Janady13/missionmatch / docs/BUILD_STATE.md

1# missionMATCH BUILD_STATE 2 3================================================================================ 4STANDING REFERENCE. The CURRENT handoff is the SESSION HANDOFF section below. 5================================================================================ 6 7THE TOP OF THIS FILE USED TO CARRY A SECOND, OLDER HANDOFF and it went stale: it still said Gate 8C fails and Gate A waits on one blocker, both of which were superseded the same day. Two handoffs 9in one ledger is one handoff too many, and the stale one is the one a fresh session reads first. 10Removed 29 July 2026. What remains here is DURABLE reference that does not change per session. 11 12PRODUCTION IS TWO DATABASES. Reading this wrong caused an outage. 13 CONTROL PLANE, authoritative identity, what MM_DATABASE_URL points at: 14 missionmatch on megamind-agi 100.77.114.40 PORT 5433, v80. 15 ANSWER EVERY IDENTITY QUESTION HERE. 16 TENANT DATA PLANE, only via tenant_directory: 17 missionmatch on M4 100.94.8.94 port 5432, v80. Its users copy is NON 18 AUTHORITATIVE; an hourly sync keeps it honest. 19 STAGING: missionmatch_staging on M4 5432, v81, served by mm-api-staging on 20 Bubbles 127.0.0.1:8097, vhost missionmatch-staging.thatwebhostingguy.com. 21 STAGING IS ONE AHEAD ON PURPOSE: 0081 is staging only pending a deploy. 22 Both production nodes run 8f24414531e80a9a. Bundle index-BE5iWWvj.js. 23 24ACCESS, all verified this session 25 Bubbles ssh user@100.90.97.104 pw user, sudo via echo user | sudo -S 26 M4 ssh joseph@100.94.8.94 psql /opt/homebrew/bin/psql, 27 local trust as -U postgres 28 megamind-agi NO direct SSH. ssh -o PubkeyAuthentication=no 29 -o PreferredAuthentications=password josep@100.69.120.61, then 30 scp a script and run: wsl -- bash /mnt/c/Users/josep/<script>.sh 31 MULTI LINE QUOTING THROUGH wsl BREAKS. Always stage a file. 32 PASSWORD REDACTED 28 July 2026, finding D4. It is in the secrets 33 store, never here. See the standing rule below. 34 psql locally /opt/homebrew/opt/libpq/bin/psql, not on PATH by default. 35 Staging test accounts: patriciacox6@aol.com and desk.admin@fg-talent.test. 36 PASSWORDS REDACTED 28 July 2026, finding D4, and both were 37 ROTATED before redaction because they were already burned. The 38 replacements are in the secrets store. Redacting without rotating 39 would have been theatre: the old values are in git history and in 40 a chat transcript, and a redaction does not un publish them. 41 42HOW TO DEPLOY, and why production is not repository HEAD 43 HEAD carries Phase 1 and 2 build features that stay DARK until Gate 6. Build in 44 a worktree at e74fd2e, overlay ONLY the approved track's files, hand resolve 45 cmd/api/main.go, take AppShell.tsx from the BASELINE, then GREP THE ARTIFACTS. 46 Both nodes get the identical binary or failover serves two answers. 47 Frontend: rewrite ONLY the two asset hashes; the line count must not change. 48 Env files: sudo tee TRUNCATES. Stage to /tmp then cp. 49 Post deploy: re prove build routes dark on the UNAUTHENTICATED AND the 50 AUTHENTICATED leg. An unauthenticated only sweep cannot see a defect behind the 51 session gate, which is how a 500 was missed. 52 53THE INSTRUMENTS, all new this session, all with positive controls 54 tools/verify/stress race, load, soak. -control plants a defect and the 55 profile MUST fail on it before a counted run. 56 tools/verify/visual-sweep logs in as real roles, 5 viewports, contact sheet. 57 --control plants a 4000px overflow. 58 /usr/local/sbin/mm-restore-drill.sh run at EVERY phase close. 59 Timers: 02:45 cp backup, 03:05 db backup, 5min watch, hourly identity sync. 60 61CANDIDATE INTAKE, WHAT EXISTS AND THE ONE DECISION IT NEEDS, 30 July 2026. Joseph asked for candidate import 62that also PULLS FROM DATABASES rather than only ingesting files. Researched before building; most of it exists. 63 64WHAT IS ALREADY BUILT, and it is more than expected 65 connector.Connector is an interface: Name() and FetchPage(ctx, since, page) returning people, a next page 66 cursor, and the max updated timestamp seen. 67 connector.Sync is a REAL INCREMENTAL SYNC FRAMEWORK, not a stub. It reads the org's watermark from 68 connector_sync_state, pages from it, ingests each page through the proven sourcing path with a 69 sourcing_log provenance row, and advances the watermark PER PAGE in one atomic transaction. Network I/O 70 runs OUTSIDE the transaction so a slow fetch never holds one open. A 429 maps to ErrThrottled and stops 71 the run gracefully, keeping the pages already committed. No PII is logged. 72 benchimport carries a FileSource interface with TWO implementations already: a resume source that extracts 73 from documents, and a structured source for tabular records. 74 ONE CONNECTOR EXISTS: iCIMS, an applicant tracking system. 75 76SO THE GAP IS NOT THE MACHINERY. It is two things: no HTTP route reaches any of it, and there is no second 77source to pull from. 78 79THE DECISION, AND IT IS A SECURITY DECISION RATHER THAN A DESIGN PREFERENCE. 80 iCIMS credentials come from PROCESS ENVIRONMENT VARIABLES: ICIMS_CUSTOMER_ID, ICIMS_CLIENT_ID, 81 ICIMS_CLIENT_SECRET. That means ONE DEPLOYMENT CAN SERVE EXACTLY ONE iCIMS ACCOUNT. It works for a single 82 pilot tenant and it cannot serve customers, because the second customer's credentials have nowhere to live. 83 connector_sync_state holds watermarks, not configuration and not secrets. 84 85 PULLING FROM A CUSTOMER'S DATABASE MAKES THIS SHARPER, not softer. A database source needs a DSN, which is a 86 live credential to a system this platform does not own, stored per tenant. Three sub questions come with it 87 and each is a real exposure rather than a detail: 88 WHERE THE SECRET LIVES. The precedent in this codebase is good and should be followed: TOTP secrets are 89 AES 256 GCM encrypted at rest with a key_version so the KEK can rotate. A connector_configs table with 90 the same shape is the honest answer, not a plaintext column and not an env var. 91 WHAT THE CONNECTION MAY REACH. An operator supplied DSN is a request the SERVER makes to an arbitrary 92 host, which is server side request forgery with a friendly name. It needs an explicit egress posture: 93 an allowlist, or at minimum a refusal of loopback and private ranges, decided deliberately rather than 94 inherited by accident. 95 WHAT THE QUERY MAY DO. A customer supplied query must run READ ONLY with a statement timeout, in a 96 transaction that cannot write, because "SELECT the candidates" and "DROP the candidates" differ by one 97 word in a text box. 98 99 THE OPTIONS, stated as a choice rather than a recommendation dressed as a finding: 100 A. Per org connector_configs with AES 256 GCM at rest, mirroring the TOTP pattern. Multi tenant, and the 101 most work. 102 B. Keep credentials in the environment and support ONE source per deployment. Cheapest, and it cannot 103 onboard a second customer onto the same connector. 104 C. Resolve credentials through the existing secrets.Resolver backend abstraction, which already has a 105 cache and a pluggable backend, so a cloud secret manager becomes configuration rather than code. 106 I recommend A for the database and ATS sources, with C as the deployment time option for platform wide 107 credentials. B is what exists and it does not survive a second customer. 