LXBStudioLLC · LXBStudioLLC · Jul 12, 2026 · Jul 12, 2026
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Questions and beta feedback
+    url: https://github.com/LXBStudioLLC/envoy/discussions
+    about: Ask questions, share test results, or say hello in Discussions.
diff --git a/.gitignore b/.gitignore
@@ -70,3 +70,6 @@ logs/
 Thumbs.db
 .DS_Store
 desktop.ini
+
+# === Test output ===
+TestResults/
diff --git a/AGENTS.md b/AGENTS.md
@@ -13,7 +13,7 @@ Envoy is a **.NET 8 WPF Windows desktop app** with two pillars:
 2. **Full-Auto is scoped to company-owned and ATS-hosted career sites.** Aggregators (LinkedIn, Indeed, Glassdoor, ZipRecruiter, Monster, Dice, etc.) are **Copilot-only by product choice** — a site classifier enforces this **in code**, not just in docs. (Rationale: a block from a company that wasn't going to hire you costs nothing; aggregators are where a block actually hurts the user, so we don't full-auto them.)
 3. **On a hard block, hand off — don't fight it.** When a site presents a CAPTCHA, bot-check, or rate-limit, Envoy surfaces it to the user and logs it; it does **not** attempt to defeat the control. **No CAPTCHA-solving, and no techniques whose purpose is to defeat a site's bot-detection.** Full-Auto fails gracefully and yields to the human rather than escalating.
 4. **Data layers read public data and don't bypass authentication.** Ghost detection and job discovery use public ATS JSON APIs, key-gated search APIs (e.g. Brave Search), public government datasets, and the posting already in front of the user. **No scraping behind a login.**
-5. Ghost detection outputs **RISK SCORE + CONFIDENCE + EVIDENCE** — an assessment with reasons, defaulting to neutral, **not** a bare "FAKE"/"GHOST" label on a named company. (Retained as the product's differentiator and its defamation cover; change deliberately, not by accident. Precision-vs-recall is a tunable default, not a hard rule.)
+5. Ghost detection outputs **RISK SCORE + CONFIDENCE + EVIDENCE** — an assessment with reasons, defaulting to neutral, **not** a bare "FAKE"/"GHOST" label on a named company. (Retained as the product's differentiator and its fairness posture toward named companies; change deliberately, not by accident. Precision-vs-recall is a tunable default, not a hard rule.)
 6. **.NET 8**, nullable enabled, file-scoped namespaces, match existing patterns. Do **NOT** blanket-add `ConfigureAwait(false)` — `Envoy.Core` is consumed in-process by the WPF UI.
 7. Work on a `feature/<name>` branch created off `main`. Do **NOT** push directly to `main`. Do **NOT** force-push.
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,7 +6,7 @@ All notable changes to Envoy are documented in this file. Format is based on [Ke
 
 ### Fixed
 - Ollama settings crash. Model-list bindings to read-only properties threw when the LLM settings view rendered (`Run.Text` binds two-way by default); all such bindings are now `OneWay`.
-- A full code-review pass fixed 53 verified bugs. Highlights: resume PDFs now include the contact header (name, email, phone) that was being omitted; the LinkedIn template matches URLs again; Google Gemini returns its model list; the safety gate no longer crashes on unusual LLM output; settings and DPAPI key-save failures surface in the UI instead of failing silently; the browser bridge disposes cleanly and serializes its sends; and a captive `DbContext` (unbounded growth, concurrent-access crash) was replaced with a per-operation context factory. Also: cancellation is honored in job discovery, Greenhouse posting dates feed the age signals correctly, keyword-density matching no longer counts "java" inside "javascript", plus a batch of null guards, culture-invariant casing (Turkish-locale safe), and resource-leak fixes.
+- A full code-review pass fixed 53 verified bugs. Highlights: resume PDFs now include the contact header (name, email, phone) that was being omitted; the LinkedIn template matches URLs again; Google Gemini returns its model list; the safety gate no longer crashes on unusual LLM output; settings and DPAPI key-save failures surface in the UI instead of failing silently; the browser bridge disposes cleanly and serializes its sends; and a captive `DbContext` (unbounded growth, concurrent-access crash) was replaced with a per-operation context factory. Also: cancellation is honored in job discovery, Greenhouse posting dates feed the age and repost signals correctly, keyword-density matching no longer counts "java" inside "javascript", plus a batch of null guards, culture-invariant casing (Turkish-locale safe), and resource-leak fixes.
 
