CareerVector × Management
Purpose
Operate and support CareerVector without creating a privileged browsing surface over private workspaces, a remote-control plane over terminal or desktop clients, or an unrecorded path for agents to alter user state. This is the CareerVector-facing part of the full-height fourth-column Management rail.
Product-operation split
| Surface | CareerVector authority | Management may see | Management must not see or do |
|---|---|---|---|
| Web service | Availability, D1/Yjs/realtime paths, JobCache seam, canonical operations | Aggregate health, release, queue, cost, failure, and content-free audit evidence | Enumerate workspaces, recover a private link, or browse workspace content |
| Native TUI | Local workflow, local connector processes, provider login, native Typst/ruler, device settings | Signed-release state, connector manifest/version, conformance result, content-free error class | Inventory application roots, retrieve credentials/transcripts, or issue ambient device commands |
| Tauri desktop | Network-loaded browser UI, native adapter runtime, fetch/render bridge, updater, OS integration | Bundle and updater state, adapter/runtime health, conformance, and content-free errors | Read workspace content, provider credentials, local files, or invoke undeclared device commands |
| Support case | Participant-selected evidence and a short-lived support capability | Only the declared diagnostic bundle and resulting receipt | Expand scope beyond the bundle or turn support into standing access |
Operator pathways
- Understand aggregate web-service health, realtime behavior, work queues, connector/runtime release health, turn latency, limit/exhaustion classes, and content-free error classes.
- Investigate a user-reported problem with explicit, scoped evidence supplied by the user or generated by privacy-safe diagnostics.
- Publish and roll back signed cterm/TUI releases and approved connector manifests without gaining access to provider credentials, prompts, local application directories, or workspace content.
- Review QA, releases, incidents, migrations, and public status.
- Verify export, erasure, link rotation/clone recovery, and local-data cleanup through participant-controlled evidence.
Invariants
- There is no general operator workspace browser.
- Private prompts, documents, ChatGPT credentials, and workspace content do not enter telemetry by default.
- Every write to workspace truth uses the same typed operation contract as other actors.
- There is no operator account-to-workspace membership path. Support capability is initiated by a workspace-link holder, explicit, short-lived, scoped, revocable, and visible.
- Aggregate learning and observability cannot reconstruct a person's workspace activity.
- TUI release management targets manifests and signed artifacts, never individual devices.
Current state
CareerVector Ops/QA/Status/Wiki perspectives and web-service health evidence exist. The imported TUI has checksum-pinned managed connectors, rollback mechanics, hermetic protocol tests, and native renderer/ruler evidence, but its signed cterm-plus-TUI distribution is target work. A normalized CareerVector observation envelope, participant-generated support bundle, connector supply-chain projection, and product-owned command receipts remain target/open.
Decisions still required
- Support-capability lifecycle and participant-controlled evidence-sharing UX.
- Privacy-safe telemetry tiers and redaction contract.
- Web assistant execution placement and recovery without first-party accounts.
- Signed TUI/cterm update policy, connector-manifest authority, rollback, and conformance gates.
- Operator approval boundaries for connector runtime/protocol changes.
Completion evidence
Resolve one web and one TUI support case using only participant-scoped evidence; prove denial of unrelated workspace and device access; audit every state-changing action; roll a connector or TUI release forward and back; verify erasure and credential isolation end to end.