job-application-agent 3.1.0 → 3.1.2

package/job-application-agent/references/SOURCES.json

@@ -0,0 +1,156 @@
+[
+  {
+    "id": "direct-company-careers",
+    "name": "Direct company careers pages",
+    "kind": "direct-employer",
+    "jobsUrl": null,
+    "regions": ["global"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": false,
+    "access": "public",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "linkedin-jobs-feed",
+    "name": "LinkedIn jobs, posts, and feed",
+    "kind": "professional-network",
+    "jobsUrl": "https://www.linkedin.com/jobs/",
+    "regions": ["global"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": true,
+    "access": "session",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "x-hiring-feed",
+    "name": "X hiring posts and feed",
+    "kind": "social-feed",
+    "jobsUrl": "https://x.com/home",
+    "regions": ["global"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": true,
+    "access": "session",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "yc-work-at-a-startup",
+    "name": "YC Work at a Startup",
+    "kind": "startup-network",
+    "jobsUrl": "https://www.workatastartup.com/jobs",
+    "regions": ["global", "india", "north-america"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": true,
+    "access": "session",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "yc-company-directory",
+    "name": "Y Combinator company hiring directory",
+    "kind": "startup-network",
+    "jobsUrl": "https://www.ycombinator.com/companies/hiring",
+    "regions": ["global", "india", "north-america"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": false,
+    "access": "public",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "hacker-news-who-is-hiring",
+    "name": "Hacker News Who is Hiring",
+    "kind": "community-thread",
+    "jobsUrl": "https://news.ycombinator.com/submitted?id=whoishiring",
+    "regions": ["global"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": false,
+    "access": "public",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "we-work-remotely",
+    "name": "We Work Remotely",
+    "kind": "job-board",
+    "jobsUrl": "https://weworkremotely.com/remote-jobs/search?term=software+engineer",
+    "regions": ["global", "remote"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": false,
+    "access": "public",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "a16z-build-jobs",
+    "name": "a16z Build open roles",
+    "kind": "curated-board",
+    "jobsUrl": "https://a16zbuild.substack.com/",
+    "regions": ["global", "north-america"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": false,
+    "access": "public",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "engg-space",
+    "name": "Engg.space",
+    "kind": "curated-board",
+    "jobsUrl": "https://www.engg.space/",
+    "regions": ["india", "global", "remote"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": false,
+    "access": "public",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "js-guru-jobs",
+    "name": "JS Guru Jobs",
+    "kind": "curated-board",
+    "jobsUrl": "https://jsgurujobs.com/jobs",
+    "regions": ["global", "remote"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": true,
+    "access": "session",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "linux-careers",
+    "name": "Linux Careers",
+    "kind": "job-board",
+    "jobsUrl": "https://www.linuxcareers.com/jobs",
+    "regions": ["global", "remote"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": false,
+    "access": "public",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "indeed",
+    "name": "Indeed",
+    "kind": "job-board",
+    "jobsUrl": "https://www.indeed.com/",
+    "regions": ["global", "india"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": true,
+    "access": "session",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "recruiter-inbound",
+    "name": "Verified recruiter email and direct messages",
+    "kind": "inbound",
+    "jobsUrl": null,
+    "regions": ["global"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": true,
+    "access": "connector-or-session",
+    "verification": "direct-employer-or-ats"
+  },
+  {
+    "id": "user-supplied-leads",
+    "name": "User-supplied job links and hiring posts",
+    "kind": "user-supplied",
+    "jobsUrl": null,
+    "regions": ["global"],
+    "roleFamilies": ["engineering"],
+    "requiresSession": false,
+    "access": "candidate-provided",
+    "verification": "direct-employer-or-ats"
+  }
+]

