Skill-check platform before the first candidate

The /contact form's submit handler does not send anything. It hides the form, reveals a green "Thank you! Your message has been sent. We'll get back to you within 24 hours." panel, and stops there. The source comment says so outright:

// In production, this would POST to /api/contact
document.getElementById('contactForm').classList.add('hidden');
document.getElementById('successMessage').classList.remove('hidden');

There is no fetch call, no action attribute and no method attribute on the form. The matching API route does not exist — POST /api/public/contact returns 404 "The route api/public/contact could not be found."

Verified: filled the form with a valid name, email and message, clicked Send Message, and watched the network panel — zero API requests were made while the success panel appeared instantly. With JavaScript disabled, the form falls back to a GET and dumps the user's message into the URL query string:

https://skills.maahir.io/contact?name=QA&email=qa%40example.com&subject=&message=msg

All 10 jobs returned by the public jobs API carry assessment_template_id: null and assessment_required: true simultaneously. The job cards promise "Skill test included" and "≈25 min test". The candidate applies, the API returns 201 with a valid assessment token, and the assessment page renders exactly one line:

Assessment not configured.

Verified: completed a real application for Junior Accountant at Systems Limited. The apply API returned 201, the browser was redirected to /assessment/jX3vIQ6BNow…, and that page displayed "Assessment not configured." — with no question, no progress indicator, no way to continue and no error state.

The one real job with a description — Intern (Finance and Account) at Server4Sale — also has a null template. Separately, the assessment page's own source contains an offline banner ("You appear to be offline. Your answers are saved locally and will sync when you reconnect.") sitting in the default DOM alongside the completion screen, which needs a state check before it can render.

Every page in the site repeats one promise, in the footer of all 28 pages: "Free for job seekers". On the homepage it becomes "For every job seeker — free forever" and "Free for job seekers, CNIC never shared, Works on slow internet". The pricing page states "Job seekers never pay" and gives job seekers their own "FREE forever" tier.

The registration form requires company_name as a non-optional field:

$ curl -X POST https://skills.maahir.io/api/auth/register \
    -d '{"name":"…","email":"…","password":"…","password_confirmation":"…"}'
{"message":"The company name field is required.","errors":{"company_name":["The company name field is required."]}} 422

Supplying a company name creates a tenant and registers the account with the role tenant_owner — the employer/organisation role, not a candidate role. There is no candidate signup path anywhere on the site. The only job-seeking CTA on the homepage, "I want a job", points at /register — the employer form.

The job board at /jobs is the most public-facing product surface, and it currently lists test data. Verified against the live /api/public/jobs response — 10 published jobs, of which the first three are:

• "Stone Sawyer" — Agency T · "North Jamalberg" — "Error officiis iste ea qui. Est est deserunt deleniti quia. Necessitatibus labore laboriosam labore velit."
• "Mold Maker" — Agency T · "Hackettville" — "Optio debitis praesentium rerum consequatur fugit dicta…"
• "Anthropologist" — Probe Agency A · "East Jaquan" — "Reiciendis est dolore rem tempora quo…"

The city filter dropdown on /jobs offers East Jaquan, Hackettville, North Jamalberg alongside the real Pakistani cities. These are Faker-generated place names, not Pakistan. The tenants are named "Agency T" and "Probe Agency A".

This directly breaks the "Built for Pakistan" positioning and the "Made for Pakistan" badge, and it is the first thing any employer, candidate or investor will see. It also poisons the /apply funnel — the very first job card links straight into an apply form for a fictional role in a fictional city.

Every page loads the same module bundle. It is empty on the wire:

$ curl -I https://skills.maahir.io/build/assets/app-BvRk9kiK.js
HTTP/2 200
content-type: application/javascript
content-length: 0

The CSS bundle beside it is healthy — app-Ckq0k-Cg.css returns 62,019 bytes and renders correctly. The build/manifest.json lists the full asset set including Inter and Noto Nastaliq Urdu webfonts, and those fonts do load correctly, so the build pipeline itself ran — the emitted JS file is the thing that came out empty.

Impact today is contained but fragile. The critical interactive paths — mobile hamburger, contact form, login, register, job board, apply form, assessment, agency workspace — all carry their own inline <script> blocks, so they still work. That is luck, not design: the page is carrying a 7.2 KB inline copy of a browser-logging script on every single page while the intended bundle is empty, and any new component that assumes the bundle will ship will fail silently in production.

The three header dropdowns — For Organizations, For Individuals FREE and Platform — are opened purely by CSS group-hover. They carry no click handler, no aria-expanded state change, and no keyboard focus target that opens them.

Verified on an emulated iPhone (390×844, touch enabled): tapping For Organizations did not open the panel — measured panel height 0px, computed visibility false, after a 5-second tap attempt that timed out because the element never became interactive. The same markup on desktop opens fine on hover.

This matters more than usual for this product specifically: the site's own homepage feature list advertises "Works on slow internet" and "Built for Pakistan: Urdu, PKR, CNIC-safe identity, WhatsApp, NAVTTC-aligned" and the platform page sells "Built for Pakistan — Urdu, mobile, 3G". A Pakistani candidate or recruiter on a phone cannot reach Hiring, Campus & Workforce, Skill Passport, Govt Job Prep, Certification Prep or Skill Paths from the header. The mobile hamburger does open the same destinations — but the hamburger is the only way in, and every one of those destinations is also a top-level section of the product.