Named intent
Versioned command type, target authority, scope, reason, and prohibited effects.
Authorized operatorBlueprint · careervector.blueprint-graph/v5
Graph explorer
Twenty composable top-level diagrams plus recursively nested 21×21 semantic layers. Nodes descend; boundary arrows cross to neighbours.
Nested layer 2 · control · privacy · operations · evidence
Typed Management command
A command is an explicit capability request to the owning domain, with authorization, preview, idempotent execution, evidence, receipt, and recovery.
- Named intent to Actor capability: authorize
- Actor capability to Preflight + preview: admit
- Preflight + preview to Idempotent execution: commit
- Idempotent execution to Immutable receipt: record
- Immutable receipt to Verify or compensate: prove outcome
- Verify or compensate to Named intent: close or compensate
Actor capability
Identity, delegated permission, expiry, data classification, and approval class.
Target productPreflight + preview
State/version predicates and the expected effects are checked before mutation.
Target productIdempotent execution
The owning runtime validates and performs exactly the allowlisted effect.
Target productImmutable receipt
Actor, capability, accepted preconditions, result, evidence, and recovery state.
Target productVerify or compensate
Expected evidence closes the command; partial or failed work invokes named recovery.
Management and target product01 · process · target Named intent Versioned command type, target authority, scope, reason, and prohibited effects.
Authorized operator02 · boundary · open Actor capability Identity, delegated permission, expiry, data classification, and approval class.
Target product03 · process · target Preflight + preview State/version predicates and the expected effects are checked before mutation.
Target product04 · service · target Idempotent execution The owning runtime validates and performs exactly the allowlisted effect.
Target product05 · store · target Immutable receipt Actor, capability, accepted preconditions, result, evidence, and recovery state.
Target product06 · process · target Verify or compensate Expected evidence closes the command; partial or failed work invokes named recovery.
Management and target product
Flows
- Named intent → Actor capability authorize
- Actor capability → Preflight + preview admit
- Preflight + preview → Idempotent execution commit
- Idempotent execution → Immutable receipt record
- Immutable receipt → Verify or compensate prove outcome
- Verify or compensate → Named intent close or compensate
Canonical architecture note
Open note ↗Management Command Contract
Purpose
Prevent dashboards, agents, and shared operator tooling from becoming unbounded writers. A Management command is an explicit request to a domain authority; it is never a hidden database mutation or a side effect of reading a panel.
Required envelope
| Field | Meaning |
|---|---|
| Command type and version | Stable, allowlisted operation with versioned semantics |
| Target authority | Product/runtime that alone may accept and execute the command |
| Actor and capability | Human or agent identity plus the exact delegated permission |
| Scope | Product, resource IDs, data classification, and expiry |
| Intent and reason | What outcome is requested and why |
| Preconditions | Version, state, evidence, and safety predicates checked before execution |
| Idempotency key | Retry identity that cannot repeat the effect |
| Preview | Expected effects and prohibited effects before approval |
| Approval | Policy and human authority required for this command class |
| Expected evidence | Signals that prove success, partial success, or failure |
| Recovery | Rollback or compensating command and its own authority |
Lifecycle
draft intent -> authorize -> preview -> approve -> execute at owner
-> immutable receipt -> verify evidence -> close or compensate
The receipt records the command version, actor, capability, target, accepted preconditions, execution result, evidence references, and recovery state. Audit failure must not be silently treated as command success.
Privacy and authority
- CareerVector commands are workspace-scoped and revocable; no generic workspace-query command exists.
- Internals commands operate through named orchestration, corpus, or maintenance APIs, never arbitrary SQL.
- JobCache customer support commands are separate from public-corpus commands.
- An agent can propose or execute only within the same declared capability model as a human.
Acceptance evidence
- Repeating the same command key cannot repeat its effect.
- Failed preconditions cause no mutation.
- Every successful effect has a durable receipt and observable verification.
- Every partially successful effect names the compensation path.
- Removing the Management UI does not remove the target runtime's command validator.
Open decisions
- Approval classes and separation of duties.
- Receipt storage and retention per product.
- Emergency/break-glass policy.
- Common envelope versus product-specific typed unions.