Job Search has continued to evolve, but the latest work has also exposed an old assumption that no longer belongs in the service.

One of the AI-assisted configuration functions was still checking whether the user had been granted a separate, generic OpenAI permission before it would run. That does not fit how Job Search is supposed to work. If a user has access to Job Search, the AI features belonging to Job Search should be handled by the service itself rather than requiring another unrelated permission on the account.

That legacy check has now been removed from the Job Search AI helpers.

This applies to functionality such as:

• AI-assisted job-search instruction suggestions
• suggested profile names
• negative keyword suggestions
• CV analysis and related professional-background helpers

The important part is that Job Search can now treat these features as part of Job Search itself instead of leaking an internal OpenAI access model into the user experience.

Better instructions, not just more keywords

The next step is less about adding another search field and more about making the search profile itself smarter.

A Job Search profile already contains quite a lot of information: keywords, locations, exclusions, relevance rules, instructions, previous searches and, where available, CV and application material.

The longer-term goal is to make better use of that information.

Instead of only asking the user to manually write more instructions, Tools should be able to analyse the existing profile and start a useful conversation around it.

For example:

What would you like the search to focus on more?

Are there types of jobs you keep seeing that are not useful?

Are we missing roles that would make sense based on your experience?

Should the search be broader in some areas and stricter in others?

That would make Job Search less of a static configuration form and more of an assistant that can help refine the search over time.

Learning from previous searches

Another part of that idea is to analyse what the searches have actually produced.

If a profile repeatedly returns jobs that are dismissed, poorly matched or clearly outside the user’s intentions, that should be useful information.

Likewise, if relevant jobs repeatedly appear under titles or technologies that were not originally included in the profile, Tools should be able to point that out.

The aim is not to silently rewrite someone’s search profile.

Instead, Job Search should be able to explain what it sees and suggest improvements that the user can review and approve.

That could eventually mean suggestions such as:

• broaden a role family that appears to produce good matches
• add a missing synonym or adjacent job title
• tighten an exclusion that repeatedly produces noise
• reconsider a geographical restriction
• distinguish between a hard requirement and something that is merely preferred
• identify skills in the CV that are not currently reflected in the search profile

Much better AI-generated instructions

The instruction field is also becoming increasingly important.

Short keyword-style AI suggestions are not enough for more advanced profiles. A useful instruction should be able to describe priorities, trade-offs, geography, role families, technical interests, exclusions and acceptable adjacent opportunities in a way that the search engine can actually work with.

The intention is therefore to make AI-generated instruction suggestions longer, more detailed and more useful as complete search strategies.

Rather than producing three slightly different versions of the same sentence, the suggestions should be able to represent genuinely different approaches, for example:

• a focused strategy based closely on the current profile
• a broader strategy that includes realistic adjacent roles
• an exploratory strategy that looks for opportunities the current configuration may be missing

The user’s own CV and other saved Job Search material can also become important evidence here, so the system can suggest broader searches without inventing experience that is not actually there.

Instruction history and undo

As the instructions become more advanced, simply overwriting the old version is not good enough.

A planned improvement is therefore to keep a history of instruction changes.

That would make it possible to see how a search profile has evolved, compare an older version with the current one and restore a previous version if a change turns out to make the search worse.

This is particularly important if Tools starts helping users refine their profiles over a longer period. Improvements should be reversible.

From configuration to ongoing refinement

The broader vision is that Job Search should not stop being useful once the initial profile has been created.

Creating the profile should only be the beginning.

Over time, Tools should be able to use the profile, previous searches and the user’s own feedback to help answer questions such as:

• What are we missing?
• What are we searching too narrowly for?
• What keeps generating bad matches?
• Which parts of the profile are actually working?
• Are there realistic roles that the current search never considers?
• Has the user’s focus changed since the profile was first created?

The user should remain in control of every meaningful change, but Tools can do a much better job of helping them understand and improve the search.

That is the direction I want Job Search to move in next: not simply more automated searching, but a search profile that can be reviewed, challenged, refined and improved together with the person using it.

Turn school timetable screenshots into a complete weekly Skånetrafiken travel plan, including travel margins, route preferences, alternatives and shareable results.

https://tools.tornevall.net/transit-planner

---

Planning a school week around public transport is easy until every weekday starts and ends at a different time. Transit Planner is a new service in Tornevall Tools designed to turn a weekly schedule into a practical travel plan using Skånetrafiken.

Instead of manually checking journeys for every school day, Transit Planner combines the timetable with public transport data and builds a weekly overview.

From a screenshot to a weekly travel plan

A school schedule can be uploaded as one or several screenshots. The images are analysed together using OpenAI vision, allowing overlapping screenshots to be combined into one week.