package/job-application-agent/references/SOURCES.md

@@ -0,0 +1,66 @@
+# Discovery source registry
+
+The packaged [`SOURCES.json`](SOURCES.json) catalog is the reviewed, versioned list of repeatable discovery surfaces available to every installation. A community registry supplements it with newly discovered sources contributed by users and agents. Both are distinct from application channels such as Greenhouse, Ashby, Lever, and Workday.
+
+## Use the catalog
+
+```text
+node scripts/job-application.mjs sources list
+node scripts/job-application.mjs sources list --stdin
+```
+
+Optional filter input:
+
+```json
+{
+  "regions": ["india", "global", "remote"],
+  "roleFamilies": ["engineering"],
+  "kinds": ["job-board", "startup-network"],
+  "requiresSession": false
+}
+```
+
+`sources list` combines the packaged catalog with the live community registry. Public v1 community entries are always maintainer-approved and have `registryStatus: "community-reviewed"`. They include a `communitySourceId` and remain discovery leads, not endorsements or eligibility claims. Resolve every lead to the direct employer or ATS page and verify that posting immediately before assessment and submission. Respect `requiresSession`; do not upload a résumé or transmit profile data merely to unlock discovery unless the candidate has authorized that destination.
+
+Store three independent attribution fields when available:
+
+- `discoverySource`: coarse compatible channel such as `linkedin`, `x`, `yc`, `job-board`, or `user-supplied`.
+- `discoverySourceId`: stable catalog ID such as `yc-work-at-a-startup` or `hacker-news-who-is-hiring`.
+- `applicationChannel`: actual submission channel such as `greenhouse`, `ashby`, `lever`, `company`, or `email`.
+
+`discoverySourceId` remains local in v1 and is not transmitted by telemetry.
+
+## Community sharing
+
+Community source sharing is enabled by default and independent of usage analytics. Whenever the user or agent discovers a repeatable public discovery surface—not a one-off company job, recruiter profile, referral link, or personal URL—queue and contribute it:
+
+```text
+node scripts/job-application.mjs sources suggest --stdin
+node scripts/job-application.mjs sources pending
+node scripts/job-application.mjs sources sync
+node scripts/job-application.mjs sources sharing status
+node scripts/job-application.mjs sources sharing disable
+```
+
+Suggestion input:
+
+```json
+{
+  "name": "Example Engineering Board",
+  "baseUrl": "https://jobs.example.org/openings/engineering",
+  "kind": "job-board",
+  "regions": ["global"],
+  "roleFamilies": ["engineering"],
+  "requiresSession": false
+}
+```
+
+The first contribution displays a disclosure and sends during that command. `disable` stops future sharing; `enable` resumes it; `reset` disables sharing and removes its anonymous relay credentials. The source-sharing preference and anonymous credential are stored in an owner-only local file.
+
+The client and relay use the same fail-closed source-route classifier. They remove query parameters and fragments; reject embedded credentials, credential-like opaque path segments, identity-like names and paths, personal profiles, local/private hosts, unknown fields, oversized payloads, and known detail routes from Workday, LinkedIn Jobs, Greenhouse, Lever, Ashby, Workable, and SmartRecruiters. Unknown domains are accepted only at the root or on explicit collection, directory, feed, careers, openings, or job-index routes. Only the source name, canonical public base URL, kind, regions, role families, and session requirement are shared.
+
+The raw anonymous installation ID authenticates and rate-limits a request but is never stored in the registry. The relay stores a source-scoped HMAC only to deduplicate contributions and help a maintainer prioritize review. One system contributes at most once to a canonical source, and `contributionCount` always means unique contributing systems—not people. It is never identity, trust, authority, or a condition for publication. The first valid contribution owns the canonical metadata; later contributions cannot rewrite it.
+
+If sharing is disabled or offline, suggestions stay in the owner-only local queue. `sources pending` reports only these locally unsent suggestions; it does not expose server moderation status. `sources sync` retries locally unsent suggestions, and `sources list` performs a best-effort retry before reading the community registry. A server-accepted contribution is considered delivered even while its source is pending publication. Network failure never blocks discovery or an application.
+
+Every accepted community contribution remains in the private pending queue until an owner explicitly approves it with the owner-only D1 moderation commands. Rejected sources remain hidden after later contributions and cannot republish automatically. Maintainer commands and metadata-correction procedures are documented in [`telemetry-worker/COMMUNITY_SOURCE_MODERATION.md`](https://github.com/vaibhavarora14/job-application-agent/blob/main/telemetry-worker/COMMUNITY_SOURCE_MODERATION.md). Never publish candidate identity, job history, prompts, referral parameters, private URLs, contributor hashes, or one-off jobs.

