ThatAIguyA world of ideas

THE CONSCIOUSNESS ATLAS
Read. Experiment. Follow the evidence.

ConsciousnessLearn · Explore · Joseph Anady

Janady13/missionmatch / CLAUDE.md

Source identity, revision, and recovered contents.

GitHub sourceSource text recovered

Source identity

FieldRecorded value
Source typeGitHub source
Original recordJanady13/missionmatch / CLAUDE.md
DateNot specified in source
RepositoryJanady13/missionmatch
Revision09015496d565a172bcaa15cfe9a8e4b072b13df0
Branchworkstream-b-screenmatch
Path or archive memberCLAUDE.md
Original SHA-256a5987e26dd1044c275ad28f36df161b95bcaab32d3721901c745cb7e56d7c0ec
Git blob SHA71b7e2299841463e49abaa2f374254d055af40f9
Reading-copy SHA-256a5987e26dd1044c275ad28f36df161b95bcaab32d3721901c745cb7e56d7c0ec

Original source ↗

Every recorded occurrence

These 69 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original recordBranch or archiveRevision / identifierOriginal location
Janady13/missionmatch / CLAUDE.mdworkstream-b-screenmatch09015496d565a172bcaa15cfe9a8e4b072b13df0Open original
Janady13/missionmatch / CLAUDE.mdworkstream-a-opportunity-intelligence1675031db74316e100782d063e9eda1a597fe3a1Open original
Janady13/missionmatch / CLAUDE.mdmaster1e9249840a4302ec82e123b9c9cb6f75badea3e4Open original
Janady13/missionmatch / CLAUDE.mdfeature/aioe-upgrade2178e7298d0e5d9af83afa12402fd587f0ba6ed8Open original
Janady13/missionmatch / CLAUDE.mdworkstream-d-command-center255e7d1d420abf5e277d0cd8c9b14f6f72b6acb9Open original
Janady13/missionmatch / CLAUDE.mdw0-aedt-compliance39df94f92b2a33f852481fe1954dabed841524bbOpen original
Janady13/missionmatch / CLAUDE.mdworkstream-d-missionmatch3be46ba89edb737182075a2b320509b42dc916f8Open original
Janady13/missionmatch / CLAUDE.mdm5-price-to-win41000ad30fff4129fdaf5ec84e15ba14c27d4890Open original
Janady13/missionmatch / CLAUDE.mdworkstream-e-dataflow-deploy433815a042f9741411e60fa553fe72143e9b10dbOpen original
Janady13/missionmatch / CLAUDE.mdw3-ai-staffing-recommendations43d56387270ef4da4cabd794d97ca6a49909bc7dOpen original
Janady13/missionmatch / CLAUDE.mdworkstream-e-commercial-stubs4437da660539284a400ee380b9b427a300c369eeOpen original
Janady13/missionmatch / CLAUDE.mdws3-clearance4b8e7ce594c068621867f9c9deed0ec64ae6c553Open original
Janady13/missionmatch / CLAUDE.mdcollision-deconfliction4ee5a09972608ed89f8377c6665542d5f450f0a6Open original
Janady13/missionmatch / CLAUDE.mdworkstream-c-slatematch5cd60c918301b46ecd6ed3e03e20c395da0062e2Open original
Janady13/missionmatch / CLAUDE.mdai-intelligence-layer5d5ddff70393a197c5f54a45280bb5dd42b24755Open original
Janady13/missionmatch / CLAUDE.mdws7-federal-signal6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2Open original
Janady13/missionmatch / CLAUDE.mdws6-retrieval6c56e29231ec05735927fa265c97d517499dfeafOpen original
