release: promote dev → main (v0.3.3 → v0.5.0)

.agents/skills/apply-job/SKILL.md

@@ -33,7 +33,7 @@ Read `candidate/application-limits.yml` (if absent, skip silently and proceed).
 - If `status: caution`: warn and confirm before proceeding.
 - If a new cap or cooldown is stated by the user mid-flow (e.g. "limit me to 2 apps there per quarter"): write it back to `application-limits.yml` using *confirm-first* friction (propose the exact change, get a yes, write, echo `Written to application-limits.yml: <key: value>`).
 
-Run `node src/cli/tracker.mjs --summary` to confirm current application-limits context and echo the result.
+Run `rolester tracker --summary` to confirm current application-limits context and echo the result.
 
 ---
 
@@ -56,7 +56,7 @@ ACTION: apply-now|hold|manual|cut
 
 - **GATE: KEEP** → proceed.
 - **GATE: REVIEW** → confirm with user before proceeding.
-- **GATE: CUT** → write `status: cut` to the tracker row. In the same `tracker.json` write, check for a backing comm thread (`jobs[id].comm` where `comm.status` is not already `closed`). If one exists, set `comm.status = "closed"`, `comm.nextActionDue = null`, `comm.nextAction = null`, `comm.draft = null`, and append to `comm.messages[]`: `{ direction: "note", at: "<ISO>", body: "Role cut — <reason from GATE line>. No further action." }`. Run `npm run verify:tracker && node src/cli/tracker.mjs --verify && node src/cli/tracker.mjs` after the write. Halt, stop.
+- **GATE: CUT** → write `status: cut` to the tracker row. In the same `tracker.json` write, check for a backing comm thread (`jobs[id].comm` where `comm.status` is not already `closed`). If one exists, set `comm.status = "closed"`, `comm.nextActionDue = null`, `comm.nextAction = null`, `comm.draft = null`, and append to `comm.messages[]`: `{ direction: "note", at: "<ISO>", body: "Role cut — <reason from GATE line>. No further action." }`. Run `npm run verify:tracker && rolester tracker --verify && rolester tracker` after the write. Halt, stop.
 
 ---
 
@@ -85,7 +85,7 @@ Apply priority logic:
 
 Check if `workspace/writing-samples/` contains files newer than `candidate/writing-style.md`. If so: run `npm run calibrate:style` first, then confirm it completed before continuing.
 
-Read: `candidate/writing-style.md`, `candidate/honesty.yml`, `candidate/evidence.yml`. Then run `npm run learnings -- read "<role>"` (the helper resolves the family from `targeting.yml` and exits 0 silently if no file exists yet — a missing file is normal).
+Read: `candidate/writing-style.md`, `candidate/honesty.yml`, `candidate/evidence.yml`. Then run `rolester learnings read "<role>"` (the helper resolves the family from `targeting.yml` and exits 0 silently if no file exists yet — a missing file is normal).
 
 Invoke `tailor-application` to produce `workspace/tailored/<Company>_<Role>.md` and a cover letter whenever the application accepts one (a cover-letter field — required or optional — or an email/attachment channel). Default to including a cover letter; it is a second ATS keyword-matching surface. Only skip it when the application has no way to accept one.
 
@@ -172,18 +172,18 @@ Enter this step when `isEasyApply(url)` returns true OR `hostnameToPortal(url) =
 Run:
 
 ```
-npm run automation -- status --json
+rolester automation status --json
 ```
 
 Inspect `capabilities.one_click_apply`. The applicable platform is `linkedin`. `allowed: true` means all three conditions are simultaneously true: the `one_click_apply` capability global switch is on, LinkedIn's per-capability switch is on, and LinkedIn's one-time ToS consent is recorded. This is the three-part AND from `mayRun()` in `src/core/automation/consent.mjs` — never re-derive it in prose.
 
 If `capabilities.one_click_apply` does not show `allowed: true` for `linkedin`, explain exactly how to opt in, then **stop** — do not open a browser:
 
 1. Read LinkedIn's terms of service yourself to confirm that automated Easy Apply is permitted under your account's usage.
-2. Record consent: `npm run automation -- consent linkedin --write`
-3. Enable the capability global switch: `npm run automation -- enable one_click_apply --write`
-4. Enable for LinkedIn: `npm run automation -- enable one_click_apply linkedin --write`
-5. Verify: `npm run automation -- status --json`
+2. Record consent: `rolester automation consent linkedin --write`
+3. Enable the capability global switch: `rolester automation enable one_click_apply --write`
+4. Enable for LinkedIn: `rolester automation enable one_click_apply linkedin --write`
+5. Verify: `rolester automation status --json`
 
 State clearly: this capability is OFF by default; enabling it is a deliberate choice. The user must read LinkedIn's ToS themselves before recording consent — Rolester records the decision, it does not make it. This step is always user-initiated and must never run on a schedule or unattended.
 