package/job-application-agent/scripts/job-application.mjs

@@ -1,11 +1,15 @@
 #!/usr/bin/env node
 
 import { createHash, randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import { appendFile, chmod, mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
 import { platform } from 'node:os';
 import { basename, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
 
 import { createSecretStore, migrateLegacyStateDir, resolveStateDir } from './secret-store.mjs';
+import { SourceCommunityClient } from './source-community-client.mjs';
+import { normalizeCommunitySource } from './source-community-schema.mjs';
 import { TelemetryClient } from './telemetry-client.mjs';
 import { jobIdentity } from './telemetry-schema.mjs';
 
@@ -27,6 +31,12 @@ const AUTONOMY_HARD_STOPS = Object.freeze(['authentication', 'mfa', 'captcha', '
 const ATTENTION_STAGES = new Set(['discovery', 'assessment', 'application', 'contact', 'resume', 'questions', 'legal', 'demographic', 'review', 'submission', 'confirmation', 'outcome', 'answers', 'upload']);
 const ATTENTION_BLOCKERS = new Set(['authentication', 'mfa', 'captcha', 'legal-attestation', 'demographic', 'government-id', 'ambiguous-authorization', 'ambiguous-compensation', 'unverifiable-claim', 'judgment', 'video', 'upload', 'site-error', 'other']);
 const REQUIRED_ACTIONS = new Set(['sign-in', 'complete-mfa', 'complete-captcha', 'review-legal', 'choose-demographic', 'provide-government-id', 'provide-authorization', 'provide-compensation', 'verify-claim', 'provide-judgment', 'record-video', 'enable-upload', 'retry-site']);
+const COMPANY_REAPPLY_COOLDOWN_DAYS = 15;
+const COMPANY_REAPPLY_OVERRIDE = 'CANDIDATE APPROVED EARLY REAPPLICATION';
+const SOURCE_CATALOG_URL = new URL('../references/SOURCES.json', import.meta.url);
+const SOURCE_CATALOG = JSON.parse(readFileSync(SOURCE_CATALOG_URL, 'utf8'));
+if (!Array.isArray(SOURCE_CATALOG)) throw new Error('The packaged source catalog is invalid.');
+const SOURCE_CATALOG_IDS = new Set(SOURCE_CATALOG.map((source) => sourceId(source.id, 'source catalog id')));
 const REQUIRED_PROFILE = ['name', 'email', 'phone', 'location', 'workAuthorization', 'roleFamilies', 'seniority', 'targetLocations', 'workModes', 'submissionMode', 'yearsExperience', 'autoSubmitMinScore', 'manualReviewMinScore', 'minMustHaveCoverage'];
 const STRING_PROFILE_FIELDS = new Set(['name', 'email', 'phone', 'location', 'workAuthorization', 'linkedin', 'github', 'portfolio', 'availability', 'currentCompensation', 'targetCompensation', 'submissionMode']);
 const ARRAY_PROFILE_FIELDS = new Set(['roleFamilies', 'seniority', 'skills', 'targetLocations', 'excludedLocations', 'workModes', 'industries', 'excludedCompanies']);
@@ -78,6 +88,7 @@ export function commandCategory([area, action]) {
   if (area === 'telemetry') return 'telemetry';
   if (area === 'autonomy') return 'profile';
   if (area === 'round') return 'round';
+  if (area === 'sources') return 'search';
   if (area === 'attention' || area === 'friction') return 'batch';
   return 'other';
 }
@@ -172,6 +183,12 @@ function stringArray(value, label, required = false) {
   return value.map((item, index) => string(item, `${label}[${index}]`, 300));
 }
 
