Add job and resume history with a direct resume-for-JD API #12

Why

The owner wants a dashboard history of jobs and the exact generated resumes, and a direct API that returns a resume for a JD. Current saved versions exist but dashboard does not show them; MCP drafts and unsaved UI generation disappear from dashboard history.

What

Add a plain JSON POST /api/resume using the same generation policy and auth/token controls. Authenticated calls save immutable output versions to existing job/resume tables by default; guests supply inline master/JD and remain stateless. Preserve default unsaved MCP compatibility while allowing an explicit save_to_history flag. Extend the existing dashboard Applications section into History with status filtering and links to all stored versions. Automatically record successful UI generations in guest local storage or owned cloud storage. Saved/edited drafts remain distinct versions; never mark a generated job applied or regress later application status.

Design

Preserve approved Precision Studio, landing and footer. Extend existing rows/disclosures and document view using native controls; no new page composition or nav redesign. Existing D1 tables and batch transactions; no dependencies or migrations. Route mutations call owner-scoped server actions. Keep original master intact. Plain JSON response exposes markdown, optional html, history save state and version URL. Auth remains the existing signed-in session; no API-key/OAuth access is invented.

Specs

• WHEN an authenticated caller sends an owned master and JD, THEN one generated version and its target job are saved atomically and returned with a history link; generation is not submission.
• WHEN a guest supplies master text/JD, THEN the API returns the resume without D1 writes; an explicit request for cloud history requires sign-in.
• WHEN requests or record IDs are invalid/unowned, THEN reject before AI/token use with no cross-user writes.
• WHEN generation fails, THEN no successful history record is created. WHEN saving history fails after generation, THEN return the generated resume with explicit unsaved state; do not regenerate silently.
• WHEN the dashboard opens, THEN users see their jobs and saved versions, filter applied/later stages, reopen older exact versions and export them. Guest history survives reload in that browser.
• WHEN an applied/interview/offer/rejected job receives another draft, THEN its application status stays unchanged.

Tasks

• Owner-scoped transactional history save/list and guest equivalents.
• Plain JSON API and opt-in MCP history compatibility; input and error contracts.
• Dashboard History and exact-version reopening in the established design; preflight and rendered checks.
• Automatic UI generation history and visible save failure recovery.
• Focused ownership/status/API/guest/version tests, full release verification, docs and raw real IO captures.
• Qualify successful current production resume generation after the shared gateway failure in Enforce resume identity and factual grounding before qualifying automatic tailoring #11 is resolved.
• Qualify authenticated production API persistence using a controlled signed-in session; local real SQL/action tests pass.

Shared gateway reliability and broad semantic summary quality remain open in #11. Actual external ChatGPT/OAuth client qualification is separate; no credentials are requested in chat. No commits/pushes. Deployment follows the owner's existing after-verification authorization.

Deployment and evidence — 8 October

Deployed Worker f467fa78-60c9-4e44-80bb-ea655f11f686 at 100% traffic; tag d22cd94-local-f87d90ef1107, verified uncommitted snapshot based on d22cd94. No commit/push, migration, secrets or production config change. Remote variables preserved; no CI/main parity claim.

643 unit tests, 30 built desktop/mobile E2E, typecheck/lint, full Cloudflare/Astro build, extension, route parity, docs and fresh design receipt pass. Six live public smoke checks pass on recheck after an initial timeout. Both live desktop/mobile guest History tests pass (synthetic fixtures; exact old source/reload, latest selection, applied filter, Markdown export). Landing overlay hash unchanged.

Fresh REST validation/auth guards pass; frontend/fullstack/agents generation all fail with HTTP 502 generation_failed. Local Worker generation failed too. Separate bounded remote-binding diagnostic reports provider_fatal, two attempts, including mistral/codestral-latest returning a malformed completion. No retry loop/provider override. This is a live-generation blocker, not evidence of working IO. Inputs/outputs: output/history-api-20261008. Older selected successful MCP samples remain historical, not current REST qualification. Shared reliability remains #11.

Guest UI history is browser-local; cloud master/history uses existing signed-in sessions. No API keys/external OAuth or real-account live persistence is claimed. Application status does not certify which exact resume was uploaded externally.

