job-application-agent 3.3.0 → 3.4.0

package/README.md

@@ -108,11 +108,14 @@ The bundled CLI handles private profile storage, résumé import, scoring, dupli
 
 Discovery combines the reviewed [`SOURCES.json`](job-application-agent/references/SOURCES.json) catalog with an anonymous community registry. Every confirmed application automatically contributes its canonical public job URL, company, role, application channel, and provider; prior confirmed ledger entries backfill during later commands after a one-command disclosure grace period. Jobs, repeatable boards, and feeds are logged pending and become visible in the public dashboard or CLI only after maintainer review. Disable both forms of community sharing independently from analytics with `sources sharing disable`.
 
+Rounds require recorded attempts across at least three distinct discovery sources, including a successful search, and source attribution for confirmed submissions. If more than 60% of submissions come from one source, the agent must explain the concentration. Blockers and empty results are reported; fit requirements never change to meet a source quota. See [round coverage](job-application-agent/references/RUNS.md#discovery-coverage).
+
 ## 🔐 Privacy
 
 | Data | Where it stays |
 |---|---|
 | Profile | macOS Keychain, Windows Credential Manager, or Linux Secret Service (libsecret) |
+| Analytics name and email (unless opted out) | Private PostHog events after disclosure; local sharing preference in owner-only state |
 | Résumé and ledgers | Owner-only local state directory |
 | Browser login | Existing browser session |
 | Community-sharing preference and delivery receipts | Owner-only local state directory |
@@ -120,12 +123,13 @@ Discovery combines the reviewed [`SOURCES.json`](job-application-agent/reference
 
 Candidate data, résumés, application history, credentials, and browser sessions are never committed to this repository.
 
-Anonymous structured analytics are enabled by default to improve the agent. They may include job and workflow categories, but never candidate identity, résumé content, prompts, answers, browser data, IP addresses, or raw errors.
+Structured usage analytics and name/email sharing are enabled by default for support and product improvement. After a disclosure command with no identity transmission, subsequent commands include the name and email explicitly saved in the candidate profile in the maintainer's private PostHog analytics. No résumé content, other profile fields, prompts, answers, browser data, IP addresses, or raw errors are sent. `telemetry identity disable` stops identity sharing and rotates the analytics UUID so future usage is anonymous; `telemetry disable` stops all analytics. Previously collected events remain subject to the retention policy.
 
 Anonymous community sharing is also enabled by default, separately from analytics. Confirmed applications share only a canonical public job URL, company, role, application channel, optional coarse discovery source, and derived provider URL—never candidate identity, answers, résumé, score, referral parameters, or submission timestamp. Repeatable discovery surfaces share their bounded catalog metadata through a maintainer-review queue. The registry stores no raw installation IDs; record-scoped contributor hashes are used only for deduplication and counts, never as identity or publication authority.
 
 ```bash
 node ~/.agents/skills/job-application-agent/scripts/job-application.mjs telemetry status
+node ~/.agents/skills/job-application-agent/scripts/job-application.mjs telemetry identity disable
 node ~/.agents/skills/job-application-agent/scripts/job-application.mjs telemetry disable
 node ~/.agents/skills/job-application-agent/scripts/job-application.mjs sources sharing status
 node ~/.agents/skills/job-application-agent/scripts/job-application.mjs sources sharing disable

package/job-application-agent/SKILL.md

@@ -24,7 +24,7 @@ Use `scripts/job-application.mjs` for private state and deterministic checks. Re
 5. Use `review-each` for per-application approval. Use `routine-auto` only when the current request authorizes the destination or batch and every automatic-eligibility condition passes.
 6. When the candidate explicitly grants continuing autonomy, read [references/AUTONOMY.md](references/AUTONOMY.md) and persist it with `autonomy grant --stdin`. Do not repeat skill-level upload or submission approval prompts while the active grant and profile both use `routine-auto`.
 7. Obey browser and tool confirmation requirements regardless of the stored mode or autonomy grant.
-8. Disclose default-enabled structured anonymous analytics and the `telemetry disable` control. Disclose default-enabled anonymous community sharing of confirmed public job links and repeatable discovery sources, plus the independent `sources sharing disable` control. The CLI also displays these disclosures before the first eligible transmission.
+8. Disclose default-enabled structured usage analytics and separate default-enabled name/email sharing with the maintainer through private PostHog analytics for support and product improvement. Explain `telemetry identity disable` to keep future analytics anonymous and `telemetry disable` to stop all analytics. Relay the CLI disclosure to the user before running another command; the disclosure command never sends identity. Use only the explicit saved candidate profile name/email, never names or emails scraped from conversation, résumés, job pages, or recruiter contacts. Honor an opt-out immediately. Disclose default-enabled anonymous community sharing of confirmed public job links and repeatable discovery sources, plus the independent `sources sharing disable` control. The CLI also displays these disclosures before the first eligible transmission.
 
 Never store passwords, MFA codes, government IDs, demographic data, CAPTCHA answers, browser session data, or inferred candidate facts.
 
@@ -33,6 +33,7 @@ Never store passwords, MFA codes, government IDs, demographic data, CAPTCHA answ
 Read [references/SOURCES.md](references/SOURCES.md) before the first discovery pass in a workflow.
 
 1. Run `sources jobs` for recently confirmed direct job links and `sources list` (optionally filtered) for the highest-signal packaged and maintainer-reviewed discovery sources. Resolve every lead to the direct employer or ATS page.
+   For each round, select at least three distinct relevant discovery sources before applying. Search across them before working deeply through one feed; include alternatives to the previous round's dominant source. Record each actual search, including zero suitable results, or an observed access blocker with `round source --stdin`. Two YC views count as one network; recruiter inboxes and user-supplied links supplement discovery but do not satisfy the three-source minimum. Do not claim that listing the catalog means a board was searched. Keep a blocked source in the report and continue to accessible alternatives.
 2. Attribute the lead with coarse `discoverySource`, stable packaged or community `discoverySourceId` when known, and independent `applicationChannel`. Treat a one-off user link as `user-supplied`. Whenever a user or agent discovers a repeatable public board, feed, directory, or careers index that is not already listed, run `sources suggest --stdin`; the CLI contributes its sanitized metadata by default unless community sharing has been disabled.
 3. Verify the application channel immediately before assessment. Mark it `active`, `closed`, or `unclear`.
 4. Classify eligibility only after checking residence, location, work authorization, sponsorship, schedule, and employment type.
@@ -51,6 +52,7 @@ Do not lower seniority, compensation, location, work mode, or evidence threshold
 ## Apply
 
 For batches, scheduled work, or resumable handoffs, read [references/RUNS.md](references/RUNS.md), create a round ID, and use the attention and friction queues.
+Check `round status` after the initial discovery pass and before submitting. Preserve source attribution independently of the ATS. A round cannot complete without recorded coverage and attribution; if one discovery source supplies more than 60% of confirmed submissions, explain why using the reviewed alternatives and their fit or access results. Do not submit weaker matches to balance source percentages. Report searched sources, blockers, source mix, and any concentration explanation when handing off or completing a round.
 
 1. Recheck employer, title, direct domain, posting status, eligibility, and `autoEligible` immediately before submission.
 2. Run `ledger check --stdin` with the internal ledger ID, canonical URL, employer job ID, company, and role when available. Review both requisition duplicate status and same-company history.
@@ -95,7 +97,7 @@ node scripts/job-application.mjs ledger review
 node scripts/job-application.mjs ledger review-ack --stdin
 node scripts/job-application.mjs autonomy grant --stdin
 node scripts/job-application.mjs autonomy status|preview|revoke
-node scripts/job-application.mjs round start|complete --stdin
+node scripts/job-application.mjs round start|source|complete --stdin
 node scripts/job-application.mjs round status [round-id]
 node scripts/job-application.mjs sources list [--stdin]
 node scripts/job-application.mjs sources jobs [--stdin]
@@ -108,6 +110,7 @@ node scripts/job-application.mjs attention list
 node scripts/job-application.mjs friction record --stdin
 node scripts/job-application.mjs friction list
 node scripts/job-application.mjs telemetry status|enable|disable|reset
+node scripts/job-application.mjs telemetry identity status|enable|disable
 node scripts/job-application.mjs telemetry preview --stdin
 node scripts/job-application.mjs telemetry record --stdin
 ```

package/job-application-agent/references/ANALYTICS.md

@@ -4,10 +4,15 @@ Job Application Agent includes default-enabled, opt-out usage analytics. The pur
 
 The first eligible command displays a disclosure. New installations may send that command's events after the disclosure. Existing installations receive a one-command grace period before events begin.
 
+Name and email sharing is also enabled by default, separately from usage analytics. New and upgraded installations receive an identity disclosure; that entire command sends no identity. Starting with the following command, when analytics and identity sharing are enabled, only the explicit `name` and `email` in the saved candidate profile accompany new usage events. The maintainer can use these private PostHog fields for support and product improvement. Agents must show the disclosure to the user before proceeding to another command. Missing, unreadable, or invalid identity falls back to anonymous events. No conversation or résumé extraction is performed by telemetry.
+
 ## Controls
 
 ```text
 node scripts/job-application.mjs telemetry status
+node scripts/job-application.mjs telemetry identity status
+node scripts/job-application.mjs telemetry identity disable
+node scripts/job-application.mjs telemetry identity enable
 node scripts/job-application.mjs telemetry disable
 node scripts/job-application.mjs telemetry enable
 node scripts/job-application.mjs telemetry reset
@@ -15,10 +20,13 @@ node scripts/job-application.mjs telemetry preview --stdin
 node scripts/job-application.mjs telemetry record --stdin
 ```
 
