# Visabon AI — October 2026 MVP

Live demonstration: https://visapilot-ai.shadysong8.chatgpt.site

The site retains owner-private hosting access. The application includes separate email accounts, but external visitors cannot reach signup until the hosting audience is deliberately opened or suitable visitor access is granted. Do not confuse application membership with hosting access.

## Product and evidence

Visabon AI organizes international hiring and visa preparation for consultancy agencies, employers and individual applicants. The founder's consulting, HR, workforce support and integration experience in Kosovo and North Macedonia informs the software workflows. That consulting business and its revenue are distinct from this new software product. No software users, customer traction, partnerships or revenue are claimed.

## Implemented versus planned

| Implemented | Incomplete / planned |
|---|---|
| English/Turkish website, marketing, pricing, demo contact and draft privacy pages | Commercial launch, validated pricing, billing |
| Distinct applicant C/D preparation, employer company/personnel and consultancy Schengen portals | Company team memberships, invitations, shared cases, MFA, SSO |
| Email/password accounts, immutable account type, hashed server sessions; one-time ChatGPT portal enrollment; legacy consultancy data preserved | Email ownership verification, password recovery and email notifications; email provider not configured |
| Case create/edit/search/filter/archive/restore, applicants/employers, notes, tasks, deadlines and history | External recruitment integrations and automatic notifications; assignees are labels |
| D1 persistence; private R2 upload/download/delete; file/checklist mappings | Malware scanning, audited retention, erasure, backup/restore and privacy operations |
| 29-country Schengen official source directory, bounded on-demand source previews and 24-hour cache | Exhaustive current nationality/residence/category-specific rules; some official sites block automated requests |
| Downloadable Unicode PDF preparation checklists; national visas distinguished from short-stay templates | Verified country-specific final checklists and official local appointment channels for every residence/type combination |
| Uploaded-document demo review; missing evidence warnings; human confirmation; official channel handoff | Evaluated live model activation; actual slot search and booking are not implemented |
| Server-only OpenAI Responses adapter for TXT/PDF/PNG/JPEG, schema validation, consent, usage caps and timeout | No live credentials configured or model calls performed in this deployment |
| Employer-created job board, draft/preview/publish/pause/close, consenting candidate interests and internal stages; server-only 500-entry feed adapter | BA partnership/redistribution rights or licensed provider access, live external vacancies and verified daily scheduling |

## Architecture

React/Vinext UI → Cloudflare Worker authenticated APIs → D1 records and private R2 files.

`accounts` stores email, name, role, company, versioned salted scrypt password hashes (N=16384, r=8, p=5, 16 MiB core memory; 32 MiB allocation ceiling). `sessions` stores only SHA-256 hashes of 256-bit random tokens with seven-day expiry. Session cookies are `__Host-`, Secure, HttpOnly, SameSite=Lax. Existing hosted ChatGPT identities remain separate; accounts are never linked by matching email. A supplied email-session cookie does not fall back to another identity if invalid.

Cases/documents/reports are authorized by server-derived account ID and demo/pilot scope on every query. Three SSR portals enforce account type. Applicant case creation binds the applicant name to their account; they cannot use consultancy create/edit/seed APIs. Employer and agency workspaces currently have one owner each, not collaborative organization tenants.

Document upload allows PDF, PNG, JPEG and UTF-8 TXT, maximum 5 MB, checks signatures/encoding, bounds request streams and rejects foreign checklist references. R2 object keys are private and unpredictable. Downloads are authorized attachments with no-store, nosniff and sandbox headers. The workspace limit is 100 files. Document review is limited to ten files / 15 MB combined and ten reviews per account per day.

Preparation reports are tied to case contents, version and stored file IDs/mappings. Changes invalidate the handoff. An item must be human-marked complete and linked to a file. A human must confirm all content, unresolved findings and the correct official requirements. The handoff opens an approved official URL; it does not reserve a slot, make a payment, establish eligibility, validate authenticity or imply approval.

