JobCache × Management

Purpose

Define how authorized operators understand and change JobCache without giving shared observability tools an undocumented write path into the product or corpus. This is the JobCache-facing part of the full-height fourth-column Management rail.

Authority split

• JobCache App owns customer/session operation and support.
• JobCache Core and ingestion own corpus, source, queue, routing, and publication operation.
• JobCache Ops UI/API/MCP projects those authorities; it does not replace them.
• Shared Management correlates bounded observations and command receipts. It does not acquire JobCache credentials, scheduler authority, or a general CrateDB write path.

Operator pathways

• Inspect service health, queue pressure, source drift, corpus freshness, and delivery state.
• Investigate a result through role, ad, evidence, enrichment, and publication lineage.
• Declare source, budget, policy, suppression, and publication controls.
• Handle customer support, correction, takedown, and export requests.
• Review quality evidence and release status before promoting changes.
• Explain commercial placement separately from organic relevance.

Exchange with Management

The upward path is a content-safe observation envelope: producer, product, environment, classification, freshness, evidence address, and semantic/architecture references. The return path is a typed command intent. JobCache validates and executes that command inside its owning runtime, then returns a receipt and verification evidence.

The current JobCache Ops API, UI, and MCP already expose health, corpus, freshness, source, device, routing, cost, audit, and bounded recovery surfaces. The shared envelope, complete lineage investigation, approval classes, preview semantics, and uniform compensation receipts remain target work.

Invariants

• Observability is read-only unless an action uses a named Management command.
• Every material command is authenticated, authorized, idempotent where practical, and audited by JobCache's owning authority.
• Management does not become a second ingestion scheduler or corpus writer.
• JobCache support tools cannot enumerate or enter unrelated opaque sessions.
• Removing shared Management does not remove JobCache execution or recovery authority.

Decisions still required

• Operator roles, approval thresholds, and the common observation envelope.
• The source-policy, corpus-correction, and recovery command vocabulary.
• Incident, support, and takedown workflows.
• Commercial controls and their isolation from relevance evidence.

Completion evidence

Trace one production symptom from JobCache evidence through shared Management and back to a JobCache-owned command. For each command: schema, authority, preview, execution receipt, rollback or compensation, audit event, UI/MCP parity, and an adversarial authorization test.