job-application-agent 3.3.0 → 3.4.1

package/job-application-agent/scripts/version.mjs

@@ -1 +1 @@
-export const SKILL_VERSION = '3.3.0';
+export const SKILL_VERSION = '3.4.1';

package/job-application-agent/tests/cloud-state-client.test.mjs

@@ -0,0 +1,105 @@
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, readFile, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import { CloudStateClient, saveCloudConfig } from '../scripts/cloud-state-client.mjs';
+import worker, { sha256Hex } from '../../state-worker/src/worker.mjs';
+import { createMemoryD1, hasNodeSqlite } from '../../state-worker/tests/d1-mock.mjs';
+import { createMemoryR2 } from '../../state-worker/tests/r2-mock.mjs';
+
+const TOKEN = 'test-client-token-with-sufficient-length-cloud';
+const sqliteTest = hasNodeSqlite ? test : test.skip;
+
+async function setup() {
+  const root = await mkdtemp(join(tmpdir(), 'job-agent-cloud-'));
+  const stateDir = join(root, 'state');
+  const configPath = join(root, 'cloud', 'config.json');
+  await mkdir(stateDir, { recursive: true });
+  const schema = await readFile(new URL('../../state-worker/migrations/0001_private_state.sql', import.meta.url), 'utf8');
+  const DB = createMemoryD1(schema);
+  await DB.prepare('INSERT INTO clients (client_id, name, token_hash, created_at) VALUES (?, ?, ?, ?)')
+    .bind('client-test', 'Test Client', sha256Hex(TOKEN), new Date().toISOString()).run();
+  const bindings = { DB, STATE: createMemoryR2(), STATE_TOKEN: 'legacy', LEGACY_WRITES_DISABLED: '1' };
+  const fetchImpl = (input, init) => worker.fetch(new Request(input, init), bindings);
+  await saveCloudConfig({ version: 2, url: 'https://state.example.com', token: TOKEN, clientId: 'client-test', clientName: 'Test Client' }, { configPath });
+  const client = new CloudStateClient({ stateDir, configPath, fetchImpl });
+  return { root, stateDir, configPath, bindings, client };
+}
+
+sqliteTest('cloud config and profile cache are owner-only and work without Keychain', async () => {
+  const ctx = await setup();
+  await ctx.client.putDocument('profile', { name: 'Ada', email: 'ada@example.com' }, 0);
+  const profile = await ctx.client.refreshProfileCache();
+  assert.equal(profile.name, 'Ada');
+  if (process.platform !== 'win32') assert.equal((await stat(ctx.configPath)).mode & 0o777, 0o600);
+  const cache = join(ctx.stateDir, 'cloud-profile-cache.json');
+  if (process.platform !== 'win32') assert.equal((await stat(cache)).mode & 0o777, 0o600);
+  assert.deepEqual(JSON.parse(await readFile(cache, 'utf8')), profile);
+});
+
+sqliteTest('cloud documents refresh the owner-only local caches', async () => {
+  const ctx = await setup();
+  await ctx.client.putDocument('autonomy', { version: 1, enabled: true, mode: 'routine-auto' }, 0);
+
+  const refreshed = await ctx.client.refreshDocumentCaches();
+
+  assert.equal(refreshed.autonomy.revision, 1);
+  assert.equal(JSON.parse(await readFile(join(ctx.stateDir, 'autonomy.json'), 'utf8')).enabled, true);
+  if (process.platform !== 'win32') assert.equal((await stat(join(ctx.stateDir, 'autonomy.json'))).mode & 0o777, 0o600);
+});
+
+sqliteTest('reconcile dry-run reports the exact union without writing', async () => {
+  const ctx = await setup();
+  const local = [