## Role-specific workflows (October 2026 revision)

- **Individual:** choose C (short stay) or D (national preparation) when starting an application; choose destination, answer purpose questions and confirm a route. The applicant name is server-bound to the account. This interface has no company management or other-person applicant lists.
- **Employer:** save company name, work country, city and optional sector/registration reference. Add employees by name and use their nationality, residence, purpose, occupation and qualification answers to select a route. The server binds the destination and company to the saved profile; arbitrary company/country fields are rejected or ignored. After personnel records or vacancies exist, the company work country cannot change through the profile form. A different destination currently requires a separate company account.
- **Consultancy:** retain the case dashboard, tasks and reporting; use the dedicated Schengen section to filter tourism, business trips and family/friend visits. New cases use questions and explicit human confirmation. Applicant cards/details show the visa purpose rather than a company name as the subtitle.
- **All three:** Visa Navigator, mapped private uploads, missing-evidence review, notes, recorded expert-review enquiry, and human-confirmed official application/appointment entry point. Business views also support task labels. Expert enquiries are stored internally; no expert network or delivery service is connected.

An existing email account keeps its registered role. Selecting a different login card produces an explicit mismatch and a button to use the registered portal; it never grants different permissions. A new hosted ChatGPT identity enrolls once at `/account/setup`. Existing consultancy case owners must retain their agency identity; the UI explains separate email registration for a different role. Email and ChatGPT accounts are never merged by matching email address.

`profiles` stores the server-owned company/onboarding profile and selected role. `cases.payload.visaRoute` stores the country route ID, C/D class, questionnaire answers, purpose confirmation and optional §81a enquiry. Optimistic case version checks prevent silent overwrites. Changing a populated file to a different country/purpose/route requires a separate case. Existing legacy files can be configured for the same purpose and country while keeping documents and custom checklist items; previously unlinked files can be mapped to a checklist item.

### Navigator sources and limitations

The navigator uses deterministic, inspectable rules. It suggests candidates from purpose, duration, occupation and declared qualification, then shows unconfirmed job-offer, recognition and driver-qualification questions. It never decides legal eligibility. Three C preparation purposes exist for all 29 Schengen countries. Other national categories are clearly provisional enquiries, not a claim that every country offers every programme. The country directory is **not exhaustive** and does not replace current consular rules.

Germany has source-linked summaries for EU Blue Card (§18g), qualified professional employment (§18a/§18b), professional drivers (§19c(1) with §24a BeschV), experienced workers (§19c(2) with §6 BeschV), Opportunity Card, recognition and self-employment. The route summaries were checked 9 October 2026 using the Federal Government's [Make it in Germany](https://www.make-it-in-germany.com/en/visa-residence/) guidance. Individual requirements, salary thresholds, exemptions and mission-specific document lists remain verification tasks. German study and Ausbildung summaries now link official guidance; family enquiries and country-specific final requirements remain provisional.

§81a is shown as an optional **procedure enquiry**, never a standalone visa or entitlement; applicability must be checked with the authority. It is not presumed for professional drivers. “25F” was not verified as an official professional-driver visa label. The driver page links the actual sourced route and mentions the separate qualification pathway without automatically declaring someone eligible.

German D preparation hands off to the official [Consular Services Portal](https://digital.diplo.de/visa); C preparation uses the official visa-service directory. Other country handoffs use the existing controlled official registry. These are entry points, not preselected residence-specific appointments. No availability query or booking occurs.

## AI behavior and configuration

Currently no live model is connected. TXT demo review recognizes labeled Name, Employer, Destination and Start date fields. PDF/image contents are not read in demo mode. It never produces an AI pass or legal approval. Manual human preparation confirmation remains available after the demo and all checklist evidence is present.

The optional adapter in `lib/document-analysis.ts` uses the OpenAI Responses API directly; it does not require a ChatGPT plugin. Configure through the server secret manager:

- `OPENAI_API_KEY`: secret API key; never place in the frontend, repository or user-visible documentation.
- `OPENAI_MODEL`: account-accessible model supporting structured outputs and the required file/image inputs.
- `VISAPILOT_LIVE_AI_ENABLED`: explicitly set to `true` only after model, privacy, data-transfer and usage evaluation.

The API requires explicit processing consent before sending documents externally. `store:false`, no tools, fixed system instructions, untrusted document/data separation, strict JSON schema, runtime validation and a 45-second timeout are implemented. These are technical controls, not a guarantee of model reliability or provider retention terms. Provider processing, data residency and retention must be assessed before real passports are used. A failed live request never falls back silently to a fabricated pass.

