pi-career 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+## 0.1.0 - 2026-08-06
+
+### Added
+
+- Standalone Pi package with the stable `career_core_discover`, `career_core_resume`, and `career_core_job` tools.
+- Self-contained reviewed unsigned and not-notarized native Career Core runtimes for `darwin-arm64` and `linux-x64-gnu`, pinned to Core commit `a3cdb4c6d7f966397e93ea4664071975bca7228c` with manifest/provenance/hash/size/mode/contract verification and fail-closed target selection.
+- Bundled discovery-led `career-core` Agent Skill with no separate CLI prerequisite or stale oversized-result fallback.
+- Reproducible checked-in TypeScript bundle, strict runtime/package-content verification, offline no-model and real bundled-operation smokes, isolated Pi install acceptance, and optional bundled-runtime fixture compatibility.
+- Native CI execution for every claimed target without a separate Core checkout or provider credentials.
+- Deterministic `/career-setup`, `/career-library`, `/career-vacancy`, `/career-match`, and `/career-analyze` workflows with bounded symlink-free text libraries, branch-aware consented session cards, conservative ranking, cancellation ownership, and RPC/TUI support without provider/model calls.
+- Public-repository author, ownership, issue-form, private vulnerability-reporting, Dependabot, and pull-request hygiene.
+- Synthetic process-boundary coverage adapted from Career Core commit `100774ed8bb3b39c019d64ce105af1e3f209144f`.
+- Public `pi-career@0.1.0` npm package, unsigned annotated `v0.1.0` Git tag, and GitHub Release channel with no crate publication or custom release asset; exact version/full-commit installation remains canonical.
+- Exact locked normal/build `career-cli` dependency evidence for both native targets, selected third-party MIT/copyright payloads, Rust 1.97.1 Standard Library evidence, target dynamic imports, the required Unicode License V3 text, deterministic package checks, and documented sole-maintainer `v0.1.0` sign-off with no independent legal-review claim.
+- Strict production and complete development/host-Pi audit gates, both clean at the explicit low threshold, with bounded duplicate-key-rejecting JSON, trusted-tool enforcement, tool-shadowing tests, and npm environment override sanitization.
+
+### Changed
+
+- Strict package checks enforce exact public npm registry/access metadata, reject optional or bundled runtime dependency declarations, allow only approved documents, verify the extracted native license inventory, prove no Pi package contents or `node_modules`, enforce exactly four wildcard external peers, and run extracted load/runtime/install smokes.
+- Pi development packages are updated to `0.84.0` (`typebox` `1.3.7`), retiring the temporary nonzero audit acceptance. `audit:production` and `audit:full` now both gate from low severity and invoke npm from the real Node installation rather than `PATH`; `check:publish` is a direct Node, no-publication readiness orchestrator combining both clean audits with strict package proof. npm tree/severity environment overrides are removed, duplicate decoded JSON keys are rejected, and package extraction uses verified absolute `/usr/bin/tar`.

package/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Revaz Zakalashvili
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Revaz Zakalashvili
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,31 @@
+pi-career
+
+Portions of the initial process adapter, tool mappings, Agent Skill guidance,
+and synthetic process-boundary tests were adapted from career-core commit
+100774ed8bb3b39c019d64ce105af1e3f209144f, Copyright (c) 2026 Revaz
+Zakalashvili, under the MIT OR Apache-2.0 dual license.
+
+This repository preserves those dual-license terms. See LICENSE-MIT and
+LICENSE-APACHE.
+
+Unsigned package-owned native runtime binaries and exact per-target provenance
+were imported from the independently verified Career Core workflow run
+30953471793 at commit a3cdb4c6d7f966397e93ea4664071975bca7228c,
+Copyright (c) 2026 Revaz Zakalashvili. They are tracked package inputs from a
+Career Core workflow marked not_a_public_release, not standalone/custom release
+assets, signed artifacts, or a notarized distribution. Version 0.1.0 distributes
+them inside the public npm package and tracked Git tree; no custom release asset,
+signature, or notarization is claimed.
