Add common third party enricher worker

Introduce a poll-based worker that fills the global common_third_parties
catalog (URLs, headquarter address, legal name, certifications, logo)
so each tenant no longer starts from sparse, name-only rows. Enrichment
is requested at row creation by ResolveOrCreateCommonThirdParty; curated
seed rows are not enqueued, to avoid a re-seed storm.

The pipeline uses two specialized agents plus a deterministic logo step.
Agent A (company profile) resolves legal name, headquarter address, and
the canonical website over web search; its website and legal name feed
Agent B and the logo step. Agent B (compliance docs) resolves the legal
document URLs, trust/security/status pages, and certifications using the
browser read-only toolset (gated on ChromeDPAddr) plus web search. The
logo step restores pkg/webinspect as a pure deterministic package and
stores the discovered icon in S3, linked via logo_file_id.

Each agent returns per-field value/confidence/source_url. The worker
writes a column only when confidence clears a configurable threshold and
the field is not externally owned (seed or human), and always records
full per-field provenance in a new enrichment JSONB column so re-runs
fill only gaps and human edits are never clobbered. New bookkeeping
columns (enrichment_requested_at, enrichment, enrichment_attempts) back
the claim queue and stale recovery; agents run outside transactions and
results persist in one final transaction.

The worker is opt-in: it no-ops unless its agent provider is configured.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/probod/aliases.go

@@ -43,8 +43,9 @@ type (
 	ThirdPartyVettingWorkerConfig = probodconfig.ThirdPartyVettingWorkerConfig
 	AgentsConfig                  = probodconfig.AgentsConfig
 
-	TrackerMappingWorkerConfig          = probodconfig.TrackerMappingWorkerConfig
-	CommonPatternEnrichmentWorkerConfig = probodconfig.CommonPatternEnrichmentWorkerConfig
+	TrackerMappingWorkerConfig             = probodconfig.TrackerMappingWorkerConfig
+	CommonPatternEnrichmentWorkerConfig    = probodconfig.CommonPatternEnrichmentWorkerConfig
+	CommonThirdPartyEnrichmentWorkerConfig = probodconfig.CommonThirdPartyEnrichmentWorkerConfig
 
 	MailerConfig        = probodconfig.MailerConfig
 	SMTPConfig          = probodconfig.SMTPConfig

pkg/probod/common_third_party_enrichment.go

@@ -0,0 +1,73 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probod
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"go.gearno.de/kit/log"
+	"go.opentelemetry.io/otel/trace"
+	"go.probo.inc/probo/pkg/filemanager"
+	"go.probo.inc/probo/pkg/thirdparty"
+)
+
+// buildCommonThirdPartyEnrichmentConfig wires the common-third-party
+// enrichment worker config: the LLM client for its two agents plus the
+// worker tuning, browser endpoint, and logo-storage dependencies. It is
+// opt-in: a deployment that does not set
+// `llm.common-third-party-enrichment.provider` gets a zero config (nil
+// LLM client), so the worker runs as a no-op and the caller skips
+// registration.
+func (impl *Implm) buildCommonThirdPartyEnrichmentConfig(
+	l *log.Logger,
+	tp trace.TracerProvider,
+	r prometheus.Registerer,
+	fileManager *filemanager.Service,
+) (thirdparty.EnrichmentConfig, error) {
+	if impl.cfg.Agents.CommonThirdPartyEnrichment.Provider == "" {
+		return thirdparty.EnrichmentConfig{}, nil
+	}
+
+	agentCfg, llmClient, err := impl.resolveAgentClient(
+		"common-third-party-enrichment",
+		impl.cfg.Agents.CommonThirdPartyEnrichment,
+		l,
+		tp,
+		r,
+	)
+	if err != nil {
+		return thirdparty.EnrichmentConfig{}, fmt.Errorf("cannot resolve common third party enrichment agent client: %w", err)
+	}
+
+	workerCfg := impl.cfg.CommonThirdPartyEnrichmentWorker
+
+	return thirdparty.EnrichmentConfig{
+		LLMClient:           llmClient,
+		Model:               agentCfg.ModelName,
+		MaxTokens:           agentCfg.MaxTokens,
+		Temperature:         agentCfg.Temperature,
+		FirecrawlAPIKey:     impl.cfg.Agents.Tools.FirecrawlAPIKey,
+		ChromeAddr:          impl.cfg.ChromeDPAddr,
+		AgentTimeout:        time.Duration(workerCfg.AgentTimeout) * time.Second,
+		MaxTurns:            workerCfg.AgentMaxTurns,
+		ConfidenceThreshold: workerCfg.ConfidenceThreshold,
+		StaleAfter:          time.Duration(workerCfg.StaleAfter) * time.Second,
+		MaxAttempts:         workerCfg.MaxAttempts,
+		FileManager:         fileManager,
+		Bucket:              impl.cfg.AWS.Bucket,
+	}, nil
+}

