pi-career 0.2.0 → 0.4.0

package/docs/career-run-roadmap.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-Career Core Phase 8 was merged as `f6d1783` through PR #21. The first compact `career_run` implementation, ephemeral handles, complete bounded in-memory results, detail hydration, raw-tool activation control, and synthetic token benchmark are implemented here. Runtime distribution now belongs to reviewed exact `@revazi/career@0.1.1`; pi-career packages no native artifacts and resolves compatible external routes before managed execution. Package-owned save/export, richer interactive change selection/navigation, and broader PDF extraction compatibility remain later reviewed work.
+Career Core Phase 8 was merged as `f6d1783` through PR #21. The compact `career_run` implementation, ephemeral handles, complete bounded in-memory results, detail hydration, raw-tool activation control, synthetic token benchmark, and bounded non-PDF reviewed-change selector are implemented here. Runtime distribution now belongs to reviewed exact `@revazi/career@0.2.0`; pi-career packages no native artifacts, supports only macOS/Linux, and resolves compatible external routes before managed execution. Synthetic PDF compatibility covers reviewed Chromium-generated tagged and untagged documents, a reproducible ReportLab-generated two-page document, an embedded open-licensed font, a CSS multi-column layout, and fail-closed image-only/malformed/oversized inputs. The package-owned user-confirmed materialized-variant save workflow is implemented for private Markdown/text artifacts on those supported platforms. Application-workspace Gate 1 is also implemented for explicit config-v2 migration, one disjoint private root, immutable application status/vacancy/selected-original revisions, and read-only reconciliation. The dedicated token-optimization benchmark study now has frozen before/after evidence bound to the reviewed production commits and exact source/Skill trees. Application-workspace assisted artifacts, deletion, repair/adoption/archive/sync and broader files, further review UX, and further PDF generator/font coverage remain later explicitly authorized work; Windows is unsupported rather than deferred roadmap scope.
 
 Completed sequence:
 
@@ -12,9 +12,38 @@ Completed sequence:
 4. Primary `career_run` implementation with raw tools inactive by default.
 5. Reproducible synthetic context benchmark and budget gates.
 6. External local-first resolver with exact package acquisition, pre-private-input compatibility validation, and removal of bundled native artifacts.
+7. Turn-terminating variant review plus bounded TUI warning/discard review, exact change inspection, explicit selection, and later editor handoff without automatic materialization.
+8. User-only TUI/RPC exact preview and confirmed no-clobber saving of current POSIX Markdown/text materializations with fail-closed assisted sidecars and rescanning.
+9. Versioned pre-optimization token benchmark with immutable Git source/Skill-tree and snapshot provenance, actual contracts and managed serialization parity, Skill discovery/full-load context, call/result/detail/editor surfaces, independent workflow rollups, semantic-retention invariants, and explicit before/optimizing/after gates.
+10. User-only application-workspace Gate 1 with strict config v2/CAS, one existing private disjoint root, immutable application state/vacancy/original bindings, and read-only reconciliation without Core/provider/model/network/session-append behavior.
 
 This document records findings and phase boundaries; it does not independently authorize persistence, publication, release, or later deferred work.
 
+## Next target: model context on demand
+
+The completed optimization reduced the cost of an activated Career workflow. The application-overlay phase has a stricter goal: a model turn in an ordinary Pi session that has not been explicitly activated for Career assistance must contain **zero Career-specific context tokens**. No `career-core` Skill name/description/content and no `career_run` or raw-tool schema should be model-visible merely because pi-career is installed. This target replaces neither the bundled Skill nor the managed tool; it changes when they become model-visible.
+
+The activation contract is:
+
+1. `/career` navigation, local catalog/detail reads, readiness derivation, and deterministic Career Core Analyze/Match actions do not activate model context and do not submit a model turn.
+2. Only a user-selected assistance action such as resume regeneration, cover-letter suggestions, or match explanation may request Career model context.
+3. The adapter first revalidates the selected application and prepares a visible bounded editor handoff. It never submits that handoff automatically.
+4. The bundled Career Skill and compact `career_run` tool become available only to the explicit application-scoped assistance session. `career_run` remains the primary managed tool.
+5. Once activated, that session keeps a stable Career model surface across its related turns so prompt caching is not defeated by per-turn tool/Skill churn.
+6. The exact raw compatibility names—`career_core_discover`, `career_core_resume`, and `career_core_job`—remain registered compatibility surfaces but inactive unless the user explicitly selects raw/debug mode.
+7. `/new`, branch replacement, detach, application identity drift, and unavailable roots invalidate process-local handles and require fresh validation. No prior application context is silently reused.
+
+Application attachment and model-context activation are separate. #64 fixes the exact strict custom-entry data in [`application-workspaces.md`](application-workspaces.md): one path-free root/application identity pointer, an exact detachment record, and a separate activation bound to that attachment. Implementation removes static Skill discovery, reconstructs valid activation in `session_start`, conditionally contributes the bundled Skill path from `resources_discover`, activates only `career_run`, and uses one terminal reload after activation, detach, or a branch visibility change. It must follow Pi’s fresh-session lifecycle and never retain an old context after session replacement.
+
+Benchmarking for this target must keep the historical frozen optimization evidence unchanged and add separate measurements for:
+
+- ordinary model turns outside an explicitly activated Career assistance session: exactly zero Career-specific Skill/tool tokens;
+- overlay and deterministic local operations: zero model submissions and zero model tokens;
+- first activated assistance turn: Skill discovery/content, `career_run`, handoff, and bounded result surfaces; and
+- later turns in the same assistance session: an unchanged model-visible Career surface suitable for provider prompt-cache reuse.
+
+This target does not authorize removal of `career_run`, renaming of raw tools, hidden prompt submission, automatic session creation, or implementation before the persistence/session contracts are approved.
+
 ## Findings motivating the migration
 
 The integration gap is adapter design rather than implementation language. Pi Fallow also invokes its Rust core through a CLI subprocess, but provides a substantially more agent-oriented boundary:
@@ -50,10 +79,10 @@ career_run {command: match, handle: resume:...}
 career_run {command: variant-review, handle: resume:..., payload: {changes: [...]}}
 career_run {command: materialize, handle: review:..., payload: {selected_change_ids: [...]}}
 career_run {command: detail, handle: result:..., payload: {section: evidence}}
-# package-owned save remains deferred
+# local saving is a separate user-only /career-save slash command
 ```
 
-This is the implemented compact v1 command shape; package-owned save remains deferred. Private document text continues to travel only through bounded stdin at the Career Core process boundary, never through CLI arguments.
