jobtrackingapp/docs/verification/ai-003-strategy-snapshot-queue.md

AI-003 Strategy Snapshot durable operation

Updated: 2026-08-09

Status: IMPLEMENTED — NOT VERIFIED. Repository implementation and automated tests pass; browser, selected local model, MariaDB, restart canary and production rollout are not verified.

Revalidated execution path and root cause

The Overview button in JobDetailsDialog.tsx called candidate fit and GET /api/jobapplications/{id}/focus-plan concurrently. Opening the Focus Plan tab or pressing Regenerate called the same GET. JobApplicationsController.GetFocusPlan loaded owner-filtered job/profile/attachments, then performed four sequential model requests and wrote one AiWorkspaceNote before returning. Authorization and owner filters were present, but the browser request owned the complete workload: proxy/transport timeout or application restart lost the request, there was no stable operation ID, and refresh/double-click/cancel/retry had no durable contract. Live reproduction remains blocked; this is a confirmed code execution path, not a claimed browser reproduction.

Implemented contract

• GET /api/jobapplications/{jobId}/focus-plan is read-only and returns only the stable cached result or 404 strategy_not_generated.
• POST /api/jobapplications/{jobId}/focus-plan/operations validates the owner-scoped job, profile and up to four selected attachments, applies centralized Pro/privacy/capacity admission and returns 202 with the existing safe operation DTO/status URL.
• GET .../focus-plan/operation resumes the latest operation for the exact job/attachment context after navigation or refresh.
• Task strategy.snapshot stores only jobId|attachmentIds; job text, CV, notes, attachment text and prompts are rehydrated in the worker's owner scope and never copied into UserOperations.
• An active operation is reused. The next successful regeneration key includes the current cached-result timestamp; failed/cancelled work uses the existing safe retry API. A crash/retry overwrites the same unique AiWorkspaceNote, not a second output row.
• The handler makes one bounded structured generation request, validates the entire JSON shape before publishing, passes worker cancellation, records actual provider/model/route metadata and rejects embedded source instructions. Job text, profile text, structured profile and extracted attachment context have explicit ceilings.
• UI states cover queued, local processing, retry wait, approved-fallback wait, completed, failed, cancelled and cancellation requested, with cancel/retry actions. A request-version guard prevents a stale resume lookup from erasing a newly queued operation.
• The existing generic terminal notification is produced transactionally by the operation store. No email is sent.

strategy.snapshot is not in the external fallback allowlist, so it remains local-only even when a user has external consent. The worker switch remains off by default pending the production canary.

Automated evidence

• Focused backend Strategy/cache/queue/policy tests: 34/34.
• Strategy UI focused suite: 6/6.
• Full backend: 592/592.
• Full frontend: 47/47 suites, 160/160 tests.
• Frontend production build and git diff --check: pass; line-ending notices only.
• Tests use SQLite and fake model output. They cover 202/idempotent duplicate click, typed handler success/provenance, one stable result, malformed response/retry state/no partial output, owner isolation, queued/cancelled/failed/retry UI states and cached-result refresh.

Remaining gates

• Browser refresh, navigation, back/forward, mobile, light/dark and keyboard checks are blocked by localhost browser policy.
• No Ollama model, external provider, private CV, production service or paid API was called.
• Worker/model restart and lease recovery are proven generically by AI-001 tests but not run with a real Strategy model.
• MariaDB execution, production queue telemetry, selected-model timeout/quality benchmarks, notification navigation and deployment rollback remain unverified.
• Cross-feature monthly token/cost accounting remains incomplete; the durable operation row prevents duplicate work and records execution provenance, but is not a billing ledger.

Rollback

Keep Workers:AiOperationsEnabled=false, revert commit a621226, and retain the additive operation/note tables. No dependency, schema or migration changed. Any already queued strategy.snapshot rows should be cancelled or drained before removing the handler.