pi-career 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## Unreleased
+
+## 0.3.0 - 2026-08-14
+
+### Breaking
+
+- Removed Windows support. Package metadata now permits installation only on macOS/Linux, and direct local/Git extension initialization registers no command/tool and fails with stable payload-free `unsupported_platform` guidance before runtime route work, acquisition, compatibility probing, or private stdin.
+
+### Changed
+
+- Updated the exact external runtime and managed compatibility boundary to `@revazi/career@0.2.0` / Core 0.2.0 after reviewing the six-target package, registry integrity, SLSA provenance, and unchanged v1 operation/schema semantics. Pi-career validates the exact ordered six-package v2 launcher manifest while delegating native selection and integrity algorithms to the launcher.
+- Decoupled immutable `7ed36c4…` after-study evidence from later source: frozen bytes/trees/deltas remain exact, while current measurements may improve only with unchanged shape/invariants/budgets and no workflow regression relative to that snapshot.
+- Consolidated the model-visible Career Skill while preserving safety invariants and avoiding workflow regressions; the frozen before/after evidence records an aggregate reduction from 25,652 to 21,552 workflow tokens (15.98%).
+- Added a Git-history/source-tree/hash-bound before/optimizing/after token-optimization benchmark phase with Pi Skill discovery/full-load context, actual managed serialization parity, direct tool-call/result/detail/editor surfaces, and independent workflows; semantic/privacy gates prevent savings by dropping required context.
+- Added user-only TUI/RPC `/career-save` for exact preview and separately confirmed no-clobber saving of current Markdown/text materializations on supported macOS/Linux systems, with private managed-directory markers, strict assisted/non-authoritative v2 sidecars, in-memory idempotency, and immediate exclusion-verifying rescan; PDF saves fail closed.
+- Changed assisted-sidecar scanning to quarantine malformed, missing-in-managed-root, duplicate-key, edited, or hash-mismatched artifacts instead of allowing fallback to original analysis/matching eligibility.
+- Expanded the frozen synthetic token benchmark across managed match, suggestion/replacement review, materialization, and evidence/change/document detail hydration outputs, all under explicit common-output budgets.
+- Added mocked release-automation regressions for checked-in hosted-gate invocation, bounded registry propagation, exact npm publish/SLSA attestation formats, fail-closed responses, and publication-to-release ordering.
+- Generalized the trusted-publishing checklist and recorded immutable `v0.2.0` coordinates, incident boundaries, and no-blind-rerun recovery guidance.
+- Expanded synthetic PDF compatibility coverage with pinned Chromium 150 tagged/untagged fixtures, an embedded OFL-licensed Lato subset, a CSS multi-column layout, and fail-closed image-only/malformed/oversized inputs without OCR.
+- Added a reproducible two-page ReportLab 4.4.10 searchable-PDF fixture with pinned generator-wheel provenance, exact extracted text, compressed content, and an embedded Lato subset.
+- Added turn-terminating non-PDF variant review and a bounded TUI `/career-review` flow that requires warning/discard acknowledgment, exact per-change inspection, explicit inclusion, and a later handle/ID-only editor handoff; PDF handles fail closed before selection or materialization.
+- Added a final paged cross-change review and separate prepare choice before `/career-review` can place selected canonical IDs in the editor, with a back path that preserves the in-memory selection for revision.
+- Replaced the final selected-change JSON object with compact labeled records that keep exact IDs, sections, line bounds, before/after text, and both evidence sets visible.
+- Added constant-state final-review navigation that can reopen any selected exact record directly before the separate prepare-or-back decision.
+
 ## 0.2.0 - 2026-08-10
 
