docs(ai): record strategy queue evidence

docs/work-programmes/decisions.md

@@ -289,3 +289,13 @@
 - **Consequences:** `AI_ROUTING_MODE` supports `local_only`, `local_first` and explicitly gated `external_only`; invalid values fail closed. New durable task IDs stay local until allowlisted. The current circuit is process-local and one AI worker is the effective single-model concurrency limit. Per-request prompt size limits external spend/exposure, but complete monthly cross-feature accounting and model selection remain rollout gates.
 - **User approval required:** No; this directly implements the approved local-first programme without invoking a provider or production service.
 - **Reversible:** Yes. Set `EXTERNAL_AI_ENABLED=false` or `AI_ROUTING_MODE=local_only`; the older `AI_PROVIDER`/model configuration is retained. Existing nullable operation fields and AI history remain readable.
+
+## DEC-030 — Strategy generation is one typed operation and one structured inference
+
+- **Date:** 2026-08-09
+- **Decision:** Make Focus Plan GET cache-only and move generation to typed `strategy.snapshot` work on the shared queue. Encode only job and at most four attachment IDs, reuse active operations, and replace four sequential model calls with one bounded JSON response whose complete shape is validated before the unique cache row is updated. Keep Strategy absent from the external fallback allowlist.
+- **Reason/evidence:** the traced button/GET path owned four serial model calls and had no restart/cancel/retry identity. AI-001/002 already provide every needed state/policy/routing primitive. One structured inference reduces timeout exposure and makes publication atomic without a second queue or schema.
+- **Alternatives considered:** increase HTTP/proxy timeouts; keep GET as a command; add a Strategy queue/table; store prompts/private text in operation payload; four model calls inside the worker; race external/local providers. These retain the root failure, duplicate infrastructure/private data/output, or violate established routing safety.
+- **Consequences:** existing cached `FocusPlanDto` remains readable, while generation now returns 202 and the UI resumes by operation ID/context. Retry can overwrite only the same unique result row. Worker activation and real-model tuning remain rollout gates; operation records provide deduplication/provenance, not full monthly billing accounting.
+- **User approval required:** No; both programmes explicitly require durable Strategy work and consolidation with AI-001/002.
+- **Reversible:** Yes. Keep the worker off and revert `a621226`; no schema/dependency changed. Cancel or drain queued `strategy.snapshot` rows before removing the handler.

