docs(phase-6): verification (5/5 must-haves pass; human/deploy items pending)

Parity test 5 passed; no ATS/LLM in extension JS; token not hardcoded; single
source of truth. Remaining items are deployment/runtime (live API end-to-end +
Streamlit-on-7860 coexistence).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.planning/phases/06-chrome-extension/06-VERIFICATION.md

@@ -0,0 +1,133 @@
+---
+phase: 06-chrome-extension
+verified: 2026-06-20T00:00:00Z
+status: human_needed
+score: 5/5 must-haves verified
+human_verification:
+  - test: "Load extension unpacked in Chrome (chrome://extensions → Load unpacked → extension/) and navigate to a LinkedIn job listing. Click extension icon → popup opens → job title and company appear within 1-2 seconds."
+    expected: "No manifest errors shown. Options page saves API URL, token, and resume PDF. Popup shows extracted job title and company. Run button triggers spinner."
+    why_human: "Chrome extension manifest loading, content-script DOM extraction, and chrome.storage.local round-trip cannot be exercised by automated Python tests."
+  - test: "With a locally running api_server.py (python api_server.py), open Options, set api_url=http://localhost:7860 and a matching API_SECRET_TOKEN token, upload a PDF resume, then click Run on a LinkedIn/Naukri/Indeed job page."
+    expected: "Spinner appears, status badge (READY/READY_REVIEW/etc.) and scores table are displayed. Download DOCX button triggers a file download."
+    why_human: "Full end-to-end flow (extension → local API → LLM pipeline → DOCX download) requires a live server. The HF Space deployment path additionally requires API keys and HF secrets."
+  - test: "Verify the Streamlit web UI still loads at http://localhost:7860 after starting python api_server.py."
+    expected: "Streamlit UI renders at the root URL, proxied through FastAPI. The extension API and Streamlit app coexist on port 7860."
+    why_human: "Subprocess launch of Streamlit on 8501 and httpx reverse-proxy to 7860 cannot be smoke-tested without a running server process."
+---
+
+# Phase 6: Chrome Extension Verification Report
+
+**Phase Goal:** Avoid IP-blocking by applying one job at a time in-browser. User opens a job listing, clicks Run in a Chrome extension; the extension extracts the JD and sends it with the pre-uploaded resume to the SAME existing Python pipeline (now also a JSON API on the HF Space) which tailors+scores+renders with IDENTICAL scoring and returns a DOCX/PDF download. The HF Space serves both the standalone Streamlit app and the extension API from one codebase.
+**Verified:** 2026-06-20
+**Status:** human_needed
+**Re-verification:** No — initial verification
+
+---
+
+## Goal Achievement
+
+### Observable Truths
+
+| # | Truth | Status | Evidence |
+|---|-------|--------|----------|
+| 1 | R-EXT1: No ATS/LLM/scoring logic in any extension JS | VERIFIED | grep of background.js, content.js, popup.js for ats_score/jd_match/keyword/llm/openai/generate_resume returns zero matches. jd_match appears in popup.js only as a display key rendering the API's returned score value (L172, L176), not computing it. |
+| 2 | R-EXT2: api_server reuses existing pipeline; parity tests pass | VERIFIED | api_server.py calls `_run_provider_chain(base_resume_override=base_resume)` on L130. `pytest tests/test_api_parity.py tests/test_api_health.py -v` → 5 passed in 3.87s. test_api_parity_deterministic PASSED (data/resume/resume.pdf present locally). |
+| 3 | R-EXT3: JD extraction with LinkedIn/Naukri/Indeed selectors + generic fallback | VERIFIED | content.js (281 lines) contains extractLinkedIn, extractNaukri, extractIndeed, extractGenericJD, MutationObserver waitForElement, platform router, EXTRACT_JD message listener, and 16000-char truncation. |
+| 4 | R-EXT4: Resume stored in extension; token not hardcoded | VERIFIED | options.js writes resume_b64 + api_token to chrome.storage.local.set. background.js reads via chrome.storage.local.get(['resume_b64', 'api_url', 'api_token']). No hardcoded token string found in any JS file (checked with 32+ char literal regex). |
+| 5 | R-EXT5: Download in-page; download buttons gated on download_allowed | VERIFIED | popup.js L188: `if (result.download_allowed) { downloadsEl.classList.add('visible') }`. background.js uses URL.createObjectURL + chrome.downloads.download. Downloads container is hidden by default and only revealed on download_allowed=true. |