Janady13/missionmatch / CLAUDE.mdper-tenant-routing9bde0f9a74b89d01980fa658e5253acda7528d0cOpen original
Janady13/missionmatch / CLAUDE.mdai-brain-liveaac32fc49c878cc5bca099459307611562d0bac1Open original
Janady13/missionmatch / CLAUDE.mdgraphrag-foundationb0ddeb9f633fd138d09309d1a17b7d13bc3a67f7Open original
Janady13/missionmatch / CLAUDE.mdws1-ontology-syncb596f449a32a1016fbd403c36505cc00a1ac9ee6Open original
Janady13/missionmatch / CLAUDE.mdtime-to-fill-survivalb66e1e505863d4f17741a4b9ede73509e45bd6c6Open original
Janady13/missionmatch / CLAUDE.mdruthless-debug-sweepb7d742f8f032984be3817efffa3eb8b13b651c1fOpen original
Janady13/missionmatch / CLAUDE.mdmag-substrateb82c7100a492dec67dfd1eda6b3f53def859be35Open original
Janady13/missionmatch / CLAUDE.mdcapture-readinessbae6af7cb2997e819174a9e9cfff5e16067a1975Open original
Janady13/missionmatch / CLAUDE.mddeploy-and-opsbdacd9d0b4d5998d25fc74bf4007f4c3ec538c7aOpen original
Janady13/missionmatch / CLAUDE.mdws8-teaching-loopc823f0fb6bb2aba0f39001eb6de96f4000d9321fOpen original
Janady13/missionmatch / CLAUDE.mdphase2-eval-fairnessd361af254701975fe239927656ababb56374655eOpen original
Janady13/missionmatch / CLAUDE.mdworkstream-b-sam-contract-awardsd5101cceb98e70000cebb31d3e7ac73d747d3a6dOpen original
Janady13/missionmatch / CLAUDE.mdphase2-connectorse038d4c687aec16f8bd9bc4d907eea14d91f8704Open original
Janady13/missionmatch / CLAUDE.mdworkstream-a-shared-coree0de03ac3a1ec826bd15d0e048e3b02baa23eeffOpen original
Janady13/missionmatch / CLAUDE.mdws2-alias-relationshipe4dada4601c6eb101830f9d223a9655dfa120616Open original
Janady13/missionmatch / CLAUDE.mdpresentation-readinesseb574acaa29d71ce4d0f852572e87c275c79fdb7Open original
Janady13/missionmatch / CLAUDE.mdws9-bench-ingestionf585a9ef32fa554663ce1fba9a414a54b6e49cf0Open original
Janady13/missionmatch / CLAUDE.mdvendor-intelligencefe9796a19c261951d3f2565206c0c1b5ac294465Open original
Janady13/missionmatch / CLAUDE.mdper-tenant-routing9bde0f9a74b89d01980fa658e5253acda7528d0cOpen original
Janady13/missionmatch / CLAUDE.mdcollision-deconfliction4ee5a09972608ed89f8377c6665542d5f450f0a6Open original
Janady13/missionmatch / CLAUDE.mdws6-retrieval6c56e29231ec05735927fa265c97d517499dfeafOpen original
Janady13/missionmatch / CLAUDE.mdworkstream-a-shared-coree0de03ac3a1ec826bd15d0e048e3b02baa23eeffOpen original
Janady13/missionmatch / CLAUDE.mdm5-price-to-win41000ad30fff4129fdaf5ec84e15ba14c27d4890Open original
Janady13/missionmatch / CLAUDE.mdworkstream-c-slatematch5cd60c918301b46ecd6ed3e03e20c395da0062e2Open original
Janady13/missionmatch / CLAUDE.mdws1-ontology-syncb596f449a32a1016fbd403c36505cc00a1ac9ee6Open original
Janady13/missionmatch / CLAUDE.mdmaster1e9249840a4302ec82e123b9c9cb6f75badea3e4Open original
