jobhunt-kit 0.3.0 → 0.5.0

package/plugins/jobhunt-kit/scripts/tracker.mjs

@@ -2,14 +2,15 @@
 // Local bookkeeping only. No network, credentials, or application sending here.
 import { DatabaseSync } from 'node:sqlite';
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdirSync, readFileSync, writeFileSync, existsSync, copyFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, existsSync } from 'node:fs';
 import { resolve, dirname, join } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+import { atomicWrite, localPath, MAX_JSON_BYTES, readBytes, readJSON, sha256 } from './files.mjs';
+import { schemaErrors, validateSchema } from './validation.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const now = () => new Date().toISOString();
 const hash = value => createHash('sha256').update(typeof value === 'string' ? value : JSON.stringify(value)).digest('hex');
-const readJSON = path => JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''));
 const need = (condition, message) => { if (!condition) throw new Error(message); };
 const text = value => typeof value === 'string' && value.trim().length > 0;
 const safeURL = value => {
@@ -25,12 +26,12 @@ export function initData(directory) {
   const dir = resolve(directory);
   // Never store candidate state in a plugin cache, including a locally loaded plugin.
   need(dir !== ROOT && !dir.startsWith(ROOT + '/') && !dir.startsWith(ROOT + '\\'), 'Data must be outside the plugin directory');
-  mkdirSync(dir, { recursive: true });
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
   for (const file of ['profile.json', 'policy.json', 'profile.md', 'intake.md']) {
-    if (!existsSync(join(dir, file))) copyFileSync(join(ROOT, 'templates', file), join(dir, file));
+    if (!existsSync(join(dir, file))) atomicWrite(join(dir, file), readFileSync(join(ROOT, 'templates', file)), { base: dir });
   }
   for (const folder of ['resumes', 'materials', 'reports']) mkdirSync(join(dir, folder), { recursive: true });
-  writeFileSync(join(dir, '.gitignore'), '*\n');
+  if (!existsSync(join(dir, '.gitignore'))) atomicWrite(join(dir, '.gitignore'), '*\n', { base: dir });
   const store = new Tracker(dir);
   store.close();
   return { data: dir, initialized: true, profile: 'empty unless previously populated' };
@@ -39,11 +40,12 @@ export function initData(directory) {
 export class Tracker {
   constructor(directory) {
     this.dir = resolve(directory);
-    need(existsSync(join(this.dir, 'profile.json')), 'Run init first');
-    this.db = new DatabaseSync(join(this.dir, 'history.sqlite'));
+    need(existsSync(localPath(this.dir, 'profile.json')), 'Run init first');
+    this.db = new DatabaseSync(localPath(this.dir, 'history.sqlite'));
     const version = this.db.prepare('PRAGMA user_version').get().user_version;
-    if (![0, 1].includes(version)) { this.db.close(); throw new Error('Unsupported database version; explicit migration required'); }
-    this.db.exec(`PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL;
+    if (![0, 1, 2].includes(version)) { this.db.close(); throw new Error('Unsupported database version; explicit migration required'); }
+    this.db.exec('PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL;');
+    if (version === 0) this.db.exec(`
       CREATE TABLE IF NOT EXISTS runs(id TEXT PRIMARY KEY, started_at TEXT NOT NULL, finished_at TEXT,
         status TEXT NOT NULL, profile_hash TEXT NOT NULL, input TEXT NOT NULL, result TEXT);
       CREATE TABLE IF NOT EXISTS jobs(id TEXT PRIMARY KEY, canonical_url TEXT UNIQUE NOT NULL,
@@ -52,11 +54,47 @@ export class Tracker {
       CREATE TABLE IF NOT EXISTS observations(id INTEGER PRIMARY KEY, run_id TEXT NOT NULL REFERENCES runs(id),
         job_id TEXT NOT NULL REFERENCES jobs(id), at TEXT NOT NULL, payload TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS attempts(id TEXT PRIMARY KEY, job_id TEXT UNIQUE NOT NULL REFERENCES jobs(id),
-        started_at TEXT NOT NULL, mode TEXT NOT NULL, packet TEXT NOT NULL, result TEXT);
+        started_at TEXT NOT NULL, mode TEXT NOT NULL, packet TEXT NOT NULL, result TEXT,
+        policy_hash TEXT, application_snapshot TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS dispatches(attempt_id TEXT PRIMARY KEY REFERENCES attempts(id), at TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS events(id INTEGER PRIMARY KEY, at TEXT NOT NULL, kind TEXT NOT NULL,
         job_id TEXT, run_id TEXT, payload TEXT NOT NULL);
-      PRAGMA user_version=1;`);
+      CREATE UNIQUE INDEX IF NOT EXISTS one_running_search ON runs(status) WHERE status='running';
