Managed job-application effects
Reusable production composition for candidate-scoped browser submission, reconciliation, and external-account workflows. It composes the existing signed Playwright drivers with the FORCE-RLS browser-state store and the trusted worker effect ports.
The package caches one runtime per exact candidate scope. Browser bindings, signed workflows, and evidence are read or written only through that scope. Secret values, CDP connection data, and document bytes remain behind deployment-owned provider ports and are used transiently.
The default worker composition is lazy and fail-closed. Set JOB_APPLICATION_EFFECTS_DEPENDENCIES_MODULE to an allowlisted @lssm-tech/integration.job-application-effects-dependencies-* package and provide JOB_APPLICATION_DATABASE_URL plus JOB_APPLICATION_DATABASE_ROLE. Readiness verifies the non-privileged database role, database availability, and dependency readiness before the worker claims work.
Deployment packages may provide either one already-isolated handle store and workflow verifier or scope factories. Managed deployments should use the scope factories so opaque browser handles and verification keys are resolved from the exact candidate FORCE-RLS context.
This package does not solve CAPTCHA, rotate identities, infer candidate answers, or retry ambiguous submissions.
Authorized verify_account work uses the pending scoped inbox challenge instead of the generic browser account workflow. The runtime claims exactly one challenge, reads its sanitized encrypted object, and reserves a distinct fenced email-link or OTP sub-effect before opening or submitting anything. Successful effects settle the challenge and account; retryable failures release it, while invalid sender, redirect, purpose, expiry, or ambiguous OTP evidence requires takeover. Missing scoped verification dependencies fail closed.
The allowlisted dependency module may also expose candidate-scoped deletion destinations. Managed effects forward only the exact scope, destination kind, opaque target reference, task idempotency key, and cancellation signal. They do not resolve or log deletion targets in the generic worker.