 ### Added
 - The application, its window, the installer, and the shortcuts now carry the Envoy ghost icon.

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -15,7 +15,7 @@ Envoy is a **.NET 8 WPF Windows desktop app** with two pillars:
 2. **Full-Auto is scoped to company-owned and ATS-hosted career sites.** Aggregators (LinkedIn, Indeed, Glassdoor, ZipRecruiter, Monster, Dice, etc.) are **Copilot-only by product choice**, enforced **in code** via a site classifier — not just documented.
 3. **On a hard block, hand off — don't fight it.** CAPTCHA, bot-check, or rate-limit → surface to the user and log it. **No CAPTCHA-solving, and no techniques whose purpose is to defeat a site's bot-detection.** Full-Auto fails gracefully and yields to the human.
 4. **Data layers read public data and don't bypass authentication.** Ghost detection and job discovery use public ATS JSON APIs, key-gated search APIs (e.g. Brave Search), public government datasets, and the posting in front of the user. **No scraping behind a login.**
-5. Ghost detection outputs **RISK SCORE + CONFIDENCE + EVIDENCE** — an assessment with reasons, defaulting to neutral, not a bare "FAKE"/"GHOST" label on a named company. (Kept as the differentiator and defamation cover; precision-vs-recall is a tunable default, not a hard rule.)
+5. Ghost detection outputs **RISK SCORE + CONFIDENCE + EVIDENCE** — an assessment with reasons, defaulting to neutral, not a bare "FAKE"/"GHOST" label on a named company. (Kept as the differentiator and the fairness posture toward named companies; precision-vs-recall is a tunable default, not a hard rule.)
 6. **.NET 8**, nullable enabled, file-scoped namespaces, match existing patterns. Do **NOT** blanket-add `ConfigureAwait(false)`.
 7. Work on a `feature/<name>` branch created off `main`. Do **NOT** push directly to `main`. Do **NOT** force-push.
 

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -2,6 +2,8 @@
 
 Thanks for thinking about a contribution. Envoy is a Windows-only WPF desktop app built mainly around ghost-job detection: scoring how likely a job posting is a waste of an applicant's time, with transparent evidence. The resume-tailoring and form-fill flow is a human-gated copilot.
 
+Envoy is in early beta. Running it on a real machine and reporting what breaks is worth as much as code right now, and both get credited the same way (see [Credit](#credit)).
+
 ## The best way to help: write a ghost signal (and hand it to your agent)
 