+      CREATE TABLE IF NOT EXISTS file_revisions(name TEXT PRIMARY KEY, revision INTEGER NOT NULL, sha256 TEXT NOT NULL, updated_at TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS pending_file_writes(id TEXT PRIMARY KEY, name TEXT NOT NULL, old_sha256 TEXT NOT NULL,
+        new_sha256 TEXT NOT NULL, content TEXT NOT NULL, event_kind TEXT NOT NULL, event_payload TEXT NOT NULL, created_at TEXT NOT NULL,
+        UNIQUE(name));
+      CREATE TABLE IF NOT EXISTS schema_migrations(version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL, details TEXT NOT NULL);
+      INSERT OR IGNORE INTO schema_migrations VALUES(2,datetime('now'),'fresh schema v2');
+      PRAGMA user_version=2;`);
+    if (version === 1) this.migrateV1();
+    this.db.exec('CREATE UNIQUE INDEX IF NOT EXISTS one_pending_write_per_file ON pending_file_writes(name)');
+    this.db.exec("CREATE TABLE IF NOT EXISTS schema_migrations(version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL, details TEXT NOT NULL)");
+    this.db.prepare('INSERT OR IGNORE INTO schema_migrations VALUES(?,?,?)').run(2, now(), 'schema v2 registered');
+    this.recoverFileWrites();
+    this.seedFileRevision('profile.json');
+    this.seedFileRevision('policy.json');
+  }
+  migrateV1() {
+    this.transaction(() => {
+      const running = this.db.prepare("SELECT id FROM runs WHERE status='running' ORDER BY started_at DESC").all();
+      for (const row of running.slice(1)) {
+        const result = { status: 'blocked', reason: 'Closed during schema v2 migration because another newer search was active' };
+        this.db.prepare("UPDATE runs SET status='blocked',finished_at=?,result=? WHERE id=?").run(now(), JSON.stringify(result), row.id);
+      }
+      this.db.exec(`ALTER TABLE attempts ADD COLUMN policy_hash TEXT;
+        ALTER TABLE attempts ADD COLUMN application_snapshot TEXT;
+        UPDATE attempts SET application_snapshot=json_object('legacy',1,'packet',json(packet)) WHERE application_snapshot IS NULL;
+        CREATE UNIQUE INDEX one_running_search ON runs(status) WHERE status='running';
+        CREATE TABLE file_revisions(name TEXT PRIMARY KEY, revision INTEGER NOT NULL, sha256 TEXT NOT NULL, updated_at TEXT NOT NULL);
+        CREATE TABLE pending_file_writes(id TEXT PRIMARY KEY, name TEXT NOT NULL, old_sha256 TEXT NOT NULL,
+          new_sha256 TEXT NOT NULL, content TEXT NOT NULL, event_kind TEXT NOT NULL, event_payload TEXT NOT NULL, created_at TEXT NOT NULL,
+          UNIQUE(name));
+        CREATE TABLE schema_migrations(version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL, details TEXT NOT NULL);
+        PRAGMA user_version=2;`);
+      this.db.prepare('INSERT INTO schema_migrations VALUES(?,?,?)').run(2, now(), JSON.stringify({ from: 1, closed_duplicate_runs: running.slice(1).map(row => row.id) }));
+      this.event('schema_migrated', { from: 1, to: 2, closed_duplicate_runs: running.slice(1).map(row => row.id) });
+    });
   }
   close() { this.db.close(); }
   transaction(fn) {
@@ -68,8 +106,60 @@ export class Tracker {
     this.db.prepare('INSERT INTO events(at,kind,job_id,run_id,payload) VALUES(?,?,?,?,?)')
       .run(now(), kind, job, run, JSON.stringify(payload));
   }
+  seedFileRevision(name) {
+    const path = localPath(this.dir, name);
+    const digest = sha256(readBytes(path, { base: this.dir }));
+    this.db.prepare('INSERT OR IGNORE INTO file_revisions VALUES(?,?,?,?)').run(name, 1, digest, now());
+  }
+  recoverFileWrites() {
+    if (!this.db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='pending_file_writes'").get()) return;
+    for (const row of this.db.prepare('SELECT * FROM pending_file_writes ORDER BY created_at').all()) {
+      this.transaction(() => {
+        const pending = this.db.prepare('SELECT * FROM pending_file_writes WHERE id=?').get(row.id);
+        if (!pending) return;
+        const path = localPath(this.dir, pending.name);
+        const actual = existsSync(path) ? sha256(readBytes(path, { base: this.dir })) : null;
+        if (actual !== pending.new_sha256 && actual !== pending.old_sha256) throw new Error(`Managed file ${pending.name} changed during an interrupted write; inspect it before continuing`);
+        if (actual !== pending.new_sha256) atomicWrite(path, pending.content, { base: this.dir });
+        const revision = (this.db.prepare('SELECT revision FROM file_revisions WHERE name=?').get(row.name)?.revision || 0) + 1;
+        this.db.prepare('INSERT INTO file_revisions VALUES(?,?,?,?) ON CONFLICT(name) DO UPDATE SET revision=excluded.revision,sha256=excluded.sha256,updated_at=excluded.updated_at')
