Privacy boundary
No workspace link, CV, notes, prompt, transcript, provider credential, or local application directory crosses by default.
CareerVectorBlueprint · careervector.blueprint-graph/v7
Graph explorer
Twenty composable top-level diagrams plus recursively nested 21×21 semantic layers. Nodes descend; boundary arrows cross to neighbours.
Cell 4.4 · operations · governance · privacy · evidence
CareerVector management
CareerVector Management observes services and releases across browser, TUI, and Tauri without acquiring workspace content, provider credentials, or ambient device control.
- Service + client evidence to Privacy boundary: minimize
- Participant-scoped support to Privacy boundary: bound disclosure
- Participant-scoped support to Release + recovery: request owned action
Service + client evidence
Health, realtime, releases, connector manifests, conformance, costs, and content-free failure classes.
Open layer ↘Participant-scoped support
A link holder deliberately supplies bounded diagnostics or a short-lived support capability.
Workspace participantRelease + recovery
Web deploy, TUI/cterm artifact, Tauri bundle, connector supply, rollback, and user-visible recovery retain proof.
CareerVector Management- 01 · store · mixed Service + client evidence
Health, realtime, releases, connector manifests, conformance, costs, and content-free failure classes.
Open deeper layer ↘ 02 · policy · target Privacy boundary No workspace link, CV, notes, prompt, transcript, provider credential, or local application directory crosses by default.
CareerVector03 · boundary · open Participant-scoped support A link holder deliberately supplies bounded diagnostics or a short-lived support capability.
Workspace participant04 · process · target Release + recovery Web deploy, TUI/cterm artifact, Tauri bundle, connector supply, rollback, and user-visible recovery retain proof.
CareerVector Management
Flows
- Service + client evidence → Privacy boundary minimize
- Participant-scoped support → Privacy boundary bound disclosure
- Participant-scoped support → Release + recovery request owned action
Canonical architecture note
Open note ↗Management
Outcome
Give humans and agents one explainable way to observe, understand, and intentionally change the system without creating shadow schedulers, hidden database writes, or unaudited control paths.
Full-height Management rail
02 policy · obligations · governance
09 JobCache operation
09 observability · monitoring · Ops · QA · Status · Wiki
09 CareerVector operation
14 change · release · recovery · audit · accountability
Management owns the entire fourth column. It is a federation of operational perspectives and product-owned control boundaries, not a common backend and never a superuser over JobCache, CareerVector, AI providers, user workspaces, or participant devices.
Perspectives
| Perspective | Role |
|---|---|
| Ops | Authenticated diagnosis and named operator commands |
| QA | Tests, suites, releases, regressions, and evidence |
| Status | Bounded public service truth and incident communication |
| Wiki | Git-backed architecture, decisions, runbooks, code links, and retrieval |
| Observability | Metrics, logs, traces, costs, freshness, drift, and audit events |
These perspectives may share schemas, navigation, and knowledge. Their runtime data and authority remain owned by the relevant product.
The internal subdivision and shared envelope are defined in Management Federation. Management is a federation of three product authorities, not a common backend: JobCache Management, Internals Management, and CareerVector Management publish bounded observations into shared perspectives while retaining their own data and execution authority.
CareerVector's terminal TUI and Tauri desktop app add device-side operational boundaries. Management may own release manifests, signed artifacts, connector-version policy, conformance evidence, and content-free error classes. It does not remotely control either client, receive provider credentials, or turn a private device into an operator data source. Device diagnostics cross only when the workspace participant explicitly supplies a bounded support bundle.
Control model
Every state-changing action is a typed command with declared authority, scope, preconditions, expected evidence, and an immutable receipt. Dashboards are projections; they do not acquire write authority merely by displaying state.
The same envelope crosses each product-management seam:
product-owned observation -> Management projection -> investigation
-> typed command intent -> product-owned execution
-> receipt + verification -> Management projection
The recursive command layer is specified in Management Command Contract.
AI-native operator
The agent operator reads the same architecture and evidence as a human. It must be able to trace an alert to a module, contract, implementation, test, deployment, and permitted action. Unknown authority or missing evidence means explain and escalate, not improvise a write.
Current state
Wiki, QA, Status, CareerVector Ops, JobCache Ops, and the shared Ops aggregation layer are as-built perspectives with different levels of evidence. A single normalized observation envelope, cross-product correlation contract, consistent command/receipt protocol, and complete architecture-drift gate remain target work.
Decisions still required
- Command and approval model.
- Unified observation envelope, classification, correlation, and retention.
- Incident and change-management lifecycle.
- Cost, quota, budget, and capacity controls.
- How architecture drift becomes a failing quality signal.
- TUI and Tauri release/connector supply-chain evidence and participant-controlled diagnostic bundles.
Completion evidence
Run the same proof for JobCache and CareerVector: read-only correlation from a symptom to runtime evidence, followed by a separately authorized, audited, idempotent product-owned action and verified recovery. Removing Management must leave both products able to execute and recover on their own.