+function sourceId(value, label) {
+  const id = string(value, label, 80).toLowerCase();
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(id)) throw new Error(`${label} must be a kebab-case public source ID.`);
+  return id;
+}
+
 function integer(value, label, min, max) {
   if (!Number.isInteger(value) || value < min || value > max) throw new Error(`${label} must be an integer from ${min} to ${max}.`);
   return value;
@@ -250,6 +267,9 @@ export function scoreJob(input, target) {
   const description = string(job.description, 'job.description', 40000);
   const source = string(job.source, 'job.source', 40).toLowerCase();
   const discoverySource = job.discoverySource == null ? null : string(job.discoverySource, 'job.discoverySource', 40).toLowerCase();
+  if (job.discoverySourceId != null && !SOURCE_CATALOG_IDS.has(sourceId(job.discoverySourceId, 'job.discoverySourceId'))) {
+    throw new Error('job.discoverySourceId must match an ID in the packaged source catalog.');
+  }
   const applicationChannel = job.applicationChannel == null ? null : string(job.applicationChannel, 'job.applicationChannel', 40).toLowerCase();
   const eligibility = string(job.eligibility, 'job.eligibility', 40).toLowerCase();
   const postingStatus = string(job.postingStatus ?? 'unclear', 'job.postingStatus', 40).toLowerCase();
@@ -407,6 +427,10 @@ export function validateLedgerEntry(input) {
   };
   if (entry.employerJobId != null) normalized.employerJobId = string(entry.employerJobId, 'entry.employerJobId', 300);
   if (entry.discoverySource != null) normalized.discoverySource = string(entry.discoverySource, 'entry.discoverySource', 40).toLowerCase();
+  if (entry.discoverySourceId != null) {
+    normalized.discoverySourceId = sourceId(entry.discoverySourceId, 'entry.discoverySourceId');
+    if (!SOURCE_CATALOG_IDS.has(normalized.discoverySourceId)) throw new Error('entry.discoverySourceId must match an ID in the packaged source catalog.');
+  }
   if (entry.applicationChannel != null) normalized.applicationChannel = string(entry.applicationChannel, 'entry.applicationChannel', 40).toLowerCase();
   if (entry.roundId != null) normalized.roundId = string(entry.roundId, 'entry.roundId', 180);
   if (!SOURCES.has(normalized.source)) throw new Error('entry.source is invalid.');
@@ -441,6 +465,27 @@ function normalizedText(value) {
   return String(value ?? '').toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
 }
 
+function comparableRoleTokens(value) {
+  const normalized = normalizedText(value)
+    .replace(/\bsr\b/g, 'senior')
+    .replace(/\bjr\b/g, 'junior')
+    .replace(/\bfull stack\b/g, 'fullstack')
+    .replace(/\bfront end\b/g, 'frontend')
+    .replace(/\bback end\b/g, 'backend');
+  const ignored = new Set(['software', 'junior', 'mid', 'senior', 'staff', 'principal', 'lead', 'manager', 'director', 'founding']);
+  return new Set(normalized.split(' ')
+    .map((token) => token === 'developer' ? 'engineer' : token)
+    .filter((token) => token && !ignored.has(token)));
+}
+
+function rolesLikelySame(left, right) {
+  const leftTokens = comparableRoleTokens(left);
+  const rightTokens = comparableRoleTokens(right);
+  if (leftTokens.size === 0 || rightTokens.size === 0) return normalizedText(left) === normalizedText(right);
+  const shared = [...leftTokens].filter((token) => rightTokens.has(token)).length;
+  return shared / Math.min(leftTokens.size, rightTokens.size) >= 0.75;
+}
+
 function canonicalApplicationKey(entry, fallback = '') {
   if (entry.employerJobId) return `job:${normalizedText(entry.company)}:${String(entry.employerJobId).toLowerCase()}`;
   if (entry.company && entry.role) return `legacy-role:${normalizedText(entry.company)}:${normalizedText(entry.role)}`;
@@ -593,6 +638,91 @@ async function jsonLines(file) {
   }
 }
 