Current generation and auth checkpoint — 8 October follow-up

Current production generation now succeeds for frontend (actual owner-approved Codex MCP), backend and unsupported-role (REST) cases. All preserve the same 12 exact points, three projects, two pins, education and identity and return explicit stateless guest state. This qualifies current successful generation, while the original shared-gateway-resolution condition remains open: the cause of intermittent provider HTTP 400/403 failures is not established by three successes.

The owner explicitly authorized ordinary Google Auth. We attempted the normal sign-in flow; Google rejected the automated browser with “This browser or app may not be secure.” The accessible normal dashboard remained a guest, and the bounded isolated browser expired without a session. This is a browser/authentication limitation, not missing user permission. No password, OTP, cookies, session values, account fabrication or security bypass was used; no authenticated synthetic generation/write was dispatched.

Authenticated live persistence therefore remains unqualified and #12 remains open. Previously passing real-SQL/action tests and guest History/reload/export evidence are preserved; they do not substitute for a signed-in production save. No new deployment is needed for this docs/testing follow-up. Safe auth metadata: handoff results/evidence-10/auth-followup-checkpoint.json.

Account API connection follow-up — 8 October

Implement an explicit scoped bearer connection in existing Settings without a new primary workspace. Issue it only from an authenticated browser server action. The capability is HMAC-signed with the linked session's random token using a domain-separated message; it never reveals or accepts the browser session token. Scope is only /api/resume and /api/mcp; expire after at most 24 hours or the linked session expiry, whichever is earlier. Validate the session's current row and signature for every API request. Expired/revoked/forged bearer credentials must return 401 before any generation, billing or write, with no guest/cookie fallback. Use request-local AsyncLocalStorage for existing owner-scoped server actions. A disconnect action deletes only the current session row with user ownership enforced, revoking its issued capabilities and ending that browser session; no schema/config/secret change.

Settings explains that access can read owned masters, generate resumes using existing credits, and save History. Display token only after deliberate issuance; never persist it in browser storage, logs or examples. stdio accepts ROLEPATCH_API_TOKEN securely. Plain JSON API saves by default; MCP stays opt-in. This is an API-token/stdio connection, not ChatGPT OAuth support.

• Implement scoped expiry/signature/session validation and request isolation with no new dependency or migration.
• Add bounded Settings control with the approved design and explicit access/expiry/revocation wording.
• Exercise an actual local authenticated session issuance → bearer → owned master → saved exact History flow against local SQL.
• Verify wrong owner, forged/expired/revoked token, concurrent guests, charging/refund, and no use on unrelated routes.
• Qualify signed-in production save once browser control is available; it currently reports no browsers/apps.

Released remaining fixes — 8 October

Worker 42423168-40da-44d3-82d7-59de945e18e0 serves 100% traffic; tag d22cd94-local-92bd037e7916 identifies the verified uncommitted artifact. 670 unit tests, 32 built desktop/mobile E2E, full Cloudflare/Astro and extension builds, typecheck/lint, route parity, docs and preserve design receipt pass. Actual local Worker + isolated D1 + Better Auth qualifies token issuance, owned master and JD-only calls, exact stored versions, stdio MCP default-unsaved behavior, owner isolation and disconnect/old-token 401. No mocked auth/DB/API in that flow.

Four live guest Builder/History E2E and seven unchanged repository smoke assertions using native curl HTTP/1.1 pass. Three live synthetic JD cases return complete resumes preserving all points, projects, identity and education with summaries. No production cloud writes or application submissions. Fresh post-deploy landing browser navigation timed out before the entry controls; that handoff remains unqualified. The pre-release actual public-to-built-candidate CTA/onboarding/JD path passed and landing bytes remain unchanged. Default Node qualification transport had connection/body timeouts; failed checkpoints are retained. Native HTTP and actual Chromium establish these paths through a freshly verified public DNS IPv6 address selected only in test clients; no production DNS change, global availability or provider reliability claim.

Owner master also produced three inspected local outage-path samples: frontend achievements (Storybook, visual matching and Tailwind), backend/API ownership and agent runtime/RAG. Early samples selected stack metadata; source evidence now retains Markdown origin and favors real achievement bullets. Parser-based regressions and final outputs pass. These are local fallback evidence, not a semantic reranker benchmark.