+This is the implemented compact v1 model-tool shape; local saving remains outside it as the user-only `/career-save <variant-handle>` slash command. Private document text continues to travel only through bounded stdin at the Career Core process boundary, never through CLI arguments.
 
 Career Core remains authoritative for operations, schemas, algorithms, typed errors, evidence, warnings, uncertainty, ordering, deterministic baselines, and assisted/non-authoritative semantics. Pi-career owns handles, orchestration, projection, interaction, and explicitly approved persistence.
 
@@ -159,7 +188,7 @@ Raw generic agents remain discovery-first. A reviewed managed adapter may perfor
 
 ## Pi-career managed adapter phase
 
-Pi-career now uses one primary compact `career_run` tool. The existing `career_core_discover`, `career_core_resume`, and `career_core_job` tools remain registered as inactive advanced/debugging compatibility tools rather than occupying normal model context; `/career-tools raw` enables them explicitly.
+The current implementation uses one primary compact `career_run` tool. The existing `career_core_discover`, `career_core_resume`, and `career_core_job` tools remain registered as inactive advanced/debugging compatibility tools rather than occupying normal model context; `/career-tools raw` enables them explicitly. The context-on-demand target above will additionally keep `career_run` and Career Skill metadata out of model turns outside an explicitly activated assistance session while preserving this managed/raw relationship after activation.
 
 ### Ephemeral handles
 
@@ -187,21 +216,24 @@ Common results include only the decision surface needed for the next action whil
 
 The complete Core result must be captured before projection, remain unchanged, and be recoverable in the current process. It must never be partially consumed after truncation. Resume/job payloads and full results must not be written to temp files without a separately approved design.
 
-### Deferred richer review rendering and selection
+### Delivered bounded reviewed-change selection
+
+For non-PDF variant reviews, `career_run variant-review` terminates the agent turn and returns the ephemeral review handle. `/career-review <review-handle>` then provides bounded TUI navigation over:
 
-A later reviewed phase may add bounded custom rendering for:
+- all warnings, factuality limitations, and discard records, which require explicit acknowledgment;
+- every canonical retained change, excluded by default;
+- exact before/proposed-after text, line bounds, resume evidence, and vacancy evidence in a paged view;
+- an explicit included-ID set in original Core order;
+- a final paged cross-change view with compact labels for every exact selected record;
+- direct final-stage reopening of any selected record, followed by a separate prepare-or-back decision.
 
-- before/proposed-after changes
-- evidence and source targets
-- confirmed/provisional status
-- warnings and factuality limitations
-- discard codes
+Only the final prepare decision creates a later ordinary editor message containing the unchanged review handle and selected canonical IDs. It does not call Core, submit to a provider, append selection state, materialize, save, or write. The user must review and submit that message separately. Exact cached review input remains process-memory-only and deterministic materialization still reuses it unchanged. PDF review handles fail closed at selection and materialization because extracted text cannot preserve PDF styling.
 
-The initial managed adapter already requires explicit canonical change IDs and reuses the exact complete reviewed proposal for materialization; the model must not select automatically. A later bounded multi-select interaction may make that user decision easier without changing the authority boundary.
+Further reviewed work may improve navigation or presentation further, but must retain the same warning, evidence, authority, cancellation, process-memory, cross-change confirmation, and explicit-selection boundaries.
 
 ### Approved save workflow
 
-A later explicitly authorized save action should require:
+The implemented design and threat model are recorded in [`variant-save-workflow.md`](variant-save-workflow.md). `/career-save` requires:
 
 1. exact destination and file preview
 2. explicit user confirmation
@@ -211,40 +243,44 @@ A later explicitly authorized save action should require:
 6. immutable originals and overwrite rejection
 7. immediate library rescan with variants excluded from authoritative analysis/matching
 
-Destination configuration remains suggestion-only until this phase is designed, threat-reviewed, implemented, and tested.
+Destination configuration remains suggestion-only until one exact `/career-save` plan is previewed unchanged and separately confirmed. Full-result export and `/career-workspace` remain outside this narrower materialized-variant save workflow; Gate 1 application state persistence is a separate user-only consent surface, while assisted workspace artifacts and deletion remain later gates.
 
 ### Document ingestion
 
-To broaden confidence beyond the current searchable-PDF fixtures, extend synthetic compatibility tests to cover Chromium-generated PDFs, common embedded fonts, multi-column documents, and tagged/untagged searchable PDFs. Continue to reject encrypted, image-only, malformed, oversized, or timed-out PDFs without OCR unless OCR receives separate authorization.
+The synthetic compatibility suite includes immutable Chromium 150/Skia fixtures for tagged and untagged searchable PDFs, a CSS multi-column document, and a reproducible ReportLab 4.4.10 two-page fixture. Searchable fixtures use an embedded OFL-licensed Lato subset. The suite pins reviewed fixture hashes, generator/tool-wheel coordinates, exact extracted text for the ReportLab document, and exercises the normal isolated scanner. Deterministic synthetic boundary cases verify that image-only, malformed, and oversized inputs fail closed without OCR.
+
+Further reviewed expansion may cover other common PDF generators and open-licensed embedded fonts. Continue to reject encrypted or timed-out PDFs and all text-unavailable documents without OCR unless OCR receives separate authorization.
 
 ### UX and context benchmarks
 
-The initial frozen synthetic benchmark covers the active/raw tool contracts, representative analyze and variant-review results, and the existing workbench prompt. Later benchmark expansion should cover:
+The versioned synthetic benchmark now covers Pi's stable always-visible `career-core` Skill name/description metadata, the complete on-demand `SKILL.md` for matching career tasks, the actual active/raw tool contracts, representative direct tool-call arguments, compact context/analyze/match/review/materialization results, evidence/change/document detail hydration, all six workbench prompts, the later reviewed-ID handoff, and independent end-to-end workflow rollups. Linked Skill references and machine-specific discovery location paths remain outside the measured context boundary. It records exact measured-surface SHA-256, tool calls, user model submissions, Skill-context occurrences, complete-source occurrences, repeated complete-source bytes, schema-discovery calls, and nested-JSON status alongside token totals; synthetic managed result/detail fixtures must match actual `career_run` serialization.
