job-application-agent 3.1.2 → 3.2.1

package/README.md

@@ -102,7 +102,7 @@ flowchart LR
 
 The bundled CLI handles private profile storage, résumé import, scoring, duplicate checks, resumable rounds, attention queues, and application/outcome ledgers. The coding agent handles discovery and browser interaction under the rules in [`SKILL.md`](job-application-agent/SKILL.md).
 
-Discovery combines the reviewed [`SOURCES.json`](job-application-agent/references/SOURCES.json) catalog with an anonymous community registry. Repeatable public boards and feeds found by users or agents are sanitized and shared by default through `sources suggest --stdin`; disable this independently with `sources sharing disable`. Each contribution enters a private pending moderation queue. Only a maintainer-reviewed source becomes publicly searchable. One-off jobs, personal profiles, referral parameters, and candidate data are never published as sources, and every lead must still resolve to a direct employer or ATS before use.
+Discovery combines the reviewed [`SOURCES.json`](job-application-agent/references/SOURCES.json) catalog with an anonymous community registry. Every confirmed application automatically contributes its canonical public job URL, company, role, application channel, and provider; prior confirmed ledger entries backfill during later commands after a one-command disclosure grace period. Jobs, repeatable boards, and feeds are logged pending and become visible in the public dashboard or CLI only after maintainer review. Disable both forms of community sharing independently from analytics with `sources sharing disable`.
 
 ## 🔐 Privacy
 
@@ -111,20 +111,21 @@ Discovery combines the reviewed [`SOURCES.json`](job-application-agent/reference
 | Profile | macOS Keychain or Windows Credential Manager |
 | Résumé and ledgers | Owner-only local state directory |
 | Browser login | Existing browser session |
-| Source-sharing preference | Owner-only local state directory |
+| Community-sharing preference and delivery receipts | Owner-only local state directory |
 | Skill code | Version-controlled installation directory |
 
 Candidate data, résumés, application history, credentials, and browser sessions are never committed to this repository.
 
 Anonymous structured analytics are enabled by default to improve the agent. They may include job and workflow categories, but never candidate identity, résumé content, prompts, answers, browser data, IP addresses, or raw errors.
 
-Anonymous community source sharing is also enabled by default, separately from analytics. It shares only sanitized metadata for repeatable public job-discovery surfaces. The registry stores no raw installation IDs; source-scoped contributor hashes and counts are used only for deduplication and moderation prioritization, never as identity or publication authority.
+Anonymous community sharing is also enabled by default, separately from analytics. Confirmed applications share only a canonical public job URL, company, role, application channel, optional coarse discovery source, and derived provider URL—never candidate identity, answers, résumé, score, referral parameters, or submission timestamp. Repeatable discovery surfaces share their bounded catalog metadata through a maintainer-review queue. The registry stores no raw installation IDs; record-scoped contributor hashes are used only for deduplication and counts, never as identity or publication authority.
 
 ```bash
 node ~/.agents/skills/job-application-agent/scripts/job-application.mjs telemetry status
 node ~/.agents/skills/job-application-agent/scripts/job-application.mjs telemetry disable
 node ~/.agents/skills/job-application-agent/scripts/job-application.mjs sources sharing status
 node ~/.agents/skills/job-application-agent/scripts/job-application.mjs sources sharing disable
+node ~/.agents/skills/job-application-agent/scripts/job-application.mjs sources jobs
 ```
 
 See [`ANALYTICS.md`](job-application-agent/references/ANALYTICS.md) for the event contract and retention policy, or view the [public aggregate dashboard](https://job-application-agent-telemetry.varora1406.workers.dev/).

package/job-application-agent/SKILL.md

@@ -24,7 +24,7 @@ Use `scripts/job-application.mjs` for private state and deterministic checks. Re
 5. Use `review-each` for per-application approval. Use `routine-auto` only when the current request authorizes the destination or batch and every automatic-eligibility condition passes.
 6. When the candidate explicitly grants continuing autonomy, read [references/AUTONOMY.md](references/AUTONOMY.md) and persist it with `autonomy grant --stdin`. Do not repeat skill-level upload or submission approval prompts while the active grant and profile both use `routine-auto`.
 7. Obey browser and tool confirmation requirements regardless of the stored mode or autonomy grant.
-8. Disclose default-enabled structured anonymous analytics and the `telemetry disable` control. Disclose default-enabled anonymous community source sharing and the independent `sources sharing disable` control. The CLI also displays these disclosures before the first eligible transmission.
+8. Disclose default-enabled structured anonymous analytics and the `telemetry disable` control. Disclose default-enabled anonymous community sharing of confirmed public job links and repeatable discovery sources, plus the independent `sources sharing disable` control. The CLI also displays these disclosures before the first eligible transmission.
 
 Never store passwords, MFA codes, government IDs, demographic data, CAPTCHA answers, browser session data, or inferred candidate facts.
 
@@ -32,8 +32,8 @@ Never store passwords, MFA codes, government IDs, demographic data, CAPTCHA answ
 
 Read [references/SOURCES.md](references/SOURCES.md) before the first discovery pass in a workflow.
 