+
+The reviewed runtime license copies and third-party notice are preserved under
+runtime/. docs/native-dependency-inventory.md records the exact locked
+normal/build career-cli graph, selected MIT texts for every reachable crate,
+Rust 1.97.1 Standard Library evidence, target dynamic imports, and exclusions
+for both distributed targets. unicode-ident 1.0.24 and Rust Unicode data require
+the Unicode License V3; the exact selected license/copyright payload is
+preserved under docs/licenses/.
+
+The dependency inventory is evidence, not legal advice or legal approval. For
+version 0.1.0, docs/releasing.md records sole-maintainer license sign-off rather
+than independent legal review, the artifact-provenance decision, and clean
+production and full development audits.

package/README.md

@@ -0,0 +1,159 @@
+# pi-career
+
+Self-contained [Pi package](https://github.com/earendil-works/pi) for deterministic Career Core workflows on explicitly supported native targets.
+
+This publicly readable Git repository owns the Pi adapter, package-owned runtime artifacts and resolver, Pi package metadata, Pi-facing Agent Skill, build/package tests, and integration guidance. Career Core remains authoritative for operations, algorithms, versioned JSON schemas, errors, evidence, warnings, uncertainty, ordering, and assisted/non-authoritative semantics.
+
+## Surface and non-scope
+
+The package preserves exactly three native tools:
+
+- `career_core_discover`
+- `career_core_resume`
+- `career_core_job`
+
+On supported targets it also provides deterministic slash commands:
+
+- `/career-setup`
+- `/career-library`
+- `/career-vacancy`
+- `/career-match`
+- `/career-analyze`
+
+Commands call the same package-owned runtime directly through bounded argv/stdin execution; they never call an LLM-facing tool, provider, model, network, PATH, Cargo, sibling checkout, or downloaded runtime. The workflow scans only explicitly configured `.md`/`.txt` roots, excludes assisted variants and inputs over 50,000 Unicode scalar values from authoritative operations, and never overwrites source files. See [`docs/design.md`](docs/design.md), [`docs/product-flow.md`](docs/product-flow.md), and [`SECURITY.md`](SECURITY.md).
+
+## Supported runtime targets
+
+| Package target | Native platform |
+|---|---|
+| `darwin-arm64` | macOS on Apple silicon |
+| `linux-x64-gnu` | Linux x64 with glibc |
+
+Windows, macOS x64, Linux arm64, Linux musl, and unknown libc/platform combinations are unsupported. The package may register on an unsupported target, but deterministic operations fail closed with a payload-free `unsupported_platform` error; they never guess, download a runtime, search `PATH`, or invoke Cargo.
+
+The unsigned package-owned runtime artifacts were produced and natively verified from Career Core commit `a3cdb4c6d7f966397e93ea4664071975bca7228c` by [artifact run 30953471793](https://github.com/revazi/career-core/actions/runs/30953471793). [`runtime/manifest.json`](runtime/manifest.json) pins target paths, sizes, SHA-256 values, provenance, and bounded contract digests. Before the first bundled spawn in each process, the selected regular executable is checked for exact size, mode, and SHA-256; only successful verification is cached in memory.
+
+`CAREER_CLI_PATH` remains an optional developer/recovery override. When set, it must be a bounded absolute path to a separately reviewed compatible executable and takes precedence over the bundled runtime. Normal users do not set it.
+
+## End-user prerequisites
+
+- Pi with 0.84.0-compatible package APIs
+- one of the two supported native targets above
+- a reviewed clean local checkout, public Git commit, or exact npm version of this package
+
+No separate Career Core checkout, `career` installation, Cargo, Rust toolchain, install-time build, or runtime download is required.
+
+## Reviewed local installation
+
+Pi local-path packages are referenced in place rather than copied. Register a reviewed clean checkout at a stable absolute path:
+
+```bash
+cd /absolute/path/to/pi-career
+package_root="$(pwd -P)"
+pi install "$package_root"
+pi list
+```
+
+Restart Pi or run `/reload` after a reviewed update. A local registration follows files at that path and does not pin future changes, so update the checkout only to reviewed revisions.