Janady13/missionmatch / CLAUDE.mdws8-teaching-loopc823f0fb6bb2aba0f39001eb6de96f4000d9321fOpen original
Janady13/missionmatch / CLAUDE.mdw3-ai-staffing-recommendations43d56387270ef4da4cabd794d97ca6a49909bc7dOpen original
Janady13/missionmatch / CLAUDE.mdmag-substrateb82c7100a492dec67dfd1eda6b3f53def859be35Open original
Janady13/missionmatch / CLAUDE.mdws3-clearance4b8e7ce594c068621867f9c9deed0ec64ae6c553Open original
Janady13/missionmatch / CLAUDE.mdworkstream-d-command-center255e7d1d420abf5e277d0cd8c9b14f6f72b6acb9Open original
Janady13/missionmatch / CLAUDE.mdphase2-eval-fairnessd361af254701975fe239927656ababb56374655eOpen original
Janady13/missionmatch / CLAUDE.mdworkstream-e-dataflow-deploy433815a042f9741411e60fa553fe72143e9b10dbOpen original
Janady13/missionmatch / CLAUDE.mdruthless-debug-sweepb7d742f8f032984be3817efffa3eb8b13b651c1fOpen original
Janady13/missionmatch / CLAUDE.mdtime-to-fill-survivalb66e1e505863d4f17741a4b9ede73509e45bd6c6Open original
Janady13/missionmatch / CLAUDE.mdai-intelligence-layer5d5ddff70393a197c5f54a45280bb5dd42b24755Open original
Janady13/missionmatch / CLAUDE.mdgraphrag-foundationb0ddeb9f633fd138d09309d1a17b7d13bc3a67f7Open original
Janady13/missionmatch / CLAUDE.mdworkstream-a-opportunity-intelligence1675031db74316e100782d063e9eda1a597fe3a1Open original
Janady13/missionmatch / CLAUDE.mddeploy-and-opsbdacd9d0b4d5998d25fc74bf4007f4c3ec538c7aOpen original
Janady13/missionmatch / CLAUDE.mdws9-bench-ingestionf585a9ef32fa554663ce1fba9a414a54b6e49cf0Open original
Janady13/missionmatch / CLAUDE.mdws2-alias-relationshipe4dada4601c6eb101830f9d223a9655dfa120616Open original
Janady13/missionmatch / CLAUDE.mdpresentation-readinesseb574acaa29d71ce4d0f852572e87c275c79fdb7Open original
Janady13/missionmatch / CLAUDE.mdworkstream-b-screenmatch09015496d565a172bcaa15cfe9a8e4b072b13df0Open original
Janady13/missionmatch / CLAUDE.mdws7-federal-signal6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2Open original
Janady13/missionmatch / CLAUDE.mdworkstream-e-commercial-stubs4437da660539284a400ee380b9b427a300c369eeOpen original
Janady13/missionmatch / CLAUDE.mdai-brain-liveaac32fc49c878cc5bca099459307611562d0bac1Open original
Janady13/missionmatch / CLAUDE.mdworkstream-d-missionmatch3be46ba89edb737182075a2b320509b42dc916f8Open original
Janady13/missionmatch / CLAUDE.mdphase2-connectorse038d4c687aec16f8bd9bc4d907eea14d91f8704Open original
Janady13/missionmatch / CLAUDE.mdworkstream-b-sam-contract-awardsd5101cceb98e70000cebb31d3e7ac73d747d3a6dOpen original
Janady13/missionmatch / CLAUDE.mdw0-aedt-compliance39df94f92b2a33f852481fe1954dabed841524bbOpen original
Janady13/missionmatch / CLAUDE.mdfeature/aioe-upgrade2178e7298d0e5d9af83afa12402fd587f0ba6ed8Open original
Janady13/missionmatch / CLAUDE.mdcapture-readinessbae6af7cb2997e819174a9e9cfff5e16067a1975Open original

