Federated Search Gateway

Search several tenant-authorized providers with incompatible native scores. Use a deterministic rank-fusion policy over bounded source results, and distinguish a best-effort page from an exhaustive global ranking.

Sources have independent permissions, ranking scales and response times. Analyse which coverage is required, how heterogeneous results merge and what pagination means when some sources are incomplete.

Begin with bounded source queries and deterministic rank fusion. Waiting indefinitely for all sources destroys latency; comparing raw scores assumes unsupported calibration. Record source coverage and retain a short-lived result session for explainable pagination.

1. Authorize each source and result before disclosure.
2. Use bounded parallel fan-out with per-source deadlines.
3. Merge by stable identities under a versioned fusion rule.
4. Pin pagination inputs or disclose best-effort changes.

Workload: 15,000 reads/s, 100 writes/s, 2000 B records, 800 ms read p99 target. These are exercise assumptions; the Solution includes capacity formulas.

Source adapters have separate deadlines and bounded candidate counts. Deterministic rank fusion combines source ranks without pretending raw scores are calibrated across engines. Persist the result session's coverage and ranking version, then reauthorize each page because source permissions may change after the first response.

Sources A and B return promptly while C times out. The response labels C unavailable and merges A/B under the pinned fusion policy. Page two reads the same session ordering but removes newly unauthorized results. It does not rerun an unrelated live search and call that stable pagination.