Janady13/missionmatch / docs/CLAUDE_CODE_BUILD_DIRECTIVE.md

1# CLAUDE CODE BUILD DIRECTIVE: OPPORTUNITY TO OUTCOME 2 3missionMATCH complete update. Generated 27 July 2026. This is the single 4source of truth for the build. It absorbs and supersedes 5INTELLIGENCE_EXPANSION_SPEC.md, whose content now lives in Phases 0, 2, and 4. 6Move that file to docs/archive in Phase 0 so exactly one work order exists. 7 8The mission: an opportunity may enter through the SAM.gov API, manual entry, 9uploaded solicitation documents, a customer or teaming partner scope, a 10spreadsheet import, or a future agency forecast feed. Every intake path 11converges into one canonical workflow: 12 13 Opportunity -> Source Documents -> Scope Extraction -> Human Review -> 14 Approved Requirements -> Staffing Slates -> Proposal Workspace -> 15 Submission -> Outcome 16 17This UPDATES missionMATCH. Nothing is built beside it. 18 19-------------------------------------------------------------------------------- 200. SESSION PROTOCOL, HOW CLAUDE CODE RUNS THIS BUILD 21-------------------------------------------------------------------------------- 22 231. Read order at the start of every session: CLAUDE.md, this directive, 24 docs/BUILD_STATE.md, then only the files needed for the current item. 252. Phase lock. Work exclusively on the lowest incomplete phase. Never start 26 phase N+1 until every item in the phase N gate is verified and recorded. 273. Ledger. docs/BUILD_STATE.md is append only in practice: one line per 28 completed gate item recording phase, item number, verification evidence 29 (the command run, the rows observed, the screen checked), commit hash, 30 and date. Only verified items enter. Aspirations never enter. 314. Commit convention: "phaseN itemM: short description". One logical change 32 per commit. 335. Frozen and untouchable: internal/modules/matching/engine (the candidate 34 scoring engine), db/migrations_eeo, every existing migration file, 35 generated sqlc output (regenerate, never hand edit), and the append only 36 audit semantics. 376. Extend, never build beside (Section 1). If a change appears to require a 38 parallel structure, stop, record the conflict in BUILD_STATE, and wait 39 for Joseph rather than forking. 407. Verification method, unchanged from how this system was built: reproduce 41 the defect or behavior against the live database first, implement, verify 42 against the same database, verify end to end through the live 43 authenticated API, then look at the rendered screen. Concurrency is 44 proven by racing it, not by reasoning about it. 458. Inherited non negotiable rules: No Python anywhere, Go backend, 46 TypeScript frontend, bash scripts. No dashes in written output, commas or 47 rewrite, hyphens only inside code identifiers, protocol headers such as 48 User-Agent, and official designations. Every API key stays on the 49 server, root owned 0600, never in the repo, never in the browser bundle. 50 Clearance is clearance intelligence, never verified. Fail closed 51 everywhere. 529. Environment rule, AMENDMENT 1, reinstated 28 July 2026 by the consolidated 53 amendments (docs/DIRECTIVE_AMENDMENTS_CONSOLIDATED.md). This supersedes the 54 27 July decision to build directly against production, which is now void for 55 all work from 28 July forward. 56 57 Every migration, every live database verification, and every end to end check 58 through Phase 5 runs against missionmatch_staging. The production tenant 59 database is touched only at Gate 6, and only after the backup and restore test 60 passes. If any task appears to require production before Gate 6, stop and 61 record the conflict in BUILD_STATE instead of proceeding. 62 63 RESOLVED LOCATION. The amendment names staging as missionmatch_staging on 64 megamind-agi port 5433. Verified on 28 July: that database exists but is an 65 EMPTY SHELL, 0 organizations, 0 candidates, and its goose table is not even 66 readable by the app role. The working staging is missionmatch_staging on M4 67 port 5432: 76 tables, 2766 organizations, 8872 candidates, and it is the 68 database the live mm-api-staging service on 127.0.0.1:8097 actually serves. 69 Gate verification requires an end to end check through a live authenticated 70 API and a rendered screen, which only the M4 database supports. Per Section 0 71 item 5 of the amendments, the smallest change satisfying both is to honor the 72 amendment's database NAME and its staging only rule while using the host where 73 that database actually functions. Staging therefore means 74 missionmatch_staging on 100.94.8.94 port 5432. 75 76 Safety rails on every schema change, unchanged: assert the connected database 77 name before any write, pg_dump the target before a migration batch, keep 78 migrations additive and transactional, and keep down migrations refusing to 79 destroy application authored rows. 80 81-------------------------------------------------------------------------------- 821. EXTEND, NEVER BUILD BESIDE (THE ANTI DRIFT MAP) 83-------------------------------------------------------------------------------- 84 85EXTEND these existing components. Do not duplicate their function anywhere: 86 87 cmd/sam-sync upgraded in Section 4, never replaced 88 cmd/opp-sync unified opportunity ingestion 89 cmd/awards-sync gains task order depth in Phase 4 90 internal/modules/opportunities gains the tenant tracked layer 91 internal/modules/opportunity_intelligence 92 internal/modules/awards 93 internal/modules/bidoutcomes outcomes write through here 94 internal/modules/alerts notifications ride here, with alert-sweep 95 internal/modules/slatematch the proposal workspace lives here 96 internal/modules/commandcenter readiness tiles read from here 97 internal/modules/recruitmatch completed in Phase 5 98 internal/modules/governance evidence pack export lands here 99 internal/platform/docextract and internal/platform/extraction 100 internal/platform/storage document bytes, keyed by hash 101 internal/platform/secrets the only home for keys 102 internal/platform/inference circuit breaker, bounded retries 103 internal/platform/scrub extended with egress payload classes 104 internal/platform/audit OnTx coverage for every material action 105 internal/platform/tenant, tenantpool, database, config, csvsafe, obs 106 frontend/src/tools/slatematch new screens mount here 107 frontend/src/App.tsx routes and ToolGuard, existing pattern 108 db/migrations numbering continues from the current max 109 110NEW things allowed, and this list is exhaustive: 111 112 Tables named in Section 3. 113 Binaries named in Section 8. 114 Package internal/modules/proposals with pure subpackage engine. 115 Frontend screens named in Section 6. 116 docs/BUILD_STATE.md and docs/archive/. 117 118FORBIDDEN, full stop: 119 120 A new repository, a new API binary, or a second candidate scoring engine. 121 A fifth product entitlement. 122 Renaming or restructuring existing tables. 123 Schema changes outside numbered migrations. 124 Ingestion paths that edit approved requirements or tenant authored data. 125 Secrets anywhere except the secrets store. 126 NL to SQL, model authored SQL, or model authored parameters. 