+          .run(pending.name, revision, pending.new_sha256, now());
+        this.event(pending.event_kind, { ...JSON.parse(pending.event_payload), revision, sha256: pending.new_sha256, recovered_interrupted_write: true });
+        this.db.prepare('DELETE FROM pending_file_writes WHERE id=?').run(pending.id);
+      });
+    }
+  }
+  writeManagedJSON(name, value, { expectedSha256, eventKind, eventPayload = {} }) {
+    need(['profile.json', 'policy.json'].includes(name), 'Unsupported managed file');
+    const path = localPath(this.dir, name);
+    const content = JSON.stringify(value, null, 2) + '\n';
+    need(Buffer.byteLength(content, 'utf8') <= MAX_JSON_BYTES, `${name} serialized output exceeds the ${MAX_JSON_BYTES} byte limit`);
+    const newDigest = sha256(content);
+    const id = randomUUID();
+    this.transaction(() => {
+      const oldDigest = sha256(readBytes(path, { base: this.dir }));
+      need(!expectedSha256 || oldDigest === expectedSha256, `${name} changed concurrently; reload and retry`);
+      this.db.prepare('INSERT INTO pending_file_writes(id,name,old_sha256,new_sha256,content,event_kind,event_payload,created_at) VALUES(?,?,?,?,?,?,?,?)')
+        .run(id, name, oldDigest, newDigest, content, eventKind, JSON.stringify(eventPayload), now());
+    });
+    const revision = this.transaction(() => {
+      const pending = this.db.prepare('SELECT * FROM pending_file_writes WHERE id=?').get(id);
+      need(pending, `${name} write was superseded; reload and retry`);
+      const actual = sha256(readBytes(path, { base: this.dir }));
+      need(actual === pending.old_sha256 || actual === pending.new_sha256, `${name} changed concurrently; reload and retry`);
+      if (actual !== pending.new_sha256) atomicWrite(path, pending.content, { base: this.dir });
+      const revision = (this.db.prepare('SELECT revision FROM file_revisions WHERE name=?').get(name)?.revision || 0) + 1;
+      this.db.prepare('INSERT INTO file_revisions VALUES(?,?,?,?) ON CONFLICT(name) DO UPDATE SET revision=excluded.revision,sha256=excluded.sha256,updated_at=excluded.updated_at')
+        .run(name, revision, newDigest, now());
+      this.event(eventKind, { ...eventPayload, revision, sha256: newDigest });
+      this.db.prepare('DELETE FROM pending_file_writes WHERE id=?').run(id);
+      return revision;
+    });
+    return { revision, sha256: newDigest };
+  }
   profile(requireReady = true) {
-    const profile = readJSON(join(this.dir, 'profile.json'));
+    const profile = readJSON(localPath(this.dir, 'profile.json'), { base: this.dir });
+    validateSchema('profile', profile);
     need(profile.schema_version === 1, 'Unsupported profile schema');
     if (requireReady) {
       need(text(profile.confirmed_at) && Number.isFinite(Date.parse(profile.confirmed_at)), 'Candidate must confirm profile before search/apply');
@@ -83,26 +173,34 @@ export class Tracker {
     return { ...row, payload: JSON.parse(row.payload), draft: row.draft && JSON.parse(row.draft), approval: row.approval && JSON.parse(row.approval) };
   }
   runStart(input) {
-    const p = this.profile();
-    const id = randomUUID();
-    this.db.prepare('INSERT INTO runs VALUES(?,?,NULL,?,?,?,NULL)').run(id, now(), 'running', p.hash, JSON.stringify(input));
-    return { run_id: id, profile_hash: p.hash };
+    return this.transaction(() => {
+      need(!this.db.prepare("SELECT id FROM runs WHERE status='running'").get(), 'Finish or recover the previous running search before starting another');
+      const p = this.profile();
+      const id = randomUUID();
+      this.db.prepare('INSERT INTO runs VALUES(?,?,NULL,?,?,?,NULL)').run(id, now(), 'running', p.hash, JSON.stringify(input));
+      return { run_id: id, profile_hash: p.hash };
+    });
   }
   runEvent(input) {
-    need(this.db.prepare('SELECT id FROM runs WHERE id=?').get(input.run_id), 'Unknown run');
     need(text(input.kind), 'Event kind required');
-    this.event(input.kind, input.data ?? {}, null, input.run_id);
-    return { recorded: true };
+    return this.transaction(() => {
+      need(this.db.prepare("SELECT id FROM runs WHERE id=? AND status='running'").get(input.run_id), 'Unknown or finished run');
+      this.event(input.kind, input.data ?? {}, null, input.run_id);
+      return { recorded: true };
+    });
   }
   runFinish(input) {
     need(['complete', 'partial', 'blocked', 'failed'].includes(input.status), 'Invalid run result');
     need(text(input.reason), 'Run stop reason required');
-    const result = this.db.prepare('UPDATE runs SET status=?,finished_at=?,result=? WHERE id=? AND status=?')
