Health · queues · drift
Service, source, corpus, delivery, and customer signals.
Ops/StatusBlueprint · relationship
Operate JobCache deliberately
Read-only observability and named commands are separated so dashboards never become shadow writers.
Cell 2.3 · operations · control · evidence- Health · queues · drift to Lineage investigation: correlate
- Lineage investigation to Named command gate: declare intent
- Named command gate to Audit + recovery evidence: execute and prove
Lineage investigation
Traverse result → role → ad → evidence → publication.
Ops/QANamed command gate
Authenticated command with scope, preconditions, preview, and authority.
ManagementAudit + recovery evidence
Immutable receipt plus rollback or compensation and verification.
Management01 · perspective · target Health · queues · drift Service, source, corpus, delivery, and customer signals.
Ops/Status02 · process · target Lineage investigation Traverse result → role → ad → evidence → publication.
Ops/QA03 · boundary · open Named command gate Authenticated command with scope, preconditions, preview, and authority.
Management04 · store · open Audit + recovery evidence Immutable receipt plus rollback or compensation and verification.
Management
Flows
- Health · queues · drift → Lineage investigation correlate
- Lineage investigation → Named command gate declare intent
- Named command gate → Audit + recovery evidence execute and prove
JobCache × Management
Purpose
Define how authorized operators understand and change JobCache without giving observability tools an undocumented write path into the product or corpus.
Operator pathways
- Inspect service health, queue pressure, source drift, corpus freshness, and delivery state.
- Investigate a result through role, ad, evidence, enrichment, and publication lineage.
- Declare source, budget, policy, suppression, and publication controls.
- Handle customer support, correction, takedown, and export requests.
- Review quality evidence and release status before promoting changes.
- Explain commercial placement separately from organic relevance.
Invariants
- Observability is read-only unless an action uses a named Management command.
- Every material command is authenticated, authorized, idempotent where practical, and audited.
- Management does not become a second ingestion scheduler or corpus writer.
- JobCache support tools cannot enumerate or enter unrelated opaque sessions.
Decisions still required
- Operator roles and approval thresholds.
- The source-policy and corpus-correction command vocabulary.
- Incident, support, and takedown workflows.
- Commercial controls and their isolation from relevance evidence.
Completion evidence
For each command: schema, authority, preview, execution receipt, rollback or compensation, audit event, UI/MCP parity, and an adversarial authorization test.