-- `disable` stops future collection while preserving the anonymous installation ID.
-- `enable` resumes collection with the same anonymous installation ID.
+- `identity disable` stops name/email sharing without disabling usage analytics. It clears the analytics UUID and relay credentials; the next eligible event gets a new UUID so future anonymous usage does not share the identified UUID. The command itself sends nothing.
+- `identity enable` resumes default-on identity sharing after another disclosure grace command when previously opted out. It rotates the UUID again to avoid attaching identity to the intervening anonymous period. It does not re-enable disabled usage analytics.
+- `status` and `identity status` show the UUID and sharing/disclosure flags, never the candidate name/email or relay token. They send nothing and do not acknowledge disclosure.
+- `disable` stops all future analytics collection while preserving the installation ID and identity-sharing preference.
+- `enable` resumes collection with the same installation ID and preserves the identity-sharing preference.
 - `reset` disables collection and removes the anonymous ID and relay token. Enabling later creates a new identity.
-- `preview` validates and shows an event without transmitting it.
+- `preview` validates and shows structured event properties without transmitting them. It does not read or display profile identity; identity attachment is controlled separately.
 - `record` rejects undocumented events and properties; browser workflows use it for started, step, pause, skip, and round events. Confirmed submissions are emitted by `ledger add` and must not be recorded twice.
 - `status`, `disable`, `reset`, and `preview` never transmit an event. After `enable`, collection resumes on the next eligible workflow command.
 - Previously collected events remain until the analytics retention period expires. Disabling or resetting does not issue a historical-deletion request.
@@ -29,11 +37,15 @@ Community sharing is a separate default-enabled feature with independent `source
 
 ## Identity boundary
 
-Analytics never includes the candidate's name, email, phone, exact address, profile URLs, candidate location, work authorization, personal compensation or compensation floor, target profile or thresholds, resume or attachments, must-have evidence or coverage details, rejection reasons, prompts, responses, job descriptions, form questions, drafted answers, notes, passwords, MFA, CAPTCHA, legal or demographic answers, browser data, IP address, request headers, user agent, or raw error messages.
+The only candidate identity fields allowed are the explicitly saved name and email, under the separately disclosed opt-out control above. They appear only in the validated optional `identity` envelope object (`name`: 1–160 characters; `email`: 1–254 characters with email syntax). Unknown fields and control characters are rejected by both client and relay. They are forwarded as private event properties `candidateName` and `candidateEmail`, keeping the UUID as `distinct_id`. They are never sent to the public aggregate store or community registry, and are never duplicated in local telemetry configuration. Workflow event properties still reject name/email and all other identity fields; `telemetry record` cannot inject an identity object.
+
+Analytics never includes phone, exact address, profile URLs, candidate location, work authorization, personal compensation or compensation floor, target profile or thresholds, resume or attachments, must-have evidence or coverage details, rejection reasons, prompts, responses, job descriptions, form questions, drafted answers, notes, passwords, MFA, CAPTCHA, legal or demographic answers, browser data, IP address, request headers, user agent, or raw error messages.
+
+Opt-out prevents future identity collection; it does not delete or anonymize previously collected events. Before opt-out, events sharing an identified UUID can be linked, including earlier anonymous events for that UUID. UUID rotation is not a historical deletion request and may increase installation-based counts.
 
 Structured job context may include company, role title, canonical destination domain, a SHA-256 hash of the job URL after removing query parameters and fragments, bounded discovery source, ATS/application channel, job country, work mode, employment type, seniority, role family, published salary band, fit score, match/gap categories, workflow stages, field categories, pause reasons, submission result, outcome, bounded interview quality, and bounded interview failure point.
 
-The more specific local `discoverySourceId` catalog attribution is not transmitted in v1.
+Per-application `discoverySourceId` attribution is not transmitted. Round coverage reports send only the allowlisted packaged source IDs from `SOURCES.json`; custom/community IDs are collapsed to `community`. Search evidence, concentration explanations, application IDs, and round IDs stay local.
 
 Local attention details and friction evidence are never transmitted. Analytics may receive only their already-documented bounded stage, ATS, pause reason, result, and aggregate count fields.
 
@@ -45,6 +57,7 @@ Company and title values are bounded and rejected when they resemble an email, p
 |---|---|
 | `installation_started` | OS family, Node major version, submission mode |
 | `command_completed` | Command category, result, duration bucket |
+| `source_checked` | Allowlisted packaged source ID or `community`, searched/blocked status, reviewed/qualified counts, optional bounded blocker |
 | `job_discovered` | Company, title, job hash/domain, ATS/source, job country, work mode, seniority, employment type, role family, published salary band |
 | `job_assessed` | Company, title, job hash/domain, ATS, fit score, eligibility, decision, match/gap tags |
 | `application_started` | Job hash, ATS, approval mode, required-field count, resume/cover-letter/referral requirements |
@@ -52,7 +65,7 @@ Company and title values are bounded and rejected when they resemble an email, p
 | `application_paused` | Job hash, ATS, stage, bounded reason |
 | `application_skipped` | Job hash, bounded reason, fit score, eligibility |
 | `application_submitted` | Company, title, job hash/domain, ATS, duration, fields filled, short-answer count, resume-upload Boolean, approval mode |
-| `round_completed` | Requested/submitted/assessed/skipped/paused/error counts, duration bucket |
+| `round_completed` | Requested/submitted/assessed/skipped/paused/error counts, duration bucket; optional attempted/searched/blocked source counts, maximum source share percentage, bounded concentration reason |
 | `outcome_recorded` | Company, title, job hash/domain, ATS, outcome, days since submission, optional bounded interview quality/failure point |
 | `review_generated` | Canonical unique-submission and outcome counts, review-due Boolean |
 | `skill_error` | Stable error code, workflow stage, ATS/job hash when available, recoverable Boolean |
@@ -65,9 +78,13 @@ Only documented enums, bounded numbers, Booleans, bounded company/title/country
 - PostHog US Cloud stores personless events with `$process_person_profile: false`.
 - Every event disables GeoIP enrichment with `$geoip_disable: true`, and the PostHog project discards incoming IP data.
 - The project does not call PostHog identify, alias, group, person-property, autocapture, or session-replay features.
-- Anonymous installation IDs remain stable until reset.
+- Installation IDs remain stable until reset or an identity-sharing boundary change. An identified UUID is pseudonymous, not anonymous.
 - The product retention policy is 24 months and dashboards are private. Dashboard queries exclude data older than 24 months.
 - A public usage dashboard exposes only fixed aggregate metrics. It never exposes raw events or anonymous installation IDs, rolls segment counts below three into `other`, and caches results at the edge for 15 minutes.
 - After PostHog accepts an event, the relay best-effort increments a separate Cloudflare D1 store containing daily counters and HMAC-derived installation hashes. The public endpoint reads only this aggregate store; it has no PostHog read credential.
 - PostHog US Cloud must be configured with a 24-month raw-event TTL before production telemetry is considered fully retention-compliant. The current free project does not expose a self-service raw-event TTL, so the owner must enable that control through an eligible PostHog plan or arrange time-bounded deletion with PostHog. This limitation does not weaken any collection-time identity boundary.
 - The Worker does not forward client IPs or request headers, and Worker observability is disabled.
+
+## Release ordering
+
+Deploy the relay with optional identity-envelope support before releasing the CLI. Existing schema-v1 envelopes without identity remain valid; older relays reject the new optional identity field. Then release the CLI and updated disclosures together. This change does not backfill candidate identity from historical ledgers or transmit existing local candidate data during development.

package/job-application-agent/references/RUNS.md

@@ -6,12 +6,50 @@ Start each batch with an explicit ID:
 
 ```text
 node scripts/job-application.mjs round start --stdin
+node scripts/job-application.mjs round source --stdin
 node scripts/job-application.mjs round status [round-id]
 node scripts/job-application.mjs round complete --stdin
 ```
 
 Start input: `{ "requestedCount": 30 }`. Complete input: `{ "roundId": "round-..." }`.
 
+## Discovery coverage
+
+Before submitting, search at least three relevant independent sources from `sources list`, including alternatives to the last round's dominant source. Listing the catalog or browsing multiple jobs on one board is not source coverage. Record a report after each actual search or observed access blocker:
+
+```json
+{
+  "roundId": "round-...",
+  "sourceId": "linkedin-jobs-feed",
+  "status": "searched",
+  "reviewedCount": 12,
+  "qualifiedCount": 3,
+  "evidence": "Reviewed current target-matching listings; three met the unchanged fit criteria."
+}
+```
+
+`status` is `searched` or `blocked`. Empty search results count as a search with zero counts, with evidence explaining the query/filter and absence of suitable postings. `reviewedCount` and `qualifiedCount` are bounded at 10,000; qualified cannot exceed reviewed. A blocked report must have zero counts and a `blocker` of `login`, `mfa`, `captcha`, `site-error`, or `access-unavailable`. Evidence is required, at most 2,000 characters, and stays private. Record concrete observations, never invented evidence or raw page content, credentials, recruiter identities, or answers. Reports describe agent-observed work; the CLI cannot independently verify browser activity.
+
+The minimum is three distinct sources attempted and at least one successfully searched. Blockers count toward attempts, not searches; try accessible alternatives whenever available. Repeated checks do not increase diversity. The two YC catalog entries count as one network. Inbound recruiting messages and user-provided links may supply good leads but do not count toward the three discovery sources. `round status` returns source reports, search/blocker counts, submission distribution, and missing attribution. A later blocker does not erase a prior search.
+
+Every confirmed submission needs a `discoverySourceId` referring to a searched source. For older ledger entries without it, pass `applicationIds` in the matching `round source` report to append attribution without rewriting the ledger. Attribution must reference confirmed applications in that round and cannot conflict with their saved source. Coverage updates cannot modify a completed round. Always record real confirmed submissions even if discovery coverage is incomplete; the completion gate does not prevent accurate ledger accounting.
+
+If any discovery source supplies more than 60% of confirmed submissions, `round complete` requires `concentrationReason` and a private `concentrationEvidence` explanation (at most 2,000 characters). Reasons are `stronger-fit`, `alternatives-exhausted`, `access-blocked`, or `candidate-directed`. For example:
+
+```json
+{
+  "roundId": "round-...",
+  "concentrationReason": "stronger-fit",
+  "concentrationEvidence": "The other searched sources had no eligible Senior/Staff matches; selected LinkedIn leads met all existing requirements."
+}
+```
+
+This is a discovery requirement, not an application quota. Never lower fit, eligibility, compensation, or evidence requirements to diversify submissions. ATS concentration alone does not imply discovery concentration: jobs from several boards may all use Ashby. Report coverage and blockers on unfinished handoffs too; `round complete` also continues to enforce the confirmed-submission target. Previously completed rounds remain historical; open rounds need coverage before completion.
+
+Coverage reports emit bounded `source_checked` analytics automatically. Only allowlisted packaged source IDs (community sources become `community`), counts, status, and blocker codes are sent. Notes, application IDs, exact community IDs, and round IDs stay local. Completion emits aggregate coverage counts, maximum source share, and the reason code, never the explanation. Failed best-effort analytics does not erase local reports.
+
+## Submission accounting
+
 Count only unique applications with a visible employer/ATS confirmation or a verified sent recruiting email that were also added to the ledger with the same `roundId`. Filled forms, blockers, drafts, unsent email, and ambiguous confirmations never count. `round complete` rejects an under-target round.
 