+
+**Score: 5/5 truths verified (automated)**
+
+---
+
+## Required Artifacts
+
+| Artifact | Expected | Status | Details |
+|----------|----------|--------|---------|
+| `api_server.py` | FastAPI on port 7860 with /api/health, /api/generate, Streamlit reverse proxy | VERIFIED | 361 lines. Syntax OK. Imports from src.resume_parser_v2, src.resume_customizer, src.llm_client, src.providers. start_streamlit() guarded in `__main__` — safe to import in tests. |
+| `requirements.txt` | fastapi, uvicorn[standard], websockets, python-multipart added | VERIFIED | All 4 packages present. |
+| `start.sh` | Launches python api_server.py (not streamlit directly) | VERIFIED | L46: `echo "=== Starting FastAPI + Streamlit (via api_server.py) ==="` L48: `exec python api_server.py`. No `streamlit run ui.py` after the api_server reference. |
+| `extension/manifest.json` | MV3, storage/downloads/activeTab/scripting permissions, options_ui, content_scripts | VERIFIED | manifest_version=3, all 4 permissions present, options_ui pointing to options/options.html, content_scripts with content.js at document_idle, background service_worker=background.js. |
+| `extension/options/options.html` | Resume upload, API URL, API token fields; all required IDs | VERIFIED | All 6 required IDs present: api_url, api_token, resume_file, resume_status, save_btn, status_msg. |
+| `extension/options/options.js` | PDF → base64 + SHA-256 → chrome.storage.local; token from form | VERIFIED | chrome.storage.local.set, resume_b64, sha256, api_token all present. Token read from `document.getElementById('api_token').value` — not hardcoded. |
+| `extension/content.js` | LinkedIn/Naukri/Indeed selectors + generic fallback + EXTRACT_JD message listener | VERIFIED | 281 lines. All 10 required symbols present. extractLinkedIn is async with waitForElement MutationObserver. |
+| `extension/popup/popup.html` | Run button, spinner, status, scores table, Download DOCX/PDF buttons | VERIFIED | All 8 required IDs present including downloads container and individual score cells. |
+| `extension/popup/popup.js` | EXTRACT_JD → GENERATE → DOWNLOAD orchestration; download gating | VERIFIED | EXTRACT_JD, GENERATE, DOWNLOAD, download_allowed, docx_b64, chrome.tabs.query, chrome.runtime.sendMessage all present. |
+| `extension/background.js` | GENERATE (API call) + DOWNLOAD (chrome.downloads); no ATS logic | VERIFIED | 99 lines. All required symbols present. No forbidden symbols found. Token read from storage, not hardcoded. |
+| `tests/test_api_health.py` | 3 smoke tests; health, token gate, missing resume | VERIFIED | 3 tests PASSED. |
+| `tests/test_api_parity.py` | Parity test via StubProvider; skips on absent resume.pdf | VERIFIED | test_fixture_jd_exists PASSED. test_api_parity_deterministic PASSED (resume.pdf present). |
+| `tests/fixtures/sample_jd.txt` | PM JD fixture, 200+ chars | VERIFIED | 2342 chars, "Product Manager" present, TestCo company. |
+
+---
+
+## Key Link Verification
+
+| From | To | Via | Status | Details |
+|------|----|-----|--------|---------|
+| api_server.generate_resume_for_api | src/resume_customizer._run_provider_chain | base_resume_override kwarg | WIRED | api_server.py L130: `customizer._run_provider_chain(job, filepath, provider_chain, base_resume_override=base_resume)` |
+| api_server proxy route | Streamlit on localhost:8501 | httpx.AsyncClient + websockets | WIRED | HTTP catch-all proxy at L321-354. WebSocket proxy at L265-316. |
+| start.sh | api_server.py | exec python api_server.py | WIRED | L48: `exec python api_server.py` |
+| options.js | chrome.storage.local | chrome.storage.local.set({resume_b64, api_token, api_url}) | WIRED | options.js L103: `chrome.storage.local.set(toStore, ...)` with resume_b64, api_token, api_url in toStore |
+| background.js | api_server /api/generate | fetch(api_url + '/api/generate', X-Api-Token header, FormData) | WIRED | background.js L48: `fetch(...'/api/generate', {headers: {'X-Api-Token': ...}, body: formData})` |
+| background.js | chrome.downloads | URL.createObjectURL + chrome.downloads.download | WIRED | background.js L90-94 |
+| popup.js | content.js | chrome.tabs.sendMessage(tabId, {type: 'EXTRACT_JD'}) | WIRED | popup.js sends EXTRACT_JD; content.js message listener responds |