-1. Run `sources list` (optionally filtered) and search the highest-signal packaged and maintainer-reviewed community sources. Resolve every lead to the direct employer or ATS page.
-2. Attribute the lead with coarse `discoverySource`, stable packaged-catalog `discoverySourceId` when known, and independent `applicationChannel`. Treat a one-off user link as `user-supplied`. Whenever a user or agent discovers a repeatable public board, feed, directory, or careers index that is not already listed, run `sources suggest --stdin`; the CLI contributes its sanitized metadata by default unless community sharing has been disabled.
+1. Run `sources jobs` for recently confirmed direct job links and `sources list` (optionally filtered) for the highest-signal packaged and maintainer-reviewed discovery sources. Resolve every lead to the direct employer or ATS page.
+2. Attribute the lead with coarse `discoverySource`, stable packaged or community `discoverySourceId` when known, and independent `applicationChannel`. Treat a one-off user link as `user-supplied`. Whenever a user or agent discovers a repeatable public board, feed, directory, or careers index that is not already listed, run `sources suggest --stdin`; the CLI contributes its sanitized metadata by default unless community sharing has been disabled.
 3. Verify the application channel immediately before assessment. Mark it `active`, `closed`, or `unclear`.
 4. Classify eligibility only after checking residence, location, work authorization, sponsorship, schedule, and employment type.
 5. Extract explicit seniority, experience range, work mode, locations, comparable published salary maximum, and all must-have requirements.
@@ -62,7 +62,7 @@ For batches, scheduled work, or resumable handoffs, read [references/RUNS.md](re
 8. Upload only the canonical resume unless the candidate explicitly provides another attachment. Resolve its absolute path with `resume path`, then follow [references/BROWSER_UPLOADS.md](references/BROWSER_UPLOADS.md). Use the browser's privileged path-based upload capability first; treat a visible native file picker as a fallback.
 9. Do not answer demographic questions. Stop for login/SSO/MFA, CAPTCHA, legal attestations, unclear authorization or compensation, sensitive identifiers, and judgment-only questions.
 10. Verify every required field, answer, attachment, and disclosure. Submit when the current request or active autonomy grant authorizes it.
-11. Record `submitted` only after visible success confirmation, using independent `discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` values. Record no submission when confirmation is missing or ambiguous.
+11. Record `submitted` only after visible success confirmation, using independent `discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` values. `ledger add` automatically shares the sanitized public job metadata and durably retries on relay failure; do not run a separate manual contribution. Record no submission when confirmation is missing or ambiguous.
 12. Record workflow telemetry with `telemetry record --stdin`. Let `ledger add` emit `application_submitted`; do not emit it twice. Pass job URLs and structured metrics only through documented transient fields.
 13. Queue hard stops with `attention add --stdin` and continue elsewhere. Record reproducible general-purpose failures with `friction record --stdin`; improvement work must never delay application work.
 
@@ -98,6 +98,7 @@ node scripts/job-application.mjs autonomy status|preview|revoke
 node scripts/job-application.mjs round start|complete --stdin
 node scripts/job-application.mjs round status [round-id]
 node scripts/job-application.mjs sources list [--stdin]
+node scripts/job-application.mjs sources jobs [--stdin]
 node scripts/job-application.mjs sources suggest --stdin
 node scripts/job-application.mjs sources pending
 node scripts/job-application.mjs sources sync

package/job-application-agent/references/ANALYTICS.md

@@ -25,7 +25,7 @@ node scripts/job-application.mjs telemetry record --stdin
 
 Telemetry is best effort. It has no offline queue, uses a short network timeout, and never changes the result of a job-application command.
 
-Community source sharing is a separate default-enabled feature with independent `sources sharing status|enable|disable|reset` controls. It does not send analytics events or store a raw contributor identity with a source; a source-scoped HMAC is used only for unique-system counting. See [`SOURCES.md`](SOURCES.md) for its exact public metadata contract.
+Community sharing is a separate default-enabled feature with independent `sources sharing status|enable|disable|reset` controls. Confirmed applications contribute bounded public job metadata, while repeatable discovery sources use maintainer review. Neither sends analytics events nor stores a raw contributor identity with a record; a record-scoped HMAC is used only for deduplication and unique-system counting. See [`SOURCES.md`](SOURCES.md) for the exact public metadata contracts.
 
 ## Identity boundary
 

package/job-application-agent/references/SCHEMAS.md

@@ -131,7 +131,7 @@ Add only after visible success confirmation.
 
 Use `duplicateOverride` only for a verified distinct requisition after a possible-duplicate warning. Use `companyReapplyOverride` only when the candidate explicitly approves a different-role reapplication during the cooldown or after a recorded outcome. Both override phrases and `telemetry` are transient. An accepted company reapplication override stores only `reapplicationApproval: "candidate-explicit"` in the private ledger. Use approval `APPROVE SUBMIT` for per-application approval or `STANDING AUTHORIZATION` when the current request authorizes routine batch submission.
 
-`discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` are optional for backward compatibility and should be supplied for new resumable rounds. `discoverySourceId` remains local and is not included in telemetry. `ledger check` returns hard duplicate status, bounded same-company history, and the same `companyReapply` decision enforced by `ledger add` while holding the application lock.
+`discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` are optional for backward compatibility and should be supplied for new resumable rounds. `discoverySourceId` accepts stable packaged and `community-…` source IDs; it remains local and is not included in telemetry. After a visibly confirmed submission, `ledger add` automatically contributes only the canonical public URL, company, role, application channel, optional coarse discovery source, and derived provider URL to the pending community job registry. Existing installations receive a one-command disclosure grace period before historical backfill; `sources sharing disable` opts out. The private answers, score, submission time, IDs, and round remain local, and no job appears publicly before maintainer review. `ledger check` returns hard duplicate status, bounded same-company history, and the same `companyReapply` decision enforced by `ledger add` while holding the application lock.
 