 Run both company-level and requisition-level duplicate checks before filling and again immediately before transmission. Hard ledger-ID, canonical-URL, employer-job-ID, and requisition duplicates always stop. Same-role aliases require a verified distinct requisition and `NEW REQUISITION CONFIRMED`. A genuinely different role at the same company may proceed automatically only when `companyReapply.decision` is `eligible-after-cooldown`: 15 full days have passed since the latest company application and no outcome has been recorded. `cooldown-active` and `follow-up-present` require explicit candidate approval.

package/job-application-agent/references/SCHEMAS.md

@@ -131,7 +131,7 @@ Add only after visible success confirmation.
 
 Use `duplicateOverride` only for a verified distinct requisition after a possible-duplicate warning. Use `companyReapplyOverride` only when the candidate explicitly approves a different-role reapplication during the cooldown or after a recorded outcome. Both override phrases and `telemetry` are transient. An accepted company reapplication override stores only `reapplicationApproval: "candidate-explicit"` in the private ledger. Use approval `APPROVE SUBMIT` for per-application approval or `STANDING AUTHORIZATION` when the current request authorizes routine batch submission.
 
-`discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` are optional for backward compatibility and should be supplied for new resumable rounds. `discoverySourceId` accepts stable packaged and `community-…` source IDs; it remains local and is not included in telemetry. After a visibly confirmed submission, `ledger add` automatically contributes only the canonical public URL, company, role, application channel, optional coarse discovery source, and derived provider URL to the pending community job registry. Existing installations receive a one-command disclosure grace period before historical backfill; `sources sharing disable` opts out. The private answers, score, submission time, IDs, and round remain local, and no job appears publicly before maintainer review. `ledger check` returns hard duplicate status, bounded same-company history, and the same `companyReapply` decision enforced by `ledger add` while holding the application lock.
+`discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` are optional for backward compatibility and should be supplied for new resumable rounds. `discoverySourceId` accepts stable packaged and `community-…` source IDs; per-application attribution remains local. Separate source-coverage events may include packaged source IDs, while community IDs are collapsed to `community`. After a visibly confirmed submission, `ledger add` automatically contributes only the canonical public URL, company, role, application channel, optional coarse discovery source, and derived provider URL to the pending community job registry. Existing installations receive a one-command disclosure grace period before historical backfill; `sources sharing disable` opts out. The private answers, score, submission time, IDs, and round remain local, and no job appears publicly before maintainer review. `ledger check` returns hard duplicate status, bounded same-company history, and the same `companyReapply` decision enforced by `ledger add` while holding the application lock.
 
 ## Autonomy grant input
 
@@ -145,11 +145,13 @@ The owner-only `autonomy.json` stores the fixed routine scopes, grant time, and
 
 ## Round input
 
+Use `round source --stdin` for per-source search/blocker reports and optional attribution of existing confirmed application IDs. The exact coverage and concentration contracts, completion requirements, and examples are in [RUNS.md](RUNS.md#discovery-coverage). Evidence remains local; only allowlisted packaged source IDs and bounded coverage metrics enter analytics.
+
 ```json
 { "requestedCount": 30 }
 ```
 
-`round start --stdin` appends a `started` event to owner-only `rounds.ndjson` and returns a generated `roundId`. Add that ID to every confirmed ledger entry. `round complete --stdin` accepts `{ "roundId": "round-..." }` and appends a completion event only after the target count is present in the ledger.
+`round start --stdin` appends a `started` event to owner-only `rounds.ndjson` and returns a generated `roundId`. Add that ID to every confirmed ledger entry. `round complete --stdin` accepts `{ "roundId": "round-..." }`, plus concentration reason and evidence when required, and appends a completion event only after the target count, source coverage, attribution, and concentration requirements are satisfied.
 
 ## Attention input
 

package/job-application-agent/references/SOURCES.md

@@ -30,7 +30,7 @@ Store three independent attribution fields when available:
 - `discoverySourceId`: stable packaged or community ID such as `yc-work-at-a-startup` or `community-abcdef1234567890`.
 - `applicationChannel`: actual submission channel such as `greenhouse`, `ashby`, `lever`, `company`, or `email`.
 
-`discoverySourceId` remains local in v1 and is not transmitted by telemetry.
+Per-application `discoverySourceId` remains local. Round coverage analytics may send allowlisted packaged source IDs; all community source IDs are collapsed to `community`. See [RUNS.md](RUNS.md) for the required discovery coverage, blocker reports, and concentration explanations.
 
 ## Community sharing
 

package/job-application-agent/scripts/job-application.mjs

@@ -37,6 +37,10 @@ const SOURCE_CATALOG_URL = new URL('../references/SOURCES.json', import.meta.url
 const SOURCE_CATALOG = JSON.parse(readFileSync(SOURCE_CATALOG_URL, 'utf8'));
 if (!Array.isArray(SOURCE_CATALOG)) throw new Error('The packaged source catalog is invalid.');
 const SOURCE_CATALOG_IDS = new Set(SOURCE_CATALOG.map((source) => sourceId(source.id, 'source catalog id')));
+const MIN_DISCOVERY_SOURCES = 3;
+const CONCENTRATION_THRESHOLD = 60;
+const SOURCE_BLOCKERS = new Set(['login', 'mfa', 'captcha', 'site-error', 'access-unavailable']);
+const CONCENTRATION_REASONS = new Set(['stronger-fit', 'alternatives-exhausted', 'access-blocked', 'candidate-directed']);
 const COMMUNITY_SOURCE_ID = /^community-[0-9a-f]{16}$/;
 const REQUIRED_PROFILE = ['name', 'email', 'phone', 'location', 'workAuthorization', 'roleFamilies', 'seniority', 'targetLocations', 'workModes', 'submissionMode', 'yearsExperience', 'autoSubmitMinScore', 'manualReviewMinScore', 'minMustHaveCoverage'];
 const STRING_PROFILE_FIELDS = new Set(['name', 'email', 'phone', 'location', 'workAuthorization', 'linkedin', 'github', 'portfolio', 'availability', 'currentCompensation', 'targetCompensation', 'submissionMode']);
@@ -1065,7 +1069,82 @@ async function roundStart(input) {
     occurredAt: isoDate(value.startedAt, 'round.startedAt'),
   };
   await appendPrivateEvent('rounds', event);
-  return { roundId: event.roundId, requestedCount: event.requestedCount, startedAt: event.occurredAt, completed: false };
+  return { roundId: event.roundId, requestedCount: event.requestedCount, startedAt: event.occurredAt, completed: false, discoveryPolicy: { minSources: MIN_DISCOVERY_SOURCES, concentrationThresholdPercent: CONCENTRATION_THRESHOLD }, nextStep: 'Search at least 3 distinct relevant discovery sources, record searches or blockers with round source --stdin, and review round status before applying.' };
+}
+
+function discoveryGroup(id) {
+  // Two views of the same hiring network do not demonstrate independent coverage.
+  if (['yc-work-at-a-startup', 'yc-company-directory'].includes(id)) return 'yc';
+  return id;
+}
+
+function discoverySummary(events, applications, completion) {
+  const latest = new Map();
+  const searchedIds = new Set();
+  const attribution = new Map();
+  for (const event of events.filter((item) => item.type === 'source-checked')) {
+    latest.set(event.sourceId, event);
+    if (event.status === 'searched') searchedIds.add(event.sourceId);
+    for (const id of event.applicationIds ?? []) attribution.set(id, event.sourceId);
+  }
+  const sources = [...latest.values()];
+  const eligible = sources.filter((item) => !['recruiter-inbound', 'user-supplied-leads'].includes(item.sourceId));
+  const attempted = new Set(eligible.map((item) => discoveryGroup(item.sourceId)));
+  const searched = new Set(eligible.filter((item) => searchedIds.has(item.sourceId)).map((item) => discoveryGroup(item.sourceId)));
+  const distribution = new Map();
+  let unattributedCount = 0;
+  for (const entry of applications) {
+    const source = entry.discoverySourceId ?? attribution.get(entry.id);
+    if (!source || !searchedIds.has(source)) { unattributedCount++; continue; }
+    const group = discoveryGroup(source);
+    distribution.set(group, (distribution.get(group) ?? 0) + 1);
+  }
+  const maxCount = Math.max(0, ...distribution.values());
+  const maxSourceSharePercent = applications.length ? Math.round(maxCount / applications.length * 100) : 0;
+  return {
+    minSources: MIN_DISCOVERY_SOURCES,
+    attemptedSourceCount: attempted.size,
+    searchedSourceCount: searched.size,
+    blockedSourceCount: [...attempted].filter((id) => !searched.has(id)).length,
+    coverageSatisfied: attempted.size >= MIN_DISCOVERY_SOURCES && searched.size > 0,
+    sources: sources.map(({ sourceId, status, reviewedCount, qualifiedCount, blocker, evidence }) => ({ sourceId, status, searchedDuringRound: searchedIds.has(sourceId), reviewedCount, qualifiedCount, ...(blocker ? { blocker } : {}), evidence })),
+    submissionDistribution: [...distribution].map(([sourceId, count]) => ({ sourceId, count })),
+    unattributedCount,
+    maxSourceSharePercent,
+    concentrationNeedsExplanation: applications.length > 0 && maxCount / applications.length * 100 > CONCENTRATION_THRESHOLD,
+    ...(completion?.concentrationReason ? { concentrationReason: completion.concentrationReason, concentrationEvidence: completion.concentrationEvidence } : {}),
+  };
+}
+
+async function roundSource(input) {
+  const value = object(input, 'source coverage');
+  const allowed = new Set(['roundId', 'sourceId', 'status', 'reviewedCount', 'qualifiedCount', 'blocker', 'evidence', 'applicationIds']);
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown source coverage property: ${key}.`);
+  const sourceId = knownDiscoverySourceId(value.sourceId, 'coverage.sourceId');
+  const status = string(value.status, 'coverage.status', 20);
+  if (!['searched', 'blocked'].includes(status)) throw new Error('coverage.status must be searched or blocked.');
+  const reviewedCount = integer(value.reviewedCount, 'coverage.reviewedCount', 0, 10000);
+  const qualifiedCount = integer(value.qualifiedCount, 'coverage.qualifiedCount', 0, reviewedCount);
+  const blocker = value.blocker == null ? null : string(value.blocker, 'coverage.blocker', 40);
+  if (status === 'blocked' && (!SOURCE_BLOCKERS.has(blocker) || reviewedCount !== 0 || qualifiedCount !== 0)) throw new Error('Blocked sources require a documented blocker and zero counts.');
+  if (status === 'searched' && blocker != null) throw new Error('Searched sources cannot have a blocker.');
+  const evidence = string(value.evidence, 'coverage.evidence', 2000);
+  const applicationIds = value.applicationIds == null ? [] : [...new Set(stringArray(value.applicationIds, 'coverage.applicationIds'))];
+  if (applicationIds.length > 1000 || (status === 'blocked' && applicationIds.length)) throw new Error('Invalid coverage.applicationIds.');
+  return withStateLock('rounds', async (dir) => {
+    const round = await roundStatus(string(value.roundId, 'coverage.roundId', 180));
+    if (round.completed) throw new Error('Cannot record coverage for a completed round.');
+    const applications = await jsonLines(join(dir, 'applications.ndjson'));
+    for (const id of applicationIds) {
+      const entry = applications.find((item) => item.id === id && item.roundId === round.roundId && item.status === 'submitted');
+      if (!entry || (entry.discoverySourceId && entry.discoverySourceId !== sourceId)) throw new Error('Coverage attribution must match a confirmed application in this round and its saved source.');
+    }
+    const event = { type: 'source-checked', roundId: round.roundId, sourceId, status, reviewedCount, qualifiedCount, evidence, applicationIds, ...(blocker ? { blocker } : {}), occurredAt: new Date().toISOString() };
+    const file = join(dir, 'rounds.ndjson');
+    await appendFile(file, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+    await chmod(file, 0o600);
+    return event;
+  });
 }
 
