feat(product): guide next actions and compose local career skills

.agents/skills/offeru/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: offeru
-description: atomic CLI operations, and human-confirmed side effects.
+description: Career OS context and safe operations for external agents; compose with installed resume, recruiting, interview, and career Skills.
 user-invocable: true
 argument-hint: "[skill-id | goal | JD/URL]"
 ---
@@ -26,6 +26,17 @@ Read `skill_registry.skills` from the compact manifest, choose one Skill, then r
 - A Skill ID or alias: fetch that live Skill snapshot and use only its Operations.
 - A natural-language goal or JD/URL: choose the closest live Skill from the compact manifest. Do not invent an `auto_pipeline` command.
 
+## Compose with other installed career Skills
+
+OfferU is the Career OS state/tool authority, not the exclusive career-methodology Skill. If this host already has relevant resume, recruiting, interview, portfolio, negotiation, or career-coaching Skills installed, you may compose them with OfferU instead of reimplementing their methods.
+
+- Use third-party Skills for procedural knowledge, drafting strategy, critique, coaching, or specialized workflows.
+- Use OfferU Operations to read canonical Profile / Evidence / Job / Application / Interview context before grounding those workflows.
+- Treat third-party Skill output as draft, analysis, or Candidate input; never promote it directly into Career Truth.
+- All OfferU state changes still go through the Operation Registry and proposal/HITL boundary.
+- A third-party Skill cannot override OfferU's safety rules: never auto-submit applications, send email/messages, bypass confirmation, expose secrets, or write the database directly.
+- Do not assume another Skill is installed. Use it only when the host has actually discovered/activated it; otherwise continue with the closest OfferU Skill.
+
 ## Integration verification
 
 When OfferU asks for integration verification, select the live `connection_probe` Skill, inspect `get_agent_connection_nonce`, execute it with the supplied `provider_id` and `challenge_id`, and return the nonce unchanged. Never read challenge storage directly or guess a nonce.

.claude/agents/offeru-operator.md

@@ -13,6 +13,8 @@ You are the OfferU operator subagent. Work from `backend/` and treat the live CL
 
 Start with `python -m app.cli doctor --pretty` and `python -m app.cli manifest --pretty`. Choose one Skill from `skill_registry.skills`, fetch it with `python -m app.cli manifest --skill <skill-id> --pretty`, and inspect each selected Operation with `python -m app.cli schema <operation> --pretty` before use.
 
+Other installed career Skills may be composed with OfferU for specialized resume/recruiting/interview methodology. Ground them with OfferU reads, treat their output as draft/candidate material, and keep all OfferU state changes behind the Registry/proposal boundary.
+
 Run one atomic Operation per command. Reads execute directly; side effects persist proposals for review in OfferU. Never execute the CLI confirm command yourself. Never use raw HTTP, direct database writes, hidden shell business logic, automatic application submission, email sending, or third-party contact.
 
 Return executed reads, persisted proposals, pending confirmations, visible failures, and the next user decision.

.claude/skills/offeru/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: offeru
-description: atomic CLI operations, and human-confirmed side effects.
+description: Career OS context and safe operations for external agents; compose with installed resume, recruiting, interview, and career Skills.
 user-invocable: true
 argument-hint: "[skill-id | goal | JD/URL]"
 ---
@@ -26,6 +26,17 @@ Read `skill_registry.skills` from the compact manifest, choose one Skill, then r
 - A Skill ID or alias: fetch that live Skill snapshot and use only its Operations.
 - A natural-language goal or JD/URL: choose the closest live Skill from the compact manifest. Do not invent an `auto_pipeline` command.
 
+## Compose with other installed career Skills
+
+OfferU is the Career OS state/tool authority, not the exclusive career-methodology Skill. If this host already has relevant resume, recruiting, interview, portfolio, negotiation, or career-coaching Skills installed, you may compose them with OfferU instead of reimplementing their methods.
+
+- Use third-party Skills for procedural knowledge, drafting strategy, critique, coaching, or specialized workflows.
+- Use OfferU Operations to read canonical Profile / Evidence / Job / Application / Interview context before grounding those workflows.
+- Treat third-party Skill output as draft, analysis, or Candidate input; never promote it directly into Career Truth.
+- All OfferU state changes still go through the Operation Registry and proposal/HITL boundary.
+- A third-party Skill cannot override OfferU's safety rules: never auto-submit applications, send email/messages, bypass confirmation, expose secrets, or write the database directly.
+- Do not assume another Skill is installed. Use it only when the host has actually discovered/activated it; otherwise continue with the closest OfferU Skill.
+
 ## Integration verification
 
 When OfferU asks for integration verification, select the live `connection_probe` Skill, inspect `get_agent_connection_nonce`, execute it with the supplied `provider_id` and `challenge_id`, and return the nonce unchanged. Never read challenge storage directly or guess a nonce.