Recovered source transcript

Download complete source text ↓141 lines · 13.2 KB
# missionMATCH / slateMATCH / screenMATCH — Project Context for Claude Code ## What this is A **Cleared Workforce Intelligence Platform** for US government contractors, cleared staffing firms, proposal teams, and capture teams. NOT a generic ATS. The whole product serves the loop: **Requirement → Candidate Intelligence → Match Scoring → Ranked Candidate Slate → Proposal Readiness.** slateMATCH (requirement-to-slate) is the core differentiator. ## Hard rules (tooling and writing style, non negotiable) 1. No Python anywhere. Backend is Go, frontend is TypeScript and Node, scripts are bash. Never add a Python script, tool, or dependency. HTML is written by hand, never generated by a program. 2. No dashes of any kind in written output: code comments, log strings, UI copy, docs, and commit messages. Use commas, periods, or rewrite the sentence. Hyphens that are required syntax are allowed inside URLs, HTTP header names, CLI flags, and code identifiers (package names, file names, npm script keys). 3. Every API key stays on the server only. All keys load from `/etc/missionmatch/sam-sync.env` on Bubbles, a root owned 0600 file that is never web served and never in the repo. Placeholder names live in `.env.example` and the real env file is covered by `.gitignore`. Never print a key, never commit a key, never expose a key to the browser bundle. 4. Clearance is a self reported indicator, shown in the UI as "clearance intelligence," never as "verified." The real check is the hiring client FSO through DISS at onboarding. State this once where clearance appears. ## Demo data (sales demo seed) The candidate pool in the demo org is SYNTHETIC generated data, not real people, and is labeled "Demo data" in the UI everywhere candidates appear (the entire pool, not only the External sourced leads). Clearance values are seeded self reported indicators on generated profiles. A live demo must never imply these are real cleared people; the real check is the customer FSO through DISS at onboarding, and once Galapagos loads their own bench the seeded fillers fall away. The deliberate seed shaping is documented and reproducible in `db/seed/demo_gapfillers.sql`: nine rare skill holders are set available and TS/SCI active so the three hardest staffing gaps have legitimate fillers. That lets the Win Impact feature show HIGH on the Candidates page while the Command Center still names the open gaps (NEED 10 Intelligence Analysts, 3 Data Scientists, 2 Cyber Architects), so the two screens tell one connected story. It moves the Command Center to roughly readiness 86 Watch instead of 59.75 At Risk. ## Authentication and Accounts (Phase 2 decisions, locked) The auth module lives in `internal/modules/auth` with the pure crypto and RBAC primitives in `internal/platform/security`. It produces a verified (org_id, user_id, role) from a first party opaque server side session and feeds `app.current_org_id` only from that validated state, never a client header. The tenancy foundation (RunInTenantTx, WithOrg, the RLS contract) is reused, not rebuilt. These choices are settled and must not drift: 1. **Password KDF is PBKDF2 with HMAC SHA 256 (SP 800-132), never argon2 or bcrypt.** Those KDFs sit outside the FIPS validated boundary; PBKDF2 is inside CMVP module #5247 under GOFIPS140=v1.0.0. Iteration count is 600000 (OWASP 2024 floor). SP 800-132 directs maximizing iterations within tolerable latency, so this deliberately exceeds the CAVP tested envelope (iteration count 1 to 10000, password length 8 to 64). That is a stronger choice, not a deviation: state it that way to a FedRAMP assessor. Password input is capped at 64 characters to stay inside the tested length bound. 2. **A versioned credential pepper** (HMAC SHA 256 of the password under a server held key, applied before PBKDF2, stays in boundary) is stored as a per credential `pepper_version` so the pepper can rotate without a flag day. TOTP secrets are AES 256 GCM encrypted at rest with a `key_version` so the KEK can rotate too. 3. **MFA is mandatory TOTP** (RFC 6238, pinned to HMAC SHA 256 end to end, 32 byte secret, strictly monotonic replay guard). TOTP is implemented in house on the standard library (crypto/hmac) rather than a third party library, so every primitive stays provably inside the validated module and there is no external crypto to re verify under fips140=on. No code path yields an active session with MFA unsatisfied. 