pkg/probod/probod.go

@@ -181,6 +181,15 @@ func New() *Implm {
 				StaleAfter:     1500,
 				MaxConcurrency: 1,
 			},
+			CommonThirdPartyEnrichmentWorker: CommonThirdPartyEnrichmentWorkerConfig{
+				Interval:            10,
+				MaxConcurrency:      1,
+				StaleAfter:          900,
+				AgentTimeout:        90,
+				AgentMaxTurns:       12,
+				ConfidenceThreshold: 0.7,
+				MaxAttempts:         3,
+			},
 		},
 	}
 }
@@ -328,6 +337,11 @@ func (impl *Implm) Run(
 
 	fileManagerService := filemanager.NewService(pgClient, baseURL, s3Client)
 
+	commonThirdPartyEnrichmentCfg, err := impl.buildCommonThirdPartyEnrichmentConfig(l, tp, r, fileManagerService)
+	if err != nil {
+		return err
+	}
+
 	var (
 		samlCert *x509.Certificate
 		samlKey  *rsa.PrivateKey
@@ -819,6 +833,34 @@ func (impl *Implm) Run(
 		)
 	}
 
+	// The common-third-party enrichment worker fills catalog metadata
+	// (URLs, address, certifications, logo) via two agents plus a
+	// deterministic logo step. It needs an LLM client, so it is only
+	// started when its agent config is present.
+	stopCommonThirdPartyEnrichmentWorker := func() {}
+
+	if commonThirdPartyEnrichmentCfg.LLMClient != nil {
+		commonThirdPartyEnrichmentWorker := thirdparty.NewCommonThirdPartyEnrichmentWorker(
+			pgClient,
+			l.Named("common-third-party-enrichment-worker"),
+			commonThirdPartyEnrichmentCfg,
+			worker.WithInterval(time.Duration(impl.cfg.CommonThirdPartyEnrichmentWorker.Interval)*time.Second),
+			worker.WithMaxConcurrency(impl.cfg.CommonThirdPartyEnrichmentWorker.MaxConcurrency),
+		)
+
+		var commonThirdPartyEnrichmentWorkerCtx context.Context
+
+		commonThirdPartyEnrichmentWorkerCtx, stopCommonThirdPartyEnrichmentWorker = context.WithCancel(context.Background())
+
+		wg.Go(
+			func() {
+				if err := commonThirdPartyEnrichmentWorker.Run(commonThirdPartyEnrichmentWorkerCtx); err != nil {
+					cancel(fmt.Errorf("common third party enrichment worker crashed: %w", err))
+				}
+			},
+		)
+	}
+
 	mailingListWorker := mailman.NewMailingListWorker(mailmanService, pgClient, l.Named("mailing-list-worker"))
 	mailingListWorkerCtx, stopMailingListWorker := context.WithCancel(context.Background())
 
@@ -910,6 +952,7 @@ func (impl *Implm) Run(
 	stopTrackerPolicyWorker()
 	stopTrackerMappingWorker()
 	stopCommonPatternEnrichmentWorker()
+	stopCommonThirdPartyEnrichmentWorker()
 	stopMailingListWorker()
 	stopVettingWorker()
 	stopEvidenceDescriptionWorker()