pi-career 0.1.0 → 0.2.0

package/docs/product-flow.md

@@ -1,8 +1,10 @@
 # Product flow roadmap
 
-## Current phase: deterministic tools and slash-command MVP
+The cross-repository migration plan and measured findings are recorded in [`career-run-roadmap.md`](career-run-roadmap.md). Career Core Phase 8 and the first managed `career_run` implementation are complete; package-owned saving and PDF extraction expansion remain later phases.
 
-This package preserves the three stable native tools:
+## Current phase: managed agent tool and deterministic slash commands
+
+The normal active model surface is one compact `career_run` tool. The exact raw compatibility tools remain registered but inactive until `/career-tools raw` explicitly enables them:
 
 - `career_core_discover`
 - `career_core_resume`
@@ -10,38 +12,52 @@ This package preserves the three stable native tools:
 
 It also registers:
 
-- `/career-setup` for library and privacy onboarding—not external CLI installation
-- `/career-library` for explicitly configured Markdown/text resume roots
+- `/career-setup` for library/privacy onboarding and a suggestion-only preferred variation directory—not external CLI installation
+- `/career-library` for explicitly configured searchable PDF, Markdown, and text resume roots, with actionable extraction notices
+- `/career-application` for session-scoped company/role identity and vacancy/result isolation
 - `/career-vacancy` for bounded vacancy input after session-persistence consent
 - `/career-match` for deterministic multi-resume matching and conservative ranking
 - `/career-analyze` for deterministic single-resume readiness detail
+- `/career-workbench` for a bounded, guided, visibly reviewable rebuild handoff to the user's normal Pi editor
+- `/career-tools` to switch between the managed-only and advanced raw model-tool surfaces
 
-On supported targets all eight routes invoke the package-owned deterministic Career Core runtime. Slash commands call the shared process helper directly and do not use a provider/model or an LLM-facing tool.
+`career_run`, the raw compatibility tools, `/career-vacancy`, `/career-match`, and `/career-analyze` invoke the compatible Career Core route selected by the external resolver. Managed compatibility is validated before private input, and the reviewed exact package may be acquired only after local routes fail unless `PI_OFFLINE=1`. `career_run` validates Phase 8 operation/schema contracts internally, resolves current originals/vacancy through ephemeral handles, keeps complete results in bounded process memory, and exposes compact detail hydration without nested `input_json`. Setup/library scanning remains local. `/career-application` manages consented session state only. `/career-workbench` does not invoke Core or a provider/model itself: it prepares an ordinary editor message containing one original resume and, only for tailoring, the current vacancy. Guided modes cover complete score explanation, reviewed improvement suggestions, a question-led factual interview before reviewed replacements, direct reviewed exact replacements, and vacancy-specific variant review. The user must review and submit that message separately through Pi.
 
 Binding boundaries:
 
-- no provider/model calls in deterministic commands
-- agent-directory-relative non-sensitive config only
-- no resume or vacancy text in global config
+- no package-initiated provider/model calls or automatic submission; the workbench stops at a reviewable editor prompt, and only the user's later ordinary Pi submission may contact the selected provider; exact-package acquisition before private stdin is the sole network-capable adapter-runtime behavior
+- agent-directory-relative non-sensitive config only; it may contain canonical library roots and one bounded absolute preferred variation-directory suggestion
+- no resume or vacancy text in global config; a variation-directory preference is destination guidance, not write approval
 - session entries only after explicit persistence consent; entries persist to JSONL even when excluded from model context
+- one company/role per Pi session; application IDs scope vacancy/result state and `/new` prevents prior company prompts from remaining in the next application conversation
 - original resumes only for deterministic analyze/match
 - assisted variants remain labeled and excluded from authoritative reranking
 - stable path/id tie-breaking; any close-cluster label is a UI heuristic, not a Core result
 - cancellation aborts the active child and stops remaining batch work
-- no full-result export unless a separate bounded local-file workflow is designed and tested
+- complete slash-command Core results remain transiently inspectable through a read-only pager; managed full results/exact review inputs remain only in a 16-entry/64-MiB ephemeral registry, and no full JSON is added to session state or written to a file
+- searchable PDF text extraction is local and isolated with fixed byte/page/time/memory/result ceilings; OCR and document rewriting remain out of scope
+- workbench prompts keep originals immutable, omit absolute source paths, treat document text as untrusted data, rerun complete deterministic baselines after submission, and require Career Core review of external suggestions, replacements, and variant changes
+- workbench prompts may include a privacy-reduced preferred variation-directory display path from setup; the selected agent recommends it first only after a separate user request and receives no automatic write authority
+- review proposals use verbatim source targets and in-range evidence, prefer single-line targets, make one review attempt, and surface discard codes instead of model-led repair/retry loops
+- raw tool JSON remains authoritative; managed projections refer to complete authoritative in-memory results by handle, while prose hydrates only requested evidence and retained items
+- PDF workbench output is suggestion-only because extracted text cannot expose or preserve visual layout; Markdown/text prompts require existing structure and unchanged wording to remain intact
+- no full-result file export unless a separate bounded local-file workflow is designed and tested
+
+The approved workflow specification fixes command behavior, persistence format, non-TUI behavior, bounded UI, and cancellation ownership. Print/JSON modes fail closed except for the pure `/career-vacancy clear` state action. Company/role isolation and future opt-in artifact persistence follow the separate [`application-workspaces.md`](application-workspaces.md) contract.
+
+## Assisted handoff and later materialization
 
