pi-career 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## Unreleased
 
+## 0.4.0 - 2026-10-04
+
+### Added
+
+- Implemented application-workspace Gate 1 behind user-only no-argument TUI/RPC `/career-workspace`: explicit strict config-v1-to-v2 migration, one existing owner-only disjoint application root, marker attach/detach, immutable application manifest and append-only status/workflow-original-vacancy/selected-original revisions, and read-only crash/drift reconciliation.
+- Added canonical complete editor previews plus separate confirmation, config/inode compare-and-swap, exact config/root locks, no-clobber hard-link publication, bounded limits, private modes, sync/settlement, idempotency, payload-free failures, and synthetic macOS/Linux filesystem coverage for Gate 1.
+- Added the separately authorized application-workspace transaction for user-authored Markdown/plain-text cover letters: an unchanged exact preview, distinct persistence confirmation, and ordinary workspace-mutation approval precede immutable no-clobber artifact/state publication; view and clear preserve validated history, and no assisted drafting, Core/provider/network call, or submission occurs.
+
+### Changed
+
+- Updated the exact lockfile-pinned Pi development suite to 1.0.2, including compatibility coverage for Pi's structured working-directory prompt section and default interactive-mode entry point; the four Pi-provided runtime packages remain wildcard external peers. Pi 1.0.2 removes the vulnerable development shrinkwrap selection of `brace-expansion@5.0.9`, and the strict full audit and publication-readiness check pass with `brace-expansion@5.0.12`.
+- Preserved first-run and v1 compatibility: ordinary setup may safely bootstrap only private `career/`, absent/v1 ordinary mutations continue writing canonical v1, only confirmed workspace-root configuration migrates to v2, and every later writer preserves v2 plus its optional application-root binding while freshly rejecting root overlap.
+- Documented that Gate 1 performs no Core/runtime/provider/model/network/child/session-append action and does not implement assisted workspace artifacts, deletion, broader application files, repair, adoption, archive, or sync. The separate `/career-save` workflow is unchanged.
+- When a persistent application is attached, `/career-vacancy`, `/career-match`, `/career-analyze`, `/career-workbench`, and `career_run context` use workspace files as the only current vacancy/Resume authority: cancelled vacancy saves change neither workspace nor session, match uses the effective Resume, analyze uses only the selected original, and workbench/assistance never auto-submit.
+- Attached `/career-application` shows and updates workspace lifecycle only through a previewed file mutation, and `/career-application clear` detaches without a competing session-only status or vacancy.
+- TUI `/career` is application-first: Applications and Resumes are the only top-level destinations, while Setup, job description, Analyze, Match, Workspace, and Ask Pi are contextual routes/actions. The existing `/career-*` commands remain direct compatibility routes with breadcrumb-aware Back/Escape behavior; Left/Right or Tab switches destinations, and `a` still attaches only after confirmation without activating assistance. Overlay navigation does not call Core or a provider.
+- One Career view model now owns views, items, selection, detail, and attach. TUI overlay and RPC hierarchical select/confirm dialogs are only renderers of that model; those slash commands only choose the starting view, leftover command-specific menus are gone, and opening/browsing never attaches or calls Core.
+- Setup and library views can add a resume root after confirmation (`n` in TUI, Add root in RPC). The action writes config only, reloads the shared model, and does not attach, call Core, or create files.
+- TUI Career overlay now renders a centered, margin-separated, theme-compatible rounded Unicode modal frame with connected separators, consistent interior padding, explicit breadcrumbs/current state/recommended action/safe alternatives, concise contextual hints, and local help. ANSI/Unicode rows and exact previews are measured against the padded inner width, while a terminal-derived row budget preserves the frame and footer and scrolls only content; long catalogs keep selection visible and detail/help support Up/Down scrolling.
+- Overlay/RPC Career UI can create an application, rescan or remove a library root, run analyze/match, edit a vacancy, update status, and open Gate 1 workspace management from the shared view model. Opening and browsing still never attach or call Core; those actions stay confirmation-gated.
+- Overlay empty states, session-created applications, analyze/match result rows, Ask Pi, detach, and vacancy clear stay on the shared view model so `/career` can run as an in-Pi application without leftover command menus.
+- Attached applications can select and immutably bind one eligible original Resume from Library, Analyze, or Match (`o` in TUI) through the existing exact preview and separate confirmation flow. Attached Analyze/Match no longer fall back to an unbound library Resume, and assisted variants remain ineligible.
+- Legacy Applications rows can finish identity-only migration without a matching session or attachment after separately entering exact labels, reviewing exact canonical bytes, and confirming no-clobber publication; list/open, cancellation, drift, and losing concurrent plans remain no-write.
+
 ## 0.3.0 - 2026-08-14
 