108 109WHAT CAN BE BUILT WITHOUT THAT DECISION, and should be, because it needs no new credential surface at all: 110 A STRUCTURED CANDIDATE IMPORT ROUTE. benchimport's structured source already parses tabular records into 111 BenchRecord and ToSourcedPerson feeds the same proven ingest path connector.Sync uses. An upload that 112 STREAMS and parses in memory needs no object storage, which matters because MM_STORAGE_ROOT is unset in 113 production and document intake is therefore dark. So a customer could load a bench today, from the product, 114 with no new secret anywhere. 115 RESUME upload is the half that DOES need storage, and it is blocked behind the same disk decision as 116 document intake, on a root disk at 82 percent whose backups share it. 117 118NOTHING WAS BUILT FOR THIS YET. Recorded so the decision is made deliberately rather than discovered halfway 119through a connector that is already holding a customer's database password. | this commit | 2026-07-30 120 121PHASE 3 WORK PLAN, RESEARCHED PER ITEM, 30 July 2026. Joseph asked for each numbered item researched for what 122it actually needs, then the list worked down, then a full application test round. Every "exists" or "absent" 123below is a query result or a grep, not a recollection. 124 125ITEM 1, PROPOSAL MIGRATIONS. DONE. Migration 0086 in all three databases at v86: 11 tables, 11 forced RLS, 6 126 slate lifecycle columns, composite tenant keys throughout, no DELETE grants, the approved_count invariant in 127 the schema, and mm_mirror_staging_role_privileges() so the 0085 class of gap cannot recur. 128 129ITEM 3, THE READINESS ENGINE. NEXT, and first because everything downstream reads it. 130 internal/modules/proposals/engine, pure Go, injected inputs, no database, no I/O, READINESS_ALGO_VERSION. 131 Weights 0.30 staffing coverage, 0.25 compliance matrix, 0.20 required sections, 0.10 review and approval, 132 0.10 schedule health, 0.05 risk posture. Sums to 1.00, asserted by a test rather than by arithmetic in a 133 comment. 134 EIGHT HARD BLOCKERS, from Section 7: customer deadline passed, required compliance item open, required 135 section missing, required staffing quantity uncovered, final approval missing, unreviewed amendment affecting 136 scope, required attachment missing, submission validation failed. 137 DETERMINISM IS THE GATE CLAUSE AND IT HAS THREE KNOWN FAILURE MODES, all quiet: a float64 arriving through 138 JSON unmarshalling into interface{}, GO'S RANDOMISED MAP ITERATION anywhere in the scoring path, and 139 unstable tie breaking when two drivers score equal. Mitigations are decided in advance: decimal everywhere, 140 NO map iteration feeds a score (inputs arrive as slices and any map is sorted before use), and every ordering 141 carries a total order tiebreaker. A test runs the same input 100 times and asserts byte identical output. 142 It shares NOT ONE LINE with the candidate engine, per Section 7, while mirroring its cap philosophy. 143 144ITEM 7, THE SLATE APPROVAL LIFECYCLE AND THE EIGHT WAY RACE. Second, because it is the hardest thing in the 145 phase and a concurrency design validated last is validated by hope. 146 Schema is ready. What remains is the transaction: approve and withdraw each take FOR UPDATE on the member 147 row, adjust proposal_staffing_links.approved_count, and audit through OnTx. 148 THE REAL DIFFICULTY IS LOCK ORDERING, not the counter. Eight transactions touching a member row AND the 149 links row deadlock unless they always acquire in the same order. Decision: ALWAYS the links row first, then 150 the member row, because the links row is the contended one and taking it first serialises the counter update 151 without holding a member lock while waiting. 152 The harness runs eight concurrent workers doing approve, withdraw and re approve, then asserts the final 153 count. The schema CHECK turns any lost update into an error rather than a flattering number. 154 155ITEM 5, SUBMISSION WITH SERVER SIDE HARD BLOCKER ENFORCEMENT. The check lives in the SERVICE, never the 156 handler, so a future route cannot bypass it, and a test asserts no submission path skips it. Gate 3 is 157 explicit that the API refuses, not merely the UI. 158 159ITEM 8 AND 9, PRICING AND RECORDED WAGE FLOORS, from the 30 July amendment. A pure margin function on decimal: 160 bill minus pay minus burden. AN UNBURDENED LINE RETURNS NO MARGIN AT ALL, which is gate clause A, and the 161 API omits the field with a stated reason rather than sending a spread that reads as margin. A line priced 162 below its recorded floor is a hard blocker, which folds pricing into item 5 rather than beside it. 163 164ITEM 6, OUTCOME RECORDING THROUGH bidoutcomes. The module EXISTS, 477 lines with a Routes function, and 165 MM_BID_OUTCOMES_ENABLED is UNSET in both environments so the recording routes are not mounted and the ledger 166 ships dormant. This item is mostly wiring plus the flag, not new machinery. 167 168ITEM 4, THE TWO COMMANDS. cmd/proposal-readiness-snapshot for scheduled persistence and 169 cmd/proposal-deadline-alerts sweeping deadlines into alerts, plus cmd/stale-requirement-scan. The alerts 170 module EXISTS at 930 lines, so deadline alerts extend it. Every binary follows the sam-sync pattern: 171 idempotent, bounded, observable, audited, provenance aware, safe to rerun. 172 173ITEM 2, THE WORKSPACE TABS, Section 6. TEN tabs: Overview, Scope, Requirements, Compliance Matrix, Sections, 174 Staffing, Milestones, Risks, Attachments, Activity. Overview alone carries opportunity summary, both 175 deadlines, owners, stage, readiness, hard blockers, scope changes, staffing coverage, compliance completion, 176 section completion, review milestones, risks and recent activity. Every tile clickable through to its 177 filtered list. Reuse AppShell, ToolGuard, lib/queries. Activity is fed from the append only audit trail. 178 LAST, deliberately: a tab that renders a number the engine has not settled is a tab built twice. 179 180ROUTES, Section 9: POST /api/proposals, GET and PATCH /api/proposals/{id}, GET /{id}/readiness, 181 POST /{id}/readiness/snapshot, POST /{id}/submit, POST /{id}/outcome, plus CRUD for sections, compliance 182 items, milestones, risks, staffing links and attachments. 183CAPABILITIES: proposal.manage at recruiter and above, proposal.submit at manager and above. The other 22 184 exist; these two do not and the exhaustively tested matrix must be updated with them. 185 186EVERYTHING IS BUILT IN PRODUCTION per the rail amendment, with rollback before each change, artifacts hash 187verified after transit, and controls run before conclusions. | this commit | 2026-07-30 188 189RECORDED SCOPE AMENDMENT, PHASE 3 GAINS PRICING, AND GATE 3 GAINS FOUR CLAUSES. 30 July 2026, Joseph's 190decision after he challenged my claim that the gate was the obstacle. He was right and the claim was wrong: the 191gate is a specification we write, not a constraint we inherit, so a phase that gains scope gains gate clauses. 192 193PHASE 3 IS NOW: PROPOSAL OPERATIONS, INCLUDING PRICING. The directive's seven items stand unchanged, plus: 194 195 8. PROPOSAL PRICING. A staffing line on a proposal carries a labor category, a pay rate, a BURDEN, and a bill 196 rate. Margin is COMPUTED, never stored, by a pure function on shopspring/decimal, because a stored margin 197 drifts from its inputs and the whole point is that the number can be re derived. 198 9. RECORDED WAGE FLOORS. A table of wage determination floors per labor category and locality, entered by a 199 named human with the determination number, revision, and effective date. NOT extracted from the document, 200 and the reason is finding one: the SCA wage determination's text layer carries no usable character map, so 201 the floor cannot be read from it and OCR is deferred as candidate P2. A floor a human recorded is honest. 