-      .run(input.status, now(), JSON.stringify(input), input.run_id, 'running');
-    need(result.changes === 1, 'Unknown or already finished run');
-    return { recorded: true };
+    return this.transaction(() => {
+      const result = this.db.prepare('UPDATE runs SET status=?,finished_at=?,result=? WHERE id=? AND status=?')
+        .run(input.status, now(), JSON.stringify(input), input.run_id, 'running');
+      need(result.changes === 1, 'Unknown or already finished run');
+      return { recorded: true };
+    });
   }
   put(input) {
+    validateSchema('vacancy', input);
     need(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(input.slug), 'Invalid slug');
     need(text(input.title), 'Title required');
     const canonical = safeURL(input.original_url || input.url);
@@ -140,6 +238,7 @@ export class Tracker {
     return this.transaction(() => {
       const job = this.job(input.slug);
       need(['discovered', 'draft', 'needs_user', 'approved'].includes(job.status), 'Vacancy cannot be drafted in this status');
+      validateSchema('draft', input);
       const p = this.profile();
       need(job.payload.profile_hash === p.hash, 'Reassess vacancy for current profile');
       need(['suitable', 'review'].includes(job.payload.match.verdict), 'Vacancy must be assessed first');
@@ -167,7 +266,9 @@ export class Tracker {
     });
   }
   policy(input) {
-    const current = readJSON(join(this.dir, 'policy.json'));
+    const path = localPath(this.dir, 'policy.json');
+    const currentBytes = readBytes(path, { base: this.dir });
+    const current = JSON.parse(currentBytes.toString('utf8').replace(/^\uFEFF/, ''));
     need(['review_each', 'auto'].includes(input.mode), 'Invalid policy mode');
     if (input.mode === 'auto') {
       need(text(input.auto?.user_authorization), 'Explicit scoped user authorization required');
@@ -176,8 +277,11 @@ export class Tracker {
       need(input.auto.profile_hash === this.profile().hash, 'Auto authorization must bind current profile hash');
     }
     const policy = { ...current, mode: input.mode, auto: input.mode === 'auto' ? input.auto : null };
-    writeFileSync(join(this.dir, 'policy.json'), JSON.stringify(policy, null, 2) + '\n');
-    this.event('policy_changed', policy);
+    validateSchema('policy', policy);
+    const autoAudit = policy.auto && { profile_hash: policy.auto.profile_hash, expires_at: policy.auto.expires_at,
+      max_attempts_per_utc_day: policy.auto.max_attempts_per_utc_day };
+    this.writeManagedJSON('policy.json', policy, { expectedSha256: sha256(currentBytes), eventKind: 'policy_changed',
+      eventPayload: { mode: policy.mode, auto: autoAudit } });
     return policy;
   }
   begin(input) {
@@ -192,17 +296,19 @@ export class Tracker {
       need(Number.isInteger(p.profile.hirify_profile_id) && p.profile.hirify_profile_id > 0 && job.draft.hirify_profile_id === p.profile.hirify_profile_id, 'Confirm exact Hirify profile');
       need(p.profile.resume?.review_status === 'ready', 'Resume review not ready');
       need(text(p.profile.resume.path) && text(p.profile.resume.sha256), 'Resume file and fingerprint required');
-      const resume = resolve(this.dir, p.profile.resume.path);
+      const resume = localPath(this.dir, p.profile.resume.path);
       need(createHash('sha256').update(readFileSync(resume)).digest('hex') === p.profile.resume.sha256, 'Resume file changed; review and update profile');
       const policy = readJSON(join(this.dir, 'policy.json'));
       const approved = job.approval?.draft_hash === hash(job.draft);
       let mode = 'review_each';
+      let policyHash = null;
       if (!approved) {
         mode = 'auto';
         const auto = policy.auto;
         need(policy.mode === 'auto' && auto && text(auto.user_authorization), 'Explicit approval required');
         need(auto.profile_hash === p.hash && Date.parse(auto.expires_at) > Date.now(), 'Auto authorization expired or profile changed');
         need(Number.isInteger(auto.max_attempts_per_utc_day) && auto.max_attempts_per_utc_day > 0, 'Invalid auto cap');
+        policyHash = hash(policy);
         const requirements = job.payload.match.requirements;
         need(Array.isArray(requirements) && requirements.length > 0 && requirements.every(r => r.result === 'pass' && text(r.evidence)), 'Auto mode requires all critical requirements checked');
         const used = this.db.prepare('SELECT COUNT(*) AS count FROM attempts WHERE started_at>=?').get(now().slice(0, 10)).count;
@@ -210,20 +316,24 @@ export class Tracker {
       }
       // UNIQUE(job_id) is the durable duplicate-send guard, including unknown results.