127 Web scraping of candidate data of any kind. 128 129-------------------------------------------------------------------------------- 1302. DECISIONS RECORDED, DO NOT REOPEN 131-------------------------------------------------------------------------------- 132 1331. The proposal workspace ships inside the slatematch entitlement. A 134 proposal is the continuation of a slate. Routes mount in the slatematch 135 route group with flat aliases registered per the existing pattern. 136 Record this in STACK_DECISIONS. 1372. Tenant tracked opportunities live inside internal/modules/opportunities 138 as a tenant owned layer above the shared public cache. No new capture 139 module. 1403. The readiness engine is a new pure package 141 internal/modules/proposals/engine: shopspring/decimal, no database, no 142 I/O, a versioned READINESS_ALGO_VERSION constant. It never touches or 143 resembles the candidate scoring engine. 1444. Proposal outcomes write through the existing bidoutcomes module, closing 145 the loop that AIOE already expects. 1465. Deadline and amendment notifications use the existing alerts module. 1476. External inference: OpenAI becomes a third gateway backend under the 148 rules in Section 5.3. The key exposed in chat on 27 July 2026 is revoked 149 and replaced before the enabled flag ever turns true. 1507. Capabilities: map new actions onto the existing 19 first. If none fits, 151 add exactly these, at these role thresholds, and update the exhaustively 152 tested capability matrix: opportunity.manage at recruiter and above, 153 scope.review at recruiter and above, requirement.approve at manager and 154 above, proposal.manage at recruiter and above, proposal.submit at 155 manager and above. Superuser holds all by rule, never by matrix row. 1568. Migration numbers continue from the current maximum in db/migrations. 157 Never renumber, never reuse, never touch the EEO set. 1589. ingest_manifest lives wherever the public opportunity cache lives today. 159 Inspect the sam-sync write target and follow that exact pattern: if the 160 cache is per tenant, the manifest carries organization_id like every 161 tenant table; if the cache is shared reference data, the manifest is 162 shared reference data. Tenant rows reference manifest rows by id. 163 164-------------------------------------------------------------------------------- 1653. DATA MODEL 166-------------------------------------------------------------------------------- 167 168Invariants for every new tenant table, no exceptions: organization_id, 169forced row level security, a composite index leading with organization_id, 170composite foreign keys, ON DELETE SET NULL only in the column list form 171(migration 0053 exists because the bare form is a trap), audit coverage 172through OnTx, and down migrations that refuse with a count rather than 173destroy application authored rows. 174 1753.1 tracked_opportunities 176 177 organization_id, id, public_opportunity_id, source_type, 178 source_record_id, sam_notice_id, title, solicitation_number, 179 agency_name, office_name, notice_type, set_aside_code, naics_code, 180 psc_code, place_of_performance, posted_at, response_deadline, 181 estimated_value_min, estimated_value_max, ceiling_value, 182 period_of_performance_start, period_of_performance_end, incumbent_name, 183 prime_or_sub, capture_owner_user_id, status, source_url, 184 source_manifest_id, created_by_user_id, created_at, updated_at 185 186 source_type enum: sam_gov, agency_forecast, customer, partner, internal, 187 spreadsheet, manual. 188 status enum: identified, qualifying, qualified, pursuing, no_bid, 189 submitted, won, lost, cancelled, archived. 190 Unique partial index on (organization_id, public_opportunity_id) where 191 public_opportunity_id is not null, so a tenant cannot track one public 192 notice twice. 193 1943.2 opportunity_versions, immutable snapshots 195 196 organization_id, id, opportunity_id, version_number, amendment_number, 197 source_version_label, source_payload_hash, normalized_payload, 198 fetched_at, effective_at, supersedes_version_id, ingest_manifest_id, 199 is_current, created_by_user_id 200 201 Unique on (organization_id, opportunity_id, version_number). is_current 202 flips inside the same transaction that inserts the successor. Rows are 203 never updated after insert except that flag, enforce with a trigger in 204 the audit style. 205 2063.3 opportunity_documents 207 208 organization_id, id, opportunity_id, opportunity_version_id, 209 document_type, file_name, media_type, storage_key, size_bytes, sha256, 210 source_url, source_type, uploaded_by_user_id, extraction_status, 211 extraction_error_code, supersedes_document_id, is_current, created_at 212 213 document_type enum: solicitation, amendment, sow, pws, soo, 214 labor_categories, pricing_template, evaluation_criteria, security, 215 q_and_a, past_performance, subcontract_scope, customer_scope, 216 attachment, other. 217 extraction_status enum: pending, running, done, failed. Failed is 218 retryable. Duplicate detection by sha256 within the opportunity. 219 Bytes go through internal/platform/storage; the malware scan 220 integration point sits between upload and extraction_status pending. 221 2223.4 opportunity_document_chunks, exact extraction provenance 223 224 organization_id, id, document_id, page_number, section_label, 225 text_content, content_hash, extraction_method, confidence, created_at 226 2273.5 opportunity_scope_items 228 229 organization_id, id, opportunity_id, scope_type, title, description, 230 source_document_id, source_page_number, source_section_label, 231 source_quote_hash, extraction_method, extraction_confidence, 232 review_status, reviewed_by_user_id, reviewed_at, parent_scope_item_id, 233 display_order, created_at, updated_at 234 235 scope_type enum: objective, task, deliverable, labor_category, 236 staffing_quantity, skill, certification, clearance, 237 customer_experience, location, travel, schedule, security_control, 238 reporting, transition, key_personnel, pricing_instruction, 239 evaluation_factor, compliance_clause, assumption, dependency, risk, 240 other. 241 review_status enum: extracted, accepted, edited, rejected, merged, 242 manual. 243 2443.6 requirement_drafts, the safety boundary before live scoring 245 246 organization_id, id, opportunity_id, source_scope_item_id, 247 labor_category, quantity, clearance_level, polygraph, compartments, 248 required_skills, mandatory_skill_flags, required_certifications, 249 minimum_years_experience, required_customer_experience, work_location, 250 remote_allowed, travel_percent, availability_date, employment_type, 251 pay_band_min, pay_band_max, bill_rate_min, bill_rate_max, 252 derivation_method, derivation_confidence, review_status, 253 reviewed_by_user_id, reviewed_at, approved_requirement_id, created_at, 254 updated_at 255 256 review_status enum: draft, in_review, approved, rejected. Promotion to 257 the existing requirement table happens in one audited transaction that 258 takes FOR UPDATE on the draft row, so racing approvals elect exactly one 259 winner, matching the nine existing lock patterns. 