202 A floor guessed from an unreadable PDF would not be. 203 204GATE 3 GAINS FOUR CLAUSES, and they are written to slot into the gate rather than sit beside it: 205 206 A. A BILL RATE WITH NO BURDEN PRODUCES NO MARGIN AT ALL. Not a spread labelled as margin, not a zero, not a 207 null quietly rendered as a dash. The API refuses to return a margin field for an unburdened line and says 208 why. This is tonight's most expensive lesson made into a gate clause: the product could show bill minus 209 pay and call it margin, and that number would be wrong in the direction that loses money. 210 B. THE SAME INPUTS PRODUCE BIT IDENTICAL MARGIN ACROSS RUNS, decimal throughout, no float64 anywhere in the 211 path, proven the same way readiness is proven. 212 C. A STAFFING LINE PRICED BELOW ITS RECORDED WAGE FLOOR IS A HARD BLOCKER ON SUBMISSION, ENFORCED SERVER 213 SIDE. This is why pricing belongs in this phase rather than beside it: it does not extend the gate, it 214 makes the gate's central clause mean more. An underpriced SCA position is exactly the class of thing that 215 must stop a submission at the API and not merely grey out a button. 216 D. WRAP RATE RESOLUTION IS RECORDED ON THE PRICED LINE with its source and version, so a margin can be re 217 derived months later and an assessor can see which burden assumption produced which bill rate. 218 219WHAT IS DELIBERATELY NOT IN THIS PHASE, so the amendment does not become a bucket the way my three misfilings 220did: 221 THE WAGE BRIDGE, D22, STAYS OUT. Canonical SOC form, ontology_crosswalk, and skills.soc_code are MARKET 222 COMPARISON data. Phase 3 needs a floor a human recorded, not a market band, and dragging a bridge that is 223 broken in three ways into a phase that does not need it is how a phase stops closing. 224 THE SELF EXTENDING KNOWLEDGE STORE STAYS OUT. Unphased and visible. 225 OCR STAYS OUT. Candidate P2, and clause C is written to not need it. 226 227THE HARD PARTS, NAMED IN ADVANCE so the plan is honest about where the time goes. Only two of the gate's 228clauses are genuinely difficult and neither is pricing: 229 THE EIGHT WAY RACE ON approved_count. The count moves both up AND down, since withdrawal decrements and re 230 approval after withdrawal is allowed, so a member can cycle. The difficulty is not the counter, it is LOCK 231 ORDERING: eight transactions each taking FOR UPDATE on a member row and touching proposal_staffing_links will 232 deadlock unless they always acquire in the same order. And the gate says PROVEN BY RACING IT, so a harness 233 that runs eight concurrent workers and asserts the final count, not an argument that the code reads correctly. 234 I am building that harness FIRST, not last, because a concurrency design validated at the end is a 235 concurrency design validated by hope. 236 BIT IDENTICAL READINESS. Three ways it breaks and all three are quiet: a float64 arriving through JSON 237 unmarshalling into interface{}, GO'S RANDOMISED MAP ITERATION anywhere in the scoring path, and unstable tie 238 breaking when two drivers score equal. The frozen engine already solved this with decimal and total order 239 tiebreakers; readiness has MORE inputs and must inherit the same discipline. 240 241EVERYTHING IS BUILT IN PRODUCTION, per the rail amendment recorded above this entry. No side builds, no 242sandbox. Rollback before each change, artifacts hash verified after transit, controls run before conclusions. 243| this commit | 2026-07-30 244 245CORRECTION, I ENLARGED PHASE 3 THREE TIMES WITHOUT CHECKING WHAT PHASE 3 IS, 30 July 2026. Found while 246preparing the Phase 3 breakdown Joseph asked for. 247 248THE DIRECTIVE'S PHASE 3 IS "PROPOSAL OPERATIONS", Section at line 550, and it is seven numbered items with its 249own Gate 3: proposal migrations from Section 3.7, the workspace tabs from Section 6, the readiness engine from 250Section 7 with snapshots and cmd/proposal-readiness-snapshot, cmd/proposal-deadline-alerts and 251cmd/stale-requirement-scan, a submission workflow with SERVER SIDE hard blocker enforcement, outcome recording 252through bidoutcomes, and the slate approval lifecycle merged from consolidated amendment 2.3. 253 254I RECORDED THREE THINGS AS "PHASE 3 SCOPED WORK" TONIGHT AND NOT ONE OF THEM IS IN IT: 255 the wrap rate and burden model 256 the wage bridge, D22 257 the self extending knowledge store 258Each entry reasoned carefully about why the item did not belong in PHASE 2, which was correct, and then 259assigned it to Phase 3 as though Phase 3 were a bucket for whatever is next. I never opened the directive to 260check. THAT IS THE EXACT DRIFT THIS PROTOCOL EXISTS TO PREVENT, and I spent the night enforcing it on 261everything else while doing it myself three times in the ledger. 262 263WHAT IS ACTUALLY TRUE ABOUT THOSE THREE ITEMS: they are real, they are recorded with measurements, and they 264have no phase. Saying they have no phase is more useful than assigning them one, because an unphased item is 265visible while a misfiled one is not. 266 267THE ONE THING THAT WAS CORRECTLY ASSIGNED: the office format reader holds Phase 3's single IMPROVEMENT slot, 268which is the licensed channel for one unscoped item per phase, and that is what an improvement slot is for. 269The other three are not improvements, they are scope, and scope needs a recorded amendment rather than a slot. 270 271WHAT NEEDS JOSEPH'S DECISION, stated as a choice rather than a recommendation dressed as a finding: 272 A. Run Phase 3 as the directive defines it. The three items wait, unphased and visible. 273 B. Amend Phase 3 to include the wrap rate, on the argument that proposal operations without pricing is half a 274 proposal. That is a defensible reading and it is an AMENDMENT, recorded as one, not an assumption. 275 C. Insert a phase before Phase 3 for the money and knowledge substrate. 276I recommend A or B and I lean B only if he wants proposal pricing in this phase, because Gate 3 as written does 277not test pricing at all and a phase whose gate cannot see half its scope is a phase that closes on partial 278evidence. | this commit | 2026-07-30 279 280RECORDED DECISION, THE PRODUCTION RAIL IS AMENDED, 30 July 2026. Joseph: "push it into production. do not 281build something outside production again it doubles the work." 282 283WHAT CHANGED. The standing rail read "production scope closed outside recorded approvals", and the phase 284protocol built and proved everything in staging while production stayed deliberately untouched. That is now 285amended: BUILD IN PRODUCTION. The doubling he is describing is real and I should have named it first. Phase 2 286was built and gated entirely against staging, then had to be deployed and re verified in production afterwards, 287which meant every artifact was staged twice, every credential path exercised twice, and the Gate C fixture 288accounts existed only on one side. Tonight's deploy also proved the two environments are NOT equivalent: the 289staging role parity defect in migration 0085 existed precisely because staging has its own roles that no 290migration names. 291 292WHAT DOES NOT CHANGE, and this is not hedging, it is the part that makes the amendment safe: 293 ROLLBACK BEFORE THE FIRST CHANGE. A copy of every artifact, and a database dump on disk, before anything is 294 touched. Tonight that path was used twice and it worked twice. 