 ## Autonomy grant input
 

package/job-application-agent/references/SOURCES.md

@@ -1,12 +1,14 @@
 # Discovery source registry
 
-The packaged [`SOURCES.json`](SOURCES.json) catalog is the reviewed, versioned list of repeatable discovery surfaces available to every installation. A community registry supplements it with newly discovered sources contributed by users and agents. Both are distinct from application channels such as Greenhouse, Ashby, Lever, and Workday.
+The packaged [`SOURCES.json`](SOURCES.json) catalog is the reviewed, versioned list of repeatable discovery surfaces available to every installation. A community registry supplements it with maintainer-reviewed discovery sources and direct public job links from confirmed applications. Both remain distinct from application channels such as Greenhouse, Ashby, Lever, and Workday.
 
 ## Use the catalog
 
 ```text
 node scripts/job-application.mjs sources list
 node scripts/job-application.mjs sources list --stdin
+node scripts/job-application.mjs sources jobs
+echo '{"limit":25,"cursor":"opaque-cursor"}' | node scripts/job-application.mjs sources jobs --stdin
 ```
 
 Optional filter input:
@@ -20,24 +22,27 @@ Optional filter input:
 }
 ```
 
-`sources list` combines the packaged catalog with the live community registry. Public v1 community entries are always maintainer-approved and have `registryStatus: "community-reviewed"`. They include a `communitySourceId` and remain discovery leads, not endorsements or eligibility claims. Resolve every lead to the direct employer or ATS page and verify that posting immediately before assessment and submission. Respect `requiresSession`; do not upload a résumé or transmit profile data merely to unlock discovery unless the candidate has authorized that destination.
+`sources list` combines the packaged catalog with the live repeatable-source registry. Public v1 community entries are always maintainer-approved and have `registryStatus: "community-reviewed"`. Their `id` and `communitySourceId` are the same stable community ID and may be stored as `discoverySourceId`. `sources jobs` returns the newest maintainer-reviewed confirmed job links, 50 at a time by default, with an opaque `nextCursor` for pagination. Both are discovery leads, not endorsements or eligibility claims. Resolve every lead to the direct employer or ATS page and verify that posting immediately before assessment and submission.
 
 Store three independent attribution fields when available:
 
 - `discoverySource`: coarse compatible channel such as `linkedin`, `x`, `yc`, `job-board`, or `user-supplied`.
-- `discoverySourceId`: stable catalog ID such as `yc-work-at-a-startup` or `hacker-news-who-is-hiring`.
+- `discoverySourceId`: stable packaged or community ID such as `yc-work-at-a-startup` or `community-abcdef1234567890`.
 - `applicationChannel`: actual submission channel such as `greenhouse`, `ashby`, `lever`, `company`, or `email`.
 
 `discoverySourceId` remains local in v1 and is not transmitted by telemetry.
 
 ## Community sharing
 
-Community source sharing is enabled by default and independent of usage analytics. Whenever the user or agent discovers a repeatable public discovery surface—not a one-off company job, recruiter profile, referral link, or personal URL—queue and contribute it:
+Community sharing is enabled by default and independent of usage analytics. A confirmed `ledger add` queues and attempts the sanitized public job metadata automatically. Installations with historical applications consume one full disclosure command without transmission before backfill, giving them time to run `sources sharing disable`; an explicit `sources sharing enable` opts in immediately. New installations have no historical backfill and contribute the first newly confirmed job after displaying the notice. Existing confirmed ledger entries are the durable backfill/retry queue and are retried in bounded batches during later commands. No separate contribution command is required for applied jobs.
+
+Whenever the user or agent discovers a repeatable public discovery surface—not a recruiter profile, referral link, personal URL, or one-off job detail route—queue it for maintainer review:
 
 ```text
 node scripts/job-application.mjs sources suggest --stdin
 node scripts/job-application.mjs sources pending
 node scripts/job-application.mjs sources sync
+node scripts/job-application.mjs sources jobs
 node scripts/job-application.mjs sources sharing status
 node scripts/job-application.mjs sources sharing disable
 ```
@@ -55,12 +60,14 @@ Suggestion input:
 }
 ```
 
-The first contribution displays a disclosure and sends during that command. `disable` stops future sharing; `enable` resumes it; `reset` disables sharing and removes its anonymous relay credentials. The source-sharing preference and anonymous credential are stored in an owner-only local file.
+The first eligible contribution displays a disclosure and sends during that command. `disable` stops both job and discovery-source sharing; `enable` resumes and retries it; `reset` disables sharing and removes its anonymous relay credentials. The preference, anonymous credential, and delivery receipts are stored in owner-only local files.
+
+The applied-job contract contains only the canonical HTTPS job URL, company, role, application channel, optional coarse discovery source, and a server-derived provider URL. Referral, tracking, and fragment data are removed; a small allowlist of stable job/requisition query identifiers is retained so query-addressed jobs do not collapse together. The server adds day-bucketed first/last-seen dates and an anonymous agent-report count. Candidate identity, résumé, form answers, score, application timestamp, referral parameters, raw installation ID, and contributor hash are never public or stored with a community job. Every accepted record is logged as pending; only a maintainer-reviewed destination and matching company/role can become public. Canonical URL deduplication prevents repeated rows, and rejected records never republish automatically.
 
 The client and relay use the same fail-closed source-route classifier. They remove query parameters and fragments; reject embedded credentials, credential-like opaque path segments, identity-like names and paths, personal profiles, local/private hosts, unknown fields, oversized payloads, and known detail routes from Workday, LinkedIn Jobs, Greenhouse, Lever, Ashby, Workable, and SmartRecruiters. Unknown domains are accepted only at the root or on explicit collection, directory, feed, careers, openings, or job-index routes. Only the source name, canonical public base URL, kind, regions, role families, and session requirement are shared.
 