260 2613.7 Proposal tables 262 263 proposals: organization_id, id, opportunity_id, title, stage, status, 264 proposal_owner_user_id, capture_owner_user_id, customer_deadline, 265 internal_deadline, submitted_at, outcome_recorded_at, created_at, 266 updated_at. 267 proposal_sections and proposal_section_versions: section_code, title, 268 owner_user_id, required, page_or_word_limit, due_at, draft_status, 269 review_status, approved_by_user_id, version_number, content 270 reference. 271 proposal_compliance_items: source requirement text, source_document_id, 272 page or section, response_location, owner_user_id, due_at, status, 273 evidence reference, reviewer_user_id. 274 proposal_milestones: kind enum covering question_deadline, pink_team, 275 red_team, gold_team, final_review, upload, submission, plus due_at 276 and completed_at. 277 proposal_risks: likelihood, impact, owner_user_id, mitigation, trigger, 278 status, related_scope_item_id. 279 proposal_team_members, proposal_staffing_links (requirement_id, 280 slate_id, required_quantity, approved_count), proposal_attachments, 281 proposal_readiness_snapshots (overall decimal, one decimal column 282 per component, blockers, drivers, algorithm_version, 283 calculated_at). 284 2853.8 ingest_manifest 286 287 source, url, license, fetched_at, record_count, content_hash, and 288 organization_id if the Section 2 item 9 inspection says per tenant. 289 Every synced row and every knowledge card traces to a manifest row. 290 291-------------------------------------------------------------------------------- 2924. SAM.GOV INGESTION UPGRADE, INSIDE cmd/sam-sync 293-------------------------------------------------------------------------------- 294 295The complete flow, in order: 296 2971. Retrieve official notice metadata. 2982. Write or refresh the shared public opportunity cache. 2993. Record provenance in ingest_manifest. 3004. Retrieve the full description where permitted. The description field 301 returns a URL that costs a second authenticated call, so the call budget 302 is double the notice count. Opportunity pages cap at one thousand 303 records. Personal keys allow roughly ten calls a day, role backed 304 roughly one thousand, federal system accounts roughly ten thousand. 305 Explicit pagination and caching, always. 3065. Retrieve attachment metadata. 3076. Compare the current source hash to the last stored source hash. 3087. On change, create an immutable opportunity_versions row for every tenant 309 tracking the notice. 3108. Queue approved public attachments for cmd/sam-attachment-sync. 3119. Extract document text through the existing extraction packages. 31210. Generate draft scope items, Section 5 rules. 31311. Notify tracking tenants through the alerts module when an amendment 314 lands or a deadline changes. 31512. Never touch tenant authored data. Refresh writes only to the public 316 cache and to versions. A test asserts that every tenant owned column on 317 tracked_opportunities survives a refresh byte for byte. 318 319Amendment handling, always: a new amendment creates a new version, retains 320the original, diffs deadlines, labor categories, quantities, security 321requirements, and evaluation criteria, flags affected approved 322requirements, and requires a named human to accept operational changes. 323Nothing silently rewrites an approved requirement. 324 325-------------------------------------------------------------------------------- 3265. EXTRACTION, NORMALIZATION, AND THE EXTERNAL BOUNDARY 327-------------------------------------------------------------------------------- 328 3295.1 Deterministic extraction first, before any model call, in the existing 330extraction packages: headings, numbered clauses, tables, dates, deadlines, 331dollar values, labor categories, quantities, clearance terms, 332certifications, locations, travel percentages, period of performance, 333deliverables, evaluation factors. Output lands in 334opportunity_document_chunks with provenance. 335 3365.2 Model normalization second, through the existing inference router: 337 3381. The model returns typed JSON matching a declared schema. 3392. Every item carries document provenance: document id, page, section, 340 quote hash. 3413. Uncited output is rejected. 3424. Invalid enum values, dates, lengths, and quantities are rejected. 3435. Model output creates scope item drafts and requirement drafts only. 3446. Only a named, authorized human promotes a draft into anything the 345 scoring engine can see. Extract, draft, review, approve, promote. 346 3475.3 The external boundary. megamind-gateway gains a third backend: 348 349 backend openai, endpoint https://api.openai.com/v1/chat/completions, 350 bearer from the secrets resolver, model as a config value validated non 351 empty at boot, enabled flag default false. Enabled without the secret 352 fails the boot closed. 353 354internal/platform/scrub gains egress payload classes. Only these may leave 355the machine: PUBLIC_KNOWLEDGE, PUBLIC_DATA_SUMMARY, ONTOLOGY_SUGGEST, and 356REQUIREMENT_NORMALIZE. Public SAM.gov notice text may use the external 357backend under REQUIREMENT_NORMALIZE. Tenant uploaded documents and every 358private scope stay on the local plane, always. Never external, enforced by 359the gate and by tests: candidate rows, resume text, names, emails, phone 360numbers, tenant identifiers, anything from the eeo schema, RouteRAG and 361RouteGraph over tenant data, scoring inputs, scoring outputs, and slate 362contents. The gate fails closed to the local plane. Every external call 363audits backend name, payload class, byte count, and content hash, never 364content. The verifier gates all returned prose exactly as it does for local 365models. Record the backend in the model registry and AEDT inventory as 366outside the FIPS boundary, restricted to non regulated tasks. 367 368-------------------------------------------------------------------------------- 3696. FRONTEND, INSIDE frontend/src/tools/slatematch 370-------------------------------------------------------------------------------- 371 372Intake screens: 373 3741. Create opportunity: title, source type, agency or customer, 375 solicitation or reference number, response deadline, prime or 376 subcontract, capture owner, status. Minimum eight fields, nothing else 377 required. 3782. Opportunity intelligence: NAICS, PSC, set aside, place of performance, 379 estimated value, period of performance, incumbent, source URL, notes, 380 known partners. All optional. 3813. Upload documents: drag and drop plus file picker, required document 382 classification, file type allowlist, file size limit, sha256 duplicate 383 detection, upload progress, extraction status, retryable extraction 384 errors, malware scan hook. 3854. Review scope: for every extracted item show the text, document name, 386 page or section, extraction method, and confidence, with accept, edit 387 and accept, reject, split, merge, and add manually. 3885. Build requirements: generate drafts from accepted staffing scope, show 389 missing required fields, allow manual completion, require named 390 approval, promote, preserve lineage. 