295 AN ARTIFACT IS HASH VERIFIED AFTER TRANSIT AND BEFORE A SERVICE START. Tonight a binary was corrupted in 296 transit and segfaulted production's second node. The assertion now refuses a mismatch outright, because care 297 is not a control and a hash is. 298 HEALTH IS CHECKED AND THE CHECK IS CHECKED. A bad health URL caused a false rollback tonight. A rollback 299 fired by a broken check is cheap; a deploy passed by a broken check is not. 300 CONTROLS STILL RUN FIRST. The post deploy verification asserts that routes which SHOULD answer do answer, 301 before concluding anything from a route that does not. 302 THE ENGINE STAYS FROZEN, RLS STAYS FORCED, PROVENANCE STAYS BORN AT ORIGIN, AND MIGRATIONS REMAIN THE ONLY 303 WAY TO CHANGE SCHEMA. Building in production changes WHERE work is proven, not what is permitted. 304 305THE HONEST COST OF THE AMENDMENT, stated once so it is not rediscovered as a surprise. Building in production 306means a defect's first audience can be a customer rather than a gate. The phase protocol's staging first order 307existed to buy exactly that separation, and giving it up trades a slower build for a faster one with a shorter 308blast radius between a mistake and a user. Joseph owns that trade and has made it. The mitigation is the list 309above, and the one thing I will keep insisting on is that a production change still carries its rollback and 310its controls, because those are what make a fast deploy survivable rather than merely fast. | this commit | 2026-07-30 311 312## PER ORGANIZATION SETTINGS, SEALED SECRETS, FIELD SENSITIVITY AND WORK VISIBILITY, 30 July 2026 313 314Migration 0087 is live in ALL THREE databases at v87, verified per database rather than summarized: control 315plane 100.77.114.40:5433, tenant 100.94.8.94:5432, staging missionmatch_staging. Four new tables each with 316FORCE ROW LEVEL SECURITY, four policies, and ZERO policies naming a role, which is the 0085 and 0086 lesson 317held. Backfill covered every organization: 1 of 1 on each production database, 4855 of 4855 on staging. 318Staging app grants mirrored 13 of 13 against the production app role, and the positive control confirmed the 319staging app role still has NO CONNECT to the production database. 320 321WHAT IT ANSWERS. Three asks landed on one missing thing, a place where a tenant states how it works and a 322place where it stores a password. Invites had to be hand delivered, recruiters were double working the same 323candidate, and rates were visible to everyone. 324 325DECISIONS RECORDED. 326- Secrets are AES 256 GCM under MM_ORG_SECRET_KEK with a key_version, MIRRORING the mfa_totp pattern from 327 migration 0009 rather than inventing a second meaning for encrypted at rest. A SEPARATE key from the TOTP 328 KEK, because one key covering both populations means one disclosure covers both. 329- BOTH PRODUCTION NODES HOLD THE IDENTICAL KEY, proven by comparing hashes of the value, never the value. A 330 secret sealed on one node must open on the other. STAGING HOLDS A DIFFERENT KEY, proven to differ, so a 331 staging disclosure is not a production disclosure. 332- Mail sends through the CUSTOMER'S OWN server from the CUSTOMER'S OWN address, so an invitation passes their 333 SPF and DKIM and does not arrive from a domain their staff was trained to distrust. 334- WHEN DELIVERY SUCCEEDS THE TOKEN IS WITHHELD from the response. It has reached the intended person; a 335 second copy in an administrator's browser is a live credential with no purpose. 336- IT DEGRADES TO THE PILOT BEHAVIOUR ALWAYS. No mail configured, or a mail server that refuses, returns the 337 one time link exactly as before. A mail outage never costs an account creation. 338- There is NO CLEARTEXT MAIL OPTION at any port. What this transport carries is an activation credential and 339 a person's name. 340- The test endpoint sends ONLY to the administrator's own address. One that accepted a recipient would be an 341 open relay wearing a settings screen. 342- Settings MAY NOT WEAKEN A COMPLIANCE GUARANTEE, which is why the table is typed columns and not a key value 343 bag. Human approval of every slate member, adverse impact reporting, the audit trail and the fixed NIST 344 session timeouts are NOT settings and must never be added here. 345- Defaults are the INDUSTRY ones: rates at managers, margin at owner, contacts at team, work visibility at 346 organization so the double work control ships ON. 347 348THE SERVER SIDE REQUEST FORGERY BOUND, because a customer supplying a mail host is asking this server to 349connect somewhere. The destination is resolved and checked and then the CHECKED ADDRESS is dialled, not the 350name, which closes the rebinding window. Loopback, private ranges, link local, the cloud metadata address, 351carrier grade NAT where this operator's own machines live, and IPv6 unique local are all refused. Proven live 352against 127.0.0.1, 169.254.169.254 and 100.94.8.94, each refused with 502. 353 354ONE REAL DEFECT FOUND AND FIXED BY THE WALKTHROUGH. Save was a single INSERT ... ON CONFLICT DO UPDATE. An 355organization with no settings row took the INSERT branch, where the SET clause does not apply, so the FIRST 356save an owner ever performed returned 200 and changed nothing. provision_org creates no settings row, so 357EVERY newly provisioned customer hit it. MarkVerified and MarkAttemptFailed had the same class of bug, a 358plain UPDATE against a missing row affecting zero rows and reporting success. Fixed with an ensureRow that 359every writer calls. A structural regression test pins it and was PROVEN TO FAIL against the broken shape 360before it was allowed to pass. 361 362VERIFIED: 50 of 50 walkthrough assertions against staging, including the controls that matter. The stored 363password never appears in any response, the scrubbed transport error carries no credential, a recruiter 364cannot read the settings surface at all, a recruiter cannot widen their own access, and narrowing 365work_visibility to private changes the recruiter's answer while leaving the owner's intact. 57 Go packages 366pass, vet clean. 367 368DEPLOYED: both production nodes run the IDENTICAL binary sha 93e07b85f224a0c9, both report organization 369secret storage ENABLED key version 1, both health 200, public site 200, staging 200. 370 371NOT DONE YET, named so it does not read as finished. work_claims and work_touches EXIST IN THE SCHEMA with 372their indexes and policies, and nothing writes to them yet: the claim and presence ROUTES are the next piece, 373and the visibility rules that will govern them are already live and tested. The frontend settings screen is 374also not built; every route above is proven at the API only. 375 376## WHO IS WORKING WHAT, the double work control, 30 July 2026 377 378The tables went in with migration 0087 and nothing wrote to them. That is now closed. internal/modules/collab 379serves five routes: read the activity on a record, record a visit, claim, release, and the caller's own list. 380 381WHY ITS OWN MODULE. The question is identical for a candidate, a requisition, an opportunity, a proposal and 382a client. Putting it in recruiting would have made the missionmatch module import a sibling to ask about a 383candidate; a copy per module would have produced five answers that drift. 