 The raw anonymous installation ID authenticates and rate-limits a request but is never stored in the registry. The relay stores a source-scoped HMAC only to deduplicate contributions and help a maintainer prioritize review. One system contributes at most once to a canonical source, and `contributionCount` always means unique contributing systems—not people. It is never identity, trust, authority, or a condition for publication. The first valid contribution owns the canonical metadata; later contributions cannot rewrite it.
 
-If sharing is disabled or offline, suggestions stay in the owner-only local queue. `sources pending` reports only these locally unsent suggestions; it does not expose server moderation status. `sources sync` retries locally unsent suggestions, and `sources list` performs a best-effort retry before reading the community registry. A server-accepted contribution is considered delivered even while its source is pending publication. Network failure never blocks discovery or an application.
+If sharing is disabled or offline, repeatable-source suggestions remain in their owner-only queue and confirmed jobs remain pending in the canonical ledger until a minimal delivery receipt exists. `sources pending` reports both kinds of locally unsent work. `sources sync` retries both, and `sources list` performs a best-effort retry before reading the registry. A server-accepted source suggestion is delivered even while pending moderation. Network failure never blocks discovery or an application.
 
-Every accepted community contribution remains in the private pending queue until an owner explicitly approves it with the owner-only D1 moderation commands. Rejected sources remain hidden after later contributions and cannot republish automatically. Maintainer commands and metadata-correction procedures are documented in [`telemetry-worker/COMMUNITY_SOURCE_MODERATION.md`](https://github.com/vaibhavarora14/job-application-agent/blob/main/telemetry-worker/COMMUNITY_SOURCE_MODERATION.md). Never publish candidate identity, job history, prompts, referral parameters, private URLs, contributor hashes, or one-off jobs.
+Every accepted repeatable-source contribution remains in the private moderation queue until an owner explicitly approves it with owner-only D1 commands. Rejected sources remain hidden after later contributions and cannot republish automatically. Maintainer procedures are documented in [`telemetry-worker/COMMUNITY_SOURCE_MODERATION.md`](https://github.com/vaibhavarora14/job-application-agent/blob/main/telemetry-worker/COMMUNITY_SOURCE_MODERATION.md). This moderation rule does not delay sanitized confirmed-job links.

package/job-application-agent/scripts/job-application.mjs

@@ -9,7 +9,7 @@ import { pathToFileURL } from 'node:url';
 
 import { createSecretStore, migrateLegacyStateDir, resolveStateDir } from './secret-store.mjs';
 import { SourceCommunityClient } from './source-community-client.mjs';
-import { normalizeCommunitySource } from './source-community-schema.mjs';
+import { normalizeCommunityJob, normalizeCommunitySource } from './source-community-schema.mjs';
 import { TelemetryClient } from './telemetry-client.mjs';
 import { jobIdentity } from './telemetry-schema.mjs';
 
@@ -37,6 +37,7 @@ const SOURCE_CATALOG_URL = new URL('../references/SOURCES.json', import.meta.url
 const SOURCE_CATALOG = JSON.parse(readFileSync(SOURCE_CATALOG_URL, 'utf8'));
 if (!Array.isArray(SOURCE_CATALOG)) throw new Error('The packaged source catalog is invalid.');
 const SOURCE_CATALOG_IDS = new Set(SOURCE_CATALOG.map((source) => sourceId(source.id, 'source catalog id')));
+const COMMUNITY_SOURCE_ID = /^community-[0-9a-f]{16}$/;
 const REQUIRED_PROFILE = ['name', 'email', 'phone', 'location', 'workAuthorization', 'roleFamilies', 'seniority', 'targetLocations', 'workModes', 'submissionMode', 'yearsExperience', 'autoSubmitMinScore', 'manualReviewMinScore', 'minMustHaveCoverage'];
 const STRING_PROFILE_FIELDS = new Set(['name', 'email', 'phone', 'location', 'workAuthorization', 'linkedin', 'github', 'portfolio', 'availability', 'currentCompensation', 'targetCompensation', 'submissionMode']);
 const ARRAY_PROFILE_FIELDS = new Set(['roleFamilies', 'seniority', 'skills', 'targetLocations', 'excludedLocations', 'workModes', 'industries', 'excludedCompanies']);
@@ -189,6 +190,12 @@ function sourceId(value, label) {
   return id;
 }
 
