Parly Talent: your candidate profile

Talent is a separate, gated experience. It is unavailable unless the server and web deployment enable TALENT_ENABLED=1.

At /talent/profile, connect GitHub or sign into your existing Parly account first to link it. GitHub sign-in uses a verified primary email and stable GitHub ID. Matching email addresses never silently merge accounts. Only public repositories, public merged-PR counts, languages, and GitHub's restricted contribution count are collected. No private repository names or contents are requested. Tokens are discarded after extraction.

The top of the profile has large GitHub, LinkedIn and Work email controls with connection states. Connections are optional. LinkedIn says Not available yet unless the Hub has its dedicated verification configuration; the rest of the flow still works.

Choose Create my profile to combine your connected GitHub technology/activity signals with an optional CV or LinkedIn export (pasted text or a PDF up to 3 MB). The draft has a suggested headline, professional summary and self-reported experience for you to review, edit or discard. Experience comes only from your supplied document; GitHub activity and a verified email never establish employment. No document is needed to create a profile from connected signals. Document extraction requires configured Vertex AI, uses your Parly AI credits and allows five imports per hour.

The new draft path sends source text/PDF bytes transiently to the model; Talent does not upload them to its durable file store. Only approval saves the profile. Saved headline/about/experience are normalized to controlled professional roles, seniority, technology labels and valid dates. Employer names, names, contact details, URLs, GitHub handles and repository names are removed from those matching fields. The current finite technology/role vocabulary can omit uncommon specialties. Open to, private preferences and blocked employer domains remain editable owner-only fields and may contain whatever you enter; do not put identifying details in them. Verified work domains stay blocked. Existing legacy profiles are converted when explicitly saved; this change does not bulk-delete existing data or previously uploaded files.

LinkedIn is an account-connection flag, not identity or employment verification. It uses the exact Composio auth config selected by TALENT_LINKEDIN_AUTH_CONFIG_ID, with no automatic fallback. The approved managed config also requests posting permission on its consent screen; Talent itself calls only the read-only GET_MY_INFO tool and never posts. A custom openid/profile-only config can replace it later by changing the configured ID. The Hub checks its own ACTIVE account for the signed-in person and runs the fixed LINKEDIN_GET_MY_INFO action against that exact account. The response is discarded; only the connection flag is kept in the profile. A separate uniqueness collection keeps the HMAC of the provider subject, keyed using CREDENTIALS_KEY, so one LinkedIn account cannot be claimed by multiple profiles. Preserve/migrate those identity hashes before rotating the key. A callback state cookie is single-use and bound to the current session.

The anonymous preview shows the last approved, saved server summary and a stable random alias. It includes visible role count, controlled role/seniority/technology labels, merged aggregate duration and GitHub counts; it excludes names, employers, contact details, dates, URLs and private preferences. Missing/invalid end dates on newly normalized roles do not create ongoing employment; mark a current role Present explicitly. Concurrent saves return a conflict rather than overwriting another version.

API: POST /me/profile/draft accepts optional {text} or {pdf} (base64), returns a draft and does not save it. PATCH /me/profile approves matching facts plus private preferences. GET /me/profile/connections exposes availability; POST /me/profile/linkedin/connect accepts an opaque state and returns the dedicated OAuth URL; POST /me/profile/linkedin/verify checks the current person's provider connection. All require a human session and the Talent gate.

LinkedIn deployment: configure COMPOSIO_API_KEY, CREDENTIALS_KEY, TALENT_URL and TALENT_LINKEDIN_AUTH_CONFIG_ID on the Hub. Set the auth config ID to the operator-approved Composio LinkedIn configuration; only ACTIVE accounts from that exact config qualify. Prefer an openid/profile-only custom config when available. TALENT_URL is also used by the web callback. Missing configuration disables the LinkedIn control. Scope changes require an operator-selected auth config, not a fallback in Talent.

Deployment: configure TALENT_GITHUB_CLIENT_ID, TALENT_GITHUB_CLIENT_SECRET and TALENT_URL on the Hub, and TALENT_GITHUB_CLIENT_ID plus TALENT_URL on the web deployment. Register the exact TALENT_URL/talent/auth/github/callback OAuth callback. The browser flow uses an HttpOnly state cookie, PKCE and the current session binding. TALENT_ENABLED is off by default; enabling this slice does not constitute approval for a public launch.