Merge frontend redesign

Brings 122 commits of work that has been developed on the
`frontend-redesign` branch since main last shipped. Major themes:

Frontend
- Full landing page rebuild (hero, sticky-pinned workbench scroll
  narrative, single-tile bento carousel, footer)
- Workspace UI rebuild (Direction B): topbar with command palette,
  four-step rail, FAB assistant, hero band, dense sidebar
- Mobile-responsive cuts on both landing and workspace at
  iPhone-class viewports
- Conversational resume builder UI (chat-driven, with LLM
  structuring pass)

Backend / orchestration
- Cached jobs cache layer with scheduled refresh + Postgres RPC
  for relevance-ranked search
- Four ATS sources: Greenhouse (~117 boards), Lever (30 sites),
  Ashby (36 boards), Workday (11 Fortune 500 tenants)
- DOCX-first artifact export (classic_ats + professional_neutral
  themes); Markdown export removed
- Three-layer LLM retry stack (SDK retries + app retry + per-agent
  retry) with per-agent fallback isolation
- LLM-first JD parser with regex fallback

Workspace assistant
- Ungated chat (was previously locked until first analysis run)
- State-aware context — every query now carries `workspace_state`
  + `workspace_snapshot` projections
- Refreshed product knowledge index to ground truth

Documentation
- ADR-012 through ADR-019 (Next.js + FastAPI baseline, cached
  jobs, Postgres RPC, DOCX export, conversational builder,
  state-aware assistant, three-layer retry, independent step nav)
- DEVLOG Days 36–41
- docs/architecture.md refreshed

Author: LEANDERANTONY

.env.example

@@ -25,21 +25,58 @@ APP_BASE_URL=http://localhost:3000
 ## persisted saved-workspace reload, and account-level quotas.
 SUPABASE_URL=
 SUPABASE_ANON_KEY=
+## Service-role key used ONLY by the cached_jobs writer
+## (/admin/refresh-cache) and reader (/jobs/search). Bypasses RLS —
+## never send to the frontend, never use for user-scoped tables.
+SUPABASE_SERVICE_ROLE_KEY=
 SUPABASE_AUTH_REDIRECT_URL=http://localhost:3000/workspace
 SUPABASE_APP_USERS_TABLE=app_users
 SUPABASE_USAGE_EVENTS_TABLE=usage_events
 SUPABASE_SAVED_WORKSPACES_TABLE=saved_workspaces
 SUPABASE_SAVED_JOBS_TABLE=saved_jobs
 SUPABASE_RESUME_BUILDER_SESSIONS_TABLE=resume_builder_sessions
+SUPABASE_CACHED_JOBS_TABLE=cached_jobs
 SAVED_WORKSPACE_TTL_HOURS=24
+## Shared secret guarding /admin/refresh-cache. Set the same value in
+## the Supabase pg_cron job's HTTP headers so the cron can include
+## it. Rotate if leaked.
+REFRESH_CACHE_SECRET=
 