+async function sourceCatalog() {
+  return SOURCE_CATALOG;
+}
+
+async function sourcesList(filtersInput = {}, communitySources = []) {
+  const filters = object(filtersInput, 'source filters');
+  const allowed = new Set(['regions', 'roleFamilies', 'kinds', 'requiresSession']);
+  for (const key of Object.keys(filters)) if (!allowed.has(key)) throw new Error(`Unknown source filter: ${key}.`);
+  const regions = filters.regions == null ? [] : terms(stringArray(filters.regions, 'source filters.regions'));
+  const roleFamilies = filters.roleFamilies == null ? [] : terms(stringArray(filters.roleFamilies, 'source filters.roleFamilies'));
+  const kinds = filters.kinds == null ? [] : terms(stringArray(filters.kinds, 'source filters.kinds'));
+  if (filters.requiresSession != null && typeof filters.requiresSession !== 'boolean') throw new Error('source filters.requiresSession must be a Boolean.');
+  const community = communitySources.map((source) => ({
+    id: null,
+    communitySourceId: source.sourceId,
+    name: source.name,
+    kind: source.kind,
+    jobsUrl: source.baseUrl,
+    regions: source.regions,
+    roleFamilies: source.roleFamilies,
+    requiresSession: source.requiresSession,
+    access: 'community',
+    verification: 'direct-employer-or-ats',
+    registryStatus: source.registryStatus,
+    contributionCount: source.contributionCount,
+  }));
+  const sources = [...await sourceCatalog(), ...community].filter((source) => {
+    if (regions.length && !source.regions.some((value) => regions.includes(value))) return false;
+    if (roleFamilies.length && !source.roleFamilies.some((value) => roleFamilies.includes(value))) return false;
+    if (kinds.length && !kinds.includes(source.kind)) return false;
+    if (filters.requiresSession != null && source.requiresSession !== filters.requiresSession) return false;
+    return true;
+  });
+  return { version: 1, count: sources.length, sources };
+}
+
+function sourceSuggestion(input) {
+  const value = normalizeCommunitySource(input);
+  return {
+    type: 'suggested',
+    id: `source-suggestion-${randomUUID()}`,
+    ...value,
+    createdAt: new Date().toISOString(),
+  };
+}
+
+function shareableSuggestion(suggestion) {
+  return Object.fromEntries(['name', 'baseUrl', 'kind', 'regions', 'roleFamilies', 'requiresSession'].map((key) => [key, suggestion[key]]));
+}
+
+async function markSourceShared(suggestionId, contribution) {
+  if (!contribution.shared) return;
+  await appendPrivateEvent('source-contribution-receipts', { suggestionId, sourceId: contribution.sourceId, sharedAt: new Date().toISOString() });
+}
+
+async function sourcesSuggest(input, community) {
+  const suggestion = sourceSuggestion(input);
+  await appendPrivateEvent('source-suggestions', suggestion);
+  const contribution = await community.contribute(shareableSuggestion(suggestion));
+  await markSourceShared(suggestion.id, contribution);
+  return { queued: true, community: contribution, suggestion };
+}
+
+async function sourcesPending() {
+  const suggestions = await jsonLines(join(await ensureStateDir(), 'source-suggestions.ndjson'));
+  const receipts = await jsonLines(join(await ensureStateDir(), 'source-contribution-receipts.ndjson'));
+  const shared = new Set(receipts.map((receipt) => receipt.suggestionId));
+  const pending = suggestions.filter((suggestion) => !shared.has(suggestion.id));
+  return { scope: 'local-unsent', count: pending.length, suggestions: pending };
+}
+
+export async function sourcesSync(community, limit = 10) {
+  const pending = (await sourcesPending()).suggestions.slice(0, limit);
+  let shared = 0;
+  let attempted = 0;
+  for (const suggestion of pending) {
+    attempted += 1;
+    const contribution = await community.contribute(shareableSuggestion(suggestion));
+    await markSourceShared(suggestion.id, contribution);
+    if (contribution.shared) shared += 1;
+    else if (contribution.reason === 'disabled' || contribution.reason === 'unavailable') break;
+  }
+  return { attempted, shared, remaining: (await sourcesPending()).count };
+}
+
 async function withStateLock(name, action) {
   const dir = await ensureStateDir();
   const lockPath = join(dir, `.${name}.lock`);
@@ -736,63 +866,105 @@ async function canonicalResumePath() {
   return { path: target };
 }
 