+    { id: 'app-1', company: 'A', submittedAt: '2026-01-01T00:00:00.000Z' },
+    { id: 'app-2', company: 'B', submittedAt: '2026-01-02T00:00:00.000Z' },
+  ];
+  await writeFile(join(ctx.stateDir, 'applications.ndjson'), `${local.map(JSON.stringify).join('\n')}\n`);
+  await ctx.client.appendRecord('applications', local[0], { recordKey: 'app-1', idempotencyKey: 'migration:app-1' });
+  const report = await ctx.client.reconcile({ dryRun: true });
+  assert.deepEqual(report.streams.applications, { localRows: 2, cloudRows: 1, localOnly: 1, cloudOnly: 0, unionRows: 2 });
+  assert.equal((await ctx.bindings.DB.prepare("SELECT COUNT(*) AS count FROM records WHERE stream = 'applications'").first()).count, 1);
+});
+
+sqliteTest('reconcile imports local-only rows idempotently and preserves provenance', async () => {
+  const ctx = await setup();
+  const local = [{ id: 'app-1', company: 'A', submittedAt: '2026-01-01T00:00:00.000Z' }];
+  await writeFile(join(ctx.stateDir, 'applications.ndjson'), `${JSON.stringify(local[0])}\n`);
+  const first = await ctx.client.reconcile({ dryRun: false, provenance: 'mac-cutover' });
+  const second = await ctx.client.reconcile({ dryRun: false, provenance: 'mac-cutover' });
+  assert.equal(first.imported, 1);
+  assert.equal(second.imported, 0);
+  const row = await ctx.bindings.DB.prepare("SELECT provenance FROM records WHERE stream = 'applications'").first();
+  assert.equal(row.provenance, 'mac-cutover');
+});
+
+sqliteTest('reconcile includes the owner-only discovery review ledger', async () => {
+  const ctx = await setup();
+  const lead = { type: 'lead-reviewed', roundId: 'round-1', leadId: 'lead-1', disposition: 'duplicate', occurredAt: '2026-01-01T00:00:00.000Z' };
+  await writeFile(join(ctx.stateDir, 'discovery.ndjson'), `${JSON.stringify(lead)}\n`);
+
+  const report = await ctx.client.reconcile({ dryRun: false });
+
+  assert.equal(report.streams.discovery.imported ?? report.streams.discovery.localOnly, 1);
+  assert.deepEqual((await ctx.client.listStream('discovery'))[0].value, lead);
+});
+
+sqliteTest('resume download verifies checksum and creates a private path cache', async () => {
+  const ctx = await setup();
+  const bytes = Buffer.from('%PDF-1.7\ncloud-resume-fixture');
+  await ctx.client.putFile('resume.pdf', bytes, 0);
+  const result = await ctx.client.fetchResume();
+  assert.equal(result.sha256, sha256Hex(bytes));
+  if (process.platform !== 'win32') assert.equal((await stat(result.path)).mode & 0o777, 0o600);
+  assert.equal(Buffer.from(await readFile(result.path)).equals(bytes), true);
+});
+
+sqliteTest('outage queues an already observed append but blocks application intents', async () => {
+  const ctx = await setup();
+  const offline = new CloudStateClient({ stateDir: ctx.stateDir, configPath: ctx.configPath, fetchImpl: async () => { throw new Error('offline'); } });
+  const queued = await offline.appendRecord('outcomes', { id: 'app-1', status: 'interview' }, { recordKey: 'app-1', idempotencyKey: 'outcome:1', queueOnFailure: true });
+  assert.equal(queued.queued, true);
+  await assert.rejects(() => offline.createIntent({ applicationId: 'app-2', canonicalUrl: 'https://jobs.example/app-2', leaseId: 'lease' }), /cloud state unavailable/i);
+});