+function knownDiscoverySourceId(value, label) {
+  const id = sourceId(value, label);
+  if (!SOURCE_CATALOG_IDS.has(id) && !COMMUNITY_SOURCE_ID.test(id)) throw new Error(`${label} must match a packaged or community source ID.`);
+  return id;
+}
+
 function integer(value, label, min, max) {
   if (!Number.isInteger(value) || value < min || value > max) throw new Error(`${label} must be an integer from ${min} to ${max}.`);
   return value;
@@ -267,9 +274,7 @@ export function scoreJob(input, target) {
   const description = string(job.description, 'job.description', 40000);
   const source = string(job.source, 'job.source', 40).toLowerCase();
   const discoverySource = job.discoverySource == null ? null : string(job.discoverySource, 'job.discoverySource', 40).toLowerCase();
-  if (job.discoverySourceId != null && !SOURCE_CATALOG_IDS.has(sourceId(job.discoverySourceId, 'job.discoverySourceId'))) {
-    throw new Error('job.discoverySourceId must match an ID in the packaged source catalog.');
-  }
+  if (job.discoverySourceId != null) knownDiscoverySourceId(job.discoverySourceId, 'job.discoverySourceId');
   const applicationChannel = job.applicationChannel == null ? null : string(job.applicationChannel, 'job.applicationChannel', 40).toLowerCase();
   const eligibility = string(job.eligibility, 'job.eligibility', 40).toLowerCase();
   const postingStatus = string(job.postingStatus ?? 'unclear', 'job.postingStatus', 40).toLowerCase();
@@ -428,8 +433,7 @@ export function validateLedgerEntry(input) {
   if (entry.employerJobId != null) normalized.employerJobId = string(entry.employerJobId, 'entry.employerJobId', 300);
   if (entry.discoverySource != null) normalized.discoverySource = string(entry.discoverySource, 'entry.discoverySource', 40).toLowerCase();
   if (entry.discoverySourceId != null) {
-    normalized.discoverySourceId = sourceId(entry.discoverySourceId, 'entry.discoverySourceId');
-    if (!SOURCE_CATALOG_IDS.has(normalized.discoverySourceId)) throw new Error('entry.discoverySourceId must match an ID in the packaged source catalog.');
+    normalized.discoverySourceId = knownDiscoverySourceId(entry.discoverySourceId, 'entry.discoverySourceId');
   }
   if (entry.applicationChannel != null) normalized.applicationChannel = string(entry.applicationChannel, 'entry.applicationChannel', 40).toLowerCase();
   if (entry.roundId != null) normalized.roundId = string(entry.roundId, 'entry.roundId', 180);
@@ -642,7 +646,7 @@ async function sourceCatalog() {
   return SOURCE_CATALOG;
 }
 
-async function sourcesList(filtersInput = {}, communitySources = []) {
+export async function sourcesList(filtersInput = {}, communitySources = []) {
   const filters = object(filtersInput, 'source filters');
   const allowed = new Set(['regions', 'roleFamilies', 'kinds', 'requiresSession']);
   for (const key of Object.keys(filters)) if (!allowed.has(key)) throw new Error(`Unknown source filter: ${key}.`);
@@ -651,7 +655,7 @@ async function sourcesList(filtersInput = {}, communitySources = []) {
   const kinds = filters.kinds == null ? [] : terms(stringArray(filters.kinds, 'source filters.kinds'));
   if (filters.requiresSession != null && typeof filters.requiresSession !== 'boolean') throw new Error('source filters.requiresSession must be a Boolean.');
   const community = communitySources.map((source) => ({
-    id: null,
+    id: source.sourceId,
     communitySourceId: source.sourceId,
     name: source.name,
     kind: source.kind,
@@ -709,6 +713,10 @@ async function sourcesPending() {
   return { scope: 'local-unsent', count: pending.length, suggestions: pending };
 }
 
+async function communityPendingStatus() {
+  return { ...await sourcesPending(), communityJobs: await communityJobsPending() };
+}
+
 export async function sourcesSync(community, limit = 10) {
   const pending = (await sourcesPending()).suggestions.slice(0, limit);
   let shared = 0;
@@ -723,6 +731,69 @@ export async function sourcesSync(community, limit = 10) {
   return { attempted, shared, remaining: (await sourcesPending()).count };
 }
 
