Integrate Brooks recruiting app through the Lua hook SDK

[eric-levinson]

Goal

Connect Brooks's CFB27 recruiting Electron app to the supported @cfb27/lua-hook SDK without copying pipe, process-discovery, installer, eval, or memory primitives into the app.

References

• Repository design: https://github.com/eric-levinson/cfb27-lua-hook/blob/main/docs/superpowers/specs/2026-07-11-cfb27-lua-hook-repository-design.md
• Protocol v1: https://github.com/eric-levinson/cfb27-lua-hook/blob/main/docs/protocol.md
• SDK/CLI runtime verification: https://github.com/eric-levinson/cfb27-lua-hook/blob/main/docs/research/runtime-verification.md
• Recruiting app source: https://github.com/brooksg357-a11y/cfb27-dynasty-modding
• Design input: the live-hook recruiting assessment Brooks shared during the host redesign; its key recommendation was to connect Electron main to the persistent host rather than revive remote injection.

Acceptance criteria

• Electron main imports @cfb27/lua-hook and owns the host connection.
• Startup performs hello capability negotiation and handles protocol/version mismatch.
• A selected-recruit read-only live overlay can display supported host-derived state alongside saved recruiting data.
• Cursor-based events reconnect without duplicating already-seen events.
• The preload exposes a narrow typed API for status, selected-recruit reads, and subscriptions.
• The renderer never receives raw evaluate, runScript, address, AOB, read_u8, or write_u8 access.
• Host unavailable, timeout, unsupported build, and reconnect states use stable SDK error codes.
• No installer mutation occurs from doctor/read-only connection flows.
• Tests cover Electron-main adaptation, preload isolation, capability fallback, cursor advancement, and disconnect/reconnect.
• Offline-only scope and the absence of any anticheat bypass remain explicit.

Out of scope

• Reintroducing the archived save-editor UI into this repository.
• Renderer-accessible arbitrary Lua or memory APIs.
• Live recruiting writes before a separate reviewed transaction design proves authoritative objects, compare-before-write checks, readback, rollback, and save behavior.

[eric-levinson]

Read-only recruiting-app integration is now open as a draft upstream PR: https://github.com/brooksg357-a11y/cfb27-dynasty-modding/pull/1

It pins v0.1.0-dev.1, keeps the SDK in Electron main, exposes only sanitized status plus game_ready/tick events, and adds reconnect coverage. No Lua/memory/write APIs are exposed to the renderer.