package/job-application-agent/tests/job-application.test.mjs

@@ -5,6 +5,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
 import { fileURLToPath } from 'node:url';
+import { createServer } from 'node:http';
 
 import { buildReview, commandCategory, durationBucket, migrateProfile, profileStatus, scoreJob, telemetryErrorCode, telemetryJobAssessed, validateLedgerEntry, validateProfile, validateSubmissionTelemetry } from '../scripts/job-application.mjs';
 
@@ -52,6 +53,7 @@ function isolatedCliEnv(directory) {
   return {
     ...process.env,
     JOB_APPLICATION_AGENT_STATE_DIR: directory,
+    JOB_APPLICATION_AGENT_CLOUD_CONFIG: join(directory, 'cloud-config.json'),
     JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
   };
 }
@@ -88,6 +90,24 @@ test('returns the canonical resume path for direct browser uploads', async (t) =
   assert.deepEqual(result, { path: resume });
 });
 
+test('returns a verified local resume cache while configured cloud storage is offline', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-offline-resume-'));
+  const cloudDirectory = await mkdtemp(join(tmpdir(), 'public-job-agent-offline-cloud-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  t.after(() => rm(cloudDirectory, { recursive: true, force: true }));
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const resume = join(directory, 'resume.pdf');
+  const configPath = join(cloudDirectory, 'config.json');
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
+  await writeFile(resume, '%PDF-1.7\ncached resume fixture');
+  await writeFile(configPath, JSON.stringify({ version: 2, url: 'https://127.0.0.1:9', token: 'offline-client-token-with-sufficient-length', clientId: 'offline-client' }), { mode: 0o600 });
+  const env = { ...isolatedCliEnv(directory), JOB_APPLICATION_AGENT_CLOUD_CONFIG: configPath };
+
+  const result = JSON.parse(execFileSync(process.execPath, [script, 'resume', 'path'], { env, encoding: 'utf8' }));
+
+  assert.deepEqual(result, { path: resume });
+});
+
 test('preserves the Linux secret-tool install error for profile-dependent commands', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'job-agent-linux-profile-error-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
@@ -492,5 +512,81 @@ test('telemetry CLI controls are private and reset removes anonymous credentials
   assert.equal(disabled.enabled, false);
   const reset = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'reset'], { env, encoding: 'utf8' }));
   assert.equal(reset.hasInstallationId, false);
+  const identityDisabled = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'identity', 'disable'], { env, encoding: 'utf8' }));
+  assert.equal(identityDisabled.identityEnabled, false);
+  assert.equal(identityDisabled.enabled, false);
+  const identityEnabled = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'identity', 'enable'], { env, encoding: 'utf8' }));
+  assert.equal(identityEnabled.identityEnabled, true);
+  assert.equal(identityEnabled.enabled, false);
+  assert.equal(identityEnabled.identityDisclosed, false);
   if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'telemetry.json'))).mode & 0o777, 0o600);
 });
+
+test('CLI emits bounded source coverage without private evidence or attribution', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-coverage-cli-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const captured = [];
+  const server = createServer(async (request, response) => {
+    let raw = '';
+    for await (const chunk of request) raw += chunk;
+    captured.push(JSON.parse(raw));
+    response.setHeader('content-type', 'application/json');
+    response.end(JSON.stringify({ accepted: true }));
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: true, disclosed: true, graceConsumed: true, installationEventPending: false, identityEnabled: false, installationId: crypto.randomUUID(), token: 'synthetic-token', tokenExpiresAt: '2099-01-01T00:00:00Z' }));
+  const env = { ...isolatedCliEnv(directory), JOB_APPLICATION_AGENT_TELEMETRY_URL: `http://127.0.0.1:${server.address().port}` };
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const started = await runCli(script, ['round', 'start', '--stdin'], { requestedCount: 1 }, env);
+  assert.equal(started.code, 0, started.stderr);
+  const roundId = JSON.parse(started.stdout).roundId;
+  const sourceId = 'community-0123456789abcdef';
+  const report = await runCli(script, ['round', 'source', '--stdin'], { roundId, sourceId, status: 'searched', reviewedCount: 8, qualifiedCount: 2, evidence: 'Private search query and candidate context', applicationIds: [] }, env);
+  assert.equal(report.code, 0, report.stderr);
+  const event = captured.find((body) => body.event === 'source_checked');
+  assert.ok(event, JSON.stringify(captured));
+  assert.deepEqual(event.properties, { sourceId: 'community', status: 'searched', reviewedCount: 8, qualifiedCount: 2 });
+  assert.equal(JSON.stringify(captured).includes('Private search query'), false);
+  assert.equal(JSON.stringify(captured).includes(roundId), false);
+  assert.equal(JSON.stringify(captured).includes(sourceId), false);
+});
+
+test('CLI attaches only explicit saved name/email after disclosure and opt-out continues anonymous usage', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-identity-cli-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const captured = [];
+  const server = createServer(async (request, response) => {
+    let raw = '';
+    for await (const chunk of request) raw += chunk;
+    captured.push({ path: request.url, body: JSON.parse(raw) });
+    response.setHeader('content-type', 'application/json');
+    response.end(JSON.stringify(request.url === '/v1/install' ? { installationId: crypto.randomUUID(), token: 'synthetic-relay-token', expiresAt: '2099-01-01T00:00:00Z' } : { accepted: true }));
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  // Synthetic Secret Service implementation: never touch the developer's real profile.
+  const preload = `import cp from 'node:child_process'; import { syncBuiltinESMExports } from 'node:module'; Object.defineProperty(process, 'platform', { value: 'linux' }); cp.execFileSync = (file, args) => { if (file === 'secret-tool' && args[0] === 'lookup') return ${JSON.stringify(JSON.stringify(target))}; throw new Error('Unexpected secret operation'); }; syncBuiltinESMExports();`;
+  const runtimeArgs = ['--import', `data:text/javascript,${encodeURIComponent(preload)}`];
+  const env = { ...isolatedCliEnv(directory), JOB_APPLICATION_AGENT_TELEMETRY_URL: `http://127.0.0.1:${server.address().port}` };
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const run = (args) => runCli(script, args, undefined, env, runtimeArgs);
+  const first = await run(['profile', 'check']);
+  assert.equal(first.code, 0, first.stderr);
+  assert.match(first.stderr, /name and email sharing is enabled by default/i);
+  assert.ok(captured.length > 0);
+  assert.ok(captured.every(({ body }) => body.identity === undefined));
+  const second = await run(['profile', 'check']);
+  assert.equal(second.code, 0, second.stderr);
+  const identified = captured.at(-1).body;
+  assert.deepEqual(identified.identity, { name: target.name, email: target.email });
+  assert.equal(JSON.stringify(identified).includes(target.phone), false);
+  assert.equal(JSON.stringify(identified).includes(target.location), false);
+  const count = captured.length;
+  const optedOut = await run(['telemetry', 'identity', 'disable']);
+  assert.equal(optedOut.code, 0, optedOut.stderr);
+  assert.equal(captured.length, count);
+  assert.equal((await run(['profile', 'check'])).code, 0);
+  assert.equal(captured.at(-1).body.identity, undefined);
+  assert.notEqual(captured.at(-1).body.installationId, identified.installationId);
+});