 ### Breaking

package/NOTICE

@@ -15,7 +15,7 @@ notices belong to the separately installed or acquired exact
 bundled by pi-career v0.1.0 remains in docs/native-dependency-inventory.md and
 docs/releasing.md but is not part of the current runtime boundary.
 
-Searchable PDF text extraction bundles unpdf 1.8.0, Copyright (c) 2023-PRESENT
+Searchable PDF text extraction bundles unpdf 1.8.1, Copyright (c) 2023-PRESENT
 Johann Schopplich, under the MIT License preserved at
 docs/unpdf-LICENSE-MIT.txt. Its bundled serverless PDF.js implementation is
 derived from Mozilla PDF.js and is distributed under the Apache License 2.0,

package/README.md

@@ -12,6 +12,7 @@ The package's command handlers do not call a model/provider. `/career-workbench`
 It gives you:
 
 - local slash commands for setting up a resume library, analyzing originals, and matching them to a vacancy;
+- a user-only `/career-workspace` flow for an explicitly configured private application root, immutable status/vacancy revisions, selected-original digest binding, and read-only reconciliation;
 - one compact managed agent tool, `career_run`, for guided work after the deterministic baseline;
 - a visible workbench handoff that never sends private resume text until you review and submit it yourself;
 - bounded TUI inspection and explicit selection of Core-reviewed non-PDF changes without automatic materialization;
@@ -20,12 +21,20 @@ It gives you:
 
 Career Core remains authoritative for scores, evidence, warnings, uncertainty, matching, and proposal review. `pi-career` owns the Pi workflow and presentation layer; it does not reimplement Career Core algorithms or schemas.
 
-> **Version note:** this README describes the `pi-career@0.3.0` candidate. Published `pi-career@0.2.0` is the prior native-free release, and `pi-career@0.1.0` is the historical bundled-runtime release. Until `0.3.0` is explicitly released and visible on the npm registry, use a reviewed local checkout or pinned Git commit.
+> **Version note:** this documentation describes `pi-career@0.4.0`. The prior native-free release is `pi-career@0.3.0`; `pi-career@0.2.0` is the earlier native-free release, and `pi-career@0.1.0` is the historical bundled-runtime release.
+
+### `/career` application mode
+
+`/career` is a modal application inside Pi, not a prompt that enters the agent loop. It locally lists persistent applications in deterministic order, supports text and lifecycle filters, creates and opens applications, displays the three-component package checklist and derived readiness, and exposes explicit attachment and lifecycle actions. A valid attached application opens directly in detail; browsing another application never attaches it. Existing `/career-application` and `/career-workspace` commands remain compatible fallbacks.
+
+Opening, browsing, filtering, viewing readiness, and inspecting bounded local details use only local extension state. Explicit deterministic analysis or matching invokes Career Core locally without invoking a model. None of those actions submits a message, appends a session entry merely for navigation, or places Resume, job-description, application, or Core-result content in model context.
+
+Model assistance begins only after the user selects an explicit assistance action, reviews the visible editor handoff, and submits it through normal Pi interaction. Persistent application attachment, Career-specific model-context activation, provider submission, and file mutation remain separate decisions. Ordinary sessions expose no Career Skill path or Career tool schema until a valid assistance-activation record is present and its path-free attachment pointer revalidates.
 