391 392Proposal workspace tabs: Overview (opportunity summary, customer deadline, 393internal deadline, owners, stage, readiness, hard blockers, scope changes, 394staffing coverage, compliance completion, section completion, review 395milestones, risks, recent activity), Scope, Requirements, Compliance 396Matrix (source requirement, document, page or section, response location, 397owner, due date, status, evidence, reviewer), Sections (code, title, owner, 398required, page or word limit, due date, draft status, review status, 399approval, version), Staffing (requirement, required quantity, linked slate, 400approved candidates, remaining gap, last scoring date, stale score 401warning), Milestones, Risks, Attachments, and Activity fed from the append 402only audit trail. Every new tile is clickable through to its filtered list. 403Reuse AppShell, ToolGuard, lib/queries, and the existing screen patterns. 404 405-------------------------------------------------------------------------------- 4067. READINESS ENGINE, internal/modules/proposals/engine 407-------------------------------------------------------------------------------- 408 409Pure Go, shopspring/decimal, no database, no I/O, injected inputs, a 410READINESS_ALGO_VERSION constant. Weights: 411 412 Staffing coverage 0.30 413 Compliance matrix 0.25 414 Required sections 0.20 415 Review and approval 0.10 416 Schedule health 0.10 417 Risk posture 0.05 418 419Hard blockers cap readiness regardless of total, mirroring the band cap 420philosophy of the candidate engine without sharing a line of code with it: 421customer deadline passed, required compliance item open, required section 422missing, required staffing quantity uncovered, final approval missing, 423unreviewed amendment affecting scope, required attachment missing, 424submission validation failed. Every result returns overall score, component 425scores, driver explanations, hard blockers, calculation timestamp, and 426algorithm version. Submission is blocked server side while any hard blocker 427exists. Snapshots persist to proposal_readiness_snapshots. This makes the 428command center distinction concrete: low proposal readiness can be a 429documentation problem, not a people problem. 430 431-------------------------------------------------------------------------------- 4328. BINARIES, EXHAUSTIVE LIST OF NEW COMMANDS 433-------------------------------------------------------------------------------- 434 435 cmd/sam-attachment-sync download queued public attachments 436 cmd/opportunity-extract run extraction over pending documents 437 cmd/opportunity-scope-normalize model normalization pass, Section 5 438 cmd/opportunity-amendment-diff version diffing and impact flags 439 cmd/proposal-readiness-snapshot scheduled readiness persistence 440 cmd/proposal-deadline-alerts deadline sweeps into alerts 441 cmd/stale-requirement-scan flag requirements older than policy 442 cmd/oews-metro-sync Phase 4, BLS OEWS at MSA level, API v2 443 cmd/sca-wd-sync Phase 4, SAM.gov wage determinations 444 cmd/usajobs-sync Phase 4, USAJOBS with the three headers 445 Authorization-Key, User-Agent set to the 446 registered email, Host data.usajobs.gov 447 448Task order depth extends cmd/awards-sync using USASpending File D1 through 449api.usaspending.gov bulk_download. Every binary follows the sam-sync 450pattern: idempotent, bounded, observable, audited, provenance aware, safe 451to rerun. 452 453-------------------------------------------------------------------------------- 4549. API ROUTES 455-------------------------------------------------------------------------------- 456 457 POST /api/opportunities 458 GET /api/opportunities/{id} 459 PATCH /api/opportunities/{id} 460 POST /api/opportunities/{id}/documents 461 GET /api/opportunities/{id}/documents 462 POST /api/opportunities/{id}/extract 463 GET /api/opportunities/{id}/scope 464 POST /api/opportunities/{id}/scope/items 465 PATCH /api/opportunities/{id}/scope/items/{item_id} 466 POST /api/opportunities/{id}/requirement-drafts 467 POST /api/requirement-drafts/{id}/approve 468 POST /api/requirement-drafts/{id}/reject 469 POST /api/proposals 470 GET /api/proposals/{id} 471 PATCH /api/proposals/{id} 472 GET /api/proposals/{id}/readiness 473 POST /api/proposals/{id}/readiness/snapshot 474 POST /api/proposals/{id}/submit 475 POST /api/proposals/{id}/outcome 476 477Plus normal CRUD for proposal sections, compliance items, milestones, 478risks, attachments, and staffing links. Every route follows the existing 479change discipline: thin handler, service layer logic, RunInTenantTx, 480capability check, tool entitlement gate answering 404 never 403, the same 481gate on flat alias paths, and an endpoint catalogue update. 482 483-------------------------------------------------------------------------------- 48410. PHASES AND GATES 485-------------------------------------------------------------------------------- 486 487PHASE 0: SECURITY AND PREFLIGHT 488 4891. HUMAN STEP, Joseph and Tom: revoke the exposed OpenAI key in the OpenAI 490 dashboard. Claude Code verifies no key material exists anywhere in the 491 repo or in any file it authors. 4922. HUMAN STEP: create a fresh project scoped key under a Mission Workforce 493 Technologies organization with a monthly usage cap and budget alerts. 494 It enters internal/platform/secrets as openai_api_key, root owned 0600 495 on M4, and nowhere else. 4963. HUMAN STEP: begin the SAM.gov system account application. Approval can 497 take weeks, so it starts now even though Phase 4 consumes it. 4984. Implement the scrub gate egress classes and external call audit rows 499 with the backend flag still false. 5005. Move INTELLIGENCE_EXPANSION_SPEC.md to docs/archive. 5016. Create docs/BUILD_STATE.md with the ledger format from Section 0. 502 503GATE 0: gateway with openai enabled and no secret refuses to boot, proven 504against the live gateway. Scrub tests pass. BUILD_STATE exists. The archive 505move is committed. 506 507PHASE 1: OPPORTUNITY FOUNDATIONS 508 5091. Migrations for tracked_opportunities, opportunity_versions, 510 opportunity_documents, opportunity_document_chunks, and ingest_manifest 511 per Section 2 item 9. 5122. Intake screens 1 through 3 with create, intelligence, and upload flows. 5133. sam-sync upgrade steps 1 through 8 of Section 4, including hash 514 comparison, versioning, and attachment queuing. 5154. cmd/sam-attachment-sync. 5165. Amendment detection wiring into the alerts module. 517 518GATE 1: a SAM.gov opportunity ingests twice without duplication. A manual 519opportunity is created with only the eight minimum fields and supports 520every downstream capability a SAM.gov opportunity supports. Versions are 521immutable, proven by attempted update failing. Tenant authored fields 522survive a source refresh byte for byte, proven by test. Uploads are 523validated, hashed, versioned, and traceable. All touched screens render 524with zero 5xx and zero page errors. 525 526PHASE 2: SCOPE AND REQUIREMENTS 527 5281. Deterministic extraction into chunks, Section 5.1. 5292. Local model normalization producing cited scope item drafts. 