       const attempt = randomUUID();
-      const packet = { ...job.draft, slug: job.payload.slug, mode, attempt_id: attempt };
-      this.db.prepare('INSERT INTO attempts VALUES(?,?,?,?,?,NULL)').run(attempt, job.id, now(), mode, JSON.stringify(packet));
+      const applicationSnapshot = { vacancy: job.payload, draft: job.draft, profile_hash: p.hash, created_at: now() };
+      const packet = { ...job.draft, slug: job.payload.slug, mode, attempt_id: attempt, policy_hash: policyHash, application_snapshot_hash: hash(applicationSnapshot) };
+      this.db.prepare('INSERT INTO attempts(id,job_id,started_at,mode,packet,result,policy_hash,application_snapshot) VALUES(?,?,?,?,?,NULL,?,?)')
+        .run(attempt, job.id, now(), mode, JSON.stringify(packet), policyHash, JSON.stringify(applicationSnapshot));
       this.db.prepare('UPDATE jobs SET status=?,updated_at=? WHERE id=?').run('submitting', now(), job.id);
       this.event('send_intent', { attempt_id: attempt, mode }, job.id);
       return packet;
     });
   }
   finish(input) {
+    validateSchema('finish', input);
     need(['submitted', 'failed', 'unknown'].includes(input.outcome), 'Invalid send outcome');
     need(text(input.evidence), 'Response or uncertainty evidence required');
     if (input.outcome === 'submitted') need(text(input.application_id), 'Successful Hirify response must include application ID');
     return this.transaction(() => {
       const attempt = this.db.prepare('SELECT * FROM attempts WHERE id=?').get(input.attempt_id);
       need(attempt, 'Unknown attempt');
+      if (['submitted', 'unknown'].includes(input.outcome)) need(this.db.prepare('SELECT attempt_id FROM dispatches WHERE attempt_id=?').get(attempt.id), 'Cannot record a network outcome before dispatch');
       if (attempt.result) {
         need(JSON.parse(attempt.result).outcome === input.outcome, 'Use resolve for an unknown result');
         return { unchanged: true };
@@ -243,10 +353,14 @@ export class Tracker {
       need(job.status === 'submitting' && job.id === attempt.job_id, 'Attempt is not pending');
       const p = this.profile();
       need(p.hash === packet.profile_hash && hash(job.payload) === packet.vacancy_hash, 'Profile or vacancy changed after begin');
-      need(createHash('sha256').update(readFileSync(resolve(this.dir, p.profile.resume.path))).digest('hex') === p.profile.resume.sha256, 'Resume changed after begin');
+      need(createHash('sha256').update(readFileSync(localPath(this.dir, p.profile.resume.path))).digest('hex') === p.profile.resume.sha256, 'Resume changed after begin');
       if (packet.mode === 'auto') {
-        const policy = readJSON(join(this.dir, 'policy.json'));
+        const policy = readJSON(localPath(this.dir, 'policy.json'), { base: this.dir });
+        const policyHash = hash(policy);
         need(policy.mode === 'auto' && policy.auto?.profile_hash === p.hash && Date.parse(policy.auto.expires_at) > Date.now(), 'Auto permission revoked or expired');
+        need(packet.policy_hash && attempt.policy_hash === packet.policy_hash && policyHash === packet.policy_hash, 'Auto permission changed after begin');
+        const used = this.db.prepare('SELECT COUNT(*) AS count FROM attempts WHERE started_at>=?').get(now().slice(0, 10)).count;
+        need(used <= policy.auto.max_attempts_per_utc_day, 'Auto daily cap changed after begin');
       } else need(job.approval?.draft_hash === hash(job.draft), 'Approval no longer valid');
       this.db.prepare('INSERT INTO dispatches VALUES(?,?)').run(attempt.id, now());
       this.event('cli_dispatch', { attempt_id: attempt.id }, job.id);
@@ -268,6 +382,7 @@ export class Tracker {
     });
   }
   status(input) {
+    validateSchema('status', input);
     const allowed = {
       discovered: ['dismissed', 'needs_user'], draft: ['dismissed', 'needs_user'],
       approved: ['dismissed', 'needs_user'], needs_user: ['dismissed', 'submitted_external'],
@@ -288,6 +403,43 @@ export class Tracker {
   list() {
     return this.db.prepare('SELECT * FROM jobs ORDER BY created_at DESC').all().map(r => ({ ...r, payload: JSON.parse(r.payload), draft: r.draft && JSON.parse(r.draft), approval: r.approval && JSON.parse(r.approval) }));
   }
+  attempts() {
+    return this.db.prepare('SELECT * FROM attempts ORDER BY started_at DESC').all().map(row => ({ ...row,
+      packet: JSON.parse(row.packet), result: row.result && JSON.parse(row.result), application_snapshot: JSON.parse(row.application_snapshot) }));
+  }
+  attemptPacket(attemptId) {
+    need(text(attemptId), 'Attempt id required');