package/job-application-agent/tests/linux-secret-service.integration.test.mjs

@@ -18,6 +18,7 @@ test('Linux Secret Service supports the real profile CLI lifecycle', { skip: !en
   const env = {
     ...process.env,
     JOB_APPLICATION_AGENT_KEYCHAIN_SERVICE: service,
+    JOB_APPLICATION_AGENT_CLOUD_CONFIG: join(directory, 'cloud-config.json'),
     JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
     JOB_APPLICATION_AGENT_STATE_DIR: directory,
   };

package/job-application-agent/tests/telemetry-client.test.mjs

@@ -26,7 +26,7 @@ test('new installations disclose and send the first event immediately', async (t
   assert.equal(session.installationEventPending, true);
   await client.record({ event: 'installation_started', properties: { osFamily: 'macos', nodeMajor: 24, submissionMode: 'unconfigured' } }, session);
   const result = await client.record({ event: 'command_completed', properties: { command: 'search', result: 'success', durationBucket: '1-5s' } }, session);
-  assert.match(notice, /anonymous usage analytics/i);
+  assert.match(notice, /usage analytics/i);
   assert.equal(result.sent, true);
   assert.equal(relay.requests.length, 3);
   assert.equal((await client.beginCommand('search')).installationEventPending, false);
@@ -68,7 +68,7 @@ test('a pre-disclosure telemetry config cannot send on its disclosure command',
   let notice = '';
   const client = new TelemetryClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: relay.fetch, stderr: (value) => { notice += value; } });
   const session = await client.beginCommand('search');
-  assert.match(notice, /anonymous usage analytics/i);
+  assert.match(notice, /usage analytics/i);
   assert.equal(session.allowSend, false);
   assert.equal(relay.requests.length, 0);
 });
@@ -130,3 +130,92 @@ test('strict record rejects invalid schema while automatic telemetry stays best
   await assert.rejects(() => client.record(invalid, session, { strict: true }), /durationBucket/i);
   assert.deepEqual(await client.record(invalid, session), { sent: false, reason: 'invalid' });
 });
+
+const usageEvent = { event: 'command_completed', properties: { command: 'profile', result: 'success', durationBucket: 'under-1s' } };
+
+test('identity sharing defaults on but waits until the command after disclosure, including upgrades', async (t) => {
+  for (const legacy of [false, true]) {
+    const directory = await mkdtemp(join(tmpdir(), 'telemetry-identity-'));
+    t.after(() => rm(directory, { recursive: true, force: true }));
+    if (legacy) await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: true, disclosed: true, graceConsumed: true }));
+    const relay = fakeRelay();
+    let notice = '';
+    const client = new TelemetryClient({ stateDir: directory, fetch: relay.fetch, stderr: (value) => { notice += value; }, readIdentity: () => ({ name: 'Test Candidate', email: 'candidate@example.com' }) });
+    const first = await client.beginCommand('profile');
+    await client.record(usageEvent, first);
+    assert.match(notice, /name and email/i);
+    assert.match(notice, /telemetry identity disable/);
+    assert.equal(relay.requests.at(-1).body.identity, undefined);
+    await client.record(usageEvent); // A missing session must not bypass the disclosure gate.
+    assert.equal(relay.requests.at(-1).body.identity, undefined);
+    await client.record(usageEvent, await client.beginCommand('profile'));
+    assert.deepEqual(relay.requests.at(-1).body.identity, { name: 'Test Candidate', email: 'candidate@example.com' });
+    assert.equal((await client.status()).identityEnabled, true);
+    assert.equal(JSON.stringify(await client.readConfig()).includes('candidate@example.com'), false);
+  }
+});
+
+test('identity opt-out rotates credentials and stops identity sharing even in an already started command', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'telemetry-identity-optout-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const relay = fakeRelay();
+  const client = new TelemetryClient({ stateDir: directory, fetch: relay.fetch, stderr: () => {}, readIdentity: () => ({ name: 'Test Candidate', email: 'candidate@example.com' }) });
+  await client.beginCommand('profile');
+  const session = await client.beginCommand('profile');
+  await client.record(usageEvent, session);
+  assert.ok(relay.requests.at(-1).body.identity);
+  const before = relay.requests.length;
+  const status = await client.configureIdentity('disable');
+  assert.equal(status.enabled, true);
+  assert.equal(status.identityEnabled, false);
+  assert.equal(status.hasInstallationId, false);
+  assert.equal(relay.requests.length, before);
+  await client.record(usageEvent, session);
+  assert.equal(relay.requests.at(-1).body.identity, undefined);
+  assert.deepEqual(relay.requests.at(-2).body, {});
+  const anonymousId = (await client.status()).installationId;
+  await client.configureIdentity('disable');
+  assert.equal((await client.status()).installationId, anonymousId);
+  await client.configure('disable');
+  await client.configure('enable');
+  assert.equal((await client.status()).identityEnabled, false);
+});
+
+test('disabled telemetry and identity opt-out never read identity; malformed identity does not stop usage', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'telemetry-identity-failure-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const relay = fakeRelay();
+  let reads = 0;
+  const client = new TelemetryClient({ stateDir: directory, fetch: relay.fetch, stderr: () => {}, readIdentity: () => { reads++; return { name: 'Test', email: 'bad', resume: 'private' }; } });
+  await client.configure('disable');
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.equal(reads, 0);
+  await client.configure('enable');
+  await client.beginCommand('profile');
+  assert.equal((await client.record(usageEvent, await client.beginCommand('profile'))).sent, true);
+  assert.equal(relay.requests.at(-1).body.identity, undefined);
+  await client.configureIdentity('disable');
+  const before = reads;
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.equal(reads, before);
+});
+
+test('identity re-enable discloses again and rotates the anonymous interval without enabling telemetry', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'telemetry-identity-resume-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const relay = fakeRelay();
+  const client = new TelemetryClient({ stateDir: directory, fetch: relay.fetch, stderr: () => {}, readIdentity: () => ({ email: 'candidate@example.com' }) });
+  await client.configureIdentity('disable');
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.equal(relay.requests.at(-1).body.identity, undefined);
+  await client.configure('disable');
+  const status = await client.configureIdentity('enable');
+  assert.equal(status.enabled, false);
+  assert.equal(status.hasInstallationId, false);
+  assert.equal(status.identityDisclosed, false);
+  await client.configure('enable');
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.equal(relay.requests.at(-1).body.identity, undefined);
+  await client.record(usageEvent, await client.beginCommand('profile'));
+  assert.deepEqual(relay.requests.at(-1).body.identity, { email: 'candidate@example.com' });
+});

package/job-application-agent/tests/telemetry-schema.test.mjs

@@ -6,8 +6,20 @@ import {
   createTelemetryEnvelope,
   jobIdentity,
   validateEvent,
+  validateTelemetryEnvelope,
 } from '../scripts/telemetry-schema.mjs';
 