-The approved workflow specification fixes command behavior, persistence format, non-TUI behavior, bounded UI, and cancellation ownership. Print/JSON modes fail closed except for the pure `/career-vacancy clear` state action.
+The current workbench prepares private context in Pi's editor only. It does not call a model, hide the source payload, or write a document. Submitting is the user's separate provider action. The prompt directs the selected Pi agent to start with `career_run context`, use internal exact Phase 8 contract discovery, rerun and preserve complete deterministic baselines behind ephemeral handles, and pass external suggestions, replacements, or variant changes through the corresponding Career Core review before presenting them. The question-led rewrite mode reviews first, asks one bounded batch of user-verifiable factual questions, and waits for a later turn before drafting or reviewing exact replacements.
 
-## Later phase: assisted workflows
+For a non-PDF vacancy-specific variant, the first assisted turn must stop after review and ask the user to explicitly select Core-assigned canonical change IDs. Only a later turn may invoke deterministic materialization with exactly those selected IDs. The result remains assisted/non-authoritative and cannot enter authoritative analysis or matching. PDF workbenches stop after reviewed targeted changes for manual application and never materialize extracted text as a styled resume.
 
-Model-assisted tailoring or suggestion review is intentionally deferred. A future phase may use the currently selected Pi model only after separate provider consent, validate one bounded schema-driven proposal, pass it through Career Core review/materialization, and save a new immutable assisted file. It must not add provider fallback, automatic repair/retry, overwrite originals, auto-apply changes, or feed assisted output back into authoritative analysis/matching.
+Automatic variant saving remains deferred. Setup now records or derives only a preferred destination suggestion: an explicit override wins, otherwise `variants/` under the selected original's configured root is recommended. It creates no directory or file. A future phase may save a newly materialized immutable assisted file only after separate local-file approval. It must not add provider fallback, automatic repair/retry, overwrite originals, auto-apply changes, or feed assisted output back into authoritative analysis/matching.
 
 ## Non-goals in this phase
 
-- provider/model-assisted commands or full-screen UI
-- PDF/DOCX/OCR/URL ingestion
-- model/provider integration
+- package-initiated provider/model clients, credentials, automatic prompt submission, or full-screen UI
+- DOCX/OCR/URL ingestion; image-only PDFs require external OCR or export
 - source-document or full-Core-result persistence outside the approved config/custom-entry workflow
 - source document mutation
-- publication, release downloads, signing, or notarization
-- expanded runtime platform claims beyond `darwin-arm64` and `linux-x64-gnu`
+- career-document publication/export, release-asset downloads, signing, or notarization
+- package-owned native binaries or platform claims beyond the exact reviewed `@revazi/career@0.1.1` catalog

package/docs/releasing.md

@@ -1,79 +1,90 @@
 # Release process
 
-This document records the bounded `v0.1.0` release process and evidence requirements.
+This document defines the bounded trusted-publishing release process for `pi-career@0.2.0` and records the historical `v0.1.0` outcome.
 