+    const row = this.db.prepare('SELECT packet FROM attempts WHERE id=?').get(attemptId);
+    need(row, 'Unknown attempt');
+    return JSON.parse(row.packet);
+  }
+  integrity() {
+    const database = this.db.prepare('PRAGMA integrity_check').all().map(row => row.integrity_check);
+    const foreignKeys = this.db.prepare('PRAGMA foreign_key_check').all();
+    const files = {};
+    for (const [name, schema] of [['profile.json', 'profile'], ['policy.json', 'policy']]) {
+      try {
+        const value = readJSON(localPath(this.dir, name), { base: this.dir });
+        const errors = schemaErrors(schema, value);
+        const actual = sha256(readBytes(localPath(this.dir, name), { base: this.dir }));
+        const tracked = this.db.prepare('SELECT revision,sha256 FROM file_revisions WHERE name=?').get(name);
+        files[name] = { valid: errors.length === 0, errors, revision: tracked?.revision || null,
+          tracked_sha256_matches: tracked?.sha256 === actual };
+      } catch (error) { files[name] = { valid: false, errors: [error.message] }; }
+    }
+    return { schema_version: this.db.prepare('PRAGMA user_version').get().user_version,
+      database_ok: database.length === 1 && database[0] === 'ok', database, foreign_key_violations: foreignKeys,
+      files, running_runs: this.db.prepare("SELECT id,started_at FROM runs WHERE status='running'").all(),
+      unresolved_attempts: this.db.prepare("SELECT attempts.id,jobs.status,attempts.started_at FROM attempts JOIN jobs ON jobs.id=attempts.job_id WHERE jobs.status IN ('submitting','submission_unknown')").all(),
+      pending_file_writes: this.db.prepare('SELECT id,name,created_at FROM pending_file_writes').all(),
+      migrations: this.db.prepare('SELECT * FROM schema_migrations ORDER BY version').all() };
+  }
+  recover(input) {
+    need(input && typeof input === 'object', 'Recovery input required');
+    if (input.type === 'run') return this.runFinish({ run_id: input.run_id, status: input.status || 'blocked', reason: input.reason });
+    if (input.type === 'attempt') return this.resolveUnknown({ slug: input.slug, outcome: input.outcome, evidence: input.evidence, application_id: input.application_id });
+    throw new Error('Recovery type must be run or attempt');
+  }
   history() { return this.db.prepare('SELECT * FROM events ORDER BY id').all().map(r => ({ ...r, payload: JSON.parse(r.payload) })); }
   runs() { return this.db.prepare('SELECT * FROM runs ORDER BY started_at DESC').all().map(r => ({ ...r, input: JSON.parse(r.input), result: r.result && JSON.parse(r.result) })); }
   report() {
@@ -295,17 +447,20 @@ export class Tracker {
     const lines = ['# Поиск работы — локальный отчёт', '', `Обновлён: ${now()}`, '',
       'История SQLite; ответы работодателей вносятся по сообщению пользователя.', '',
       '| Вакансия | Статус | Совпадение / причины | Следующий шаг |', '|---|---|---|---|'];
+    const attempts = new Map(this.attempts().map(attempt => [attempt.job_id, attempt]));
     for (const job of this.list()) {
+      const snapshot = attempts.get(job.id)?.application_snapshot?.vacancy;
+      const shown = ['submitting', 'submission_unknown', 'submitted', 'failed', 'interview', 'rejected', 'withdrawn', 'offer', 'accepted', 'declined'].includes(job.status) && snapshot ? snapshot : job.payload;
       const next = ({ discovered: 'Проверить и подготовить', draft: 'Согласовать отклик', approved: 'Проверить квоту и отправить',
         needs_user: 'Ответы / ручной отклик', submitting: 'Проверить результат; не повторять', submission_unknown: 'Уточнить результат; не повторять',
         submitted: 'Ждать ответа', submitted_external: 'Ждать ответа', interview: 'Подготовиться к интервью', offer: 'Обсудить предложение' })[job.status] || 'Нет автоматического действия';
-      lines.push(`| ${esc(job.payload.title)} (${esc(job.payload.url)}) | ${job.status} | ${esc(job.payload.match.verdict)}: ${esc(job.payload.match.reasons?.join('; '))} | ${next} |`);
+      lines.push(`| ${esc(shown.title)} (${esc(shown.url)}) | ${job.status} | ${esc(shown.match.verdict)}: ${esc(shown.match.reasons?.join('; '))} | ${next} |`);
     }
     lines.push('', '## Запуски', '');
     for (const run of this.runs()) lines.push(`- ${run.started_at}: ${run.status}; ${esc(run.result?.reason || 'Не завершён — проверить журнал перед продолжением')}`);
     const content = lines.join('\n') + '\n';
     const path = join(this.dir, 'reports', 'latest.md');
-    writeFileSync(path, content);
+    atomicWrite(path, content, { base: this.dir });
     return { path, content };
   }
 }