@@ -238,14 +238,14 @@ After submitting, confirm the application advanced past the submit step:
 
 1. Read the current URL and page text. Check both the URL path (segments: `/confirmation`, `/thank-you`, `/submitted`, `/complete`, `/success`) AND the visible page text ("Application received", "We got your application", "Thanks for applying", or similar) — a match on either constitutes a confirmation signal. `confirmationCheck(pageText, currentUrl)` in `src/core/apply/form-fill.mjs` encodes this logic; mirror that dual-signal check when evaluating manually.
 2. **Verification-code protocol (M17):** if the page shows an emailed verification-code prompt (detected by `submitGuard`/BLOCKER_SIGNALS in `form-fill.mjs` — phrases such as "verification code", "enter the code", "check your email"), handle it through the narrow mail-access path:
-   - Run `npm run automation -- status --json` and inspect `capabilities.mail_access`.
+   - Run `rolester automation status --json` and inspect `capabilities.mail_access`.
    - Infer the mail platform from the recipient address when obvious using `inferMailAccessPlatformFromEmail()` from `src/core/automation/mail-access.mjs`: `gmail.com` / `googlemail.com` → `gmail`; `outlook.com` / `hotmail.com` / `live.com` / `msn.com` → `outlook`; other real email domains → `webmail`. If there is no recipient address, ask the user which provider holds the code. Use `webmail` for any provider other than Gmail/Outlook.
    - If `mail_access` is not `allowed: true` for that platform, halt and ask the user to provide the code manually. Also show the opt-in steps:
      1. Read the mail provider's terms yourself.
-     2. `npm run automation -- consent <gmail|outlook|webmail> --write`
-     3. `npm run automation -- enable mail_access --write`
-     4. `npm run automation -- enable mail_access <gmail|outlook|webmail> --write`
-     5. `npm run automation -- status --json`
+     2. `rolester automation consent <gmail|outlook|webmail> --write`
+     3. `rolester automation enable mail_access --write`
+     4. `rolester automation enable mail_access <gmail|outlook|webmail> --write`
+     5. `rolester automation status --json`
    - If `mail_access` is allowed, use the session browser to open the provider and follow `buildVerificationCodeMailPlan()` / `classifyMailAccessBlocker()` / `extractVerificationCodes()` from `src/core/automation/mail-access.mjs`. For `webmail`, pass the visible provider name as `providerName` when known. Read only the specific recent verification-code message for this current application or sign-in flow. Do not browse the broader inbox. Do not send, delete, reply, archive, or mark messages read.
    - Halt immediately on a mail login wall, mail 2FA prompt, captcha, or unexpected interstitial. Set `status: "manual-apply"` with a note such as `"manual-apply: mail_access blocked — Gmail login wall, provide code manually"` and ask the user to provide the code manually.
    - Once the code is obtained, return to the original application page, enter the code, and continue verification.
@@ -308,7 +308,7 @@ Run validation and re-render in sequence:
 
 ```
 npm run verify:tracker
-node src/cli/tracker.mjs --verify && node src/cli/tracker.mjs
+rolester tracker --verify && rolester tracker
 ```
 
 Both must exit 0 **and** the row must now be present (confirm by `id`). If the row
@@ -332,7 +332,7 @@ Then log the submission to the Activity Pulse feed (the dashboard's live timelin
 a re-run never double-logs:
 
 ```
-npm run activity -- append --type applied --actor agent \
+rolester activity append --type applied --actor agent \
   --title "Applied — <Company>" --summary "<Role> · via <channel>" \
   --company "<Company>" --role "<Role>" --app-id <application id> --url "<posting URL>" --write
 ```

.agents/skills/calendar-sync/SKILL.md

@@ -20,7 +20,7 @@ calendar write remains confirm-first.
 Run:
 
 ```bash
-npm run automation -- status --json
+rolester automation status --json
 ```
 