-## Approved channel boundary
+## Release boundary
 
-After every gate below is closed, the authorized channels are:
+The coordinated `v0.2.0` release may create exactly:
 
-1. one public `pi-career@0.1.0` npm package;
-2. one annotated, unsigned `v0.1.0` Git tag pointing to the exact published commit; and
-3. one GitHub Release containing notes derived from the finalized `CHANGELOG.md` entry.
+1. one public `pi-career@0.2.0` npm package on `https://registry.npmjs.org/`;
+2. one annotated, unsigned `v0.2.0` Git tag pointing to the exact published commit; and
+3. one GitHub Release for that tag with notes derived from the finalized [`CHANGELOG.md`](../CHANGELOG.md) entry.
 
-The npm package contains the strict allowlisted artifact tested by `npm run check:package`, including both unsigned native binaries. The project will not publish to crates.io, attach the npm tarball or native binary as a custom GitHub Release asset, add lifecycle/publication scripts, or claim signing/notarization. GitHub automatically generated source archives contain the complete tracked tree and are not substitutes for the tested npm artifact.
+The npm package must be the native-free allowlisted artifact verified by `npm run check:package`. It contains the Pi extension, generated PDF worker, Agent Skill, and documentation. It must contain no `runtime/`, native executable, `node_modules`, Pi peer package contents, production dependency tree, lifecycle download/build hook, or publication script.
 
-The exact npm version and reviewed full commit SHA are the canonical installation and audit coordinates. The GitHub Release notes must state that SHA and the npm package's registry integrity. A tag is a discovery label, not a substitute for immutable commit review, and README Git installation instructions must continue to use a full SHA.
+Career Core distribution remains external. The candidate pins exact [`@revazi/career@0.1.1`](https://www.npmjs.com/package/@revazi/career/v/0.1.1); its reviewed launcher owns native target/libc, package metadata, provenance, Unix mode or Windows file invariant, size, format, architecture, and SHA-256 verification. Pi-career must not copy those algorithms or artifacts.
 
-There is no automated publication workflow. Release execution is manual; sole maintainer Revaz Zakalashvili explicitly authorized the coordinated `v0.1.0` npm publication, tag, and GitHub Release after the candidate gates.
+The reviewed external release is bound to Career Core commit/tag `0318b3b0993ee23093c8f023757fa7e4d8b3b8e0`/`v0.1.1` and successful protected publication run [`31346152236`](https://github.com/revazi/career-core/actions/runs/31346152236). The launcher registry integrity is `sha512-K2WojK0wbuMt4WWT87jrLUiRWLwlDeYR0BcSTqlaTGc0SNw4z7VWkSe7utFwH2MFhHaIE1iHWfpsj+nNlHklvQ==`; registry metadata reports SLSA v1 provenance for the launcher and all eight lockstep native packages.
 
-## Blocking gates
+The sole permitted automated publication path is the tag-triggered `.github/workflows/release.yml` workflow using npm Trusted Publishing through GitHub OIDC and the protected `npm` environment. It must use no `NPM_TOKEN`, `NODE_AUTH_TOKEN`, OTP, or other long-lived publication credential. Preparation, CI success, a version bump, workflow availability, or this document does **not** authorize tag creation/push, npm publication, or a GitHub Release; release execution remains a separate explicit maintainer action. Do not publish to crates.io, attach an npm tarball/native binary as a custom GitHub Release asset, add signing/notarization claims, or add lifecycle/publication scripts.
 
-Every item in this section blocks the npm publication, tag, and GitHub Release. A skipped, unknown, or merely planned result is not a pass.
+The exact npm version and full published commit SHA are the canonical installation and audit coordinates. The GitHub Release notes must state that SHA and the npm registry integrity. A tag is a discovery label, not a substitute for immutable commit review.
 
