docs(m1): add security model and complete the readme first screen

README.md

@@ -16,26 +16,79 @@ submits, never sends, never stores a credential.
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
-**Status:** pre-release. Nothing is built yet beyond the manifest; the build
-brief in `docs/build-brief.md` is the contract, and milestones ship in order
-(M1–M6).
+**Status:** pre-release, milestone 1 of six. The candidate profile, the
+scoring script, two skills and the host tool server are built; case folders,
+ingestion, correspondence, drafting and learning are not. The build brief in
+`docs/build-brief.md` is the contract, and milestones ship in order (M1–M6).
 
 ## Install
 
-Not installable yet. When released, the plugin is pinned by tag in the
-`ktg-plugin-marketplace` catalog:
+Read this first if you are not the author. The ingestion guard this plugin
+depends on is installed from a **self-hosted** Forgejo host,
+`git.fromaitochitta.com`, which a third party may not be able to reach. This
+repository is published as a working reference, not as a one-command install:
+if you cannot reach that host, everything here is readable and most of it
+runs, but the guarded ingestion path cannot be built. Saying so plainly is
+better than an install block whose first step fails for everyone but its
+author.
+
+The plugin runs on two surfaces, and they install differently.
+
+**Claude Code** — pinned by tag in the `ktg-plugin-marketplace` catalog:
 
 ```bash
 claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
 claude plugin install jobbsok@ktg-plugin-marketplace
 ```
 
+**Claude Cowork** — there is no marketplace command. Build the archive from
+this repository's explicit include list, then upload it through
+*Customize → Plugins*:
+
+```bash
+bash scripts/package_plugin.sh     # writes jobbsok.plugin
+```
+
+Never build that archive with a recursive zip of the repository root: it would
+ship `.git`, the virtualenv, the local-only `STATE.md` and everything under
+`.claude/`. The script exists so that cannot happen by accident.
+
+**Then, once, on either surface** — build the Python environment the scripts
+and the host tool server run on:
+
+```bash
+bash scripts/bootstrap.sh          # add --med-xlsx for the spreadsheet export
+```
+
+In an installed copy this builds the environment under `$CLAUDE_PLUGIN_DATA`,
+which survives a plugin update; the packaged archive deliberately excludes the
+virtualenv, so the bootstrap is the supported route there. Without it the
+`jobbsok-tools` server has no interpreter to run on and refuses to start
+rather than serving on whatever `python3` the PATH offers. `JOBBSOK_PYTHON`
+overrides the interpreter choice.
+
+**Finally, the workspace** — the plugin never guesses at a location:
+
+```bash
+export JOBBSOK_WORKSPACE=~/jobbsok-workspace   # or pass --workspace
+```
+
+The `kandidatprofil` skill scaffolds the tree on first run. The workspace is
+yours, lives outside this repository, and is never committed.
+
 ## Non-goals
 
 Submitting applications. Sending email. Any write to Finn.no or LinkedIn.
 Credential storage. Background jobs. Multi-user support. Recruiter-side
 features. Bulk listing harvest.
 
+## Security
+
+The trust model, the boundaries and the risks this design accepts are in
+[SECURITY.md](SECURITY.md). The short version: read-only against external
+sites, no credential handling, all data local, and every listing or email body
+passes the ingestion guard before it becomes a file.
+
 ## Changelog
 
 See [CHANGELOG.md](CHANGELOG.md).