+
+Remove the registration with the same resolved path:
+
+```bash
+cd /absolute/path/to/pi-career
+package_root="$(pwd -P)"
+pi remove "$package_root"
+pi list
+```
+
+## Public npm installation pinned to a version
+
+After reviewing the release metadata, install an exact published version:
+
+```bash
+pi install npm:pi-career@0.1.0
+pi list
+```
+
+A versioned npm package is pinned and skipped by package updates. Review and install a new exact version to update. Remove it by package identity:
+
+```bash
+pi remove npm:pi-career
+```
+
+## Public Git installation pinned to a commit
+
+After reviewing a full commit SHA, install directly from this public repository; no configured Git credentials are required:
+
+```bash
+pi install git:github.com/revazi/pi-career@<full-reviewed-commit-sha>
+pi list
+```
+
+A pinned Git package is not moved by `pi update --extensions`. To update, review a new full SHA and install that explicit ref:
+
+```bash
+pi install git:github.com/revazi/pi-career@<new-full-reviewed-commit-sha>
+```
+
+Remove it by repository identity:
+
+```bash
+pi remove git:github.com/revazi/pi-career
+```
+
+Version `0.1.0` is published as the public npm package `pi-career` with no lifecycle scripts, package-owned runtime npm dependencies, or bundled Pi peer contents. The npm tarball carries the same two unsigned, hash-verified, not-notarized native executables as reviewed local and Git installations; it does not build them with Cargo on the user's machine.
+
+The `v0.1.0` release consists of the exact npm version, an unsigned annotated Git tag, and a GitHub Release; the reviewed full commit SHA and exact npm version are the installation coordinates. There is no crate publication, custom release asset, signing, or notarization. Both the package-owned production audit and complete development/host-Pi audit are clean at the explicit low threshold. Native-license evidence received documented sole-maintainer review, not independent legal review; see [`docs/releasing.md`](docs/releasing.md).
+
+## Contributor build and verification
+
+Node.js 22.19 or newer is required for development checks; release verification uses npm 10.9.3 from the Node 22.19 CI toolchain. TypeScript under `src/` is authoritative. `dist/index.js` is its reproducible generated bundle and is intentionally tracked with the reviewed native runtimes so clean local, public-Git, and npm packages load without development dependencies. Node build/test tooling stays as directly executed `.mjs` under `scripts/` and `tests/` and is excluded from the package artifact. Pi-provided packages remain external peers.
+
+```bash
+npm ci
+npm run build
+git diff --exit-code -- dist/index.js
+npm run check
+npm run test:bundled-runtime
+npm run audit:production
+npm run audit:full
+npm run check:publish
+PI_OFFLINE=1 npm run test:pi-smoke
+PI_OFFLINE=1 npm run test:install
+git diff --check
+```
+
+`npm run build` rebuilds only `dist/index.js`; it never builds or downloads native runtimes. `npm run check:runtime-artifacts` enforces the runtime manifest, provenance, five-file source artifact contract, target magic, exact hashes/sizes/modes, and package bounds. `npm run audit:production` requires zero package-owned production vulnerabilities and `npm run audit:full` requires zero vulnerabilities across the complete development/host-Pi tree, both from an explicit low-severity threshold. Production/full audit and package commands invoke `process.execPath` with the absolute npm CLI derived from that real Node installation, verify any inherited `npm_execpath`, and remove omit/include/audit-level/`NODE_ENV` overrides; npm and tar are never selected from `PATH`. `npm run check:publish` is a direct Node authoritative readiness orchestrator but does not publish anything: it runs both strict audits and the package checks. Strict bounded parsing rejects duplicate decoded keys in audit and pack JSON. The package check uses verified absolute `/usr/bin/tar`, proves the tarball has no `node_modules` or Pi package contents, keeps exactly `@earendil-works/pi-ai`, `@earendil-works/pi-coding-agent`, `@earendil-works/pi-tui`, and `typebox` as wildcard external peers, extracts the artifact, loads it, executes the bundled runtime, and performs an isolated install/list/remove smoke. Any future audit finding blocks publication and requires remediation rather than a checked-in acceptance baseline.