 ## Requirements
 
 - Node.js 22.19 or newer
-- Pi with 0.84.0-compatible package APIs
+- Pi with 1.0.0-compatible package APIs
 - macOS or Linux on ARM64/x64; GNU Linux requires glibc 2.35+, and musl Linux is supported
 - either a compatible local `career` executable or network access for first-use acquisition of exact `@revazi/career@0.2.0`
 
@@ -33,14 +42,14 @@ Windows is unsupported. npm enforces the package `os` allowlist; for a local or
 
 ## Install
 
-After the registry confirms the release, install the exact version:
+Install the exact reviewed version:
 
 ```bash
-pi install npm:pi-career@0.3.0
+pi install npm:pi-career@0.4.0
 pi list
 ```
 
-For release-candidate testing, a clean checkout includes reproducible `dist/index.js` and `dist/pdf-worker.js` bundles, so local installation does not require a build or npm install:
+For local-checkout testing, a clean checkout includes reproducible `dist/index.js` and `dist/pdf-worker.js` bundles, so local installation does not require a build or npm install:
 
 ```bash
 cd /absolute/path/to/pi-career
@@ -149,7 +158,7 @@ In Pi, run:
 /career-setup
 ```
 
-Choose **Add root** and enter the resume directory. Setup stores the canonical root in private local Pi configuration; it does not copy, move, or edit your resumes.
+Choose **Add root** and enter the resume directory. Setup stores the canonical root in private local Pi configuration; it does not copy, move, or edit your resumes. On first ordinary setup, pi-career may create only the missing agent-directory-relative `career/` config directory as canonical effective-user-owned `0700` beneath the existing canonical Pi agent directory. It never adopts or chmods a pre-existing unsafe object. Workspace configuration remains stricter and requires that private config directory to exist before `/career-workspace` begins.
 
 Setup also displays a preferred `variants/` destination. This is suggestion-only: it creates no directory or file and does not authorize a save.
 
@@ -190,6 +199,8 @@ Then set the vacancy:
 
 Paste the vacancy text directly. `pi-career` never fetches a vacancy URL. Career Core validates the text before it becomes the current vacancy.
 