384 385IT IS NOT A SECOND OWNERSHIP SYSTEM. clients and requisitions keep owner_user_id from migration 0047 as the 386authority on whose desk a record belongs to. A claim is a shorter lived and different fact: not "this account 387is mine" but "I am on this right now, do not also call them today". The read returns BOTH. CANDIDATES had 388neither, and a candidate phoned twice in one day by the same agency is the complaint this closes. 389 390DECISIONS RECORDED. 391- A CLAIM IS NOT A LOCK. A second person gets 409 with the alternative named, and taking a record over is an 392 EXPLICIT flag that writes its own audit row, so "Marcus took this from Dana" is findable later. 393- CLAIMING AGAIN EXTENDS rather than conflicting, because a recruiter pressing claim twice means "I am still 394 on this", which is what the expiry needs to hear. 395- EXPIRED CLAIMS ARE RELEASED BEFORE A NEW ONE IS TRIED. The partial unique index covers every unreleased 396 claim, so without this an abandoned claim would own a candidate forever. 397- PRESENCE IS UPSERTED, NEVER APPENDED. One row per person per record. Appending would generate a row per 398 page view per recruiter per candidate and put a browsing history of a named employee in a trivially 399 reportable table. This is presence, not surveillance. Presence is also NOT RECORDED when the organization 400 switches it off, rather than recorded and hidden. 401- PRIVATE HIDES COLLEAGUES, NEVER YOURSELF, NEVER FROM MANAGEMENT. A caller who may not see others still sees 402 their OWN claim, because hiding it causes the very double work this prevents. Managers see the team at 403 every level, since a manager who cannot see the collision is the one person who could fix it. 404- visible_to_you IS RETURNED EXPLICITLY. A filtered answer must never read as "nobody is on this". 405- NO NEW CAPABILITY. Reads sit at candidate.read so a viewer sees the collision; writes at candidate.write. 406 The frozen matrix already said this correctly and did not need widening. 407- The entity type is a CLOSED MAP to table names because the table name reaches SQL. An unknown type is a 404 408 before any query is built, and a test asserts every value is a bare lowercase identifier. 409 410VERIFIED: 45 of 45 walkthrough assertions against staging with THREE real people on one real candidate, plus 4118 module tests including a structural one that pins the visibility rule to exactly one call site. 58 Go 412packages green, vet clean. Deployed to both production nodes, identical binary sha acf1f910eb9221f5, health 413200 on each, site 200. 414 415WORTH RECORDING: the first walkthrough run reported nineteen failures and every one was MY HARNESS, not the 416product. The auth limiter is New(1, 10), burst ten refilling one per second, and creating three people in a 417row makes about twelve auth calls, so the third person got 429 and I first misread it as a broken session. 418The limiter was right. The harness now backs off instead, and the limiter was NOT weakened to make a test 419pass. 420 421STILL NOT BUILT: the frontend. Every route here is proven at the API only, so a recruiter cannot yet see any 422of this. 423 424## RECORD SCOPE AND TEAMS, the third access axis, 30 July 2026 425 426Migration 0088 live in ALL THREE databases at v88, verified per database. teams and team_members with FORCE 427ROW LEVEL SECURITY and zero role scoped policies, candidates.owner_user_id, three scope settings, and 428mm_team_peer_ids. 429 430WHY. A recruiting platform's access model has three axes and this had one and a half. WHAT ACTIONS may I take 431was the capability matrix, already correct. WHICH FIELDS may I see was field sensitivity, migration 0087. 432WHICH RECORDS may I see at all did not exist, and it is the axis Bullhorn, Greenhouse, Lever and Salesforce 433all have. Two things blocked it: there was no notion of a TEAM, so "my team's records" could not be 434expressed, and CANDIDATES HAD NO OWNER, so the most important record type in the product could not be scoped. 435 436DECISIONS RECORDED. 437- THE DEFAULT IS ORGANIZATION, WHICH IS EXACTLY TODAY'S BEHAVIOUR, and a test asserts every role still sees 438 everything under the shipped settings. A migration that narrowed somebody's view on the morning it shipped 439 would be an incident, not a feature. 440- THE UNRESTRICTED QUERY PATH IS LITERALLY UNCHANGED. ListCandidatesScoped is a SEPARATE sqlc query, so an 441 organization that has not narrowed runs the same statement it always ran and cannot have been broken. 442- OWNER AND ADMIN ARE ALWAYS ORGANIZATION WIDE AND IT IS NOT CONFIGURABLE. A product that lets an 443 administrator lock themselves out of their own data generates a support call it cannot resolve. 444- A MANAGER MAY NOT BE NARROWED TO OWN, refused with 422: a manager who cannot see their team cannot run a 445 desk. Manager scope chooses between the team and the floor, nothing narrower. 446- AN UNKNOWN OR CORRUPT SETTING NARROWS TO own, never widens. The failure mode is somebody seeing too little 447 and saying so, not everybody seeing everything and nobody noticing. 448- A PERSON MAY BE ON SEVERAL TEAMS. Agencies run people across desks; one team per person makes the common 449 case a lie. Team scope is the union of every team the caller belongs to, and the peer resolver INCLUDES the 450 caller so somebody on no team still sees their own work. 451- TEAM LEAD IS A LABEL, NOT AN AUTHORITY. Making somebody a lead does not promote them, which is what stops 452 an org chart feature becoming a privilege escalation path. 453- UNOWNED RECORDS ARE VISIBLE BY DEFAULT. An unowned candidate nobody can see is a candidate nobody will 454 ever work. Releasing a candidate back to the pool is a supported action, not an error, so a departing 455 recruiter's bench stays workable. 456- READING the desks is candidate.read, since an org chart is not privileged. WRITING membership is 457 org.settings.write, because under a narrowed scope adding somebody to a team IS an access grant, and it is 458 audited as one. 459 460VERIFIED: 41 of 41 walkthrough assertions against staging with an owner, a manager and TWO recruiters on 461different desks over four candidates, proving narrowing hides, teams reveal, removal from a desk takes the 462access with it, and no one can lock the account holder out. 58 Go packages green, vet clean. Both production 463nodes on identical binary sha 2580f555149f9ff0, health 200 each, site 200. 464 465THREE DEFECTS FOUND BY THE WALKTHROUGH, all mine, all fixed. 4661. THE SAME SILENT NO OP AS LAST TIME. The three scope fields were added to the store, to validation and to 467 the SQL, and NOT to the handler's request struct, so the API accepted them, returned 200 and changed 468 nothing. A reflection test now compares the two structs field by field in BOTH directions and was proven 469 to fail against the broken shape. This class of bug has now happened twice; it cannot happen a third time. 4702. A NULL SCANNED INTO A Go bool. A team with no lead makes "lead_user_id = user_id" NULL, so every READ of 471 the teams surface was a 500 while every write worked perfectly. That asymmetry is why it survived until 472 somebody tried to look at the desks. 