/tailor-resume

description: Tailor a resume to a job description, score it against ATS and HR rubrics, create a DOCX, and update the tracker.

Tailor Resume Only — Native Four-Role Team

Optimize and tailor the resume using concurrent Codex shell and file operations for speed. Target: 75-85% ATS + 70%+ HR with AUTHENTIC content.

Job Description

$ARGUMENTS

CANDIDATE-FIT PREFLIGHT (MANDATORY FIRST GATE)

Before scorer startup, research, resume development, any role/native-team invocation, output/application-directory creation, DOCX generation, or tracker work, resolve `master_resume_path` from `config.json` and put this exact job description in a private temporary UTF-8 file. Screen only that configured master resume—never a previously tailored resume. Generate one safe `run_id`, one safe `case_id`, and one strict ISO `as_of_date`, then run:

`python candidate_fit_preflight.py --resume <configured-master-resume> --job-description <private-exact-JD.txt> --run-id <run_id> --case-id <case_id> --as-of-date <YYYY-MM-DD> --json`

Require exit `0` and a valid `candidate-fit-policy-v3` report bound to the same IDs, date, master SHA-256, and exact-JD SHA-256. Canonically hash it as `candidate_fit_report_digest`. Continue only with exact threshold `70.0`, score at least 70, trustworthy extraction, zero hard knockouts, `passed: true`, and no codes. Exit `1`, a score below 70 (including 60–69), or any hard knockout is `REJECTED:CANDIDATE_FIT`; create no application directory, draft, DOCX, or tracker row and invoke no role or native team. Exit `2` or an unavailable, malformed, stale, non-canonical, or digest-mismatched report is `FAILED:CANDIDATE_FIT_PREFLIGHT` and fails closed. There is no automatic or manual workflow bypass. ATS and HR baselines are separate advisory diagnostics and cannot override this gate.

Instructions

You are the coordinator, not the resume author. The user has provided a job description above. Execute the following phases, keeping independent scoring and file work concurrent where safe.

---

NATIVE RESUME TEAM (mandatory)

Only after candidate fit passes, read `commands/resume-team.md`, run its host preflight, and invoke `native_resume_team.py` for the current host with the same run/case IDs, `as_of_date`, exact private JD file, and a prospective non-existing output path. Do not create the path first. Do not manually reproduce the role sequence for a publishable draft. The runtime runs `resume-researcher` -> `resume-writer` -> `resume-auditor`, then `resume-editor` only after `FAIL`, followed by a fresh Auditor. It validates handoff digests, parents, distinct identities, and replay state and allows at most two Editor corrections. The coordinator must not author or silently repair resume prose. Require macOS or Linux; Windows preflight fails closed with `POSIX_RUNTIME_REQUIRED`.

For Codex only, omit model flags by default because the hardened subprocess ignores user configuration and transient parent-session settings; do not claim an inherited profile, model, or Ultra setting. Add `--model <exact-model>` and/or `--reasoning-effort ultra` only when explicitly requested. There is no runtime profile option, and Claude must not receive Codex-only pins.

Accept the `resume-team-result/v2` runtime result only on exit `0`, `terminal_class: PUBLISHED`, and an independent SHA-256 match between `final_draft_digest` and the published `resume.md`. Require `candidate_fit_report` and `candidate_fit_report_digest` to exactly match the independently validated preflight. This is only an authorized, digest-verified Markdown draft-stage artifact—not a completed resume package. This command must still create and verify the resume DOCX, update and verify the tracker, clean up only after those gates, and complete its final report before reporting package completion.

If the runtime's defense-in-depth recomputation returns `REJECTED:CANDIDATE_FIT` or `FAILED:CANDIDATE_FIT_PREFLIGHT`, require the prospective output path to remain absent and stop without any role result, finalization, or fallback draft.

The `PUBLISHED` result must also contain an inline `resume-team-final-receipt/v2` `authorization_receipt`, its `authorization_receipt_digest`, and a durable `authorization_receipt_path`. Resolve it against the output directory when relative and require its resolved parent to equal the resolved output directory. Read only a regular, non-symlink JSON file; validate `schemas/resume-team-final-receipt.schema.json`, recompute its canonical digest, and match both receipt fields. Require matching run/case IDs; require the receipt's candidate-fit report and digest to match the runtime and independent preflight; and bind `draft_digest` and `verified_target_digest` to `final_draft_digest` and the independently hashed `resume.md`. Recompute `source_digest` from the current configured master and `job_description_digest` from the fixed sibling `job_description.txt`; require a SHA-256 Researcher artifact and distinct same-host native Researcher/Auditor identities. Require exact `auditor_attestation` with a native agent ID, SHA-256 artifact digest, PASS verdict, and the same draft digest. Require exact `authorization_report` with the same draft, `passed: true`, no codes, and exactly three ordered named PASS votes—`evidence`, `human_voice`, `canonical_integrity`—with no codes, the same draft, and distinct invocation IDs. Its canonical digest must equal `authorization_digest`, and `vote_invocation_ids` must equal the vote IDs in order. Require a publication ID. Fail closed on any missing, malformed, stale, or mismatched value, and preserve the durable sidecar during cleanup.

Draft-stage publication requires a final Auditor `PASS` plus three independent exit-0 votes on the exact same final digest: `evidence_audit.py`, `human_voice_audit.py`, and `resume_integrity_audit.py`. Scores are advisory and cannot override these gates.

Authorization is byte-specific and immutable. Once the runtime publishes the autho