+If you want the separate Gate 1 local application record, prepare an existing private `0700` directory outside every resume/variation root, then run `/career-workspace`. Configure the root and initialize the current application only after reviewing and confirming each exact mutation. This is optional and does not save an assisted resume.
+
 ### 6. Match your originals
 
 ```text
@@ -214,7 +225,7 @@ For a non-PDF tailored variation, `career_run variant-review` ends the agent tur
 
 ## Slash command reference
 
-The workflow commands below require interactive TUI/RPC mode except `/career-vacancy clear`; `/career-review` is TUI-only, `/career-save` supports TUI/RPC, and `/career-tools` is a lightweight tool-surface switch. Slash-command handlers do not invoke a model/provider. `/career-workbench` and `/career-review` prepare editor prompts whose later user submission does. Core-backed commands may resolve or acquire the external runtime before processing private input.
+The workflow commands below require interactive TUI/RPC mode except `/career-vacancy clear`; `/career-review` is TUI-only, `/career-save` and no-argument `/career-workspace` support TUI/RPC, and `/career-tools` is a lightweight tool-surface switch. Slash-command handlers do not invoke a model/provider. `/career-workbench` and `/career-review` prepare editor prompts whose later user submission does. Core-backed commands may resolve or acquire the external runtime before processing private input.
 
 ### `/career-setup [status]`
 
@@ -261,6 +272,23 @@ After clearing—or before working on another company/role—run `/new`. The sam
 
 This command manages session state only. It does not create workspace folders or application files.
 
+### `/career-workspace`
+
+Open the user-only TUI/RPC application-workspace menu. The command accepts no arguments and is not available as a model tool. Print/JSON modes fail before reading config, session-private data, or workspace files.
+
+Gate 1 can:
+
+- show read-only status and classify drift, interrupted initialization, or crash-left locks/temporary files without repair;
+- explicitly configure one already-existing canonical owner-only `0700` application root, creating or validating its private package marker;
+- initialize the current active application at a package-derived direct-child path with immutable manifest and exact private display-identity metadata;
+- append an immutable full state revision for current status, exact workflow-original vacancy bytes, vacancy clear, or a freshly scanned selected-original digest binding;
+- write or revise a separately authorized user-authored Markdown/plain-text cover letter when a current vacancy and effective resume exist, view the current validated artifact, or clear its current reference while retaining immutable history;
+- detach the root from config without changing the marker or any application file.
+
+Every mutation displays a complete canonical preview in the editor, requires the preview to return byte-identically, and then requires a separate confirmation. Writing a cover letter also requires a distinct persistence confirmation before the ordinary workspace-mutation approval; cancellation writes nothing. Configuration and workspace files use owner-only modes, locks, bounded no-clobber publication, sync, and fail-closed identity/disjointness checks. Application roots must remain physically disjoint in both directions from every resume-library root and variation-root suggestion.
+
+Workspace files outlive `/career-application clear`, `/new`, session deletion, transient shutdown, detach, package removal, and status `closed`. Gate 1 does **not** save an assisted resume, delete a workspace/root/application, copy or modify an original, save Core/provider output, create assisted cover-letter content, or create notes, `changes.md`, interview files, PDF/DOCX artifacts, repair, adoption, archive, or sync behavior. The cover-letter transaction accepts only content authored by the user in the local editor; it does not call Career Core, a model/provider, or the network, and it does not submit the letter. `/career-save` remains a separate resume-library variation workflow with independent consent.
+
 ### `/career-vacancy [clear]`
 
 Set, inspect, replace, or clear the current vacancy.
@@ -400,7 +428,7 @@ When raw mode is explicitly enabled, discovery-first use remains mandatory: capa
 3. package-local exact `@revazi/career@0.2.0`;
 4. bounded acquisition of exact `@revazi/career@0.2.0` from the canonical npm registry.
 
-Runtime installation is separate from loading the local Pi package. `/career-setup`, `/career-library`, `/career-application`, `/career-workbench`, and `/career-review` itself do not resolve or invoke Core; `/career-review` requires a still-live review produced earlier by `career_run`. `/career-vacancy`, `/career-analyze`, `/career-match`, `career_run`, and the raw tools do need Core.