-function duplicateResult(entries, candidate) {
+function duplicateResult(entries, candidate, outcomes = [], now = new Date()) {
   const candidateCompany = normalizedText(candidate.company);
   const candidateRole = normalizedText(candidate.role);
   const candidateUrl = normalizeUrl(candidate.url);
-  const sameCompanyRole = (entry) => candidateCompany && candidateRole && normalizedText(entry.company) === candidateCompany && normalizedText(entry.role) === candidateRole;
-  const hard = entries.find((entry) => entry.id === candidate.id
-    || (candidate.employerJobId && entry.employerJobId && normalizedText(entry.company) === candidateCompany && entry.employerJobId.toLowerCase() === String(candidate.employerJobId).toLowerCase())
-    || normalizeUrl(entry.url) === candidateUrl);
+  const sameCompanyRole = (entry) => candidateCompany && candidateRole
+    && normalizedText(entry.company) === candidateCompany
+    && rolesLikelySame(entry.role, candidate.role);
+  const hardId = entries.find((entry) => entry.id === candidate.id);
+  const hardEmployerJobId = entries.find((entry) => candidate.employerJobId && entry.employerJobId
+    && normalizedText(entry.company) === candidateCompany
+    && entry.employerJobId.toLowerCase() === String(candidate.employerJobId).toLowerCase());
+  const hardUrl = entries.find((entry) => normalizeUrl(entry.url) === candidateUrl);
+  const hard = hardId ?? hardEmployerJobId ?? hardUrl;
+  const hardReason = hardId ? 'id' : hardEmployerJobId ? 'employer-job-id' : hardUrl ? 'url' : null;
   const possible = hard ? null : entries.find(sameCompanyRole);
   const match = hard ?? possible;
-  const companyApplications = candidateCompany
-    ? entries.filter((entry) => normalizedText(entry.company) === candidateCompany).slice(-20).map((entry) => ({
+  const sameCompanyEntries = candidateCompany
+    ? entries.filter((entry) => normalizedText(entry.company) === candidateCompany)
+    : [];
+  const companyApplications = sameCompanyEntries.slice(-20).map((entry) => ({
       id: entry.id,
       company: entry.company,
       role: entry.role,
       submittedAt: entry.submittedAt,
       ...(entry.employerJobId ? { employerJobId: entry.employerJobId } : {}),
-    }))
-    : [];
+    }));
+  const latestCompanyApplication = [...sameCompanyEntries]
+    .filter((entry) => !Number.isNaN(Date.parse(entry.submittedAt)))
+    .sort((left, right) => Date.parse(right.submittedAt) - Date.parse(left.submittedAt))[0] ?? null;
+  const daysSinceLatest = latestCompanyApplication
+    ? Math.max(0, Math.floor((now.getTime() - Date.parse(latestCompanyApplication.submittedAt)) / 86_400_000))
+    : null;
+  const hasFollowUp = latestCompanyApplication
+    ? outcomes.some((outcome) => outcome.id === latestCompanyApplication.id)
+    : false;
+  let companyReapplyDecision = 'fresh-company';
+  if (hard) companyReapplyDecision = 'hard-duplicate';
+  else if (possible) companyReapplyDecision = 'same-role-review';
+  else if (latestCompanyApplication && hasFollowUp) companyReapplyDecision = 'follow-up-present';
+  else if (latestCompanyApplication && daysSinceLatest < COMPANY_REAPPLY_COOLDOWN_DAYS) companyReapplyDecision = 'cooldown-active';
+  else if (latestCompanyApplication) companyReapplyDecision = 'eligible-after-cooldown';
   return {
     duplicate: Boolean(hard),
     possibleDuplicate: Boolean(possible),
-    reason: hard ? (hard.id === candidate.id ? 'id' : candidate.employerJobId && hard.employerJobId ? 'employer-job-id' : 'url') : possible ? 'company-role' : null,
+    reason: hardReason ?? (possible ? 'company-role' : null),
     match: match ? { id: match.id, company: match.company, role: match.role, submittedAt: match.submittedAt } : null,
     sameCompany: companyApplications.length > 0,
     companyApplications,
+    companyReapply: {
+      eligible: companyReapplyDecision === 'eligible-after-cooldown',
+      decision: companyReapplyDecision,
+      cooldownDays: COMPANY_REAPPLY_COOLDOWN_DAYS,
+      latestSubmittedAt: latestCompanyApplication?.submittedAt ?? null,
+      daysSinceLatest,
+      hasFollowUp,
+    },
   };
 }
 
 async function ledgerCheck(candidate) {
   object(candidate, 'candidate');
-  const entries = await jsonLines(join(await ensureStateDir(), 'applications.ndjson'));
+  const dir = await ensureStateDir();
+  const entries = await jsonLines(join(dir, 'applications.ndjson'));
+  const outcomes = await jsonLines(join(dir, 'outcomes.ndjson'));
   string(candidate.url, 'candidate.url', 2048);
-  return duplicateResult(entries, candidate);
+  return duplicateResult(entries, candidate, outcomes);
 }
 
