YOUR INBOX (before HireCanvas)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📧 Bank statement
📧 Netflix invoice
📧 [MISSED] "Interview invitation — Stripe" ← gone
📧 Wi-Fi recharge
📧 "Your application to Google was received"
📧 LinkedIn: 10 new jobs for you
📧 "We're moving forward with other candidates" (Meta)
📧 "Interview scheduled — Vercel"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

AFTER HIRECANVAS SYNC
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Stripe    → Interview    (pipeline updated, reminder set)
✅ Google    → Applied      (new entry created)
✅ Meta      → Rejected     (status updated)
✅ Vercel    → Interview    (pipeline updated, reminder set)
🚫 Bank / Netflix / Wi-Fi  → filtered, never hits AI
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

┌─────────────────────────────────────────────┐
│           BROWSER (Next.js Client)           │
│   Zustand + TanStack Query (status polling)  │
└────────────────────┬────────────────────────┘
                     │ HTTPS / Server Actions
                     ▼
┌─────────────────────────────────────────────┐
│           NEXT.JS SERVER                    │
│   API Routes  |  Server Actions             │
└────────┬────────────────────┬───────────────┘
         │ reads/writes       │ enqueue job
         ▼                    ▼
┌─────────────────┐  ┌────────────────────────┐
│   SUPABASE      │  │   REDIS (BullMQ)       │
│   PostgreSQL    │  │   3 queues:            │
│   RLS + Auth    │◄─│   sync/extract/remind  │
│   Realtime      │  └──────────┬─────────────┘
└─────────────────┘             │
                    ┌───────────┼────────────┐
                    ▼           ▼            ▼
             ┌──────────┐ ┌──────────┐ ┌──────────┐
             │  SYNC    │ │EXTRACTION│ │ REMINDER │
             │ WORKER   │ │ WORKER   │ │ WORKER   │
             │          │ │          │ │          │
             │Gmail API │ │Gemini    │ │AWS SES   │
             │OAuth     │ │Claude    │ │Schedule  │
             │5-stage   │ │GPT-4o    │ │follow-ups│
             │filter    │ │Verifier  │ │          │
             └──────────┘ └──────────┘ └──────────┘

CREATE TABLE processed_emails (
  id uuid PRIMARY KEY,
  user_id uuid REFERENCES app_users,
  gmail_message_id text NOT NULL,
  content_hash text NOT NULL,   -- SHA-256(sender + subject + snippet)
  review_status text DEFAULT 'needs_review',
  created_at timestamptz DEFAULT now(),
  UNIQUE(user_id, content_hash)
);

CREATE TABLE job_status_timeline (
  id uuid PRIMARY KEY,
  job_id uuid REFERENCES jobs,
  from_status text,
  to_status text NOT NULL,
  trigger_source text,    -- 'ai_extraction' | 'manual' | 'csv_import'
  confidence float,
  evidence_quote text,    -- verbatim quote from the email
  triggered_at timestamptz DEFAULT now()
);

CREATE TABLE ai_usage (
  id uuid PRIMARY KEY,
  user_id uuid REFERENCES app_users,
  model text NOT NULL,
  stage text NOT NULL,          -- 'classifier' | 'extractor' | 'verifier'
  input_tokens int NOT NULL,
  output_tokens int NOT NULL,
  cost_usd numeric(10,6) NOT NULL,
  created_at timestamptz DEFAULT now()
);

// Try incremental sync first (only what changed since last run)
if (lastHistoryId) {
  try {
    messages = await listFromHistory(gmail, lastHistoryId);
  } catch (err) {
    if (err.code === 404) {
      // History expired after ~30 days — fall back to query sync
      messages = await listFromQuery(gmail, dateRange);
    }
  }
}
// Wide date ranges are sliced into 30-day chunks
// to prevent silent truncation from Gmail API limits

Email arrives
     │
     ▼
[1] OUTBOUND CHECK     → sent mail? discard
     │
     ▼
[2] GMAIL LABELS       → PROMOTIONS/SOCIAL/FORUMS?
                          discard UNLESS known ATS domain
     │
     ▼
[3] SIZE GUARD         → HTML body > 50KB + not ATS domain?
                          discard (bulk newsletter)
     │
     ▼
[4] SHA-256 DEDUP      → hash(sender+subject+snippet) in DB?
                          skip (already processed)
     │
     ▼
[5] KEYWORD FAST-SKIP  → regex on subject + sender
                          newsletter pattern? discard
                          job pattern? proceed
     │
     ▼
  Enqueue for AI extraction

Raw Email
    │
    ▼
[SANITIZER]     Strip SSN, credit cards, API keys, passwords
                Log PII patterns fired → extraction_audit_log
    │
    ▼
[STAGE 1]       Relevance Classifier
CLASSIFIER      Model: Gemini 2.5 Flash
                Input: sender + subject + first 800 chars

                Output: {
                  is_job_lifecycle: boolean,
                  email_type: 'interview_invite' | 'rejection' | ...,
                  confidence: 0.0-1.0
                }
    │
    │ is_job_lifecycle = true (or ATS domain override)
    ▼
[STAGE 2]       Structured Extractor
EXTRACTOR       Model: Gemini 2.5 Flash
                Input: first 2500 chars of sanitized body

                Output: {
                  company, role, status, recruiter_name,
                  interview_date, salary_range, ats_vendor,
                  low_confidence_fields: string[]
                }
    │
    ▼
[STAGE 3]       Cross-Model Verifier
VERIFIER        Model: Claude Haiku 4.5 (if Stage 2 = Gemini)
                    OR GPT-4o (if Stage 2 = Claude)
                NEVER same model as Stage 2

                Checks:
                  - Does company appear in email body?
                  - Does status match context?
                  - Can it find a verbatim evidence quote?