+
+The token-optimization study is intentionally split:
 
-- match, suggestion/replacement-review, materialization, and hydration result tokens
-- model turns and tool calls
-- mandatory warning/evidence/uncertainty retention
-- repeated private-source bytes
-- malformed-envelope prevention
-- TUI and RPC behavior
-- cold/warm runtime performance and memory
+1. `before_frozen` pins the post-save-workflow `c7d7634…` production `src/` and `skills/` Git trees, complete surface-digested benchmark snapshot, and snapshot SHA-256 before optimization;
+2. after the baseline merges, `optimizing` names that immutable baseline-history commit, verifies the frozen bytes from Git history, and lets the separately reviewed optimization merge only after all savings, no-regression, budget, shape, and invariant gates pass without requiring a self-referential after snapshot; and
+3. `after_frozen` adds a separately generated snapshot bound to the full merged optimization commit and its source/Skill tree IDs. The gate verifies that frozen snapshot and its exact deltas from immutable Git history; later current source may differ only when corpus/tokenizer/workflow shape, invariants, and budgets remain unchanged and no workflow regresses relative to the frozen after snapshot. The finalized snapshot is bound to `7ed36c4…` and records 25,652 → 21,552 aggregate workflow tokens (15.98% reduction), with every workflow reduced by 820 tokens.
 
-Initial targets:
+Predeclared after-phase targets:
 
+- at least 10% lower aggregate independent-workflow tokens with no workflow regression
 - primary active tool contract at or below 400 `o200k_base` tokens
 - no model-visible schema-export step in the managed flow
 - no nested `input_json`
-- original source included at most once per model workflow unless explicitly requested again
-- common result at or below roughly 1,500 tokens
-- complete authoritative detail recoverable on demand
+- original complete source included at most once per model workflow unless explicitly requested again
+- common result and detail at or below 1,500 tokens
+- required warning, uncertainty, authority, exact-selection, and detail-hydration semantics retained
 - review → explicit selection → materialization without rebuilding the Core envelope
 
+Provider wrappers, hidden prompts/reasoning, caching, and billing remain outside these tokenizer-proxy counts. Later benchmark expansion should add provider-specific tokenizer studies when reproducible local tokenizers are available, plus cold/warm runtime performance and memory without adding telemetry or private fixtures.
+
 ## Runtime boundaries retained after externalization
 
 Pi-career retains:
 
+- macOS/Linux-only package metadata and an adapter-level unsupported-platform failure before any route work or private stdin
 - no packaged native runtime artifacts or runtime dependencies
-- fixed resolution through explicit `CAREER_CLI_PATH`, PATH `career`, package-local exact `@revazi/career`, then acquisition of exact `@revazi/career@0.1.1`
+- fixed resolution through explicit `CAREER_CLI_PATH`, PATH `career`, package-local exact `@revazi/career`, then acquisition of exact `@revazi/career@0.2.0`
 - no Cargo, sibling checkout, source build, arbitrary executable download, unpinned package, or lifecycle fallback
 - `PI_OFFLINE=1` disables acquisition; the only implicit network-capable behavior is bounded exact-package acquisition after local routes fail and before private stdin opens
 - exact managed compatibility for caller-controlled routes and native integrity delegated to the reviewed package launcher

package/docs/cover-letter-contract.md

@@ -0,0 +1,18 @@
+# Application-owned cover letters — issue #57
+
+This contract authorizes only user-authored Markdown or UTF-8 plain-text cover-letter artifacts in the application workspace. It does not authorize provider/model drafting, adoption of files, submission, or deletion.
+
+## Authority and state
+
+The canonical `pi.career.application_state` schema retains its nullable `cover_letter_artifact` reference. A non-null reference binds a private application-owned relative path, SHA-256, UTF-8 byte size, format, `authority: "user_authored"`, current vacancy digest, and effective-resume digest. Readiness remains derived from the complete validated state chain and current dependencies; a missing, stale, drifted, or unavailable reference is not ready.
+
+Artifacts are immutable revisions named `cover-letter-NNNNNN.md` or `.txt`; edits create a new artifact and state revision and never modify prior artifact bytes. View opens the validated current artifact in local UI only. Clear appends a state revision with a null reference and does not remove artifact history.
+
+## Write transaction
+
+1. Require the currently attached, valid application and both a current vacancy and effective resume. Ask the user to select Markdown or plain text, then author content in a local editor. Input must be valid UTF-8, non-empty, CR-free, NUL-free, and no larger than the existing 262,144-byte workspace text bound.
+2. Display the exact authored bytes in a separate preview editor. Require unchanged return, then require a distinct persistence confirmation. Cancellation at either step writes nothing.
+3. Build a path-free mutation preview and obtain the existing explicit workspace mutation approval. Under the application-root lock, revalidate config snapshot, attached application identity, current application parent hash (which binds the expected previous cover-letter reference), vacancy/resume authority, capacity, and absence of every target.
+4. Publish artifact then state using the existing private temporary-file, exclusive/no-clobber publication protocol; state is the commit record. On failure, rollback only files proven to be owned by this transaction. Unknown pre-existing files fail closed and are never overwritten/adopted. A state append is never reported successful unless its committed head is verified.
+
+All data remains local to the configured application workspace and local Pi UI. No Core/provider/network calls or session payload appends occur. Errors remain payload-free. Clearing and editing preserve the complete immutable artifact history.

package/docs/design.md

@@ -4,7 +4,7 @@
 
 `pi-career` is a public Pi adapter package for reviewed Career Core targets. It owns the Pi extension, external runtime resolver, Pi-facing Agent Skill, generated TypeScript bundles, package tests, and integration guidance. It does **not** own or package native Career Core binaries. Career Core remains authoritative for operations, schemas, algorithms, errors, evidence, warnings, uncertainty, ordering, and assisted/non-authoritative semantics; this repository does not copy those contracts or algorithms into TypeScript.
 
-The primary managed Pi surface is `career_run`. It uses ephemeral resume/result/review/variant handles, internal Career Core operation/schema discovery, compact projections, and bounded detail hydration. The exact raw compatibility tools remain registered but are normally inactive:
+In the current command-oriented implementation, the primary managed Pi surface is `career_run`. It uses ephemeral resume/result/review/variant handles, internal Career Core operation/schema discovery, compact projections, and bounded detail hydration. The exact raw compatibility tools remain registered but are normally inactive:
 
 - `career_core_discover`
 - `career_core_resume`
@@ -12,41 +12,61 @@ The primary managed Pi surface is `career_run`. It uses ephemeral resume/result/
 
 `/career-tools managed|raw|status` controls whether the raw tools occupy active model context; it never changes the process, compatibility, privacy, or runtime-resolution boundary.
 
-The TypeScript source is authoritative. Checked-in deterministic `dist/index.js` and `dist/pdf-worker.js` bundles support clean local, pinned-Git, and npm Pi loading without packaged runtime dependencies. The isolated PDF worker bundles the reviewed text extractor; Pi-provided imports remain external peers. Package metadata permits only separately reviewed public publication of the unscoped `pi-career` package to the canonical npm registry.
