Create or open by link
No registration or login; the private route resolves the workspace capability.
CareerVector web edgeBlueprint · careervector.blueprint-graph/v7
Graph explorer
Twenty composable top-level diagrams plus recursively nested 21×21 semantic layers. Nodes descend; boundary arrows cross to neighbours.
Nested layer 1 · product · control · privacy · evidence
CareerVector workspace link access
The private workspace link grants write and collaboration access, a derivative link grants read-only access, and provider login remains separate device authority.
- Create or open by link to Private write link: create or resolve
- Private write link to Canonical workspace: grant access
- Private write link to Link collaboration: share deliberately
- Read-only derivative to Link collaboration: narrow to read-only
- Canonical workspace to Injected tool scope: inject bounded capability
- Link collaboration to Injected tool scope: preserve link scope
- Injected tool scope to Separate provider authority: bind separately
- Rotation · export · erasure to Canonical workspace: clone, retire, export, or erase
- Rotation · export · erasure to Separate provider authority: revoke separately
Private write link
Possession grants workspace read/write authority and is explained as the access key.
CareerVector workspace edgeCanonical workspace
D1/Yjs stores content and clocks; the link addresses it without an account record.
CareerVector D1/YjsLink collaboration
Trusted people use the same write capability; device/actor provenance remains visible.
Workspace participantsRead-only derivative
A separate mirror route enforces write denial server-side.
CareerVector web edgeInjected tool scope
A trusted host resolves the private link and injects bounded workspace/thread authority; the model never sees it.
CareerVector tool hostRotation · export · erasure
Link disclosure and data lifecycle need explicit clone/retire, export, erasure, and support behavior.
Product ownerSeparate provider authority
Device-local connector login can expire or be revoked without changing workspace access.
Provider connector01 · boundary · as-built Create or open by link No registration or login; the private route resolves the workspace capability.
CareerVector web edge02 · boundary · as-built Private write link Possession grants workspace read/write authority and is explained as the access key.
CareerVector workspace edge03 · store · as-built Canonical workspace D1/Yjs stores content and clocks; the link addresses it without an account record.
CareerVector D1/Yjs04 · policy · as-built Link collaboration Trusted people use the same write capability; device/actor provenance remains visible.
Workspace participants05 · boundary · as-built Read-only derivative A separate mirror route enforces write denial server-side.
CareerVector web edge06 · boundary · target Injected tool scope A trusted host resolves the private link and injects bounded workspace/thread authority; the model never sees it.
CareerVector tool host07 · process · open Rotation · export · erasure Link disclosure and data lifecycle need explicit clone/retire, export, erasure, and support behavior.
Product owner08 · boundary · as-built Separate provider authority Device-local connector login can expire or be revoked without changing workspace access.
Provider connector
Flows
- Create or open by link → Private write link create or resolve
- Private write link → Canonical workspace grant access
- Private write link → Link collaboration share deliberately
- Read-only derivative → Link collaboration narrow to read-only
- Canonical workspace → Injected tool scope inject bounded capability
- Link collaboration → Injected tool scope preserve link scope
- Injected tool scope → Separate provider authority bind separately
- Rotation · export · erasure → Canonical workspace clone, retire, export, or erase
- Rotation · export · erasure → Separate provider authority revoke separately
Canonical architecture note
Open note ↗CareerVector Workspace Link Access
Outcome
A person creates or opens a private CareerVector workspace without registration or login, shares that workspace deliberately, and can use web or TUI clients without inventing a first-party identity layer. Provider authorization is a separate device action and does not grant workspace access.
Authorities
- The private workspace URL is the write-capability and collaboration credential.
- A read-only derivative URL addresses a server-enforced mirror and never gains write authority.
- D1/Yjs remains authoritative for workspace content and operation clocks.
- A device identifier supplies collaboration and operation provenance. It is not an account, membership record, recovery principal, or authorization source beyond the link capability.
- Connector credentials and presentation settings belong to device-private or provider-owned storage. They do not enter canonical workspace state.
Workspace links and identifiers do not cross to JobCache or model providers. A connector host receives an injected, bounded workspace capability only at the CareerVector tool boundary; the model cannot supply or widen it.
Client attachment
The browser and Tauri clients resolve the workspace directly from its private route. The production TUI will
attach to the same workspace by an explicit paste/open-link ceremony and then use the normal read,
operation, and realtime contracts. Its current local application.json adapter is transitional
and does not alter this authority model.
Sharing the write link grants the same workspace authority. Product language must say this plainly. If a narrower collaborator role is needed later, it must be a new explicit capability, not a hidden account-membership system.
Lifecycle and recovery
- Lost browser/device state: reopen the saved private link; no account-recovery flow exists.
- Lost link: CareerVector cannot recover authority from email, IP address, provider identity, workspace content, or device telemetry.
- Read-only sharing: mint/use a mirror link whose write denial is enforced server-side.
- Suspected disclosure: link rotation, clone-and-retire, export, and erasure behavior must be explicit and recoverable before being promised as built.
- Provider authorization loss: workspace access remains intact; only that connector becomes unavailable until reauthorized.
- Connector failure: direct browser/TUI/Tauri workspace work remains available.
Acceptance evidence
- no first-party registration, login, session, membership, or account-recovery route is required;
- an unknown workspace link cannot enumerate another workspace;
- write-link collaboration converges and read-only derivatives reject every server-side write;
- provider login never grants workspace access and workspace access never grants provider login;
- TUI attachment preserves unknown fields and uses canonical clocks/operations rather than a whole-workspace overwrite;
- export, erasure, link-disclosure recovery, and support-capability behavior are explained and tested without fabricating recoverable identity.