Opt-in crowd-learning: report what worked/moved/broke on a source (kind: success | drift | break) to improve the next pack version.

Version + capability handshake: server version, registered tools, and the load-bearing invariants the client must respect.

Create a new profile (made active) and return it. patch is the intake fields (name, titles, sectors, work mode, …).

Return the active profile (or a given one), JSON fields parsed.

Apply a partial update. With no profile_id, updates the active profile — or creates it if the user has none yet (the /setup path).

List the user's profiles (the active one has is_active=1).

Switch the active profile.

Append quantified wins (each needs a metric) to the achievements bank.

Capture the user's writing voice so drafts sound like them.

Apply client-LLM-extracted structured fields (LinkedIn/GitHub/portfolio) to the active profile, recording the source url for provenance. Call ONLY after preview_url_import + human CONFIRM — this tool writes.

Read-only LinkedIn/GitHub/portfolio import preview (S5.4).

YOU open the URL in the user's browser and paste the visible page text.
The server never fetches. Returns the same contact + setup_hints shape as
parse_cv plus source_url. Does NOT write — CONFIRM with the human, then
import_from_url_findings(url, confirmed_fields).

Per-source search playbooks for the active profile — the URLs YOU open in the user's browser to find postings.

The full search + apply playbook for one source. Pack data only — no DB.

List enabled sources, optionally filtered by country/sector tags. Pack data only — no DB.

Ingest postings YOU extracted from a source: deduped, scored against the profile, and persisted. Each finding needs at least url + title.

Report which URLs the copilot already knows (scouted or applied). Only browse/apply the ones marked 'new'.

The scouted matches, best score first.

Inspect one scouted match by id.

Pipeline counts for a status summary: new matches, awaiting the human, submitted/verified, responses. The same read the dashboard shows.

The active autopilot (L2) policy: min_score, max_per_day, since when. null policy = autopilot off, every submit awaits the human. Policies are written ONLY from the dashboard (human session) — never here.

The L2 work queue: approved matches on auto_apply_safe boards scoring at/above the policy min, not dedup-blocked, with no open application. Empty when autopilot is off or no board is flagged safe. Read-only.

The structured brief (job keywords + facts inventory + style + honesty rules) YOU draft the cv/cover_letter from. Only claim what the facts_inventory proves.

Store YOUR draft (markdown) for a match; versions auto-increment.

The stored drafts for a match, newest version first.

Deterministic check of the posting's keywords vs a stored draft: covered / missing_but_have (truthfully addable) / genuine_gaps (acknowledge, never stuff).

Approve a match (human decision) so materials/apply can proceed.

Discard a match (human decision); it will never be re-surfaced.

Start a supervised application session for an APPROVED match: runs the preflight (dedup gate, daily cap) and returns the step plan YOU execute in the user's browser. The plan never contains a submit step — request_submit is the only submission route and the human decides.

Report a step's outcome (ok | blocked | mismatch). The server answers with the next step, a repair, or a human-pause — never a submit.

Deterministic answer for an unpredicted form question — from the profile or saved answers; otherwise ask_user (never invent).

Persist a HUMAN-confirmed screener answer so it is never asked twice.

Close an application you decided not to pursue (any open state). A later start_application for the same match opens a fresh session.

THE consent gate. Ask permission to move to submission: at consent level 0 the answer is always await_human — show the filled form; the HUMAN clicks Submit.

AFTER the human confirms they clicked Submit: close the loop (state, dedup record, audit).

Record what happened (no_reply|rejected|interview|offer|hired) — feeds calibration.

A local file path for the asset (for form uploads).

Record that the HUMAN submitted an application (any channel) so the copilot never re-surfaces the posting. Idempotent per URL.

What the profile is still missing (required first, then progressive). Offer ONE gap at a time when contextually useful — never a form-wall.

Zero-LLM regex extraction of contact fields from pasted CV text. Returns candidate fields (None = unknown — ask the human, never invent). Does NOT write the profile: CONFIRM with the human, then call update_profile.

GDPR data portability: everything stored about you (profile, findings, applications, assets, audit trail) as one JSON object. Read-only.

GDPR erasure, two-step (S7.2d): called WITHOUT a token, returns a per-table summary of what would be deleted plus a single-use confirm_token (valid 5 minutes) — show both to the human. Called WITH that token, permanently deletes ALL their data (every table + the account row). IRREVERSIBLE. The token is the consent artifact: never invent one — only the human can read it back to you. Consider export_my_data first.