Management Federation

Outcome

Let humans and agents investigate the whole product family through one coherent object model without moving product authority, private data, or state-changing code into a central dashboard.

Ownership model

The product authority emits a typed observation. Management indexes and correlates that observation. Authority remains with the producer.

Common object path

domain-owned observation
  -> normalized envelope
  -> nine-hub semantic references
  -> Ops / QA / Status / Wiki / agent projection
  -> investigation
  -> separately authorized command intent, if change is required

The nine hubs remain exactly Idea, Implementation, Journal, Behaviour, Suite, Test, Anomaly, Infra, and Event. Blueprint, Presentation, Status, and Operating Obligation are projections or boundary records, not additional hub kinds. See Knowledge Graph Source of Truth.

Observation envelope

Every promoted observation needs:

• a stable object and observation ID;
• producer, product, environment, and timestamp;
• semantic hub references and architecture module references;
• data classification and redaction declaration;
• evidence location, freshness, and confidence;
• correlation IDs for release, incident, request, or command where available.

The exact wire schema is still open. Until it exists, individual products remain authoritative and Management must label any adapter-specific projection honestly.

Read and write seams

Reads may federate broadly over the fields each producer declared safe. Writes never federate implicitly. A state change crosses back into the owning product only through Management Command Contract.

Failure and recovery

• A missing producer yields a degraded or stale projection, not invented healthy state.
• A schema mismatch quarantines the observation and raises an architecture/implementation drift signal.
• A correlation failure keeps the original evidence addressable.
• A command failure remains owned and recoverable in the target domain; Management retains its receipt.

Privacy

CareerVector's private workspace seam is structural. Aggregate telemetry and explicitly attached support evidence may cross it. Raw workspace content does not cross because an operator or agent would find it convenient.

The TUI and Tauri desktop app are device-side product perspectives, not managed fleet agents. Management may publish signed release and connector manifests to them and receive explicit content-free update or support evidence. It cannot inventory private application directories, retrieve provider credentials, or issue ambient commands to a person's machine.

Acceptance evidence

• One user symptom can be traced through a product observation to architecture, implementation, test, deploy, and current runtime evidence.
• The same investigation is expressible in human UI and agent API/MCP terms.
• Removing Management does not remove any product's execution or recovery authority.
• A CareerVector operator cannot enumerate private workspace content.

Open decisions

• Normalized observation schema and retention.
• Correlation and identity rules across the three management authorities.
• Which rollups are materialized versus computed on demand.
• Promotion rules from runtime data into Anomaly, Event, and Journal hubs.