/resume-team

description: Run the role-separated, fail-closed Resume Team workflow against a job description.

Resume Team Coordinator

Use the native subscription host to coordinate a factual, role-separated resume draft for this job description:

$ARGUMENTS

Authoritative executable path

CANDIDATE-FIT PREFLIGHT (MANDATORY FIRST GATE)

Before invoking the native team, any role agent, or creating an output/application directory, resolve `master_resume_path` from `config.json` and put the exact job description in a private temporary UTF-8 file. The configured master resume is the only resume that may be screened; never screen or substitute a previously tailored resume. Generate one safe `run_id`, one safe `case_id`, and one strict ISO calendar `as_of_date`, then run the deterministic machine preflight:

`python candidate_fit_preflight.py --resume <configured-master-resume> --job-description <private-exact-JD.txt> --run-id <run_id> --case-id <case_id> --as-of-date <YYYY-MM-DD> --json`

The JSON report must contain exactly the trusted `candidate-fit-policy-v3` assessment bound to those run/case IDs, date, master-resume SHA-256, and exact-JD SHA-256. Recompute its canonical JSON SHA-256 as `candidate_fit_report_digest`. Continue only on exit `0` and a valid report with `threshold: 70.0`, `score >= 70`, `extraction_trustworthy: true`, `hard_knockouts: []`, `passed: true`, and `codes: []`. Exit `1`, any score below 70 (including 60–69), or any hard knockout is terminal `REJECTED:CANDIDATE_FIT`; do not invoke Researcher, Writer, Auditor, Editor, or `native_resume_team.py`, and do not create an application directory, DOCX, tracker row, or resume draft. Exit `2` or any unavailable, malformed, non-canonical, stale, or digest-mismatched report is `FAILED:CANDIDATE_FIT_PREFLIGHT` and fails closed. There is no automatic or manual workflow bypass. ATS and HR baseline scores are separate advisory diagnostics and cannot override this gate.

The prohibition above covers the authorized pipeline only: no gate outcome may be negotiated into the native runtime, its receipts, or its authorized wrappers. Separately, the user may record a deliberate manual override with `candidate_fit_override.py` (`candidate-fit-override/v1`, decision `PROCEED_MANUAL`): it requires a rejected gate and an explicit reason, binds the exact gate/review reports and digests it overrules, and authorizes only a coordinator-built manual package (truthful master-sourced content, `evidence_audit.py`, `human_voice_audit.py`, `resume_integrity_audit.py`, non-authorized renderers, `MANUAL_DRAFT.txt` labeling). It never invokes the runtime, creates receipts, or updates the tracker through authorized wrappers.

For an authorized draft, do not reproduce this orchestration manually. The hardened runtime currently requires macOS or Linux; its Windows host preflight fails closed with `POSIX_RUNTIME_REQUIRED`. Only after the candidate-fit gate passes, run the non-model host preflight with `python native_resume_team.py --host <codex|claude> --check-host --config config.json`. Continue only on exit `0` with `ready: true`. Select a prospective sanitized output path but do not create it. Capture the runtime's exact stdout in a private temporary result file so finalization retains the sidecar path and digest; for example, run `runtime_result_file="$(mktemp)"` followed by `python native_resume_team.py --host <codex|claude> --job-description-file <private-exact-JD.txt> --output-dir <new-application-dir> --config config.json --run-id <run_id> --case-id <case_id> --as-of-date <YYYY-MM-DD> >"$runtime_result_file"`, preserving and checking the Python process exit status before parsing the single JSON result. The output directory must not exist before invocation: the runtime has no replacement mode, recomputes the same deterministic candidate-fit report before constructing its role adapter or output state, and creates output only after that report passes. It atomically preserves the exact request as `<output-dir>/job_description.txt`; it accepts only a byte-identical pre-existing regular file and never overwrites a different one.

For Codex only, omit model flags by default: the hardened subprocess ignores user configuration and transient parent-session settings, so the effective managed CLI default is unknown and must not be reported as an inherited profile, model, or Ultra setting. If the user explicitly requests pins, append `--model <exact-model>` and/or `--reasoning-effort ultra`. There is no runtime profile option. Never pass those Codex-only pins to Claude.

An exit-0 `resume-team-result/v2` result with `terminal_class: PUBLISHED` means only that an authorized, digest-verified `<output-dir>/resume.md` draft-stage artifact was atomically committed and read back. It is not a completed application package. Before accepting it, require the inline `candidate_fit_report` and `candidate_fit_report_digest` to exactly match the independently validated preflight report and canonical digest. Resolve `authorization_receipt_path` against `<output-dir>` when relative and require the resolved path's parent to equal the resolved output directory. Read only a regular, non-symlink file. Parse its exact `resume-team-final-receipt/v2` JSON, recompute its canonical digest, and require equality with `authorization_receipt_digest` and the inline `authorization_receipt`. Require matching result/receipt run and case IDs, require the receipt's candidate-fit report and digest to equal the result and independently validated preflight, and bind receipt `draft_digest` and `verified_target_digest` to `final_draft_digest` and the independently hashed `resume.md`.

The acceptance gate is executable, not optional prose. Extract the exact `authorization_receipt_path` and `authorization_receipt_digest` from the captured runtime result, resolve the path as described above, and require exit `0` plus `verified: true` from:

`python final_receipt_verifier.py --resume <output-dir>/resume.