feat(ai): centralize durable usage

Add a content-free usage ledger with legacy backfill. Reserve Workspace and durable Strategy/CV work before execution so deleted history or duplicate admission cannot reset limits.
2026-08-15 20:03:06 +02:00
parent dbff0f8d49
commit 134aac7bcf
28 changed files with 3539 additions and 83 deletions
@@ -18,6 +18,7 @@ The Overview button in `JobDetailsDialog.tsx` called candidate fit and `GET /api
 - The handler makes one bounded structured generation request, validates the entire JSON shape before publishing, passes worker cancellation, records actual provider/model/route metadata and rejects embedded source instructions. Job text, profile text, structured profile and extracted attachment context have explicit ceilings.
 - UI states cover queued, local processing, retry wait, approved-fallback wait, completed, failed, cancelled and cancellation requested, with cancel/retry actions. A request-version guard prevents a stale resume lookup from erasing a newly queued operation.
 - The existing generic terminal notification is produced transactionally by the operation store. No email is sent.
+- Admission creates one content-free usage reservation in the same transaction as the operation. Duplicate clicks reuse it, and successful execution replaces the conservative 12,000-token reservation with the measured input/output character estimate.

 `strategy.snapshot` is not in the external fallback allowlist, so it remains local-only even when a user has external consent. The worker switch remains off by default pending the production canary.

@@ -36,7 +37,7 @@ The Overview button in `JobDetailsDialog.tsx` called candidate fit and `GET /api
 - No Ollama model, external provider, private CV, production service or paid API was called.
 - Worker/model restart and lease recovery are proven generically by AI-001 tests but not run with a real Strategy model.
 - MariaDB execution, production queue telemetry, selected-model timeout/quality benchmarks, notification navigation and deployment rollback remain unverified.
- Cross-feature monthly token/cost accounting remains incomplete; the durable operation row prevents duplicate work and records execution provenance, but is not a billing ledger.
+- The Strategy operation now participates in the central monthly usage ledger. Older synchronous AI endpoints outside this workflow remain a separate POL-001 completion item.

 ## Rollback