+test('identity envelope accepts only bounded name and email and keeps old anonymous envelopes compatible', () => {
+  const input = { installationId: '11111111-1111-4111-8111-111111111111', token: 'signed-token', skillVersion: '3.3.0', event: 'command_completed', properties: { command: 'profile', result: 'success', durationBucket: 'under-1s' } };
+  const envelope = createTelemetryEnvelope({ ...input, identity: { name: ' Test Candidate ', email: ' candidate@example.com ' } });
+  assert.deepEqual(envelope.identity, { name: 'Test Candidate', email: 'candidate@example.com' });
+  assert.deepEqual(validateTelemetryEnvelope(envelope), envelope);
+  assert.equal(validateTelemetryEnvelope(createTelemetryEnvelope(input)).identity, undefined);
+  for (const identity of [{}, { name: 'x', phone: 'private' }, { email: 'invalid' }, { name: 'x'.repeat(161) }, { email: 'a\nb@example.com' }, { name: 'Test\nPrivate' }, { name: 'Test', resume: 'private' }]) {
+    assert.throws(() => validateTelemetryEnvelope({ ...envelope, identity }), /identity/i);
+  }
+});
+
 const baseJob = {
   company: 'Example AI',
   title: 'Staff Product Engineer',
@@ -16,6 +28,16 @@ const baseJob = {
   ats: 'greenhouse',
 };
 
+test('source coverage telemetry excludes local evidence and community identifiers', () => {
+  const event = { event: 'source_checked', properties: { sourceId: 'linkedin-jobs-feed', status: 'searched', reviewedCount: 10, qualifiedCount: 2 } };
+  assert.equal(validateEvent(event).properties.sourceId, 'linkedin-jobs-feed');
+  assert.throws(() => validateEvent({ ...event, properties: { ...event.properties, evidence: 'private query and notes' } }), /unknown/i);
+  assert.throws(() => validateEvent({ ...event, properties: { ...event.properties, sourceId: 'community-abcdef1234567890' } }), /sourceId/i);
+  assert.throws(() => validateEvent({ ...event, properties: { ...event.properties, qualifiedCount: 11 } }), /qualifiedCount/i);
+  assert.throws(() => validateEvent({ ...event, properties: { ...event.properties, status: 'blocked' } }), /block/i);
+  assert.equal(validateEvent({ event: 'source_checked', properties: { sourceId: 'community', status: 'blocked', reviewedCount: 0, qualifiedCount: 0, blocker: 'captcha' } }).properties.blocker, 'captcha');
+});
+
 test('canonicalizes job URLs and hashes the destination without query data', async () => {
   assert.equal(canonicalizeJobUrl('https://Jobs.Example.com/role/123/?utm_source=x#apply'), 'https://jobs.example.com/role/123');
   const first = await jobIdentity('https://jobs.example.com/role/123?ref=friend');

package/job-application-agent/tests/workflow-state.test.mjs

@@ -20,7 +20,7 @@ async function fixture(t, label) {
     graceConsumed: true,
     installationEventPending: false,
   }));
-  return { directory, env: { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory, JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9' } };
+  return { directory, env: { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory, JOB_APPLICATION_AGENT_CLOUD_CONFIG: join(directory, 'cloud-config.json'), JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9' } };
 }
 
 function cli(env, args, input) {
@@ -121,15 +121,87 @@ test('counts only unique confirmed ledger submissions for an explicit round', as
   assert.equal(status.blockedCount, 1);
   assert.equal(status.completed, false);
 