5303. External REQUIREMENT_NORMALIZE for public SAM.gov notice text only, 531 behind the scrub gate. Backend may be enabled only if Phase 0 items 1 532 and 2 are recorded in BUILD_STATE. 5334. Screen 4 scope review queue with accept, edit, reject, split, merge, 534 and manual add. 5355. requirement_drafts, screen 5, and the single transaction promotion 536 path. 5376. cmd/opportunity-extract, cmd/opportunity-scope-normalize, 538 cmd/opportunity-amendment-diff. 5397. Amendment impact analysis flagging affected approved requirements for 540 named human acceptance. 541 542GATE 2: every extracted scope item carries a source citation. Uncited model 543output is rejected, proven by test. A fixture containing a candidate row 544and a fixture of tenant uploaded document text each fail the scrub suite 545when placed anywhere in an external bound payload. Eight racing promotions 546of one draft elect exactly one approved requirement. An ingest run during 547promotion corrupts nothing. Approved requirements are never rewritten by 548any ingest path, proven by test. 549 550PHASE 3: PROPOSAL OPERATIONS 551 5521. Proposal migrations from Section 3.7. 5532. The workspace tabs from Section 6. 5543. The readiness engine from Section 7 with snapshots and 555 cmd/proposal-readiness-snapshot. 5564. cmd/proposal-deadline-alerts and cmd/stale-requirement-scan. 5575. Submission workflow with server side hard blocker enforcement. 5586. Outcome recording through bidoutcomes. 5597. SLATE APPROVAL LIFECYCLE, merged from consolidated amendment 2.3. The 560 slate member record gains status in proposed, approved, withdrawn, plus 561 approved_by_user_id, approved_at, withdrawn_by_user_id, withdrawn_at, 562 and withdrawal_reason, which is REQUIRED on every withdrawal and stored. 563 Approve is one transaction taking FOR UPDATE on the member row: set 564 status and stamps, and where the slate links to a proposal increment 565 proposal_staffing_links.approved_count, audited through OnTx. The 566 approval shows in the proposal Staffing tab, readiness inputs, and slate 567 exports with who and when. Withdraw uses the same transaction discipline: 568 requires the reason, sets status and stamps, decrements approved_count, 569 audits, and flags the latest readiness snapshot stale. Withdrawal never 570 deletes anything. Re approval after withdrawal is allowed and the audit 571 trail carries the full sequence. Both actions use the existing slate 572 decision capability and notify the capture owner and proposal owner 573 through the alerts module. UI: approve and withdraw buttons on the member 574 row, withdraw opens a reason modal, the row shows current status with the 575 latest stamp. 576 577GATE 3: a proposal with any hard blocker cannot be submitted through the 578API, not merely the UI. The same inputs produce bit identical readiness 579scores across runs. Every readiness result includes component scores, 580driver explanations, blockers, timestamp, and algorithm version. All 581workspace tabs render with zero 5xx. An outcome lands in bidoutcomes. 582 583GATE 3 ADDITIONS, merged from consolidated amendment 2.3: approve, withdraw, 584and re approve leave approved_count exactly correct under an EIGHT WAY RACE, 585proven by racing it. A withdrawal without a reason is rejected by the API, 586not just the form. A withdrawal flips readiness staleness and the next 587snapshot reflects the reduced coverage. The full sequence is visible in the 588audit trail. 589 590PHASE 4: INTELLIGENCE TIER A 591 5921. cmd/oews-metro-sync, cmd/sca-wd-sync (roughly ninety thousand wage 593 determination records, current revision flagged, no bulk download, so 594 page and cache), cmd/usajobs-sync including the unauthenticated code 595 list API, and task order depth in cmd/awards-sync. 5962. ontology-sync bump to O*NET 30.3 now and 31.0 when it lands late 597 August 2026, CC BY 4.0 attribution recorded in the manifest, Career 598 Exploration Tools excluded because their license is no derivatives. 5993. Verify whether CALC+ under buy.gsa.gov exposes a usable bulk path 600 before building on it. If not, ceiling rates load manually and are 601 versioned. 6024. Eleven compliance knowledge cards through curation.curate, each cited 603 to primary sources: NYC Local Law 144, Illinois HB 3773 with the AI 604 Video Interview Act, California FEHA automated decision rules, 605 California CCPA ADMT rules, Colorado SB 26-189 and its stay, Texas 606 TRAIGA, New Jersey LAD guidance, Mobley v. Workday through the 22 June 607 2026 order, the Kistler v. Eightfold FCRA theory and why missionMATCH 608 is first party only, OFCCP after EO 11246 with the 5.1 percent VEVRAA 609 benchmark and the ESDS listing duty, and the EU AI Act with Digital 610 Omnibus timing. 6115. Five new closed TAG intents, read only, parameterized, the model 612 selects the name only: wage_benchmark_by_msa(soc_code, msa), 613 sca_wd_lookup(state, county), recompete_radar(agency, naics, 614 months_ahead), vevraa_benchmark_status(), and 615 clearance_runway(clearance_level). 6166. The AEDT evidence pack export stub in governance: scoring inputs, 617 engine version, weights, band caps applied, model registry entry, 618 exportable per decision. 619 620GATE 4: every sync writes ingest_manifest rows and reruns without 621duplicates. All eleven cards render with citations and appear in 622GET /knowledge/cards. All five intents live in the registry with tests. 623 624PHASE 5: recruitMATCH DESK COMPLETION 625 6261. Expand the New Client form until a real client can be recorded: 627 contacts, addresses, billing terms, status, notes. 6282. Fix the stale hardcoded copy at 629 internal/modules/recruitmatch/derive.go:73 so the dashboard reflects 630 what is actually tracked. 6313. Make dashboard stat cards clickable through to their filtered lists, 632 platform wide. 6334. Wire the existing time to fill migration to a real service. 6345. Add revenue and bill rate tracking on placements, and candidate source 635 on candidates, with reporting. 6366. Add the redeployment metric with an assignment end date alert through 637 the alerts module, plus submissions per job and fill rate analytics. 638 639MERGED FROM THE CONSOLIDATED AMENDMENTS. The full text of each item is in 640docs/DIRECTIVE_AMENDMENTS_CONSOLIDATED.md at the section cited; the summary 641here is the work order. 642 6437. DESK INTEGRATION, amendment 2.4. (A) Requisition to requirement bridge: 644 requisitions gain requirement_id, creating a job order either links an 645 existing requirement or creates and links one using the structured fields 646 the platform already scores against. The FROZEN engine is reached ONLY 647 through this bridge. Editing a linked requirement after screenings exist 648 marks those results stale, never silently. (B) Resume pipeline: upload on 649 the candidate record and through apply intake, sha256, versioned, current 650 flag, priors retained, bytes through internal/platform/storage; parsing 651 through docextract and extraction into DRAFT profile suggestions accepted 652 or edited by a recruiter, never silently applied; clearance always labeled 653 clearance intelligence, self reported; duplicate detection on email and 654 phone prompts open or merge. (C) Screen from the desk: a Screen action on 655 an application runs screenMATCH against the requisition's linked 656 requirement, storing score, band, caps applied, engine version, and 657 timestamp on the application, with re screening history and a stale badge. 