docs/work-programmes/master-progress.md

@@ -2,21 +2,21 @@
 
 Updated: 2026-08-09
 
-- **Overall programme status:** Active. Six packages are locally verified; twelve packages through AI-002 are implemented with automated/runtime evidence but blocked from later browser/provider/production gates; AI-003 is now in progress.
-- **Current work package:** `AI-003` — Strategy Snapshot durable-operation migration (`IN PROGRESS`), reusing AI-001 operations and AI-002 routing rather than creating a Strategy-specific queue.
-- **Completed work packages:** None are `DONE`; all repository security packages still have applicable browser, provider and/or production gates.
+- **Overall programme status:** Active. Six packages are locally verified; thirteen packages through AI-003 are implemented with automated/runtime evidence but blocked from applicable browser/model/provider/production gates; AI-004 is in progress.
+- **Current work package:** `AI-004` — CV-processing 504 durable-operation migration (`IN PROGRESS`), reusing the shared operation/notification/routing foundation and preserving the review gate.
+- **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates.
 - **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001 and PROD-002 (`VERIFIED LOCALLY`).
-- **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001 and AI-002 (`IMPLEMENTED — NOT VERIFIED`): foundations through bounded local-first routing pass local checks; real producers, browser, selected-model/provider, accounting and production gates remain.
+- **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003 (`IMPLEMENTED — NOT VERIFIED`). AI-003 now has a real typed producer/handler and explicit durable UI states, but its worker remains default-off pending rollout gates.
 - **Production-verified work:** None.
-- **Blocked work:** SEC-006 requires explicit internet/package-index permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Browser access was denied by the browser admin policy check; SMTP/MariaDB environments are unavailable.
-- **Deferred work:** None. Conditional large abstractions, model deletion, multi-replica coordination and unrelated production changes remain outside current packages.
-- **Next five work packages:** AI-003 Strategy Snapshot queue migration; AI-004 CV processing queue migration; UX-001 authentication/theme corrections; QA-001 job-analysis/keyword quality; UX-002 Career Workspace/CV Builder redesign. SEC-006/007 resume after package-index permission.
-- **Status counts:** 6 `VERIFIED LOCALLY`; 12 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 15 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
-- **Test status:** backend 588/588; AI-002 focused provider/privacy/queue/history 26/26; frontend baseline 47/47 suites and 158/158 tests plus build; Python sidecar 22/22. Compose and patch checks pass. Prior POL/PROD/OPS/BG/SEC/CORE evidence remains green.
-- **Deployment status:** No deployment performed. No production migrations were run.
-- **Production status:** Unchanged and unverified. Pre-existing Docker development services on 3000/5202 were observed and left untouched.
-- **Known regressions:** No known regression from the implemented packages. AI-002 preserves local behavior, defaults external consent off, performs no parallel provider race and records actual provenance. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before the new migration; normal startup owns reconciliation. Complete cross-feature monthly usage accounting remains a pre-rollout gap.
-- **Outstanding security findings:** JT-001 repository ownership is implemented but remains High deployment risk until migration/inventory/provider checks; production portion of JT-002; JT-006, JT-009 and associated JT-011/JT-012/JT-022 prerequisites. JT-005 owner foundation is implemented but workers remain off until persistent notification, entitlement and privacy gates. JT-007/JT-008/JT-010 repository behavior is not fully browser/provider/production verified.
+- **Blocked work:** SEC-006 requires explicit internet/package-index permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Browser access is denied by browser administrator policy; SMTP/MariaDB environments are unavailable.
+- **Deferred work:** None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages.
+- **Next five work packages:** AI-004 CV processing; UX-001 authentication/theme corrections; QA-001 job-analysis/keyword quality; UX-002 Career Workspace/CV Builder redesign; MAIL-001 consolidated email experience. SEC-006/007 resume after package-index permission.
+- **Status counts:** 6 `VERIFIED LOCALLY`; 13 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 14 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`.
+- **Test status:** backend 592/592; AI-003 focused backend 34/34; frontend 47/47 suites and 160/160 tests, AI-003 focused 6/6, production build pass; prior sidecar 22/22. Patch check passes. Browser/model/MariaDB/production checks were not run.
+- **Deployment status:** No deployment performed. No production migrations were run. AI operation worker remains disabled by default.
+- **Production status:** Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred.
+- **Known regressions:** None found by automated suites. Jest still needs `--forceExit` and reports its existing open-handle notice. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap.
+- **Outstanding security findings:** JT-001 repository ownership remains High deployment risk until migration/inventory/provider checks; production portion of JT-002; JT-006/JT-009 and associated JT-011/JT-012/JT-022 prerequisites. JT-005 foundations are implemented; AI worker activation awaits controlled rollout. JT-007/JT-008/JT-010 lack browser/provider/production verification.
 
 ## Current evidence
 
@@ -39,5 +39,6 @@ Updated: 2026-08-09
 - `docs/verification/pol-002-ai-privacy.md`
 - `docs/verification/ai-001-durable-ai-queue.md`
 - `docs/verification/ai-002-provider-routing.md`
+- `docs/verification/ai-003-strategy-snapshot-queue.md`
 - `docs/verification/prod-002-ai-evaluation.md`
 - `docs/work-programmes/master-work-plan.md`

docs/work-programmes/master-work-plan.md

@@ -16,7 +16,7 @@ Allowed statuses are `NOT STARTED`, `IN PROGRESS`, `IMPLEMENTED — NOT VERIFIED
 
 `DONE` requires every applicable acceptance criterion, focused and regression tests, browser/accessibility/theme/mobile checks, tenant and entitlement checks, documentation, migration/rollback evidence, and production verification. Repository-only work that still requires production is at most `VERIFIED LOCALLY`.
 
-Exactly one implementation item may be `IN PROGRESS`. As of this revision it is **AI-003**.
+Exactly one implementation item may be `IN PROGRESS`. As of this revision it is **AI-004**.
 