+
+Optional local compatibility uses an explicitly supplied reviewed Career Core fixture root while still executing the bundled runtime:
+
+```bash
+CAREER_CORE_FIXTURE_ROOT=/absolute/path/to/reviewed/career-core \
+  npm run test:compat
+```
+
+Hosted CI needs no separate Core checkout or provider credentials. Its native matrix executes every claimed target: Ubuntu x64 GNU and macOS arm64.
+
+## Privacy before document operations
+
+Pi may persist native-tool arguments/results and workflow custom entries in session JSONL. The slash commands require the displayed session-persistence decision before the first private vacancy or compact result card is appended to a persisted session. Global config stores only canonical resume-root paths and bounded labels—never resume text, vacancy text, or Core output. Full Core JSON is not stored by the workflow, and custom workflow entries are excluded from LLM context.
+
+For direct native-tool use, make the same explicit persistence decision before placing private resume or job content in `input_json`. Prefer a new transient run when session saving is not wanted:
+
+```bash
+pi --no-session
+```
+
+This is not a secure-erasure guarantee and does not remove previous sessions, shell history, backups, provider copies, or saved output. Local Pi-context approval also does not authorize sending content to an external model/provider.
+
+Start with `career_core_discover`, invoke only capabilities reported as available, and export the exact input schema before document calls. If the adapter reports `result_too_large` or `result_too_many_lines`, do not request or use partial output. Full-result export is not yet available through pi-career.
+
+## Maintainer and support
+
+Maintained by [Revaz Zakalashvili](https://github.com/revazi). Use this repository's Issues for sanitized bugs and scoped feature requests, follow [`CONTRIBUTING.md`](CONTRIBUTING.md) for changes, and follow [`SECURITY.md`](SECURITY.md) for vulnerabilities. Never place private career content or vulnerability details in an ordinary issue.
+
+## License and provenance
+
+Licensed under either Apache-2.0 or MIT, at your option. See [`LICENSE-APACHE`](LICENSE-APACHE), [`LICENSE-MIT`](LICENSE-MIT), [`NOTICE`](NOTICE), and the package-bounded runtime license/notices files under [`runtime/`](runtime/).
+
+The locked normal/build dependency evidence for both native CLI targets is in [`docs/native-dependency-inventory.md`](docs/native-dependency-inventory.md). The package preserves the exact selected MIT/copyright texts for every reachable crate group, Rust 1.97.1 Standard Library evidence, and the required [`Unicode License V3`](docs/licenses/Unicode-3.0.txt) text under [`docs/licenses/`](docs/licenses/). `npm run check:native-licenses` enforces that payload. The inventory is evidence, not legal advice or automated release approval; [`docs/releasing.md`](docs/releasing.md) requires documented human sign-off and transparently records sole-maintainer review when independent review is unavailable.

package/SECURITY.md

@@ -0,0 +1,45 @@
+# Security and privacy
+
+## Reporting
+
+Do not open an ordinary issue with vulnerability details. Public repository visibility does not change this rule: use a private Security-tab reporting/advisory route when it is available to your repository role; otherwise contact the maintainer through an already agreed private channel before sharing exploit details. Do not include resume text, job descriptions, credentials, executable paths, Pi sessions, hashes, environment values, or raw process diagnostics in a report.
+
+## Bundled runtime boundary
+
+On supported targets, the extension invokes only its reviewed package-owned Career Core executable unless the caller explicitly sets a bounded absolute `CAREER_CLI_PATH` override. Resolution never searches `PATH`, a Career Core checkout, or Cargo and never downloads/builds a runtime.
+
+Supported bundled targets are exactly `darwin-arm64` and `linux-x64-gnu`; Linux support requires positive glibc detection. Other platforms, architectures, musl, and unknown libc fail closed with a payload-free `unsupported_platform` error.
+
+The committed runtime manifest pins exact Core commit/run provenance, paths, target triples, sizes, modes, SHA-256 values, notices, and bounded contract digests. Before the first bundled spawn per process, the resolver rejects links/non-files, verifies exact mode/size/SHA-256, and caches only successful verification in memory. Runtime-selection/integrity errors never expose platform details, paths, hashes, environment values, or raw filesystem errors. The imported binaries are unsigned package-owned artifacts tracked with the repository and included in the npm package; this project makes no signing or notarization claim.