-  const completed = cli(env, ['round', 'complete', '--stdin'], { roundId: started.roundId });
+  for (const sourceId of ['linkedin-jobs-feed', 'indeed', 'hacker-news-who-is-hiring']) {
+    cli(env, ['round', 'source', '--stdin'], {
+      roundId: started.roundId, sourceId, status: 'searched', reviewedCount: 30, qualifiedCount: sourceId === 'linkedin-jobs-feed' ? 30 : 0,
+      evidence: 'Reviewed matching postings against the unchanged target; other leads did not qualify.',
+      applicationIds: sourceId === 'linkedin-jobs-feed' ? Array.from({ length: 30 }, (_, i) => `round-role-${i}`) : [],
+    });
+  }
+  const completed = cli(env, ['round', 'complete', '--stdin'], { roundId: started.roundId, concentrationReason: 'stronger-fit', concentrationEvidence: 'The other searched sources had no qualifying roles; all selected roles met the target.' });
   assert.equal(completed.completed, true);
   assert.equal(cli(env, ['round', 'status', started.roundId]).completed, true);
   const roundEvents = (await readFile(join(directory, 'rounds.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
   assert.equal(roundEvents.filter((event) => event.type === 'submission-confirmed').length, 30);
-  assert.equal(roundEvents.length, 32);
+  assert.equal(roundEvents.length, 35);
   if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'rounds.ndjson'))).mode & 0o777, 0o600);
 });
 