 ## Optional job-search backend settings. Keep ENABLE_JOB_SEARCH_BACKEND=false
 ## until the separate backend service is available in the target environment.
 ENABLE_JOB_SEARCH_BACKEND=false
 JOB_BACKEND_BASE_URL=http://localhost:8000
 JOB_BACKEND_HOSTPORT=
-GREENHOUSE_BOARD_TOKENS=
-LEVER_SITE_NAMES=
+# Comma-separated lists of board / site identifiers. Each is the
+# {token} in https://boards-api.greenhouse.io/v1/boards/{token}/jobs
+# or the {site} in https://api.lever.co/v0/postings/{site}. The
+# /admin/refresh-cache endpoint pulls every active job from each.
+# Bad tokens surface as "error" in the refresh report's
+# providers.greenhouse.errors[] (or .lever) — trim them from your
+# env after the first refresh shows which ones failed.
+#
+# Validated seed list ~58 Greenhouse + 6 Lever = ~8.7K active jobs.
+# Companies that previously used Greenhouse/Lever and migrated to
+# Ashby (Linear, Vercel, Netlify, Supabase, OpenAI, ...) were
+# trimmed after the first refresh — they 404'd. Add your own and
+# they'll either show up as "ok" or "error" in the next refresh
+# report.
+GREENHOUSE_BOARD_TOKENS=databricks,stripe,mongodb,anthropic,cloudflare,datadog,waymo,okta,samsara,zscaler,roblox,airbnb,brex,sofi,gitlab,scaleai,intercom,affirm,gleanwork,figma,fivetran,pinterest,elastic,reddit,twilio,robinhood,boxinc,lyft,smartsheet,asana,instacart,cresta,motional,dropbox,nuro,zoominfo,discord,moloco,gusto,wayve,faire,classpass,chime,fastly,amplitude,monzo,twitch,peloton,opendoor,mercury,mozilla,qualtrics,sumologic,pagerduty,launchdarkly,mixpanel,marqeta,wikimedia,algolia,triplelift,airtable,descript,calendly,typeface,narvar,glossier,placerlabs,modernhealth,lastpass,honeycomb,udacity,bitwarden,assemblyai,coursera,planetscale,inflectionai,kayak,allbirds,hubspot
+LEVER_SITE_NAMES=dnb,plaid,mistral,palantir,netflix,attentive
+## Ashby boards. Modern AI/dev-tools tier (Linear, Cursor, Replit,
+## Vercel, Cohere, Mistral, Sierra, Decagon, ...) — companies that
+## migrated off Greenhouse/Lever in 2023-2025. Endpoint:
+## https://api.ashbyhq.com/posting-api/job-board/{token}
+ASHBY_BOARD_TOKENS=mistral,notion,elevenlabs,cohere,sierra,ramp,decagon,plaid,cursor,replit,lovable,perplexity,deepgram,gamma,writer,supabase,n8n,workos,exa,linear,render,substack,character,posthog,poolside,column,railway,warp,statsig,pinecone,weaviate,stytch,pika,runway,nylas,clerk
+## Workday tokens are tenant:host:site triples — each Fortune 500
+## company runs its own Workday tenant on a numbered host
+## (wd1.myworkdayjobs.com, wd5, etc) at a public site. Validated
+## tenants below unlock ~14.5K jobs. The bulk-validation script in
+## scripts/probe_workday.py (or a similar one-off) finds more —
+## many big companies (AMD, Intel, Tesla, Cisco, IBM) require
+## tenant-specific request shapes that the default body doesn't
+## satisfy; those return 422 and are excluded.
+WORKDAY_BOARD_TOKENS=micron:wd1:External,nvidia:wd5:NVIDIAExternalCareerSite,citi:wd5:2,walmart:wd5:WalmartExternal,hpe:wd5:Jobsathpe,adobe:wd5:external_experienced,boeing:wd1:EXTERNAL_CAREERS,disney:wd5:disneycareer,hp:wd5:ExternalCareerSite,blackrock:wd1:BlackRock_Professional,workday:wd5:Workday
 
 ## Frontend origin settings for the Next.js transition.
 FRONTEND_APP_URL=http://localhost:3000

DEVLOG.md

@@ -7,7 +7,7 @@
 from backend.rate_limit import limiter, rate_limit_exceeded_handler
 from backend.routers.auth import router as auth_router
 from backend.routers.health import router as health_router
-from backend.routers.jobs import router as jobs_router
+from backend.routers.jobs import admin_router as jobs_admin_router, router as jobs_router
 from backend.routers.workspace import router as workspace_router
 
 
@@ -41,5 +41,6 @@ def root():
 
 app.include_router(health_router, prefix=settings.api_prefix)
 app.include_router(jobs_router, prefix=settings.api_prefix)
+app.include_router(jobs_admin_router, prefix=settings.api_prefix)
 app.include_router(auth_router, prefix=settings.api_prefix)
 app.include_router(workspace_router, prefix=settings.api_prefix)

backend/app.py

@@ -1,7 +1,13 @@
 import os
 from dataclasses import dataclass
 
-from src.config import GREENHOUSE_BOARD_TOKENS, JOB_BACKEND_BASE_URL, LEVER_SITE_NAMES
+from src.config import (
+    ASHBY_BOARD_TOKENS,
+    GREENHOUSE_BOARD_TOKENS,
+    JOB_BACKEND_BASE_URL,
+    LEVER_SITE_NAMES,
+    WORKDAY_BOARD_TOKENS,
+)
 