+function shareableLedgerJob(entry) {
+  return normalizeCommunityJob({
+    url: entry.url,
+    company: entry.company,
+    role: entry.role,
+    applicationChannel: entry.applicationChannel ?? entry.source,
+    ...(entry.discoverySource == null ? {} : { discoverySource: entry.discoverySource }),
+  });
+}
+
+async function markCommunityJobShared(applicationId, contribution) {
+  if (!contribution.shared) return;
+  await appendPrivateEvent('community-job-contribution-receipts', {
+    applicationId,
+    jobId: contribution.jobId,
+    sharedAt: new Date().toISOString(),
+  });
+}
+
+export async function communityJobsPending() {
+  const directory = await ensureStateDir();
+  const applications = await jsonLines(join(directory, 'applications.ndjson'));
+  const receipts = await jsonLines(join(directory, 'community-job-contribution-receipts.ndjson'));
+  const shared = new Set(receipts.map((receipt) => receipt.applicationId));
+  const pending = [];
+  let unshareable = 0;
+  for (const entry of applications) {
+    if (shared.has(entry.id)) continue;
+    try {
+      pending.push({ applicationId: entry.id, job: shareableLedgerJob(entry) });
+    } catch {
+      unshareable += 1;
+    }
+  }
+  return { count: pending.length, unshareable, applications: pending };
+}
+
+export async function communityJobsSync(community, { limit = 10, applicationIds = null } = {}) {
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) throw new Error('Community job sync limit must be between 1 and 100.');
+  const selected = applicationIds == null ? null : new Set(applicationIds);
+  const state = await communityJobsPending();
+  const pending = state.applications.filter((entry) => selected == null || selected.has(entry.applicationId)).slice(0, limit);
+  let attempted = 0;
+  let shared = 0;
+  for (const entry of pending) {
+    attempted += 1;
+    const contribution = await community.contributeJob(entry.job);
+    await markCommunityJobShared(entry.applicationId, contribution);
+    if (contribution.shared) shared += 1;
+    else if (contribution.reason === 'disabled' || contribution.reason === 'unavailable' || contribution.reason === 'grace') break;
+  }
+  const remaining = await communityJobsPending();
+  return { attempted, shared, remaining: remaining.count, unshareable: remaining.unshareable };
+}
+
+async function syncAllCommunityData(community) {
+  const sources = await sourcesSync(community);
+  return {
+    ...sources,
+    communityJobs: await communityJobsSync(community),
+  };
+}
+
 async function withStateLock(name, action) {
   const dir = await ensureStateDir();
   const lockPath = join(dir, `.${name}.lock`);
@@ -1268,6 +1339,7 @@ async function executeCommand([area, action, value], telemetry, session, communi
     const telemetryDetails = validateSubmissionTelemetry(input.telemetry);
     const entry = validateLedgerEntry(input);
     result = await ledgerAdd(entry, input.duplicateOverride, input.companyReapplyOverride);
+    result.communityJob = await communityJobsSync(community, { limit: 1, applicationIds: [entry.id] });
     domainEvents.push(await telemetryApplicationSubmitted(entry, telemetryDetails));
   } else if (area === 'ledger' && action === 'outcome' && value === '--stdin') {
     const outcome = await ledgerOutcome(await jsonStdin());
@@ -1289,23 +1361,28 @@ async function executeCommand([area, action, value], telemetry, session, communi
     result = await roundComplete(await jsonStdin());
     domainEvents.push(roundCompletedTelemetry(result));
   } else if (area === 'sources' && action === 'list' && value == null) {
-    await sourcesSync(community);
+    await syncAllCommunityData(community);
     result = await sourcesList({}, await community.list());
   } else if (area === 'sources' && action === 'list' && value === '--stdin') {
     const filters = await jsonStdin();
-    await sourcesSync(community);
+    await syncAllCommunityData(community);
     result = await sourcesList(filters, await community.list());
   }
   else if (area === 'sources' && action === 'suggest' && value === '--stdin') result = await sourcesSuggest(await jsonStdin(), community);
-  else if (area === 'sources' && action === 'pending' && value == null) result = await sourcesPending();
-  else if (area === 'sources' && action === 'sync' && value == null) result = await sourcesSync(community);
-  else if (area === 'sources' && action === 'sharing' && ['status', 'enable', 'disable', 'reset'].includes(value)) result = await community.configure(value);
+  else if (area === 'sources' && action === 'pending' && value == null) result = await communityPendingStatus();
+  else if (area === 'sources' && action === 'sync' && value == null) result = await syncAllCommunityData(community);
+  else if (area === 'sources' && action === 'jobs' && value == null) result = await community.listJobs();
+  else if (area === 'sources' && action === 'jobs' && value === '--stdin') result = await community.listJobs(await jsonStdin());
+  else if (area === 'sources' && action === 'sharing' && ['status', 'enable', 'disable', 'reset'].includes(value)) {
+    result = await community.configure(value);
+    if (value === 'enable') result.communityJobs = await communityJobsSync(community);
+  }
   else if (area === 'attention' && action === 'add' && value === '--stdin') result = await attentionAdd(await jsonStdin());
   else if (area === 'attention' && action === 'list' && value == null) result = await attentionList();
   else if (area === 'attention' && action === 'resolve' && value === '--stdin') result = await attentionResolve(await jsonStdin());
   else if (area === 'friction' && action === 'record' && value === '--stdin') result = await frictionRecord(await jsonStdin());
   else if (area === 'friction' && action === 'list' && value == null) result = await frictionList();
-  else throw new Error('Usage: profile set|migrate --stdin; profile check|field <name>; resume import <url-or-pdf>|path; score --stdin; ledger check|add|outcome|review-ack --stdin; ledger review; autonomy grant --stdin|status|preview|revoke; round start|complete --stdin|status [round-id]; sources list [--stdin]|suggest --stdin|pending|sync|sharing status|enable|disable|reset; attention add|resolve --stdin|list; friction record --stdin|list; telemetry status|enable|disable|reset|preview --stdin|record --stdin');
+  else throw new Error('Usage: profile set|migrate --stdin; profile check|field <name>; resume import <url-or-pdf>|path; score --stdin; ledger check|add|outcome|review-ack --stdin; ledger review; autonomy grant --stdin|status|preview|revoke; round start|complete --stdin|status [round-id]; sources list [--stdin]|jobs [--stdin]|suggest --stdin|pending|sync|sharing status|enable|disable|reset; attention add|resolve --stdin|list; friction record --stdin|list; telemetry status|enable|disable|reset|preview --stdin|record --stdin');
   for (const event of domainEvents) await telemetry.record(event, session);
   return result;
 }
@@ -1345,6 +1422,7 @@ async function main(args) {
   const started = Date.now();
   try {
     const result = await executeCommand(args, telemetry, session, community);
+    if (!(area === 'sources' || (area === 'ledger' && action === 'add'))) await communityJobsSync(community).catch(() => null);
     await telemetry.record({ event: 'command_completed', properties: { command, result: 'success', durationBucket: durationBucket(Date.now() - started) } }, session);
     return print(result);
   } catch (error) {

package/job-application-agent/scripts/source-community-client.mjs

@@ -1,20 +1,28 @@
+import { existsSync } from 'node:fs';
 import { chmod, mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 
 import { SKILL_VERSION } from './telemetry-client.mjs';
-import { createSourceContributionEnvelope, normalizeCommunitySource, validateCommunitySourceList } from './source-community-schema.mjs';
+import {
+  createCommunityJobContributionEnvelope,
+  createSourceContributionEnvelope,
+  normalizeCommunityJob,
+  normalizeCommunitySource,
+  validateCommunityJobList,
+  validateCommunitySourceList,
+} from './source-community-schema.mjs';
 
 export const DEFAULT_SOURCE_COMMUNITY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL ?? process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https://job-application-agent-telemetry.varora1406.workers.dev';
-export const SOURCE_SHARING_NOTICE = 'Community source sharing is enabled by default. Repeatable public job boards and hiring feeds are shared anonymously into a pending maintainer-review queue after removing personal and referral data. Run `sources sharing disable` to opt out.\n';
+export const SOURCE_SHARING_NOTICE = 'Community sharing is enabled by default. Confirmed public job links are logged privately and enter maintainer review before publication, as do repeatable job boards and hiring feeds. Personal, answer, resume, score, referral, and candidate timing data are never sent. Run `sources sharing disable` to opt out.\n';
 
 const CONFIG_FILE = 'source-sharing.json';
 const CONFIG_LOCK_FILE = '.source-sharing.lock';
 const CONFIG_LOCK_TIMEOUT_MS = 15_000;
 const CONFIG_LOCK_STALE_MS = 60_000;
 