 ### Added
@@ -16,8 +42,8 @@
 ### Changed
 
 - Replaced package-owned native artifacts with a local-first external resolver: bounded absolute `CAREER_CLI_PATH`, PATH `career`, package-local `@revazi/career`, then bounded acquisition of exact `@revazi/career@0.1.1` unless `PI_OFFLINE=1`.
-- Expanded the reviewed external runtime matrix to ARM64/x64 macOS, GNU and musl Linux, and MSVC Windows through the exact eight-target `@revazi/career@0.1.1` launcher. Windows acquisition derives npm and its command shell from validated real installation/system paths, executes no PATH-selected shim, and cancels the detached npm process group.
-- Exact managed Core 0.1.1 operation-catalog/schema-bundle compatibility now completes before private stdin opens. The reviewed Career package launcher owns native target/libc/provenance/mode or Windows file invariant/size/format/SHA-256 verification; pi-career caches routes only in memory and never retries an already-started operation on another route.
+- Expanded the reviewed external-runtime acquisition boundary through exact `@revazi/career@0.1.1`, deriving npm and its command shell from validated real installation/system paths, executing no PATH-selected shim, and cancelling the detached npm process group.
+- Exact managed Core 0.1.1 operation-catalog/schema-bundle compatibility now completes before private stdin opens. The reviewed Career package launcher owns native target/libc/provenance/mode/size/format/SHA-256 verification; pi-career caches routes only in memory and never retries an already-started operation on another route.
 - Removed `runtime/` from source/package artifacts and replaced bundled-runtime/package checks with runtime-resolution, exact Career package, offline failure, and native-free tarball coverage.
 - Workbench prompts now use `career_run` handles and native proposal payloads rather than model-visible schema discovery and manually reconstructed Core envelopes.
 - Setup and library flows now rescan immediately, display indexed PDFs and actionable scan notices, and explain the searchable PDF/Markdown/text success path instead of silently showing an empty library.

package/NOTICE

@@ -11,7 +11,7 @@ LICENSE-APACHE.
 pi-career packages no native Career Core binary. Runtime distribution,
 platform provenance, native integrity verification, and native third-party
 notices belong to the separately installed or acquired exact
-@revazi/career@0.1.1 distribution. Historical evidence for the native binaries
+@revazi/career@0.2.0 distribution. Historical evidence for the native binaries
 bundled by pi-career v0.1.0 remains in docs/native-dependency-inventory.md and
 docs/releasing.md but is not part of the current runtime boundary.
 

package/README.md

@@ -7,33 +7,36 @@
 
 `pi-career` is a [Pi package](https://github.com/earendil-works/pi) for deterministic resume analysis and conservative vacancy matching, with an optional model-assisted workflow for reviewed resume improvements.
 
-The package's command handlers do not call a model/provider. `/career-workbench` instead prepares a visible private prompt in Pi's editor; only the user's later submission invokes the selected Pi model/provider. At runtime, pi-career never uses a Career Core source checkout or Cargo build. Its optional maintainer compatibility test may read an explicitly supplied, reviewed Core fixture checkout.
+The package's command handlers do not call a model/provider. `/career-workbench` prepares a visible private prompt in Pi's editor, while `/career-review` prepares only an ephemeral review handle and explicitly selected canonical IDs; only the user's later submission invokes the selected Pi model/provider. At runtime, pi-career never uses a Career Core source checkout or Cargo build. Its optional maintainer compatibility test may read an explicitly supplied, reviewed Core fixture checkout.
 
 It gives you:
 
 - local slash commands for setting up a resume library, analyzing originals, and matching them to a vacancy;
 - one compact managed agent tool, `career_run`, for guided work after the deterministic baseline;
 - a visible workbench handoff that never sends private resume text until you review and submit it yourself;
+- bounded TUI inspection and explicit selection of Core-reviewed non-PDF changes without automatic materialization;
 - a bounded resolver for a compatible external Career Core runtime;
 - no bundled native binary, telemetry, vacancy URL fetching, automatic document overwrite, or hidden provider call.
 
 Career Core remains authoritative for scores, evidence, warnings, uncertainty, matching, and proposal review. `pi-career` owns the Pi workflow and presentation layer; it does not reimplement Career Core algorithms or schemas.
 
-> **Version note:** this README describes `pi-career@0.2.0`. Published `pi-career@0.1.0` is the historical bundled-runtime release. If `0.2.0` is not yet visible on the npm registry, use a reviewed local checkout or pinned Git commit.
+> **Version note:** this README describes the `pi-career@0.3.0` candidate. Published `pi-career@0.2.0` is the prior native-free release, and `pi-career@0.1.0` is the historical bundled-runtime release. Until `0.3.0` is explicitly released and visible on the npm registry, use a reviewed local checkout or pinned Git commit.
 
