How the scan was classified.

“Accepted” entries belong to the mathematical catalog. “Rejected” means the extracted span is not a complete mathematical record; it is still preserved here and in its full source. Where an adjacent source passage supplies the complete expression, the recovered replacement is linked.

Download every scan decision ↗

Alt-Svc: h3=":443"; ma=86400; persist=1

Server-Timing: name;dur=ms[;desc="text"], next;dur=ms

Alt-Svc: h3=":443"; ma=86400

RateLimit-Limit: 100
RateLimit-Remaining: 47
RateLimit-Reset: 60
RateLimit-Policy: 100;w=60

RateLimit-Policy: 100;w=60
RateLimit-Policy: 100;w=60, 1000;w=3600
RateLimit-Policy: "api-default";q=100;w=60

RateLimit: "default";r=999;t=60;pk=:Ym9vbWVy:

HTTP/1.1 429 Too Many Requests
Retry-After: 60
RateLimit-Limit: 100
RateLimit-Remaining: 0
RateLimit-Reset: 60
RateLimit-Policy: 100;w=60

TCP connection accepted by nginx
        |
        v
==================== ROUTING ====================
        |
        v
Read Host header
   * Match against server_name in each server block
   * If no match and no default_server: nginx returns 444 (close connection)
        |
        v
Routed to correct server block
        |
        v
==================== IDENTITY ====================
        |
        v
Read User-Agent header
   * Is this a known crawler? (UA pattern match)
   * Is it actually that crawler? (reverse DNS check, optional)
   * Is it on the rate limit whitelist? (from framework-http-rate-control-headers.md)
        |
        v
==================== CONTENT NEGOTIATION ====================
        |
        v
Read Accept (which content types client wants)
   * Pick best match for this resource
   * Set Vary: Accept on response if we vary

Read Accept-Language (which languages client prefers)
   * Pick best match for multilingual content
   * Set Vary: Accept-Language on response if we vary

Read Accept-Encoding (which compression algorithms client supports)
   * gzip, br, zstd: pick best supported by both client and server
   * Set Vary: Accept-Encoding on response (mandatory when compressing)

Read Accept-Charset (legacy, almost universally ignored in 2026)
   * Just use UTF-8 and move on
        |
        v
==================== CONDITIONAL GET ====================
        |
        v
Read If-Modified-Since (RFC date)
   * Compare to resource's Last-Modified
   * If unchanged: return 304 Not Modified, no body

Read If-None-Match (ETag value)
   * Compare to resource's current ETag
   * If matches: return 304 Not Modified, no body
   * If both If-* present: ETag takes precedence
        |
        v
==================== CONTEXT FOR LOGGING ====================
        |
        v
Read Referer (where the request originated)
   * Log for analytics (referral tracking)
   * Be aware: often empty for crawlers, often empty for privacy aware browsers

Read From (legacy contact field, used by some bots)
   * Log for crawler accountability
   * Rarely actionable
        |
        v
==================== TRANSPORT DISPOSITION ====================
        |
        v
Read Connection (close, keep-alive, upgrade)
   * keep-alive: subsequent requests can reuse the connection
   * close: close after this response
   * upgrade: switch protocol (WebSocket negotiation)
        |
        v
==================== APPLICATION ====================
        |
        v
Process the request, build the response with appropriate Vary headers

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept: application/json
Accept: */*

Accept-Language: en-US,en;q=0.9
Accept-Language: es-MX,es;q=0.9,en;q=0.8
Accept-Language: fr-FR,fr;q=0.9,en;q=0.5

Accept-Charset: utf-8, iso-8859-1;q=0.5
Accept-Charset: utf-8

Content-Type: text/html; charset=utf-8

Strict-Transport-Security: max-age=31536000
Strict-Transport-Security: max-age=31536000; includeSubDomains
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

