/apply and /rank state that postings are untrusted third-party data,
never instructions. Ten other specs that fetch or read such content did
not: /scrape ingested portal CLI output and WebSearch results with no
rule, /gmail-sync classified inbound email - the input anyone can send -
with none, and /setup Path A read the verbatim archived posting and
email-quoting outcome notes and wrote calibration into
04-job-evaluation.md, which every later /apply and /rank loads.
Each spec now points at the Trust boundary section of 09-web-research.md
instead of copying it. /gmail-sync gains Important Rule 10 (no link
fetched, no attachment opened, no reply, draft, label or forward), and
/setup Step A3 never copies archive wording into a skill file.
The new test derives the set of specs from the tools they call, so a
future fetching command without the rule fails CI. On master it lists
all ten.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Both commands told the model to add to "Strongest Behavioral Traits" and
"How I Work Best" / "How [Candidate] Works Best" while also saying "match
existing structure", but the shipped file's headings are "Strongest
Behaviors" and "How You Work Best", so an inferred trait either opened a
duplicate near-identical section or was dropped.
The companion to #519, which fixed the same drift in /reset's skeleton.
Both bullets now name the shipped headings, and a derived test in each
command's suite reads the quoted section names and requires each to be a
## heading of the shipped file; both fail on master.
Adds four contributions from @Michael-Bach:
- /setup_docs - document-driven profile population from a documents/ folder (CV, LinkedIn export, diplomas, references, past applications). Idempotent merge with explicit additive vs. conflicting buckets and per-conflict prompts.
- /reset - typed-RESET confirmation gate for clearing profile data and/or documents folder contents.
- /expand - additive competency enrichment from documents and public URLs already in the profile (GitHub repos, portfolio sites), with web-searched syllabus lookups for named courses and certifications.
- /upskill - skill-gap analysis vs tracked jobs (or single URL), produces a prioritized heatmap and learning plan with year-tagged WebSearch queries.
Also adds the documents/ folder convention with README and gitignore entries for personal output files.
Closes#6