+test('round completion requires distinct source coverage and explains concentration without imposing submission quotas', async (t) => {
+  const { env } = await fixture(t, 'source-coverage');
+  const { roundId } = cli(env, ['round', 'start', '--stdin'], { requestedCount: 2 });
+  for (const i of [1, 2]) cli(env, ['ledger', 'add', '--stdin'], submission(i, roundId, { discoverySourceId: 'linkedin-jobs-feed' }));
+  assert.match(cliFailure(env, ['round', 'complete', '--stdin'], { roundId }).stderr, /3 distinct discovery sources/i);
+  const check = { roundId, sourceId: 'linkedin-jobs-feed', status: 'searched', reviewedCount: 10, qualifiedCount: 2, evidence: 'Reviewed ten relevant postings using the target constraints.' };
+  cli(env, ['round', 'source', '--stdin'], check);
+  cli(env, ['round', 'source', '--stdin'], check);
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.attemptedSourceCount, 1);
+  cli(env, ['round', 'source', '--stdin'], { ...check, sourceId: 'indeed', qualifiedCount: 0 });
+  cli(env, ['round', 'source', '--stdin'], { ...check, sourceId: 'hacker-news-who-is-hiring', status: 'blocked', reviewedCount: 0, qualifiedCount: 0, blocker: 'site-error' });
+  const status = cli(env, ['round', 'status', roundId]);
+  assert.equal(status.discovery.coverageSatisfied, true);
+  assert.equal(status.discovery.searchedSourceCount, 2);
+  assert.equal(status.discovery.blockedSourceCount, 1);
+  assert.equal(status.discovery.maxSourceSharePercent, 100);
+  assert.match(cliFailure(env, ['round', 'complete', '--stdin'], { roundId }).stderr, /concentration/i);
+  const completed = cli(env, ['round', 'complete', '--stdin'], { roundId, concentrationReason: 'stronger-fit', concentrationEvidence: 'Only LinkedIn produced qualifying roles; Indeed had none and the third source was unavailable.' });
+  assert.equal(completed.completed, true);
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.concentrationReason, 'stronger-fit');
+  assert.match(cliFailure(env, ['round', 'source', '--stdin'], check).stderr, /completed round/i);
+});
+
+test('discovery coverage rejects invalid reports and requires attribution without rewriting confirmed ledger rows', async (t) => {
+  const { env, directory } = await fixture(t, 'source-validation');
+  const { roundId } = cli(env, ['round', 'start', '--stdin'], { requestedCount: 1 });
+  cli(env, ['ledger', 'add', '--stdin'], submission(1, roundId));
+  const before = await readFile(join(directory, 'applications.ndjson'), 'utf8');
+  const check = { roundId, sourceId: 'linkedin-jobs-feed', status: 'searched', reviewedCount: 4, qualifiedCount: 1, evidence: 'Checked relevant listings against the candidate target.' };
+  for (const bad of [{ sourceId: 'imaginary-board' }, { qualifiedCount: 5 }, { status: 'blocked' }, { applicationIds: ['not-in-round'] }, { evidence: '' }, { privateProfile: 'forbidden' }]) {
+    assert.equal(cliFailure(env, ['round', 'source', '--stdin'], { ...check, ...bad }).status, 1);
+  }
+  for (const sourceId of ['linkedin-jobs-feed', 'indeed', 'hacker-news-who-is-hiring']) cli(env, ['round', 'source', '--stdin'], { ...check, sourceId });
+  assert.match(cliFailure(env, ['round', 'complete', '--stdin'], { roundId }).stderr, /attribution/i);
+  cli(env, ['round', 'source', '--stdin'], { ...check, applicationIds: ['round-role-1'] });
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.unattributedCount, 0);
+  assert.equal(await readFile(join(directory, 'applications.ndjson'), 'utf8'), before);
+});
+
+test('source diversity is independent of ATS and concentration explanations are unnecessary for a balanced mix', async (t) => {