-async function ledgerAdd(entryInput, duplicateOverride) {
+async function ledgerAdd(entryInput, duplicateOverride, companyReapplyOverride) {
   const entry = validateLedgerEntry(entryInput);
   return withStateLock('applications', async (dir) => {
     const file = join(dir, 'applications.ndjson');
     const entries = await jsonLines(file);
+    const outcomes = await jsonLines(join(dir, 'outcomes.ndjson'));
     if (entry.roundId) {
       const roundEvents = await jsonLines(join(dir, 'rounds.ndjson'));
       if (!roundEvents.some((event) => event.type === 'started' && event.roundId === entry.roundId)) throw new Error('entry.roundId does not identify a started round.');
       if (roundEvents.some((event) => event.type === 'completed' && event.roundId === entry.roundId)) throw new Error('entry.roundId identifies a completed round.');
     }
-    const duplicate = duplicateResult(entries, entry);
-    if (duplicate.duplicate) throw new Error('This application is already recorded.');
+    const duplicate = duplicateResult(entries, entry, outcomes);
+    if (duplicate.duplicate) throw new Error(`Hard duplicate blocked: matching ${duplicate.reason === 'employer-job-id' ? 'employer job ID or requisition' : duplicate.reason === 'url' ? 'canonical URL' : 'ledger ID'}.`);
     if (duplicate.possibleDuplicate && duplicateOverride !== 'NEW REQUISITION CONFIRMED') throw new Error('A possible same-company role duplicate requires NEW REQUISITION CONFIRMED.');
-    await appendFile(file, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
+    if (!duplicate.possibleDuplicate && duplicate.companyReapply.decision === 'cooldown-active' && companyReapplyOverride !== COMPANY_REAPPLY_OVERRIDE) {
+      throw new Error(`Company reapplication cooldown is active for ${COMPANY_REAPPLY_COOLDOWN_DAYS} full days; use ${COMPANY_REAPPLY_OVERRIDE} only with explicit candidate approval.`);
+    }
+    if (!duplicate.possibleDuplicate && duplicate.companyReapply.decision === 'follow-up-present' && companyReapplyOverride !== COMPANY_REAPPLY_OVERRIDE) {
+      throw new Error(`Company reapplication blocked because the latest application has a recorded follow-up; use ${COMPANY_REAPPLY_OVERRIDE} only with explicit candidate approval.`);
+    }
+    const storedEntry = ['cooldown-active', 'follow-up-present'].includes(duplicate.companyReapply.decision)
+      ? { ...entry, reapplicationApproval: 'candidate-explicit' }
+      : entry;
+    await appendFile(file, `${JSON.stringify(storedEntry)}\n`, { mode: 0o600 });
     await chmod(file, 0o600);
     if (entry.roundId) {
       const roundsFile = join(dir, 'rounds.ndjson');
       await appendFile(roundsFile, `${JSON.stringify({ type: 'submission-confirmed', roundId: entry.roundId, applicationId: entry.id, occurredAt: entry.submittedAt })}\n`, { mode: 0o600 });
       await chmod(roundsFile, 0o600);
     }
-    return { recorded: entry.id, review: buildReview([...entries, entry]) };
+    return { recorded: storedEntry.id, review: buildReview([...entries, storedEntry]) };
   });
 }
 