4733. An untyped nil in an interface passed as a uuid parameter, which pgx cannot infer a type for. 474 475STILL NOT BUILT: the frontend, and scope enforcement currently covers the CANDIDATE list, which is the record 476type that had no owner and therefore the one that needed it. Requisitions, clients and opportunities already 477carry owner columns and are NOT yet scoped; that is the honest boundary of this pass. 478 479## THE TWO GAPS THAT MADE THE PRODUCT UNUSABLE, closed 30 July 2026 480 481Research against the established products in this market, Bullhorn, Greenhouse, Lever, Ceipal, plus the 482Salesforce patterns they all borrow, measured against a verified route inventory of 88 mounted routes. The 483spine was strong: clients through requisitions through applications through offers through placements, with 484activity logging, a task queue, six alert kinds including clearance_expiring, dispositions, reports and an 485audit trail. TWO holes made it unusable in practice, and both change what a screen must show, which is why 486they were closed BEFORE the frontend rather than retrofitted after it. 487 488Migration 0089 live in all three databases at v89, verified per database: candidate_documents, 489message_templates and messages, each with FORCE ROW LEVEL SECURITY, zero role scoped policies, and NO DELETE 490grant to the app role, confirmed by querying grantee rather than trusting a count. 491 4921. A RESUME COULD NOT BE ATTACHED TO A CANDIDATE. opportunity_documents existed; nothing equivalent existed 493 for the record type the whole product is about. Now: upload, list, download and supersede, sharing the 494 SAME object store as opportunity documents so there is one place to back up rather than two. 4952. NOTHING COULD BE SENT TO A CANDIDATE. The only two send calls in the codebase were the account invite and 496 the settings test message. Now: templates with server side placeholders, a preview, and sending through 497 the organization's OWN mail server from migration 0087. 498 499DECISIONS RECORDED. 500- THERE IS NO DELETE ON A DOCUMENT. It is SUPERSEDED, so what was sent to a client six months ago stays 501 recoverable. The duplicate index is PARTIAL on is_current, so the same bytes can be re uploaded once a 502 document has been superseded, which is what a recruiter actually does. 503- THE MEDIA TYPE IS DECIDED BY THE SERVER from a closed allowlist, and the EXTENSION beats the declared type 504 because a browser's guess is caller supplied and frequently wrong. Downloads are served with 505 Content-Disposition attachment, nosniff, a sandbox policy and private caching, so a file that slipped 506 through could still not execute in the origin. 507- THE INTEGRITY STAMP IS CHECKED ON THE WAY OUT. If stored bytes no longer hash to what was recorded, the 508 download fails rather than handing somebody a file the audit trail does not describe. 509- A MESSAGE ROW IS WRITTEN BEFORE THE SEND, not after. A send that succeeds while the database is briefly 510 unavailable would otherwise leave a candidate holding a message the agency has no record of. 511- EVERY SEND ALSO WRITES A recruiter_activities ROW with auto_captured true, so outreach appears in the same 512 history as calls and meetings. The subject is folded into the body because that table has no subject 513 column, and inventing one to suit messaging would change a table five other surfaces read. 514- PLACEHOLDERS ARE VALIDATED AT AUTHORING TIME and refused if unfillable, because a candidate receiving a 515 visible curly brace reads it as a broken mail merge. 516- A PLACEHOLDER NEVER RENDERS EMPTY. first_name falls back to the full name and then to a neutral word, 517 because "Hi ," is worse than no personalisation. 518- SENDING IS candidate.write and reading correspondence is candidate.read. Template authoring is 519 org.settings.write, because a template goes out under the organization's name to people who are not its 520 employees. 521 522VERIFIED: 38 of 38 walkthrough assertions against staging, including the controls: an HTML upload and an 523executable both refused with 415, an empty file 422, an identical re upload 409, the attachment and nosniff 524headers present, and a send refused with a 409 that names the screen that fixes it rather than a 500. 58 Go 525packages green, vet clean. Both production nodes on identical binary sha f31cff48b3a78faa. 526 527TWO DEFECTS THE WALKTHROUGH FOUND, both mine. 5281. PREVIEW REFUSED WHEN A RECORD HAD NO EMAIL ADDRESS. Previewing text is useful whether or not an address 529 exists, and refusing sends a recruiter hunting a bug that is not there. Preview now renders and returns 530 sendable false with the reason; only the SEND path insists on an address. 5312. A CANDIDATE CREATED THROUGH THE API COULD NEVER HAVE AN EMAIL ADDRESS. The candidates table has carried 532 email and headline since migration 0002 and the insert always wrote them, but createCandidateRequest 533 never exposed either. So the outbound correspondence just built would have been unusable for every 534 candidate created through the API. Found only by testing a send against a real record. 535 536DELIBERATELY NOT BUILT, recorded so it does not get picked up by accident: timesheets, invoicing and VMS, 537which are a second product and which the client's enterprise customers already impose; and autonomous AI 538sourcing and screening, which would damage the Automated Employment Decision Tool story that is this 539product's actual differentiator. 540 541STILL MISSING, in the order the research ranked them: saved searches and hotlists, bulk actions, an inbound 542apply path and job board posting, email and calendar sync so activity logs itself, interview scheduling, and 543duplicate merge. Then the frontend. 544 545## SEARCH, SAVED SEARCHES, LISTS AND BULK ACTIONS, 30 July 2026 546 547Migration 0090 live in all three databases at v90, verified per database: saved_searches, candidate_lists, 548candidate_list_members, forced RLS, zero role scoped policies, plus two structured indexes search needed. 549 550THE GAP WAS WORSE THAN THE RESEARCH SAID. There were no saved searches, and there was no SEARCH: the 551candidates route took a limit and an offset and nothing else, so "TS/SCI cleared network engineers in 552Maryland who are available" was not a question this product could be asked. The GIN index over search_tsv and 553the HNSW index over resume_embedding have existed since migration 0002 with nothing mounted on them. 554 555DECISIONS RECORDED. 556- A SAVED SEARCH IS A QUESTION, A LIST IS AN ANSWER. Two tables, not one with a flag. A saved search re runs 557 and its result moves with the bench; a list is what somebody committed to and must not move underneath 558 them, because an agency that shortlists nine people for a bid needs those nine next week. 559- EVERY USER VALUE IS A BOUND PARAMETER. Only column names and operators from closed sets are interpolated. 560 Proven with an injection string, a bare wildcard, and punctuation, all of which return 200. 561- websearch_to_tsquery, not plainto_ or to_tsquery, so a recruiter typing O'Brien or an ampersand gets 562 results rather than a syntax error. 563- SEARCH RESPECTS RECORD SCOPE through the SAME orgsettings.Filter every list uses. Without it a recruiter 564 narrowed to their own records could simply search for everybody else's, which would be a hole straight 565 through migration 0088. Proven: a scoped recruiter gets 0 and cannot widen it by naming an owner. 566- scope_applied IS RETURNED, so a short answer is explained rather than mistaken for an empty bench. 567- BULK IS ONE TRANSACTION and reports per record outcomes. Already on the list is a SKIP, not an error, 568 because somebody selecting forty people does not know which nine are already there. One malformed 569 identifier refuses the WHOLE batch, because a bulk action that quietly did thirty nine of forty is the kind 570 of thing nobody notices until the fortieth person never gets called. 