# Week 1: testing only
Strict-Transport-Security: max-age=86400

# Week 2 to 4: short commitment
Strict-Transport-Security: max-age=2592000; includeSubDomains

# Month 2: medium commitment
Strict-Transport-Security: max-age=15768000; includeSubDomains

# Month 3+: full commitment, ready for preload
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Crawler requests URL
        |
        v
Server responds with status code
        |
        v
Status 200, 304? --> proceed to indexing logic
Status 301, 308? --> follow Location, consolidate signals to target
Status 302, 307? --> follow Location, do NOT consolidate (temporary)
Status 4xx?      --> mark URL as gone or soft 404
Status 5xx?      --> defer, retry later, may eventually drop from index
        |
        v
Read X-Robots-Tag header
        |
        v
Directives present?
   |                                   |
  YES                                 NO
   |                                   |
   v                                   v
Apply directives:               Default behavior:
- noindex: do not add to index   - index this URL
- nofollow: do not follow links  - follow all links on it
- nosnippet: no preview text     - show snippet in SERP
- noarchive: no cached copy      - allow cached copy
- max-snippet:N: cap snippet     - default snippet length
        |
        v
Read Link header
        |
        v
- rel="canonical": treat target as primary, consolidate signals
- rel="alternate" hreflang: register language variants
- rel="alternate" media: register mobile/print variants
- rel="prev" / rel="next": pagination (deprecated for SEO)
- rel="preload" / "prefetch": browser hints, ignored by crawlers
        |
        v
Read HTML body (if Content-Type is text/html and not noindex)
        |
        v
Parse <head> for:
- <meta name="robots"> (may override or supplement X-Robots-Tag)
- <link rel="canonical"> (may override or supplement Link header)
- <link rel="alternate" hreflang="...">
- <link rel="amphtml">
        |
        v
Reconcile signals from HTTP and HTML
        |
        v
Update index entry

Link: <URI>; param1=value1; param2="value 2"
Link: <URI1>; rel="..."; param="..." , <URI2>; rel="..."

Link: </hero.webp>; rel=preload; as=image; fetchpriority=high

Link: </hero-large.webp>; rel=preload; as=image; media="(min-width: 1024px)", </hero-small.webp>; rel=preload; as=image; media="(max-width: 1023px)"

Link: </images/hero.webp>; rel="preload"; as="image"; fetchpriority="high"

Link: </fonts/main.woff2>; rel="preload"; as="font"; crossorigin

score(i) = w₁·Thompson(Beta(α,β) per topic)   ← exploration, cold start
         + w₂·cos(interest, item)              ← semantic match
         + w₃·freshness(i) − w₄·fatigue(i)     ← recency, anti-repetition

@param {(e: import('../ports/types.js').SignalEvent) => void} opts.onSignal

@returns {{observe: (el: Element) => void, disconnect: () => void}}

@returns {() => number} Generator yielding floats in [0, 1).

@param {() => number} rng

boost identity  G(a) = G(a+1) * U^(1/a).

X ~ G(a,1), Y ~ G(b,1)  =>  X / (X + Y) ~ Beta(a, b)

MMR = argmax [ lambda * score(c)  -  (1 - lambda) * max_sim(c, selected) ]

@param {() => number} rng  Injected randomness.

@returns {() => number}

@property {() => VisitorState | null} load

@property {(s: VisitorState) => void} save

@property {() => void} clear

ssh joseph@100.94.8.94 'PGURL=... goose -dir db/migrations postgres "$PGURL" status'   # 0017 applied

ssh joseph@100.94.8.94 '/usr/local/bin/provision-tenant \
  -admin-dsn "host=/tmp user=postgres dbname=postgres sslmode=disable" \
  -name tenant_<client_slug>'

ssh joseph@100.94.8.94 'PGURL="postgres://missionmatch_migrator:<pw>@127.0.0.1:5432/missionmatch?sslmode=disable"; goose -dir db/migrations postgres "$PGURL" up'
ssh joseph@100.94.8.94 'PGURL=...; goose -dir db/migrations postgres "$PGURL" status'   # head v19, 0019 applied

ssh joseph@100.94.8.94 'psql -U postgres -d missionmatch -v ON_ERROR_STOP=1 <<SQL
DO \$\$
DECLARE s_total int; s_emb int; c_total int; c_emb int; w int;
BEGIN
  SELECT count(*), count(embedding) INTO s_total, s_emb FROM skills;
  SELECT count(*), count(resume_embedding) INTO c_total, c_emb
    FROM candidates WHERE deleted_at IS NULL AND anonymized_at IS NULL;
  SELECT vector_dims(embedding) INTO w FROM skills WHERE embedding IS NOT NULL LIMIT 1;
  IF s_emb <> s_total THEN RAISE EXCEPTION ''skills not fully embedded: %% of %%'', s_emb, s_total; END IF;
  IF c_emb <> c_total THEN RAISE EXCEPTION ''live candidates not fully embedded: %% of %%'', c_emb, c_total; END IF;
  IF w IS DISTINCT FROM 384 THEN RAISE EXCEPTION ''sampled vector width %% not 384'', w; END IF;
  RAISE NOTICE ''BACKFILL VERIFIED: skills %%/%%, live candidates %%/%%, width %%'', s_emb, s_total, c_emb, c_total, w;
END \$\$;
SQL'

CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOFIPS140=v1.0.0 go build -trimpath -o /tmp/mm-api ./cmd/api
go version -m /tmp/mm-api | grep GOFIPS140        # must show GOFIPS140=v1.0.0
scp /tmp/mm-api user@bubbles:/tmp/mm-api.new
ssh user@bubbles '
  sudo cp /home/user/missionmatch/mm-api /home/user/mm-api.bak.$(date +%s)
  sudo systemctl stop mm-api
  sudo cp /tmp/mm-api.new /home/user/missionmatch/mm-api && sudo chmod +x /home/user/missionmatch/mm-api
  sudo systemctl start mm-api && sleep 2 && systemctl is-active mm-api
'

make build        # mm-api, the sync jobs, and provision-org, all GOFIPS140=v1.0.0
make test         # unit suite, no database
make ci-gates     # the security gates: no X-Org-ID in the release binary, FIPS stamp present