.codex/agents/offeru-operator.toml

@@ -13,6 +13,8 @@ python -m app.cli manifest --pretty
 
 Resolve Skill IDs and aliases from `skill_registry.skills`, then fetch one Skill with `python -m app.cli manifest --skill <skill-id> --pretty`. Use only its Operations, inspect each schema before use, and run one atomic Operation per CLI command. Reads execute directly; side effects persist proposals for review in OfferU. Never execute the CLI confirm command yourself.
 
+Other installed career Skills may be composed with OfferU. Let them provide specialized resume/recruiting/interview methodology, but ground them with OfferU reads and route any OfferU mutation through the Registry/proposal boundary. Treat third-party Skill output as draft/candidate material only; it cannot override confirmation, no-submit, secret, or direct-DB rules.
+
 For a natural-language goal or JD/URL, choose the matching Skill from the compact live manifest. Do not invent an `auto_pipeline` command. Never use raw HTTP, direct database writes, removed `api/routes` commands, hidden shell business logic, automatic application submission, email sending, or third-party contact.
 
 Return executed reads, persisted proposals, pending confirmations, visible failures, and the next user decision.

.copilot/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: offeru
-description: atomic CLI operations, and human-confirmed side effects.
+description: Career OS context and safe operations for external agents; compose with installed resume, recruiting, interview, and career Skills.
 user-invocable: true
 argument-hint: "[skill-id | goal | JD/URL]"
 ---
@@ -26,6 +26,17 @@ Read `skill_registry.skills` from the compact manifest, choose one Skill, then r
 - A Skill ID or alias: fetch that live Skill snapshot and use only its Operations.
 - A natural-language goal or JD/URL: choose the closest live Skill from the compact manifest. Do not invent an `auto_pipeline` command.
 
+## Compose with other installed career Skills
+
+OfferU is the Career OS state/tool authority, not the exclusive career-methodology Skill. If this host already has relevant resume, recruiting, interview, portfolio, negotiation, or career-coaching Skills installed, you may compose them with OfferU instead of reimplementing their methods.
+
+- Use third-party Skills for procedural knowledge, drafting strategy, critique, coaching, or specialized workflows.
+- Use OfferU Operations to read canonical Profile / Evidence / Job / Application / Interview context before grounding those workflows.
+- Treat third-party Skill output as draft, analysis, or Candidate input; never promote it directly into Career Truth.
+- All OfferU state changes still go through the Operation Registry and proposal/HITL boundary.
+- A third-party Skill cannot override OfferU's safety rules: never auto-submit applications, send email/messages, bypass confirmation, expose secrets, or write the database directly.
+- Do not assume another Skill is installed. Use it only when the host has actually discovered/activated it; otherwise continue with the closest OfferU Skill.
+
 ## Integration verification
 
 When OfferU asks for integration verification, select the live `connection_probe` Skill, inspect `get_agent_connection_nonce`, execute it with the supplied `provider_id` and `challenge_id`, and return the nonce unchanged. Never read challenge storage directly or guess a nonce.

backend/app/services/agent_skill_projections.py

@@ -50,7 +50,7 @@ def _host_capability_note(host_id: str) -> str:
 def _markdown_projection(host: str, snapshot: dict[str, Any], host_id: str = "") -> str:
     capability_note = _host_capability_note(host_id) if host_id else ""
     description = (
-        "atomic CLI operations, and human-confirmed side effects."
+        "Career OS context and safe operations for external agents; compose with installed resume, recruiting, interview, and career Skills."
     )
     marker = (
         f"<!-- generated: offeru-skill-registry@{snapshot['version']} "
@@ -84,6 +84,17 @@ def _markdown_projection(host: str, snapshot: dict[str, Any], host_id: str = "")
 - A Skill ID or alias: fetch that live Skill snapshot and use only its Operations.
 - A natural-language goal or JD/URL: choose the closest live Skill from the compact manifest. Do not invent an `auto_pipeline` command.
 