`lib/assistant-provider.ts` / legacy consultancy supplied-text review remains a clearly labeled deterministic demo. The uploaded-document preparation interface now serves all three portals; the legacy supplied-text consultancy demo is retained.

## Official information and jobs

`lib/visa-guides.ts` records all 29 Schengen countries, official authorities, URLs and source-directory check date. General short-stay guidance is based on the European Commission page checked 9 October 2026. Country/route-specific final requirements remain marked “Verification required”. A source retrieval timestamp is not a legal verification date. National work/study/residence routes receive a separate provisional checklist; they do not inherit tourism requirements. Visa exemption and permission to work must be checked separately.

`/api/guide` only fetches registry-controlled HTTPS URLs. Requests are bounded, redirects are not followed, scripts/styles/navigation are removed, source text is displayed as text, and excerpts are cached for 24 hours. Bot blocks, JavaScript-only pages and redirects may require the user to open the original official source. This is an excerpt retrieval mechanism, not a complete legal knowledge feed.

The applicant portal contains the full employer-created job board, keyword/country/source filters and consent-based interests. Employers manage publication and internal recruitment stages. BA and EURES remain optional external search links. Historical job examples were removed. A licensed, independently authenticated max-500-entry daily-feed adapter is prepared but not configured or scheduled; BA redistribution and interface access require appropriate authorisation. No live-feed availability, sponsorship or partnership is implied.

## Email and membership

Email/password registration and login work. Email is an unverified account identifier; no verification mail, reset link or notification is sent. Company memberships are account types, not paid subscriptions or staff access grants. Before public onboarding, connect a transactional email provider, implement single-use expiring verification/reset tokens, verify sending-domain DNS, add abuse protection and evaluate MFA/recovery. Do not promise email delivery until it is connected and tested.

## Development and testing

The managed starter's dependency and build helpers are used. Database migrations are versioned in `drizzle/`; do not create tables at request time. D1 and R2 bindings are already declared in `.openai/hosting.json`. Publishing applies new migrations without deleting existing tables or fictional demo data.

```bash
node /opt/codex/tools/pnpm/bin/pnpm.cjs exec tsc --noEmit
node tests/integration.mjs
node tests/portals.mjs
node tests/auth-runtime.mjs
node tests/routes.mjs
node tests/model-adapter.mjs
node tests/ui.mjs
node /root/.codex/plugins/cache/openai-curated-remote/sites/1.0.0/scripts/build-site.mjs
node tests/production.mjs
```

Integration tests dispatch actual routes through Miniflare with isolated D1/R2. Hosting identity and external official fetch are mocked. Production tests load the built Worker. No real customer documents, live AI calls, real email delivery or external appointment bookings are used. Browser automation is unavailable in this environment; visual responsiveness, browser clicks/cookies and the hosted sign-in round trip remain manual QA.

### Manual demonstration

1. Open `/signup`, choose Türkçe, select Individual applicant, enter a fictional name/email and password of at least 12 characters, and accept the pilot notice.
2. In `/applicant`, start a C/D application: choose C for a tourism/business/family visit or D for a national preparation route. Select destination, answer the Navigator, select a candidate and explicitly confirm the purpose. Supply fictional nationality and legal residence. Download the route-specific provisional `.txt` list.
3. Use small synthetic TXT/PDF/image files. Upload evidence beside each configured item. Confirm the exact official checklist separately and add/remove applicable entries. Mark reviewed items complete.
4. Run Visabon Assistant. Observe the DEMO label, missing evidence and unread PDF/image notices. Fix outstanding items and review again.
5. Confirm the official route and human review. The next screen opens the official channel; no slot is booked. Change a checklist item or file and verify that a fresh review is required.
6. Sign out. Register a second fictional email and verify that the first account's cases/files are absent. Register an employer separately, save a fictional German company profile, add a fictional driver and select the sourced professional-driver route. Register an agency separately, open Schengen and add a fictional business-trip applicant. Inspect each role's distinct UI, search, filters, notes, task labels and archive/restore. A wrong-role login must explain the mismatch, not change permissions.
7. Open `/jobs`, use the BA keyword/city search for Germany or EURES for another country, and inspect original-source job/company details. Check current vacancy status at the source.
8. For a new hosted ChatGPT identity, select the role once in account setup. Existing consultancy owners must keep their original data context.
9. Test desktop/tablet/mobile widths, EN/TR switching, invalid input, expired sessions, upload restrictions, missing evidence, disabled confirmation and logout in a real browser.