-### 1. Freeze and review the exact candidate
-
-- Start from synchronized public `main` and identify one full candidate SHA.
-- Ensure the candidate contains no private career content, credentials, sessions, provider output, generated local paths, or unreviewed runtime bytes.
-- Review the complete diff and confirm `package.json` remains `0.1.0`, explicitly public only at `https://registry.npmjs.org/`, peer-only at runtime, and free of lifecycle/publication scripts.
-- Confirm `src/`, `dist/index.js`, runtime manifest/provenance, package contents, supported targets, and the exact three native tools remain aligned.
-- Do not move the candidate after its local and hosted evidence is recorded. Any content change creates a new candidate and requires the gate again.
-
-### 2. Human native-license review
+## Historical `v0.1.0` outcome
 
-[`native-dependency-inventory.md`](native-dependency-inventory.md) records the exact 30-package normal/build Cargo graph, selected MIT texts for all 28 crates.io packages, the two Career Core workspace packages, Rust 1.97.1 Standard Library evidence, Unicode-3.0 requirement, target dynamic imports, and the Swift/UniFFI exclusion. `npm run check:native-licenses` enforces every packaged license/notice hash, inventory coordinate, target, provenance compiler version, and file boundary. This is evidence, not legal advice, an SPDX/CycloneDX SBOM, or an automated approval.
+Release execution completed on 2026-08-06:
 
-Before publication, a human reviewer must:
+- npm: [`pi-career@0.1.0`](https://www.npmjs.com/package/pi-career/v/0.1.0)
+- commit: `967da62503bc8a97c070946f6506ea3471baeb34`
+- annotated unsigned tag: [`v0.1.0`](https://github.com/revazi/pi-career/releases/tag/v0.1.0)
+- npm integrity: `sha512-mmbDdWDyWz77f2uLzZECJT9E6w1ZRCJjYFrUnZd3ldoS6ehEa5DrCENIfavHR5xMOFi0of6AVQ35ZTxwpeDeAQ==`
+- npm shasum: `4212cea50c08c98771df267361cee28070a15765`
+- custom GitHub Release assets: none
 
-- verify the inventory against Career Core commit `a3cdb4c6d7f966397e93ea4664071975bca7228c`, Cargo.lock SHA-256 `18d188cfea79128d4024dabe2e21f57e5d2098d32ffac8c4ef01243f49abb609`, and both per-target provenance records;
-- confirm the documented MIT selections, exact grouped upstream texts/copyright notices, Rust Standard Library evidence, and Unicode License V3 payload satisfy the package-owned obligations for both native binaries;
-- confirm the host-supplied dynamic-library boundary and that excluded Fuchsia/Swift/UniFFI dependencies are not part of either distributed target; and
-- record an explicit approve/block decision without presenting the inventory as legal advice.
+That release bundled native Career Core artifacts. Its dependency/license/provenance evidence remains historical in [`native-dependency-inventory.md`](native-dependency-inventory.md) and [`licenses/`](licenses/). None of those native files may re-enter the `v0.2.0` package.
 
-Independent review is preferred. When the project has only one maintainer, that sole maintainer may complete and record the review, but release notes must disclose that it was maintainer self-review rather than independent legal review. No npm publication, tag, or release may proceed while the human decision is absent or blocked. Any dependency, compiler, target, binary, provenance, or notice change invalidates the evidence and requires a fresh inventory and review.
+## `v0.2.0` release gates
 
-For `v0.1.0`, sole maintainer Revaz Zakalashvili reviewed the evidence above and recorded **APPROVED** for both packaged targets. This is a maintainer release decision, not independent review or legal advice.
+A skipped, unknown, stale, or merely planned result is not a pass.
 
-### 3. Upstream artifact-expiry decision
+### 1. Freeze and review the exact candidate
 
-The imported binaries and provenance remain tracked and hash-verified in this repository, but the original Career Core Actions artifacts were ephemeral:
+- Start from synchronized public `main` and identify one full candidate SHA.
+- Require a clean Git tree and no divergence from `origin/main`.
+- Confirm `package.json`, the root package-lock entries, the Skill metadata, package assertions, changelog, README, and release documentation all identify pi-career `0.2.0` where appropriate.
+- Keep Career Core and `@revazi/career` compatibility coordinates at exact `0.1.1`; do not confuse the adapter release version with the external runtime version.
+- Confirm `package.json` is explicitly public only at `https://registry.npmjs.org/`, has exactly four wildcard Pi peers, declares no production/optional/bundled dependency tree, and has no lifecycle/publication script.
+- Ensure the candidate contains no real resume, vacancy, credentials, Pi session, provider output, generated local path, npm token, or unreviewed executable.
+- Review the complete diff from `v0.1.0`, including authoritative `src/`, generated `dist/index.js`/`dist/pdf-worker.js`, `career_run`, all three exact raw tools, slash commands, external resolver, Skill, and package documentation.
+- Do not move the candidate after local/hosted evidence is recorded. Any content change creates a new candidate and requires the gates again.
 
