RADAR Architecture

RADAR is the CareerVector-to-JobCache feature slice: how a JobCache role reaches a person and how purpose-approved feedback returns. For compactness this diagram combines JobCache App and JobCache Core in the upper box. The canonical three-zone boundary is System Architecture.

Status (2026-08-17): CareerVector's seam, strict Core role search and participant erasure lifecycle are implemented. Direct-database/public-search compatibility paths and production activation of the new credentials/migrations remain; JobCache App is implemented separately and is not part of RADAR's applicant-facing runtime.

an operator · an advertiser an LLM · an API client JOBCACHE APP + CORE compressed view · role-centric website MCP server public API the public corpus product · search, browse, ad performance CrateDB doc.ads · job_vec · person_vectors · graph_edges corpus pipeline normalise · disambiguate ad→role embed · enrich · index inbound writes search executor FAST lane · a person is waiting recommendation engine SLOW lane · nobody is waiting internal API + worker authenticated JobCache internal API — faces CareerVector radar_list ↓ SLOW · batch search results ↓ FAST · a person waits ↑ query · counters FAST · purpose-scoped ↑ person_key SLOW · pulled PRIVACY SEAM — workspace_id never crosses upward dashed = FAST lane · a compatible committed snapshot is the fallback floor CAREERVECTOR — human-centric human-centric · owns identity internal API + worker sees ALL workspaces · authenticated · not part of the public product inbound writes collector FAST lane · counters, live query collector SLOW lane · vectors, edges D1 radar_list · profiles · impressions · by workspace_id reduction pipeline pseudonymise individual OR threshold aggregate build the purpose-approved artifact public API exactly ONE workspace per request · link = identity · cannot enumerate website · RADAR modal MCP server a person an LLM · an API client

Reading the diagram

Mark Means
Teal outline transforms data — the pipelines and the boundary modules
Red outline privacy-critical — authenticated internal product protocol, never a public product route
Heavy outline must be reachable — the public API
Thin outline a perspective — a facade on the public API
Grey fill a store — it holds, it does not transform
Solid arrow slow lane — batch, nobody is waiting
Dashed arrow fast lane — synchronous, a person is waiting
Red dashed rule the privacy seam. workspace_id never crosses it

The claims

JobCache is compressed here, not renamed

The upper box contains both JobCache App perspectives and JobCache Core corpus services so the RADAR round trip remains readable. The privacy seam drawn here is CareerVector's seam with JobCache Core. The independent JobCache App/Core seam is visible in the canonical three-zone graph.

The emitter enforces the privacy class

CareerVector owns the only workspace_id ↔ person_key map. Individual recommendation facts cross with a typed pseudonym reference. The deployed pk_ bytes remain compatibility epoch 0 so existing Core history is not split; a later v1 rotation requires Core aliases and a backfill. Anonymous metrics cross only after thresholding and carry no participant key. JobCache Core does not receive workspace_id. Pseudonymous does not mean anonymous.

Fast response and durable agreement are both required

The fast answer returns directly from JobCache Core, without a D1 read-back. Its immutable snapshot and the workspace pointer commit atomically before success is reported. The pointer makes every workspace participant agree on one list. A compatible stored snapshot is the fallback floor; first use without one may be unavailable.

Slow facts are pulled and deliveries are idempotent

JobCache Core claims versioned person facts, acknowledges only durably accepted fact IDs and leaves rejected facts visible in quarantine. Recommendation delivery has a stable batch ID and cannot overwrite different bytes under an existing result ID. Each source advances with a composite cursor. Shown and picked are independent streams, so a pick made after the shown fact was acknowledged is not lost.

Roles are the result unit

RADAR returns roles with ad evidence. JobCache Core owns role projection, stable identity, ranking and aliases. CareerVector owns workspace presentation, interaction capture and the one current snapshot pointer.

Vocabulary

Term Means
Ad one posting on one board — evidence, never shown alone
Role one hiring intent, backed by one or more ads — the user-facing unit
Profile the person a workspace serves. Never a list. Scoped to the workspace, not to a human
Search results roles returned for an active, typed query
Recommendations roles surfaced passively from the profile

“Candidates” is not used: in a hiring product it means applicants.

As built

CareerVector has RADAR public routes, grounded/idempotent interaction capture, D1 snapshots and grants, and the first collector/seam implementation. JobCache Core exposes a strict role-shaped search route; CareerVector normalizes the request and verifies both request and snapshot hashes before accepting it. Live snapshots, grants and the workspace pointer commit atomically. Claim/ack uses authenticated leases, byte bounds, exact partitions, durable receipts/quarantine and composite cursors. Claimed facts use the shared typed participant (CareerVector compatibility epoch 0), privacy and content-ID contract. Delivery requires the pseudonymous-person context, rejects identity-bearing or unknown metadata, and verifies content identity before its atomic commit. Direct CrateDB and the rolling legacy public-search fallback remain interim. The participant erasure slow lane is complete: workspace deletion atomically queues every persisted key epoch, Core writes a monotonic tombstone and CareerVector clears the outbox only after a verified deterministic receipt. The remaining slow-lane recommendation worker is separate work; JobCache App's observer mirror is implemented but awaits deployment.

Source: wiki/content/architecture/RADAR-ARCHITECTURE.md