+The TypeScript source is authoritative. Checked-in deterministic `dist/index.js` and `dist/pdf-worker.js` bundles support clean local, pinned-Git, and npm Pi loading without packaged runtime dependencies. The isolated PDF worker bundles the reviewed text extractor; Pi-provided imports remain external peers. Package metadata permits only separately reviewed public publication of the unscoped `pi-career` package to the canonical npm registry and declares only macOS/Linux installation through `os: ["darwin", "linux"]`.
 
-The workflow layer registers `/career-setup`, `/career-library`, `/career-application`, `/career-vacancy`, `/career-match`, `/career-analyze`, and `/career-workbench`. Setup/library scanning remains local. Core-backed commands use the same resolver and process helper as the tools. `/career-workbench` performs no provider/model call: it builds a bounded, visibly reviewable ordinary Pi editor prompt, and nothing leaves the package until the user separately submits that message through Pi. See [`product-flow.md`](product-flow.md) and [`application-workspaces.md`](application-workspaces.md).
+The workflow layer registers `/career`, `/career-setup`, `/career-library`, `/career-application`, `/career-vacancy`, `/career-match`, `/career-analyze`, `/career-workbench`, `/career-workspace`, the TUI-only `/career-review`, and the user-only TUI/RPC `/career-save`. Those `/career*` view commands open one view model; TUI overlay and RPC dialogs only render it. Application-workspace Gate 1 owns only explicit config-v2 migration, one private disjoint application root, immutable manifest/state/vacancy/original bindings, and read-only reconciliation; assisted workspace artifacts and deletion remain unimplemented later gates. Application state has one approved schema, [`pi.career.application_state`](single-application-state.md); append-only revision numbers remain integrity/history controls rather than schema versions, and former state `.v1`/`.v2` identifiers fail closed without migration. Setup/library scanning remains local. Core-backed `career_run` uses the same resolver and process helper as before. `/career-review` also invokes neither Core nor a provider; it reads one current in-memory non-PDF variant review, collects explicit canonical IDs after warning/discard and exact-change inspection, and prepares a later editor message containing only the handle and IDs. See [`product-flow.md`](product-flow.md) and [`application-workspaces.md`](application-workspaces.md).
+
+The user-only `/career-save <variant-handle>` workflow is specified in [`variant-save-workflow.md`](variant-save-workflow.md). It accepts only a current successful non-PDF materialization, uses supported Pi TUI/RPC editor and confirmation dialogs, and writes nothing until the exact preview is returned unchanged and separately confirmed. Saving performs no Core/provider/network call, appends no session entry, and preserves all runtime-resolution, private-stdin, registry, and payload-free error boundaries in this document.
+
+A separate local-only document preview action is available after opening eligible library-original or attached vacancy/selected-original/effective-Resume metadata detail. It freshly revalidates the selected authority and text digest, rejects unsafe or >12,000-byte text without truncation, and displays only validated text in transient TUI/RPC UI (TUI paginates six exact soft-wrapped lines at a time; if a grapheme cannot fit in the current terminal width, it displays no partial body and asks the user to widen the terminal; RPC shows the complete bounded text). The RPC `ui.select` title carries those private bytes to the local UI client, which may retain UI payloads under the existing [RPC local-UI retention boundary](application-workspaces.md); this is not a model prompt or provider send. Back/cancel clears the preview buffer in pi-career, not any client-held copy; list rows, ordinary detail, result cards, notifications, session entries, model context, and errors do not receive the body. This does not activate Career assistance, call Core, send to a provider, or mutate files or sessions. A tailored effective Resume remains labeled assisted, not original. The Gate 1 application-workspace contract is specified in [`application-workspaces.md`](application-workspaces.md). Every local mutation requires a complete unchanged editor preview and separate confirmation, uses strict private config/root/file validation and bounded lock/no-clobber settlement, and performs no Core/runtime/provider/model/network/child/session-append action. Empty `/career-workspace` opens the shared Career view rather than that mutation menu.
+
+## `/career` overlay and context boundary
+
+One Career view model owns routes, items, selection, detail, and actions. Applications and Resumes are the only peer top-level destinations. Setup is contextual to Resumes; job description, Analyze, Match, Workspace, and Ask Pi are contextual to application/Resume state. The existing `/career-setup`, `/career-library`, `/career-application`, `/career-vacancy`, `/career-match`, `/career-analyze`, `/career-workbench`, and `/career-workspace` names remain direct routes into that hierarchy. A contextual route has an explicit breadcrumb and Back/Escape parent, while destination switching exposes only Applications and Resumes in both TUI and RPC.
+
+The Applications projection preserves catalog ordering, adds process-local text and lifecycle filters, opens a valid attached application directly in detail, and renders lifecycle plus the derived three-component readiness projection without persisting a second index or readiness state. Current state, the derived recommended next action, and safe alternatives are visible in application detail and empty/prerequisite states; recommendations never execute themselves. Only the exact attached application exposes its contextual package actions, lifecycle mutation, and detach; marking an incomplete package Applied adds a separate warning and never claims employer submission or changes readiness. The TUI overlay and RPC hierarchical select/confirm dialogs are only renderers of that model. `/career` is local application code and never a model tool.
+
+The TUI renderer owns a complete theme-compatible rounded Unicode modal frame with connected separators, one column of interior padding on both sides, and explicit host margin around the centered overlay. Every ANSI/Unicode header, breadcrumb, destination, list/detail, exact-preview, and contextual-footer line is measured against the reduced inner width before the outer border is added. The component derives its maximum row count from Pi's terminal and preserves the frame, destinations, and footer while scrolling only the content viewport; long catalogs keep the selected row visible, and detail/help use Up/Down scrolling. Widths below 60 columns or viewports below 18 available rows reveal no private preview body and return only bounded resize guidance; action, navigation, and help keys remain inactive there, while Escape retains safe Back/Close or operation-cancellation behavior. Selection and active destination use visible glyph/text state rather than color alone; footer hints show a recommended action plus a bounded set of alternatives, and local help exposes the complete eligible shortcut list without performing an action.