-| Artifact ID | Target | GitHub-reported expiry |
-|---:|---|---|
-| `8910079991` | `darwin-arm64` | `2026-08-07T21:43:37Z` |
-| `8910084163` | `linux-x64-gnu` | `2026-08-07T21:43:47Z` |
+### 2. Review the external runtime boundary
 
-Before npm publication, a human must recheck artifact availability and explicitly decide whether the tracked binaries, per-target provenance, manifest, archive identities/hashes, and public Core commit are sufficient durable provenance after expiry. If they are not sufficient, release stays blocked pending a separately approved preservation plan. The release process does not download, copy, upload, recreate, or relabel either artifact.
+- Confirm the only acquisition coordinate remains exact `@revazi/career@0.1.1` from the canonical npm registry.
+- Confirm runtime order remains: absolute `CAREER_CLI_PATH`, PATH `career`, package-local exact launcher, then bounded exact-package acquisition unless `PI_OFFLINE=1`.
+- Confirm every caller-controlled route must pass the exact managed Core 0.1.1 operation catalog and required self-contained schema bundles before private stdin opens.
+- Confirm package-local/acquired routes delegate native target/libc/provenance/mode or Windows file invariant/size/format/architecture/SHA-256 verification to the reviewed launcher.
+- Confirm all nine exact npm packages remain version-lockstep, have canonical registry integrity and SLSA v1 provenance, and match the ordered v2 launcher catalog from reviewed Core commit `0318b3b0993ee23093c8f023757fa7e4d8b3b8e0`.
+- Run the exact-package integration test on the six hosted macOS/GNU Linux/musl Linux release targets. Updating the external package coordinate, native target list, launcher schema, or managed Core contract requires separate compatibility, provenance, audit, and package review before this gate can pass.
 
-For `v0.1.0`, sole maintainer Revaz Zakalashvili rechecked both artifacts on 2026-08-06 and recorded **SUFFICIENT**: the tracked binaries, per-target provenance, manifest, archive identities/hashes, public Core commit, and package verification are accepted as the durable evidence after upstream expiry.
+### 3. Require clean audits and strict package proof
 
-### 4. Clean production and full audits
+`npm run audit:production` and `npm run audit:full` must both report zero vulnerabilities at explicit `--audit-level=low`. No audit acceptance baseline is allowed.
 
-`npm run audit:production` must pass with zero package-owned production vulnerabilities and `npm run audit:full` must pass with zero vulnerabilities across the complete development/host-Pi tree, both at explicit `--audit-level=low`. The production audit omits development, optional, and peer trees because the tarball owns no runtime dependency tree; strict package checks separately prove there is no `node_modules` or Pi package content and that exactly four wildcard peers remain external.
+`npm run check:publish` must prove:
 
-Both audits invoke `process.execPath` plus the absolute npm CLI derived from the real Node installation, verify any inherited `npm_execpath`, remove omit/include/audit-level/`NODE_ENV` overrides, strictly parse bounded JSON, and reject duplicate decoded keys. `npm run check:publish` is the authoritative readiness gate but performs no publication. It is a direct Node orchestrator with no nested npm command and requires both clean audits plus extracted package/load/install proof. Pack uses the trusted absolute npm CLI; listing and extraction use verified root-owned absolute `/usr/bin/tar`, never PATH-selected tools.
+- both strict audits are clean;
+- trusted npm is derived from the real Node installation and conflicting `npm_execpath` is rejected;
+- npm environment overrides and duplicate decoded JSON keys cannot weaken checks;
+- package listing/extraction uses verified absolute `/usr/bin/tar`;
+- the tarball matches the exact allowlist and size bounds;
+- no native runtime, `node_modules`, Pi peer contents, production dependency tree, or lifecycle/publication script is present;
+- extracted package loading, stable offline failure, and isolated Pi install/list/remove behavior pass.
 