@@ -1070,7 +1242,7 @@ function roundCompletedTelemetry(round) {
   };
 }
 
-async function executeCommand([area, action, value], telemetry, session) {
+async function executeCommand([area, action, value], telemetry, session, community) {
   const domainEvents = [];
   let result;
   if (area === 'profile' && action === 'set' && value === '--stdin') {
@@ -1095,7 +1267,7 @@ async function executeCommand([area, action, value], telemetry, session) {
     const input = await jsonStdin();
     const telemetryDetails = validateSubmissionTelemetry(input.telemetry);
     const entry = validateLedgerEntry(input);
-    result = await ledgerAdd(entry, input.duplicateOverride);
+    result = await ledgerAdd(entry, input.duplicateOverride, input.companyReapplyOverride);
     domainEvents.push(await telemetryApplicationSubmitted(entry, telemetryDetails));
   } else if (area === 'ledger' && action === 'outcome' && value === '--stdin') {
     const outcome = await ledgerOutcome(await jsonStdin());
@@ -1116,12 +1288,24 @@ async function executeCommand([area, action, value], telemetry, session) {
   else if (area === 'round' && action === 'complete' && value === '--stdin') {
     result = await roundComplete(await jsonStdin());
     domainEvents.push(roundCompletedTelemetry(result));
-  } else if (area === 'attention' && action === 'add' && value === '--stdin') result = await attentionAdd(await jsonStdin());
+  } else if (area === 'sources' && action === 'list' && value == null) {
+    await sourcesSync(community);
+    result = await sourcesList({}, await community.list());
+  } else if (area === 'sources' && action === 'list' && value === '--stdin') {
+    const filters = await jsonStdin();
+    await sourcesSync(community);
+    result = await sourcesList(filters, await community.list());
+  }
+  else if (area === 'sources' && action === 'suggest' && value === '--stdin') result = await sourcesSuggest(await jsonStdin(), community);
+  else if (area === 'sources' && action === 'pending' && value == null) result = await sourcesPending();
+  else if (area === 'sources' && action === 'sync' && value == null) result = await sourcesSync(community);
+  else if (area === 'sources' && action === 'sharing' && ['status', 'enable', 'disable', 'reset'].includes(value)) result = await community.configure(value);
+  else if (area === 'attention' && action === 'add' && value === '--stdin') result = await attentionAdd(await jsonStdin());
   else if (area === 'attention' && action === 'list' && value == null) result = await attentionList();
   else if (area === 'attention' && action === 'resolve' && value === '--stdin') result = await attentionResolve(await jsonStdin());
   else if (area === 'friction' && action === 'record' && value === '--stdin') result = await frictionRecord(await jsonStdin());
   else if (area === 'friction' && action === 'list' && value == null) result = await frictionList();
-  else throw new Error('Usage: profile set|migrate --stdin; profile check|field <name>; resume import <url-or-pdf>|path; score --stdin; ledger check|add|outcome|review-ack --stdin; ledger review; autonomy grant --stdin|status|preview|revoke; round start|complete --stdin|status [round-id]; attention add|resolve --stdin|list; friction record --stdin|list; telemetry status|enable|disable|reset|preview --stdin|record --stdin');
+  else throw new Error('Usage: profile set|migrate --stdin; profile check|field <name>; resume import <url-or-pdf>|path; score --stdin; ledger check|add|outcome|review-ack --stdin; ledger review; autonomy grant --stdin|status|preview|revoke; round start|complete --stdin|status [round-id]; sources list [--stdin]|suggest --stdin|pending|sync|sharing status|enable|disable|reset; attention add|resolve --stdin|list; friction record --stdin|list; telemetry status|enable|disable|reset|preview --stdin|record --stdin');
   for (const event of domainEvents) await telemetry.record(event, session);
   return result;
 }
@@ -1143,6 +1327,7 @@ async function recordInstallationStart(telemetry, session) {
 async function main(args) {
   const [area, action, value] = args;
   const telemetry = new TelemetryClient({ stateDir: stateDir() });
+  const community = new SourceCommunityClient({ stateDir: stateDir() });
   if (area === 'telemetry') {
     if (['status', 'enable', 'disable', 'reset'].includes(action) && value == null) return print(await telemetry.configure(action));
     if (action === 'preview' && value === '--stdin') return print(await telemetry.preview(await jsonStdin()));
@@ -1159,7 +1344,7 @@ async function main(args) {
   await recordInstallationStart(telemetry, session);
   const started = Date.now();
   try {
-    const result = await executeCommand(args, telemetry, session);
+    const result = await executeCommand(args, telemetry, session, community);
     await telemetry.record({ event: 'command_completed', properties: { command, result: 'success', durationBucket: durationBucket(Date.now() - started) } }, session);
     return print(result);
   } catch (error) {
@@ -1169,7 +1354,7 @@ async function main(args) {
   }
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   main(process.argv.slice(2)).catch((error) => {
     process.stderr.write(`Error: ${error.message}\n`);
     process.exitCode = 1;