 
 @dataclass(frozen=True)
@@ -14,6 +20,8 @@ class BackendSettings:
     cors_allowed_origins: tuple[str, ...]
     greenhouse_board_count: int
     lever_site_count: int
+    ashby_board_count: int
+    workday_board_count: int
     # Auth cookie scoping. Empty domain means "host-only" (correct on
     # localhost, where landing+workspace share the same origin). In prod
     # set AUTH_COOKIE_DOMAIN=.job-application-copilot.xyz so the cookie is
@@ -71,6 +79,8 @@ def get_backend_settings() -> BackendSettings:
         cors_allowed_origins=cors_allowed_origins,
         greenhouse_board_count=len(GREENHOUSE_BOARD_TOKENS),
         lever_site_count=len(LEVER_SITE_NAMES),
+        ashby_board_count=len(ASHBY_BOARD_TOKENS),
+        workday_board_count=len(WORKDAY_BOARD_TOKENS),
         auth_cookie_domain=auth_cookie_domain,
         auth_cookie_secure=auth_cookie_secure,
         auth_cookie_samesite=auth_cookie_samesite,

backend/config.py

@@ -10,6 +10,17 @@ class JobSearchRequestModel(BaseModel):
     remote_only: bool = False
     posted_within_days: int | None = Field(default=None, ge=1, le=30)
     page_size: int = Field(default=20, ge=1, le=50)
+    # New filter dropdowns. work_modes is multi-select among
+    # ('remote', 'hybrid', 'onsite'). employment_types is multi-
+    # select among ('fulltime', 'parttime', 'contract', 'internship',
+    # 'temporary'). Empty list = no filter applied (all values pass).
+    work_modes: list[str] = Field(default_factory=list)
+    employment_types: list[str] = Field(default_factory=list)
+    # Single-select sort. 'relevance' (default — ts_rank then
+    # posted_at), 'newest' (posted_at DESC), 'oldest' (posted_at
+    # ASC), 'company_az' (alphabetical company). Unknown values
+    # coerce to 'relevance' downstream.
+    sort_by: str = Field(default="relevance", max_length=32)
 
     @field_validator("query", "location", mode="before")
     @classmethod
@@ -32,6 +43,24 @@ def _normalize_source_filters(cls, value):
             raise ValueError("source_filters must be a list")
         return [str(item).strip().lower() for item in value if str(item).strip()]
 
+    @field_validator("work_modes", "employment_types", mode="before")
+    @classmethod
+    def _normalize_dropdown_list(cls, value):
+        # Same pattern as source_filters — accept a list of strings,
+        # lower-case + strip empties. Whitelisting against the
+        # allowed-values set happens in CachedJobsStore.search()
+        # so the schema layer stays decoupled from RPC vocabulary.
+        if value is None:
+            return []
+        if not isinstance(value, list):
+            raise ValueError("must be a list of strings")
+        return [str(item).strip().lower() for item in value if str(item).strip()]
+
+    @field_validator("sort_by", mode="before")
+    @classmethod
+    def _normalize_sort_by(cls, value):
+        return str(value or "relevance").strip().lower() or "relevance"
+
     def to_domain(self) -> JobSearchQuery:
         return JobSearchQuery(
             query=self.query,
@@ -40,6 +69,9 @@ def to_domain(self) -> JobSearchQuery:
             remote_only=self.remote_only,
             posted_within_days=self.posted_within_days,
             page_size=self.page_size,
+            work_modes=self.work_modes,
+            employment_types=self.employment_types,
+            sort_by=self.sort_by,
         )
 
