feat: add offline career pilot curator CLI

[gustavomarques00]

Summary

Adds an offline deterministic CLI for the Career Pilot Curator.

Commands

• prepare
• assist
• notes
• classify
• synthesize

Safety

• no LLM;
• no providers;
• no telemetry;
• no GitHub publishing;
• PII sanitization;
• unsafe repository output blocked by default;
• human approval required.

Validation

• career-core tests (483);
• build;
• secret scan;
• CLI privacy and filesystem tests.

Pilot impact

This is a moderator support tool only.

P01 READY TO SCHEDULE remains unchanged.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
devflow	Ready	Preview, Comment	Jun 23, 2026 7:09pm
devflow-applyflow	Ready	Preview, Comment	Jun 23, 2026 7:09pm
devflow-financeiro	Ready	Preview, Comment	Jun 23, 2026 7:09pm
devflow-whatsapp	Ready	Preview, Comment	Jun 23, 2026 7:09pm

[gustavomarques00]

CLI code, security and smoke review

Decision:

CLI REVIEW APPROVED — READY TO MERGE

Validated:

• code scope;
• no external network or providers;
• safe filesystem boundaries;
• path traversal and symlink protection (fixed in 07c0159 → fix: harden career pilot curator CLI);
• PII sanitization including participant names;
• input size limit (INPUT_REJECTED_TOO_LARGE, exit 2);
• prepare / assist / notes / classify / synthesize smokes;
• insufficient evidence behavior (exit 4);
• human confirmation on synthesize without --yes;
• overwrite protection;
• exit codes;
• sanitized Markdown output;
• GitHub draft remains unpublished;
• automated tests (485) and build.

Review fixes applied on branch:

• realpath resolution blocks symlink escape into repo;
• participant name redaction in sanitized outputs;
• async synthesize write with human confirmation;
• session JSON observations without type field normalized.

No remaining P0 or P1 findings.

P01 READY TO SCHEDULE remains unchanged.