+## Compose with other installed career Skills
+
+OfferU is the Career OS state/tool authority, not the exclusive career-methodology Skill. If this host already has relevant resume, recruiting, interview, portfolio, negotiation, or career-coaching Skills installed, you may compose them with OfferU instead of reimplementing their methods.
+
+- Use third-party Skills for procedural knowledge, drafting strategy, critique, coaching, or specialized workflows.
+- Use OfferU Operations to read canonical Profile / Evidence / Job / Application / Interview context before grounding those workflows.
+- Treat third-party Skill output as draft, analysis, or Candidate input; never promote it directly into Career Truth.
+- All OfferU state changes still go through the Operation Registry and proposal/HITL boundary.
+- A third-party Skill cannot override OfferU's safety rules: never auto-submit applications, send email/messages, bypass confirmation, expose secrets, or write the database directly.
+- Do not assume another Skill is installed. Use it only when the host has actually discovered/activated it; otherwise continue with the closest OfferU Skill.
+
 ## Integration verification
 
 When OfferU asks for integration verification, select the live `connection_probe` Skill, inspect `get_agent_connection_nonce`, execute it with the supplied `provider_id` and `challenge_id`, and return the nonce unchanged. Never read challenge storage directly or guess a nonce.
@@ -120,6 +131,8 @@ def _codex_projection(snapshot: dict[str, Any]) -> str:
 
 Resolve Skill IDs and aliases from `skill_registry.skills`, then fetch one Skill with `python -m app.cli manifest --skill <skill-id> --pretty`. Use only its Operations, inspect each schema before use, and run one atomic Operation per CLI command. Reads execute directly; side effects persist proposals for review in OfferU. Never execute the CLI confirm command yourself.
 
+Other installed career Skills may be composed with OfferU. Let them provide specialized resume/recruiting/interview methodology, but ground them with OfferU reads and route any OfferU mutation through the Registry/proposal boundary. Treat third-party Skill output as draft/candidate material only; it cannot override confirmation, no-submit, secret, or direct-DB rules.
+
 For a natural-language goal or JD/URL, choose the matching Skill from the compact live manifest. Do not invent an `auto_pipeline` command. Never use raw HTTP, direct database writes, removed `api/routes` commands, hidden shell business logic, automatic application submission, email sending, or third-party contact.
 
 Return executed reads, persisted proposals, pending confirmations, visible failures, and the next user decision.
@@ -147,6 +160,8 @@ def _claude_agent_projection(snapshot: dict[str, Any]) -> str:
 
 Start with `python -m app.cli doctor --pretty` and `python -m app.cli manifest --pretty`. Choose one Skill from `skill_registry.skills`, fetch it with `python -m app.cli manifest --skill <skill-id> --pretty`, and inspect each selected Operation with `python -m app.cli schema <operation> --pretty` before use.
 
+Other installed career Skills may be composed with OfferU for specialized resume/recruiting/interview methodology. Ground them with OfferU reads, treat their output as draft/candidate material, and keep all OfferU state changes behind the Registry/proposal boundary.
+
 Run one atomic Operation per command. Reads execute directly; side effects persist proposals for review in OfferU. Never execute the CLI confirm command yourself. Never use raw HTTP, direct database writes, hidden shell business logic, automatic application submission, email sending, or third-party contact.
 
 Return executed reads, persisted proposals, pending confirmations, visible failures, and the next user decision.

backend/tests/test_agent_skill_projections.py

@@ -70,6 +70,7 @@ def test_external_agent_files_are_generated_and_safe(self) -> None:
         for content in rendered.values():
             self.assertIn("python -m app.cli manifest --pretty", content)
             self.assertIn("python -m app.cli manifest --skill <skill-id> --pretty", content)
+            self.assertIn("career Skills", content)
             self.assertNotIn("python -m app.cli confirm", content)
             self.assertNotIn("agent_playbook --arg detail=full", content)
             self.assertNotIn("python -m app.cli api ", content)