The service reads the actual timed lessons for each day and produces a simple schedule:

date,start,end
2026-09-28,10:00,14:45
2026-09-29,09:50,16:00
2026-09-30,09:40,14:05

The generated times remain editable before the journey search starts.

Skånetrafiken journey planning

Transit Planner then communicates with Skånetrafiken and searches for suitable journeys for every school day.

The planner takes into account:

• the first lesson of the day
• the final lesson of the day
• a configurable travel margin
• both the journey to school and the journey home
• preferred bus or train lines
• alternative journeys when several useful options exist

The same safety margin can be used in both directions.

The normal return journey is automatically based on the reverse of the morning route. If the journey home starts or ends somewhere else, a separate after-school route can be enabled.

Choose how you actually travel

Not every technically possible journey is equally useful.

Transit Planner can prefer specific services, such as a particular city bus, while still keeping other valid alternatives available. The selected journey also shows which train, regional bus or city bus is involved.

Additional journeys stay hidden until they are needed, keeping the weekly overview readable.

Searchable locations

Origin and destination fields use live searchable locations instead of requiring exact stop IDs or coordinates.

This makes it possible to search for places such as:

Klippan station
Studievägen 2, Helsingborg

without knowing how Skånetrafiken internally identifies the location.

Share the finished plan

A completed weekly plan can be given its own shareable URL.

The shared view can restore the timetable, route configuration and journey results. Uploaded timetable screenshots can also be retained with the plan, making it possible to compare the generated journeys with the original schedule later.

Built for actual weekly use

Transit Planner is intended for situations where “just check the journey planner” becomes repetitive.

A changing school timetable is an obvious example, but the same approach can also be useful for recurring work schedules, courses and other weekly activities where departure and arrival requirements change from day to day.

Transit Planner is part of Tornevall Tools and is still being actively improved as real-world schedules and Skånetrafiken data expose new edge cases.

We have completed a set of server-side fixes for the Tornevall Networks DNSBL integration after identifying authentication and reliability problems affecting existing clients, including the currently released WordPress integration.

Existing WordPress installations remain supported

One of the most important requirements was that existing installations must continue working without forcing users to upgrade their plugin just because the server-side authentication model has evolved.

ToolsAPI therefore continues to recognize the authentication method used by released DNSBL clients. Existing DNSBL API keys remain valid through the legacy-compatible authentication path, while the newer DNSBL token model continues to work alongside it.

No API key rotation or WordPress plugin update should be required solely because of these changes.

Internal retries no longer lose authentication

We also found a separate problem in the DNSBL reliability system.

Failed DNSBL mutations can be buffered and retried internally. Those retries were executed inside an authorized server process, but the replayed request itself did not contain authentication in a form understood by the API controller.

The result could be misleading errors such as:

401 unauthenticated

even though the original operation had been properly authenticated.

The retry mechanism now carries a strictly internal, runtime-only authorization marker. It is accepted only while the trusted retry process is executing and cannot be reused as an external API credential.

Better handling of temporary DNS socket failures

Another source of failures was transient UDP socket conditions during direct DNS updates, particularly:

Resource temporarily unavailable

These conditions can occur while waiting for a DNS server response and do not necessarily mean that the DNS update itself is invalid.

The DNS update layer now recognizes transient conditions such as EAGAIN, EWOULDBLOCK and interrupted socket reads and performs bounded retries before treating the operation as failed.

Real DNS errors, authentication failures and TSIG errors are still reported normally.

Additional reliability improvements

The same operational review also uncovered a few related problems in ToolsAPI.

Transit Planner image uploads were too aggressively rate-limited for the intended multi-screenshot workflow. The upload limits have been adjusted while keeping abuse protection in place.

Deploy health reporting was also made page-wide instead of depending on a specific Statuspage component name, making recovery reporting more robust if components are renamed or reorganized.

What this means for users

For users of Tornevall Networks DNSBL integrations:

• Existing released WordPress clients remain supported.
• Existing DNSBL API keys continue to work.
• Internal retry operations no longer fail simply because authentication context was lost.
• Temporary DNS socket conditions receive bounded retries instead of immediately generating a server error.
• Missing or genuinely invalid credentials still fail normally.
• No new versioned API endpoint has been introduced.

The fixes were implemented in ToolsAPI and merged on September 27, 2026.

If you recently encountered unexpected 401 responses while adding or removing DNSBL records, or intermittent DNS update failures, the problem may have been related to the server-side issues addressed by this update.

Last week was hilariously busy.

On Sunday I was planning to write something reasonably detailed about the week that had just passed. The problem was that Sunday eventually turned into “still working on things from the week that just passed”, so I never really got there.

I have therefore decided to do what every responsible developer does when the documentation backlog becomes too large: make the documentation shorter. This is roughly what happened.

