The pipeline
The workstation
Screenshots from the running app with demo data — company names replaced, contact details masked.



Decisions
Discovery runs in a subscription session, not on an API key
The daily search is a scheduled task inside the assistant I already pay for, so it costs nothing per run and holds no credentials. The workstation's optional API use has its own ledger: a monthly cap, a warning at 80%, a hard stop at 100%, no auto-reload, no quiet fallback to another budget. Running out means stopping and telling me — the same budget discipline I apply to a client system.
The gate is the product
The interesting part is not the search; it is the rule that a tailored resume can differ from the base in exactly two ways — the positioning line and the order of the skills line; the three tailoring moves (pick a variant, reorder skills, write the match notes) may only ever produce those two kinds of diff. It made the pipeline safe to run unattended, and it is a reusable pattern: define what an AI step is allowed to change, diff against that, and block the rest.
Submission stays human
No account creation, no passwords typed by a machine, no captcha solving, no form submissions. The system prepares; I decide and act. A pipeline that could apply on my behalf would be faster and worse.