No commit/push, migration, new production dependency, secret or production-config change. Existing remote vars and landing/footer preserved. No main/CI parity claim. Signed-in production persistence remains unqualified: normal browser control is unavailable, accessible isolated sessions are guests, and the owner's Google sign-in authorization remains granted. No credentials were copied or auth protections bypassed. ChatGPT OAuth remains unimplemented; released access supports finite scoped bearer API/stdio clients. Shared provider root cause remains open; fallback mitigates it without claiming repair.

The current-generation success path is requalified; the original upstream-repair condition is not claimed. #12 stays open for signed-in production qualification and any future ChatGPT/OAuth client support. ADR-0013 records scope and revocation.

Standard assistant OAuth follow-up — 8 October

Why and scope

The owner wants assistants to use the saved master and receive tailored resumes without manually supplying a browser cookie or copying credentials. The released finite bearer API is not a ChatGPT OAuth connection. Finish standard OAuth while keeping Resume Builder and Jobs as the only primary workspaces, the selected design, existing guest API/stdio compatibility, and exact resume/history policy.

Design

Use the maintained Better Auth 1.7.7 MCP provider with its JWT plugin rather than deprecated built-in OIDC or handwritten token issuance. Enable explicit DCR compatibility for current ChatGPT clients; do not claim the newer CIMD profile without a Workers-safe metadata transport. Use PKCE S256, exact redirect matching, explicit user consent, resource-bound scoped tokens, finite access/refresh lifetime, provider revocation and request-local owner identity. Protect owned tools with RFC 9728 discovery/challenges; preserve inline guest resume requests. Consent is a bounded state of existing optional Settings connection controls, not a new workspace. Add the provider's eight additive tables; existing auth/resume rows remain intact. The owner approved exact Better Auth/MCP 1.7.7 dependencies and the eight additive tables after verification; both are now deployed.

Requirements and scenarios

• WHEN an assistant discovers the resource, THEN advertised authorization and token endpoints are reachable and consistent with the MCP resource audience.
• WHEN a public client requests authorization, THEN PKCE is mandatory and explicit consent follows ordinary Google login; denying consent never issues tokens.
• WHEN a client exchanges a code with a wrong verifier, redirect or resource, or replays a consumed code, THEN reject without billing/generation/storage.
• WHEN a validated access token calls a tool, THEN existing actions use only its verified owner's master/history; arbitrary IDs and machine-only subjects are denied.
• WHEN a token is invalid, expired, revoked or lacks scope, THEN reject without cookie/guest downgrade and give the standards-based challenge.
• WHEN an existing bearer/guest client calls, THEN the shipped behavior remains compatible and cloud saving remains explicit for MCP.
• WHEN ordinary public navigation times out, THEN record the request phase and underlying failure rather than weakening the product assertions.

Tasks

• Inspect official current packages and prepare exact dependency and additive SQL previews; validate SQLite schema parity/repeatability.
• Owner explicitly approved production dependencies and verified additive migration.
• Implement and verify registration → synthetic real session → consent → PKCE exchange → owned tool → refresh → disconnect against actual isolated Worker/D1/provider, plus real SQLite negative/concurrent code replay. Actual Google login is separate.
• Preserve-design consent rendering at 390/768/1440, fresh iteration/final scans and check; guest/bearer regressions pass.
• Diagnose ordinary public request timeline; fresh complete landing/CTA/master onboarding/JD and responsive flow passes without DNS override.
• Qualify ordinary signed-in production UI generation and History persistence; synthetic generation, save, reopen, reload and exports pass on 11 October. Direct authenticated API persistence remains a separate unqualified gate.
• Full release verification and approved additive migration/deploy; live discovery/JWKS/auth guards and three complete guest resume IO pass.
• Qualify an actual external ChatGPT OAuth connection independently; actual owned-profile read and synthetic generation/save/reload pass on 12 October.

OAuth release checkpoint — 8 October

Worker 54bf7f32-2254-4540-a1e5-bf9535e384e0, 100% traffic; tag d22cd94-local-2303f21c791f, verified uncommitted snapshot based on d22cd94. Exact eight additive tables and field parity read back. A combined schema-readback query exceeded D1 SQL limits; separate statements verify every table, with the failed attempt retained. Existing resumes untouched by migration; remote vars, landing bytes and footer preserved. No commit/push, secrets or production-config change, no main/CI parity claim.