MM_APP_DSN=postgres://missionmatch_app:...@100.94.8.94:5432/missionmatch?sslmode=require \
MM_MIGRATOR_DSN=postgres://missionmatch_migrator:...@100.94.8.94:5432/missionmatch?sslmode=require \
make test-integration

Build and run FIPS validated: CGO_ENABLED=0 GOFIPS140=v1.0.0 go build, run with GODEBUG=fips140=on.

not, so the operator log said total=0 while alerts were being written. A count that disagrees with

`!= nil` guards skipped BOTH pings and fell through to 200. Readiness reported ready with every

Build and run FIPS validated: CGO_ENABLED=0 GOFIPS140=v1.0.0 go build.

dsn = os.Getenv("MM_MIGRATOR_DATABASE_URL")

mega = os.Getenv("MM_MEGAMIND_URL")

This binary is deliberately separate from the FIPS API. It still builds CGO_ENABLED=0 pure Go.

controlDSN = os.Getenv("MM_MIGRATOR_DATABASE_URL")

concurrency = 1

row per (occupation_code, area='US', metric) into the global public bls_wages catalog. It is idempotent:

The national rows carry area='US', area_name='United States', and an empty role (national data has no

the descriptive User Agent). Build and run FIPS validated: CGO_ENABLED=0 GOFIPS140=v1.0.0 go build, run

with GODEBUG=fips140=on.

Phase 4: upsert one national row per (occupation_code, area='US', metric). A series with No Data is

storeRoot = os.Getenv("MM_STORAGE_ROOT")

- db/seed/cleared_skills.sql curated cleared workforce terms (source='curated') -- apply that

- ontology_terms rows where term_kind='skill' and source_name='Corpus Mining'.

provision-tenant -admin-dsn "postgres://postgres@host/postgres?sslmode=disable" -name tenant_acme

adminDSN = os.Getenv("MM_ADMIN_DSN")

migratorDSN = os.Getenv("MM_MIGRATOR_DATABASE_URL")

pepperEnv = os.Getenv("MM_CREDENTIAL_PEPPER")

pageCap bounds a single NAICS pull (limit 1000 * 5 = up to 5000 notices/NAICS) so one run can never

tenantDSN = os.Getenv("MM_TENANT_MIGRATOR_DSN")

dsn = os.Getenv("MM_APP_DATABASE_URL")

failed = true

FREE FEDERAL SOURCES                    GLOBAL KNOWLEDGE LAYER (new, outside RLS)
   O*NET SOC skills        ─┐         ┌─►  skills            (enriched: + mission_area, source, soc_code)
   GSA CALC labor rates     ├─ ingest ┼─►  skill_aliases     (acronym and synonym to canonical skill)
   FPDS / USASpending      ─┤  (Go    ├─►  skill_relationships (requires, substitutes_for, broader_than)
   SAM raw JSON / CLINs     │  cmds)   ├─►  clearance_levels  (compartments, poly, reciprocity)
   curated IC overlay      ─┘         └─►  mission_areas      (SIGINT, GEOINT, Satellite C2, CDS, ...)
                                                   │
                                                   ▼
                          DETERMINISTIC ENGINE (frozen weights)
                          exact match → alias match → relationship credit → semantic ≥ 0.62
                                                   │
                                                   ▼
                          BRAIN (retrieval + memory + faithfulness, narrates only)
                          RRF hybrid + reranker, mission filtered, incumbent intelligence
                                                   │
                                                   ▼
                          EVALUATION HARNESS  ──►  calibrates threshold, proves bands, four fifths
                                                   ▲
                          BOUNDED FEEDBACK LOOP ───┘  scrubbed reviewer outcomes become CURATION
                                                      proposals for humans, never auto mutate scoring

CGO_ENABLED=0 GOFIPS140=v1.0.0 go build -o bin/import-bench ./cmd/import-bench
GODEBUG=fips140=on ./bin/import-bench <flags>

GODEBUG=fips140=on ./bin/import-bench \
  -org <org_uuid> \
  -profiles /bench/roster.csv \
  -resumes /bench/resumes \
  -legal-basis "client provided cleared bench, client is the data controller" \
  -dry-run

GODEBUG=fips140=on ./bin/import-bench \
  -org <org_uuid> \
  -profiles /bench/roster.csv \
  -legal-basis "client provided cleared bench, client is the data controller" \
  -size 25

GODEBUG=fips140=on ./bin/embed-backfill \
  -what candidates \
  -org <org_uuid> \
  -only-missing