Bundle 50: analysis job and inspector

[nulleimy]

Purpose

Deliver the roadmap Bundle 50 user capability on top of canonical Bundle 49: a DJ can analyze imported tracks, see bounded progress, inspect BPM/key/Camelot/energy/confidence/provenance/warnings, filter uncertain/failed results, apply auditable manual corrections, and explicitly re-analyze.

Exact baseline

• canonical branch: feature/bundle-0-bootstrap
• exact canonical SHA: 70dbddd8f6c61de3e9c2c533eb4d01e9f892f3fe
• predecessor: merged PR Bundle 49: bounded import progress and cancellation lifecycle #106 / Bundle 49C

Existing reusable boundaries

• validated provider contract: CanonicalAnalysisResult and normalize_provider_result
• provider routing: RoutedAnalysisService
• baseline local MIR provider
• existing SQLite AnalysisRepository
• generic persisted JobManager / JobRepository foundation
• Bundle 49 trusted renderer → Tauri → authenticated loopback sidecar boundary

Gaps confirmed at baseline

• generic job contract has only scalar progress; no analysis-specific counts/scope/cancel lifecycle
• AnalysisRecord lacks provider version, key confidence, warnings and correction provenance required by the inspector
• AnalysisRepository has one current row per track and no correction audit trail
• legacy AudioAnalyzer persists directly and is not the desired Bundle 50 orchestration boundary
• desktop sidecar/Rust/renderer expose library import only; no bounded analysis authority yet
• README current-status section is stale and will be corrected only as documentation accompanying this bundle, without changing licensing or product authority

Required Bundle 50 contract

AnalysisJob

States: pending | running | cancelling | done | failed | cancelled

Count progress:

• selected
• completed
• succeeded
• failed
• uncertain

Rules:

• monotonic counts
• one track failure does not fail/corrupt the batch
• cancellation checked between tracks and bounded provider work units where available
• unknown/stale job IDs fail closed
• one active analysis job in the first desktop slice

Inspector read model

Per track, expose only bounded safe fields:

• track_id + safe display name/title/artist
• bpm + bpm_confidence
• key / key_tonic / key_scale / Camelot + key_confidence
• energy
• duration
• provider + provider_version + algorithm/analysis version
• warnings
• source = provider | manual-correction
• latest correction metadata without filesystem path leakage

Filters:

• all
• uncertain
• failed
• corrected

Manual correction

• correction never overwrites provider evidence silently
• append-only audit row
• current effective view distinguishes provider result from user override
• restart-safe persistence
• explicit re-analysis produces new provider evidence and does not erase correction history

Desktop authority surface

Renderer may receive only typed commands for:

• analysis start
• analysis status
• analysis cancel
• inspector list/read
• manual correction
• explicit re-analysis

No generic filesystem/shell/network/SQLite authority. Renderer never receives sidecar secret, nonce, port, PID or absolute paths.

Acceptance

• one file failure does not corrupt the batch
• cancellation is visible and bounded
• manual correction survives restart and is distinguishable from provider output
• analysis result provenance/warnings are inspectable
• exact-head Python CI, Desktop Sidecar Proof, Desktop Rust, PR Guard and review-thread checks are green before ready-for-review

Out of scope

• Bundle 51 transition scoring
• composition/set building
• cloud/network analysis
• concurrent analysis jobs
• resume after process restart
• production-authority promotion of a MIR provider
• release/deploy/signing/notarization

Governance

MERGE_AUTHORIZATION=NO
RELEASE_AUTHORIZATION=NO
DEPLOY_AUTHORIZATION=NO
PRODUCTION_EFFECTS=NO