676 unit tests, 32 built desktop/mobile E2E, complete Worker/Astro/extension builds, typecheck/lint, 18 routes, local smoke, docs and preserve receipt pass. Actual isolated Worker/D1/Better Auth qualifies deliberate consent allow/deny, PKCE exchange, owned master listing, JD-only MCP unsaved and REST saved results, exact Jobs History, refresh and disconnect/old-token 401. Negative and concurrent replay checks use the actual provider and SQLite. No auth/DB/API mocks in the local Worker flow; its synthetic callback alone is intercepted.

Ordinary public DNS now passes seven unchanged smoke checks, full landing/CTA/master onboarding/JD/responsive handoff, OAuth resource/issuer metadata, public-only JWKS, disconnected tool challenges and invalid bearer rejection. Frontend/backend/agents live guest resume IO all return 200 and preserve complete points/projects/education/identity plus summary. Frontend discloses source_fallback; other two use AI. No live cloud resume writes or application submissions in these guest probes. Upstream provider repair is still not claimed (#11).

Dependency audit reports 21 advisories; production-path applicability was checked and patches tracked in #14. This is not a clean audit. Actual signed-in production persistence and external ChatGPT exchange remain pending; normal Chrome is newly accessible and the existing owner master/account is visible, without copying credentials.

Owner master and UI clarification — 8 October

The prepared owner master visible in Chrome is browser-local. One attempted guest-data import did not make it available in the cloud profile selector; no success is inferred from the banner returning without an error. Account transfer and signed-in generation/persistence remain open. Existing cloud synthetic profiles/jobs remain preserved. No new generation or application submission was dispatched in this checkpoint.

The owner rejected the current app visually and requested shadcn/ui. New direction previews and the two-workspace redesign are tracked in #15; owner selection is pending before production UI implementation. Released OAuth and historical verification remain intact.

Signed-in UI checkpoint — 11 October

The personal Google session passed a controlled synthetic generate → save → History → reopen → full reload check, with TXT, HTML, Word (.doc) and PDF exports. These are current production UI and account-backed History results; they do not qualify a finite-bearer direct API call or an external ChatGPT OAuth connection. No real job application was submitted. Those client/API gates keep this issue open.

External ChatGPT OAuth checkpoint — 12 October

The owner approved the prepared RolePatch connection with the exact resume scope. Ordinary ChatGPT discovery/registration and the existing personal Google session reached RolePatch consent, then returned successfully to the connected ChatGPT plugin. An actual rolepatch_resume_profiles call listed owned profiles without supplying their IDs in the request.

One authorized rolepatch_tailor_resume call used only the existing Synthetic Platform Resume fixture, a synthetic Platform Engineer vacancy and save_to_history: true. It returned AI-generated Markdown, explicit review-required/persisted state and an exact version link. Independent signed-in RolePatch Jobs showed the new Fleet OAuth QA 2026-10-12 job with one saved version. Opening that version, fully reloading it and inspecting the editor confirmed all 1,389 Markdown characters exactly matched the ChatGPT result; the rendered resume and selected version URL also remained identical across reload. One credit was consumed (20 → 19); no purchase, real application, master edit or repeat generation occurred.

Job: f834e823-bf83-45de-a296-48ccb2ebbe77. Saved version: ed8c7b94-5d45-4ee8-9772-e39bd01b218e. This qualifies external OAuth MCP owner access and saved History persistence. Finite-bearer direct REST API persistence remains a separate open gate, and this success does not establish repair of the intermittent shared provider failure in #11. A Jobs-row Download Markdown click produced no confirmed file/download event; export success is not claimed for this new OAuth fixture. Earlier qualified signed-in UI exports remain separate evidence.

CI and direct-token checkpoint — 12 October

The CI secret is installed from the existing Fleet Infisical secret. PR #38 fixes reruns of the same source SHA by deploying the exact UUID emitted by Wrangler upload, retaining the full SHA tag. Exact-main CI and six deploy gates passed at eb355d0. Runs 38218537052 and 38218837704 both succeeded for that SHA, including production smoke checks; the latest Worker version 843f8a56-d733-43c9-9c39-89d4d629938c serves 100% traffic.

The existing ROLEPATCH_API_TOKEN in Fleet/dev still returns 401 on the account-required rolepatch_resume_profiles MCP call with the required transport headers. No direct-token generation or write was attempted and no credit was consumed by this check. The personal Google Settings connection panel is prepared for deliberate token replacement. Successful owner-scoped ChatGPT OAuth generation/save/reload and prior signed-in UI checks remain qualified independently.