 

backend/models.py

@@ -22,5 +22,13 @@ def health_check():
                 "configured": settings.lever_site_count > 0,
                 "site_count": settings.lever_site_count,
             },
+            "ashby": {
+                "configured": settings.ashby_board_count > 0,
+                "board_count": settings.ashby_board_count,
+            },
+            "workday": {
+                "configured": settings.workday_board_count > 0,
+                "board_count": settings.workday_board_count,
+            },
         },
     }

backend/routers/health.py

@@ -1,4 +1,6 @@
-from fastapi import APIRouter, Depends, Request
+import secrets
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Request
 
 from backend.models import (
     JobResolveRequestModel,
@@ -7,7 +9,9 @@
     JobSearchResponseModel,
 )
 from backend.rate_limit import LIMIT_LLM, limiter
+from backend.services.job_cache_service import refresh_cached_jobs
 from backend.services.job_search_service import JobSearchService, get_job_search_service
+from src.config import REFRESH_CACHE_SECRET
 
 
 router = APIRouter(prefix="/jobs", tags=["jobs"])
@@ -18,9 +22,23 @@
 def search_jobs(
     request: Request,
     payload: JobSearchRequestModel,
+    live: bool = False,
     service: JobSearchService = Depends(get_job_search_service),
 ):
-    result = service.search(payload.to_domain())
+    """Search the job pool.
+
+    Default path (`live=false`): query the cached_jobs Supabase table
+    via Postgres full-text — ~30ms, no upstream load. The cache is
+    refreshed every 30 min by /admin/refresh-cache.
+
+    Escape hatch (`?live=true`): bypass the cache and fan out to
+    every configured Greenhouse / Lever board live. Slower (1-3s) and
+    costs upstream rate-limit budget — kept for debugging
+    'why doesn't this job appear in the cache?' questions and as a
+    fallback if the cache misbehaves.
+    """
+    domain_query = payload.to_domain()
+    result = service.search(domain_query) if live else service.search_cached(domain_query)
     return JobSearchResponseModel.from_domain(result)
 
 
@@ -33,3 +51,50 @@ def resolve_job_url(
 ):
     result = service.resolve_url(payload.url)
     return JobResolutionResponseModel.from_domain(result)
+
+
+# ----- Admin: cached_jobs refresh ---------------------------------------
+# Triggered by Supabase pg_cron via pg_net.http_post with the
+# REFRESH_CACHE_SECRET as the bearer token. Not exposed to end users.
+# Rate-limited too — even if the secret leaks, the per-IP limiter
+# protects the upstream providers from being hammered.
+
+admin_router = APIRouter(prefix="/admin", tags=["admin"])
+
+
+def _verify_refresh_secret(authorization: str | None = Header(default=None)) -> None:
+    """Bearer-token auth for admin endpoints.
+
+    Constant-time comparison via secrets.compare_digest defends against
+    timing oracles (probably overkill at our threat model but free).
+    Returns 503 if the server has no REFRESH_CACHE_SECRET configured —
+    we'd rather fail closed than open.
+    """
+    if not REFRESH_CACHE_SECRET:
+        raise HTTPException(
+            status_code=503,
+            detail="Refresh-cache secret not configured on the server.",
+        )
+    if not authorization or not authorization.lower().startswith("bearer "):
+        raise HTTPException(status_code=401, detail="Missing bearer token.")
+    presented = authorization[len("bearer ") :].strip()
+    if not secrets.compare_digest(presented, REFRESH_CACHE_SECRET):
+        raise HTTPException(status_code=401, detail="Invalid refresh-cache token.")
+
+
+@admin_router.post("/refresh-cache")
+def refresh_cache(
+    request: Request,
+    _: None = Depends(_verify_refresh_secret),
+):
+    """Refresh cached_jobs from all configured providers.
+
+    This is what Supabase pg_cron hits every 30 min. Returns the
+    structured refresh report (see `refresh_cached_jobs`) so cron
+    output can be inspected when something goes wrong.
+    """
+    try:
+        report = refresh_cached_jobs()
+    except RuntimeError as exc:
+        raise HTTPException(status_code=503, detail=str(exc)) from exc
+    return report