CareerVector / JobCache Resource Map

Status: repo-derived inventory, last reviewed 2026-05-30.

This is the operator map for active and near-active infrastructure. It is not a secret inventory and not a full provider audit. Secret values stay in ~/.agent/secrets/*.yml or provider-side secret stores.

Operating Rules

Rule	Meaning
Free tier first	Paid plans are not the operating floor. Usage-billed grants need caps.
Cloudflare is customer-serving budget	Avoid broad background orchestration on Workers.
CrateDB is shared knowledge	JobCache owns objective ad/role data, observations, chunks, embeddings, leases, and shared work cache.
D1 is private workspace state	CareerVector workspace documents, private read models, and QA evidence stay in D1/R2.
S3 means online storage	JobCache snapshots and shared blobs belong in online S3-compatible storage.
Devices are compute first	Desktop clients and owned containers outrank Render fallback compute.
IaC or exception	Resources are in Pulumi/wrangler unless explicitly dashboard/API-owned.

Topology

CareerVector user
  |
  +-- Cloudflare Workers: UI / API / MCP / wiki / status / ops / QA
  |     +-- D1 careervector: private workspace state and ops read models
  |     +-- R2 careervector: workspace files and larger blobs
  |     +-- CF realtime relay: careervector-relay-cf + Durable Object
  |
  +-- Deno Deploy relay: careervector-relay-deno
  +-- Koyeb Typst: PDF compilation
  +-- Jina / Google Maps / AI providers: URL readout, commute, LLM work
  |
  +-- shared lookup / bottom-up observation
        v
JobCache shared data layer
  |
  +-- CrateDB: ads, roles, observations, work leases, chunks, embeddings
  +-- Backblaze B2: online S3-compatible snapshots
  +-- Render jobcache-interface: UI + API + MCP, fallback Device path only
  +-- Cloudflare Workers: JobCache wiki / status / ops / QA perspectives

CareerVector

Resource	Runtime / provider	Source of truth	Purpose
Product workers: `careervector-ui`, `careervector-api`, `careervector-mcp`	Cloudflare Workers	`ui/`, `api/`, `mcp/` wrangler files; domains in `infra/cloudflare.ts`	Main app, API, MCP.
Perspective workers: wiki, status, ops, QA	Cloudflare Workers	`wiki/`, `status/`, `ops/`, `qa/`; domains in `infra/cloudflare.ts`	Operator and knowledge surfaces.
Realtime relay `careervector-relay-cf`	Cloudflare Worker + Durable Object	`relay/cf/wrangler.toml`, `infra/cloudflare.ts`	Thin realtime byte relay.
Relay `careervector-relay-deno`	Deno Deploy	`relay/deno/`; DNS records in `infra/cloudflare.ts`	Fallback relay. Cloudflare only owns DNS for `deno.relay...`.
D1 `careervector`	Cloudflare D1	`*/wrangler.toml`	Private workspace state, read models, operational ledgers.
R2 `careervector`	Cloudflare R2	`*/wrangler.toml`	Workspace files and larger objects.
D1/R2 QA resources	Cloudflare D1/R2	`qa/api/wrangler.toml`	QA queues, evidence, artifacts.
Typst compile service	Koyeb	`TYPST_COMPILE_URL`, `julian-corbet/typst-compile`	CV/CL PDF compilation. Dashboard/API-owned today.
CircleCI + `corbet/unraid`	CircleCI + self-hosted runner	`.circleci/config.yml`, `~/.agent/topics/server/k3s-ci-runner.md`	CI and QA evidence. Self-hosted runner only; no CircleCI cloud credits.
Axiom `cv_telemetry`	Axiom	`ops/api/wrangler.toml`, `ui/vite.config.ts`	CareerVector telemetry and errors.
FalkorDB graph `careervector`	FalkorDB	wiki/ops/QA wrangler files	Graph-backed wiki/ops experiments.
Jina, Google Maps, AI providers	Third-party APIs	code + `~/.agent/secrets/*.yml`	URL readout/import, commute/geocoding, LLM cascade.