+Runtime installation is separate from loading the local Pi package. `/career-setup`, `/career-library`, `/career-application`, `/career-workspace`, `/career-workbench`, and `/career-review` itself do not resolve or invoke Core; `/career-review` requires a still-live review produced earlier by `career_run`. `/career-vacancy`, `/career-analyze`, `/career-match`, `career_run`, and the raw tools do need Core.
 
 Extension initialization requires macOS or Linux and fails unsupported platforms with one payload-free `unsupported_platform` error before registering any command/tool or doing route work. Before private document stdin opens on a supported platform, the selected executable must pass the exact managed Career Core 0.2.0 operation and schema compatibility checks. An invalid explicit `CAREER_CLI_PATH` fails without fallback.
 
@@ -431,7 +459,8 @@ Use `pi --no-session` when you do not want a new Pi session JSONL. In a persiste
 
 Possible persistence surfaces are distinct:
 
-- **Package config:** canonical resume-root paths, bounded labels, and an optional variation-directory suggestion; never resume text, vacancy text, or full Core output.
+- **Package config:** canonical resume-root paths, bounded labels, an optional variation-directory suggestion, and an optional application-root UUID/path binding; never resume text, vacancy text, or full Core output.
+- **Application workspace files:** an exact root marker, immutable non-content manifest, immutable bounded company/role display identity, append-only state metadata, exact explicitly approved workflow-original vacancy snapshots, selected-original digests, and separately approved user-authored Markdown/plain-text cover-letter revisions; no selected-original bytes, Core result, provider response, prompt, credential, session ID, or environment value.
 - **Pi session:** consent, application/vacancy workflow entries, bounded result cards, and potentially tool arguments/results or submitted workbench messages.
 - **Model provider:** only content you submit through ordinary Pi model interaction; `/career-workbench` makes the private payload visible before submission, while `/career-review` prepares only an ephemeral handle and selected canonical IDs.
 - **Approved local variant files:** exact assisted Markdown/text bytes plus bounded marker/sidecar metadata only after `/career-save` preview and confirmation; never full Core JSON.
@@ -439,19 +468,19 @@ Possible persistence surfaces are distinct:
 
 `pi-career` does not create payload/result temporary files, export full Core JSON, overwrite originals, or automatically save assisted resumes. Explicit `/career-save` files are local, private-mode, assisted/non-authoritative, and excluded from analysis/matching. Searchable PDF extraction is local, bounded, and network-disabled.
 
-See [`SECURITY.md`](SECURITY.md), [`docs/design.md`](docs/design.md), and [`docs/product-flow.md`](docs/product-flow.md) for the complete boundary and threat model.
+See [`SECURITY.md`](SECURITY.md), [`docs/design.md`](docs/design.md), and [`docs/product-flow.md`](docs/product-flow.md) for the complete boundary and threat model. Synthetic hardening evidence and its limitations are indexed in [`docs/hardening-validation.md`](docs/hardening-validation.md).
 
 ## Current limitations
 
 - Supported original formats: searchable PDF, Markdown, and UTF-8 text.
 - No OCR, DOCX/Pages editing, vacancy URL fetching, or PDF layout reconstruction.
-- No automatic resume or application-workspace saving; explicit materialized-variant saving is private Markdown/text only on supported macOS/Linux filesystems.
+- No automatic resume saving. Application workspaces persist only explicitly previewed status/vacancy/original bindings and the separate confirmation-gated user-authored Markdown/plain-text cover-letter revisions; assisted resume artifacts and package deletion remain unimplemented separate gates.
 - PDF workbench output is targeted manual guidance only.
 - Assisted variants remain non-authoritative and cannot be reranked as originals.
 - Matching is conservative workflow guidance, not a hiring prediction or proprietary ATS simulation.
 - Supported runtime targets are `darwin-arm64`, `darwin-x64`, `linux-x64-gnu`, `linux-arm64-gnu`, `linux-x64-musl`, and `linux-arm64-musl`; Windows is unsupported.
 
-The future application-workspace contract is documented in [`docs/application-workspaces.md`](docs/application-workspaces.md); those filesystem-writing phases are not implemented.
+Application-workspace Gate 1, the separately authorized user-authored cover-letter transaction, and the still-unimplemented assisted-resume/deletion protocols are documented in [`docs/application-workspaces.md`](docs/application-workspaces.md) and [`docs/cover-letter-contract.md`](docs/cover-letter-contract.md). Neither implemented workflow authorizes or implies Gates 2–4.
 
 ## Development
 
@@ -490,6 +519,16 @@ CAREER_CORE_FIXTURE_ROOT=/absolute/path/to/reviewed/career-core \
 