6588. PUBLISHING TO THE TENANT WEBSITE, amendment 2.5. Requisition visibility 659 internal_only or published with public label open, on_hold, filled, 660 closed, behind a publish checklist. The mm_api public jobs handler renders 661 SERVER SIDE HTML from Go templates: a careers index, one canonical detail 662 page per published open job, and the apply endpoint. Exactly one 663 JobPosting JSON-LD block per detail page mirroring visible content, none 664 on the list page. nginx on Bubbles proxies fg-talent.com/careers/ to the 665 mm_api upstream with the tenant slug fixed server side, and 666 /careers/apply with its own limit_req zone. JOSEPH REVIEWS BOTH LOCATION 667 BLOCKS BEFORE THEY TOUCH THE LIVE VHOST. Apply intake is same origin, 668 creating or dedupe matching a candidate and an application in the applied 669 stage, source career_site, consent event stored with notice version, 670 honeypot plus rate limiting. Nothing is ever posted to Google: indexing is 671 the careers sitemap section regenerated on publish and unpublish, internal 672 links, GSC Request Indexing, and the URL Inspection API. Expiry 673 discipline through cmd/jobs-expiry-sweep. FG TALENT CONTENT RULE, enforced 674 in template AND in test: only Patricia Cox and Brian Atwood may appear on 675 the public site or in schema; Tom and Glennette appear nowhere. 676 hiringOrganization is FG Talent Partners. Tenant mapping is configuration: 677 tenant_slug, public_base_url, brand template, consent notice reference; a 678 mapped tenant's jobs path on the missionMATCH domain issues a 301. 6799. DESK WORKFLOW ADDITIONS 1 through 11, amendment 2.6: structured intake 680 brief (role context, candidate profile, submission logistics), pipelines 681 per placement type, client submittal records with feedback reason codes 682 and an aging SLA timer, a reason taxonomy on every rejection and backward 683 stage move, days in stage aging, activities and tasks wired into every 684 record surface, talent pools and saved searches, status triggered alerts 685 with human send, offers completed with decline reasons flowing into 686 placements, an optional per client requisition approval chain, and client 687 specific submittal requirements. 68810. THE IMPORT CENTER AND UPLOADS, amendment 4. ONE upload subsystem, three 689 entry points (candidate record, recruitMATCH Import Center, screenMATCH 690 screen from resume), and apply intake uses the same path. Every bulk 691 import is STAGED, never direct: import_batches, import_rows, 692 import_mappings, then validate, preview, and a HUMAN COMMIT with a first 693 party attestation. Protected class columns are REJECTED at validation by 694 name pattern and content sniffing; EEO data never enters through an 695 import. cmd/import-process is asynchronous, bounded, observable, audited, 696 and idempotent by row action. Archive safety on every zip: list entries 697 first, per entry allowlist and size cap, entry count cap, reject nested 698 archives and path traversal. 69911. THE CANDIDATE SPINE AND THE CANDIDATES PAGE, amendment 5. ONE candidate 700 spine shared by every surface, with shared frontend profile components 701 composed by both the command center and the new recruitMATCH Candidates 702 page. Candidate search is DETERMINISTIC SQL through the existing hybrid 703 fusion exposed as a repository query; the AI Ask path is untouched. 704 Reverse match runs the frozen engine, one candidate against every open 705 requisition's linked requirement, persisting score, band, engine version, 706 and computed_at, going stale on change. Add to job order creates the 707 application under FOR UPDATE with exactly ONE active application per 708 candidate per requisition enforced by a partial unique index over non 709 terminal statuses. Applications record added_from and, when added from a 710 match, the score snapshot at add time. Job order status is a state 711 machine (draft, open, on_hold, filled, closed) that UPDATES ITSELF: 712 filling the last seat flips to filled inside the placement transaction the 713 seat lock governs, moves remaining active applications to 714 filled_by_another (a distinct outcome, never a rejection) with 715 notifications, and unpublishes the public page; a fall off frees the seat, 716 reopens the order, alerts, and NEVER republishes without a human confirm. 717 718GATE 5: a real client is created through the UI. The full pipeline, 719contacted to interview to offer to hire or no hire, is exercised end to end 720with data. Time to fill, fill rate, submissions per job, redeployment rate, 721revenue, bill rate, and source all render with real numbers. Zero 5xx. 722 723GATE 5 ADDITIONS, merged from consolidated amendments 2.8, 4.6, and 5.7. 724 725Publishing and desk (2.8): publish a job order and load it at 726https://fg-talent.com/careers/ and its detail URL, with curl showing full job 727content in the INITIAL HTML response, no JS required. Exactly one JobPosting 728JSON-LD block mirroring visible content, passing Rich Results. Apply from 729fg-talent.com creates a candidate and an application, stage applied, source 730career_site, consent event stored with notice version, duplicate check firing 731on a repeat email. Filling the order removes the detail page, the index entry, 732the sitemap entry, and the markup. The missionMATCH domain path for the FG 733Talent slug issues a 301. Page and schema contain Patricia Cox and Brian 734Atwood only, with a TEST asserting Tom and Glennette appear nowhere in 735rendered output or JSON-LD. Unknown slug returns 404 leaking nothing, and the 736apply rate limit answers 429 under a race. The careers sitemap regenerates on 737publish and unpublish, GSC Request Indexing is exercised once and recorded, 738and the feed renders on a test page. Screen from an application stores a 739banded result that goes stale when the requirement changes; resume parse 740produces suggestions and never overwrites; duplicate detection fires. An 741intake brief saves with all three blocks, a client submittal records feedback 742with a reason code whose SLA timer ages, a rejection carries a taxonomy 743reason, and an accepted offer flows into a placement carrying rates forward. 744 745Imports (4.6): a three file resume bundle commits to three candidates with 746parsed suggestions and batch and row lineage. A planted duplicate triggers the 747dedupe prompt and a merge produces ONE candidate. A spreadsheet with a 748protected class column is REJECTED at validation with the column named and 749nothing reaches a live table. A five hundred row spreadsheet commits with 750correct counts and a clean error export. KILL cmd/import-process MID COMMIT 751and rerun: the batch completes with no duplicates, proven by counts. Screen 752from resume produces a banded result and the dedupe prompt fires. A bulk 753screen fills the queue and lists a corrupt file as failed. A zip with path 754traversal and a zip with a nested archive are both rejected AT LISTING. Every 755commit stores the attestation with user and timestamp. An uncommitted batch is 756invisible to candidates, search, matching, and slates, proven by query. 