+  const { env } = await fixture(t, 'balanced-discovery');
+  const { roundId } = cli(env, ['round', 'start', '--stdin'], { requestedCount: 5 });
+  const ids = ['linkedin-jobs-feed', 'indeed', 'hacker-news-who-is-hiring'];
+  for (const sourceId of ids) cli(env, ['round', 'source', '--stdin'], { roundId, sourceId, status: 'searched', reviewedCount: 3, qualifiedCount: 2, evidence: 'Reviewed relevant postings and verified target fit.' });
+  for (let i = 1; i <= 5; i++) cli(env, ['ledger', 'add', '--stdin'], submission(i, roundId, { discoverySourceId: ids[(i - 1) % 3], applicationChannel: 'ashby' }));
+  const completed = cli(env, ['round', 'complete', '--stdin'], { roundId });
+  assert.equal(completed.discovery.maxSourceSharePercent, 40);
+  assert.equal(completed.discovery.concentrationNeedsExplanation, false);
+  assert.equal(cli(env, ['round', 'complete', '--stdin'], { roundId }).completionRecorded, false);
+});
+
+test('blocked-only attempts and two views of the same network do not satisfy discovery', async (t) => {
+  const { env } = await fixture(t, 'blocked-discovery');
+  const { roundId } = cli(env, ['round', 'start', '--stdin'], { requestedCount: 1 });
+  const check = { roundId, status: 'blocked', reviewedCount: 0, qualifiedCount: 0, blocker: 'login', evidence: 'Source requires an authenticated session that is unavailable.' };
+  for (const sourceId of ['linkedin-jobs-feed', 'yc-work-at-a-startup', 'yc-company-directory']) cli(env, ['round', 'source', '--stdin'], { ...check, sourceId });
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.attemptedSourceCount, 2);
+  cli(env, ['round', 'source', '--stdin'], { ...check, sourceId: 'indeed' });
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.coverageSatisfied, false);
+  const { blocker, ...searched } = check;
+  cli(env, ['round', 'source', '--stdin'], { ...searched, sourceId: 'indeed', status: 'searched', reviewedCount: 1, qualifiedCount: 1 });
+  cli(env, ['round', 'source', '--stdin'], { ...check, sourceId: 'indeed' });
+  assert.equal(cli(env, ['round', 'status', roundId]).discovery.coverageSatisfied, true);
+});
+
 test('ships a filterable global discovery source catalog and tracks source attribution', async (t) => {
   const { directory, env } = await fixture(t, 'source-catalog');
   const catalog = cli(env, ['sources', 'list']);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "job-application-agent",
-  "version": "3.3.0",
+  "version": "3.4.1",
   "description": "A privacy-first Agent Skill and CLI for evidence-based job discovery, application completion, and outcome tracking.",
   "license": "MIT",
   "type": "module",
@@ -38,7 +38,7 @@
     "check:native-artifacts": "node scripts/ci/validate-native-artifacts.mjs",
     "privacy-audit": "node --test job-application-agent/tests/privacy-audit.test.mjs",
     "smoke:package": "node scripts/smoke-package.mjs",
-    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check job-application-agent/scripts/version.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs",
+    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/cloud-state-client.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check job-application-agent/scripts/version.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs && node --check state-worker/src/worker.mjs && node --check state-worker/src/backup.mjs && node --check state-worker/src/cli.mjs && node --check state-worker/bin/sync.mjs",
     "prepack": "npm run check && npm test && npm run privacy-audit"
   },
   "engines": {