+
+Opening, highlighting, browsing, filtering, switching destinations, help, and viewing local details must not attach an application, bind a Resume, activate assistance, call `sendMessage()` or `sendUserMessage()`, invoke a provider/model, append a session entry, resolve/acquire/invoke Core, or mutate a file. Attach, library root add/remove/rescan, application create, selected-original bind, vacancy edit/clear, status update, detach, Ask Pi, and workspace management are explicit actions on the same model. Attached selected-original bind reuses the exact immutable workspace preview, confirmation, fresh-source validation, and no-clobber commit path; attached Analyze and Match require that authority instead of selecting an unrelated library original. Explicit deterministic Analyze and Match actions invoke Core through the unchanged resolver boundary, but do not activate or invoke a model. In the Resume-library detail, Analyze is available only for the highlighted available Original; the action carries that record's exact document/root/format/text-digest identity through post-confirmation rescan and final submission validation, never reopening the generic chooser or substituting another Resume. Library detail also exposes explicit authority, format, availability, current-session analysis state, and payload-free notices. Explicit Rescan presents local cancellable progress and installs only a completed projection; root removal remains a separately confirmed config-only change.
+
+The overlay reads one bounded catalog metadata snapshot per open or explicit refresh, loads exact document/detail bytes lazily, and caches only bounded process-local view data. It creates no index, watcher, polling task, payload/result persistence, or speculative operation. Every mutation, Core action, attachment, and assistance handoff revalidates current identity and referenced bytes rather than trusting cached display state.
+
+The target model surface is context-on-demand. Installation and ordinary model turns outside an explicitly activated Career assistance session expose no Career-specific Skill metadata/content or tool schema. Only an explicit assistance action may establish one application-scoped assistance session, load the bundled Career Skill, and activate the primary `career_run` tool; the exact raw compatibility tools remain inactive by default. The action may prepare a visible editor handoff but may not submit it. Once the user submits, the activated Career surface remains stable within that assistance session for prompt-cache reuse.
+
+Application attachment is a separate #64 decision with exact path-free identity-pointer, detachment, and activation custom-entry data specified in [`application-workspaces.md`](application-workspaces.md). Attachment contains no document/result/prompt content and does not itself activate tools, load Skill content, invoke Core/provider, or authorize persistence. Workspace files remain authoritative. The implemented lifecycle removes static Skill discovery, validates branch state in `session_start`, contributes the Skill path conditionally in `resources_discover`, and terminally reloads after visibility changes. It does not authorize publication or release.
 
 ## Runtime resolution and compatibility
 
-Runtime routes are resolved in this fixed order:
+At extension initialization, pi-career requires macOS or Linux. Any other platform, including Windows, registers no command or tool and returns one stable payload-free `unsupported_platform` adapter error before reading or validating `CAREER_CLI_PATH`, traversing `PATH`, checking a package-local launcher, acquiring npm content, invoking a compatibility probe, or opening private stdin. Invocation and resolver entry points retain the same guard as defense in depth. On a supported platform, runtime routes are resolved in this fixed order:
 
 1. a bounded absolute `CAREER_CLI_PATH`, when explicitly set;
 2. the first executable `career` on the caller's `PATH`;
-3. a package-local exact `@revazi/career@0.1.1` launcher;
-4. bounded acquisition of exact `@revazi/career@0.1.1` from the canonical npm registry, followed by direct execution of the resolved launcher;
+3. a package-local exact `@revazi/career@0.2.0` launcher;
+4. bounded acquisition of exact `@revazi/career@0.2.0` from the canonical npm registry, followed by direct execution of the resolved launcher;
 5. otherwise a stable payload-free installation error.
 
 There is no sibling-checkout, Cargo, source-build, lifecycle-script, arbitrary URL/download, unpinned package, or PATH-selected npm/npx fallback. `PI_OFFLINE=1` disables route 4. The resolver caches only a successful route in process memory and invalidates it whenever the `CAREER_CLI_PATH` or `PATH` value changes.
 
-`CAREER_CLI_PATH`, PATH, and package-local installations are caller-controlled. Before any private operation opens stdin, the selected route must pass the exact managed compatibility surface: Core version `0.1.1`, all 15 `career.operation_catalog.v1` descriptors (capability mapping, CLI path, transport, schema IDs, input bounds, and 32-MiB output bound), and the required self-contained schema bundles with only valid local references. Explicit override failure never falls back. Automatically considered routes may be skipped during this payload-free compatibility phase. If a previously selected automatic executable later fails before its operation process emits `spawn`, the adapter may advance once to the next route; cancellation, timeout, or any already-started operation is never retried through another route.
+`CAREER_CLI_PATH`, PATH, and package-local installations are caller-controlled. Before any private operation opens stdin, the selected route must pass the exact managed compatibility surface: Core version `0.2.0`, all 15 `career.operation_catalog.v1` descriptors (capability mapping, CLI path, transport, schema IDs, input bounds, and 32-MiB output bound), and the required self-contained schema bundles with only valid local references. Explicit override failure never falls back. Probe failures, including cancellation and timeout, are reissued as stable payload-free adapter errors and do not retain foreign messages, stacks, paths, environment values, or validated Core error text. Automatically considered routes may be skipped during this payload-free compatibility phase. If a previously selected automatic executable later fails before its operation process emits `spawn`, the adapter may advance once to the next route; cancellation, timeout, or any already-started operation is never retried through another route.
 
-The package-local and acquired routes execute the reviewed `@revazi/career` launcher using the real Node executable. Pi-career validates the exact v2 launcher manifest, ordered eight-package catalog reference, lockstep optional-package map, and bounded launcher file before execution. The launcher remains responsible for native package selection, libc requirements, package/version/provenance mapping, regular-file type, Unix mode or Windows file invariant, size, format, architecture, and SHA-256 verification before it starts Career Core. Pi-career does not duplicate those native verification algorithms or package native files.
+The package-local and acquired routes execute the reviewed `@revazi/career` launcher using the real Node executable. Pi-career validates the exact v2 launcher manifest, ordered six-package catalog reference, lockstep optional-package map, declared file allowlist, `career` bin, and bounded launcher file before execution. The launcher remains responsible for native package selection, libc requirements, package/version/provenance mapping, regular-file type and Unix mode, size, format, architecture, and SHA-256 verification before it starts Career Core. Pi-career does not duplicate those native verification algorithms or package native files.
 
-Acquisition invokes the npm CLI derived from the real `process.execPath` installation using the reviewed Unix or Windows Node installation layout, rejects ambiguous or conflicting `npm_execpath`, pins the canonical registry/package/version, includes optional native packages, and disables lifecycle scripts. It never invokes an npm/npx executable selected from caller `PATH`. Unix acquisition pins `/bin/sh`; Windows acquisition validates `SystemRoot`, derives `System32/cmd.exe`, rejects conflicting `ComSpec`, sanitizes shell/PATH overrides, and uses that shell only inside npm's acquisition-only execution. npm's acquisition command prints only its controlled PATH through Node's `-p` option. From bounded stdout, pi-career requires exactly one absolute first PATH entry ending in `node_modules/.bin`, derives the fixed sibling `@revazi/career/bin/career.js`, and ignores platform-specific npm banner lines without exposing them. It then invokes the manifest-validated JavaScript launcher directly with real Node and `shell: false`; no npm command shim becomes the Career route.