## Three-month roadmap

Month 1: synthetic-data pilots with agencies, employers and applicants; validate workflow pain, willingness to pay, individual versus B2B demand, pilot usability and information maintenance costs; complete privacy/threat model.

Month 2: transactional email verification/recovery, organization memberships and tested role grants, consent-based applicant sharing, retention/deletion and backups; curate exact routes with official sources and qualified reviewers.

Month 3: evaluated live model review/OCR, licensed job integration feasibility, official appointment API feasibility, subscriptions/webhooks, monitoring and incident recovery; independent security review before controlled real-data pilots.

## Assumptions requiring validation

- Agencies and employers pay for software separately from consulting services; displayed prices are illustrative.
- Individual applicants benefit from a separate membership and have acceptable acquisition/support costs.
- Official information can be maintained by nationality, legal residence and purpose without unsafe oversimplification.
- Document extraction meaningfully reduces human work at acceptable accuracy, latency and cost.
- Job source licensing and available official appointment integrations support the proposed experience.
- Hosting audience, server limits, processing regions and recovery controls meet customer needs.
- Existing consulting experience supports product discovery but does not establish software traction or Startup Status acceptance.

## Production security and privacy work

No GDPR compliance is claimed. Before launch, establish controller identity/contact, processor agreements, lawful basis, residency/transfers, retention/erasure and incident procedures; validate legal-content governance and model safeguards; add malware scanning, verification/recovery/MFA, abuse controls, org-level permissions, audit review, backups and recovery tests. The current site is an owner-private synthetic-data pilot.

## Live signup repair — 9 October 2026

Production signup/login returned HTTP 500 while local Miniflare tests passed. The deployed Workers runtime caps PBKDF2 iterations and the previous 600,000-iteration call exceeded it. New passwords now use native scrypt (N=2^14, r=8, p=5), a standard memory-hard 16 MiB configuration documented by OWASP. The stored hash includes a fixed version and parameters; comparisons are constant-time, passwords are not truncated and nonexistent accounts exercise the same scrypt verification path. This does not weaken or silently reinterpret existing hashes. Legacy 600,000-iteration hashes are preserved and upgraded only after a successful verification; if that legacy KDF is unavailable, the API returns a clear migration-required error instead of an invalid-password claim. Password recovery still requires a mail provider before public launch.

Auth error logs contain only a stage and stable error code, never request bodies, passwords, emails, session tokens or raw exception messages. Existing ChatGPT consultancy owners receive a clear continuation link and separate email signup choices; role changes cannot reclassify their existing files. Private hosting access is unchanged.


## Recruitment and expanded route catalog — 9 October 2026

Implemented: D1-backed employer vacancies (private draft, preview, explicit publish, pause, close, optimistic edits), applicant in-portal full-text job cards with country/source/keyword filters and 20-card pagination, expiry checks, up to 500 external cards, explicit applicant contact-sharing consent, internal candidate stages and applicant withdrawal removing contact/message data. Only published vacancy fields cross account boundaries; case files, private documents, company drafts and other applicants' interests remain isolated. Demo and pilot publications are separate. Employer tasks, near/overdue dates, document-gap overview and downloadable human preparation report reuse actual case data. The work questionnaire also distinguishes ordinary employment, seasonal work, intra-corporate transfer and research contracts. Company country is locked after a case or vacancy exists. Employer and candidate identity/claims are not verified.

The two historical BA example cards were removed. There is **no live BA feed and no daily import schedule**. BA's source terms (https://www.arbeitsagentur.de/nutzungsbedingungen, checked 2026-10-09, sections 2a(3), 6b) restrict robots/interface data collection and govern sharing with selected partners by agreement. Obtain appropriate BA partner access / redistribution rights, or a licensed alternative. The publicly documented third-party bund.dev API is not treated as authorisation. Native employer publication works without a third-party feed.