-The former temporary development/host-Pi acceptance was explicitly retired after upgrading the Pi development baseline to `0.84.0`; no accepted-audit file or validator remains. Do not use `npm audit fix --force`, downgrade the Pi baseline, override or patch the published Pi shrinkwrap, hand-edit lock entries, or add a replacement acceptance. A future finding blocks publication until remediated.
+Do not use `npm audit fix --force`, downgrade the Pi baseline, hand-edit third-party lock entries, or add an acceptance file. A future vulnerability blocks release until remediated.
 
-### 5. Complete verification on the frozen SHA
+### 4. Run complete verification on the frozen SHA
 
 Run with Node.js 22.19 or newer:
 
 ```bash
 npm ci
 npm run build
-git diff --exit-code -- dist/index.js
+git diff --exit-code -- dist/index.js dist/pdf-worker.js
+npm run bench:tokens
 npm run check
-npm run test:bundled-runtime
+npm run test:runtime-resolution
+npm run test:career-package
 npm run audit:production
 npm run audit:full
 npm run check:publish
@@ -86,37 +97,73 @@ git diff --check
 
 Requirements:
 
-- `npm run build` may reproduce tracked `dist/index.js`; it must not alter runtime artifacts. The immediate dist diff must pass.
-- All project/runtime/package/offline checks and both zero-vulnerability audits must pass, the runtime npm tree must remain empty, and `npm run check:publish` must pass.
-- Compatibility must execute against an explicitly reviewed fixture checkout; a skip is not release evidence.
-- No audit acceptance or not-clean full-audit claim is permitted.
-- The exact final SHA must then pass both required hosted native jobs: `darwin-arm64` on macOS arm64 and `linux-x64-gnu` on Linux x64 glibc.
+- The immediate dist diff after `npm run build` must pass; a later reproducibility test alone does not prove the candidate committed the generated output.
+- Token measurements must exactly reproduce the committed baseline and remain within budgets.
+- Exact-package acquisition must execute managed discovery plus representative synthetic resume/job operations.
+- Compatibility must run against an explicitly reviewed fixture checkout. A skip is not release evidence.
+- The production npm tree must remain empty apart from unmet external peers expected in the Pi host.
+- No command may create a repository tarball, native runtime, payload/result file, acceptance baseline, or publication side effect.
+
+### 5. Require hosted checks on the same SHA
+
+Main branch protection must require the strict, up-to-date `Adapter checks` context. That ordinary pull-request job proves the build, deterministic adapter tests, native-free package, offline loading/install, and diff checks without acquiring or executing the external Career package.
+
+The costly six-target matrix is not an automatic pull-request check. After freezing the final SHA on public `main`, manually dispatch `.github/workflows/external-career.yml` on that exact ref and require all six native GitHub checks:
+
+```bash
+gh workflow run external-career.yml --ref main
+```
+
+- `External Career package (darwin-arm64)`;
+- `External Career package (darwin-x64)`;
+- `External Career package (linux-x64-gnu)`;
+- `External Career package (linux-arm64-gnu)`;
+- `External Career package (linux-x64-musl)`;
+- `External Career package (linux-arm64-musl)`.
+