 Inspect `capabilities.calendar_sync`. Applicable platforms:
@@ -37,10 +37,10 @@ If the requested platform is not allowed, stop before opening a browser or
 running local automation and explain the opt-in path:
 
 ```bash
-npm run automation -- consent <platform> --write
-npm run automation -- enable calendar_sync --write
-npm run automation -- enable calendar_sync <platform> --write
-npm run automation -- status --json
+rolester automation consent <platform> --write
+rolester automation enable calendar_sync --write
+rolester automation enable calendar_sync <platform> --write
+rolester automation status --json
 ```
 
 The user must read the provider/platform terms themselves before recording
@@ -125,10 +125,10 @@ Avoid duplicates by normalized `provider + eventId + eventIso + title`.
 Then run:
 
 ```bash
-node src/cli/tracker.mjs --verify
+rolester tracker --verify
 npm run verify:tracker
-npm run activity -- append --type system --title "Calendar event synced" --summary "Confirmed event written to the selected calendar provider." --tag calendar --write
-node src/cli/tracker.mjs
+rolester activity append --type system --title "Calendar event synced" --summary "Confirmed event written to the selected calendar provider." --tag calendar --write
+rolester tracker
 ```
 
 Add concrete `--company`, `--role`, or `--app-id` refs when the synced event maps

.agents/skills/company-health/SKILL.md

@@ -182,7 +182,7 @@ PERSISTED onto `workspace/tracker.json`; the renderer only reads it. Mirror the
 2. Bump `meta.lastUpdatedAt` (the freshness stamp every writing skill bumps).
 3. Verify + re-render (the dashboard handoff):
    ```
-   node src/cli/tracker.mjs --verify
+   rolester tracker --verify
    ```
    Fix and re-run until it passes clean. Render must never write `tracker.json`.
 
@@ -191,7 +191,7 @@ PERSISTED onto `workspace/tracker.json`; the renderer only reads it. Mirror the
 ## STEP 6 — Log to Activity Pulse
 
 ```
-npm run activity -- append --type research --actor agent \
+rolester activity append --type research --actor agent \
   --title "Company health: <Company> — <rating>" \
   --summary "<function>-scoped: <the one driving signal>" \
   --company "<Company>" --write

.agents/skills/configure/SKILL.md

@@ -7,7 +7,7 @@ description: Show current settings and route changes to the validated CLI or own
 
 > **Runs under AGENTS.md.** These contracts bind without being restated here: Privacy Invariant (`current_base` never outbound), Honesty Firewall, Placeholder/Bracket Ban, Gate Write-back, Domain-Neutral Rule, Browser Automation Contract, Activity Pulse logging, Tracker verify+re-render, and Sent-Clears-Draft. Inline reminders at point-of-use are intentional; standalone restatements point back to the relevant AGENTS.md section.
 
-> **Agent voice.** Read `candidate/modes.yml#agent_voice` (default `standard`) before producing settings summaries. Apply the register from AGENTS.md#mode-switches. `exec-summary` = changed setting + confirmation in one line; `standard` = current state + change + confirmation as short bullets; `verbose` = full settings matrix. To change `agent_voice` itself: `npm run modes -- set agent_voice <value> --write`.
+> **Agent voice.** Read `candidate/modes.yml#agent_voice` (default `standard`) before producing settings summaries. Apply the register from AGENTS.md#mode-switches. `exec-summary` = changed setting + confirmation in one line; `standard` = current state + change + confirmation as short bullets; `verbose` = full settings matrix. To change `agent_voice` itself: `rolester modes set agent_voice <value> --write`.
 
 ## Core Principle
 
@@ -35,9 +35,9 @@ Consequential writes (comp floor/target, broad company exclusions) are confirm-f
 Before offering to change anything, run these checks and report what they show:
 