It started with a terrible Laravel idea

ToolsAPI was still running Laravel 8, which had been out of security support for quite some time. The sensible upgrade advice is to move through the major versions one at a time, dealing with package compatibility, framework changes, middleware, routing, PHPUnit and whatever else Laravel decided to move around between releases.

So naturally I upgraded directly from Laravel 8 to Laravel 13 because I didn’t care about the warnings. Instead, I trusted Copilot, I had very little time, and apparently this is how decisions are made now. It went almost well. At late evening, at 22, I was acutally passing thought last hell of caches. After that point it actually worked surprisingly well. Yes, production found some ancient cached Laravel state and briefly reminded me that software can remember things long after everyone involved would prefer it didn’t. But if just drop that little issue, everything was up again. Leaving copilot alone for 16 hours with destructive methods isn’t a very clever idea, so that was the first ruleset I had to add: DO NOT RUN DESTRUCTIVE CALLS IN PRODUCTION!

Because I did it in production…

What really happened

ToolsAPI – Laravel 13

The whole platform moved from Laravel 8 to Laravel 13, old compatibility baggage was removed, dependencies were modernized and Laravel Mix was replaced with Webpack 5. Production celebrated by throwing HTTP 500 errors because stale cache survived the upgrade, so deployment checks and cache handling were subsequently taught some manners.

GitHub Actions – “But did it actually work?”

The development flow became much more aggressively issue -> branch -> code -> test -> PR -> CI -> fix what exploded -> merge. Several integrations now perform real provider checks instead of receiving a participation trophy because a mock returned 200 OK. Problem is that I got some dumb integrity checks inside that system that practically ate my budget.

Error reporting – Fail loudly, please

Browser errors, API failures, workers, schedulers and other operational disasters can now report directly to #toolsapi, independently of ordinary audit settings. This has already proven useful because apparently software defects become much easier to fix once they stop hiding. Slack and massive Codex integrations really works nice! All errors are shown quickly and ChatGPT can read from those errors and fix them instantly!

Slack AI Bot – It has escaped into Slack

The Slack bot learned DMs, mentions, active thread continuation, images, multiple workspaces and a polling fallback for situations where Slack Events decides not to be particularly eventful. Public distribution also forced the polling logic to become considerably less enthusiastic about calling Slack’s API every ten seconds.

This wasn’t really planned, but since I was curious on other things, this is where I ended up.

Alert Engine – Scheduling things without creating a time paradox

A shared Alert Engine now handles recurring monitoring, runs, results, deduplication, notifications and history instead of every service inventing its own cron-shaped wheel. Real scheduler traffic immediately found stuck runs and overlaps, so locking, stale-run recovery and overlap protection were added before the scheduler could successfully fight itself.

Web Search Alerts – Google Alerts after drinking OpenAI

Web Search Alerts became considerably more serious: real OpenAI web search, source recovery, verification, deduplication, notifications, run history and better diagnostics. It also learned how to survive malformed output, incomplete provider responses and HTTP 403 results, because the Internet remains committed to being the Internet.

Job Search – Teaching AI what I don’t want

Job Search gained live progress, better search diagnostics, Alert Engine integration and profile-specific negative keywords. AI may suggest that “truck driver” is perhaps not the ideal result for a developer profile, but it still has to ask permission before permanently learning from its mistake.

Whisper – Please transcribe this somewhere else

Whisper gained multi-file uploads, better transfer progress, transcript-based titles and the ability to run speaker diarization after transcription. More importantly, transcription can now be handed to remote CPU/GPU workers using leases, heartbeats, progress reporting and capability negotiation, allowing the web server to concentrate on its traditional responsibility of having entirely different problems.

With that said, this is IF you have a GPU to run with. I really don’t. Besides, I’m trying to run with Diarization again.

Guestbook – Somehow this became a platform

What started as “let’s preserve some old guestbook data” turned into multiple owned guestbooks, imports, APIs, embeds, moderation and external client support. Public DNSBL badges were replaced with country flags, because publicly branding every visitor with internal abuse metadata turned out to be slightly more information than a guestbook actually needs.

WordPress – Tools has plugins now

The WordPress integration grew into a real Tools client with Guestbook support, direct Tools account pairing, DNSBL credential handling and proper Plugin Check coverage. The separate DNSBL plugin also started moving deeper into WooCommerce and fraud/event handling, because apparently DNS blacklists also needed a career change.

Security Advisory Watch – Because upgrading Laravel wasn’t enough security work

Products and technologies can now be monitored for advisories, CVEs and related security changes using the same search and notification foundations. It also gained dedicated GUI and regression coverage after discovering the classic enterprise security vulnerability known as “the form looks like shit”.

Security Probe Guard – The guard dog bit the owner

Automatic exploit-probe detection and temporary bans were added. Then an automatic ban managed to lock out the operator, which led to recovery routes, fail-open handling for old automatic bans and the revolutionary security concept of “maybe don’t automatically ban the administrator”.