 The exact reviewed external runtime coordinate is [`@revazi/career@0.2.0`](https://www.npmjs.com/package/@revazi/career/v/0.2.0), published from Career Core commit [`536690632884c17336cc3c108f1bba0f254b862b`](https://github.com/revazi/career-core/tree/536690632884c17336cc3c108f1bba0f254b862b). Its launcher owns native target/libc selection and package metadata, provenance, file invariants, size, format, and SHA-256 verification. Registry integrity and SLSA v1 provenance were reviewed for the user-facing launcher and all six lockstep native packages. Pi-career validates that exact six-package v2 manifest and supports only its macOS/Linux targets.
 
+Published `pi-career` v0.3.0 coordinates are retained for verification:
+
+- npm: [`pi-career@0.3.0`](https://www.npmjs.com/package/pi-career/v/0.3.0)
+- Git commit: [`2c0da9ff623b50cc02a7b5bccd3cb047596d947e`](https://github.com/revazi/pi-career/tree/2c0da9ff623b50cc02a7b5bccd3cb047596d947e)
+- npm integrity: `sha512-u/odRK/KMYXhIt/lvGm93RFmQIwBQZV0qbAf1vs/GsNH8Fx/X2f+p+F1iyUYtMi5RH9++SkdhEN8CR2XBScyBw==`
+- npm shasum: `3ad37db78cb76330838fbb3efe722c1cff4d8d00`
+- same-SHA six-target compatibility: [run `31791011739`](https://github.com/revazi/pi-career/actions/runs/31791011739)
+- OIDC publication and registry verification: [run `31791158472`](https://github.com/revazi/pi-career/actions/runs/31791158472)
+- GitHub Release: [`v0.3.0`](https://github.com/revazi/pi-career/releases/tag/v0.3.0), with no custom assets
+
 Historical published `pi-career` v0.1.0 coordinates are retained for verification:
 
 - npm: [`pi-career@0.1.0`](https://www.npmjs.com/package/pi-career/v/0.1.0)

package/SECURITY.md

@@ -30,7 +30,7 @@ The process adapter creates no career payload/result temporary file and performs
 
 `/career-vacancy`, `/career-match`, and `/career-analyze` use the same helper; setup/library scanning and application state remain local. `/career-workbench` does not call a provider, model, or Core process; it only prepares a bounded ordinary Pi editor message containing selected private source. Nothing is sent automatically. If submitted, Pi may persist it and send it to the selected provider.
 
-Global config stores only canonical root paths, bounded labels, and an optional variation-directory suggestion in an agent-directory-relative `0700` directory with atomic `0600` writes. Scans are bounded, UTF-8 strict, and symlink-free. Searchable PDFs are limited to 10 MiB and 20 pages and parsed in a package-owned worker with fixed time, memory, and result ceilings. Network fetch, eval, WASM, streaming, auto-fetch, and system-font lookup are disabled; OCR is not performed. Source text and full Core results are never written to global config or logs.
+Global config stores only canonical resume-root paths, bounded labels, an optional variation-directory suggestion, and an optional application-root UUID/path binding. First ordinary setup may create only the missing agent-directory-relative `career/` directory as canonical effective-user-owned `0700` beneath an existing canonical Pi agent directory; pre-existing unsafe objects are never adopted or chmodded, and workspace configuration requires that private directory already exist. Owner-only `0600` config locks plus byte/inode compare-and-swap protect writes. Ordinary absent/v1 mutations remain canonical v1 while no workspace is attached; only confirmed **Configure application root** migrates to strict v2, after which every writer preserves v2 and freshly rejects physical overlap. Scans are bounded, UTF-8 strict, and symlink-free. Searchable PDFs are limited to 10 MiB and 20 pages and parsed in a package-owned worker with fixed time, memory, and result ceilings. Network fetch, eval, WASM, streaming, auto-fetch, and system-font lookup are disabled; OCR is not performed. Source text and full Core results are never written to global config or logs. User-only no-argument `/career-workspace` Gate 1 may separately persist a non-content root marker/manifest, append-only full status metadata, exact explicitly approved workflow-original vacancy bytes, and selected-original digests under one existing owner-only `0700` root disjoint from every resume/variation root. Every mutation requires unchanged complete preview plus separate confirmation and uses bounded private no-clobber publication; workspace actions invoke no Core/runtime/provider/model/network/child process and append no session entry. Assisted workspace artifacts, deletion, repair/adoption/archive/sync, and broader files are not implemented.
 
 Only a strictly shaped, bounded, allowlisted `career.error.v1` may cross a known nonzero Core failure. Other failures expose stable payload-free `career.pi_error.v1`. Runtime code must not log or expose source/result text, raw errors, stderr, executable paths, hashes, platform details, environment values, npm diagnostics, or credentials.