+| popup.js | background.js | chrome.runtime.sendMessage({type: 'GENERATE'}) | WIRED | popup.js sends GENERATE; background.js onMessage handles it |
+| tests/test_api_parity.py | api_server.generate_resume_for_api | direct call with StubProvider monkey-patch | WIRED | L83: `api_server.generate_resume_for_api(pdf_bytes, jd_text, job_title, company)` |
+| tests/test_api_health.py | api_server.app | TestClient(api_server.app) | WIRED | L28: `client = TestClient(api_server.app)` |
+
+---
+
+## Requirements Coverage
+
+| Requirement | Plans | Description | Status | Evidence |
+|-------------|-------|-------------|--------|----------|
+| R-EXT1 | 06-01, 06-04 | Thin-client extension: no ATS/LLM logic in JS | SATISFIED | grep of all 4 extension JS files returns zero forbidden symbols |
+| R-EXT2 | 06-01, 06-05 | Same scoring as web app (parity test) | SATISFIED | test_api_parity_deterministic PASSED with StubProvider; api_server calls _run_provider_chain not a fork |
+| R-EXT3 | 06-03 | Generic + curated JD extraction (LinkedIn/Naukri/Indeed) | SATISFIED | content.js has platform-specific selectors + generic text-density fallback + MutationObserver for SPA |
+| R-EXT4 | 06-02, 06-04 | Resume stored locally in extension; token not hardcoded | SATISFIED | options.js stores resume_b64 + api_token to chrome.storage.local; background.js reads from storage |
+| R-EXT5 | 06-03, 06-04 | Download DOCX/PDF in-page; gated on download_allowed | SATISFIED | popup.js gates downloads on download_allowed; background.js triggers chrome.downloads.download |
+
+---
+
+## Anti-Patterns Found
+
+| File | Line | Pattern | Severity | Impact |
+|------|------|---------|----------|--------|
+| None found | — | — | — | — |
+
+No TODO/FIXME/placeholder comments, empty implementations, or return-null stubs found in any phase artifact. All functions have substantive implementations.
+
+---
+
+## Human Verification Required
+
+### 1. Chrome Extension Load and JD Extraction
+
+**Test:** Load the extension unpacked in Chrome (chrome://extensions → Developer mode → Load unpacked → select the `extension/` folder). Navigate to any LinkedIn, Naukri, or Indeed job listing. Click the extension icon.
+**Expected:** No manifest errors shown in chrome://extensions. Options page opens correctly (right-click → Options). Popup shows extracted job title and company within 1-2 seconds of opening.
+**Why human:** Chrome extension manifest loading, MV3 service worker registration, content-script injection at document_idle, and chrome.storage.local are Chrome-runtime APIs that cannot be exercised by Python tests.
+
+### 2. Full End-to-End Run with Local API
+
+**Test:** Run `python api_server.py` locally. Open Options, set api_url=`http://localhost:7860`, paste a token matching `API_SECRET_TOKEN` env var, upload a PDF resume. Navigate to a job page and click Run.
+**Expected:** Spinner appears (15-60s for LLM). Status badge (READY/READY_REVIEW/etc.) and scores table appear. Clicking Download DOCX saves a file to disk.
+**Why human:** Full pipeline run requires live LLM providers (Kimi/NVIDIA/GLM). The end-to-end extension → API → pipeline → download flow cannot be exercised without a running server.
+
+### 3. Streamlit Reverse-Proxy Coexistence
+
+**Test:** After `python api_server.py` starts, open `http://localhost:7860` in a browser.
+**Expected:** The Streamlit web UI loads and is functional. The API endpoints (`/api/health`, `/api/generate`) also respond. Both work from the same port 7860.
+**Why human:** Verifying the subprocess launch of Streamlit on 8501 and httpx proxy routing to 7860 requires a running process; the TestClient in health tests does not start Streamlit.
+
+---
+
+## Gaps Summary
+
+No automated gaps found. All 5 must-have truths are verified in the actual codebase. All 13 artifacts exist and are substantive (not stubs). All 10 key links are wired. All 5 requirements are satisfied by code evidence. Pytest exits 0 with 5/5 passed.
+
+The three human-verification items are deployment/runtime checks that are explicitly out-of-scope for automated verification per the must_verify note: "full live end-to-end (real Kimi/NVIDIA + deployed HF API) is NOT runnable here — mark that as human/deployment-gated, not failed."
+
+---
+
+_Verified: 2026-06-20_
+_Verifier: Claude (gsd-verifier)_