package/plugins/jobhunt-kit/scripts/validation.mjs

@@ -0,0 +1,30 @@
+import Ajv2020 from 'ajv/dist/2020.js';
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const ajv = new Ajv2020({ allErrors: true, strict: true, allowUnionTypes: true });
+ajv.addFormat('date-time', value => typeof value === 'string' && /^\d{4}-\d{2}-\d{2}T/.test(value) && Number.isFinite(Date.parse(value)));
+ajv.addFormat('uri', value => {
+  try { const url = new URL(value); return Boolean(url.protocol); } catch { return false; }
+});
+
+const validators = new Map();
+for (const name of ['profile', 'policy', 'vacancy', 'draft', 'finish', 'status']) {
+  const schema = JSON.parse(readFileSync(join(ROOT, 'schemas', `${name}.schema.json`), 'utf8'));
+  validators.set(name, ajv.compile(schema));
+}
+
+export function validateSchema(name, value) {
+  const validate = validators.get(name);
+  if (!validate) throw new Error(`Unknown schema: ${name}`);
+  if (validate(value)) return value;
+  const detail = validate.errors.map(error => `${error.instancePath || '/'} ${error.message}`).join('; ');
+  throw new Error(`${name} schema: ${detail}`);
+}
+
+export function schemaErrors(name, value) {
+  try { validateSchema(name, value); return []; }
+  catch (error) { return [error.message]; }
+}

package/plugins/jobhunt-kit/skills/job-apply/SKILL.md

@@ -43,10 +43,12 @@ review_each: показать роль/компанию/ссылку, выбра
    не заменяют серверный профиль, и CLI не загружает локальное резюме автоматически.
    Если профиль Hirify неполон/изменился, сначала показать отличия кандидату.
 2. `begin` создаёт единственное намерение и возвращает attempt_id и точный пакет.
-   Сохранить вывод в D/materials/attempt.json. Begin не отправляет отклик.
+   CLI уже сохраняет пакет в уникальный `packet_path` вида
+   `D/materials/attempt-<attempt_id>.json`. Использовать именно возвращённый путь,
+   не переименовывать и не собирать пакет вручную. Begin не отправляет отклик.
 3. Только после успешного begin в этом процессе вызвать Hirify один раз. Чтобы не
    исказить кавычки/переносы письма, использовать
-   `node <P>/scripts/send-packet.mjs --data <D> <D>/materials/attempt.json`.
+   `node <P>/scripts/send-packet.mjs --data <D> <packet_path из begin>`.
    Команда проверяет сохранённое намерение, отмечает запуск до сети и вызывает CLI
    с `vacancy apply <slug> --profile <id> --cover <text> --json` массивом аргументов.
 4. По достоверному успеху сохранить finish submitted с application_id и кратким

package/plugins/jobhunt-kit/skills/job-resume/SKILL.md

@@ -20,8 +20,9 @@ findings; затем отдельно оценить вёрстку и факт
 с реальным форматом файла. Если парсер/рендер недоступен, указать границу проверки.
 Не загружать резюме в сторонний ATS-checker без разрешения пользователя.
 
-Сохранить результат по [шаблону отчёта](../../templates/resume-review.md) в
-D/materials/resume-review.md. Предлагать конкретные правки, не создавать достижения.
+Сохранить результат по [шаблону отчёта](../../templates/resume-review.md) в точный
+versioned `review_path`, возвращённый `resume check` (`D/materials/resume-<sha>/review.md`).
+Предлагать конкретные правки, не создавать достижения.
 Если запрошена правка, сохранить новую версию, проверить её и обновить путь, SHA-256
 и review_status в профиле. Повторно подтвердить изменённые факты с кандидатом.
 

package/plugins/jobhunt-kit/skills/job-track/SKILL.md

@@ -28,3 +28,11 @@ note (содержание, источник, дата). Не заявлять,
 
 Ничего не отправлять работодателям из скилла трекинга. Отмена локального статуса
 не отзывает отправленное через Hirify заявление. Напоминания — только пользователю.
+
+Для диагностики использовать doctor и recover inspect; recover apply закрывает run
+или подтверждает исход attempt только по переданному пользователем доказательству.
+Backup/restore всегда проверяют точный inventory manifest, SQLite и согласованность
+ревизий JSON; restore требует точную фразу и сохраняет сырой quarantine-снимок
+подтверждения. Privacy map и [карта данных](../../references/privacy.md) показывают
+размещение PII, export создаёт проверяемую копию, redact и purge требуют точных фраз,
+а purge ещё и обязательный backup_directory.