+Record the dispatched run's `headSha` and reject it unless it equals the frozen release SHA. The macOS arm64 and Linux x64 GNU jobs execute the complete release ladder, including immediate dist reproducibility, clean audits, native-free package proof, offline smokes, and diff checks. Every target job executes a native Node build, exact launcher acquisition, managed contracts, representative synthetic resume/job operations, runtime resolver checks, and offline package load. Dispatch this matrix for external package coordinate, launcher/platform catalog, runtime resolver, managed Core contract, and release reviews—not for unrelated ordinary pull requests.
+
+### 6. Finalize release-facing text
 
-### 6. Finalize notes only after all other gates pass
+Before release authorization:
 
-After every preceding gate passes, a separately committed finalization change must:
+- convert `CHANGELOG.md` candidate notes to the dated `0.2.0` entry;
+- ensure README installation uses exact `npm:pi-career@0.2.0` and clearly distinguishes historical v0.1.0;
+- state that pi-career packages no native runtime and identify exact external `@revazi/career@0.1.1` plus all eight supported targets;
+- state that both production and complete development/host-Pi audits are clean at the explicit low threshold;
+- keep all full commit SHA and npm integrity placeholders out of tracked files until those values exist; record them in the GitHub Release after publication.
 
-- convert the candidate notes to a dated `0.1.0` entry;
-- preserve unsigned/not-notarized runtime caveats and the two supported targets;
-- state that `pi-career@0.1.0` is the public npm package and that there is no crate publication or custom release asset; and
-- state that both the package-owned production audit and complete development/host-Pi audit are clean at the explicit low threshold.
+The finalization commit cannot contain its own SHA. Only the separately authorized final clean commit may be published and receive `v0.2.0`.
 
-A commit cannot contain its own Git SHA. After the finalization commit exists, record its full SHA in the GitHub Release notes and verify npm's `gitHead` against it. Only that separately authorized final commit may receive the annotated tag, npm publication, and GitHub Release.
+## Manual pre-publication checks
 
-## Manual release execution
+Run these only on the frozen clean candidate:
 
-After all blocking gates pass on the final clean commit and the maintainer has explicitly authorized execution:
+1. Confirm npm package `pi-career` has exactly the GitHub Actions trusted publisher `revazi/pi-career`, workflow `release.yml`, environment `npm`.
+2. Confirm the GitHub `npm` environment exists and applies the reviewed deployment protections. No npm token or OTP may be stored in GitHub, npm configuration, repository files, Pi messages, logs, or release notes.
+3. Confirm `npm view pi-career@0.2.0 version --json` reports no existing version. npm versions are immutable.
+4. Run trusted `npm pack --dry-run --json --ignore-scripts` or rely on the stricter recorded `check:publish` artifact proof.
+5. Record the candidate full SHA, package filename/size, clean audit results, hosted run URLs, and reviewed fixture SHA outside private content.
+6. Obtain explicit release authorization. Do not infer authorization from readiness work.
 
-1. Confirm `npm whoami` identifies the intended npm account and the registry is exactly `https://registry.npmjs.org/`. Never place an npm token or one-time password in repository files, Pi messages, logs, or release notes.
-2. Reconfirm that `npm view pi-career@0.1.0 version --json` returns not found. A registry name check does not reserve the name.
-3. Create and push the unsigned annotated `v0.1.0` tag for the exact final commit.
-4. From Node 22.19.0/npm 10.9.3, publish once with lifecycle scripts disabled:
+## Authorized release execution
 