4. **Sessions are opaque and server side** (32 random bytes, stored only as a SHA 256 hash), in a `__Host-` cookie (HttpOnly, Secure, SameSite Strict), instantly revocable, two stage (pre MFA then active). Timeouts are fixed NIST values, 15 minutes idle and 12 hours absolute, computed and compared by the database clock, not per org configurable in this phase. 5. **Identity is one human, one account, one org.** Email is globally unique (a functional unique index on lower(email)); login resolves the user by global email before the org GUC is set, through a SECURITY DEFINER cross org lookup. Multi org access for one human is a future membership table refactor, not a Phase 2 capability. 6. **Org creation is provisioning plus invites only, no public self serve signup.** The first org and owner are created by the migrator role `provision-org` CLI calling a migrator only SECURITY DEFINER function; everyone else joins by an authority bounded invite. Invite and recovery link delivery is manual at pilot (the endpoint returns the one time link, the owner delivers it); there is no email transport in this phase. 7. **Federated SSO** (OIDC Login.gov, Entra Gov, SAML, WebAuthn and PIV CAC) and public forgot password are deferred to sub phase 2.9 behind `internal/platform/identity`. The five federal auth libraries are not added to go.mod in this phase. 8. **The dev X-Org-ID header resolver is removed** via a build tag split so it cannot compile into a production binary, and is additionally hard rejected by config validation in production. ## Products - **missionMATCH**: workforce intelligence ("who can support this mission today?") - **slateMATCH**: proposal staffing ("who belongs on the proposal candidate slate?") - **screenMATCH**: single-candidate qualification ("is this candidate qualified for this requirement?") = `POST /match` ## Language & stack (Go — chosen for cloud portability + the cleanest federal FIPS story) - **Backend: Go 1.26+** — compiled, memory-safe, single static binary, native FIPS 140-3. - **HTTP**: `chi` router (idiomatic, std-lib-compatible `net/http`). Thin handlers; logic in services. - **DB**: PostgreSQL 16 + **pgvector** (HNSW). Access via **`pgx/v5`** (`pgxpool`); typed SQL via **`sqlc`** (compile-checked, no heavy ORM). `pgvector-go` for vector types/ops. - **Migrations**: a single tool (pinned in STACK_DECISIONS.md — `goose` or `golang-migrate`); migrations are the ONLY way to change schema. - **Multi-tenancy**: Postgres Row-Level Security (pool model) — see rules below. - **Skills**: ontology (taxonomy + embeddings + adjacency) in Postgres/pgvector. - **Search**: hybrid `tsvector` full-text + `pgvector` HNSW fused with **Reciprocal Rank Fusion (RRF)**, in SQL. - **Storage**: S3-compatible behind a Go interface (MinIO local; S3/GovCloud or Azure Blob in cloud). - **Parsing/embeddings**: behind a **provider interface** — managed FedRAMP endpoint (AWS Bedrock OR Azure OpenAI) OR self-hosted vLLM; cleared resumes are CUI, so production self-hosts. The core Go app never depends on a native ML stack — it calls the provider over HTTP. - **Frontend**: Vite + React 18 + TypeScript + TanStack Query + React Router + Tailwind + shadcn/ui + Recharts. ## CLOUD-PORTABILITY MANDATE (non-negotiable — the founder's explicit requirement) The platform MUST run on **both AWS GovCloud and Azure Government** with **no single-vendor lock-in.** - Everything cloud-specific lives behind an interface: object storage, the AI/embedding provider, secrets, identity. Choosing a cloud is **configuration**, not code. - DB is portable managed Postgres+pgvector on either cloud (AWS RDS for PostgreSQL ↔ Azure Database for PostgreSQL Flexible Server). - Deploy as **containers + Terraform IaC** targeting both clouds; SBOM-at-build; FIPS-validated crypto. - Do NOT adopt an Azure-only or AWS-only primitive in the core path. If a cloud-specific feature is used, it is isolated behind a port/adapter with the other cloud's adapter present. ## "Don't blindly build" rule (founder directive) Do NOT rely on stale patterns for Go specifics. Where the correct approach is non-obvious or version-sensitive — **the FIPS 140-3 module, pgx RLS-with-a-pool, pgvector HNSW DDL/queries, sqlc + pgvector type overrides, WebAuthn/OIDC/SAML/PIV-CAC libraries, both-cloud managed-Postgres support** — follow **docs/STACK_DECISIONS.md** (research-backed, source-cited, with verified minimal patterns). If something there is missing or uncertain, research it with live sources before coding it. ## Non-negotiable engineering rules 1. **Multi-tenancy**: every tenant-scoped table has `organization_id`. Enforce with Postgres RLS (`USING` + `WITH CHECK`) and `ALTER TABLE ... FORCE ROW LEVEL SECURITY`. The app sets `SET LOCAL app.current_org_id` **per request transaction on the same pooled connection** (the pgx-pool gotcha — see STACK_DECISIONS.md) from the validated session. Never trust a client-supplied `organization_id`. No context set ⇒ **zero rows** (fail safe). The DB role the app uses is non-superuser, `NOBYPASSRLS`; a separate migrator role has `BYPASSRLS`. 