Referso parity: research referso.com and close the auto-apply quality gap

[JL514]

Goal

ApplyPilot's auto-apply works, but not as well as referso.com. Build toward parity with (or an exact clone of) referso's application-automation experience.

Phase 1 — Research (this issue)

• Launch a persistent-profile dev browser; user logs into referso.com
• Explore the logged-in app: onboarding flow, profile/resume model, job matching, auto-apply behavior, dashboards/tracking
• Produce a feature-gap analysis: referso vs ApplyPilot, ranked by impact on apply success rate

Phase 2 — Scope (follow-up issues)

• Decide clone shape: web UI on top of ApplyPilot pipeline vs CLI/agent improvements
• Implement highest-impact gaps first

Notes

• Dev browser uses a persistent Chromium profile at ~/.applypilot/referso-profile with CDP on :9222 so research scripts can attach to the logged-in session

[JL514]

Research + diagnosis complete

Logged into a live Referso account, mapped the full product, and diagnosed ApplyPilot against its own run DB.

Headline: ApplyPilot discovered 428 jobs and scored all 428, but tailored only 4 and applied to 0. Referso (managed, server-side, async, applies to ATS endpoints) has 290 submitted.

Root causes (ranked):

1. Tailor stall (428→4) — the tailor stage aborts on the first rate-limit-exhausted LLM call (llm.py raises RuntimeError, run_tailoring has no per-job try/except), leaving ~76 eligible jobs untouched. ~20% per-attempt yield, failures never retried. Gemini free-tier limits amplify it.
2. Apply queue hard-gated on tailored_resume_path (launcher.py:134) with no base-resume fallback → pool was only the 4 tailored jobs.
3. No upstream work-mode/location filter → onsite roles reach apply and get tombstoned (apply_attempts=99 is a permanent-failure sentinel, not a runaway loop).
4. Applies to LinkedIn (sign-in walls/anti-bot) instead of ATS endpoints; apply_url = application_url or url, no ATS derivation.
5. Leaked in_progress locks with no lease/TTL reclaim; limit=1 default applies one job then exits.
6. Config split-brain — user's boards:/exclude_titles YAML keys silently ignored; salary/blocked-keyword filters parsed but never applied.

Security: profile.json stores the account password in plaintext (wizard writes it; remediate regardless of direction).

Architectural fork surfaced for decision: a self-hosted clone can match Referso's UI, tracking, matching, and tailoring, but matching a managed service's raw apply-success needs server-side apply + ATS targeting + retries. Recommended: hybrid — fix the pipeline locally now (apply 0→non-zero), design a relocatable queue so a later server-side lift is infra, not a rewrite.

Full docs on branch feature/GH-76-referso-parity: docs/referso-research.md, docs/parity-plan.md.