 ```
-npm run doctor
-npm run modes -- status
-npm run automation -- status
+rolester doctor
+rolester modes status
+rolester automation status
 ```
 
 Report a brief summary of each setting's current value and where it lives. Never print `current_base` — it is a private gate input and must never appear in any output, shared artifact, or report from this skill.
@@ -58,21 +58,21 @@ Run the CLI confirm-first. The default is a **dry run** — it shows the exact l
 
 | What to change | Command | Friction |
 |---|---|---|
-| Comp floor (walk-away minimum) | `npm run gate -- comp-floor <N> --write --confirm` | confirm-first |
-| Comp target (negotiation anchor) | `npm run gate -- comp-target <N> --write --confirm` | confirm-first |
-| Comp expected (form-field value) | `npm run gate -- comp-expected <N> --write` | write-and-report |
-| Excluded company | `npm run gate -- exclude-company "<Name>" --write --confirm` | confirm-first |
-| Cut signal | `npm run gate -- cut-signal "<signal>" --write` | write-and-report |
-| Keep signal | `npm run gate -- keep-signal "<signal>" --write` | write-and-report |
-| Honesty: do not claim a tool | `npm run gate -- do-not-claim "<tool>" --write` | write-and-report |
-| Honesty: do not fabricate a claim | `npm run gate -- do-not-fabricate "<claim>" --write` | write-and-report |
-| Usage mode (compute/scope) | `npm run modes -- set usage <lean\|standard\|full> --write` | write-and-report |
-| Application mode (pursuit posture after discovery) | `npm run modes -- set application <selective\|balanced\|high-volume> --write` | write-and-report |
-| Record ToS consent for a platform | `npm run automation -- consent <platform> --write` | write-and-report |
-| Withdraw ToS consent for a platform | `npm run automation -- revoke <platform> --write` | write-and-report |
-| Enable a capability (globally or per-platform) | `npm run automation -- enable <capability> [platform] --write` | write-and-report |
-| Disable a capability | `npm run automation -- disable <capability> [platform] --write` | write-and-report |
-| Session browser provider | `npm run automation -- session <extension\|playwright> --write` | write-and-report |
+| Comp floor (walk-away minimum) | `rolester gate comp-floor <N> --write --confirm` | confirm-first |
+| Comp target (negotiation anchor) | `rolester gate comp-target <N> --write --confirm` | confirm-first |
+| Comp expected (form-field value) | `rolester gate comp-expected <N> --write` | write-and-report |
+| Excluded company | `rolester gate exclude-company "<Name>" --write --confirm` | confirm-first |
+| Cut signal | `rolester gate cut-signal "<signal>" --write` | write-and-report |
+| Keep signal | `rolester gate keep-signal "<signal>" --write` | write-and-report |
+| Honesty: do not claim a tool | `rolester gate do-not-claim "<tool>" --write` | write-and-report |
+| Honesty: do not fabricate a claim | `rolester gate do-not-fabricate "<claim>" --write` | write-and-report |
+| Usage mode (compute/scope) | `rolester modes set usage <lean\|standard\|full> --write` | write-and-report |
+| Application mode (pursuit posture after discovery) | `rolester modes set application <selective\|balanced\|high-volume> --write` | write-and-report |
+| Record ToS consent for a platform | `rolester automation consent <platform> --write` | write-and-report |
+| Withdraw ToS consent for a platform | `rolester automation revoke <platform> --write` | write-and-report |
+| Enable a capability (globally or per-platform) | `rolester automation enable <capability> [platform] --write` | write-and-report |
+| Disable a capability | `rolester automation disable <capability> [platform] --write` | write-and-report |
+| Session browser provider | `rolester automation session <extension\|playwright> --write` | write-and-report |
 
 **Capabilities:** `status_polling`, `authenticated_search`, `messaging`, `one_click_apply`, `profile_optimize`, `profile_apply`, `mail_access`.
 
@@ -118,12 +118,12 @@ The session browser is the Layer 3 interactive provider (`docs/BROWSER.md`). Two
 Switch the provider with:
 
 ```
-npm run automation -- session <extension|playwright> --write
+rolester automation session <extension|playwright> --write
 ```
 
 Dry-run by default; `--write` commits. The first `--write` scaffolds `candidate/automation.yml` from the template if it doesn't exist yet. The change is schema-validated and comment-preserving.
 
-`npm run doctor` now surfaces the configured provider and a best-effort presence probe (whether the provider looks reachable). See `docs/BROWSER.md` for the full substrate map and the Browser Automation Contract in `AGENTS.md` for the permission model.
+`rolester doctor` now surfaces the configured provider and a best-effort presence probe (whether the provider looks reachable). See `docs/BROWSER.md` for the full substrate map and the Browser Automation Contract in `AGENTS.md` for the permission model.
 
 ---
 
@@ -132,13 +132,13 @@ Dry-run by default; `--write` commits. The first `--write` scaffolds `candidate/
 After every write, run:
 
 ```
-npm run doctor
+rolester doctor
 ```
 
 For changes to candidate config files, also run:
 
 ```
-npm run ingest -- --check
+rolester ingest --check
 ```
 
 Report what changed. If validation fails, surface the exact error and fix it before closing.