app.job-application-worker

Job application worker

Continuous, abortable, fenced worker host for isolated account, inbox, browser, application, reconciliation, export, and deletion jobs.

The managed composition claims from one exact deployment queue. Each work item carries its immutable candidate scope and initiating actor envelope; the worker reauthorizes the command and executes it under that candidate scope. Leases, heartbeats, completion, retry, and dead-letter transitions require the current fencing token.

An isolated deployment may set JOB_APPLICATION_EFFECTS_MODULE to an allowlisted @lssm-tech/integration.job-application-effects-* package. The module must expose complete submit, reconciliation, and account effect ports, plus optional readiness and shutdown hooks. Partial or untrusted modules fail before claims begin; omitting the module preserves the killed-effect default.

The managed effects package handles an authorized, durable job-application.account.verify claim by reserving exactly one pending inbox challenge and a fenced link/OTP sub-effect. It reads the sanitized message only through the candidate-scoped encrypted-object dependency, settles successful work, releases retryable failures, and moves unsafe or ambiguous challenges to takeover. External effects remain disabled unless both the worker control and the allowlisted effects module are explicitly enabled.

Application deletion enqueues opaque external destinations before database references are scrubbed. When the global kill switch is off and JOB_APPLICATION_EXTERNAL_EFFECTS_ENABLED=true, the managed host starts a separate deletion service using JOB_APPLICATION_DELETION_WORKER_ID (falling back to JOB_APPLICATION_WORKER_ID). Tasks are ordered by the fifteen-minute deadline, heartbeat independently, and settle only through the exact candidate, owner, fence, and live lease. A lost lease never acknowledges an external effect; destination ports must be idempotent for safe crash replay.