 function replayAttention(events, roundId = null) {
@@ -1135,7 +1214,8 @@ async function roundStatus(roundId = null) {
   if (!id) throw new Error('No application round has been started.');
   const started = starts.find((event) => event.roundId === id);
   if (!started) throw new Error('Application round was not found.');
-  const applications = (await jsonLines(join(dir, 'applications.ndjson'))).filter((entry) => entry.roundId === id && entry.status === 'submitted');
+  const matching = (await jsonLines(join(dir, 'applications.ndjson'))).filter((entry) => entry.roundId === id && entry.status === 'submitted');
+  const applications = [...new Map(matching.map((entry, index) => [canonicalApplicationKey(entry, String(index)), entry])).values()];
   const confirmedCount = new Set(applications.map((entry, index) => canonicalApplicationKey(entry, String(index)))).size;
   const attention = await attentionList(id);
   const completion = events.find((event) => event.type === 'completed' && event.roundId === id);
@@ -1146,6 +1226,7 @@ async function roundStatus(roundId = null) {
     remainingCount: Math.max(0, started.requestedCount - confirmedCount),
     blockedCount: attention.count,
     completed: Boolean(completion),
+    discovery: discoverySummary(events.filter((event) => event.roundId === id), applications, completion),
     startedAt: started.occurredAt,
     ...(completion ? { completedAt: completion.occurredAt } : {}),
   };
@@ -1153,14 +1234,26 @@ async function roundStatus(roundId = null) {
 
 async function roundComplete(input) {
   const value = object(input, 'round completion');
-  const allowed = new Set(['roundId', 'completedAt']);
+  const allowed = new Set(['roundId', 'completedAt', 'concentrationReason', 'concentrationEvidence']);
   for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown round completion property: ${key}.`);
-  const status = await roundStatus(string(value.roundId, 'round.roundId', 180));
-  if (status.completed) return status;
-  if (status.confirmedCount < status.requestedCount) throw new Error(`Round requires ${status.requestedCount} confirmed submissions before completion.`);
-  const event = { type: 'completed', roundId: status.roundId, occurredAt: isoDate(value.completedAt, 'round.completedAt') };
-  await appendPrivateEvent('rounds', event);
-  return { ...status, completed: true, completedAt: event.occurredAt };
+  // Use the same lock order as ledger writes so completion cannot race a confirmed submission.
+  return withStateLock('applications', () => withStateLock('rounds', async (dir) => {
+    const status = await roundStatus(string(value.roundId, 'round.roundId', 180));
+    if (status.completed) return { ...status, completionRecorded: false };
+    if (status.confirmedCount < status.requestedCount) throw new Error(`Round requires ${status.requestedCount} confirmed submissions before completion.`);
+    if (!status.discovery.coverageSatisfied) throw new Error('Round requires attempts across at least 3 distinct discovery sources, including at least one searched source. Record coverage and blockers with round source --stdin.');
+    if (status.discovery.unattributedCount) throw new Error('Round requires discovery source attribution for every confirmed submission. Supply missing attribution using round source applicationIds; do not rewrite the ledger.');
+    let explanation = {};
+    if (status.discovery.concentrationNeedsExplanation || value.concentrationReason != null || value.concentrationEvidence != null) {
+      if (!CONCENTRATION_REASONS.has(value.concentrationReason)) throw new Error('Source concentration requires a documented concentrationReason and private concentrationEvidence.');
+      explanation = { concentrationReason: value.concentrationReason, concentrationEvidence: string(value.concentrationEvidence, 'round.concentrationEvidence', 2000) };
+    }
+    const event = { type: 'completed', roundId: status.roundId, occurredAt: isoDate(value.completedAt, 'round.completedAt'), ...explanation };
+    const file = join(dir, 'rounds.ndjson');
+    await appendFile(file, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+    await chmod(file, 0o600);
+    return { ...status, discovery: { ...status.discovery, ...explanation }, completed: true, completionRecorded: true, completedAt: event.occurredAt };
+  }));
 }
 
 async function frictionRecord(input) {
@@ -1309,6 +1402,11 @@ function roundCompletedTelemetry(round) {
       pausedCount: round.blockedCount,
       errorCount: 0,
       durationBucket: durationBucket(Math.max(0, Date.parse(round.completedAt) - Date.parse(round.startedAt))),
+      attemptedSourceCount: round.discovery.attemptedSourceCount,
+      searchedSourceCount: round.discovery.searchedSourceCount,
+      blockedSourceCount: round.discovery.blockedSourceCount,
+      maxSourceSharePercent: round.discovery.maxSourceSharePercent,
+      ...(round.discovery.concentrationReason ? { concentrationReason: round.discovery.concentrationReason } : {}),
     },
   };
 }
@@ -1356,10 +1454,18 @@ async function executeCommand([area, action, value], telemetry, session, communi
   else if (area === 'autonomy' && action === 'preview' && value == null) result = await autonomyStatus();
   else if (area === 'autonomy' && action === 'revoke' && value == null) result = await autonomyRevoke();
   else if (area === 'round' && action === 'start' && value === '--stdin') result = await roundStart(await jsonStdin());
+  else if (area === 'round' && action === 'source' && value === '--stdin') {
+    result = await roundSource(await jsonStdin());
+    domainEvents.push({ event: 'source_checked', properties: {
+      sourceId: result.sourceId.startsWith('community-') ? 'community' : result.sourceId,
+      status: result.status, reviewedCount: result.reviewedCount, qualifiedCount: result.qualifiedCount,
+      ...(result.blocker ? { blocker: result.blocker } : {}),
+    } });
+  }
   else if (area === 'round' && action === 'status') result = await roundStatus(value ?? null);
   else if (area === 'round' && action === 'complete' && value === '--stdin') {
     result = await roundComplete(await jsonStdin());
-    domainEvents.push(roundCompletedTelemetry(result));
+    if (result.completionRecorded) domainEvents.push(roundCompletedTelemetry(result));
   } else if (area === 'sources' && action === 'list' && value == null) {
     await syncAllCommunityData(community);
     result = await sourcesList({}, await community.list());
@@ -1382,7 +1488,7 @@ async function executeCommand([area, action, value], telemetry, session, communi
   else if (area === 'attention' && action === 'resolve' && value === '--stdin') result = await attentionResolve(await jsonStdin());
   else if (area === 'friction' && action === 'record' && value === '--stdin') result = await frictionRecord(await jsonStdin());
   else if (area === 'friction' && action === 'list' && value == null) result = await frictionList();
-  else throw new Error('Usage: profile set|migrate --stdin; profile check|field <name>; resume import <url-or-pdf>|path; score --stdin; ledger check|add|outcome|review-ack --stdin; ledger review; autonomy grant --stdin|status|preview|revoke; round start|complete --stdin|status [round-id]; sources list [--stdin]|jobs [--stdin]|suggest --stdin|pending|sync|sharing status|enable|disable|reset; attention add|resolve --stdin|list; friction record --stdin|list; telemetry status|enable|disable|reset|preview --stdin|record --stdin');
+  else throw new Error('Usage: profile set|migrate --stdin; profile check|field <name>; resume import <url-or-pdf>|path; score --stdin; ledger check|add|outcome|review-ack --stdin; ledger review; autonomy grant --stdin|status|preview|revoke; round start|source|complete --stdin|status [round-id]; sources list [--stdin]|jobs [--stdin]|suggest --stdin|pending|sync|sharing status|enable|disable|reset; attention add|resolve --stdin|list; friction record --stdin|list; telemetry status|enable|disable|reset|preview --stdin|record --stdin');
   for (const event of domainEvents) await telemetry.record(event, session);
   return result;
 }
@@ -1403,9 +1509,14 @@ async function recordInstallationStart(telemetry, session) {
 