                Output: {
                  approved: boolean,
                  status_evidence: string,   ← QUOTE PROOF CHECK
                  corrections: {}
                }
    │
    ├── confidence >= threshold + evidence found
    │       → AUTO-ACCEPT: DB upsert, timeline row, reminder
    │
    └── confidence < threshold OR evidence missing
            → HUMAN REVIEW QUEUE ("Review Pending" in UI)

// The verifier must return a verbatim quote from the email
// that justifies the status it assigned.
// We then do a literal string search.

const quoteExists = emailBody
  .toLowerCase()
  .includes(result.status_evidence.toLowerCase());

if (!quoteExists) {
  // Model fabricated a quote that doesn't exist → hard fail
  return { approved: false, reason: 'evidence_not_found_in_body' };
}

EMAIL:
From: recruiting@stripe.com
Subject: Interview Invitation — Engineering at Stripe

"Hi Alex, we'd like to invite you for a technical interview
with our engineering team. Scheduled for June 10th, 2PM PST via Zoom."

STAGE 1:  { is_job_lifecycle: true, type: "interview_invite", confidence: 0.98 }

STAGE 2:  { company: "Stripe", status: "interview",
            interview_date: "2026-06-10", role: null,
            low_confidence_fields: ["role"] }

STAGE 3:  { approved: true,
            status_evidence: "invite you for a technical interview" }

QUOTE CHECK: "invite you for a technical interview"
  → exists in body? ✅ YES

RESULT:
  → status updated to Interview
  → timeline row written (Applied → Interview)
  → reminder scheduled for June 9th, 9:00 AM

// On any provider failure:
await redis.set(`llm:cooldown:${provider}`, '1', 'PX', 25_000);
// Quarantined for 25 seconds, then auto-recovers

// Fallback chain:
async function getAvailableProvider(preferred: string): Promise<string> {
  for (const provider of [preferred, 'gemini', 'openai', 'claude', 'ollama']) {
    const cooling = await redis.exists(`llm:cooldown:${provider}`);
    if (!cooling) return provider;
  }
  return 'regex_fallback';  // last resort — no hallucinations possible
}

Gemini 2.5 Flash → GPT-4o → Claude Haiku → Ollama (local, free) → Regex Parser

const DAILY_LIMITS_USD = { free: 0.05, pro: 0.25, elite: 0.50 };

// Runs before EVERY AI job
await assertWithinDailyAIBudget(userId, tier);

// When exceeded — not a failure, graceful degradation:
// 1. Update sync_status with user-visible warning message
// 2. Re-enqueue job with 12-hour delay (auto-retry)
// 3. User sees toast: "Daily AI limit reached. Retrying at 10 AM."

// AES-256-GCM encryption before storage
const encrypted = encryptToken(oauthRefreshToken, process.env.TOKEN_ENCRYPTION_KEY);
await db.oauthTokens.save({ userId, ...encrypted });

// Decrypted in-memory only during sync worker run
// Never logged. Never exposed to the browser.

// Runs on every email before it touches any external model
const PII_PATTERNS = {
  ssn:         /\b\d{3}-\d{2}-\d{4}\b/g,
  credit_card: /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g,
  openai_key:  /sk-[a-zA-Z0-9]{20,}/g,
  github_pat:  /ghp_[a-zA-Z0-9]{36}/g,
  password:    /password\s*[:=]\s*\S+/gi,
};
// Every pattern fired is logged to extraction_audit_log (GDPR record)

-- Enforced at DB layer — not just the application layer
CREATE POLICY "users_own_jobs" ON jobs
  FOR ALL
  USING (user_id = auth.uid())
  WITH CHECK (user_id = auth.uid());
-- Same pattern on all 9 tables
-- Even a manipulated request returns zero rows

main branch push
        │
        ▼
┌───────────────────────────────────────┐
│   PARALLEL JOBS                       │
│   Lint + npm audit --audit-level=high │
│   TypeScript strict check             │
│   Unit tests (Jest)                   │
└───────────────┬───────────────────────┘
                │ all pass
                ▼
         Next.js build + Docker build
                │
                ▼
     E2E tests (Playwright)
     Against REAL Supabase — not mocked
     Tests: auth flows, RLS, Stripe webhooks
                │
                ▼
     CD fires ONLY on CI success
     SSH → EC2 → docker compose up --build
     Health check: /api/health
       { status: "ok", db: true, redis: true }
                │
                ▼
            ✅ Deploy complete