+
+## Process and data boundary
+
+The selected runtime is invoked through direct argv-only `spawn` with `shell: false`. Document JSON is bounded, parsed as one object before spawn, and sent only through stdin.
+
+The process adapter creates no career payload/result temporary file and performs no model, provider, credential, network, URL-fetching, telemetry, MCP, or retry/repair behavior. It enforces timeout/cancellation cleanup, independent stdout/stderr ceilings, fatal UTF-8 decoding, exact-one-object success, no success diagnostics, and complete-result context bounds. Oversized authoritative results fail rather than truncate; partial output and full-result export are unavailable.
+
+The deterministic slash-command layer calls that adapter helper directly. Its global config stores only canonical root paths and bounded labels in an agent-directory-relative `0700` directory with atomic `0600` writes. Scans are bounded, UTF-8 strict, and symlink-free. Source text and full Core results are never written to global config or logs.
+
+Only a strictly shaped, bounded, allowlisted `career.error.v1` may cross a known nonzero runtime failure. Other failures expose a stable payload-free `career.pi_error.v1`. Runtime code must not log or expose source/result text, raw errors, stderr, executable paths, hashes, platform details, environment values, or credentials.
+
+## Pi session boundary
+
+Pi may store tool arguments/results and workflow custom entries in session JSONL. Before the workflow appends its first private vacancy or compact result card in a persisted session, it requires the explicit local-persistence decision. Custom workflow entries do not enter LLM context, and full Core JSON is not stored. Direct private native-tool use still requires an explicit decision. Prefer a new transient run when persistence is not wanted:
+
+```bash
+pi --no-session
+```
+
+This is not secure erasure and does not remove shell history, backups, earlier Pi sessions, provider copies, or separately saved results. Consent to local Pi context is not consent to send content to an external model/provider.
+
+## Installation and supply chain
+
+Pi packages execute with the user's permissions. Install only a reviewed clean local checkout, public Git source pinned to a reviewed full commit, or public npm package pinned to an exact reviewed version. Review the tracked TypeScript bundle, runtime manifest/provenance, binary hashes/modes, package allowlist, registry metadata, and native CI results. Normal installation has no npm lifecycle script, post-install runtime download, Cargo/Rust build, or package-owned runtime npm dependency.
+
+`npm run audit:production` must report zero package-owned production vulnerabilities and `npm run audit:full` must report zero vulnerabilities across the complete development/host-Pi tree, both with explicit `--audit-level=low`. Audit and pack checks invoke `process.execPath` with the absolute npm CLI derived from the real Node installation, require any inherited `npm_execpath` to resolve to that CLI, remove omit/include/audit-level/`NODE_ENV` overrides, and strictly reject duplicate decoded JSON keys. Package listing/extraction invokes verified root-owned absolute `/usr/bin/tar`; neither npm nor tar is resolved from `PATH`. The strict package check proves the tarball contains no `node_modules` or Pi package contents and declares exactly four wildcard external peers: `@earendil-works/pi-ai`, `@earendil-works/pi-coding-agent`, `@earendil-works/pi-tui`, and `typebox`. Those packages are supplied by the host Pi installation, outside this tarball's production dependency tree.
+
+The direct Node `check:publish` orchestrator requires both clean audits and the extracted package proof. Any future low-or-higher audit finding, duplicate-key ambiguity, untrusted tool coordinate, command failure, or malformed report fails closed. Do not add an audit-acceptance baseline; remediate the dependency or stop publication.
+
+A local-path registration follows later filesystem changes. Uninstalling the package only unregisters it; it does not erase Git clones, Pi sessions, shell history, backups, or document copies.
+
+Supported security fixes apply to the latest reviewed repository revision and published npm version. Version `0.1.0` follows the package, tag, audit, provenance, and release boundary recorded in [`docs/releasing.md`](docs/releasing.md).