 async function main(args) {
   const [area, action, value] = args;
-  const telemetry = new TelemetryClient({ stateDir: stateDir() });
+  const telemetry = new TelemetryClient({ stateDir: stateDir(), readIdentity: () => {
+    const profile = storedProfileRaw();
+    // Only explicit saved fields; no resume parsing, conversation scraping, or full profile payload.
+    return Object.fromEntries(['name', 'email'].filter((key) => typeof profile[key] === 'string' && profile[key].trim()).map((key) => [key, profile[key]]));
+  } });
   const community = new SourceCommunityClient({ stateDir: stateDir() });
   if (area === 'telemetry') {
+    if (action === 'identity' && ['status', 'enable', 'disable'].includes(value) && args.length === 3) return print(await telemetry.configureIdentity(value));
     if (['status', 'enable', 'disable', 'reset'].includes(action) && value == null) return print(await telemetry.configure(action));
     if (action === 'preview' && value === '--stdin') return print(await telemetry.preview(await jsonStdin()));
     if (action === 'record' && value === '--stdin') {
@@ -1413,7 +1524,7 @@ async function main(args) {
       await recordInstallationStart(telemetry, session);
       return print(await telemetry.record(await jsonStdin(), session, { strict: true }));
     }
-    throw new Error('Usage: telemetry status|enable|disable|reset|preview --stdin|record --stdin');
+    throw new Error('Usage: telemetry status|enable|disable|reset|preview --stdin|record --stdin; telemetry identity status|enable|disable');
   }
 
   const command = commandCategory(args);

package/job-application-agent/scripts/telemetry-client.mjs

@@ -1,13 +1,14 @@
 import { chmod, mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
-import { createTelemetryEnvelope, jobIdentity, validateEvent } from './telemetry-schema.mjs';
+import { createTelemetryEnvelope, jobIdentity, validateEvent, validateTelemetryIdentity } from './telemetry-schema.mjs';
 import { SKILL_VERSION } from './version.mjs';
 
 export { SKILL_VERSION };
 
 export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https://job-application-agent-telemetry.varora1406.workers.dev';
-export const TELEMETRY_NOTICE = 'Anonymous usage analytics are enabled by default. They include structured job and workflow metrics, but never your identity, resume, prompts, form answers, browser data, or candidate profile. Run `telemetry disable` to opt out or `telemetry preview` to inspect an event.\n';
+export const TELEMETRY_NOTICE = 'Usage analytics are enabled by default. They include structured job and workflow metrics. Name and email sharing has a separate disclosure and opt-out. Resume content, other profile fields, prompts, form answers, browser data, and raw errors are never sent. Run `telemetry disable` to stop all analytics or `telemetry preview` to inspect an event.\n';
+export const IDENTITY_NOTICE = 'Name and email sharing is enabled by default. Starting with the next command, JobAgent shares the name and email explicitly saved in your candidate profile with the maintainer through private PostHog usage analytics for support and product improvement. Run `telemetry identity disable` to keep future analytics anonymous, or `telemetry disable` to stop all analytics. Opting out rotates the analytics ID; previously collected data is retained under the analytics retention policy.\n';
 
 const CONFIG_VERSION = 1;
 const CONFIG_FILE = 'telemetry.json';
@@ -38,13 +39,14 @@ async function writePrivate(file, value) {
 }
 
 export class TelemetryClient {
-  constructor({ stateDir, endpoint = DEFAULT_TELEMETRY_ENDPOINT, fetch: fetchFn = globalThis.fetch, stderr = (value) => process.stderr.write(value), now = () => new Date(), timeoutMs = Number(process.env.JOB_APPLICATION_AGENT_TELEMETRY_TIMEOUT_MS ?? 3000) }) {
+  constructor({ stateDir, endpoint = DEFAULT_TELEMETRY_ENDPOINT, fetch: fetchFn = globalThis.fetch, stderr = (value) => process.stderr.write(value), now = () => new Date(), timeoutMs = Number(process.env.JOB_APPLICATION_AGENT_TELEMETRY_TIMEOUT_MS ?? 3000), readIdentity = () => undefined }) {
     this.stateDir = stateDir;
     this.endpoint = endpoint.replace(/\/$/, '');
     this.fetch = fetchFn;
     this.stderr = stderr;
     this.now = now;
     this.timeoutMs = timeoutMs;
+    this.readIdentity = readIdentity;
   }
 
   get configPath() { return join(this.stateDir, CONFIG_FILE); }
@@ -57,7 +59,7 @@ export class TelemetryClient {
   async readConfig() {
     try {
       const value = JSON.parse(await readFile(this.configPath, 'utf8'));
-      return { version: CONFIG_VERSION, enabled: value.enabled !== false, disclosed: value.disclosed === true, graceConsumed: value.graceConsumed === true, installationEventPending: value.installationEventPending === true, installationId: value.installationId ?? null, token: value.token ?? null, tokenExpiresAt: value.tokenExpiresAt ?? null };
+      return { version: CONFIG_VERSION, enabled: value.enabled !== false, disclosed: value.disclosed === true, graceConsumed: value.graceConsumed === true, installationEventPending: value.installationEventPending === true, installationId: value.installationId ?? null, token: value.token ?? null, tokenExpiresAt: value.tokenExpiresAt ?? null, identityEnabled: value.identityEnabled !== false, identityDisclosed: value.identityDisclosed === true };
     } catch (error) {
       if (error.code === 'ENOENT') return null;
       return { version: CONFIG_VERSION, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false, installationId: null, token: null, tokenExpiresAt: null };
@@ -101,7 +103,13 @@ export class TelemetryClient {
       config.graceConsumed = true;
       await this.saveConfig(config);
     }
-    return { command, enabled: config.enabled, allowSend: config.enabled && allowSend, installationEventPending: config.installationEventPending === true };
+    const allowIdentity = config.identityEnabled !== false && config.identityDisclosed === true;
+    if (config.enabled && config.identityEnabled !== false && !config.identityDisclosed) {
+      this.stderr(IDENTITY_NOTICE);
+      config.identityDisclosed = true;
+      await this.saveConfig(config);
+    }
+    return { command, enabled: config.enabled, allowSend: config.enabled && allowSend, allowIdentity, installationEventPending: config.installationEventPending === true };
   }
 
   async credentials(config) {
@@ -128,13 +136,17 @@ export class TelemetryClient {
       if (session.unavailable) return { sent: false, reason: 'unavailable' };
       let config = await this.readConfig();
       if (!config?.enabled) return { sent: false, reason: 'disabled' };
+      let identity;
+      if (session.allowIdentity === true && config.identityEnabled !== false && config.identityDisclosed === true) {
+        try { identity = validateTelemetryIdentity(await this.readIdentity()); } catch { /* Missing or invalid identity never blocks anonymous analytics. */ }
+      }
       config = await this.credentials(config);
-      const payload = createTelemetryEnvelope({ installationId: config.installationId, token: config.token, event, skillVersion: SKILL_VERSION });
+      const payload = createTelemetryEnvelope({ installationId: config.installationId, token: config.token, event, skillVersion: SKILL_VERSION, identity });
       let response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload), signal: AbortSignal.timeout(this.timeoutMs) });
       if (response.status === 401) {
         config.tokenExpiresAt = null;
         config = await this.credentials(config);
-        response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(createTelemetryEnvelope({ installationId: config.installationId, token: config.token, event, skillVersion: SKILL_VERSION })), signal: AbortSignal.timeout(this.timeoutMs) });
+        response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(createTelemetryEnvelope({ installationId: config.installationId, token: config.token, event, skillVersion: SKILL_VERSION, identity })), signal: AbortSignal.timeout(this.timeoutMs) });
       }
       if (!response.ok) {
         session.unavailable = true;
@@ -154,7 +166,22 @@ export class TelemetryClient {
 
   async status() {
     const config = await this.readConfig();
-    return { enabled: config?.enabled ?? true, disclosed: config?.disclosed ?? false, hasInstallationId: Boolean(config?.installationId), endpoint: this.endpoint, schemaVersion: 1 };
+    return { enabled: config?.enabled ?? true, disclosed: config?.disclosed ?? false, hasInstallationId: Boolean(config?.installationId), installationId: config?.installationId ?? null, identityEnabled: config?.identityEnabled ?? true, identityDisclosed: config?.identityDisclosed ?? false, endpoint: this.endpoint, schemaVersion: 1 };
+  }
+
+  async configureIdentity(action) {
+    if (action === 'status') return this.status();
+    if (!['enable', 'disable'].includes(action)) throw new Error('Identity action must be status, enable, or disable.');
+    const current = await this.readConfig() ?? { version: CONFIG_VERSION, enabled: true, disclosed: false, graceConsumed: true, installationEventPending: true };
+    const enabled = action === 'enable';
+    // Rotate at both boundaries to avoid identifying an earlier anonymous period.
+    if (enabled !== (current.identityEnabled !== false)) {
+      Object.assign(current, { installationId: null, token: null, tokenExpiresAt: null });
+    }
+    if (enabled && current.identityEnabled === false) current.identityDisclosed = false;
+    current.identityEnabled = enabled;
+    await this.saveConfig(current);
+    return this.status();
   }
 
   async configure(action) {

package/job-application-agent/scripts/telemetry-schema.mjs

@@ -31,6 +31,9 @@ const FAILURE_POINTS = values('role-scope', 'company-problem', 'constraints', 'i
 const ERROR_CODES = values('invalid_input', 'network_failure', 'relay_unavailable', 'authentication_required', 'site_changed', 'upload_failed', 'submission_unconfirmed', 'rate_limited', 'internal_error');
 const MATCH_TAGS = values('role_family', 'seniority', 'skills', 'industry', 'location', 'remote', 'salary', 'ai', 'product', 'leadership', 'authorization');
 const GAP_TAGS = values('role_family', 'seniority', 'skills', 'industry', 'location', 'salary_unknown', 'salary_below', 'authorization_unclear', 'sponsorship', 'experience', 'domain', 'other');
+const DISCOVERY_SOURCE_KEYS = values('direct-company-careers', 'linkedin-jobs-feed', 'x-hiring-feed', 'yc-work-at-a-startup', 'yc-company-directory', 'hacker-news-who-is-hiring', 'we-work-remotely', 'a16z-build-jobs', 'engg-space', 'js-guru-jobs', 'linux-careers', 'indeed', 'recruiter-inbound', 'user-supplied-leads', 'community');
+const DISCOVERY_BLOCKERS = values('login', 'mfa', 'captcha', 'site-error', 'access-unavailable');
+const CONCENTRATION_REASONS = values('stronger-fit', 'alternatives-exhausted', 'access-blocked', 'candidate-directed');
 
