AI-first, run like a product — not a demo

Jobsucher is the product I own end to end: vision, architecture, the boundaries of what AI is allowed to do, billing and operations. Eleven weeks from an empty repository to a paying product on its own domain.

Jobsucher is an AI-assisted job-search CRM: vacancies, companies, contacts and your own evidence — projects, skills, work cases — in one workspace, with AI limited to the tasks where it earns its place: parsing a vacancy, matching it against documented experience, assembling and validating a tailored CV. It ships as a hosted product at jobsucher.app.

The CTO decisions that made it work

• AI as a bounded service, not a chatEvery model call goes through one gateway: a ten-stage pipeline with strict JSON-schema output contracts, exactly one repair attempt on a bad answer, a circuit breaker, caching and telemetry. Ten versioned contracts define what the AI may return. The open-ended chat was built, measured and removed — it did not earn its place.
• Provider-agnostic by designThe product started on local models, moved to hosted ones when quality demanded it, and ended with routing that picks a model per task by speed and cost. Switching providers is a configuration change, not a rewrite — because the boundary was drawn on day one.
• Every claim traceableA generated CV is only published when every bullet is tied to a piece of evidence in the profile, job titles match the official history, and the rendered PDF passes a geometry inspection for overflow and clipping. AI output is a draft; the validator decides.
• Spend and risk controlled before the callA per-run token stop-loss, a prompt guard that rejects leaked HTML, debug traces and scope violations, daily quotas, a runtime preflight and per-model cost reporting. The budget is a product rule, not a surprise on the invoice.
• Built to fail wellDedicated queues per workload, timeouts ordered so a killed worker can never leave a run stuck, a reaper for the ones that still do, graceful stops, mail that says so when it cannot send. Datastores on loopback only, TLS on its own domain, ownership scoping proven by audit tests.
• Business layer, not just codeCard-backed trials, subscriptions, renewals, dunning and disputes; plan limits and usage metering; a guided onboarding and an action journal that turn a tool into a habit. The product is a business from day one, not a prototype waiting for one.

Outcomes, not output

• 11 weeks from an empty repository to a product with billing, TLS and its own domain
• 100 pull requests merged to main in 10 weeks — up to 31 a week — with forward-only migrations and no big-bang releases
• AI cost is a product rule: every CV generation is hard-capped at 40,000 tokens — under $0.03 per CV with the default model
• The whole product — app, workers, PostgreSQL, Elasticsearch, TLS — runs on one $6-a-month server
• A stuck generation recovers itself within 25 minutes, without a human; owner isolation is proven by audit tests, not assumed

How I run an AI-first team

• Research before rewrites: written bottleneck analyses and refactor plans precede every major change
• A repeatable QA protocol: personas × vacancy quality tiers in three languages, token spend recorded per run
• AI agents are contributors under rules: branch conventions, PR-only main, human merge, forward-only migrations
• Honest positioning: the README says what the AI cannot do, and the product is designed around that truth

What this means for your product

• A CTO who can take an AI product from zero to paying users — and has the repository to prove it
• AI features that survive an audit: bounded tasks, validated output, traceable claims, controlled spend
• Governance for a team that builds with AI agents without losing control of its code base
• Architecture that lets you change model providers as the market changes