 Ghost detection is built on a signal framework (`src/Envoy.GhostDetection/`). Each signal is an `IGhostSignal` that looks at a `JobPosting` and returns a `SignalResult`, or `null` for no opinion. Signals run in parallel, and `GhostScorer` combines them into a risk band (Neutral, Elevated, or High) with human-readable evidence.
@@ -75,7 +77,6 @@ docs/
   ADAPTIVE_PARSER.md       adaptive parser scoring, fingerprints, relocation
   TEMPLATE_AUTHORING.md    walk-through for adding new job-board templates
   SETUP.md                 user-facing install and first-launch
-  internal/                internal design notes (not user-facing)
 ```
 
 ## Branch and commit conventions
@@ -108,6 +109,10 @@ If your change adds a new job-board template, include:
 - File-scoped namespaces everywhere. It matches the existing code and the rule in `.editorconfig`.
 - Static frozen brushes live in `src/Envoy.UI/Theme.cs`. Don't redeclare `Color.FromRgb(...)` literals per view. Pull from `Theme` with `using static Envoy.UI.Theme;`.
 
+## Credit
+
+Everyone who helps gets credited. Merged PRs appear in the contributor graph and get a line in the notes of the release they ship in. Bug reports, test sessions, and template captures that lead to a change are credited by name in those same notes. If you would rather not be named, say so in your issue or PR and it stays out.
+
 ## License
 
 Envoy is licensed under [AGPLv3](LICENSE). By opening a PR you agree your contribution ships under the same license. AGPL doesn't allow network use without source disclosure, so if you fork Envoy into a hosted service, you have to publish your changes.
diff --git a/README.md b/README.md
@@ -12,6 +12,7 @@
 <p align="center">
   <img src="https://img.shields.io/badge/license-AGPL--3.0-blue.svg" alt="License: AGPL-3.0">
   <img src="https://img.shields.io/github/v/release/LXBStudioLLC/envoy?color=2ea44f&label=release" alt="Latest release">
+  <img src="https://img.shields.io/badge/status-early%20beta-ff8c00" alt="Status: early beta">
   <img src="https://img.shields.io/badge/platform-Windows%2010%2F11%20x64-0078D6" alt="Platform: Windows 10/11 x64">
   <img src="https://img.shields.io/badge/installer-Authenticode%20signed-4c1" alt="Signed installer">
   <img src="https://img.shields.io/badge/built%20with-.NET%208-512BD4" alt="Built with .NET 8">
@@ -23,6 +24,7 @@
 
 <p align="center">
   <a href="#download">Download</a> ·
+  <a href="#early-beta-testers-and-contributors-wanted">Help wanted</a> ·
   <a href="#ghost-detection">How it works</a> ·
   <a href="#find-jobs">Find Jobs</a> ·
   <a href="#apply-copilot">Apply Copilot</a> ·
@@ -48,6 +50,17 @@ You tailor the resume, fill out the same fields again, hit submit, and never hea
 
 ---
 
+## Early beta: testers and contributors wanted
+
+Envoy is in early beta. It works end to end and every release is signed, but so far it has run on a small number of machines against a limited slice of real postings. That is the gap you can close.
+
+- **Test it.** Install it, run your real searches, and open an issue for anything that looks wrong: a real job flagged as risky, an obvious ghost scored OK, a crash, a screen that confused you. A five-minute report genuinely moves the project.
+- **Contribute.** Five starter issues are open, graded easy to moderate, including two self-contained ghost signals and a new job-board source. [CONTRIBUTING.md](CONTRIBUTING.md) has the step-by-step, including how to hand a signal spec to a coding agent.
+
+Everyone who helps gets credited. Merged PRs are listed in the notes of the release they ship in, and so are the people whose bug reports and test sessions led to a fix. If you would rather not be named, say so in your issue or PR.
+
+---
+
 ## Download
 
 [Grab the latest release](https://github.com/LXBStudioLLC/envoy/releases/latest) for Windows 10/11, 64-bit.
@@ -84,7 +97,7 @@ Four signals run in the app today, all unit-tested:
 | Duplicate JD | Weak | Local (cross-company text match within a batch) |
 | Scam Pattern | Deterministic | Local regex (off-platform redirects, upfront fee or PII asks, crypto and gift-card payment, check and overpayment fraud) |
 
-A fifth signal, Repost Frequency, is written and tested but stays off until Envoy remembers listings across sessions, which this build doesn't do yet. So it never fires today.
+A fifth signal, Repost Frequency, watches for listings that get re-posted to look new. Its stronger path needs listing history across sessions, which this build doesn't keep yet, but a timestamp fallback can already fire when a posting's own dates show it was bumped long after it first went up.
 
 Each signal says whether it needs the network. That lets Envoy score a whole list locally in the Find Jobs view and save the network calls for when you open a single posting.
 
@@ -232,7 +245,7 @@ Hit a bug or a bad flag? [Open an issue](https://github.com/LXBStudioLLC/envoy/i
 
 - [x] Ghost-detection signal framework, wired into the app
 - [x] Four active signals: ATS cross-check, posting age, duplicate JD, scam pattern
-- [ ] Repost frequency signal (written and tested; off until listing history persists across sessions)
+- [ ] Repost frequency signal, full history-backed detection (the timestamp fallback ships today; the stronger path needs listing history across sessions)
 - [x] Job search over public ATS feeds plus optional Brave Search, every posting scored
 - [ ] More signals: hiring freeze ([#5](https://github.com/LXBStudioLLC/envoy/issues/5)), PERM filings ([#1](https://github.com/LXBStudioLLC/envoy/issues/1))
 - [x] Windows zip and signed installer

diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md
@@ -9,7 +9,6 @@ packages are listed separately and are **not** distributed with the app.
 | Package | Version | License |