 ## Requirements
 
 - Node.js 22.19 or newer
 - Pi with 0.84.0-compatible package APIs
-- a reviewed ARM64/x64 target: macOS, GNU/Linux with glibc 2.35+, musl Linux, or MSVC Windows
-- either a compatible local `career` executable or network access for first-use acquisition of exact `@revazi/career@0.1.1`
+- macOS or Linux on ARM64/x64; GNU Linux requires glibc 2.35+, and musl Linux is supported
+- either a compatible local `career` executable or network access for first-use acquisition of exact `@revazi/career@0.2.0`
+
+Windows is unsupported. npm enforces the package `os` allowlist; for a local or Git registration, extension initialization fails with stable `unsupported_platform` guidance before registering any command or tool, inspecting `CAREER_CLI_PATH`, searching `PATH`, validating package routes, acquiring npm content, or opening private stdin.
 
 ## Install
 
 After the registry confirms the release, install the exact version:
 
 ```bash
-pi install npm:pi-career@0.2.0
+pi install npm:pi-career@0.3.0
 pi list
 ```
 
@@ -45,13 +48,6 @@ pi install "$(pwd -P)"
 pi list
 ```
 
-On Windows PowerShell, register the same clean checkout with:
-
-```powershell
-pi install (Resolve-Path .).Path
-pi list
-```
-
 Local-path installation loads the checkout in place. After a reviewed update, restart Pi or run `/reload`.
 
 To pin a reviewed Git commit instead:
@@ -108,15 +104,21 @@ flowchart TD
     T -->|Tailor to vacancy| X["Analyze and match the original<br/>Career Core reviews variant changes once"]
     X --> Y{"Original format"}
     Y -->|PDF| AA["Return targeted manual changes only"]
-    Y -->|Markdown/text| AB["Later turn: user selects retained change IDs"]
-    AB --> AC["career_run materialize<br/>assisted text; still not saved"]
+    Y -->|Markdown/text| AB["career_run ends the review turn"]
+    AB --> AD["/career-review<br/>inspect notices and exact changes<br/>all IDs start excluded"]
+    AD --> AE{"Review and submit selected IDs?"}
+    AE -->|No| Z
+    AE -->|Yes| AC["Later turn: career_run materialize<br/>assisted text remains in memory"]
+    AC --> AF{"Save this local variant?"}
+    AF -->|No| Z
+    AF -->|Yes| AG["/career-save<br/>review exact files and destination<br/>then confirm separately"]
 
     N --> Z["Original remains unchanged<br/>assisted output is non-authoritative<br/>and is never reranked as an original"]
     Q --> Z
     U --> Z
     W --> Z
     AA --> Z
-    AC --> Z
+    AG --> Z
 ```
 
 ### 1. Start with a transient Pi session
@@ -208,11 +210,11 @@ Choose an original and a guided mode. The command prepares a private prompt in P
 
 After you submit, the selected Pi agent uses `career_run` to rerun complete deterministic baselines and Core-review any proposed suggestions, replacements, or vacancy-specific changes. The original remains immutable.
 
-For a non-PDF tailored variation, the agent must stop after review and ask you to select retained change IDs. Materialization can happen only in a later turn with exactly those IDs. For PDFs, the workbench returns targeted manual changes only because extracted text cannot preserve typography, columns, spacing, or graphics.
+For a non-PDF tailored variation, `career_run variant-review` ends the agent turn. Run `/career-review <review-handle>` to inspect every warning/discard and each exact before/after/evidence record; all retained changes start excluded. Explicitly include the IDs you want, review those selected changes together, and separately confirm the handle/ID-only editor handoff before submitting it as a later turn. The selector never materializes or submits automatically. After successful materialization, you may separately run `/career-save <variant-handle>` to inspect the complete local file plan and confirm it; the model cannot invoke saving. For PDFs, the workbench returns targeted manual changes only because extracted text cannot preserve typography, columns, spacing, or graphics; PDF review handles cannot enter selection, materialization, or saving.
 
 ## Slash command reference
 
-The workflow commands below require interactive TUI/RPC mode except `/career-vacancy clear`; `/career-tools` is a lightweight tool-surface switch. Slash-command handlers do not invoke a model/provider. `/career-workbench` prepares an editor prompt whose later user submission does. Core-backed commands may resolve or acquire the external runtime before processing private input.
+The workflow commands below require interactive TUI/RPC mode except `/career-vacancy clear`; `/career-review` is TUI-only, `/career-save` supports TUI/RPC, and `/career-tools` is a lightweight tool-surface switch. Slash-command handlers do not invoke a model/provider. `/career-workbench` and `/career-review` prepare editor prompts whose later user submission does. Core-backed commands may resolve or acquire the external runtime before processing private input.
 
 ### `/career-setup [status]`
 
@@ -322,7 +324,40 @@ The optional resume filter behaves like `/career-analyze`. Available modes are:
 
 The command itself calls neither Career Core nor a provider. It puts the complete selected resume—and the vacancy only for tailoring—into Pi's editor. Nothing is sent until you submit. Submitting may persist that message and send it to the provider selected in Pi.
 
-`pi-career` currently does not save the resulting variation to disk.
+The workbench and model never save automatically. Only a later successful non-PDF materialization can be passed by the user to `/career-save` for separate exact local preview and confirmation.
+
+### `/career-review <review-handle>`
+
+Review and explicitly select retained changes from a current non-PDF `career_run variant-review` result. This command is available only in TUI mode and only while the ephemeral review handle remains in the current process/session branch.
+
+The bounded selector:
+
+- requires inspection/acknowledgment of all Core warnings and discarded-change reasons;
+- shows every canonical change as excluded by default;
+- opens a paged exact view of its before text, proposed after text, line bounds, resume evidence, and vacancy evidence;
+- includes a change only after you toggle it from that exact view;
+- requires at least one included canonical ID before continuing;
+- pages all selected exact changes together in a compact labeled view, lets you reopen any selected record directly, and requires a separate final prepare choice with a back option for revisions.
+
+Only that final prepare choice creates a short editor message containing the review handle and selected IDs. It does not invoke Career Core, materialize a result, contact a provider, append selection state to the Pi session, save a result, or write a file. Review and submit that editor message manually to start the later materialization turn. Escape cancels without preparing anything.
+
+PDF review changes remain manual-application guidance and are rejected by `/career-review`, `career_run materialize`, and `/career-save`.
+
+### `/career-save <variant-handle>`
+
+Save one current successful Markdown/text `career_run materialize` result as a new assisted local variant. This user-only command is not a model tool and is available in TUI/RPC mode on supported POSIX systems.
+
+Before writing anything, it:
+
+1. revalidates the ephemeral variant and unchanged original;
+2. derives an eligible direct-child managed variants directory;
+3. opens a complete canonical preview containing exact destination paths, artifact/sidecar bytes, hashes, and any directory marker;
+4. requires the preview to be returned byte-identically;
+5. asks for a separate final confirmation.
+
+It then publishes new `0600` files in a `0700` managed directory without replacing existing paths, writes a strict assisted/non-authoritative sidecar, and rescans before reporting success. Missing, malformed, edited, or hash-mismatched assisted metadata is quarantined and never falls back to original eligibility. Saving invokes no Career Core operation, provider, model, network request, or session entry. PDF handles fail closed; the save workflow is supported on pi-career's macOS/Linux platforms with its POSIX-private filesystem contract.
+
+Saved files are not securely erased by session deletion, root removal, package removal, or `PI_OFFLINE=1`. Pi-career never automatically overwrites, updates, moves, or deletes them.
 
 ### `/career-tools [managed|raw|status]`
 
@@ -342,7 +377,9 @@ Normal users do not need to call raw JSON tools. The package's Agent Skill instr
 2. `analyze` and `match` return compact projections backed by complete in-memory Core results;
 3. suggestion, replacement, and variant proposals must pass the corresponding Core review command;
 4. `detail` hydrates only the requested evidence, warning, check, change, document, or raw section;
-5. `materialize` requires a prior variant-review handle and explicit user-selected retained IDs.
+5. non-PDF `variant-review` ends its turn so `/career-review` can collect an explicit local selection and prepare a later user message;
+6. `materialize` requires that unchanged review handle and exactly the user-selected retained IDs;
+7. only the user may separately run `/career-save <variant-handle>` for unchanged preview and confirmation.
 
 Handles and complete results remain bounded in process memory and disappear on session/branch replacement, reload, or shutdown. They are not result files and cannot be reconstructed safely from chat text.
 
@@ -360,14 +397,14 @@ When raw mode is explicitly enabled, discovery-first use remains mandatory: capa
 
 1. absolute `CAREER_CLI_PATH`;
 2. `career` on `PATH`;
-3. package-local exact `@revazi/career@0.1.1`;
-4. bounded acquisition of exact `@revazi/career@0.1.1` from the canonical npm registry.
+3. package-local exact `@revazi/career@0.2.0`;
+4. bounded acquisition of exact `@revazi/career@0.2.0` from the canonical npm registry.
 
-Runtime installation is separate from loading the local Pi package. `/career-setup`, `/career-library`, `/career-application`, and `/career-workbench` do not need Core. `/career-vacancy`, `/career-analyze`, `/career-match`, `career_run`, and the raw tools do.
+Runtime installation is separate from loading the local Pi package. `/career-setup`, `/career-library`, `/career-application`, `/career-workbench`, and `/career-review` itself do not resolve or invoke Core; `/career-review` requires a still-live review produced earlier by `career_run`. `/career-vacancy`, `/career-analyze`, `/career-match`, `career_run`, and the raw tools do need Core.
 
-Before private document stdin opens, the selected executable must pass the exact managed Career Core 0.1.1 operation and schema compatibility checks. An invalid explicit `CAREER_CLI_PATH` fails without fallback. On Windows, the PATH route remains direct-argv-only and selects a native `career.exe`; npm command shims are not executed through a caller-selected shell.
+Extension initialization requires macOS or Linux and fails unsupported platforms with one payload-free `unsupported_platform` error before registering any command/tool or doing route work. Before private document stdin opens on a supported platform, the selected executable must pass the exact managed Career Core 0.2.0 operation and schema compatibility checks. An invalid explicit `CAREER_CLI_PATH` fails without fallback.
 
-The exact launcher target matrix is:
+The pi-career runtime target matrix is:
 
 | Operating system | Architecture | Runtime target | Requirement |
 | --- | --- | --- | --- |
@@ -377,10 +414,8 @@ The exact launcher target matrix is:
 | GNU/Linux | ARM64 | `linux-arm64-gnu` | glibc 2.35+ |
 | musl Linux | x64 | `linux-x64-musl` | detected musl runtime |
 | musl Linux | ARM64 | `linux-arm64-musl` | detected musl runtime |
-| Windows | x64 | `win32-x64-msvc` | native MSVC Windows |
-| Windows | ARM64 | `win32-arm64-msvc` | native MSVC Windows |
 
-The platform-specific optional packages are internal launcher details; install or acquire only exact `@revazi/career@0.1.1`.
+The platform-specific optional packages are internal launcher details; install or acquire only exact `@revazi/career@0.2.0`. Pi-career validates the launcher's exact ordered six-package v2 manifest and lockstep versions before direct execution, while the launcher remains authoritative for native selection and integrity. Windows remains unsupported.
 
 To prohibit acquisition:
 
@@ -388,13 +423,6 @@ To prohibit acquisition:
 PI_OFFLINE=1 pi --no-session
 ```
 
-On Windows PowerShell:
-
-```powershell
-$env:PI_OFFLINE = "1"
-pi --no-session
-```
-
 Offline Core-backed use then requires a compatible `CAREER_CLI_PATH`, `career` on `PATH`, or package-local launcher. Acquisition receives no resume or vacancy input, but it may leave ordinary npm cache or `_npx` data; this is not secure erasure.
 
 ## Privacy and persistence
@@ -405,10 +433,11 @@ Possible persistence surfaces are distinct:
 
 - **Package config:** canonical resume-root paths, bounded labels, and an optional variation-directory suggestion; never resume text, vacancy text, or full Core output.
 - **Pi session:** consent, application/vacancy workflow entries, bounded result cards, and potentially tool arguments/results or submitted workbench messages.
-- **Model provider:** only content you submit through ordinary Pi model interaction; `/career-workbench` makes the private payload visible before submission.
+- **Model provider:** only content you submit through ordinary Pi model interaction; `/career-workbench` makes the private payload visible before submission, while `/career-review` prepares only an ephemeral handle and selected canonical IDs.
+- **Approved local variant files:** exact assisted Markdown/text bytes plus bounded marker/sidecar metadata only after `/career-save` preview and confirmation; never full Core JSON.
 - **npm cache:** ordinary package-acquisition data, never private Career Core stdin.
 
-`pi-career` does not create payload/result temporary files, export full Core JSON, overwrite originals, or automatically save assisted resumes. Searchable PDF extraction is local, bounded, and network-disabled.
+`pi-career` does not create payload/result temporary files, export full Core JSON, overwrite originals, or automatically save assisted resumes. Explicit `/career-save` files are local, private-mode, assisted/non-authoritative, and excluded from analysis/matching. Searchable PDF extraction is local, bounded, and network-disabled.
 
 See [`SECURITY.md`](SECURITY.md), [`docs/design.md`](docs/design.md), and [`docs/product-flow.md`](docs/product-flow.md) for the complete boundary and threat model.
 
@@ -416,11 +445,11 @@ See [`SECURITY.md`](SECURITY.md), [`docs/design.md`](docs/design.md), and [`docs
 
 - Supported original formats: searchable PDF, Markdown, and UTF-8 text.
 - No OCR, DOCX/Pages editing, vacancy URL fetching, or PDF layout reconstruction.
-- No automatic resume or application-workspace saving.
+- No automatic resume or application-workspace saving; explicit materialized-variant saving is private Markdown/text only on supported macOS/Linux filesystems.
 - PDF workbench output is targeted manual guidance only.
 - Assisted variants remain non-authoritative and cannot be reranked as originals.
 - Matching is conservative workflow guidance, not a hiring prediction or proprietary ATS simulation.
-- Reviewed external native targets are `darwin-arm64`, `darwin-x64`, `linux-x64-gnu`, `linux-arm64-gnu`, `linux-x64-musl`, `linux-arm64-musl`, `win32-x64-msvc`, and `win32-arm64-msvc`.
+- Supported runtime targets are `darwin-arm64`, `darwin-x64`, `linux-x64-gnu`, `linux-arm64-gnu`, `linux-x64-musl`, and `linux-arm64-musl`; Windows is unsupported.
 
 The future application-workspace contract is documented in [`docs/application-workspaces.md`](docs/application-workspaces.md); those filesystem-writing phases are not implemented.
 
@@ -433,6 +462,7 @@ npm ci
 npm run build
 git diff --exit-code -- dist/index.js dist/pdf-worker.js
 npm run bench:tokens
+npm run bench:tokens:compare
 npm run check
 npm run test:runtime-resolution
 npm run test:career-package
@@ -445,6 +475,8 @@ npm run test:compat
 git diff --check
 ```
 