 const text = (max, identitySafe = false) => ({ kind: 'text', max, identitySafe });
 const integer = (min, max) => ({ kind: 'integer', min, max });
@@ -43,6 +46,7 @@ const JOB = {
 };
 
 export const EVENT_SCHEMAS = {
+  source_checked: { required: { sourceId: enumValue(DISCOVERY_SOURCE_KEYS), status: enumValue(values('searched', 'blocked')), reviewedCount: integer(0, 10000), qualifiedCount: integer(0, 10000) }, optional: { blocker: enumValue(DISCOVERY_BLOCKERS) } },
   installation_started: { required: { osFamily: enumValue(values('macos', 'linux', 'windows', 'other')), nodeMajor: integer(20, 99), submissionMode: enumValue(SUBMISSION_MODES) } },
   command_completed: { required: { command: enumValue(COMMANDS), result: enumValue(RESULTS), durationBucket: enumValue(DURATIONS) } },
   job_discovered: { required: { ...JOB, source: enumValue(SOURCES), jobCountry: text(80, true), workMode: enumValue(WORK_MODES), seniority: enumValue(SENIORITIES), employmentType: enumValue(EMPLOYMENT), roleFamily: enumValue(ROLE_FAMILIES) }, optional: { salaryCurrency: { kind: 'currency' }, salaryMin: integer(0, 10000000), salaryMax: integer(0, 10000000) } },
@@ -52,7 +56,7 @@ export const EVENT_SCHEMAS = {
   application_paused: { required: { jobHash: { kind: 'hash' }, ats: enumValue(ATS), stage: enumValue(STAGES), reason: enumValue(PAUSE_REASONS) } },
   application_skipped: { required: { jobHash: { kind: 'hash' }, reason: enumValue(SKIP_REASONS), fitScore: integer(0, 100), eligibility: enumValue(ELIGIBILITY) } },
   application_submitted: { required: { ...JOB, durationBucket: enumValue(DURATIONS), fieldsFilled: integer(0, 500), shortAnswerCount: integer(0, 100), resumeUploaded: boolean, approvalMode: enumValue(APPROVAL_MODES) } },
-  round_completed: { required: { requestedCount: integer(1, 1000), submittedCount: integer(0, 1000), assessedCount: integer(0, 10000), skippedCount: integer(0, 10000), pausedCount: integer(0, 10000), errorCount: integer(0, 10000), durationBucket: enumValue(DURATIONS) } },
+  round_completed: { required: { requestedCount: integer(1, 1000), submittedCount: integer(0, 1000), assessedCount: integer(0, 10000), skippedCount: integer(0, 10000), pausedCount: integer(0, 10000), errorCount: integer(0, 10000), durationBucket: enumValue(DURATIONS) }, optional: { attemptedSourceCount: integer(0, 10000), searchedSourceCount: integer(0, 10000), blockedSourceCount: integer(0, 10000), maxSourceSharePercent: integer(0, 100), concentrationReason: enumValue(CONCENTRATION_REASONS) } },
   outcome_recorded: {
     required: { ...JOB, outcome: enumValue(OUTCOMES), daysSinceSubmission: integer(0, 3650) },
     optional: { interviewQuality: enumValue(INTERVIEW_QUALITIES), failurePoint: enumValue(FAILURE_POINTS) },
@@ -118,6 +122,11 @@ export function validateEvent(input) {
   }
   for (const [name, rule] of Object.entries(schema.optional ?? {})) if (name in input.properties) properties[name] = validateProperty(name, input.properties[name], rule);
   if (input.event === 'outcome_recorded' && properties.failurePoint && !properties.interviewQuality) throw new Error('failurePoint requires interviewQuality.');
+  if (input.event === 'source_checked') {
+    if (properties.qualifiedCount > properties.reviewedCount) throw new Error('qualifiedCount cannot exceed reviewedCount.');
+    if (properties.status === 'blocked' && (!properties.blocker || properties.reviewedCount !== 0 || properties.qualifiedCount !== 0)) throw new Error('Blocked sources require a blocker and zero counts.');
+    if (properties.status === 'searched' && properties.blocker) throw new Error('Searched sources cannot have a blocker.');
+  }
   const result = { event: input.event, properties };
   if (new TextEncoder().encode(JSON.stringify(result)).length > TELEMETRY_MAX_BYTES) throw new Error('Telemetry event exceeds 4 KB.');
   return result;
@@ -142,19 +151,37 @@ export async function jobIdentity(value) {
   return { jobHash: [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, '0')).join(''), domain: new URL(canonical).hostname };
 }
 
-export function createTelemetryEnvelope({ installationId, token, event, properties, skillVersion }) {
+// Identity is a separate allowlisted envelope field, never arbitrary event input.
+export function validateTelemetryIdentity(input) {
+  if (!input || Array.isArray(input) || typeof input !== 'object') throw new Error('Telemetry identity must be an object.');
+  for (const key of Object.keys(input)) if (!['name', 'email'].includes(key)) throw new Error('Unknown telemetry identity property.');
+  const identity = {};
+  for (const [key, max] of [['name', 160], ['email', 254]]) {
+    if (!(key in input)) continue;
+    const value = input[key];
+    if (typeof value !== 'string' || !value.trim() || value.length > max || /[\x00-\x1f\x7f]/.test(value)) throw new Error('Invalid telemetry identity field.');
+    const normalized = value.trim();
+    if (key === 'email' && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) throw new Error('Invalid telemetry identity email.');
+    identity[key] = normalized;
+  }
+  if (!Object.keys(identity).length) throw new Error('Telemetry identity must include name or email.');
+  return identity;
+}
+
+export function createTelemetryEnvelope({ installationId, token, event, properties, skillVersion, identity }) {
   if (!UUID.test(installationId)) throw new Error('installationId must be an anonymous UUID.');
   if (typeof token !== 'string' || token.length < 8 || token.length > 2048) throw new Error('token is invalid.');
   if (typeof skillVersion !== 'string' || !VERSION.test(skillVersion)) throw new Error('skillVersion is invalid.');
   const safe = validateEvent(typeof event === 'string' ? { event, properties } : event);
   const envelope = { schemaVersion: TELEMETRY_SCHEMA_VERSION, skillVersion, installationId, token, ...safe };
+  if (identity !== undefined) envelope.identity = validateTelemetryIdentity(identity);
   if (new TextEncoder().encode(JSON.stringify(envelope)).length > TELEMETRY_MAX_BYTES) throw new Error('Telemetry payload exceeds 4 KB.');
   return envelope;
 }
 
 export function validateTelemetryEnvelope(input) {
   if (!input || Array.isArray(input) || typeof input !== 'object') throw new Error('Telemetry payload must be an object.');
-  const allowed = new Set(['schemaVersion', 'skillVersion', 'installationId', 'token', 'event', 'properties']);
+  const allowed = new Set(['schemaVersion', 'skillVersion', 'installationId', 'token', 'event', 'properties', 'identity']);
   for (const key of Object.keys(input)) if (!allowed.has(key)) throw new Error(`Unknown telemetry envelope property: ${key}.`);
   if (input.schemaVersion !== TELEMETRY_SCHEMA_VERSION) throw new Error('Unsupported telemetry schema version.');
   return createTelemetryEnvelope(input);

package/job-application-agent/scripts/version.mjs

@@ -1 +1 @@
-export const SKILL_VERSION = '3.3.0';
+export const SKILL_VERSION = '3.4.0';

package/job-application-agent/tests/job-application.test.mjs

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
 import { fileURLToPath } from 'node:url';
+import { createServer } from 'node:http';
 
 import { buildReview, commandCategory, durationBucket, migrateProfile, profileStatus, scoreJob, telemetryErrorCode, telemetryJobAssessed, validateLedgerEntry, validateProfile, validateSubmissionTelemetry } from '../scripts/job-application.mjs';
 