 |---|---|---|
 | HandyControl | 3.5.1 | MIT |
-| Microsoft.EntityFrameworkCore.Design | 8.0.0 | MIT |
 | Microsoft.EntityFrameworkCore.Sqlite | 8.0.0 | MIT |
 | Microsoft.Extensions.DependencyInjection | 8.0.1 | MIT |
 | Microsoft.Extensions.Hosting | 8.0.1 | MIT |
@@ -25,10 +24,11 @@ packages are listed separately and are **not** distributed with the app.
 **QuestPDF note:** QuestPDF is dual-licensed. The free **Community** license
 covers organizations with under US $1M annual gross revenue and open-source
 projects; larger organizations require a paid license. Anyone forking Envoy
-should confirm their own eligibility — see https://www.questpdf.com/license/ .
+should confirm their own eligibility; see https://www.questpdf.com/license/ .
 
-### Test-only packages (NOT shipped with the application)
+### Build-time and test-only packages (NOT shipped with the application)
 
+Microsoft.EntityFrameworkCore.Design 8.0.0 (MIT, build-time only),
 xunit 2.6.6 (Apache-2.0), xunit.runner.visualstudio 2.5.6 (Apache-2.0 / MIT),
 Moq 4.20.70 (BSD-3-Clause), Microsoft.NET.Test.Sdk 17.8.0 (MIT).
 
@@ -38,9 +38,9 @@ Envoy embeds the following fonts, each licensed under the SIL Open Font
 License, Version 1.1 (full text below). Per-font copies also live in
 `src/Envoy.UI/Fonts/`.
 
-- **JetBrains Mono** — Copyright 2020 The JetBrains Mono Project Authors
+- **JetBrains Mono**, Copyright 2020 The JetBrains Mono Project Authors
   (https://github.com/JetBrains/JetBrainsMono)
-- **Orbitron** — Copyright 2018 The Orbitron Project Authors
+- **Orbitron**, Copyright 2018 The Orbitron Project Authors
   (https://github.com/theleagueof/orbitron), with Reserved Font Name: "Orbitron"
 
 ---

diff --git a/assets/README.md b/assets/README.md
@@ -10,12 +10,12 @@ Real brand assets (generated in the app's dark theme; swap for designer versions
 | `banner.png` | Wordmark at the top of the README | 1280 by 360 |
 | `social-preview.png` | Link-share card. Upload it in GitHub Settings, then General, then Social preview | 1280 by 640 |
 
-Placeholders (replace with real screenshots at the same paths; the README picks them up with no markdown change):
+Screenshots (real app captures, staged with fictional demo data so no real company or personal detail appears next to a risk band):
 
-| File | Used for | Size |
+| File | Shows | Size |
 |---|---|---|
-| `ghost-score.png` | Ghost Risk panel: band, confidence, evidence lines (the important one) | about 1640 by 920, shown at 820px |
-| `find-jobs.png` | Find Jobs results with a risk band on each posting | about 1640 by 920 |
-| `apply-copilot.png` | Apply view paused at the Confirm or Cancel gate | about 1640 by 920 |
+| `ghost-score.png` | Ghost Risk panel: band, score, evidence lines | 1600 by 820, shown at 820px |
+| `find-jobs.png` | Find Jobs results with a risk band on each posting | 1600 by 1260 |
+| `apply-copilot.png` | Apply view paused at the Confirm or Cancel gate | 1600 by 950 |
 
-Tips: keep one app theme, keep personal details out of frame (use a sample resume), and compress the PNGs before committing. A short GIF of dropping a resume, tailoring it, and reviewing before submit works well too.
+If you retake them: keep one app theme, use fictional data only (no real companies beside a risk band, no personal details), and compress the PNGs before committing. A short GIF of dropping a resume, tailoring it, and reviewing before submit works well too.
diff --git a/docs/SETUP.md b/docs/SETUP.md
@@ -2,21 +2,21 @@
 
 ## Requirements
 
-- **Windows 10/11 (64-bit).** Envoy is a WPF desktop application — macOS/Linux are not supported at v1.
+- **Windows 10/11 (64-bit).** Envoy is a WPF desktop application; macOS/Linux are not supported at v1.
 - [Ollama](https://ollama.com) installed and running (only required if you want to use a local model; you can run Envoy with a cloud provider instead).
 - Google Chrome or Microsoft Edge installed.
 
 ## Installation
 
 ### Inno Setup installer (recommended)
-1. Download `Envoy-v1.0.0-setup.exe` from [Releases](../../releases).
+1. Download `Envoy-<version>-setup.exe` from [Releases](../../releases).
 2. Run the installer.
 3. Launch Envoy from the Start Menu or desktop shortcut.
 
 ### ZIP package
-1. Download `Envoy-v1.0.0-win-x64.zip` from [Releases](../../releases).
+1. Download `Envoy-<version>-win-x64.zip` from [Releases](../../releases).
 2. Extract anywhere (e.g. `C:\Tools\Envoy\`).
-3. Double-click `Envoy.exe` (or `Envoy.UI.exe`, depending on the build).
+3. Double-click `Envoy.exe`.
 
 ### PowerShell installer
 From inside the extracted ZIP, run:
@@ -43,13 +43,13 @@ This copies the app to `%LOCALAPPDATA%\Envoy`, adds desktop + Start Menu shortcu
 
 ## Chrome Remote Debugging
 
-For the stealth browser to work, Chrome must be launched with:
+For the apply copilot's browser bridge to work, Chrome must be launched with:
 
 ```
 --remote-debugging-port=9222
 ```
 
-Envoy will handle this automatically — it relaunches Chrome with the right flag if a debug session isn't already running.
+Envoy handles this automatically and relaunches Chrome with the right flag if a debug session isn't already running.
 
 ## Troubleshooting
 
@@ -67,4 +67,4 @@ Envoy will handle this automatically — it relaunches Chrome with the right fla
 - Ensure your GPU drivers are up to date.
 
 **"Cloud API key not accepted after I copied my settings to another PC"**
-- API keys are encrypted with Windows DPAPI under the `CurrentUser` scope — they cannot be decrypted by a different Windows user account or on a different machine. Re-enter the key on the new machine.
+- API keys are encrypted with Windows DPAPI under the `CurrentUser` scope, so they cannot be decrypted by a different Windows user account or on a different machine. Re-enter the key on the new machine.