Blueprint · domain

JobCache Core and privacy seams

CrateDB owns public corpus truth while JobCache App and CareerVector retain their unrelated local identities.

Cell 3.2 · runtime · data · privacy · evidence
  • JobCache App to Observer privacy seam: reduced request
  • Observer privacy seam to Protected Core API: authenticated
  • Protected Core API to and from CrateDB: search / lifecycle
  • CrateDB to and from Corpus pipeline: reconcile + project
  • CrateDB to Workspace privacy seam: public projection
  • Workspace privacy seam to CareerVector: workspace-local delivery
reduced requestauthenticatedsearch / lifecyclereconcile + projectpublic projectionworkspace-local delivery
serviceas-built

JobCache App

Observer-facing sessions, views, grants, snapshots, and product delivery.

JobCache App
boundaryas-built

Observer privacy seam

session_id stays in App; only declared reductions cross.

JobCache App/Core
serviceas-built

Protected Core API

Authenticated search, deposit, delivery, and lifecycle boundary.

JobCache Core
storeas-built

CrateDB

Roles, ads, facts, evidence, vectors, lineage, tasks, and outcomes.

Open layer ↘
processmixed

Corpus pipeline

Reconcile ad→role, retain disagreement, age evidence, and publish projections.

JobCache Core
boundaryas-built

Workspace privacy seam

workspace_id, documents, prompts, and activity stay in CareerVector.

CareerVector/Core
servicemixed

CareerVector

Private workspace receives public projections and keeps private truth locally.

CareerVector
search and immutable deliveryvalidated canonical deposittelemetry / declared controlpublic facts / private request
  1. 01 · service · as-built JobCache App

    Observer-facing sessions, views, grants, snapshots, and product delivery.

    JobCache App
  2. 02 · boundary · as-built Observer privacy seam

    session_id stays in App; only declared reductions cross.

    JobCache App/Core
  3. 03 · service · as-built Protected Core API

    Authenticated search, deposit, delivery, and lifecycle boundary.

    JobCache Core
  4. 04 · store · as-built CrateDB

    Roles, ads, facts, evidence, vectors, lineage, tasks, and outcomes.

    Open deeper layer ↘
  5. 05 · process · mixed Corpus pipeline

    Reconcile ad→role, retain disagreement, age evidence, and publish projections.

    JobCache Core
  6. 06 · boundary · as-built Workspace privacy seam

    workspace_id, documents, prompts, and activity stay in CareerVector.

    CareerVector/Core
  7. 07 · service · mixed CareerVector

    Private workspace receives public projections and keeps private truth locally.

    CareerVector

Flows

  • JobCache App Observer privacy seam reduced request
  • Observer privacy seam Protected Core API authenticated
  • Protected Core API CrateDB search / lifecycle
  • CrateDB Corpus pipeline reconcile + project
  • CrateDB Workspace privacy seam public projection
  • Workspace privacy seam CareerVector workspace-local delivery
as built target / open Boundary arrows open the neighbouring module; ports stay machine-only

Internals

Purpose

Hold and serve the current public model of the job market. Internals is a blueprint label for JobCache Core and its immediate processing boundary; it is not a third product.

Canonical model

role → ad → workspace job

Core owns the role and ad rungs. CareerVector owns private workspace job state. Role facts aggregate evidence across ads without erasing disagreement or analyzing identical text twice.

CrateDB authority

  • Canonical current roles and ads.
  • Structured facts with evidence and temporal validity.
  • Embeddings and search projections.
  • Role/ad reconciliation and revision lineage.
  • Shared reusable enrichment results and public aggregate outputs.

Raw observations remain in object storage. Unfinished pipeline work remains in rebuildable operational state. Product-local session and workspace state remains in product D1/Yjs.

Invariants

  • CrateDB is the only canonical public-corpus database.
  • Publication is idempotent, revisioned, and traceable to immutable observations.
  • A role aggregate never hides conflicting ad evidence.
  • Product-local identifiers do not enter Core.
  • One-node CrateDB is an explicit resource constraint, not an excuse for a second truth store.
  • Customer reads take precedence over asynchronous publication pressure.

Completion evidence

Schema and query budgets for 100,000 ads; temporal role/ad reconstruction; vector and hybrid search benchmarks; publication atomicity; lineage queries; and privacy-boundary tests.

Source: architecture/modules/internals.md