+Acquisition invokes the npm CLI derived from the real Unix `process.execPath` installation, rejects ambiguous or conflicting `npm_execpath`, pins `/bin/sh` plus the canonical registry/package/version, includes optional native packages, and disables lifecycle scripts. It never invokes an npm/npx executable selected from caller `PATH`. npm's acquisition command prints only its controlled PATH through Node's `-p` option. From bounded stdout, pi-career requires exactly one absolute first PATH entry ending in `node_modules/.bin`, derives the fixed sibling `@revazi/career/bin/career.js`, and ignores npm banner lines without exposing them. It then invokes the manifest-validated JavaScript launcher directly with real Node and `shell: false`; no npm command shim becomes the Career route.
 
-Acquisition has fixed time/stdout/stderr bounds and sends no private stdin. The npm child starts in a detached process group: Unix cancellation signals the negative process-group ID, while Windows uses `CTRL_BREAK` for the detached npm group and a bounded forced pass for npm itself. Ordinary npm cache and `_npx` data may remain after acquisition; neither package removal nor `PI_OFFLINE=1` provides secure erasure.
+Acquisition has fixed time/stdout/stderr bounds and sends no private stdin. The npm child starts in a detached Unix process group; cancellation signals the negative process-group ID and makes a bounded forced pass after the grace period. Ordinary npm cache and `_npx` data may remain after acquisition; neither package removal nor `PI_OFFLINE=1` provides secure erasure.
 
-The reviewed `@revazi/career@0.1.1` launcher supplies `darwin-arm64`, `darwin-x64`, `linux-x64-gnu`, `linux-arm64-gnu`, `linux-x64-musl`, `linux-arm64-musl`, `win32-x64-msvc`, and `win32-arm64-msvc`. GNU Linux requires glibc 2.35 or newer. Unknown targets/libc, older glibc, and native integrity failures remain delegated to that launcher and surface only as bounded adapter failures. Windows PATH discovery remains direct-argv-only and considers native `career.exe`/`.com`/extensionless files, not caller-selected `.cmd` or `.bat` shells; package launchers use the validated package-local/acquired route instead.
+Pi-career's supported `@revazi/career@0.2.0` targets are `darwin-arm64`, `darwin-x64`, `linux-x64-gnu`, `linux-arm64-gnu`, `linux-x64-musl`, and `linux-arm64-musl`. GNU Linux requires glibc 2.35 or newer. Unknown supported-platform targets/libc, older glibc, and native integrity failures remain delegated to that launcher and surface only as bounded adapter failures.
 
 ## Process and privacy boundary
 
 The adapter calls `spawn(command, fixedArgv, { shell: false })`; operations and schema IDs are bounded before spawn. For package launcher routes, the fixed prefix is the validated launcher path invoked by the real Node executable. Document JSON is one bounded object string sent only through child stdin with `--input - --format json-compact`. Private stdin is not ended into the child until Node emits the successful `spawn` event.
 
-The process adapter creates no payload/result temporary files and adds no model, provider, telemetry, repair, URL-fetching, or command retry after launch. The sole network-capable runtime behavior is the bounded exact-package acquisition above, which finishes before private stdin opens. A successful Core child must emit exactly one UTF-8 JSON object with no stderr. Raw tools retain the 50,000-byte/2,000-line Pi-context ceiling and fail without partial output. Managed execution captures the complete Core result up to Core's declared 33,554,432-byte successful-machine-output ceiling. Complete managed results and exact review inputs live only in a 16-entry/64-MiB process-memory registry addressed by ephemeral handles; session/branch replacement and shutdown clear private entries. Model-visible projections/details remain capped at 50,000 bytes and never truncate the authoritative Core result.
+The process adapter creates no payload/result temporary files and adds no model, provider, telemetry, repair, URL-fetching, or command retry after launch. The sole network-capable runtime behavior is the bounded exact-package acquisition above, which finishes before private stdin opens. A successful Core child must emit exactly one UTF-8 JSON object with no stderr. Raw tools retain the 50,000-byte/2,000-line Pi-context ceiling and fail without partial output. Managed execution captures the complete Core result up to Core's declared 33,554,432-byte successful-machine-output ceiling. Complete managed results and exact review inputs live only in a 16-entry/64-MiB process-memory registry addressed by ephemeral handles; session/branch replacement and shutdown clear private entries. Model-visible projections/details remain capped at 50,000 bytes and never truncate the authoritative Core result. Variant review terminates its agent turn. For non-PDF originals, the TUI selector reads the exact retained changes from that registry, defaults all IDs to excluded, pages the selected exact records together with compact labels, permits direct read-only reopening of each selected record, and requires a separate final prepare choice before putting only an explicit selected-ID request in the editor; it appends no selection entry and performs no materialization or submission. PDF review entries are marked non-materializable in memory and fail closed in both selection and materialization.
 
-A direct Career Core operation timeout or abort sends `SIGTERM`, then `SIGKILL` after a bounded grace period, and settlement waits for close. npm acquisition uses detached process-group termination for descendants, including Windows `CTRL_BREAK` delivery rather than a PATH-selected tree-kill helper. stdout and stderr have independent byte ceilings. Fatal UTF-8, malformed/multiple success documents, successful stderr, signals, and stream failures map to stable errors. Only a strictly shaped, bounded, allowlisted `career.error.v1` may be nested in an adapter error. Source/result text, executable paths, hashes, platform/environment values, npm output, raw stderr, and filesystem/process errors are never logged or exposed.
+A direct Career Core operation timeout or abort sends `SIGTERM`, then `SIGKILL` after a bounded grace period, and settlement waits for close. npm acquisition uses detached Unix process-group termination for descendants rather than a PATH-selected tree-kill helper. stdout and stderr have independent byte ceilings. Fatal UTF-8, malformed/multiple success documents, successful stderr, signals, and stream failures map to stable errors. Only a strictly shaped, bounded, allowlisted `career.error.v1` may be nested in an adapter error. Source/result text, executable paths, hashes, platform/environment values, npm output, raw stderr, and filesystem/process errors are never logged or exposed.
