trackly-cli 0.7.0 → 0.7.2

package/README.md

@@ -171,6 +171,7 @@ Then use natural language in any of these clients:
 | trackly_get_profile_onboarding | Get schema plus missing questions |
 | trackly_update_application_profile | Save scoped answers with optimistic concurrency |
 | trackly_start_apply_run | Start a manual-submit browser run |
+| trackly_get_apply_evidence | Get aggregate, value-free beta evidence and release readiness |
 | trackly_get_apply_protocol | Get current workflow and compatibility rules |
 | trackly_report_apply_observation | Send redacted ATS mechanics feedback |
 | trackly_record_application_outcome | Record review or confirmed submission outcome |
@@ -249,7 +250,7 @@ Install trackly-cli (`npm install -g trackly-cli`), authenticate with `trackly l
 
 **What MCP servers exist for job searching?**
 
-trackly-cli includes a built-in MCP server with 21 tools for job search, company lookup, application tracking, profile onboarding, and manual-submit form preparation. Run `trackly mcp` or use `trackly agent setup --client claude`.
+trackly-cli includes a built-in MCP server with 22 tools for job search, company lookup, application tracking, profile onboarding, beta evidence, and manual-submit form preparation. Run `trackly mcp` or use `trackly agent setup --client claude`.
 
 **How do I use Claude Code for job hunting?**
 

package/bin/trackly

@@ -39,6 +39,8 @@ const VALUE_FLAGS = new Set([
   'sort',
   'status',
   'url',
+  'window-days',
+  'target-reviewed-runs',
 ]);
 
 // Flags accepted on ANY command. `api-key`/`base-url` are global overrides consumed
@@ -75,7 +77,7 @@ const COMMAND_FLAGS = {
   'request-company': ['url', 'notes'],
   'api-key': ['name'],
   config: ['api-key', 'base-url', 'clear-api-key', 'clear-base-url'],
-  agent: ['client'],
+  agent: ['client', 'window-days', 'target-reviewed-runs'],
 };
 const AUTH_HELP_TEXT = `Not authenticated.
   Option 1: trackly login                        (Google OAuth)
@@ -995,7 +997,52 @@ async function cmdAgent(args) {
     console.log(report.browserControl.note);
     return;
   }
-  failNow('Unknown agent subcommand. Use: trackly agent setup --client codex|claude|both | trackly agent doctor');
+  if (subcommand === 'evidence') {
+    const parseBoundedInteger = (value, fallback, flag, maximum) => {
+      if (value === undefined) return fallback;
+      if (value === null || !/^\d+$/.test(String(value))) {
+        failNow(`${flag} must be an integer from 1 to ${maximum}.`);
+      }
+      const parsed = Number(value);
+      if (!Number.isInteger(parsed) || parsed < 1 || parsed > maximum) {
+        failNow(`${flag} must be an integer from 1 to ${maximum}.`);
+      }
+      return parsed;
+    };
+    const windowDays = parseBoundedInteger(args['window-days'], 90, '--window-days', 365);
+    const targetReviewedRuns = parseBoundedInteger(
+      args['target-reviewed-runs'],
+      20,
+      '--target-reviewed-runs',
+      1000,
+    );
+    try {
+      const result = await apiRequest(
+        'GET',
+        `/api/jobscout/apply/evidence?windowDays=${windowDays}&targetReviewedRuns=${targetReviewedRuns}`,
+      );
+      if (isJSON()) return printJson(result);
+      const report = result.report;
+      console.log(color('bold', 'Trackly Apply evidence'));
+      console.log(`Window: last ${report.windowDays} days`);
+      console.log(`Reviewed: ${report.summary.reviewedRuns}/${report.targetReviewedRuns}; submitted=${report.summary.submittedRuns}; blocked=${report.summary.blockedRuns}`);
+      if (report.summary.excludedLegacyRuns) {
+        console.log(`Excluded pre-evidence runs: ${report.summary.excludedLegacyRuns}`);
+      }
+      console.log(`Critical contact integrity: ${report.evidence.criticalContact.coveragePercent}% (${report.evidence.criticalContact.verifiedRuns}/${report.summary.reviewedRuns}); corrected=${report.evidence.criticalContact.correctedRuns}; unresolved=${report.evidence.criticalContact.unresolvedFailureRuns}`);
+      console.log(`Manual-submit boundary: ${report.evidence.manualSubmitBoundary.coveragePercent}% (${report.evidence.manualSubmitBoundary.verifiedRuns}/${report.summary.reviewedRuns}); violations=${report.evidence.manualSubmitBoundary.violationRuns}`);
+      for (const provider of report.providers) {
+        console.log(`${provider.provider}: reviewed=${provider.reviewedRuns}; submitted=${provider.submittedRuns}; blocked=${provider.blockedRuns}`);
+      }
+      console.log(`Release gate: ${color(report.releaseGate.ready ? 'green' : 'yellow', report.releaseGate.ready ? 'ready' : 'not ready')}`);
+      if (report.releaseGate.blockers.length) console.log(`Blockers: ${report.releaseGate.blockers.join(', ')}`);
+      return;
+    } catch (error) {
+      setApiErrorExit(error, 'Failed to fetch Trackly Apply evidence');
+      return;
+    }
+  }
+  failNow('Unknown agent subcommand. Use: trackly agent setup --client codex|claude|both | trackly agent doctor | trackly agent evidence');
 }
 
 function showHelp() {
@@ -1036,6 +1083,7 @@ ${color('bold', 'Commands:')}
   ${color('cyan', 'mcp')}                  Start MCP server
   ${color('cyan', 'agent setup')}          Install Trackly Apply for Codex/Claude (--client codex|claude|both)
   ${color('cyan', 'agent doctor')}         Verify auth, MCP, skill, profile, resume, and compatibility
+  ${color('cyan', 'agent evidence')}       Show value-free beta evidence (--window-days, --target-reviewed-runs)
 
 ${color('bold', 'Flags:')}
   --api-key <key>       Use an API key for this command

package/contracts/trackly-apply-tools.json

@@ -1,11 +1,16 @@
 {
-  "contractVersion": "3.0.0",
+  "contractVersion": "3.2.0",
+  "constants": {
+    "applyScenarioCodes": ["browser_reclaim", "resume_upload", "resume_parser_recheck", "semantic_boolean_commit", "custom_select_commit", "multi_step_navigation", "free_text_voice", "required_error_sweep", "final_consent", "handoff_reclaim", "critical_contact_integrity", "manual_submit_boundary", "job_identity_match"],
+    "applyBrowserSurfaces": ["codex_in_app", "chrome_extension", "claude_in_chrome"]
+  },
   "tools": {
     "trackly_get_apply_queue": "{limit:z.number().int().min(1).max(100).optional()}",
     "trackly_get_application_profile": "{includeSensitive:z.boolean().optional(),provider:z.string().max(100).optional(),companyId:z.string().max(100).optional()}",
     "trackly_get_profile_onboarding": "{}",
     "trackly_update_application_profile": "{expectedRevision:z.number().int().min(1),source:z.enum(['web','ios','macos','codex','claude','mcp']).optional(),changes:z.array(z.discriminatedUnion('scope',[z.object({key:z.string().min(1).max(200),state:z.enum(['unknown','answered','intentionally_blank','declined']),value:z.any().optional(),scope:z.literal('global'),questionLabel:z.string().max(1000).optional()}),z.object({key:z.string().min(1).max(200),state:z.enum(['unknown','answered','intentionally_blank','declined']),value:z.any().optional(),scope:z.literal('provider'),scopeValue:z.string().min(1).max(200),questionLabel:z.string().max(1000).optional()}),z.object({key:z.string().min(1).max(200),state:z.enum(['unknown','answered','intentionally_blank','declined']),value:z.any().optional(),scope:z.literal('company'),scopeValue:z.string().min(1).max(200),questionLabel:z.string().max(1000).optional()})])).max(100).optional(),education:z.array(z.object({school:z.string().min(1).max(500),degree:z.string().max(500).nullable().optional(),fieldOfStudy:z.string().max(500).nullable().optional(),gpa:z.string().max(50).nullable().optional(),startDate:z.string().max(50).nullable().optional(),endDate:z.string().max(50).nullable().optional()})).max(20).optional(),confirmProfile:z.boolean().optional(),sensitiveStorageConsent:z.boolean().optional()}",
     "trackly_start_apply_run": "{jobId:z.number().int().min(1),clientName:z.string().max(100).optional()}",
+    "trackly_get_apply_evidence": "{windowDays:z.number().int().min(1).max(365).optional(),targetReviewedRuns:z.number().int().min(1).max(1000).optional()}",
     "trackly_get_apply_protocol": "{}",
     "trackly_report_apply_observation": "{runId:z.number().int().min(1),provider:z.string().regex(SAFE_OBSERVATION_CODE),fieldLabel:z.string().min(1).max(1000),observationType:z.string().regex(SAFE_OBSERVATION_CODE),resolutionCode:z.string().regex(SAFE_OBSERVATION_CODE).optional(),metadata:z.object({controlType:z.string().regex(SAFE_OBSERVATION_CODE).optional(),required:z.boolean().optional(),errorCode:z.string().regex(SAFE_OBSERVATION_CODE).optional(),committed:z.boolean(),scenarioCode:z.enum(APPLY_SCENARIO_CODES),browserSurface:z.enum(APPLY_BROWSER_SURFACES),browserBindingHash:z.string().regex(/^[a-f0-9]{64}$/).optional(),resumedAfterHandoff:z.boolean().optional()})}",
     "trackly_record_application_outcome": "{runId:z.number().int().min(1),outcome:z.enum(['review_ready','submitted','failed','blocked']),confirmation:z.string().max(500).optional()}",

package/docs/trackly-tools.md

@@ -93,13 +93,14 @@ You can also pass `TRACKLY_API_KEY` as an environment variable for one-off runs.
 - **trackly_get_profile_onboarding** — Get backend-owned questions plus only missing/unconfirmed answers.
 - **trackly_update_application_profile** — Save explicit answer states with optimistic concurrency and global/provider/company scope.
 - **trackly_start_apply_run** — Start a manual-submit browser run for a queued job.
+- **trackly_get_apply_evidence** — Get the authenticated user's aggregate beta evidence and release gate without returning profile answers or contact values.
 - **trackly_get_apply_protocol** — Get the current ATS support, browser integrity rules, and compatible skill version.
 - **trackly_report_apply_observation** — Report redacted ATS mechanics and actual scenario coverage without answer values or page text.
 - **trackly_record_application_outcome** — Record review readiness or a confirmed manual submission.
 - **trackly_prepare_resume** — Local MCP only: materialize the default resume in a private, expiring mode-0600 cache and return filename, size, SHA-256, exact local path, and visual-confirmation metadata. Hosted MCP returns a manual/local-agent requirement.
 - **trackly_verify_prepared_resume** — Local MCP only: immediately before attachment, recompute the user-confirmed resume hash and size, validate the exact path/run/expiration, and lock the file read-only. Any mismatch requires a fresh preview and confirmation.
 
-Apply contract v3 intentionally gives this verifier different local and hosted schemas: local MCP receives the full proof needed to inspect the private file, while hosted MCP accepts only run and confirmation identifiers and returns the manual/local-agent requirement. Local paths and fingerprints are never sent to the hosted verifier. Version 3 also requires explicit committed-state evidence on every Apply observation.
+Apply contract v3 intentionally gives this verifier different local and hosted schemas: local MCP receives the full proof needed to inspect the private file, while hosted MCP accepts only run and confirmation identifiers and returns the manual/local-agent requirement. Local paths and fingerprints are never sent to the hosted verifier. Version 3.1 also records universal value-free evidence for critical-contact integrity and the manual-submit boundary. Version 3.2 authorizes the exact stored HTTPS origin for jobs Trackly ingested from employer careers sources, without granting redirect, iframe, or hostname-suffix privileges.
 
 ### Maintenance behavior
 

package/lib/agent.js

@@ -7,13 +7,13 @@ const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 const { apiRequest, downloadFile, getConfigPaths, hasAuth, maintenanceOutput } = require('./client');
 const { version: PACKAGE_VERSION } = require('../package.json');
-const SKILL_VERSION = '4.0.0';
+const SKILL_VERSION = '4.1.1';
 const CLI_USER_AGENT = `trackly-cli/${PACKAGE_VERSION}`;
 const MCP_USER_AGENT = `trackly-mcp/${PACKAGE_VERSION}`;
 
 const SKILL_NAME = 'trackly-apply';
 const SKILL_MAJOR = Number(SKILL_VERSION.split('.')[0]);
-const MIN_APPLY_PROTOCOL_VERSION = '3.0.0';
+const MIN_APPLY_PROTOCOL_VERSION = '3.1.0';
 const CACHE_TTL_MS = 2 * 60 * 60 * 1000;
 const MANAGED_FILE = '.trackly-managed.json';
 const RESUME_PROOF_FILE = '.trackly-resume-proof.json';

package/mcp/server.js

@@ -7,16 +7,13 @@ const { z } = require('zod');
 const { apiRequest, hasAuth, maintenanceOutput } = require('../lib/client');
 const { prepareResume, verifyPreparedResume } = require('../lib/agent');
 const { version: PACKAGE_VERSION } = require('../package.json');
+const APPLY_CONTRACT = require('../contracts/trackly-apply-tools.json');
 
 const MCP_USER_AGENT = `trackly-mcp/${PACKAGE_VERSION}`;
 const MCP_MAINTENANCE_ERROR_CODE = -32002;
 const AUTH_HINT = 'Run `trackly login` or set TRACKLY_API_KEY. Get a key at https://usetrackly.app (sign in → Settings → API Keys).';
-const APPLY_BROWSER_SURFACES = ['codex_in_app', 'chrome_extension', 'claude_in_chrome'];
-const APPLY_SCENARIO_CODES = [
-  'browser_reclaim', 'resume_upload', 'resume_parser_recheck', 'semantic_boolean_commit',
-  'custom_select_commit', 'multi_step_navigation', 'free_text_voice',
-  'required_error_sweep', 'final_consent', 'handoff_reclaim',
-];
+const APPLY_BROWSER_SURFACES = APPLY_CONTRACT.constants.applyBrowserSurfaces;
+const APPLY_SCENARIO_CODES = APPLY_CONTRACT.constants.applyScenarioCodes;
 const SAFE_OBSERVATION_CODE = /^[a-z0-9][a-z0-9_:-]{0,99}$/;
 
 // Mirrors `granola-followup-app/src/services/region-classifier.ts:8` REGION_TAGS.
@@ -437,6 +434,23 @@ function createServer() {
     wrapTool(async (params) => apiRequest('POST', '/api/jobscout/apply/runs', params, false, false, MCP_USER_AGENT), 'Failed to start apply run')
   );
 
+  server.tool(
+    'trackly_get_apply_evidence',
+    'Get the authenticated user\'s aggregate, value-free Apply beta evidence and release gate. The report never returns answers, contact values, addresses, or page text.',
+    {
+      windowDays: z.number().int().min(1).max(365).optional(),
+      targetReviewedRuns: z.number().int().min(1).max(1000).optional(),
+    },
+    wrapTool(async ({ windowDays, targetReviewedRuns }) => {
+      const qs = new URLSearchParams();
+      if (windowDays !== undefined) qs.set('windowDays', String(windowDays));
+      if (targetReviewedRuns !== undefined) qs.set('targetReviewedRuns', String(targetReviewedRuns));
+      const query = qs.toString();
+      const suffix = query ? `?${query}` : '';
+      return apiRequest('GET', `/api/jobscout/apply/evidence${suffix}`, null, false, false, MCP_USER_AGENT);
+    }, 'Failed to fetch apply evidence')
+  );
+
   server.tool(
     'trackly_get_apply_protocol',
     'Get the current browser workflow, ATS support matrix, integrity rules, and compatible public-skill major version. Fetch at the start of every run and again after maintenance before resuming the existing run.',
@@ -512,7 +526,13 @@ function createServer() {
       role: 'user',
       content: {
         type: 'text',
-        text: 'Fetch the Trackly Apply protocol, profile onboarding, profile, and approved queue. Resolve missing answers with me. Before starting anything, stop on every non-null executionBlocker and every manual_only item. Start only the selected approved queue item, require major(run.protocolVersion) === major(protocol.version), require protocol.compatibleSkillMajor === 4, preserve the stored version for a resumed run, and require its provider, atsCapability, required scenarios, and originPolicy to match the queue preflight. Reclaim semantic browser control, verify the exact job/run/tab binding, hash that value-free binding, and report the same-run browser_ready attestation with committed=true. Before entering private data, normalize every page, redirect, and data-receiving iframe URL; accept an exact authorized origin or hostname only when host === allowedDomain or host.endsWith("." + allowedDomain), never by substring or page text. For vendor-hosted ATS pages, execute the backend-owned originPolicy.tenantRule exactly after every redirect or data-receiving iframe change, including its extraction, exact-host-depth, locale, percent-decoding, normalization, and fail-closed semantics, then require the normalized result to equal originPolicy.verifiedAtsTenant; never invent or reinterpret a strategy token. Obey every capability stop condition. Determine whether the form has a semantically identified Resume or CV attachment control. Only when that specific control exists, prepare the run-bound resume locally with that browser surface and binding hash, show me its exact path, filename, size, SHA-256, run, and expiration, and obtain my explicit confirmation. Treat cover-letter, portfolio, transcript, and other supporting-document controls separately according to the profile and protocol; never upload a resume to them. Immediately before attaching the resume, use the local verifier to validate the signed proof, recompute hash and size, check expiration, and lock the file read-only. Fill the form through semantic controls, verify committed values and every required error, and report a same-run passed or corrected scenario_coverage observation with committed=true for every backend-required scenario except browser_reclaim, which is satisfied only by browser_ready with the binding hash. If a required scenario cannot pass, record blocked rather than review_ready. Stop before Submit. If maintenance interrupts the run, retain the run and browser context, wait for the advertised window, refetch protocol, queue, and profile state, and resume the existing agent_browser run. Never start a duplicate run, blindly retry a mutation, enter credentials or verification codes, evade human verification, or click Submit.',
+        text: 'Compatibility gate: before starting a new run, require the fetched Trackly Apply protocol to be version 3.1.0 or newer. After trackly_start_apply_run returns, or before resuming an existing run, require the returned or stored run.protocolVersion to be version 3.1.0 or newer. Never continue or replace a pre-evidence 3.0.x run; preserve it, record it blocked when possible, and stop for supported lifecycle cleanup.',
+      },
+    }, {
+      role: 'user',
+      content: {
+        type: 'text',
+        text: 'Fetch the Trackly Apply protocol, profile onboarding, profile, and approved queue. Resolve missing answers with me. Treat required completeness separately from optional reusable coverage and employer-specific contextual questions. Before starting anything, stop on every non-null executionBlocker and every manual_only item. Start only the selected approved queue item, require major(run.protocolVersion) === major(protocol.version), require protocol.compatibleSkillMajor === 4, preserve the stored version for a resumed run, and require its provider, atsCapability, required scenarios, and originPolicy to match the queue preflight. Reclaim semantic browser control, verify the exact job/run/tab binding, hash that value-free binding, and report the same-run browser_ready attestation with committed=true. Before entering private data, require the visible company and role to match the run binding and, when available, the requisition identifier to match the stored job URL. When job_identity_match is required, report a value-free committed scenario_coverage attestation only after that visible identity check passes; never include the company, role, URL, requisition identifier, page text, or any profile value in that observation. On exact-origin fallback, revalidate the frozen company, role, and available requisition identity after every navigation or redirect and before entering any additional private data. Normalize every page, redirect, and data-receiving iframe URL; accept an exact authorized origin or hostname only when host === allowedDomain or host.endsWith("." + allowedDomain), never by substring or page text. When originPolicy.verification is trackly_employer_source_exact_origin, authorize only the exact origin in authorizedOrigins: never promote it to a host suffix and never carry it across a redirect or iframe origin change. For every other vendor-hosted ATS policy, require both originPolicy.tenantRule and originPolicy.verifiedAtsTenant to be non-null or stop before private data entry. Execute the backend-owned originPolicy.tenantRule exactly after every redirect or data-receiving iframe change, including its extraction, exact-host-depth, locale, percent-decoding, normalization, and fail-closed semantics, then require the normalized result to equal originPolicy.verifiedAtsTenant; never invent or reinterpret a strategy token. Obey every capability stop condition. Determine whether the form has a semantically identified Resume or CV attachment control. Only when that specific control exists, prepare the run-bound resume locally with that browser surface and binding hash, show me its exact path, filename, size, SHA-256, run, and expiration, and obtain my explicit confirmation. Treat cover-letter, portfolio, transcript, and other supporting-document controls separately according to the profile and protocol; never upload a resume to them. Immediately before attaching the resume, use the local verifier to validate the signed proof, recompute hash and size, check expiration, and lock the file read-only. Fill the form through semantic controls, verify committed values and every required error, and report a same-run passed or corrected scenario_coverage observation with committed=true for every backend-required scenario except browser_reclaim, which is satisfied only by browser_ready with the binding hash. Before every review_ready outcome, also report value-free committed critical_contact_integrity and manual_submit_boundary evidence; never include contact values, answers, page text, or local paths. If a required or universal review scenario cannot pass, record blocked rather than review_ready. Stop before Submit. If maintenance interrupts the run, retain the run and browser context, wait for the advertised window, refetch protocol, queue, and profile state, and resume the existing agent_browser run. Never start a duplicate run, blindly retry a mutation, enter credentials or verification codes, evade human verification, or click Submit.',
       },
     }],
   }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackly-cli",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "mcpName": "io.github.trackly-app/trackly",
   "description": "AI job search CLI + hosted MCP server with OAuth. 128K+ jobs, 1,900+ companies, 40+ ATS. Works with Claude, ChatGPT, Cursor, Windsurf, Codex via hosted streamable-http or local stdio.",
   "bin": {
@@ -58,11 +58,9 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
+    "hono": "^4.12.30",
     "zod": "^3.23.0"
   },
-  "overrides": {
-    "hono": "^4.12.25"
-  },
   "engines": {
     "node": ">=18"
   }

package/server.json

@@ -17,12 +17,12 @@
       ]
     }
   ],
-  "version": "0.7.0",
+  "version": "0.7.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "trackly-cli",
-      "version": "0.7.0",
+      "version": "0.7.2",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {

package/skills/trackly-apply/SKILL.md

@@ -19,8 +19,8 @@ Use Trackly as the source of truth for profile answers, documents, queue decisio
 
 ## Start every run
 
-1. Call `trackly_get_apply_protocol`. Skill 4.0 requires protocol major 3 (version 3.0.0 or newer) and `compatibleSkillMajor: 4`. Reject an older or incompatible major and report that the backend must finish updating or `trackly agent setup` must update the skill. This breaking gate prevents a pre-guided-mode skill or run from being reused under the stronger cross-ATS contract.
-2. Call `trackly_get_profile_onboarding` or fetch both the profile schema and application profile. Ask only unknown or unconfirmed fields.
+1. Call `trackly_get_apply_protocol`. Skill 4.1 requires protocol major 3 (version 3.1.0 or newer) and `compatibleSkillMajor: 4`. Reject an older or incompatible version and report that the backend must finish updating or `trackly agent setup` must update the skill. This gate prevents a pre-evidence skill or run from being reused under the stronger cross-ATS contract. Protocol 3.2 adds exact-origin trust for jobs Trackly ingested directly from employer careers sources; do not recreate the retired ownership-timestamp gate in the client.
+2. Call `trackly_get_profile_onboarding` or fetch both the profile schema and application profile. Treat `completeness.percent` as required onboarding readiness only. Use `coverage.missingReusableKeys` to explain reusable optional gaps, while `coverage.contextualKeys` are intentionally asked only on the relevant employer form. Do not claim that 100% required completeness answers every possible application question.
 3. Save answers with `trackly_update_application_profile`:
    - Use `answered`, `intentionally_blank`, `declined`, or `unknown` exactly.
    - If the user says “always,” save globally.
@@ -37,10 +37,11 @@ Use Trackly as the source of truth for profile answers, documents, queue decisio
 5. Call `trackly_get_apply_queue`. Select deterministically unless the user names a job. Do not replace the queue call with a fresh job search.
    - Use the queue item's backend-owned `atsCapability`, `originPolicy`, and `executionBlocker`. Never infer a stronger support claim from the page design or the LLM's familiarity with a provider. Required scenarios are backend-enforced gates; possible scenarios are reported only when actually exercised.
    - Stop before `trackly_start_apply_run` whenever `executionBlocker` is non-null. `standard` runs use the provider playbook. `guided` runs are allowed only while semantic browser state remains observable, `originPolicy.authorized` is true, and every published stop condition is obeyed. `manual_only` items stop without starting or mutating a run.
+   - When `originPolicy.verification` is `trackly_employer_source_exact_origin`, Trackly has authorized the exact stored HTTPS origin from its direct employer-careers ingestion. Do not demand a separate ownership timestamp, ATS tenant, or company-domain suffix. This authorization never extends to another origin, hostname suffix, redirect, or iframe. The queue/run will require `job_identity_match`; pass it only after the browser visibly confirms the frozen company, role, and available requisition identity. Revalidate that identity after every navigation or redirect and before entering any additional private data.
    - If the user requests the next `N` jobs, freeze the deterministic ordered set of exactly `N` job IDs before starting any run. Do not replace, rescore, or expand that approved batch.
    - For each fixed batch member, preserve an explicit job ID -> application run ID -> browser tab mapping. Complete the full start -> conditional resume preparation/confirmation/verification when an upload control exists -> form completion -> `review_ready` lifecycle for every member. A review-ready run does not block the next member. Never submit any of them.
 6. Call `trackly_start_apply_run` for the selected job or current fixed batch member. Reuse an active run returned by Trackly; never create a replacement run because browser control was interrupted.
-   - Require `run.protocolVersion` to share protocol major 3 with the fetched protocol. A resumed run may retain an older compatible 3.x patch/minor version; preserve that exact run and let the backend bind observations and resume proof to its stored version. Stop on a major mismatch. Compare `run.atsCapability` and `run.originPolicy` with the queue values. Stop and refetch the protocol and queue if support level, execution mode, provider, required scenarios, or authorized origin policy changed between preflight and run creation.
+   - Require `run.protocolVersion` to be 3.1.0 or newer and to share protocol major 3 with the fetched protocol. Never continue a pre-evidence 3.0.x run under skill 4.1. Preserve that run instead of starting a replacement, record it `blocked` with a value-free protocol-upgrade reason when possible, and tell the user the saved job can be retried only after the stale run is cleared through Trackly's supported lifecycle. Compare `run.atsCapability` and `run.originPolicy` with the queue values. Stop and refetch the protocol and queue if support level, execution mode, provider, required scenarios, or authorized origin policy changed between preflight and run creation.
    - In guided mode, inspect the page before preparing any resume bytes. Confirm the employer, role, HTTPS origin, reachable review path, semantic controls, whether an attachment control exists, and absence of a credential, verification, CAPTCHA, or submit-only wall. A missing file input is not itself a blocker; skip the resume path when the application has no attachment control. Any other failed precondition is an execution blocker, not permission to improvise.
 7. Pass the browser readiness gate before preparing resume bytes:
    - Use semantic browser control through Codex in-app browser controls, Chrome MCP/extension browser control, or Claude in Chrome.
@@ -78,7 +79,7 @@ Read [references/ats-playbook.md](references/ats-playbook.md) for the detected A
 
 Follow this order:
 
-1. Open the application in the controlled browser context and confirm the employer, role, ATS host, and HTTPS URL. Before entering private data, parse and normalize the URL, then require the exact origin to equal an `originPolicy.authorizedOrigins` entry or the normalized hostname to satisfy `host === allowedDomain` or `host.endsWith("." + allowedDomain)` for an allowed ATS suffix or verified company domain. Never use substring, display-text, logo, or suffix-without-a-dot matching. For a vendor-hosted ATS, execute the backend-owned declarative `originPolicy.tenantRule` exactly, including its extraction, exact-host-depth, locale, percent-decoding, normalization, and fail-closed semantics, then require the normalized result to equal `originPolicy.verifiedAtsTenant`; never invent or reinterpret a strategy token. Revalidate both origin and tenant after every redirect and apply the same policy to every iframe that receives private data. Stop on any unmatched origin or tenant, malformed percent encoding, missing rule, or rule shape the client cannot execute exactly.
+1. Open the application in the controlled browser context and confirm the employer, role, ATS host, and HTTPS URL. Before entering private data, require the visible company and role to match the run binding and, when the stored URL exposes one, require the requisition identifier to match. When `job_identity_match` is required, immediately report its value-free committed `scenario_coverage` proof after this check passes; never include company, role, URL, requisition, or page text in the observation. On exact-origin fallback, revalidate the frozen company, role, and available requisition identity after every navigation or redirect and before entering any additional private data. Parse and normalize the URL, then require the exact origin to equal an `originPolicy.authorizedOrigins` entry or the normalized hostname to satisfy `host === allowedDomain` or `host.endsWith("." + allowedDomain)` for an allowed ATS suffix or verified company domain. Never use substring, display-text, logo, or suffix-without-a-dot matching. When `verification` is `trackly_employer_source_exact_origin`, accept only the exact listed origin; never convert it into a hostname suffix or carry it across a redirect or iframe origin change. For every other vendor-hosted ATS policy, require both `originPolicy.tenantRule` and `originPolicy.verifiedAtsTenant` to be non-null; stop before private data entry if either is missing. Execute the backend-owned declarative tenant rule exactly, including its extraction, exact-host-depth, locale, percent-decoding, normalization, and fail-closed semantics, then require the normalized result to equal `originPolicy.verifiedAtsTenant`; never invent or reinterpret a strategy token. Revalidate both origin and tenant after every redirect and apply the same policy to every iframe that receives private data. Stop on any unmatched origin or tenant, malformed percent encoding, missing required rule, or rule shape the client cannot execute exactly.
 2. Inspect the whole form and identify required fields, semantic controls, consent controls, document inputs, and multi-step sections.
 3. When an attachment control exists, only after the exact-hash visual confirmation and a successful immediate pre-attach `trackly_verify_prepared_resume` check, upload the prepared resume before autofill when parsing may overwrite contact fields. Do not change the file between verification and attachment. Verify that the filename chip exactly matches the prepared resume’s user-facing filename and contains no internal cache identifier. Stop and replace the attachment if it does not. When no attachment control exists, skip resume preparation and upload without treating that absence as an error.
 4. Fill typed fields from the resolved Trackly profile. Clear parser-filled data when the canonical state is intentionally blank.
@@ -92,7 +93,15 @@ Follow this order:
 
 When the user corrects an answer, immediately save the appropriate scope with `trackly_update_application_profile` and report only a redacted mechanics observation through `trackly_report_apply_observation`. Never promote one user’s value into a global default. For `generic_web_form`, never save provider-scoped answers; use company scope for form-specific answers.
 
-For every run, track only scenarios actually exercised. Attest `browser_reclaim` once with the same-run `observationType: browser_ready`, exact binding hash, browser surface, and `metadata.committed: true`; do not send a duplicate `scenario_coverage` row for it. Before `review_ready`, report every other exercised scenario with `observationType: scenario_coverage`, the stable scenario code, browser surface, `metadata.committed: true` for `passed` or `corrected`, and whether the tab was resumed after handoff. Every required scenario must have the corresponding same-run committed evidence. If any required scenario is missing, uncommitted, or blocked, record the run as `blocked` instead of `review_ready`. Never include answer values or page text. Include the actual scenario coverage in the final handoff; do not claim unobserved coverage.
+For every run, track only scenarios actually exercised, except the two universal review proofs below. Attest `browser_reclaim` once with the same-run `observationType: browser_ready`, exact binding hash, browser surface, and `metadata.committed: true`; do not send a duplicate `scenario_coverage` row for it. Before `review_ready`, report every other exercised scenario with `observationType: scenario_coverage`, the stable scenario code, browser surface, `metadata.committed: true` for `passed` or `corrected`, and whether the tab was resumed after handoff.
+
+Always report both universal evidence scenarios before every `review_ready` outcome:
+
+- `critical_contact_integrity`: inventory all email, phone, country-code, and other required contact controls; verify every present canonical field exactly after parsing/autofill; confirm no required contact control is omitted, duplicated, concatenated, placeholder-only, or visibly errored. If the form truly has no such control, pass only after the whole-form inventory proves none is required. Use `corrected` when any contact field needed repair.
+- `manual_submit_boundary`: prove the live form is at its final review state, the Submit control is present or the ATS has an equivalent clearly identified boundary, and the agent did not activate it. A submit-only transition that cannot be inspected does not pass.
+- `job_identity_match` (conditional): for exact-origin fallback runs, prove the visible company, role, and available requisition identity match the frozen Trackly job before entering private data. Report only value-free metadata.
+
+Every required scenario and both universal evidence scenarios must have corresponding same-run committed evidence. If any is missing, uncommitted, or blocked, record the run as `blocked` instead of `review_ready`. Never include email, phone, applicant name, answer values, page text, or local paths in observations. Include the actual scenario coverage in the final handoff; do not claim unobserved coverage. Use `trackly_get_apply_evidence` or `trackly agent evidence` when the user asks for aggregate beta proof; never reconstruct a report from private chat content.
 
 ## Review handoff
 
@@ -112,5 +121,5 @@ After the user submits manually:
 - `best_effort` means use the named playbook and stop if browser and accessibility state disagree.
 - `guided` means the provider or employer-hosted page may be completed only through observable semantic controls. Obey every published stop condition; stop on login credentials, OTP/email verification, CAPTCHA/human verification, unexpected origin/employer, submit-only navigation, or unobservable committed state.
 - `blocked` / `manual_only` means do not start or mutate an application. LinkedIn-hosted applications are manual-only. If Trackly already stores a separate external application URL, evaluate that stored URL as its own ATS/origin; do not request or invent a URL override that the run cannot bind.
-- Unknown employer forms use the protocol's `unknownAtsFallback` only when the queue supplies an authorized, verified company-domain origin policy. An unmatched or unverified HTTPS page is manual-only, not guided, and is never promoted to `full` by the agent.
+- Unknown employer forms use the protocol's `unknownAtsFallback` only when the queue supplies an authorized verified-company origin or `trackly_employer_source_exact_origin` policy. Exact-origin authorization stays exact. An unmatched or unverified HTTPS page is manual-only, not guided, and is never promoted to `full` by the agent.
 - Launch support: Codex and Claude Code on macOS with browser control and computer use available.

package/skills/trackly-apply/references/ats-playbook.md

@@ -40,7 +40,7 @@ This group includes SmartRecruiters, Workable, BambooHR, Recruitee, Jobvite, Tea
 
 ## Unknown employer-hosted form
 
-- Use only when the protocol resolves the run to `generic_web_form` in guided mode and supplies `originPolicy.authorized: true` with `verification: verified_employer_domain`.
+- Use only when the protocol resolves the run to `generic_web_form` in guided mode and supplies `originPolicy.authorized: true` with `verification: verified_employer_domain` or `trackly_employer_source_exact_origin`. The latter authorizes only the exact stored origin.
 - Inventory every step, origin transition, control type, required error, file input, and review/submit boundary before any upload.
 - Never claim provider support from visual similarity. Stop if any critical control cannot be observed semantically.
 

package/skills/trackly-apply/references/form-integrity.md

@@ -12,8 +12,9 @@ Run this gate after each semantic selection and again across the entire form bef
 ## Page and website-type inventory
 
 - Before entering private data on a guided or unknown form, enumerate the current HTTPS origin, every visible step, any iframe origins, all file inputs, and the control that advances toward review. Require every data-receiving origin to match the backend-supplied run `originPolicy`; page text, logos, and employer names are not origin proof.
+- When the run requires `job_identity_match`, confirm the visible company, role, and available requisition identity against the frozen run before entering private data, then report only the value-free committed scenario code. Revalidate that identity after every navigation or redirect and before entering any additional private data. A mismatch blocks the run.
 - Distinguish `Next`, `Continue`, `Save`, `Review`, and `Submit` by accessible name and observed behavior. If the only way to reveal the next state is a submit-like mutation, stop for manual review.
-- Treat navigation to a different origin as a new trust boundary. Reconfirm employer, role, and requisition, then parse and normalize the redirected URL. An exact origin may equal an `authorizedOrigins` entry; hostname policies match only when `host === allowedDomain` or `host.endsWith("." + allowedDomain)`. Never accept substring, display-text, or `notexample.com` / `example.com.evil.test` lookalikes. On a vendor-hosted ATS, the shared origin is insufficient: execute the backend-owned declarative `originPolicy.tenantRule` exactly after every redirect or data-receiving iframe change, including extraction, exact host depth, optional locale, percent decoding, normalization, and every fail-closed condition. Compare the normalized result to `originPolicy.verifiedAtsTenant`. Never guess the meaning of an opaque strategy token. Unmatched redirects, tenants, malformed encoding, missing or unexecutable rules, and iframe origins are manual-only.
+- Treat navigation to a different origin as a new trust boundary. Reconfirm employer, role, and requisition, then parse and normalize the redirected URL. An exact origin may equal an `authorizedOrigins` entry; hostname policies match only when `host === allowedDomain` or `host.endsWith("." + allowedDomain)`. Never accept substring, display-text, or `notexample.com` / `example.com.evil.test` lookalikes. `trackly_employer_source_exact_origin` authorizes only the stored exact origin and grants no suffix, redirect, or iframe privilege. On every other vendor-hosted ATS policy, the shared origin is insufficient: require both `originPolicy.tenantRule` and `originPolicy.verifiedAtsTenant`, then execute the backend-owned declarative rule exactly after every redirect or data-receiving iframe change, including extraction, exact host depth, optional locale, percent decoding, normalization, and every fail-closed condition. Compare the normalized result to `originPolicy.verifiedAtsTenant`. Never guess the meaning of an opaque strategy token. Unmatched redirects, tenants, malformed encoding, missing required or unexecutable rules, and iframe origins are manual-only.
 - Treat an authentication wall as a user handoff. Never enter, retrieve, store, or infer credentials.
 
 ## Semantic controls
@@ -35,6 +36,7 @@ Run this gate after each semantic selection and again across the entire form bef
 - Read both DOM input state and macOS accessibility state.
 - Reject duplicate or concatenated values, autofill overlays, placeholder-only text, and values present only in a custom wrapper.
 - Recheck when navigation, resume parsing, or a correction banner rerenders the form.
+- Before review, inventory every email, phone, country-code, and required contact control. Pass `critical_contact_integrity` only when all present canonical values are exact and no required contact field was omitted. A form with no contact control passes only after the whole-form inventory confirms none exists or is required.
 
 ## Final sweep
 
@@ -45,6 +47,8 @@ Run this gate after each semantic selection and again across the entire form bef
 5. Verify resume filename, education dates, links, and all critical contact fields again.
 6. Confirm the Submit button is present but do not click it.
 
+After the final sweep, pass `manual_submit_boundary` only when the live final-review state is observable and no Submit-equivalent control was activated. Report both universal evidence scenarios with value-free metadata before recording `review_ready`.
+
 If any field’s committed state cannot be observed, fail the gate and explain which field needs manual review.
 
 ## Submission-state reconciliation

package/skills/trackly-apply/references/review-handoff.md

@@ -19,6 +19,7 @@ Education:
 EEO / consent choices:
 Custom answers:
 Integrity sweep: pass/fail
+Manual-submit boundary verified: yes/no
 Actual scenario coverage:
 Items requiring your attention:
 

package/skills/trackly-apply/references/scenario-coverage.md

@@ -30,6 +30,11 @@ For each exercised scenario, call `trackly_report_apply_observation` with:
 - `required_error_sweep`: every required field and visible error surface was checked.
 - `final_consent`: the final certification, acknowledgement, or consent control was verified.
 - `handoff_reclaim`: the browser tab was reclaimed after a context or control handoff.
+- `critical_contact_integrity`: every present canonical contact control was exact after parsing/autofill and the form inventory proved that no required contact field was omitted.
+- `manual_submit_boundary`: the agent reached an observable final review boundary and stopped without activating Submit or its equivalent.
+- `job_identity_match`: on an exact-origin fallback run, the visible company, role, and available requisition identity matched the frozen Trackly job before private data entry.
+
+`critical_contact_integrity` and `manual_submit_boundary` are universal review proofs and must be reported for every review-ready run. Their observations are value-free: never include email, phone, applicant name, answer values, page text, or local paths. `job_identity_match` is required only when the queue/run includes it; its value-free observation must also omit company, role, URL, and requisition.
 
 ## Final reporting