-function defaultConfig() {
-  return { version: 1, enabled: true, disclosed: false, installationId: null, token: null, tokenExpiresAt: null };
+function defaultConfig({ jobSharingGraceConsumed = true } = {}) {
+  return { version: 1, enabled: true, disclosed: false, jobSharingDisclosed: false, jobSharingGraceConsumed, installationId: null, token: null, tokenExpiresAt: null };
 }
 
 function sameCredentialState(left, right) {
@@ -44,15 +52,18 @@ async function writePrivate(file, value) {
 }
 
 export class SourceCommunityClient {
-  constructor({ stateDir, endpoint = DEFAULT_SOURCE_COMMUNITY_ENDPOINT, fetch: fetchFn = globalThis.fetch, stderr = (value) => process.stderr.write(value), now = () => new Date(), timeoutMs = Number(process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_TIMEOUT_MS ?? 3000) }) {
+  constructor({ stateDir, endpoint = DEFAULT_SOURCE_COMMUNITY_ENDPOINT, fetch: fetchFn = globalThis.fetch, stderr = (value) => process.stderr.write(value), now = () => new Date(), timeoutMs = Number(process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_TIMEOUT_MS ?? 3000), historicalApplicationsAtStart = null }) {
     this.stateDir = stateDir;
     this.endpoint = endpoint.replace(/\/$/, '');
     this.fetch = fetchFn;
     this.stderr = stderr;
     this.now = now;
     this.timeoutMs = timeoutMs;
+    this.historicalApplicationsAtStart = historicalApplicationsAtStart ?? existsSync(join(stateDir, 'applications.ndjson'));
   }
 
+  initialConfig() { return defaultConfig({ jobSharingGraceConsumed: !this.historicalApplicationsAtStart }); }
+
   get configPath() { return join(this.stateDir, CONFIG_FILE); }
   get configLockPath() { return join(this.stateDir, CONFIG_LOCK_FILE); }
 
@@ -64,10 +75,10 @@ export class SourceCommunityClient {
   async readConfig() {
     try {
       const value = JSON.parse(await readFile(this.configPath, 'utf8'));
-      return { version: 1, enabled: value.enabled !== false, disclosed: value.disclosed === true, installationId: value.installationId ?? null, token: value.token ?? null, tokenExpiresAt: value.tokenExpiresAt ?? null };
+      return { version: 1, enabled: value.enabled !== false, disclosed: value.disclosed === true, jobSharingDisclosed: value.jobSharingDisclosed === true, jobSharingGraceConsumed: value.jobSharingGraceConsumed === true, installationId: value.installationId ?? null, token: value.token ?? null, tokenExpiresAt: value.tokenExpiresAt ?? null };
     } catch (error) {
       if (error.code === 'ENOENT') return null;
-      return { version: 1, enabled: false, disclosed: true, installationId: null, token: null, tokenExpiresAt: null };
+      return { version: 1, enabled: false, disclosed: true, jobSharingDisclosed: true, jobSharingGraceConsumed: true, installationId: null, token: null, tokenExpiresAt: null };
     }
   }
 
@@ -134,7 +145,7 @@ export class SourceCommunityClient {
 
   async updateConfig(transform) {
     return this.withConfigLock(async () => {
-      const current = await this.readConfig() ?? defaultConfig();
+      const current = await this.readConfig() ?? this.initialConfig();
       const next = transform(current);
       await this.saveConfigUnlocked(next);
       return next;
@@ -145,7 +156,7 @@ export class SourceCommunityClient {
     return this.withConfigLock(async () => {
       const existing = await this.readConfig();
       if (existing) return existing;
-      const config = defaultConfig();
+      const config = this.initialConfig();
       await this.saveConfigUnlocked(config);
       return config;
     });
@@ -153,19 +164,26 @@ export class SourceCommunityClient {
 
   async status() {
     const config = await this.readConfig();
-    return { enabled: config?.enabled ?? true, disclosed: config?.disclosed ?? false, hasInstallationId: Boolean(config?.installationId), endpoint: this.endpoint, schemaVersion: 1 };
+    return { enabled: config?.enabled ?? true, disclosed: config?.disclosed ?? false, jobSharingDisclosed: config?.jobSharingDisclosed ?? false, hasInstallationId: Boolean(config?.installationId), endpoint: this.endpoint, schemaVersion: 1 };
   }
 
   async configure(action) {
     if (action === 'status') return this.status();
+    let discloseJobSharing = false;
     await this.updateConfig((config) => {
-      if (action === 'enable') config.enabled = true;
+      if (action === 'enable') {
+        config.enabled = true;
+        if (!config.jobSharingDisclosed) discloseJobSharing = true;
+        config.jobSharingDisclosed = true;
+        config.jobSharingGraceConsumed = true;
+      }
       else if (action === 'disable') config.enabled = false;
-      else if (action === 'reset') Object.assign(config, { enabled: false, disclosed: true, installationId: null, token: null, tokenExpiresAt: null });
+      else if (action === 'reset') Object.assign(config, { enabled: false, disclosed: true, jobSharingDisclosed: false, jobSharingGraceConsumed: false, installationId: null, token: null, tokenExpiresAt: null });
       else throw new Error('Source sharing action must be status, enable, disable, or reset.');
       config.disclosed = true;
       return config;
     });
+    if (discloseJobSharing) this.stderr(SOURCE_SHARING_NOTICE);
     return this.status();
   }
 