571- NO DELETE ON A LIST, it is archived, because "who did we shortlist in March" is a June question and because 572 a do_not_contact list that can be deleted is a compliance record that can be deleted. Membership CAN be 573 deleted, since removing somebody from a shortlist is a correction. 574- A PRIVATE SAVED SEARCH IS INVISIBLE TO EVERYONE ELSE INCLUDING THE OWNER OF THE ACCOUNT, and deleting one 575 you do not own returns 404 rather than 403, so private search names cannot be enumerated. 576 577THE DEFECT THIS FOUND, and it predates all of this work. 578CLEARANCE WAS STORED AS A CODE AND COMPARED AS A LABEL. The persisted value is ts_sci; the interface shows 579TS/SCI. codes.go says so explicitly and calls persisting the label rather than the code "a real bug class". 580Two halves were both wrong: validLevelCode accepted ONLY an exact code and silently degraded anything else to 581"unknown", so a candidate saved through the API with the label the interface displays LOST THEIR CLEARANCE, 582with no error; and the new search compared raw input against the column, so a recruiter typing what they see 583got an empty bench. Neither raised anything. Storing and searching now SHARE one translation, so the two 584vocabularies cannot drift, and a test locks every label and code spelling to its stored value. 585 586VERIFIED: 47 of 47 walkthrough assertions against staging over a five person bench with two lists and a 587second signed in recruiter. 58 Go packages green, vet clean. Both production nodes on identical binary sha 588b840acabd61a4222, health 200 each, site 200. 589 590STILL MISSING, in the order the research ranked them: an inbound apply path and job board posting, email and 591calendar sync so activity logs itself, interview scheduling, and duplicate merge. Then the frontend. 592 593## THE INBOUND PATH, a public careers page and an apply route, 30 July 2026 594 595Migrations 0091, 0092 and 0093 live in all three databases at v93, verified per database. job_postings and 596job_applications with forced RLS, zero role scoped policies and no app DELETE, plus three SECURITY DEFINER 597functions with EXECUTE revoked from PUBLIC. 598 599Until now every candidate had to be imported or typed in by a recruiter, so the product could only hold 600people somebody had already found. This is the difference between a database and a pipeline. 601 602DECISIONS RECORDED. 603- THE PUBLIC URL CARRIES THE EMPLOYER SLUG. A public request has no session, so no organization, so RLS 604 denies it everything, and something must name the tenant first. A bare token would need a global token to 605 tenant map that works across sharded databases; the slug is already the directory key and is information 606 the applicant should see anyway, because they are applying to Acme and not to an opaque string. 607- THE PUBLIC COPY IS ITS OWN TEXT, NOT A JOIN TO THE REQUISITION. A requisition carries bill rate, pay rate, 608 the client name and the internal description, and rendering a public page from it would put the agency's 609 margin and its customer's identity on the open internet with a silent failure mode. Publishing is therefore 610 an act of WRITING, and a field that is not on the posting row cannot leak. The walkthrough asserts this 611 directly against a requisition seeded with a rate and a confidential client name. 612- A SUBMISSION IS NOT A CANDIDATE. Under the OFCCP Internet Applicant rule an applicant is somebody who 613 expressed interest AND whom the contractor then CONSIDERED, and a federal contractor must show both. 614 Submissions land in job_applications; converting one is a separate recorded act by a named human. It also 615 means spam never reaches the bench. 616- THE SELF REPORTED CLEARANCE IS NOT CARRIED ACROSS on conversion. Writing it into the candidate's clearance 617 field would turn an unverified claim into a scored attribute. A recruiter sets it after checking. 618- CONSENT IS REQUIRED AND RECORDED AS TEXT PLUS A TIMESTAMP, not a bare boolean, because "they ticked a box" 619 is not a defensible answer and the wording changes over time. 620- ONE ANSWER, 404, for a missing employer, a missing posting, a draft and a closed one, so the public surface 621 cannot be used to map which customers exist or which roles they are quietly working. 622- NO CSRF ON THE PUBLIC ROUTES, deliberately and correctly: CSRF protects a request carrying ambient 623 authority and these carry none. They have their OWN rate limiter, two a second with a burst of twenty, 624 sized for strangers rather than for a signed in floor. 625- NO DELETE on either table. An applicant flow log with holes in it is not an applicant flow log; spam is 626 marked spam. 627 628VERIFIED: 35 of 35 walkthrough assertions against staging, with the public half tested using NO COOKIE JAR AT 629ALL so a pass proves a genuine stranger can reach it. 59 Go packages green, vet clean. Both production nodes 630on identical binary sha 322b606e56b175c9. 631 632THREE DEFECTS, all found by the walkthrough, all mine. 6331. THE STAGING PARITY HELPER MIRRORED TABLES AND COLUMNS AND NOT FUNCTIONS. Migration 0085's lesson in a new 634 place: every SECURITY DEFINER function ever granted to missionmatch_app was unreachable from 635 missionmatch_staging_app. It failed expensively, as the careers page reporting a genuinely published 636 posting as unavailable, so the symptom pointed at the data and not at a permission. Migration 0092 fixes 637 the HELPER rather than the one function, identifying functions by full argument signature because a name 638 alone is ambiguous under overloading. 6392. THE PRE TENANT RESOLVE WAS A PLAIN QUERY against organizations, which carries FORCE ROW LEVEL SECURITY. 640 The app role is NOBYPASSRLS and a public request has no app.current_org_id, so it correctly returned zero 641 rows. The tenancy contract was working exactly as designed and the feature was wrong. Migration 0093 adds 642 a narrow SECURITY DEFINER resolve that returns an identifier and nothing else. 6433. MIGRATION 0093 SHIPPED WITHOUT goose StatementBegin MARKERS, so goose split the dollar quoted function 644 body on its internal semicolons and the migration failed. It failed SAFELY, transactional, version 645 unchanged. Every other migration defining a function was then checked and all carry the markers. 646 647STILL MISSING, in the order the research ranked them: email and calendar sync so activity logs itself, 648interview scheduling, and duplicate merge. Then the frontend. External job board DISTRIBUTION, posting out to 649ClearanceJobs or Indeed, is an integration per board and is NOT built; what exists is the careers page and 650the apply route those boards would point at. 651 652## MAIL SYNC, so a recruiter's correspondence logs itself, 30 July 2026 653 654Migration 0094 live in all three databases at v94, verified per database: mail_accounts and synced_messages, 655forced RLS, zero role scoped policies. 656 657recruiter_activities has had the right vocabulary since migration 0049 and every row in it had to be TYPED BY 658A HUMAN, which is the most reliable way to end up with an activity log nobody trusts: the people best at 659recruiting are the least likely to stop and write down that they sent an email. 660 661DECISIONS RECORDED. 