 ## Consolidated dependency order
 
@@ -523,11 +523,11 @@ Ordering differences from the suggested list:
 - **Required tests:** endpoint/handler/provider fakes, all required states, entitlement/privacy/tenant checks, E2E.
 - **Required browser verification:** complete queue/status/error/retry/cancel/refresh/back-forward/mobile/theme flow.
 - **Required production verification:** local model success, timeout and restart recovery.
-- **Status:** `IN PROGRESS`.
-- **Blocker:** browser and production checks remain unavailable, but repository tracing, handler/API implementation and fake-provider tests can proceed.
-- **Evidence:** reported timeout was code-traced as synchronous `/cv/rewrite` work; live browser/provider reproduction remains blocked and must not be inferred.
-- **Commit:** none.
-- **Remaining work:** do not build a Strategy-specific queue.
+- **Status:** `IMPLEMENTED — NOT VERIFIED`.
+- **Blocker:** browser localhost policy, selected local model, MariaDB, restart canary and production access remain unavailable; worker stays default-off.
+- **Evidence:** `docs/verification/ai-003-strategy-snapshot-queue.md`; verification-log V-101–V-103; `docs/audits/evidence/ai-003/README.md`.
+- **Commit:** `a621226` (`feat(ai): queue strategy snapshots`).
+- **Remaining work:** real browser/mobile/theme/refresh/back-forward checks; selected-model timeout/quality test; MariaDB and production single-worker restart/canary/rollback; complete cross-feature usage accounting. No Strategy-specific queue was created.
 
 ### AI-004 — CV-processing 504 and durable-operation migration
 
@@ -541,7 +541,7 @@ Ordering differences from the suggested list:
 - **Required tests:** safe synthetic PDFs/DOCX/images, proxy/backend/parser/provider failure, duplicate/refresh/restart, E2E.
 - **Required browser verification:** synthetic CV first; authorized private file via temporary local copy only, never logged/committed/external.
 - **Required production verification:** synthetic/local-only canary, no external payload, restart recovery.
-- **Status:** `NOT STARTED`.
+- **Status:** `IN PROGRESS`.
 - **Blocker:** security/queue dependencies; source file availability is not required for synthetic root-path work.
 - **Evidence:** audit parser path; reported private-file 504 not yet reproduced.
 - **Commit:** none.