@@ -492,5 +493,81 @@ test('telemetry CLI controls are private and reset removes anonymous credentials
   assert.equal(disabled.enabled, false);
   const reset = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'reset'], { env, encoding: 'utf8' }));
   assert.equal(reset.hasInstallationId, false);
+  const identityDisabled = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'identity', 'disable'], { env, encoding: 'utf8' }));
+  assert.equal(identityDisabled.identityEnabled, false);
+  assert.equal(identityDisabled.enabled, false);
+  const identityEnabled = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'identity', 'enable'], { env, encoding: 'utf8' }));
+  assert.equal(identityEnabled.identityEnabled, true);
+  assert.equal(identityEnabled.enabled, false);
+  assert.equal(identityEnabled.identityDisclosed, false);
   if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'telemetry.json'))).mode & 0o777, 0o600);
 });
+
+test('CLI emits bounded source coverage without private evidence or attribution', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-coverage-cli-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const captured = [];
+  const server = createServer(async (request, response) => {
+    let raw = '';
+    for await (const chunk of request) raw += chunk;
+    captured.push(JSON.parse(raw));
+    response.setHeader('content-type', 'application/json');
+    response.end(JSON.stringify({ accepted: true }));
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: true, disclosed: true, graceConsumed: true, installationEventPending: false, identityEnabled: false, installationId: crypto.randomUUID(), token: 'synthetic-token', tokenExpiresAt: '2099-01-01T00:00:00Z' }));
+  const env = { ...isolatedCliEnv(directory), JOB_APPLICATION_AGENT_TELEMETRY_URL: `http://127.0.0.1:${server.address().port}` };
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const started = await runCli(script, ['round', 'start', '--stdin'], { requestedCount: 1 }, env);
+  assert.equal(started.code, 0, started.stderr);
+  const roundId = JSON.parse(started.stdout).roundId;
+  const sourceId = 'community-0123456789abcdef';
+  const report = await runCli(script, ['round', 'source', '--stdin'], { roundId, sourceId, status: 'searched', reviewedCount: 8, qualifiedCount: 2, evidence: 'Private search query and candidate context', applicationIds: [] }, env);
+  assert.equal(report.code, 0, report.stderr);
+  const event = captured.find((body) => body.event === 'source_checked');
+  assert.ok(event, JSON.stringify(captured));
+  assert.deepEqual(event.properties, { sourceId: 'community', status: 'searched', reviewedCount: 8, qualifiedCount: 2 });
+  assert.equal(JSON.stringify(captured).includes('Private search query'), false);
+  assert.equal(JSON.stringify(captured).includes(roundId), false);
+  assert.equal(JSON.stringify(captured).includes(sourceId), false);
+});
+
+test('CLI attaches only explicit saved name/email after disclosure and opt-out continues anonymous usage', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-identity-cli-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const captured = [];
+  const server = createServer(async (request, response) => {
+    let raw = '';
+    for await (const chunk of request) raw += chunk;
+    captured.push({ path: request.url, body: JSON.parse(raw) });
+    response.setHeader('content-type', 'application/json');
+    response.end(JSON.stringify(request.url === '/v1/install' ? { installationId: crypto.randomUUID(), token: 'synthetic-relay-token', expiresAt: '2099-01-01T00:00:00Z' } : { accepted: true }));
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  // Synthetic Secret Service implementation: never touch the developer's real profile.
+  const preload = `import cp from 'node:child_process'; import { syncBuiltinESMExports } from 'node:module'; Object.defineProperty(process, 'platform', { value: 'linux' }); cp.execFileSync = (file, args) => { if (file === 'secret-tool' && args[0] === 'lookup') return ${JSON.stringify(JSON.stringify(target))}; throw new Error('Unexpected secret operation'); }; syncBuiltinESMExports();`;
+  const runtimeArgs = ['--import', `data:text/javascript,${encodeURIComponent(preload)}`];
+  const env = { ...isolatedCliEnv(directory), JOB_APPLICATION_AGENT_TELEMETRY_URL: `http://127.0.0.1:${server.address().port}` };
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const run = (args) => runCli(script, args, undefined, env, runtimeArgs);
+  const first = await run(['profile', 'check']);
+  assert.equal(first.code, 0, first.stderr);
+  assert.match(first.stderr, /name and email sharing is enabled by default/i);
+  assert.ok(captured.length > 0);
+  assert.ok(captured.every(({ body }) => body.identity === undefined));
+  const second = await run(['profile', 'check']);
+  assert.equal(second.code, 0, second.stderr);
+  const identified = captured.at(-1).body;
+  assert.deepEqual(identified.identity, { name: target.name, email: target.email });
+  assert.equal(JSON.stringify(identified).includes(target.phone), false);
+  assert.equal(JSON.stringify(identified).includes(target.location), false);
+  const count = captured.length;
+  const optedOut = await run(['telemetry', 'identity', 'disable']);
+  assert.equal(optedOut.code, 0, optedOut.stderr);
+  assert.equal(captured.length, count);
+  assert.equal((await run(['profile', 'check'])).code, 0);
+  assert.equal(captured.at(-1).body.identity, undefined);
+  assert.notEqual(captured.at(-1).body.installationId, identified.installationId);
+});

package/job-application-agent/tests/telemetry-client.test.mjs

@@ -26,7 +26,7 @@ test('new installations disclose and send the first event immediately', async (t
   assert.equal(session.installationEventPending, true);
   await client.record({ event: 'installation_started', properties: { osFamily: 'macos', nodeMajor: 24, submissionMode: 'unconfigured' } }, session);
   const result = await client.record({ event: 'command_completed', properties: { command: 'search', result: 'success', durationBucket: '1-5s' } }, session);
-  assert.match(notice, /anonymous usage analytics/i);
+  assert.match(notice, /usage analytics/i);
   assert.equal(result.sent, true);
   assert.equal(relay.requests.length, 3);
   assert.equal((await client.beginCommand('search')).installationEventPending, false);
@@ -68,7 +68,7 @@ test('a pre-disclosure telemetry config cannot send on its disclosure command',
   let notice = '';
   const client = new TelemetryClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: relay.fetch, stderr: (value) => { notice += value; } });
   const session = await client.beginCommand('search');
-  assert.match(notice, /anonymous usage analytics/i);
+  assert.match(notice, /usage analytics/i);
   assert.equal(session.allowSend, false);
   assert.equal(relay.requests.length, 0);
 });
@@ -130,3 +130,92 @@ test('strict record rejects invalid schema while automatic telemetry stays best
   await assert.rejects(() => client.record(invalid, session, { strict: true }), /durationBucket/i);
   assert.deepEqual(await client.record(invalid, session), { sent: false, reason: 'invalid' });
 });
+
+const usageEvent = { event: 'command_completed', properties: { command: 'profile', result: 'success', durationBucket: 'under-1s' } };
+
+test('identity sharing defaults on but waits until the command after disclosure, including upgrades', async (t) => {
+  for (const legacy of [false, true]) {
+    const directory = await mkdtemp(join(tmpdir(), 'telemetry-identity-'));
+    t.after(() => rm(directory, { recursive: true, force: true }));
+    if (legacy) await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: true, disclosed: true, graceConsumed: true }));
+    const relay = fakeRelay();
+    let notice = '';
+    const client = new TelemetryClient({ stateDir: directory, fetch: relay.fetch, stderr: (value) => { notice += value; }, readIdentity: () => ({ name: 'Test Candidate', email: 'candidate@example.com' }) });
+    const first = await client.beginCommand('profile');
+    await client.record(usageEvent, first);
+    assert.match(notice, /name and email/i);
+    assert.match(notice, /telemetry identity disable/);
+    assert.equal(relay.requests.at(-1).body.identity, undefined);
+    await client.record(usageEvent); // A missing session must not bypass the disclosure gate.
+    assert.equal(relay.requests.at(-1).body.identity, undefined);
+    await client.record(usageEvent, await client.beginCommand('profile'));
+    assert.deepEqual(relay.requests.at(-1).body.identity, { name: 'Test Candidate', email: 'candidate@example.com' });
+    assert.equal((await client.status()).identityEnabled, true);
+    assert.equal(JSON.stringify(await client.readConfig()).includes('candidate@example.com'), false);
+  }
+});
+
+test('identity opt-out rotates credentials and stops identity sharing even in an already started command', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'telemetry-identity-optout-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const relay = fakeRelay();
+  const client = new TelemetryClient({ stateDir: directory, fetch: relay.fetch, stderr: () => {}, readIdentity: () => ({ name: 'Test Candidate', email: 'candidate@example.com' }) });
+  await client.beginCommand('profile');
+  const session = await client.beginCommand('profile');
+  await client.record(usageEvent, session);
+  assert.ok(relay.requests.at(-1).body.identity);
+  const before = relay.requests.length;
+  const status = await client.configureIdentity('disable');
+  assert.equal(status.enabled, true);
+  assert.equal(status.identityEnabled, false);
+  assert.equal(status.hasInstallationId, false);
+  assert.equal(relay.requests.length, before);
+  await client.record(usageEvent, session);
+  assert.equal(relay.requests.at(-1).body.identity, undefined);
+  assert.deepEqual(relay.requests.at(-2).body, {});
+  const anonymousId = (await client.status()).installationId;
+  await client.configureIdentity('disable');
+  assert.equal((await client.status()).installationId, anonymousId);
+  await client.configure('disable');
+  await client.configure('enable');
+  assert.equal((await client.status()).identityEnabled, false);
+});
+
+test('disabled telemetry and identity opt-out never read identity; malformed identity does not stop usage', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'telemetry-identity-failure-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const relay = fakeRelay();
+  let reads = 0;
+  const client = new TelemetryClient({ stateDir: directory, fetch: relay.fetch, stderr: () => {}, readIdentity: () => { reads++; return { name: 'Test', email: 'bad', resume: 'private' }; } });
+  await client.configure('disable');
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.equal(reads, 0);
+  await client.configure('enable');
+  await client.beginCommand('profile');
+  assert.equal((await client.record(usageEvent, await client.beginCommand('profile'))).sent, true);
+  assert.equal(relay.requests.at(-1).body.identity, undefined);
+  await client.configureIdentity('disable');
+  const before = reads;
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.equal(reads, before);
+});
+
+test('identity re-enable discloses again and rotates the anonymous interval without enabling telemetry', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'telemetry-identity-resume-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const relay = fakeRelay();
+  const client = new TelemetryClient({ stateDir: directory, fetch: relay.fetch, stderr: () => {}, readIdentity: () => ({ email: 'candidate@example.com' }) });
+  await client.configureIdentity('disable');
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.equal(relay.requests.at(-1).body.identity, undefined);
+  await client.configure('disable');
+  const status = await client.configureIdentity('enable');
+  assert.equal(status.enabled, false);
+  assert.equal(status.hasInstallationId, false);
+  assert.equal(status.identityDisclosed, false);
+  await client.configure('enable');
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.equal(relay.requests.at(-1).body.identity, undefined);
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.deepEqual(relay.requests.at(-1).body.identity, { email: 'candidate@example.com' });
+});

package/job-application-agent/tests/telemetry-schema.test.mjs

@@ -6,8 +6,20 @@ import {
   createTelemetryEnvelope,
   jobIdentity,
   validateEvent,
+  validateTelemetryEnvelope,
 } from '../scripts/telemetry-schema.mjs';
 
+test('identity envelope accepts only bounded name and email and keeps old anonymous envelopes compatible', () => {
+  const input = { installationId: '11111111-1111-4111-8111-111111111111', token: 'signed-token', skillVersion: '3.3.0', event: 'command_completed', properties: { command: 'profile', result: 'success', durationBucket: 'under-1s' } };
+  const envelope = createTelemetryEnvelope({ ...input, identity: { name: ' Test Candidate ', email: ' candidate@example.com ' } });
+  assert.deepEqual(envelope.identity, { name: 'Test Candidate', email: 'candidate@example.com' });
+  assert.deepEqual(validateTelemetryEnvelope(envelope), envelope);
+  assert.equal(validateTelemetryEnvelope(createTelemetryEnvelope(input)).identity, undefined);
+  for (const identity of [{}, { name: 'x', phone: 'private' }, { email: 'invalid' }, { name: 'x'.repeat(161) }, { email: 'a\nb@example.com' }, { name: 'Test\nPrivate' }, { name: 'Test', resume: 'private' }]) {
+    assert.throws(() => validateTelemetryEnvelope({ ...envelope, identity }), /identity/i);
+  }
+});
+
 const baseJob = {
   company: 'Example AI',
   title: 'Staff Product Engineer',
@@ -16,6 +28,16 @@ const baseJob = {
   ats: 'greenhouse',
 };
 
