CareerVector Workspace Link Access

Outcome

A person creates or opens a private CareerVector workspace without registration or login, shares that workspace deliberately, and can use web or TUI clients without inventing a first-party identity layer. Provider authorization is a separate device action and does not grant workspace access.

Authorities

• The private workspace URL is the write-capability and collaboration credential.
• A read-only derivative URL addresses a server-enforced mirror and never gains write authority.
• D1/Yjs remains authoritative for workspace content and operation clocks.
• A device identifier supplies collaboration and operation provenance. It is not an account, membership record, recovery principal, or authorization source beyond the link capability.
• Connector credentials and presentation settings belong to device-private or provider-owned storage. They do not enter canonical workspace state.

Workspace links and identifiers do not cross to JobCache or model providers. A connector host receives an injected, bounded workspace capability only at the CareerVector tool boundary; the model cannot supply or widen it.

Client attachment

The browser and Tauri clients resolve the workspace directly from its private route. The production TUI will attach to the same workspace by an explicit paste/open-link ceremony and then use the normal read, operation, and realtime contracts. Its current local application.json adapter is transitional and does not alter this authority model.

Sharing the write link grants the same workspace authority. Product language must say this plainly. If a narrower collaborator role is needed later, it must be a new explicit capability, not a hidden account-membership system.

Lifecycle and recovery

• Lost browser/device state: reopen the saved private link; no account-recovery flow exists.
• Lost link: CareerVector cannot recover authority from email, IP address, provider identity, workspace content, or device telemetry.
• Read-only sharing: mint/use a mirror link whose write denial is enforced server-side.
• Suspected disclosure: link rotation, clone-and-retire, export, and erasure behavior must be explicit and recoverable before being promised as built.
• Provider authorization loss: workspace access remains intact; only that connector becomes unavailable until reauthorized.
• Connector failure: direct browser/TUI/Tauri workspace work remains available.

Acceptance evidence

• no first-party registration, login, session, membership, or account-recovery route is required;
• an unknown workspace link cannot enumerate another workspace;
• write-link collaboration converges and read-only derivatives reject every server-side write;
• provider login never grants workspace access and workspace access never grants provider login;
• TUI attachment preserves unknown fields and uses canonical clocks/operations rather than a whole-workspace overwrite;
• export, erasure, link-disclosure recovery, and support-capability behavior are explained and tested without fabricating recoverable identity.