 
-The workflow may read configured `.pdf`/`.md`/`.txt` roots, atomically persist non-content global config—including one bounded preferred variation-directory suggestion—and append consented custom session entries. Searchable PDF text is extracted from bounded in-memory bytes in a package-owned worker with fixed page, time, result, and memory ceilings; network fetch is disabled before the parser loads. No full Core result is appended to session state or written to a file, and pi-career has no full-result file export.
+The workflow may read configured `.pdf`/`.md`/`.txt` roots, compare-and-swap canonical non-content global config—including one bounded preferred variation-directory suggestion and an optional application-root UUID/path binding—and append consented custom session entries. Config v1 is never migrated at startup or by ordinary setup/library/variation mutations: absent or v1 config remains canonical v1 while `application_workspace` is logically null. Only the confirmed `/career-workspace` **Configure application root** mutation writes strict v2; every later writer preserves v2 and freshly enforces physical two-way disjointness when an application root is attached. First ordinary setup may safely bootstrap only the package `career/` directory beneath an existing canonical agent directory, while workspace configuration requires that private directory already exist. Searchable PDF text is extracted from bounded in-memory bytes in a package-owned worker with fixed page, time, result, and memory ceilings; network fetch is disabled before the parser loads. No full Core result is appended to session state or written to a file, and pi-career has no full-result file export. `/career-save` may persist only exact current assisted Markdown/text materialization bytes plus bounded package-owned marker/sidecar metadata after file-specific approval. Workspace Gate 1 may separately persist only its non-content marker/manifest, append-only full state revisions, exact explicitly approved workflow-original vacancy snapshots, and selected-original digest binding.
 
 ## Threat model
 
@@ -55,25 +75,29 @@ The workflow may read configured `.pdf`/`.md`/`.txt` roots, atomically persist n
 | Shell or argument injection | Fixed allowlisted operation mappings, bounded schema-ID syntax, direct argv-only spawn, `shell: false`, document bytes on stdin only. |
 | Executable substitution | Fixed route order; bounded absolute override; exact managed compatibility before private stdin; pinned canonical npm package; package launcher native verification. |
 | Malicious PATH/npm shadowing | PATH `career` remains caller-controlled and must pass compatibility. npm is derived from real Node, conflicting `npm_execpath` is rejected, and npm/npx is never selected from PATH. |
-| Unsupported or corrupted native package | The reviewed launcher validates target/libc, package lockstep, provenance, Unix mode or Windows file invariant, size, format, architecture, and SHA-256 and fails before native execution. |
+| Unsupported platform | Package metadata refuses installation outside macOS/Linux; direct Git/local extension initialization registers nothing and returns `unsupported_platform` before route work or private stdin. |
+| Unsupported or corrupted native package | The reviewed launcher validates target/libc, package lockstep, provenance, Unix mode, size, format, architecture, and SHA-256 and fails before native execution. |
 | Private input sent to multiple routes | Compatibility probes contain no private input. Only a failure before `spawn` may retry once; started, cancelled, and timed-out operations never retry. |
 | Acquisition sees private content | Acquisition completes before document stdin opens and receives no document bytes. `PI_OFFLINE=1` disables it. |
-| Hung acquisition descendants | Fixed acquisition timeout/output bounds, detached process groups, Unix group signals, and Windows `CTRL_BREAK` plus a bounded forced npm pass. |
+| Hung acquisition descendants | Fixed acquisition timeout/output bounds, detached Unix process groups, group signals, and a bounded forced pass. |
 | Oversized request, stream, diagnostic, memory, or context | Core-catalog input ceilings, independent stdout/stderr ceilings, fixed timeouts, raw context limits, 32-MiB managed capture, bounded registry, and 50,000-byte projections. |
 | Private payload disclosure in failures | Payload-free adapter errors; no source/result/path/environment/raw-error logging; only validated Core error envelopes may be nested. |
-| Persistence mistaken for erasure | Config contains no source/result content; managed results are process-memory-only; npm/Pi/session/cache data is explicitly not claimed to be securely erased. |
+| Automatic, ambiguous, or stale review selection | Variant review terminates the turn; exact warnings/discards and per-change evidence are paged locally; all IDs default excluded; selected exact records receive a compact labeled final cross-change review, direct read-only reopening, and a separate prepare-or-back choice; only confirmed canonical IDs in Core order enter a later editor message; stale/PDF handles fail closed. |
+| Unapproved or unsafe local variant persistence | Save is user-only, requires exact unchanged preview plus separate confirmation, forbids overwrite, publishes private sidecar-first pairs, and requires fail-closed rescanning before success. |
+| Agent-initiated or cross-root application persistence | `/career-workspace` is user-only and absent from tools; Gate 1 requires no arguments, exact preview plus separate confirmation, strict session UUID identity, physically disjoint private roots, immutable no-clobber revisions, and read-only reconciliation. |
+| Persistence mistaken for erasure | Config contains no source/result content; managed results and live selector state are process-memory-only; a user-submitted prepared editor message may enter the Pi session; npm/Pi/session/cache data and any separately approved future artifacts are explicitly not claimed to be securely erased. |
 | Supply-chain or package drift | Exact external package coordinate, canonical registry, reviewed launcher delegation, four wildcard external Pi peers, no packaged runtime dependency/tree, deterministic dist, strict package allowlist, trusted npm/tar tooling, and clean low-threshold audits. |
 
 ## Build, package, CI, and installation boundary
 
 `npm run build` rebuilds only `dist/index.js` and `dist/pdf-worker.js`; it never builds, imports, or downloads native artifacts. The pi-career tarball contains no `runtime/`, native binary, `node_modules`, or Pi peer contents and declares no production/optional runtime dependency. Runtime acquisition is an invocation-time resolver route, not an npm lifecycle action.
 
-Package/audit orchestration invokes npm through `process.execPath` plus its derived absolute CLI and uses verified root-owned `/usr/bin/tar`, never PATH-selected npm/tar. Checks sanitize npm tree/severity overrides, reject duplicate decoded JSON keys, enforce exactly four wildcard external peers, verify extracted load/offline failure/install behavior, and require clean production/full audits at `--audit-level=low`. These Unix release gates remain separate from cross-platform runtime acceptance.
+Package/audit orchestration invokes npm through `process.execPath` plus its derived absolute CLI and uses verified root-owned `/usr/bin/tar`, never PATH-selected npm/tar. Checks sanitize npm tree/severity overrides, reject duplicate decoded JSON keys, enforce exactly four wildcard external peers and the macOS/Linux `os` allowlist, verify extracted load/offline failure/install behavior, and require clean production/full audits at `--audit-level=low`. The six-target external acceptance matrix covers every supported macOS/Linux runtime target.