+`npm run bench:tokens` collects the current synthetic model-visible surfaces, including Pi's stable always-visible Skill name/description metadata and the complete on-demand `career-core` Skill for matching career tasks. Linked Skill references and machine-specific discovery paths stay outside that boundary. `npm run bench:tokens:compare` verifies the surface digest, immutable `c7d7634…` before and `7ed36c4…` after source/Skill trees and frozen bytes from Git history, exact frozen before/after deltas, managed serialization parity, semantic/privacy invariants, budgets, and no current workflow regression relative to the frozen after evidence. Later source may differ and improve without rewriting that historical snapshot. The finalized frozen evidence records 25,652 → 21,552 aggregate workflow tokens (15.98% reduction) with no workflow regression.
+
 `npm run test:career-package` is the network-capable exact-package integration test. `npm run test:compat` skips unless an explicitly reviewed fixture checkout is provided:
 
 ```bash
@@ -456,7 +488,7 @@ CAREER_CORE_FIXTURE_ROOT=/absolute/path/to/reviewed/career-core \
 
 ## Security and release provenance
 
-The exact reviewed external runtime coordinate is [`@revazi/career@0.1.1`](https://www.npmjs.com/package/@revazi/career/v/0.1.1), published from Career Core commit [`0318b3b0993ee23093c8f023757fa7e4d8b3b8e0`](https://github.com/revazi/career-core/tree/0318b3b0993ee23093c8f023757fa7e4d8b3b8e0). Its launcher owns native target/libc selection and package metadata, provenance, mode or Windows file invariant, size, format, and SHA-256 verification.
+The exact reviewed external runtime coordinate is [`@revazi/career@0.2.0`](https://www.npmjs.com/package/@revazi/career/v/0.2.0), published from Career Core commit [`536690632884c17336cc3c108f1bba0f254b862b`](https://github.com/revazi/career-core/tree/536690632884c17336cc3c108f1bba0f254b862b). Its launcher owns native target/libc selection and package metadata, provenance, file invariants, size, format, and SHA-256 verification. Registry integrity and SLSA v1 provenance were reviewed for the user-facing launcher and all six lockstep native packages. Pi-career validates that exact six-package v2 manifest and supports only its macOS/Linux targets.
 
 Historical published `pi-career` v0.1.0 coordinates are retained for verification:
 
@@ -465,7 +497,7 @@ Historical published `pi-career` v0.1.0 coordinates are retained for verificatio
 - npm integrity: `sha512-mmbDdWDyWz77f2uLzZECJT9E6w1ZRCJjYFrUnZd3ldoS6ehEa5DrCENIfavHR5xMOFi0of6AVQ35ZTxwpeDeAQ==`
 - GitHub Release: [`v0.1.0`](https://github.com/revazi/pi-career/releases/tag/v0.1.0)
 
-That historical release bundled native artifacts; `pi-career@0.2.0` does not. Historical evidence remains in [`docs/native-dependency-inventory.md`](docs/native-dependency-inventory.md), [`docs/releasing.md`](docs/releasing.md), and [`docs/licenses/`](docs/licenses/).
+That historical release bundled native artifacts; `pi-career@0.2.0` and later do not. Historical evidence remains in [`docs/native-dependency-inventory.md`](docs/native-dependency-inventory.md), [`docs/releasing.md`](docs/releasing.md), and [`docs/licenses/`](docs/licenses/).
 
 Use [Issues](https://github.com/revazi/pi-career/issues) only for sanitized bugs and scoped feature requests. Follow [`SECURITY.md`](SECURITY.md) for private vulnerability reports. Never attach real resumes, vacancies, credentials, provider responses, or Pi session files to a public issue.
 

package/SECURITY.md

@@ -6,21 +6,21 @@ Do not open an ordinary issue with vulnerability details. Use a private Security
 
 ## External runtime boundary
 
-pi-career packages no native Career Core binary and has no runtime npm dependency or lifecycle script. Resolution order is fixed:
+pi-career packages no native Career Core binary and has no runtime npm dependency or lifecycle script. It supports only macOS and Linux. On an unsupported platform, extension initialization registers no command or tool and fails with one stable payload-free `unsupported_platform` error before explicit/PATH resolution, package validation, acquisition, compatibility probing, or private stdin. On supported platforms, resolution order is fixed:
 
 1. bounded absolute `CAREER_CLI_PATH`;
 2. `career` on PATH;
-3. package-local exact `@revazi/career@0.1.1`;
-4. bounded acquisition of exact `@revazi/career@0.1.1` from the canonical npm registry;
+3. package-local exact `@revazi/career@0.2.0`;
+4. bounded acquisition of exact `@revazi/career@0.2.0` from the canonical npm registry;
 5. stable payload-free installation guidance.
 
 There is no sibling-checkout, Cargo, source-build, arbitrary executable download, or unpinned package fallback. `PI_OFFLINE=1` disables acquisition. A successful route is cached only in memory and invalidated when `CAREER_CLI_PATH` or `PATH` changes. An invalid explicit override fails without fallback.
 