757 758Candidates and dataflow (5.7): the Candidates page finds a planted candidate 759by skills filter and by free text through the fusion query, and the command 760center Candidates screen still renders from shared components with ZERO 761regression. Reverse match returns an IDENTICAL ranking across repeated runs 762and the engine diff remains empty. Add to job order from the match list 763creates the application with the score snapshot and added_from match; EIGHT 764RACING ADDS of the same pair produce exactly ONE application; a duplicate add 765through the API is rejected. Stage counts update through every stage and each 766tile clicks through. Placing the final seat flips the order to filled, moves 767remaining applications to filled_by_another with alerts, and removes the 768fg-talent.com page and sitemap entry. A simulated fall off frees the seat, 769reopens the order, does NOT republish, and a one click reactivation restores a 770filled_by_another candidate to their prior stage, audited. Re adding a 771previously rejected candidate demands a reopen reason. A candidate on a 772proposal slate and in a desk pipeline resolves to ONE candidate id everywhere. 773 774PHASE 5A: IDENTITY AND ACCESS 775 776Inserted between Phase 5 and Phase 6 by docs/DIRECTIVE_AMENDMENT_6.md, triggered 777by live FG Talent feedback. Full text in that file, section 4. 778 7791. MATRIX REBUILD. Capabilities become entity action pairs carrying an 780 OWNERSHIP SCOPE of own, team, or organization, plus feature capabilities for 781 export, bulk edit, import commit, publish, and the existing approvals. The 782 nineteen current capability keys REMAIN AS ALIASES mapped forward, never 783 renamed destructively. Role defaults, tenant scoped, each row building on the 784 one before it: viewer reads only with no export and no rates and no EEO ever; 785 member adds notes, tasks, and activities; recruiter adds full desk work, 786 imports including commit with attestation, pools and saved searches, pay rate 787 visible, export limited to own and team; manager adds orders create and edit, 788 publish and unpublish, requirement approval and proposal submission, bill rate 789 and margin visible, organization wide export and bulk edit, fall off 790 reactivations; admin adds user management, tenant settings, stage templates, 791 notice templates, import mappings, and integration configuration; owner adds 792 billing and plan, retention settings, and full data export; superuser is owner 793 plus everything else BY RULE, WITHIN ITS TENANT ONLY; operator is everything 794 everywhere including platform surfaces, always audited, MFA always. 7952. OWNERSHIP SCOPES as an attribute of each entity action capability, with team 796 defined by the light teams model (an optional team assignment per tenant). 7973. FIELD SENSITIVITY CLASSES, first class rates: pay rate visible to recruiter 798 and above; bill rate and margin visible to manager and above and INVISIBLE 799 below that everywhere. Wired through render, export, feed, and API layers so a 800 hidden class is ABSENT FROM THE PAYLOAD, not blanked in the UI. The mechanism 801 is generic so future sensitive fields reuse it. 8024. IMPERSONATION, operator only: view as a user with a persistent on screen 803 banner, read only by default, write only through explicit escalation, auto 804 expiry within the hour, every impersonated request audited with BOTH 805 identities. 8065. ORGANIZATIONS PROVISIONING, operator console: create a tenant, set product 807 entitlements per tool, configure the site mapping, and invite the first 808 superuser by email. The productized path for onboarding the next client. 8096. The exhaustive capability matrix tests are REGENERATED for the new shape and 810 pass in full, including the alias mapping from the nineteen legacy keys. 811 812GATE 5A: the regenerated matrix tests pass for every role, every tool, every 813scope. A recruiter cannot obtain bill rate or margin through ANY surface, screen, 814export file, feed, or raw API response, proven by fixture inspection of the 815payloads. The grant ceiling holds at every rung, proven by attempting each 816violation. Impersonation shows the banner, expires on schedule, defaults read 817only, and writes both identities to every audit row it touches. Provisioning on 818staging creates a tenant, entitles products, configures a site mapping, and 819delivers a working superuser invitation end to end. A tenant superuser requesting 820any platform route receives 404, and the operator with MFA reaches all of them. 821 822PHASE 6: PRODUCTION HARDENING AND GO LIVE 823 8241. Enable MFA. Set MM_ENV to production and validate the 825 MM_ALLOW_SELF_HOSTED_PRODUCTION path so every production gate is live. 8262. Queue and sync metrics through obs. 8273. Backup and restore test, large document tests, and a rerun of the full 828 concurrency suite including the original sixteen racing stage 829 transitions. 8304. Documentation sweep: Owner's Manual, MODEL_CARD, STACK_DECISIONS, 831 endpoint index, table index, runbooks, and the honest work queue, which 832 must match BUILD_STATE exactly. 833 834GATE 6: the final acceptance list in Section 11 passes in full. 835 836POST GO LIVE FAST FOLLOW, not gated for launch: agency forecast ingestion, 837VEVRAA state job bank posting starting with design partner states, the 838SkillBridge authorized organizations directory (organizations, never 839people), SBA socioeconomic data through SAM.gov entity extracts, the hand 840curated quarterly clearance runway reference table from GAO and 841performance.gov, and licensed compensation benchmarks, never scraped. 842 843Merged from consolidated amendment 2.7: the client portal rendering the 844submittal and feedback model, read only, per client contact authentication; 845automated candidate engagement sequences on status triggers once a sending 846policy is decided; VEVRAA ESDS posting reusing the publish pipeline as its 847source of truth; knockout questions and reference check records on 848applications; a placement start onboarding checklist; and requisition and 849placement history import. 850 851-------------------------------------------------------------------------------- 852TASK T1: MARKETING SITE LOGIN BUTTON, STANDALONE 853-------------------------------------------------------------------------------- 854 855Registered from consolidated amendment 2.2. This is standalone work OUTSIDE 856the phase gates and OUTSIDE the missionMATCH repo, executed on the Bubbles 857vhosts. 858 8591. Enumerate the nginx vhosts on Bubbles and identify where missionMATCH is 860 marketed publicly. The application itself lives at 861 https://missionmatch.thatwebhostingguy.com, so the button belongs on the 862 marketing surface, not inside the app. 8632. If the target is ambiguous, list the candidate vhosts for Joseph in ONE 864 message and WAIT for his pick. Never guess on a production website. 