2. Composite indexes lead with `organization_id` on every tenant table. 3. **Audit logging**: a separate append-only `audit_logs` table OUTSIDE RLS. Log logins, record create/update/delete, exports, permission changes — with actor/entity/old/new/ip/ua. Never UPDATE/DELETE it in app code. 4. **PII/CUI**: clearance data and cleared resumes are sensitive. Never log PII in app logs. Resume/RFP parsing goes through the provider interface (managed for synthetic demo, self-hosted vLLM for production CUI). 5. **Security baseline (NIST 800-171 Rev 2 aligned)**: RBAC, MFA, AES-256 at rest, TLS 1.2+, session/idle timeout, password policy, export logging, consent tracking. Build with the native Go FIPS 140-3 module enabled (see STACK_DECISIONS.md) so crypto is validated from day one. 6. **API-first**. Endpoints include `GET /candidates`, `GET /requirements`, `POST /match`, `POST /slates/generate`, `GET /clearance-status`, `GET /proposal-readiness`. ## Responsible AI rules (this is an Automated Employment Decision Tool) 1. Every match score is **explainable**: per-component breakdown + human-readable rationale + gap summary + a recordable decision trace. 2. **Human-in-the-loop**: humans approve/reject every slate member. Never auto-reject. 3. **Demographic/EEO data** lives in a separate module, is privacy-protected, and is **NEVER** an input to matching (no protected attributes or close proxies as features). The matching/search code must never reference the EEO table. 4. Provide **adverse-impact reporting** (selection rates + four-fifths/80% ratios) so customers can run NYC LL144 / OFCCP audits. 5. Maintain a model card / scoring-methodology doc; align to NIST AI RMF and ISO/IEC 42001. The platform PROVIDES the data for customers' bias audits; it does not itself constitute one, and vendor tooling does not transfer the employer's liability. ## Matching engine (fixed weights — do NOT change without explicit instruction) Match Score = Clearance*0.25 + Skills*0.25 + Certifications*0.15 + CustomerExperience*0.15 + Experience*0.10 + LocationAvailability*0.10 (total 100) - **Clearance**: exact OR higher than required = 100%; lower / expired / unknown = 0% (TS/SCI satisfies Secret; Secret does NOT satisfy TS/SCI — encode the hierarchy). - **Skills**: 100% of required met = full; 80–99% = partial; below 80% = reduced. Skill matching uses **exact match first, then semantic similarity** (embeddings) for synonyms/adjacent skills; always record which candidate skill matched which required skill and the similarity. - **Bands**: Green (Proposal Ready) 90+, Yellow (Potential) 75–89, Red (Recruiting Required) <75. - The engine is a **pure, deterministic Go package** — no DB, no I/O, `skill_matcher` injected. **All scoring math uses `shopspring/decimal`, never `float64`** (bit-stable determinism for the AEDT/compliance asset). Exhaustively unit-tested with golden + property tests; lint with `go-exhaustive`/`nilaway`/`errcheck`. LLM ranking is a FUTURE layer ON TOP, never a replacement. ## Conventions - Package layout: `internal/platform/<area>` for cross-cutting (config, db, tenant, security, audit, storage, embeddings); `internal/modules/<name>` per domain with `handler.go`, `service.go`, `repo.go` (sqlc-backed), `dto.go`. Wire HTTP routes in one place. `cmd/api/main.go` is the entrypoint. - Errors are values, wrapped with `%w`; no panics in request paths. Context-aware. `gofmt`/`go vet`/ `golangci-lint` clean. Every feature ships with tests; the pure logic must pass without a DB. - Schema changes via migrations only. SQL is authored in `.sql` and compiled by `sqlc`. ## Brand (frontend) Deep Navy #0F2744 (primary), Steel Blue #2E5EAA (secondary), Mission Gold #D4A017 (accent), Light Gray #F4F6F8 (neutral). App shell: left sidebar nav, top stat cards, dashboard charts.

Search equations, builds, manuscript text, and recovered sources.