JobCache

Resource	Runtime / provider	Source of truth	Purpose
`jobcache-interface`	Render free web service	`jobcache/infra/render.ts`	UI + REST API + MCP by host routing. Not an always-on scraper.
`jobcache.corbet.ch`, `api.`, `mcp.`	Cloudflare DNS -> Render	`jobcache/infra/cloudflare.ts`	DNS-only CNAMEs to the Render interface service.
JobCache wiki/status/ops/QA workers	Cloudflare Workers	`jobcache/*/wrangler.toml`, `jobcache/infra/cloudflare.ts`	Perspective surfaces, not the main interface process.
D1 `jobcache-qa` + R2 `jobcache-qa-artifacts`	Cloudflare D1/R2	`jobcache/qa/api/wrangler.toml`, `jobcache/infra/cloudflare.ts`	QA state and artifacts.
CrateDB cluster `jobcache`	CrateDB Cloud CRFREE (West Europe, Azure)	`jobcache/migrations/cratedb/schema.sql`; DSN in Pulumi secret `jobcache:cratedbDatabaseUrl`	Hot DB since the 2026-06 cutover (see CRATEDB-MIGRATION.md). Shared public ad/role store, observations, leases, chunks, embeddings.
CockroachDB cluster `jobcache`	CockroachDB Cloud Basic	`infra-corbet-ch` repo, `cloud/jobcache/cockroach.ts`	Dormant/rollback-only since the CrateDB cutover (RU-disabled; kept `protect: true` for optional historical backfill).
B2 `jobcache-snapshots`	Backblaze B2 S3-compatible storage	`jobcache/infra/backblaze.ts`	Compressed JSON-LD snapshots and re-extraction insurance.
Axiom `jobcache_telemetry`	Axiom	`jobcache/shared/src/observability.ts`	JobCache events and captured errors.
Browserbase / Firecrawl	Third-party APIs	JobCache ops env model + secrets	Candidate extraction helpers. Keep fenced by quota and capability.

Compute Order

Rank	Compute	Role	Boundary
1	CareerVector desktop clients	Preferred Device compute for scrape/chunk/embed work after opt-in	Broker token only; no DB/B2 credentials.
2	Owned containers	Self-hosted Device pool on Unraid/k3s or similar	OCI/Kubernetes first; Docker image for portability.
3	Render `jobcache-interface`	Last-resort Device/API process	Explicit deploys; idle/exit after work.
4	Limited free provider credits	Emergency browser/extraction helpers	No automatic dependency on usage-billed credits.

Credentials

Secret file	Resource family	Status
`~/.agent/secrets/cloudflare.yml`	Workers, D1, R2, DNS	Active
`~/.agent/secrets/deno.yml`	Deno Deploy relay	Active
`~/.agent/secrets/koyeb.yml`	Typst compile	Active, slot full
`~/.agent/secrets/render.yml`	Render JobCache interface	Active
`~/.agent/secrets/cratedb.yml`	CrateDB JobCache hot DB	Active
`~/.agent/secrets/cockroach.yml`	CockroachDB JobCache	Dormant cluster (rollback only)
`~/.agent/secrets/backblaze.yml`	B2 `jobcache-snapshots`	Active
`~/.agent/secrets/circleci.yml`	CircleCI API/project access	Active
`~/.agent/secrets/axiom.yml`	`cv_telemetry`, `jobcache_telemetry`	Active
`~/.agent/secrets/falkordb.yml`	Wiki/ops graph	Configured/prototype
`~/.agent/secrets/jina.yml`, `google-maps.yml`, AI-provider files	Enrichment providers	Capability-dependent
`~/.agent/secrets/browserbase.yml`, `firecrawl.yml`	Extraction candidates	Candidate
`~/.agent/secrets/back4app.yml`, `huggingface.yml`	Free container candidates	Candidate

Never copy token values into repo docs, wrangler files, Pulumi config, or browser-visible environment variables.

Known Drift

Declaration	Problem	Next action
Root `wrangler.toml` worker `careervector`	Active topology uses package-specific workers.	Verify live state and retire if unused.
`workers/realtime/wrangler.toml` worker `careervector-realtime`	Current realtime path is `relay/cf/` + `WORKSPACE_DOC`.	Verify routes, then retire if unused.
Older docs saying Render runs always-on ingest	Architecture says Render is fallback Device/API compute only.	Clean stale references as encountered.
Browserbase/Firecrawl as regular ingest	Quota and lock-in risk.	Keep behind explicit capability/cost gates.

Live Verification Order

Cloudflare: Workers, D1, R2, DO bindings, DNS, custom domains.
Deno: relay health and DNS/CNAME ownership.
Render: jobcache-interface health, domains, autoDeploy=false.
CrateDB: cluster, doc schema, disk posture, keepalives. (Cockroach cluster dormant, rollback only.)
Backblaze: bucket, endpoint, app-key scope.
Axiom: cv_telemetry and jobcache_telemetry ingest/query access.
Candidate hosts/providers: access exists, but no production dependency.