+test('source coverage telemetry excludes local evidence and community identifiers', () => {
+  const event = { event: 'source_checked', properties: { sourceId: 'linkedin-jobs-feed', status: 'searched', reviewedCount: 10, qualifiedCount: 2 } };
+  assert.equal(validateEvent(event).properties.sourceId, 'linkedin-jobs-feed');
+  assert.throws(() => validateEvent({ ...event, properties: { ...event.properties, evidence: 'private query and notes' } }), /unknown/i);
+  assert.throws(() => validateEvent({ ...event, properties: { ...event.properties, sourceId: 'community-abcdef1234567890' } }), /sourceId/i);
+  assert.throws(() => validateEvent({ ...event, properties: { ...event.properties, qualifiedCount: 11 } }), /qualifiedCount/i);
+  assert.throws(() => validateEvent({ ...event, properties: { ...event.properties, status: 'blocked' } }), /block/i);
+  assert.equal(validateEvent({ event: 'source_checked', properties: { sourceId: 'community', status: 'blocked', reviewedCount: 0, qualifiedCount: 0, blocker: 'captcha' } }).properties.blocker, 'captcha');
+});
+
 test('canonicalizes job URLs and hashes the destination without query data', async () => {
   assert.equal(canonicalizeJobUrl('https://Jobs.Example.com/role/123/?utm_source=x#apply'), 'https://jobs.example.com/role/123');
   const first = await jobIdentity('https://jobs.example.com/role/123?ref=friend');

package/job-application-agent/tests/workflow-state.test.mjs

@@ -121,15 +121,87 @@ test('counts only unique confirmed ledger submissions for an explicit round', as
   assert.equal(status.blockedCount, 1);
   assert.equal(status.completed, false);
 
-  const completed = cli(env, ['round', 'complete', '--stdin'], { roundId: started.roundId });
+  for (const sourceId of ['linkedin-jobs-feed', 'indeed', 'hacker-news-who-is-hiring']) {
+    cli(env, ['round', 'source', '--stdin'], {
+      roundId: started.roundId, sourceId, status: 'searched', reviewedCount: 30, qualifiedCount: sourceId === 'linkedin-jobs-feed' ? 30 : 0,
+      evidence: 'Reviewed matching postings against the unchanged target; other leads did not qualify.',
+      applicationIds: sourceId === 'linkedin-jobs-feed' ? Array.from({ length: 30 }, (_, i) => `round-role-${i}`) : [],
+    });
+  }
+  const completed = cli(env, ['round', 'complete', '--stdin'], { roundId: started.roundId, concentrationReason: 'stronger-fit', concentrationEvidence: 'The other searched sources had no qualifying roles; all selected roles met the target.' });
   assert.equal(completed.completed, true);
   assert.equal(cli(env, ['round', 'status', started.roundId]).completed, true);
   const roundEvents = (await readFile(join(directory, 'rounds.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
   assert.equal(roundEvents.filter((event) => event.type === 'submission-confirmed').length, 30);
-  assert.equal(roundEvents.length, 32);
+  assert.equal(roundEvents.length, 35);
   if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'rounds.ndjson'))).mode & 0o777, 0o600);
 });
 
+test('round completion requires distinct source coverage and explains concentration without imposing submission quotas', async (t) => {
+  const { env } = await fixture(t, 'source-coverage');
+  const { roundId } = cli(env, ['round', 'start', '--stdin'], { requestedCount: 2 });
+  for (const i of [1, 2]) cli(env, ['ledger', 'add', '--stdin'], submission(i, roundId, { discoverySourceId: 'linkedin-jobs-feed' }));
+  assert.match(cliFailure(env, ['round', 'complete', '--stdin'], { roundId }).stderr, /3 distinct discovery sources/i);
+  const check = { roundId, sourceId: 'linkedin-jobs-feed', status: 'searched', reviewedCount: 10, qualifiedCount: 2, evidence: 'Reviewed ten relevant postings using the target constraints.' };
+  cli(env, ['round', 'source', '--stdin'], check);
+  cli(env, ['round', 'source', '--stdin'], check);
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.attemptedSourceCount, 1);
+  cli(env, ['round', 'source', '--stdin'], { ...check, sourceId: 'indeed', qualifiedCount: 0 });
+  cli(env, ['round', 'source', '--stdin'], { ...check, sourceId: 'hacker-news-who-is-hiring', status: 'blocked', reviewedCount: 0, qualifiedCount: 0, blocker: 'site-error' });
+  const status = cli(env, ['round', 'status', roundId]);
+  assert.equal(status.discovery.coverageSatisfied, true);
+  assert.equal(status.discovery.searchedSourceCount, 2);
+  assert.equal(status.discovery.blockedSourceCount, 1);
+  assert.equal(status.discovery.maxSourceSharePercent, 100);
+  assert.match(cliFailure(env, ['round', 'complete', '--stdin'], { roundId }).stderr, /concentration/i);
+  const completed = cli(env, ['round', 'complete', '--stdin'], { roundId, concentrationReason: 'stronger-fit', concentrationEvidence: 'Only LinkedIn produced qualifying roles; Indeed had none and the third source was unavailable.' });
+  assert.equal(completed.completed, true);
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.concentrationReason, 'stronger-fit');
+  assert.match(cliFailure(env, ['round', 'source', '--stdin'], check).stderr, /completed round/i);
+});
+
+test('discovery coverage rejects invalid reports and requires attribution without rewriting confirmed ledger rows', async (t) => {
+  const { env, directory } = await fixture(t, 'source-validation');
+  const { roundId } = cli(env, ['round', 'start', '--stdin'], { requestedCount: 1 });
+  cli(env, ['ledger', 'add', '--stdin'], submission(1, roundId));
+  const before = await readFile(join(directory, 'applications.ndjson'), 'utf8');
+  const check = { roundId, sourceId: 'linkedin-jobs-feed', status: 'searched', reviewedCount: 4, qualifiedCount: 1, evidence: 'Checked relevant listings against the candidate target.' };
+  for (const bad of [{ sourceId: 'imaginary-board' }, { qualifiedCount: 5 }, { status: 'blocked' }, { applicationIds: ['not-in-round'] }, { evidence: '' }, { privateProfile: 'forbidden' }]) {
+    assert.equal(cliFailure(env, ['round', 'source', '--stdin'], { ...check, ...bad }).status, 1);
+  }
+  for (const sourceId of ['linkedin-jobs-feed', 'indeed', 'hacker-news-who-is-hiring']) cli(env, ['round', 'source', '--stdin'], { ...check, sourceId });
+  assert.match(cliFailure(env, ['round', 'complete', '--stdin'], { roundId }).stderr, /attribution/i);
+  cli(env, ['round', 'source', '--stdin'], { ...check, applicationIds: ['round-role-1'] });
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.unattributedCount, 0);
+  assert.equal(await readFile(join(directory, 'applications.ndjson'), 'utf8'), before);
+});
+
+test('source diversity is independent of ATS and concentration explanations are unnecessary for a balanced mix', async (t) => {
+  const { env } = await fixture(t, 'balanced-discovery');
+  const { roundId } = cli(env, ['round', 'start', '--stdin'], { requestedCount: 5 });
+  const ids = ['linkedin-jobs-feed', 'indeed', 'hacker-news-who-is-hiring'];
+  for (const sourceId of ids) cli(env, ['round', 'source', '--stdin'], { roundId, sourceId, status: 'searched', reviewedCount: 3, qualifiedCount: 2, evidence: 'Reviewed relevant postings and verified target fit.' });
+  for (let i = 1; i <= 5; i++) cli(env, ['ledger', 'add', '--stdin'], submission(i, roundId, { discoverySourceId: ids[(i - 1) % 3], applicationChannel: 'ashby' }));
+  const completed = cli(env, ['round', 'complete', '--stdin'], { roundId });
+  assert.equal(completed.discovery.maxSourceSharePercent, 40);
+  assert.equal(completed.discovery.concentrationNeedsExplanation, false);
+  assert.equal(cli(env, ['round', 'complete', '--stdin'], { roundId }).completionRecorded, false);
+});
+
+test('blocked-only attempts and two views of the same network do not satisfy discovery', async (t) => {
+  const { env } = await fixture(t, 'blocked-discovery');
+  const { roundId } = cli(env, ['round', 'start', '--stdin'], { requestedCount: 1 });
+  const check = { roundId, status: 'blocked', reviewedCount: 0, qualifiedCount: 0, blocker: 'login', evidence: 'Source requires an authenticated session that is unavailable.' };
+  for (const sourceId of ['linkedin-jobs-feed', 'yc-work-at-a-startup', 'yc-company-directory']) cli(env, ['round', 'source', '--stdin'], { ...check, sourceId });
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.attemptedSourceCount, 2);
+  cli(env, ['round', 'source', '--stdin'], { ...check, sourceId: 'indeed' });
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.coverageSatisfied, false);
+  const { blocker, ...searched } = check;
+  cli(env, ['round', 'source', '--stdin'], { ...searched, sourceId: 'indeed', status: 'searched', reviewedCount: 1, qualifiedCount: 1 });
+  cli(env, ['round', 'source', '--stdin'], { ...check, sourceId: 'indeed' });
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.coverageSatisfied, true);
+});
+
 test('ships a filterable global discovery source catalog and tracks source attribution', async (t) => {
   const { directory, env } = await fixture(t, 'source-catalog');
   const catalog = cli(env, ['sources', 'list']);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "job-application-agent",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "description": "A privacy-first Agent Skill and CLI for evidence-based job discovery, application completion, and outcome tracking.",
   "license": "MIT",
   "type": "module",
@@ -38,7 +38,7 @@
     "check:native-artifacts": "node scripts/ci/validate-native-artifacts.mjs",
     "privacy-audit": "node --test job-application-agent/tests/privacy-audit.test.mjs",
     "smoke:package": "node scripts/smoke-package.mjs",
-    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check job-application-agent/scripts/version.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs",
+    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check job-application-agent/scripts/version.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs && node --check state-worker/src/worker.mjs && node --check state-worker/src/cli.mjs && node --check state-worker/bin/sync.mjs",
     "prepack": "npm run check && npm test && npm run privacy-audit"
   },
   "engines": {