The product problem.
Career information tends to fragment across old CVs, job boards, notes and application portals. Generic AI tools add another problem: a polished answer can lose the connection to the fact that supports it.
CareerOS Local was designed as a working record first. Experience, education, skills and achievements keep provenance, verification state and revision history. The LLM then analyses that owned record for matching and coaching instead of inventing a second, disconnected profile.
What the system must protect.
The architecture follows four product constraints:
- Private career records, generated documents and analysis stay on the device.
- LLM-backed matching and coaching require an approved local runtime; there is no cloud-model fallback.
- Generated suggestions cannot silently replace source facts or their revision history.
- Backups, exports and erasure must cover both structured records and local artifacts coherently.
The design decision.
The hard part was not adding a chat panel. It was building a boundary between evidence, deterministic workflow state and model interpretation. Those three things have different failure modes and should not share one vague data structure.
I separated them into a career vault, reproducible readiness and application records, and schema-validated local analysis pipelines. The interface can show where a conclusion came from and which corrective action belongs in the source record.
A supervised local runtime.
Tauri owns the desktop shell and supervises a loopback FastAPI sidecar. React provides the workspace, SQLite and local artifacts hold the durable record, and a managed llama.cpp-compatible runtime performs required LLM analysis without becoming a storage layer.
Decisions that make it a utility.
The useful product is the complete workflow around the model.
Keep provenance in the record
Career facts retain their source, verification status and revisions. Resume content and application evidence can point back to that record.
This requires more structure than a free-form profile, but it makes corrections and audits possible.
Require local analysis
Opportunity matching and coaching fail closed until the approved local runtime is ready. The application never sends the task to a remote model as a convenience fallback.
First-run setup is heavier and hardware matters, but the privacy boundary stays honest.
Package applications as evidence
Versioned resumes, answers, requirement mappings and verified files can be exported with a canonical SHA-256 manifest.
A dossier is more deliberate than a folder of loose files; it is also reproducible and reviewable.
How the product is verified.
The repository tests Python services, React behaviour and Rust desktop integration. Database migrations run as upgrade, downgrade and upgrade round trips. Backup tests inspect versions 1–4 without mutation, then exercise replacement, corruption detection and verified rollback against disposable local data.
Release automation also checks dependency licenses, SBOMs, containers and high-severity vulnerability policy. Product-tour captures come from the real application with fictional data, and the recorder rejects browser errors, failed API responses and visible alerts.
What exists today.
CareerOS Local is a working desktop utility with a career vault, resume studio, private opportunity pipeline, application dossiers, backups, exports and a supervised local analysis runtime.
It does not claim that an LLM can decide a career. The model helps interpret an owned body of evidence; the user keeps the record, the source and the final decision.
Evidence ledger.
The current repository records these reproducible checks and boundaries:
- Backend
- 1,369 tests pass in the v1.6.0 candidate; an independent review reran 42 portability and storage tests.
- Frontend + shell
- 334 frontend tests across 64 files and 17 Rust library tests pass, including the native backup writer.
- Backup assurance
- Archives from versions 1–4 receive a full non-mutating preflight; the response contains bounded metadata, not archive content.
- Scale fixture
- A 10,000-application agenda fixture records p95 at 68.670 ms against its 200 ms project budget.
- Boundary
- Local receipts do not protect against a process that can write directly to the database; unsigned imports are quarantined.