Planning a family move with linked adult accounts¶

Status: idea and architecture spike; not built yet Ticket: WING-463 Technical version: ../technical/linked-household-accounts.md

The idea¶

When one person relocates, the job decision often belongs to the whole household.

A military family may receive PCS orders while the service member keeps the same career. Their spouse may need a new job near the next installation. An adult child may move too, stay behind, keep a remote job, or begin a separate search. A civilian couple can face the same problem when one partner receives an out-of-state offer.

WorkWingman should let those adults link their accounts for the move and compare the household picture without turning the household into one shared account.

The rule that matters most¶

Every adult keeps their own account and decides what to share.

Activating household membership would not expose a resume, applications, messages, credentials, salary, military documents, exact PCS dates, or exact address. It would only establish that the adults are planning together. Each person would then choose whether to participate in a move scenario and which facts to publish to that scenario.

The person who sent an invitation would not get a read receipt, decline notice, account-existence clue, or repeated-invite loophole. The recipient could silently decline or block future invitations.

One partner could invite another adult. They could not search, edit a profile, answer application questions, or apply for jobs as that person. Adult children would have the same independence as every other adult member. Linked membership is limited to accounts with server-verified age eligibility of 18 or older; minors stay optional household cost assumptions and never become linked accounts.

How a PCS move could work¶

One person creates a private move draft with a destination region or installation and an approximate arrival window. They do not have to upload orders or reveal an exact travel itinerary.
Other adults accept their own household invitations. Acceptance creates a pending admission, not membership. Every current adult sees only a candidate-consented validated display claim, coarse account- tenure band, and verified-adult status, then confirms that exact admission before it activates with no coordination permissions. No contact, legal sign-in name, or career information is exposed, and a candidate can withdraw without a peer-facing decline event.
An adult privately signals candidacy for the move. Current participants first confirm the exact proposed participant expansion without exposing the move facts to that adult. Only then does the candidate receive one short-lived preview capability they may reread during its live window; the candidate independently confirms that exact preview or silently declines. The scenario expands only after both stages succeed. No peer sees who declined or when, though everyone is warned that generic readiness can still reveal that someone has not proceeded.
Each participating adult answers privately: “Am I moving?”, “Do I want to search there?”, “Am I keeping a remote job?”, and “When could I start?”
WorkWingman proposes a destination search to each moving adult. That adult reviews and starts it in their own account.
Everyone searches privately. A member can share only a simple status, or publish selected jobs and offers with no pay, a pay range, or an exact amount.
The household builds named plans such as “move while spouse searches,” “spouse takes offer A,” or “adult child stays in the current city.”
WorkWingman shows the household consequences side by side without declaring a winner.

Adding a participant never unlocks jobs, pay, benefits, timing, or constraints that were shared earlier. The new participant sees only the normalized move preview they confirmed. Each owner must separately review the current audience and re-grant the exact field categories and precision they want that audience to see.

What the family picture would show¶

For each plan, the comparison could show:

each adult's selected work situation and start timing;
household income as an exact amount, a range, or incomplete when someone has not shared it;
taxes calculated once for a filing group only after every affected adult confirms it and a supported multi-earner calculator exists; otherwise the tax row stays incomplete instead of summing two joint estimates;
housing, groceries, childcare, school, commuting, and insurance once for the household;
benefit category, a non-identifying coverage scope such as self/plus-one/family, and when coverage starts;
moving costs, deposits, license-transfer costs, and relocation assistance without double counting;
cash-flow ranges in time buckets no finer than everyone permitted;
hard constraints such as location, report window, childcare, professional licensing, remote-work approval, and minimum cash runway;
a generic incomplete state for peers, while each adult privately sees only their own missing action.

There would be no “best spouse,” no pressure to favor the highest salary, and no mystery family score. The product would make the tradeoffs visible so the adults can decide together.

Why military spouses need special care¶

Military-spouse employment is more than changing a city in a job search.

Some federal jobs have military-spouse hiring paths, but eligibility belongs to the individual and may require private documents. Professional licenses may transfer differently by state and occupation. Domestic remote work and overseas remote work follow different rules. OCONUS employment can depend on agency approval, taxation, SOFA, safety, and security rules.

WorkWingman should keep those details in the spouse's private account. The household view can show an owner-chosen result such as “license transfer may delay start” or “overseas approval unknown” without revealing the documents or basis. It should also connect people to official help such as SpouseWorks, licensing resources, and USAJOBS rather than pretending a comparison screen solves everything.

Each adult would control their own sharing settings for each move:

whether they are participating;
whether their search is active;
whether a role, employer, benefit summary, start window, or job constraint is visible;
whether compensation is hidden, shared as a range, or shared exactly.

An exact household total can reveal another person's salary by subtraction, especially in a two-adult household. Joint taxes, time-bucketed timelines, and the difference between two plans can reveal the same thing. WorkWingman should explain that clearly and only show an exact derived value when every contributor has knowingly shared exact figures. Otherwise every affected result stays a range or incomplete, and the app must not offer a comparison that isolates a hidden contribution.

A member could revoke a field or leave without another person's approval, even if they are the last coordinator. If offline, only that member's devices show the request as pending until the server acknowledges it. Revoking strips or hides the selected household field; leaving deletes that member's household projections. Affected comparisons become incomplete. Peers receive no push, email, or audit announcement about reduced sharing or safe exit, but later membership and per-adult rows can reveal who changed in a household of any size. Their private account, searches, jobs, and applications remain theirs. WorkWingman must also be honest that revocation cannot erase something another person already saw or copied.

If the household has no coordinator, peer job, plan, comparison, share, and export views pause. Adults can still see and revoke their own material, leave, or remove themselves from the move. Restoring coordination does not restore peer access automatically; each owner must grant the current audience again.

What is already in WorkWingman¶

WorkWingman already has family cost assumptions, location and tax comparisons, offer tradeoffs, USAJOBS military-spouse posting labels, and private signed-in workspaces. It does not yet have linked adults, invitations, member-owned searches, household sharing rules, or a multi-person comparison.

The existing “Family” page counts adults and children for cost estimates. Those counts must not be turned into accounts or used to guess who is related to whom. Before a linked comparison uses those categories, the household creates new shared cost assumptions rather than importing or adjusting any person's Family page. Every affected linked adult confirms who the new assumptions cover, so the same adult is never counted twice.

What happens next¶

The safest next step is a prototype, not a production launch.

First, interview eight recent-PCS, multi-income households about what they actually did during their last move before showing them the feature. Continue only if at least five households had two adults making connected employment decisions and already used shared notes, spreadsheets, messages, or repeated conversations to compare timing or money. Stop if two or fewer did. Three or four is inconclusive and means pivot or stop unless Andrew separately authorizes a preregistered follow-up.

Then test a synthetic-data prototype with six households. The feature fails the safety test if any adult reasonably believes that joining exposes resumes, applications, credentials, exact movement details, or military eligibility; if someone cannot leave without permission; if a reduced-sharing or safe-exit action is announced to another household member; or if the product shows more financial detail than that person selected, including through taxes, timelines, or plan differences; or if a second device still shows stale values after revoke and reload.

To pass, at least 80% of participating adults (minimum 10) must understand what membership and sharing do, at least 80% of households (minimum 5) must finish a comparison without one adult controlling another's private data, and at least four of six households must identify a real tradeoff they previously tracked manually. The prototype cannot be called “safety passed” until an IPV/coercive-control specialist and a military-family/OPSEC advisor review it.

That evidence would decide whether to build the linked-household feature, change the sharing model, or stop. We do not yet claim that demand has been proven.