oll.in — plan → execution

POC results executed 2026-07-07 · all three branches green

The two master-gate lanes plus the RAG lane were built on feat branches with synthetic data, keyless, and verified by running — tests, a live tick, and (for oll-scout) Docker. All landed as draft PRs, nothing merged, nothing deployed.

Ground truth read from the running services

Before writing a line of the plan, we read the three services oll.in leans on. This is the technical picture — real modules, real function names, real boundaries. Everything downstream is a diff against this.

Two corrections the grounding forced why we verify first

Change-set 1 — oll-write: three JD-aware verbs new prompts, not architecture

Copy the existing single-input verb pattern verbatim. Add tailor_cv, cover_letter, interview_prep. Each takes the BFF-assembled profile context (retrieved, cited) plus the job description. No new boundary, no memory client.

Files to touch

Change-set 2 — the oll.in BFF + frontend reuse ollwrite verbatim

The oll.in web app is a thin Next.js client with a server-side BFF, lifted from ollwrite's proven pattern (proactive-memory-sidecar). The browser never names a collection or holds a service token — the BFF derives everything from the Core JWT.

1. Upload CV → BFF ingests to oll-memory with a stable per-doc id (edit-safe upsert).
2. Paste / select a job → BFF retrieves top-k profile passages (relevance floor; abstain path if thin).
3. Generate → BFF calls the 3 oll-write verbs with {profile: assembled cited passages, job_description}.
4. Render → BFF maps passage ids back to inline citation nodes (drag-to-cite reused from ollwrite).
5. Photo → foto guest-checkout (no login) for the Bewerbungsfoto.
6. Pay + deliver → Core checkout (guest pay-once pack) → Core email delivers the dossier.

Change-set 3 — foto: unstub the real model config, not code

The scaffold, guest-checkout wiring, idempotent store and tests already exist and pass. Going live is configuration + one verification run, not a rewrite — the replicate provider is already implemented and guarded.

# services/foto/.env — flip provider + supply flux-LoRA config
FOTO_PROVIDER=replicate
REPLICATE_API_TOKEN=r8_…            # burned if ever exposed
FLUX_LORA_TRAINER=<owner/model:version>
REPLICATE_USERNAME=<dest for trained versions>
FOTO_PUBLIC_BASE_URL=https://<ch-domain>

The _require_replicate_ready guard refuses to run until all four are set, so a misconfigured deploy fails loud, not silently on the mock. The only open question is output quality for the Swiss Bewerbungsfoto — which is POC-B, a run, not a build.

Change-set 4 — Core: guest pair, Radar price, event dedupe additive, frozen-safe

1. Merge the guest pair (PR #21). foto is already coded against guest-checkout-session + guest-verify-session; they're additive and never weaken the authed routes. Needs Sam's per-PR go + green CI (feedback-merge-gate).
2. Add a Career Radar price/plan. Subscription mode already works — this is a Stripe price id + a plan entry, no new billing code. The pay-once dossier pack reuses plan=="one_time".
3. Add event-id idempotency before a recurring paid plan rides the webhook. A ProcessedEvent(event_id PK, processed_at) table; the webhook short-circuits a seen event.id. Small, but do it first — it's the one real gap the grounding found (idempotent-paid-fulfillment). Verify with adversarial-reviewer — this touches the money path.

Change-set 5 — oll-scout, the one new service everything else was reuse

The single genuinely-new backend. It copies the house service template (thin routes · sole-boundary clients · own Neon DB · contract-first · per-endpoint tests) and adds nothing exotic. POC-C settled its one hard unknown — the data source is Jooble (primary, only self-serve API with real Swiss coverage, GREEN ToS) + Arbeitnow (open, no-key supplement).

services/oll-scout/
  app.py  config.py  routes.py  service.py  dtos.py  errors.py
  jooble_client.py     # SOLE data-source boundary (POST jooble.org/api/{key})
  arbeitnow_client.py  # supplement, no key
  scoring.py           # calls oll-model via X-Service-Token (like text_client)
  store.py             # own Neon oll_scout: jobs + user matches (ADR-008)
  digest.py            # daily match digest -> Core /email/send
  scout_cron.py        # the always-on tick (inline; Dramatiq only if load demands)
  openapi.yaml  Dockerfile  requirements.txt  tests/

The tick (once per user per day)

1. Pull — jooble_client.search(keywords, location="Switzerland") + Arbeitnow page; dedup on source id / updated.
2. Score — scoring.py asks oll-model to rank each role against the user's oll-memory profile (fit + gaps), via the internal service token.
3. Store — upsert roles + per-user match scores into Neon oll_scout.
4. Digest — the day's strong matches → digest.py → Core /email/send. Alert, don't apply.

The POCs as runnable specs each a literal test, parallel-able

POC-A · Grounded dossier quality master gate · start now

1. On a feat/ollin-verbs branch, add the 3 verbs to dev oll-write (or, faster: hand-build the prompt and hit the existing /draft to validate value before writing the verb).
2. Ingest one real CV into oll-memory (Sam's own).
3. Run tailor_cv + cover_letter + interview_prep against 3 real Swiss postings (pulled by hand for the POC).
4. Pass gate: Sam judges ≥1 output good enough to send under his own name; every claim traces to a cited passage; no invented facts.

POC-C · Scout data source master gate · start now

1. Request the free Jooble API key; capture the storage/caching terms from the issuance email in writing.
2. Throwaway script: POST jooble.org/api/{key} with {keywords, location:"Switzerland"}; also GET arbeitnow.com/api/job-board-api.
3. Inspect field richness (title/company/location/snippet/salary/link/updated), result depth, and CH coverage quality.
4. Pass gate: Jooble returns enough well-structured CH roles under compliant terms to feed a daily digest. (Research says GREEN — this confirms field quality & depth with live calls.)

POC-B · Bewerbungsfoto output parallel

Set FOTO_PROVIDER=replicate + flux-LoRA config; generate from Sam's phone snaps. Pass gate: output passes an eyeball test vs real Swiss Bewerbungsfoto standards, consistent across ≥3 subjects.

POC-D · Radar billing reframed — smaller than thought

Subscription mode exists, so this shrank: add a test-mode Radar price + the ProcessedEvent dedupe table on feat/core-radar-billing; drive a subscription checkout → invoice.payment_succeeded webhook → /me reports the plan; replay the same event.id and assert it's a no-op. Pass gate: plan flips once, replay is inert, all existing billing tests stay green (adversarial-reviewer).

POC-E · Agent loop end-to-end builds on the proven seam

Add the 3 verbs to feat/oll-mcp-thin; apply services/oll-mcp/docs/openclaw-wiring.md; run one real application through OpenCLAW over the --http seam (human on send). Pass gate: OpenCLAW returns a review-ready dossier. (Seam already proven both transports.)

Env matrix — the new variables min-env, max-defaults

Parallel lanes & what I do on green chunked, non-overlapping

The change-sets map onto independent lanes — different files, different services — so they parallelize cleanly, each behind its POC gate.