-   ```bash
-   npm publish --access public --tag latest --ignore-scripts
-   ```
+Only after every gate passes and the maintainer explicitly authorizes release execution:
 
-5. Verify `npm view pi-career@0.1.0 --json` reports the expected version, repository, four peers, tarball integrity, and `gitHead`; then perform an isolated `pi install npm:pi-career@0.1.0`, package load, bundled-runtime smoke, and removal on a supported target.
-6. Create the GitHub Release from `v0.1.0`. State the full commit SHA, npm registry integrity, supported targets, unsigned/not-notarized binaries, no crate/custom assets, zero-vulnerability package-owned production and complete development/host-Pi audits at the explicit low threshold, and that native-license evidence received sole-maintainer self-review rather than independent legal review.
+1. Reconfirm the clean SHA, branch protection checks, trusted-publisher/environment configuration, canonical registry, and absence of `pi-career@0.2.0`.
+2. Create one annotated unsigned `v0.2.0` tag on the exact candidate and push only that tag. The tag is the immutable input that triggers `.github/workflows/release.yml`; the workflow must never create or move it.
+3. The workflow must verify the tag/version/changelog/SHA, install exact trusted-publishing-compatible npm tooling, run the complete package publication gate, and publish with lifecycle scripts disabled, public/latest coordinates, and npm provenance through OIDC.
+4. If publication returns an ambiguous response, query the registry before any rerun. Never move the tag, attempt to overwrite the version, or blindly republish.
+5. Before creating the GitHub Release, the workflow must verify registry metadata: version, repository, four wildcard peers, no dependency tree/lifecycle scripts, tarball integrity, shasum, provenance, and `gitHead` equal to the tagged candidate SHA.
+6. The workflow must create the GitHub Release from the existing `v0.2.0` tag with:
+   - full commit SHA;
+   - npm integrity and shasum;
+   - exact external `@revazi/career@0.1.1` coordinate;
+   - all eight reviewed macOS, GNU Linux, musl Linux, and MSVC Windows targets;
+   - native-free pi-career package statement;
+   - clean production/full audit statement;
+   - no crate publication, signing/notarization claim, or custom release asset.
+7. In an isolated Pi agent directory, install exact `npm:pi-career@0.2.0`, list/load it, exercise exact-package runtime acquisition with synthetic operations on a supported target, test offline failure, and remove it.
+8. Recheck the npm dist-tag, Git tag target, GitHub Release target, provenance, and main CI after all channels settle.
 
-Do not sign, attach assets, change repository settings, publish another registry tag/version, or retry after an ambiguous registry response without first querying the registry. npm versions are immutable; a failed post-publication check is an incident, not permission to overwrite `0.1.0`.
+Do not sign, attach assets, change repository visibility, add an alternate publication workflow or token-based path, publish another registry tag/version, or retry an ambiguous operation without first querying authoritative state. A failed post-publication check is an incident, not permission to replace `0.2.0`.

package/{runtime/LICENSE-MIT → docs/unpdf-LICENSE-MIT.txt}

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Revaz Zakalashvili
+Copyright (c) 2023-PRESENT Johann Schopplich
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "pi-career",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
-  "description": "Self-contained Pi tools, slash commands, and Agent Skill for deterministic Career Core workflows",
+  "description": "Pi tools, slash commands, and Agent Skill for deterministic Career Core workflows",
   "license": "MIT OR Apache-2.0",
   "author": {
     "name": "Revaz Zakalashvili",
@@ -26,7 +26,6 @@
   "files": [
     "dist",
     "docs",
-    "runtime",
     "skills",
     "CHANGELOG.md",
     "SECURITY.md",
@@ -43,13 +42,12 @@
     "test:runtime": "node --import tsx --test tests/runtime/runtime.test.mjs",
     "test:workflow": "node --import tsx --test tests/workflow/*.test.mjs",
     "test:audit": "node --test tests/audit/*.test.mjs",
-    "test:bundled-runtime": "node scripts/test-bundled-runtime.mjs",
+    "test:runtime-resolution": "node --import tsx --test tests/runtime/runtime.test.mjs",
+    "test:career-package": "node scripts/test-career-package.mjs",
     "test:pi-smoke": "node scripts/test-pi-package-load.mjs",
     "test:install": "node scripts/test-isolated-install.mjs",
-    "test:compat": "node scripts/test-bundled-runtime-compat.mjs",
+    "test:compat": "node scripts/test-career-package-compat.mjs",
     "check:dist": "node scripts/check-dist.mjs",
-    "check:runtime-artifacts": "node scripts/check-runtime-artifacts.mjs",
-    "check:native-licenses": "node scripts/check-native-license-inventory.mjs",
     "check:package": "node scripts/check-package.mjs",
     "check:publish": "node scripts/check-publish.mjs",
     "check:links": "node scripts/check-links.mjs",
@@ -57,8 +55,9 @@
     "check:runtime": "node scripts/check-runtime-boundary.mjs",
     "audit:production": "node scripts/audit-production.mjs",
     "audit:full": "node scripts/audit-full.mjs",
+    "bench:tokens": "node --import tsx scripts/token-benchmark.mjs",
     "check:syntax": "node --check scripts/*.mjs scripts/lib/*.mjs tests/audit/*.mjs tests/process/*.mjs tests/runtime/*.mjs tests/workflow/*.mjs",
-    "check": "npm run typecheck && npm run check:dist && npm run check:runtime-artifacts && npm run check:native-licenses && npm test && npm run check:runtime && npm run check:links && npm run check:secrets && npm run check:syntax"
+    "check": "npm run typecheck && npm run check:dist && npm test && npm run check:runtime && npm run check:links && npm run check:secrets && npm run check:syntax"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",
@@ -72,9 +71,11 @@
     "@earendil-works/pi-tui": "0.84.0",
     "@types/node": "24.12.4",
     "esbuild": "0.28.1",
+    "js-tiktoken": "1.0.21",
     "tsx": "4.23.5",
     "typebox": "1.3.7",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "unpdf": "1.8.0"
   },
   "publishConfig": {
     "access": "public",