8653. Add a prominent Log in button in the site header and hero linking to 866 https://missionmatch.thatwebhostingguy.com. Static HTML, CSS, and vanilla 867 JS, brand consistent, no framework, no Python. 8684. If no marketing page exists, say so and build a single branded page with a 869 hero, a product line summary, and Log in, at the vhost Joseph names. 8705. Verify rendered in a browser over HTTPS before recording done. 871 872-------------------------------------------------------------------------------- 87311. FINAL ACCEPTANCE, ALL MUST PASS 874-------------------------------------------------------------------------------- 875 8761. A SAM.gov opportunity is ingested without duplication. 8772. A manual opportunity is created with minimum information. 8783. Manual and SAM.gov opportunities have full feature parity. 8794. Amendments create immutable versions. 8805. Tenant capture data survives source refreshes. 8816. Uploaded files are validated, hashed, versioned, and traceable. 8827. Every extracted scope item has a source citation. 8838. Uncited model output is rejected. 8849. Private scopes never use external inference, proven by the scrub suite. 88510. Requirement drafts cannot enter candidate scoring without named human 886 approval. 88711. Amendments never silently rewrite approved requirements. 88812. Proposals cannot be submitted with hard blockers, enforced server side. 88913. Readiness calculations are bit reproducible. 89014. Every readiness result includes explanations and an algorithm version. 89115. Every new tenant table has organization_id, forced RLS, and the 892 composite index. 89316. Cross tenant queries return zero rows. 89417. All jobs are idempotent and rerun safe. 89518. Every external source writes provenance to ingest_manifest. 89619. The gateway with openai enabled and no secret refuses to boot. 89720. No new Python exists anywhere, confirmed by rg. 89821. No dashes exist in written docs, confirmed by rg. 89922. Audit records remain append only, update and delete still revoked. 90023. The candidate scoring engine diff against the starting commit is empty. 90124. BUILD_STATE, the honest work queue, and reality agree. 902 903Merged from the consolidated amendments, sections 2.9, 4.7, and 5.8. 904 90525. Slate approval and withdrawal maintain correct counts under race, and 906 every withdrawal carries a stored reason. 90726. Public jobs surfaces expose only published data, resolve tenants by slug 908 only, and pass Rich Results validation on every live posting. 90927. Expired or filled postings drop their markup immediately, verified by the 910 sweep job's test. 91128. Apply intake stores a consent event with notice version for every 912 submission. 91329. Desk screenings reach the engine only through the requisition to 914 requirement bridge, and the engine diff remains empty. 91530. No import writes a live record except through a committed batch, and every 916 imported record carries batch and row lineage. 91731. Protected class data cannot enter through any import path, proven by the 918 rejection tests. 91932. Import batches are idempotent under rerun and partial failure, with counts 920 that always reconcile to rows. 92133. Exactly one active application exists per candidate per requisition, 922 enforced by the database, proven by the race. 92334. Every job order status transition, automatic or manual, carries an audited 924 cause, and filled_by_another is distinguishable from rejection in every 925 report. 92635. Reverse match rankings are bit reproducible, persisted with engine version, 927 and the frozen engine remains untouched. 928 929Merged from docs/DIRECTIVE_AMENDMENT_6.md section 5. 930 93136. Every role can edit its own profile, and identity changes are audited and 932 propagate everywhere the identity renders. 93337. The role grant ceiling is enforced at the API for every rung of the ladder. 93438. Rates above pay are invisible below manager on every surface, including 935 exports, feeds, and raw API payloads. 93639. Operator requires MFA without exception, platform surfaces answer 404 to 937 everyone else, and every impersonated action carries both identities in the 938 audit trail. 93940. User accounts are never deleted; deactivation blocks login while preserving 940 ownership, activity, and audit history. 941 942DEFINITION OF DONE 943 944A company can discover an opportunity from SAM.gov or enter one manually, 945upload and version its solicitation package, extract and review the scope, 946approve workforce requirements, generate staffing slates, manage proposal 947compliance and content, measure explainable readiness, submit the 948proposal, record the outcome, and trace every material decision back to 949its original source, all inside missionMATCH, with nothing built beside 950it. 951 952================================================================================ 953APPENDIX A. THE CANONICAL DATAFLOW, PERMANENT 954================================================================================ 955 956Merged from consolidated amendment 5.1 as a permanent part of this directive. 957One candidate spine. One linking record. Everything hangs off it. 958 959 INTAKE CANDIDATE WORK 960 apply on fg-talent.com \ / desk pipeline 961 Import Center bulk \ / (applications) 962 screenMATCH resume > candidates table < proposal slates 963 quick add on the desk / one record per person \ screenings 964 (all paths dedupe) / all tools, same spine \ pools, searches 965 966 THE LINKING RECORD: application (candidate x requisition) 967 exactly one active application per candidate per requisition 968 969 requisition (job order, openings count, linked requirement) 970 | 971 | add to job order (from match, search, pool, or manual) 972 v 973 application: prescreen -> internal submittal -> client submittal 974 -> interview -> offer -> placed 975 or out at any stage, always with a reason code 976 | 977 | offer accepted 978 v 979 placement takes a seat under the existing FOR UPDATE seat lock 980 | 981 v 982 JOB ORDER UPDATES ITSELF 983 stage counts derive live on the order 984 last seat placed flips status to filled in the same transaction 985 remaining active applications become filled_by_another, notified 986 filled unpublishes the fg-talent.com page via the expiry sweep 987 a fall off frees the seat, reopens the order, alerts the owner, 988 and never republishes without a human confirming 989 | 990 v 991 placement end approaching -> redeployment alert -> candidate returns 992 to the available pool -> the spine loops 993 994Both match directions use the SAME FROZEN ENGINE: a job order ranks 995candidates, and a candidate ranks open job orders, both reading through the 996requisition to requirement bridge. screenMATCH is the deep evaluation of one 997pairing, stored on the application. slateMATCH is the proposal branch off the 998same spine, and a person may sit on a slate and in a desk pipeline at once 999because both point at one candidate record. 1000