package/scripts/check-package.mjs

@@ -33,6 +33,13 @@ const codex = load(join(root, '.codex-plugin/plugin.json'));
 const claude = load(join(root, '.claude-plugin/plugin.json'));
 assert.equal(codex.name, 'jobhunt-kit'); assert.equal(claude.name, codex.name);
 assert.equal(codex.version, claude.version);
+assert.equal(load('package.json').version, codex.version);
+assert.equal(load('plugins/jobhunt-kit/package.json').version, codex.version);
+assert.equal(load('.claude-plugin/marketplace.json').plugins[0].version, codex.version);
+for (const name of ['profile', 'policy', 'vacancy', 'draft', 'finish', 'status']) {
+  const schema = load(join(root, 'schemas', `${name}.schema.json`));
+  assert.equal(schema.$schema, 'https://json-schema.org/draft/2020-12/schema');
+}
 for (const file of ['.agents/plugins/marketplace.json', '.claude-plugin/marketplace.json']) {
   const market = load(file);
   for (const plugin of market.plugins) {

package/scripts/pack-smoke.mjs

@@ -0,0 +1,53 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { delimiter, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const root = mkdtempSync(join(tmpdir(), 'jobhunt-pack-smoke-'));
+try {
+  const env = { ...process.env, npm_config_cache: join(root, 'npm-cache') };
+  const npmCli = process.env.npm_execpath;
+  if (!npmCli) throw new Error('Run this smoke check through npm run pack:smoke');
+  const runNpm = (args, options = {}) => execFileSync(process.execPath, [npmCli, ...args], { env, ...options });
+  const packed = JSON.parse(runNpm(['pack', '--json', '--pack-destination', root], { cwd: resolve('.'), encoding: 'utf8' }));
+  const archive = join(root, packed[0].filename);
+  const consumer = join(root, 'consumer');
+  mkdirSync(consumer);
+  execFileSync('tar', ['-xzf', archive, '-C', consumer], { stdio: 'pipe' });
+  const installed = join(consumer, 'package');
+  const { install } = await import(pathToFileURL(join(installed, 'bin', 'jobhunt-kit.mjs')));
+  const workspace = join(root, 'installed-workspace');
+  const result = install(workspace, { source: installed, installDependencies: false, agents: ['codex'] });
+  assert.equal(result.scope, 'project');
+  for (const name of ['ajv', 'fast-deep-equal', 'fast-uri', 'json-schema-traverse', 'require-from-string']) {
+    cpSync(resolve('node_modules', name), join(workspace, 'node_modules', name), { recursive: true });
+  }
+  const { runCommand } = await import(pathToFileURL(join(workspace, 'plugins', 'jobhunt-kit', 'scripts', 'commands.mjs')));
+  const initialized = runCommand(['profile', 'init', '--workspace', workspace], { cwd: workspace });
+  assert.equal(initialized.initialized, true);
+  const doctor = runCommand(['doctor', '--workspace', workspace], { cwd: workspace });
+  assert.equal(doctor.integrity.database_ok, true);
+  assert.equal(JSON.parse(readFileSync(join(workspace, 'plugins', 'jobhunt-kit', 'package.json'))).dependencies.ajv, '8.20.0');
+  const globalHome = join(root, 'global-home');
+  const global = install('.', { source: installed, installDependencies: false, agents: ['codex'], scope: 'global', home: globalHome });
+  const bundle = join(global.agents[0].path, 'bundle');
+  assert.equal(existsSync(join(bundle, 'node_modules')), false);
+  const globalData = join(root, 'global-data');
+  const fakeBin = join(root, 'fake-bin');
+  mkdirSync(fakeBin);
+  const fakeNpm = join(fakeBin, 'fake-npm.mjs');
+  writeFileSync(fakeNpm, `import { cpSync, mkdirSync, readdirSync } from 'node:fs';\nimport { join } from 'node:path';\nconst destination=join(process.cwd(),'node_modules');\nmkdirSync(destination,{recursive:true});\nfor(const name of readdirSync(process.env.JOBHUNT_SMOKE_MODULES)){if(name!=='.bin'&&name!=='jobhunt-kit')cpSync(join(process.env.JOBHUNT_SMOKE_MODULES,name),join(destination,name),{recursive:true});}\n`);
+  writeFileSync(join(fakeBin, 'npm.cmd'), `@echo off\r\n"${process.execPath}" "${fakeNpm}" %*\r\n`);
+  writeFileSync(join(fakeBin, 'npm'), `#!${process.execPath}\nimport '${fakeNpm.replaceAll('\\', '/')}';\n`, { mode: 0o755 });
+  const isolatedEnv = { ...env, PATH: `${fakeBin}${delimiter}${process.env.PATH}`, JOBHUNT_SMOKE_MODULES: resolve('node_modules') };
+  execFileSync(process.execPath, [join(bundle, 'scripts', 'setup.mjs'), '--data', globalData, '--install-cli'], { env: isolatedEnv, stdio: 'pipe', timeout: 60000 });
+  assert.equal(existsSync(join(bundle, 'node_modules', 'ajv')), true);
+  assert.equal(JSON.parse(readFileSync(join(globalData, 'profile.json'))).schema_version, 1);
+  console.log(`PACK_SMOKE_OK: ${packed[0].filename}, ${packed[0].entryCount} entries`);
+} finally {
+  const absolute = resolve(root);
+  assert.ok(absolute.startsWith(resolve(tmpdir())) && absolute.includes('jobhunt-pack-smoke-'));
+  rmSync(absolute, { recursive: true, force: true });
+}