@@ -201,7 +219,7 @@ export class SourceCommunityClient {
       if (!config.enabled) return { shared: false, reason: 'disabled' };
       if (!config.disclosed) {
         this.stderr(SOURCE_SHARING_NOTICE);
-        config = await this.updateConfig((current) => ({ ...current, disclosed: true }));
+        config = await this.updateConfig((current) => ({ ...current, disclosed: true, jobSharingDisclosed: true, jobSharingGraceConsumed: true }));
         if (!config.enabled) return { shared: false, reason: 'disabled' };
       }
       config = await this.credentials(config);
@@ -240,15 +258,81 @@ export class SourceCommunityClient {
     });
   }
 
+  async contributeJob(input) {
+    const job = normalizeCommunityJob(input);
+    try {
+      let config = await this.config();
+      if (!config.enabled) return { shared: false, reason: 'disabled' };
+      if (!config.jobSharingDisclosed) {
+        this.stderr(SOURCE_SHARING_NOTICE);
+        const grace = !config.jobSharingGraceConsumed;
+        config = await this.updateConfig((current) => ({ ...current, disclosed: true, jobSharingDisclosed: true, jobSharingGraceConsumed: true }));
+        if (!config.enabled) return { shared: false, reason: 'disabled' };
+        if (grace) return { shared: false, reason: 'grace' };
+      } else if (!config.jobSharingGraceConsumed) {
+        config = await this.updateConfig((current) => ({ ...current, jobSharingGraceConsumed: true }));
+        if (!config.enabled) return { shared: false, reason: 'disabled' };
+        return { shared: false, reason: 'grace' };
+      }
+      config = await this.credentials(config);
+      let sent = await this.sendJobContribution(config, job);
+      if (sent.disabled) return { shared: false, reason: 'disabled' };
+      let response = sent.response;
+      if (response.status === 401) {
+        config = await this.updateConfig((current) => ({ ...current, tokenExpiresAt: null }));
+        config = await this.credentials(config);
+        sent = await this.sendJobContribution(config, job);
+        if (sent.disabled) return { shared: false, reason: 'disabled' };
+        response = sent.response;
+      }
+      if (!response.ok) return { shared: false, reason: 'unavailable' };
+      const result = await response.json();
+      const allowed = new Set(['accepted', 'jobId', 'publicationStatus', 'contributionCount']);
+      if (!result || typeof result !== 'object' || Array.isArray(result) || Object.keys(result).some((key) => !allowed.has(key))) return { shared: false, reason: 'unavailable' };
+      if (result.accepted !== true || !/^community-job-[0-9a-f]{16}$/.test(result.jobId)) return { shared: false, reason: 'unavailable' };
+      if (!['pending', 'published', 'rejected'].includes(result.publicationStatus)) return { shared: false, reason: 'unavailable' };
+      if (!Number.isSafeInteger(result.contributionCount) || result.contributionCount < 1 || result.contributionCount > 1_000_000_000) return { shared: false, reason: 'unavailable' };
+      return { shared: true, jobId: result.jobId, publicationStatus: result.publicationStatus, contributionCount: result.contributionCount };
+    } catch {
+      return { shared: false, reason: 'unavailable' };
+    }
+  }
+
+  async sendJobContribution(config, job) {
+    return this.withConfigLock(async () => {
+      const current = await this.readConfig() ?? config;
+      if (!current.enabled) return { disabled: true };
+      const envelope = createCommunityJobContributionEnvelope({ installationId: current.installationId, token: current.token, job, skillVersion: SKILL_VERSION });
+      const response = await this.fetch(`${this.endpoint}/v1/jobs`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(envelope), signal: AbortSignal.timeout(this.timeoutMs) });
+      return { disabled: false, response };
+    });
+  }
+
   async list() {
-    if (this.readUnavailable) return [];
+    if (this.sourceReadUnavailable) return [];
     try {
       const response = await this.fetch(`${this.endpoint}/v1/sources`, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(this.timeoutMs) });
       if (!response.ok) return [];
       return validateCommunitySourceList(await response.json());
     } catch {
-      this.readUnavailable = true;
+      this.sourceReadUnavailable = true;
       return [];
     }
   }
+
+  async listJobs({ limit = 50, cursor = null } = {}) {
+    if (this.jobReadUnavailable) return { version: 1, jobs: [], nextCursor: null };
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) throw new Error('Community job limit must be between 1 and 100.');
+    if (cursor !== null && (typeof cursor !== 'string' || !cursor || cursor.length > 1024)) throw new Error('Community job cursor is invalid.');
+    try {
+      const query = new URLSearchParams({ limit: String(limit) });
+      if (cursor !== null) query.set('cursor', cursor);
+      const response = await this.fetch(`${this.endpoint}/v1/jobs?${query}`, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(this.timeoutMs) });
+      if (!response.ok) return { version: 1, jobs: [], nextCursor: null };
+      return validateCommunityJobList(await response.json());
+    } catch {
+      this.jobReadUnavailable = true;
+      return { version: 1, jobs: [], nextCursor: null };
+    }
+  }
 }