docs/work-programmes/session-handoff.md

@@ -1,18 +1,18 @@
 # JobTracker session handoff
 
-Updated: 2026-08-03
+Updated: 2026-08-09
 
-- **Exact current task:** AI-002 — revalidate and implement the central local-first Ollama/provider routing policy using PROD-002 task classes, POL-002 consent gates and AI-001 execution context.
-- **Last completed step:** AI-001 added reusable Pro/privacy admission, bounded priority/capacity, typed default-off worker, owner/policy/cancellation recheck, heartbeat/timeout/retry handling and configuration. POL-002 immediately before it added persistent AI opt-out/external consent plus backend/sidecar gates. AI-002 is the sole `IN PROGRESS` item.
-- **Files currently modified:** all prior uncommitted programme work plus AI privacy settings/policy/controller/migration/UI/sidecar changes, `AiOperationQueue.cs`, queue tests/configuration and new architecture/verification/evidence/tracking documents. Pre-existing unrelated changes remain preserved.
-- **Commands already run this session:** targeted source tracing; backend builds; EF migration scaffold/pending-model/script/update attempts; focused/full backend tests; focused/full frontend tests; frontend production build; sidecar pytest; Compose config; diff checks. Exact POL-002 commands/results are V-089–V-095; AI-001 are V-096/V-097.
-- **Test results:** backend 581/581; AI-001 focused queue/state/API 17/17; frontend 47/47 suites and 158/158 tests plus production build; Python sidecar 18/18; Compose config and diff check pass. Browser was not run.
-- **Services currently running:** no process started in this session remains. The attempted temporary API launch command was rejected before execution. Pre-existing Docker development containers previously observed were not changed.
-- **Temporary files or processes:** no process remains. `tmp/pol002-migration.db` is a disposable partial SQLite migration rehearsal; it contains no user data and stopped at the pre-existing historical migration-chain defect. No startup-test files were created because the launch command was rejected.
-- **Production changes currently active:** none. No provider/model call, deployment, production configuration, model pull, paid service or production migration occurred.
-- **Rollback status:** all changes are repository-only and uncommitted. Set `EXTERNAL_AI_ENABLED=false` and `WORKER_AI_OPERATIONS_ENABLED=false` for immediate local-only/inactive behavior. The AI preference migration is additive; application rollback should retain its columns. AI-001 adds no schema.
-- **Uncommitted changes:** the worktree remains broadly dirty from user/prior programme work, including original `D .agent.md`, `?? AGENTS.md`, audit/todo trees and all completed package changes. Do not revert, reset, bulk-format or commit unrelated files.
-- **Known failures:** browser localhost denied; MariaDB/SMTP/production unavailable; SEC-006 package upgrades need explicit internet permission; direct clean EF-only SQLite migration fails before the new preference migration because historical `AddJobEntityAndProspectStages` expects startup reconciliation. No real AI task handler is registered and all AI workers remain off.
-- **Exact next action:** trace every `/summarize` and `/cv/*` call into one AI-002 task-routing matrix, then add actual-provider/result metadata and local health/circuit/fallback decisions to the AI-001 execution path without changing Strategy/CV producers yet.
-- **Work that can continue independently:** AI-002 repository adapter/routing tests with fake transports; then AI-003/004 typed producers/handlers. UX-001/QA-001 can proceed after foundations. SEC-006/007 require package-index permission; PROD-001/003/004 require production access.
-- **Decisions still required from the user:** none for repository-only AI-002 fake/local work. External/paid provider calls, package upgrades and production rollout/access still require explicit authority/configuration; SEC-009 deletion/retention needs the recorded retention/legal decision.
+- **Exact current task:** AI-004 — revalidate the CV upload/reprocess/rebuild/improve browser-to-parser-to-model path and migrate long work to the shared durable operation contract without bypassing human review.
+- **Last completed step:** AI-003 replaced synchronous Focus Plan GET generation with typed `strategy.snapshot` admission/handler/result persistence and explicit queue/cancel/retry/failure/completion UI. Implementation commit: `a621226`; evidence: V-101–V-103 and `docs/verification/ai-003-strategy-snapshot-queue.md`.
+- **Files currently modified:** none after the AI-003 implementation and tracking commits. Preserve any new user edits discovered on resume.
+- **Commands already run:** bounded source/document tracing; backend builds; focused backend tests; focused frontend tests; full backend/frontend suites; frontend production build; diff/status checks; staged and committed only AI-003 files. Exact results are V-101–V-103.
+- **Test results:** backend 592/592; AI-003 focused backend 34/34; frontend 47/47 suites and 160/160 tests; AI-003 UI 6/6; production frontend build pass; diff check pass. Fake model/synthetic data only.
+- **Services currently running:** none started by this session. The prior Node/Jest/build processes exited. Pre-existing Docker services were not changed.
+- **Temporary files or processes:** no new temporary file or process remains. A sandboxed build initially attempted a blocked NuGet restore; the approved build path reused/restored the existing local cache and passed. No dependency declaration changed.
+- **Production changes currently active:** none. No deployment, provider/model call, model pull, paid service, production migration or external payload occurred.
+- **Rollback status:** keep `Workers:AiOperationsEnabled=false`, revert `a621226`, and cancel/drain any queued `strategy.snapshot` rows before removing the handler. No AI-003 schema/dependency change; existing additive operation/note tables can remain.
+- **Uncommitted changes:** none expected after the tracking commit. Confirm with `git status --short --branch` before AI-004 edits.
+- **Known failures:** browser localhost denied; MariaDB/SMTP/production unavailable; SEC-006 upgrades require explicit internet/package-index permission; historical clean EF-only SQLite chain still requires startup reconciliation; Jest reports the existing force-exit/open-handle notice. Cross-feature monthly AI usage accounting is incomplete.
+- **Exact next action:** trace `ProfileCvController` upload/reprocess/rebuild/improve, `CvProcessingQueue`/worker, extraction-run/artifact persistence, sidecar parser/model calls, frontend polling and nginx/Traefik timeouts; classify which work is already durable and where 504 exposure remains before changing code.
+- **Work that can continue independently:** AI-004 repository tracing, safe synthetic fixtures, typed operation integration and fake-provider/parser tests. UX-001/QA-001 can follow foundations. SEC-006/007 await package-index permission; PROD-001/003/004 await production access.
+- **Decisions still required from the user:** none for repository-only AI-004 work using synthetic data/fakes. Internet/package upgrades, private CV access, external/paid providers and production actions still require the existing explicit authority and safety gates; SEC-009 retention/legal policy remains unresolved.