-Every caller-controlled route must pass the exact managed Core 0.1.1 operation catalog and required self-contained schema bundles before private stdin opens. Compatibility probes contain no private document input. An automatically selected executable that later fails before its operation emits `spawn` may advance once; cancellation, timeout, and any already-started operation never retry another route.
+Every caller-controlled route must pass the exact managed Core 0.2.0 operation catalog and required self-contained schema bundles before private stdin opens. Compatibility probes contain no private document input. An automatically selected executable that later fails before its operation emits `spawn` may advance once; cancellation, timeout, and any already-started operation never retry another route.
 
-The package-local/acquired `@revazi/career` launcher is invoked directly with the real Node executable. Pi-career requires the exact v2 launcher manifest and ordered eight-package catalog. The launcher owns native target/libc, lockstep package identity, provenance, regular-file type, Unix mode or Windows file invariant, size, format, architecture, and SHA-256 checks. The reviewed targets are ARM64/x64 macOS, GNU and musl Linux, and MSVC Windows; pi-career does not duplicate the launcher's native verification algorithms.
+The package-local/acquired `@revazi/career` launcher is invoked directly with the real Node executable. Pi-career validates its exact v2 manifest, including the ordered six-package lockstep optional-dependency map, declared file allowlist, and `career` bin. The launcher owns native target/libc, package provenance, regular-file type and mode, size, format, architecture, and SHA-256 checks for pi-career's six supported macOS/Linux targets; pi-career does not duplicate those native verification algorithms.
 
-Acquisition invokes the npm CLI derived from real `process.execPath`, rejects ambiguous/conflicting `npm_execpath`, sanitizes npm tree/registry/script-shell overrides, pins the canonical registry/package/version, includes optional native packages, and disables scripts. It never invokes PATH-selected npm/npx. Windows acquisition additionally derives npm from the real Windows Node layout, validates `SystemRoot`/`System32/cmd.exe`, rejects conflicting `ComSpec`, and never executes a PATH `.cmd` shim as the Career route. Acquisition receives no private stdin, has fixed timeout/stdout/stderr bounds, and uses detached process-group termination—including Windows `CTRL_BREAK`—for descendants. npm cache and `_npx` data may remain afterward; this is not secure erasure.
+Acquisition invokes the npm CLI derived from the real Unix `process.execPath` installation, rejects ambiguous/conflicting `npm_execpath`, sanitizes npm tree/registry/script-shell overrides, pins `/bin/sh` and the canonical registry/package/version, includes optional native packages, and disables scripts. It never invokes PATH-selected npm/npx. Acquisition receives no private stdin, has fixed timeout/stdout/stderr bounds, and uses detached Unix process-group termination for descendants. npm cache and `_npx` data may remain afterward; this is not secure erasure.
 
 ## Process and data boundary
 
@@ -46,7 +46,7 @@ This is not secure erasure and does not remove shell history, npm cache, backups
 
 ## Installation and supply chain
 
-Pi packages execute with the user's permissions. Install only a reviewed clean local checkout, public Git source pinned to a reviewed full commit, or public npm package pinned to an exact reviewed version. Review the tracked TypeScript bundle, external resolver, package allowlist, registry metadata, and native package CI/provenance. Normal pi-career installation has no npm lifecycle script, post-install runtime download, Cargo/Rust build, packaged native artifact, or production/optional runtime dependency. The generated PDF worker contains lockfile-pinned `unpdf` 1.8.0 and its included license notice.
+Pi packages execute with the user's permissions. Install only a reviewed clean local checkout, public Git source pinned to a reviewed full commit, or public npm package pinned to an exact reviewed version. Review the tracked TypeScript bundle, external resolver, package allowlist, registry metadata, and native package CI/provenance. Normal pi-career installation declares `os: ["darwin", "linux"]` and has no npm lifecycle script, post-install runtime download, Cargo/Rust build, packaged native artifact, or production/optional runtime dependency. The generated PDF worker contains lockfile-pinned `unpdf` 1.8.0 and its included license notice.
 
 `npm run audit:production` and `npm run audit:full` must both report zero vulnerabilities at explicit `--audit-level=low`. Audit and pack checks derive npm from real Node, verify inherited `npm_execpath`, remove tree/severity overrides, and reject duplicate decoded JSON keys. Package extraction uses verified root-owned `/usr/bin/tar`. The package check proves the tarball has no `runtime/`, native binary, `node_modules`, or Pi package contents and declares exactly four wildcard external peers. `check:publish` performs no publication.