 
-`test:career-package` separately exercises exact-package acquisition, managed Core 0.1.1 compatibility, and representative synthetic resume/job operations. The manually dispatched hosted External Career Compatibility workflow runs that acceptance natively for six release-gate targets: both macOS architectures plus GNU Linux x64/ARM64 and musl Linux x64/ARM64 in the exact pinned Alpine/Node container on native hosts. The macOS arm64 and Linux x64 GNU contexts run the complete release ladder; additional target jobs run build/type/runtime-boundary, exact-package, offline-load, and diff checks appropriate to their native environment. Ordinary pull requests run one required adapter job without external Career package acquisition; maintainers reserve the costly matrix for resolver/contract/platform changes and frozen releases.
+`test:career-package` separately exercises exact-package acquisition, managed Core 0.2.0 compatibility, and representative synthetic resume/job operations. The manually dispatched hosted External Career Compatibility workflow runs that acceptance natively for six release-gate targets: both macOS architectures plus GNU Linux x64/ARM64 and musl Linux x64/ARM64 in the exact pinned Alpine/Node container on native hosts. The macOS arm64 and Linux x64 GNU contexts run the complete release ladder; additional target jobs run build/type/runtime-boundary, exact-package, offline-load, and diff checks appropriate to their native environment. Ordinary pull requests run one required adapter job without external Career package acquisition; maintainers reserve the costly matrix for resolver/contract/platform changes and frozen releases.
 
 A user may register a reviewed clean absolute local path, public Git URL pinned to a full reviewed commit, or exact `npm:pi-career` version. Installing pi-career does not install Career Core through a lifecycle script. At first Core use, a compatible explicit/PATH/package-local route is preferred; otherwise the exact package may be acquired unless offline. Removal unregisters pi-career but does not erase Pi sessions, shell history, npm cache, Git clones, backups, or separately saved results.
 
 ## Provenance
 
-The initial process adapter, tool mappings, synthetic fake executable, process tests, and skill guidance were adapted from Career Core commit `100774ed8bb3b39c019d64ce105af1e3f209144f`. Managed-contract support was aligned with Career Core Phase 8 commit `f6d17835de4817e28ce84e8e5734ff592687dfcc`. The exact Core 0.1.1/eight-target launcher update was reviewed from Career Core commit `0318b3b0993ee23093c8f023757fa7e4d8b3b8e0` and protected publication run `31346152236`. Native distribution and integrity authority belong to exact `@revazi/career@0.1.1`, not pi-career.
+The initial process adapter, tool mappings, synthetic fake executable, process tests, and skill guidance were adapted from Career Core commit `100774ed8bb3b39c019d64ce105af1e3f209144f`. Managed-contract support was aligned with Career Core Phase 8 commit `f6d17835de4817e28ce84e8e5734ff592687dfcc`. The exact Core 0.2.0 six-target launcher contract was reviewed from Career Core commit `536690632884c17336cc3c108f1bba0f254b862b` and protected publication run `31761238274`; pi-career validates its exact ordered six-package v2 manifest while users address only the launcher package. Native distribution and integrity authority belong to exact `@revazi/career@0.2.0`, not pi-career.

package/docs/hardening-validation.md

@@ -0,0 +1,15 @@
+# Product hardening validation
+
+This is a test-evidence index, not a release authorization or claim of production-wire acceptance. Coverage uses synthetic documents, labels, sessions, and temporary workspaces only.
+
+## Black-box evidence
+
+- Terminal presentation and navigation: `tests/workflow/overlay.test.mjs` checks Unicode/theme output at widths 8–120, TUI output at 32/48/80, visible wide-screen navigation hints, keyboard movement, and Escape cancellation. `tests/workflow/document-preview.test.mjs` checks bounded paging and preview clearing.
+- TUI/RPC parity and discoverability: the overlay suite exercises registered commands in both modes, confirmation gates, and no-Core browsing; `tests/workflow/application-concurrency-acceptance.test.mjs` and `tests/workflow/lifecycle-restore-acceptance.test.mjs` cover persisted authority and restart behavior.
+- Collections and resource bounds: `tests/workflow/application-catalog.test.mjs` browses 128 valid synthetic applications and verifies deterministic order and byte-for-byte non-mutation. `tests/workflow/capacity-boundary-matrix.test.mjs` covers root and per-application entry/byte limits; `tests/workflow/scan.test.mjs` covers bounded resume-library collections.
+- Privacy and failure behavior: `tests/workflow/no-automatic-provider-submission.test.mjs`, `tests/workflow/no-private-sentinel-persistence.test.mjs`, and `tests/workflow/payload-free-error-boundaries.test.mjs` instrument forbidden provider/Core/session effects, private sentinels, and stable public failures.
+- Restart, transient-session, branch, lock, crash, and drift cases are exercised by the lifecycle, attachment, concurrency, and workspace acceptance suites under `tests/workflow/`.
+
+## Limitations
+
+These tests provide synthetic local evidence only; they do not establish real-user usability, behavior in every terminal emulator during an actual live resize, production network acceptance, or secure erasure. The 128-application check asserts bounded collection size and deterministic behavior, not a wall-clock SLA. The 0.4.0 candidate's fixture-backed compatibility run passed against the exact reviewed Career Core `v0.2.0` checkout at commit `536690632884c17336cc3c108f1bba0f254b862b`; that is local fixture parity, not production-wire acceptance. Production and full audits plus `check:publish` passed for the prepared candidate with the exact Pi 1.0.2 development suite: its published coding-agent package removes the root shrinkwrap that selected vulnerable `brace-expansion@5.0.9` in 1.0.0 and directly requires `brace-expansion@5.0.12`. This remediates the #149 dependency blocker without an audit baseline, lockfile workaround, policy exception, or claim of release authorization.

package/docs/native-dependency-inventory.md

@@ -2,7 +2,7 @@
 
 ## Status and scope
 
-This is historical reproducible dependency evidence for the two native `career` binaries packaged by pi-career `v0.1.0` and its pre-external-resolver development candidate. Pi-career `v0.2.0` tracks and packages no native binary; native distribution evidence belongs to `@revazi/career`. This document is **not legal advice**, a legal-compliance conclusion, an SPDX/CycloneDX SBOM, or release approval.
+This is historical reproducible dependency evidence for the two native `career` binaries packaged by pi-career `v0.1.0` and its pre-external-resolver development candidate. Pi-career `v0.2.0` and later track and package no native binary; native distribution evidence belongs to `@revazi/career`. This document is **not legal advice**, a legal-compliance conclusion, an SPDX/CycloneDX SBOM, or release approval.
 
 The inventory is pinned to: