cvcite 0.2.0__tar.gz

cvcite-0.2.0/.claude-plugin/marketplace.json

@@ -0,0 +1,15 @@
+{
+  "name": "cvcite",
+  "description": "cvcite: build a truthful, ATS-safe CV from one master YAML file, with skills that interview you, tailor it per role and check your public profiles against it.",
+  "owner": {
+    "name": "Agustin Gonzalez Nicolini",
+    "url": "https://github.com/agusgonzaleznic"
+  },
+  "plugins": [
+    {
+      "name": "cvcite",
+      "source": "./plugin",
+      "description": "Build a truthful, ATS-safe CV from one master YAML file, tailor it per role, and keep LinkedIn, your site and GitHub consistent with it."
+    }
+  ]
+}

cvcite-0.2.0/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @agusgonzaleznic

cvcite-0.2.0/.github/dependabot.yml

@@ -0,0 +1,13 @@
+# Weekly updates for the pinned actions in .github/workflows and action.yml. The workflows
+# `init` writes live under src/ where Dependabot does not look; lint.yml fails when their pins
+# differ from these. The Python lock in requirements/ is regenerated by hand (see its header);
+# Dependabot alerts still cover every package in it.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    # A new release waits a week before Dependabot proposes it.
+    cooldown:
+      default-days: 7
+    schedule:
+      interval: weekly

cvcite-0.2.0/.github/scripts/check-template-pins.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# The workflows `cvcite init` writes live under src/, where Dependabot does not look. Fail when
+# one of them pins an action differently from this repository's own workflows or action.yml, so
+# a Dependabot update here cannot leave the templates behind.
+#
+#   .github/scripts/check-template-pins.sh [templates-dir]
+set -euo pipefail
+templates=${1:-src/cvcite/templates/repo/github/workflows}
+extract() { grep -rhoE 'uses: [^ @#]+@[0-9a-f]{40} # v[^ ]+' "$@" | sed 's/^uses: //' | sort -u; }
+ours=$(extract .github/workflows action.yml)
+theirs=$(extract "$templates")
+fail=0
+compared=0
+while IFS= read -r ref; do
+  [ -n "$ref" ] || continue
+  action=${ref%%@*}
+  mine=$(grep -F "$action@" <<<"$ours" || true)
+  [ -n "$mine" ] || continue
+  compared=$((compared + 1))
+  if ! grep -qxF "$ref" <<<"$ours"; then
+    echo "FAIL template pin '$ref' differs from '$mine'"
+    fail=1
+  else
+    echo "ok   $ref"
+  fi
+done <<<"$theirs"
+if [ "$compared" -eq 0 ]; then
+  echo "FAIL no template pin shares an action with this repository's workflows"
+  exit 1
+fi
+exit "$fail"

cvcite-0.2.0/.github/scripts/verify-action-pins.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Verify that every action referenced in the given workflow files or folders is pinned
+# to a full commit SHA, carries a "# vX.Y.Z" version comment, and that the tag named
+# in the comment resolves to exactly that commit in the action's own repository.
+# Copied from agusgonzaleznic/github-reusable-workflows, extended to several paths.
+#
+#   .github/scripts/verify-action-pins.sh [path...]   (default: .github/workflows)
+#
+# Needs an authenticated gh (GH_TOKEN in CI). Exits non-zero on any unpinned
+# reference, missing comment, unknown tag or mismatch, and also when it finds no
+# references at all, so an empty or misread directory cannot pass.
+set -euo pipefail
+
+if [ "$#" -eq 0 ]; then set -- .github/workflows; fi
+fail=0
+checked=0
+tab=$(printf '\t')
+
+# Print the commit a tag points to, dereferencing annotated tags.
+resolve_tag() {
+  local repo=$1 tag=$2 out type sha
+  out=$(gh api "repos/$repo/git/ref/tags/$tag" --jq '[.object.type, .object.sha] | @tsv') || return 1
+  type=${out%%"$tab"*}
+  sha=${out##*"$tab"}
+  while [ "$type" = tag ]; do
+    out=$(gh api "repos/$repo/git/tags/$sha" --jq '[.object.type, .object.sha] | @tsv') || return 1
+    type=${out%%"$tab"*}
+    sha=${out##*"$tab"}
+  done
+  printf '%s\n' "$sha"
+}
+
+re='uses:[[:space:]]*([^[:space:]@#]+)@([^[:space:]#]+)[[:space:]]*(#[[:space:]]*([^[:space:]]+))?'
+
+while IFS= read -r hit; do
+  file=${hit%%:*}
+  rest=${hit#*:}
+  line=${rest%%:*}
+  text=${rest#*:}
+  [[ $text =~ $re ]] || continue
+  action=${BASH_REMATCH[1]}
+  ref=${BASH_REMATCH[2]}
+  tag=${BASH_REMATCH[4]:-}
+  case $action in ./* | docker://*) continue ;; esac
+  repo=$(cut -d/ -f1-2 <<<"$action")
+  where="$file:$line $action"
+  checked=$((checked + 1))
+  if ! [[ $ref =~ ^[0-9a-f]{40}$ ]]; then
+    echo "FAIL $where: ref '$ref' is not a full commit SHA"
+    fail=1
+    continue
+  fi
+  if [ -z "$tag" ]; then
+    echo "FAIL $where: no version comment after the SHA"
+    fail=1
+    continue
+  fi
+  if ! want=$(resolve_tag "$repo" "$tag"); then
+    echo "FAIL $where: tag $tag not found in $repo"
+    fail=1
+    continue
+  fi
+  if [ "$want" != "$ref" ]; then
+    echo "FAIL $where: $tag is $want, but the pin is $ref"
+    fail=1
+    continue
+  fi
+  echo "ok   $where $tag = $ref"
+done < <(grep -rn -E '^[[:space:]]*-?[[:space:]]*uses:' "$@")
+
+echo "checked $checked pinned action reference(s) in $*"
+if [ "$checked" -eq 0 ]; then
+  echo "FAIL no action references found in $*"
+  exit 1
+fi
+exit "$fail"

cvcite-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,78 @@
+# Tests on every pull request and every push to main, and the action itself run end to end on
+# the made-up sample. Read-only token; nothing is uploaded. Actions are pinned to full commit
+# SHAs with the release in a comment; lint.yml proves each pin.
+
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Tests (Python ${{ matrix.python }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.12", "3.13"]
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install Ghostscript, the gate's third extractor
+        run: |
+          sudo timeout 300 apt-get update
+          sudo timeout 300 apt-get install -y --no-install-recommends ghostscript
+
+      - name: Install the pinned dependencies
+        run: |
+          python -m venv .venv
+          .venv/bin/pip install --quiet --require-hashes --no-deps --only-binary :all: \
+            -r requirements/action.txt -r requirements/test.txt
+
+      - name: Run the tests
+        env:
+          PYTHONPATH: src
+        run: .venv/bin/python -m pytest -q
+
+  action:
+    name: Action on the sample
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check, render, gate and package the sample
+        uses: ./
+        with:
+          working-directory: src/cvcite/templates/sample
+          package: "true"
+          # This repository is public, and the sample person is made up.
+          allow-public: "true"
+
+      - name: The release files are there
+        working-directory: src/cvcite/templates/sample
+        run: |
+          set -euo pipefail
+          unzip -l .tmp/release/build.zip
+          (cd .tmp/release && unzip -q build.zip && sha256sum -c SHA256SUMS)

cvcite-0.2.0/.github/workflows/lint.yml

@@ -0,0 +1,71 @@
+# Lints the workflows and proves every action pin, on every pull request and push to main. The
+# workflows that `cvcite init` writes are linted too, with their placeholder filled in, since
+# they run in every user's repository.
+
+name: Lint
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    env:
+      ACTIONLINT_VERSION: 1.7.12
+      # sha256 of actionlint_1.7.12_linux_amd64.tar.gz, from the release's checksums file
+      ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install actionlint
+        run: |
+          tarball="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          curl -fsSL --max-time 120 -o "$RUNNER_TEMP/$tarball" \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${tarball}"
+          echo "${ACTIONLINT_SHA256}  ${RUNNER_TEMP}/${tarball}" | sha256sum --check --strict
+          tar -xzf "$RUNNER_TEMP/$tarball" -C "$RUNNER_TEMP" actionlint
+
+      - name: Lint this repository's workflows and the ones init writes
+        run: |
+          set -euo pipefail
+          rendered="$RUNNER_TEMP/rendered/.github/workflows"
+          mkdir -p "$rendered"
+          for f in src/cvcite/templates/repo/github/workflows/*.yml; do
+            sed 's|{{ACTION_REF}}|agusgonzaleznic/cvcite@0000000000000000000000000000000000000000 # v0.0.0|' \
+              "$f" > "$rendered/$(basename "$f")"
+          done
+          "$RUNNER_TEMP/actionlint" -color .github/workflows/*.yml "$rendered"/*.yml
+
+  pins:
+    name: Verify action pins
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check every action is pinned to the commit its version comment names
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          .github/scripts/verify-action-pins.sh .github/workflows action.yml \
+            src/cvcite/templates/repo/github/workflows
+
+      - name: Check the workflows init writes pin what this repository pins
+        run: .github/scripts/check-template-pins.sh

cvcite-0.2.0/.gitignore

@@ -0,0 +1,23 @@
+# Python and the toolchain: all regenerable
+.venv/
+.uv-cache/
+.uv-python/
+.uv-tools/
+.pip-cache/
+.cache/
+.pytest_cache/
+.ruff_cache/
+__pycache__/
+*.egg-info/
+dist/
+
+# Build output and scratch. The sample's build lands here, never in git.
+build/
+rendercv_output/
+.tmp/
+.DS_Store
+
+# Never commit a real person's CV or identity documents to this repository. It holds the tool
+# and a made-up sample only; a user's CV lives in their own private repo (`cvcite init`).
+inputs/
+*.private.*

cvcite-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Agustin Gonzalez Nicolini
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

cvcite-0.2.0/PKG-INFO

@@ -0,0 +1,178 @@
+Metadata-Version: 2.5
+Name: cvcite
+Version: 0.2.0
+Summary: Build a CV from one master YAML file and an overlay per target role, and gate every PDF the way applicant tracking systems read it.
+Project-URL: Source, https://github.com/agusgonzaleznic/cvcite
+Author: Agustin Gonzalez Nicolini
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ats,claude-code,cv,rendercv,resume,typst
+Classifier: Environment :: Console
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Office/Business
+Requires-Python: >=3.12
+Requires-Dist: pdfminer-six>=20260107
+Requires-Dist: pypdf>=6.21
+Requires-Dist: rendercv[full]==2.8
+Requires-Dist: ruamel-yaml>=0.19
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == 'test'
+Description-Content-Type: text/markdown
+
+# cvcite
+
+Build your CV from one master YAML file, tailor it for each kind of role with a small overlay,
+and gate every PDF the way applicant tracking systems (ATS) read it. Every claim on the CV traces
+to a fact you confirmed, with its source.
+
+It comes in three parts that work together or alone:
+
+- **A command line** (`cvcite`) that checks, renders and gates your CV. No AI involved.
+- **A Claude Code plugin** whose skills interview you, one multiple-choice question at a time:
+  they turn an old CV or a LinkedIn export into a fact ledger, check every date and claim, tailor
+  the CV for a job posting, and compare LinkedIn, your website and GitHub against it.
+- **A GitHub Action** that builds and gates the CV on every change, publishes the PDFs as a
+  private release when you ask, and can run an AI claim review on pull requests with your own key.
+
+Your CV lives in your own private repository. This one holds the tool and a made-up sample person.
+
+## Why
+
+- **Two CVs drift apart.** Keep one master with every fact; each variant is an overlay that only
+  changes emphasis (headline, summary, bolded words, skills line, which bullets to drop).
+- **CVs overclaim.** Every number on the CV must appear in the fact ledger (`facts.yaml`) with
+  its source, or the build fails. Facts marked `private` can never reach the CV.
+- **A PDF that looks right can read wrong.** Parsers split hyphenated words, lose ligature glyphs,
+  shatter text into one word per line, or read columns in the wrong order. The gate reads each
+  PDF with two to four independent extractors and fails it unless they agree and every bullet
+  survives whole.
+
+## Quick start
+
+You need Python 3.12 or newer (RenderCV 2.8 needs it). [uv](https://docs.astral.sh/uv/) is the easiest way to install;
+Ghostscript is optional (a third extractor for the gate).
+
+```sh
+uv tool install git+https://github.com/agusgonzaleznic/cvcite
+cvcite init my-cv --sample      # try it with the made-up sample; drop --sample to start blank
+cd my-cv
+cvcite build                    # check, render and gate every variant
+```
+
+The PDFs land in `build/<variant>/`, one folder per variant, each holding the file under the same
+name, so a recruiter cannot tell that variants exist. Keep the repository private:
+
+```sh
+git init -b main && git add -A && git commit -m "Start my CV"
+gh repo create my-cv --private --source . --push
+```
+
+## With Claude Code
+
+```text
+/plugin install cvcite --marketplace agusgonzaleznic/cvcite
+```
+
+Or in two steps: `/plugin marketplace add agusgonzaleznic/cvcite`, then
+`/plugin install cvcite@cvcite`.
+
+Then ask in your own words, for example "start my CV from inputs/old-cv.pdf" or "tailor my CV
+for this posting: <link>". The skills:
+
+| Skill | What it does |
+|---|---|
+| `cv-ingest` | Reads your old CV, LinkedIn export or JSON Resume, then builds the fact ledger with you, role by role, before writing the CV |
+| `cv-fact-check` | Runs the checks, then an adversarial reviewer that tries to refute every claim; you settle each finding |
+| `cv-tailor` | Maps a job posting's requirements to your facts, writes an overlay for it, builds and reviews it, and names the gaps honestly |
+| `cv-presence-audit` | Compares LinkedIn, your site and GitHub with the CV, and writes paste-ready texts with character counts |
+| `cv-build` | Explains every gate failure and how to fix it |
+
+The skills follow the open Agent Skills format, so other agents that read `SKILL.md` files can use
+them too; `cvcite init` also writes an `AGENTS.md` with the rules into your CV repository.
+
+The plugin holds only its skills and the reviewer agent, in `plugin/`; the skills run the
+`cvcite` command line you installed above, and ask before installing it if it is missing.
+
+**LinkedIn is read only.** The audit works from LinkedIn's own data export or a profile saved as
+PDF. Nothing signs in to your account or edits it: LinkedIn's terms forbid automated access.
+
+## In GitHub Actions
+
+`cvcite init` writes three workflows into your CV repository:
+
+- `cv.yml` checks, renders and gates every variant on each pull request and each push to `main`.
+- `release.yml` (run by hand) publishes the build as a release you can download anywhere. It
+  refuses to run in a public repository, because the PDFs carry your contact details.
+- `cv-review.yml` runs the claim reviewer on pull requests. It does nothing until you add an
+  `ANTHROPIC_API_KEY` secret, and each run is billed to that key. It sends `AGENTS.md`,
+  `facts.yaml`, `cv.yaml` (contact details included), the overlays and the diff to Anthropic's
+  API; facts in `facts.private.yaml` are never committed, so never sent. The AI can only read
+  the CV files, and its review is posted as plain text. Use a key made for this alone, with a
+  spending limit.
+
+The action runs cvcite from the release you pin, with every Python package taken from a lock
+with its hashes and no package built from source. `init` pins it to that release's full commit
+SHA. The action refuses to build in a repository that is not private; set `allow-public: "true"`
+only for a made-up CV, as this repository does for its sample. These guards stop mistakes;
+anyone who can push to your CV repository can still change its workflows.
+
+## What gets checked
+
+`cvcite check` (no rendering) and every build:
+
+- dates: format, order, future dates, overlaps, gaps over six months
+- every number in a bullet present in a fact of the ledger; none from a `private` fact, and none
+  of the `terms` a private fact lists (keep private facts in `facts.private.yaml`, which git
+  ignores); every fact's visibility one of `public`, `cv-only` or `private`
+- every skill on a skills line backed by a bullet of the same variant
+- an overlay never adds a skill the master lacks
+- only RenderCV's built-in themes, and no render settings that move files: a custom theme runs
+  code from the repository
+- no TODO, no banned character (em dashes by default), no RenderCV trap
+- privacy: no photo, date of birth, nationality, marital status, street address, identity or bank
+  number, or WhatsApp link
+
+The gate, on every PDF:
+
+- the extractors agree on the words and their order, and every bullet appears whole in each
+- no word hyphenated across a line by the typesetter
+- no text layer shattered into single words
+- every glyph plainly filled, in a colour with at least 4.5:1 contrast on white
+- the page count matches the budget in `cvcite.toml`
+
+Each check has a test that plants the defect and proves the check fails on it.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `cvcite init [--sample]` | Creates a CV repository |
+| `cvcite check` | The checks above, without rendering |
+| `cvcite build [variant...]` | Check, render and gate; `-v` prints the full gate report |
+| `cvcite gate <pdf> [yaml]` | Gates one PDF |
+| `cvcite package` | Zips the build with checksums, as a release does |
+| `cvcite ingest <file...>` | Text or data out of a CV (PDF, DOCX, ODT, HTML, Markdown), a LinkedIn export or a JSON Resume |
+| `cvcite compare --linkedin <zip>` | The CV's roles against a LinkedIn export: titles and dates |
+| `cvcite doctor` | Checks the toolchain |
+
+## How it renders
+
+[RenderCV](https://github.com/rendercv/rendercv) turns the YAML into [Typst](https://typst.app)
+and then into the PDF. cvcite renders with ligatures and kerning off: with ligatures on, one
+extractor lost every word containing "ff", "ffi" or "ffl", and with kerning on, another read a
+bold "Airflow" as two words. It also ships the one Typst package RenderCV's template imports and
+switches off RenderCV's check for a newer release (a PyPI request made without verifying TLS),
+so a render makes no network request and writes nothing outside the build.
+
+## Development
+
+```sh
+uv venv --python 3.13 && uv pip install -e ".[test]"
+.venv/bin/python -m pytest
+```
+
+## Licence
+
+MIT. RenderCV is MIT-licensed; the vendored Typst package `fontawesome` 0.6.0 is MIT-licensed,
+with its licence in `src/cvcite/vendor/`.

cvcite-0.2.0/README.md

@@ -0,0 +1,156 @@
+# cvcite
+
+Build your CV from one master YAML file, tailor it for each kind of role with a small overlay,
+and gate every PDF the way applicant tracking systems (ATS) read it. Every claim on the CV traces
+to a fact you confirmed, with its source.
+
+It comes in three parts that work together or alone:
+
+- **A command line** (`cvcite`) that checks, renders and gates your CV. No AI involved.
+- **A Claude Code plugin** whose skills interview you, one multiple-choice question at a time:
+  they turn an old CV or a LinkedIn export into a fact ledger, check every date and claim, tailor
+  the CV for a job posting, and compare LinkedIn, your website and GitHub against it.
+- **A GitHub Action** that builds and gates the CV on every change, publishes the PDFs as a
+  private release when you ask, and can run an AI claim review on pull requests with your own key.
+
+Your CV lives in your own private repository. This one holds the tool and a made-up sample person.
+
+## Why
+
+- **Two CVs drift apart.** Keep one master with every fact; each variant is an overlay that only
+  changes emphasis (headline, summary, bolded words, skills line, which bullets to drop).
+- **CVs overclaim.** Every number on the CV must appear in the fact ledger (`facts.yaml`) with
+  its source, or the build fails. Facts marked `private` can never reach the CV.
+- **A PDF that looks right can read wrong.** Parsers split hyphenated words, lose ligature glyphs,
+  shatter text into one word per line, or read columns in the wrong order. The gate reads each
+  PDF with two to four independent extractors and fails it unless they agree and every bullet
+  survives whole.
+
+## Quick start
+
+You need Python 3.12 or newer (RenderCV 2.8 needs it). [uv](https://docs.astral.sh/uv/) is the easiest way to install;
+Ghostscript is optional (a third extractor for the gate).
+
+```sh
+uv tool install git+https://github.com/agusgonzaleznic/cvcite
+cvcite init my-cv --sample      # try it with the made-up sample; drop --sample to start blank
+cd my-cv
+cvcite build                    # check, render and gate every variant
+```
+
+The PDFs land in `build/<variant>/`, one folder per variant, each holding the file under the same
+name, so a recruiter cannot tell that variants exist. Keep the repository private:
+
+```sh
+git init -b main && git add -A && git commit -m "Start my CV"
+gh repo create my-cv --private --source . --push
+```
+
+## With Claude Code
+
+```text
+/plugin install cvcite --marketplace agusgonzaleznic/cvcite
+```
+
+Or in two steps: `/plugin marketplace add agusgonzaleznic/cvcite`, then
+`/plugin install cvcite@cvcite`.
+
+Then ask in your own words, for example "start my CV from inputs/old-cv.pdf" or "tailor my CV
+for this posting: <link>". The skills:
+
+| Skill | What it does |
+|---|---|
+| `cv-ingest` | Reads your old CV, LinkedIn export or JSON Resume, then builds the fact ledger with you, role by role, before writing the CV |
+| `cv-fact-check` | Runs the checks, then an adversarial reviewer that tries to refute every claim; you settle each finding |
+| `cv-tailor` | Maps a job posting's requirements to your facts, writes an overlay for it, builds and reviews it, and names the gaps honestly |
+| `cv-presence-audit` | Compares LinkedIn, your site and GitHub with the CV, and writes paste-ready texts with character counts |
+| `cv-build` | Explains every gate failure and how to fix it |
+
+The skills follow the open Agent Skills format, so other agents that read `SKILL.md` files can use
+them too; `cvcite init` also writes an `AGENTS.md` with the rules into your CV repository.
+
+The plugin holds only its skills and the reviewer agent, in `plugin/`; the skills run the
+`cvcite` command line you installed above, and ask before installing it if it is missing.
+
+**LinkedIn is read only.** The audit works from LinkedIn's own data export or a profile saved as
+PDF. Nothing signs in to your account or edits it: LinkedIn's terms forbid automated access.
+
+## In GitHub Actions
+
+`cvcite init` writes three workflows into your CV repository:
+
+- `cv.yml` checks, renders and gates every variant on each pull request and each push to `main`.
+- `release.yml` (run by hand) publishes the build as a release you can download anywhere. It
+  refuses to run in a public repository, because the PDFs carry your contact details.
+- `cv-review.yml` runs the claim reviewer on pull requests. It does nothing until you add an
+  `ANTHROPIC_API_KEY` secret, and each run is billed to that key. It sends `AGENTS.md`,
+  `facts.yaml`, `cv.yaml` (contact details included), the overlays and the diff to Anthropic's
+  API; facts in `facts.private.yaml` are never committed, so never sent. The AI can only read
+  the CV files, and its review is posted as plain text. Use a key made for this alone, with a
+  spending limit.
+
+The action runs cvcite from the release you pin, with every Python package taken from a lock
+with its hashes and no package built from source. `init` pins it to that release's full commit
+SHA. The action refuses to build in a repository that is not private; set `allow-public: "true"`
+only for a made-up CV, as this repository does for its sample. These guards stop mistakes;
+anyone who can push to your CV repository can still change its workflows.
+
+## What gets checked
+
+`cvcite check` (no rendering) and every build:
+
+- dates: format, order, future dates, overlaps, gaps over six months
+- every number in a bullet present in a fact of the ledger; none from a `private` fact, and none
+  of the `terms` a private fact lists (keep private facts in `facts.private.yaml`, which git
+  ignores); every fact's visibility one of `public`, `cv-only` or `private`
+- every skill on a skills line backed by a bullet of the same variant
+- an overlay never adds a skill the master lacks
+- only RenderCV's built-in themes, and no render settings that move files: a custom theme runs
+  code from the repository
+- no TODO, no banned character (em dashes by default), no RenderCV trap
+- privacy: no photo, date of birth, nationality, marital status, street address, identity or bank
+  number, or WhatsApp link
+
+The gate, on every PDF:
+
+- the extractors agree on the words and their order, and every bullet appears whole in each
+- no word hyphenated across a line by the typesetter
+- no text layer shattered into single words
+- every glyph plainly filled, in a colour with at least 4.5:1 contrast on white
+- the page count matches the budget in `cvcite.toml`
+
+Each check has a test that plants the defect and proves the check fails on it.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `cvcite init [--sample]` | Creates a CV repository |
+| `cvcite check` | The checks above, without rendering |
+| `cvcite build [variant...]` | Check, render and gate; `-v` prints the full gate report |
+| `cvcite gate <pdf> [yaml]` | Gates one PDF |
+| `cvcite package` | Zips the build with checksums, as a release does |
+| `cvcite ingest <file...>` | Text or data out of a CV (PDF, DOCX, ODT, HTML, Markdown), a LinkedIn export or a JSON Resume |
+| `cvcite compare --linkedin <zip>` | The CV's roles against a LinkedIn export: titles and dates |
+| `cvcite doctor` | Checks the toolchain |
+
+## How it renders
+
+[RenderCV](https://github.com/rendercv/rendercv) turns the YAML into [Typst](https://typst.app)
+and then into the PDF. cvcite renders with ligatures and kerning off: with ligatures on, one
+extractor lost every word containing "ff", "ffi" or "ffl", and with kerning on, another read a
+bold "Airflow" as two words. It also ships the one Typst package RenderCV's template imports and
+switches off RenderCV's check for a newer release (a PyPI request made without verifying TLS),
+so a render makes no network request and writes nothing outside the build.
+
+## Development
+
+```sh
+uv venv --python 3.13 && uv pip install -e ".[test]"
+.venv/bin/python -m pytest
+```
+
+## Licence
+
+MIT. RenderCV is MIT-licensed; the vendored Typst package `fontawesome` 0.6.0 is MIT-licensed,
+with its licence in `src/cvcite/vendor/`.