-Probability queue
Trust 70–89
Manual Review
Trust < 70
Reject
Interview probability scorer
Match score + confidence label
Packet generation
Resume · cover · talking points (25/day cap)
Auto Review (5/day cap)
Conservative pass rate ~5.4%
Manual approval
Human in the loop — always
Submit + log outcome
Feeds analytics learning loop
20

What I Would Improve Next

Soon
Gmail recruiter reply detection

Auto-detect inbound recruiter emails and link to the originating application.

Soon
Google Calendar interview prep

Auto-create prep events 24h before scheduled interviews with company brief attached.

Next
Stronger salary enrichment

Cross-source salary data (Levels.fyi, Glassdoor, BLS) for missing or vague listings.

Next
Outcome-based scoring calibration

Re-weight the 11-factor trust model on real interview outcomes once n > 100.

Q4
Custom domain deployment

apply.khalilhickson.com with SSL and SEO-friendly OG cards per route.

Q4
Public sandbox mode

Recruiter-facing read-only sandbox with synthetic data, no auth required.

Want to see it in motion?

Take the guided walkthrough or schedule a live demo.