SoundCloud – Zero is also a number

SoundCloud received OAuth reauthorization, chart fixes and several profile-insight repairs after real data demonstrated that a confidence value of 0 is perfectly valid and does not necessarily mean “the application should crash now”. This is why production data gets a vote.

SocialGPT / Facebook – Controlled chaos laboratory

SocialGPT gained for a long time ago a sidepanel instead of popup based requests. We haven’t realeased this extension for a while, so nobody knows about this yet.

Services – We have enough of them to need categories

/services was reorganized into actual categories because the previous architecture was rapidly approaching “here is a large wall of links, good luck”. A green forum-inspired theme called “Jessica” also appeared during all this, because clearly visual consistency was the urgent missing ingredient.

---

What is happening now?

Android Tools – SocialGPT leaves the browser

The Android app is gaining proper context capture, AI context cleanup, full context review, privacy-safe statistics, push notifications and the required Android/Google Play consent flows. The current objective appears to be turning “select some text and ask Tools” into “Tools is just there when I need it”, without turning the phone into spyware in the process.

Web Search Alerts – Apparently not finished being useful

Results are getting source exclusions, rejected-result inspection and restoration, searchable delegation, ownership transfers, location context and better source recovery through the shared SearchFactory. What used to be “search for this occasionally” is steadily becoming a small monitoring system with opinions.

Guestbook – Still refusing to remain a guestbook

Embed routing has been repaired after web servers managed to return a 404 status together with perfectly valid JavaScript, which is an impressively confusing achievement. Autosaved settings, ownership transfer, notifications, better pagination and visible service versioning are also being added around it.

Statuspage – Yes, another platform

Tools is getting its own proper Statuspage foundation with public status pages, components, incidents, owner management, administration and a public read API. The WordPress integration is already growing a Statuspage block, because displaying whether Tools is broken should ideally continue working even when Tools is broken.

Votech – BBVote’s successor is waking up

Votech now has its proper architecture and dedicated database/model foundation, with the old BBVote data treated as historical input rather than something we should continue poking with sticks. The GUI, voting flows, administration and integrations come next. And no, the API will not suddenly grow /v1/, /v2/ and seventeen generations of archaeological sediment.

We have an election running in a few weeks. I was thinking of making a BBVote clone – PoliticalVote. Or something like that.

SocialGPT – Again – Context, but only after consent

A consent-gated context-analysis endpoint is being built so SocialGPT can correlate page content, selected text and bounded browser observations without silently shipping everything it sees somewhere else. The extension is simultaneously learning more generic DOM/XHR correlation, which sounds innocent until you remember what modern websites look like internally.

AI accounting / Ko-fi – Computers have discovered money

AI usage accounting is being connected to users, providers, token consumption and eventually prepaid credit. Ko-fi is part of the payment direction, because once AI starts consuming measurable amounts of money it becomes surprisingly important to know whose money it is consuming.

The reason for why I do this is actually, if I release an android app into Google Play Store, I don’t want to pay for other peoples AI usage. So this is going to get real. And I probably need to register myself as a firm or something very soon now.

Tools versioning – The footer now knows what it is

The main Tools platform is finally getting an explicit semantic version that everybody can see, while administrators still get the extra Laravel/PHP diagnostic information. Considering how much changed before the platform got a visible 1.0.0, this is possibly the most backwards software-release story in the entire list.

Image generation and file storage

This is also a concept that I’m working with right now. Image generation should be a platform-global feature, to make sure BBVote/Votech and other stuff can get hold of a very nice AI feature. Also storing those files somewhere, is a plan for which Filestorage could be perfect.

… and possibly some MCP services. Who knows?

---

This is a very short list actually. The more I think, the more crap I produce and I throw it at tools. If you have any suggestions, please feel free to contact med. The platform already features a lot more than I just presented, since this is only the NEW stuff coming up. Oh, did I mention a suggestion box? That’s also in the agenda…

We are building a centralized connector framework for Tools. The goal is simple: make integrations reusable, secure and easier to extend. Instead of every service having its own custom integration, Tools will provide a common framework where connectors can be added and managed consistently.

The first AI connectors will be:

• OpenAI Connector (Present)
• Microsoft Connector (Entra / Copilot, hopefully upcoming)

Future connectors will expand into areas such as…

• Social platforms
• Messaging services
• External APIs
• Enterprise integrations

Each connector will have a standardized way of handling…

• Authentication
• Permissions
• Configuration
• Logging
• API access

The foundation will support both internal services and user-owned integrations, where users can connect their own accounts and manage their own permissions.

The goal is to create an IFTTT-like integration layer, but built around something else where we keep expensive services separated from things that can be offered for free, AI services and enterprise authentication.