Prepared server-only licensed JSON integration: POST /api/jobs/refresh requires a strong independent JOBS_REFRESH_TOKEN, configured HTTPS JOBS_FEED_URL, JOBS_FEED_NAME and JOBS_FEED_RIGHTS_REFERENCE; JOBS_FEED_TOKEN is optional and server-only. None is configured in production. The feed must use the contract in lib/jobs.ts: retrieved ISO date within 36h, max 500 unique job IDs with complete title/company/country/city/occupation/contract/hours/description/requirements/support/closing date/source HTTPS URL. Response bounded to 6MB, 25s timeout, no redirects, no client-supplied feed URLs. Successful validated snapshots store individual D1 job rows and activate the source metadata in one atomic batch (25 jobs / 100 parameters per insert, up to 22 statements); failed updates preserve the previous snapshot. Expired entries disappear and snapshots older than 36h display a stale warning. Provider metadata is never represented as a visa sponsorship guarantee. Empty snapshots legitimately clear expired/withdrawn provider jobs; count is not padded to 500. Configure independent credentials through Sites runtime secret tools, never frontend or source files. Protect the hosting boundary independently as well.

After rights and source access are available: configure secrets, call the refresh endpoint through intended unattended authorisation, read back /api/jobs as an authenticated test applicant, verify source/expiry metadata, then use Sites create_schedule for a daily run in the owner's confirmed timezone. Cloud instructions must acquire fresh Sites service access plus the independent updater secret through an approved secret facility; do not embed tokens in schedule prompts. The prepared API was tested with a synthetic 500-job provider, not real BA data. No automation was created for an unavailable source.

Visa Navigator now offers 18 occupation groups, occupation-specific human-review prompts, national employment preparation entries for all 29 Schengen destinations, EU Blue Card / seasonal / ICT / research comparison categories for participating EU countries (not Denmark or EFTA), Danish work-scheme comparisons, Norwegian seasonal and Icelandic specialist/shortage enquiries. German nursing, nursing-assistant, Western Balkans, study and Ausbildung summaries were added using official sources. The applicant C/D step remains applicant-only; all three roles use the broader navigator. German professional driver route remains §19c(1) AufenthG + §24a BeschV; “25F” is not presented as an official driver visa, and §81a remains a separate procedure.

The official employment source directory is in lib/country-employment.ts. Directory access was checked 2026-10-09; many national conditions remain explicitly “Verification required”. EU Commission pages themselves contain some older national details, so source access is not a legal currentness certification. This catalog is broader but **not an exhaustive, legally verified catalog of all visas / work permits in each country**. Labour-market eligibility, regulated professions, nationality exemptions, entry visa versus work/residence permission, salary and quotas must be reviewed by qualified country editors before real use. No software customers, revenue, partnerships or real vacancy inventory are claimed.

Validation: node tests/jobs.mjs checks actual backend handlers, account/role isolation, publication/consent/withdrawal, candidate stages, expiry/mode controls, source failures/staleness and a mocked 500-entry licensed feed. Existing role, UI and built-Worker tests cover regression flows. Browser visual/click QA remains unavailable in this environment.


## PDF downloads and five-step layout — 15 October 2026

Country and route preparation downloads now return real application/pdf attachments, with Unicode-safe Turkish text, wrapping, page headers and page numbers. The five-step How It Works guide also downloads as PDF; its website headings and descriptions use Arial, 16pt (Helvetica/sans-serif fallback if a device lacks Arial). PDF exports embed the open Liberation Sans typeface under SIL OFL 1.1 for portable Turkish glyphs. Company preparation reports export as PDF locally in the browser. The synthetic TXT upload example is intentionally retained because the demo document reviewer only reads labelled TXT. Display branding is Visabon AI; account cookie identifiers and the existing hosting address remain compatible. These layout/download changes do not activate live AI or change visa requirements.


## Approved five-step PDF background — 15 October 2026

The founder-supplied Travel Pass panorama is now a softly faded background in the five-step PDF, matching the approved sample. The full image keeps its proportions, with 18% opacity and feathered edges for readability. It applies in both English and Turkish, while text, type size and warnings remain intact. The approved background is also applied to all country and route preparation checklist PDFs. Private employer reports keep their existing layout. The website background is unchanged.


The 15 October follow-up fixed an incomplete background rollout: all /api/checklist PDF outputs now include the approved Travel Pass image, including country/purpose and country/route exports. New attachment names include travel-pass to distinguish them from previously downloaded plain versions; X-Visabon-Pdf-Design identifies travel-pass-v2 and responses remain no-store.