662- HEADERS ONLY, NEVER BODIES, and it is a property of the code rather than a convention. internal/platform/ 663 imapclient asks for a fixed header field list and has NO PARAMETER through which a body could be requested. 664 Pulling bodies would drag a recruiter's whole mailbox, including correspondence with their doctor and their 665 lawyer, into a platform holding controlled unclassified information under an employment record retention 666 rule. The value of the body is small and the liability is enormous. 667- A MESSAGE MATCHING NOBODY IS NOT STORED AT ALL. Every message is compared against the tenant's candidates 668 and contacts by address and dropped if it matches none. Connecting a mailbox is not handing over a mailbox, 669 and the sync result reports the discarded count so that promise is visible rather than asserted. 670- WRITTEN IN HOUSE RATHER THAN TAKEN FROM A LIBRARY, following the recorded TOTP precedent: every primitive 671 stays provably inside the FIPS validated module and there is no external crypto to re verify. It is a 672 narrow IMAP4rev1 subset and must not grow into a general client. 673- EXAMINE AND BODY.PEEK, so syncing never marks a recruiter's mail read. A sync that silently changed what 674 their mail client showed them would be noticed once and switched off forever. 675- IMPLICIT TLS ONLY, no STARTTLS negotiation, because a negotiated upgrade is one more thing that can 676 silently not happen. 677- THE SAME REACHABILITY BOUNDARY as the mail sender, resolved then dialled by ADDRESS so DNS rebinding cannot 678 slip past. Proven live against 127.0.0.1, 169.254.169.254, 100.94.8.94 and 10.0.0.5. 679- PER USER, and every route acts on the CALLER with no user parameter. An endpoint that let one person 680 configure another's mailbox would be a way to point somebody else's credentials at a server you control. 681- The dedup ledger is deleted on disconnect, so a recruiter who reconnects re syncs cleanly instead of being 682 permanently blocked by a ledger they cannot clear. Activities already logged are untouched. 683 684VERIFIED: 24 of 24 walkthrough assertions against staging, plus 9 parser unit tests including a totality test 685that throws hostile and malformed headers at every parsing function. 60 Go packages green, vet clean. Both 686production nodes on identical binary sha d30e1e05814593c2. 687 688HONEST BOUNDARY, stated plainly: THE END TO END SYNC AGAINST A LIVE IMAP SERVER IS NOT TESTED. There is no 689real mailbox to connect to here. What is proven is the configuration surface, the credential never being 690returned, the reachability guard, an unverified mailbox being unable to switch on, a sync refusing to run 691against one, and the header parsing and address matching in unit tests. The first real mailbox will be the 692first real test, and it should be a test account rather than a live recruiter's. 693 694TWO DEFECTS THE WALKTHROUGH FOUND, both mine. 6951. EVERY VALIDATION ERROR REPORTED ITSELF AS A BAD GATEWAY. Configuration mistakes and transport failures 696 shared a message prefix and the handler could only pattern match on it, so a missing host returned 502. 697 Fixed with a sentinel error rather than a better pattern. 6982. THE FAILURE RECORD WAS ROLLED BACK BY THE ERROR THAT CAUSED IT. TestMailbox wrote last_error inside the 699 transaction and then returned the error from inside the same closure, which rolls the transaction back and 700 takes the row with it. A user saw a 502 and then found last_error empty, the least helpful possible 701 combination. The auth module carries the same note about an audit row for exactly this reason, which is 702 the second time this pattern has bitten this codebase. 703 704STILL MISSING: interview scheduling, duplicate merge. Then the frontend. Calendar sync is NOT built; CalDAV 705is the vendor neutral equivalent and is a separate piece. 706 707## INTERVIEW SCHEDULING, 30 July 2026 708 709Migration 0095 live in all three databases at v95: interview_offers and interview_offer_slots with forced 710RLS, zero role scoped policies, and a public SECURITY DEFINER read with EXECUTE revoked from PUBLIC. 711 712interviews has existed since migration 0048 and it RECORDS an interview. It had no way to ARRANGE one, which 713is the part that costs a recruiter an afternoon, being four emails and a phone call per candidate. 714 715DECISIONS RECORDED. 716- THE CALENDAR INVITE IS AN iCALENDAR ATTACHMENT, NOT A CALENDAR INTEGRATION. Integrating Google Calendar and 717 Microsoft Graph means two vendor OAuth applications, two consent screens, two credential sets and a 718 permanent dependency on two APIs, which cuts against the both clouds no lock in mandate and does nothing 719 for a candidate whose calendar is neither. An iCalendar REQUEST attachment is the interoperable standard 720 all of them already accept, needs no credentials, and is a few hundred lines with no dependency. 721- multipart/ALTERNATIVE, not mixed. Mixed produces a message with a file attached that a calendar ignores; 722 alternative with method=REQUEST is what makes the accept and decline buttons appear. 723- AN OFFER IS NOT AN INTERVIEW. Offering three times creates an offer with three slots; the interviews row 724 appears only when somebody picks one. Creating it up front would leave a pipeline full of interviews that 725 never happened, which is exactly the number a hiring manager asks about. 726- THE SLOT IS TAKEN UNDER A CONDITIONAL UPDATE, not a read then write. Two candidates cannot race, but one 727 candidate double clicking absolutely can, and a check followed by an update would create two interviews. 728 Proven: the second click is refused and the count stays at one. 729- THE INVITATION IS SENT AFTER THE TRANSACTION COMMITS, and a mail failure does NOT fail the booking. The 730 time is taken and the interview exists; a missing calendar entry is something a recruiter fixes by hand. 731- Times are ALWAYS UTC with the trailing Z and every value is escaped and every line folded. An unescaped 732 comma silently truncates a location in the recipient's calendar; an unfolded line over 75 octets is 733 rejected by some clients and mangled by others. An invite that arrives corrupted is worse than none, 734 because the recruiter believes it was sent. 735 736VERIFIED: 26 of 26 walkthrough assertions against staging with the public half using no cookie jar, plus 8 737iCalendar unit tests covering escaping, folding, multi byte safety, UTC conversion and cancellation. 61 Go 738packages green, vet clean. Both production nodes on identical binary sha f611d2f915ccca36. 739 740TWO DEFECTS, one mine and one that predates this work. 7411. MINE: a parameter was used both as a timestamp column and as the left side of an addition in the same 742 INSERT, so Postgres deduced two types for it and refused the statement with SQLSTATE 42P08. The handler 743 turned that into a generic 500 with no cause in the log, which cost a round of guessing; the handler now 744 LOGS the cause while still returning a generic message. The arithmetic moved into Go. 7452. PRE EXISTING: THERE WAS NO WAY TO LIST INTERVIEWS. They could be created and updated and never read back, 746 so the only way to see what was scheduled was to query the database. Found because the walkthrough tried 747 to confirm that booking produced exactly one interview. GET on an application's interviews now exists. 748 749STILL MISSING: duplicate merge. Then the frontend. Calendar SYNC, reading a recruiter's existing calendar, 750is not built and is a separate piece from sending an invitation. 751 752## CANDIDATE MERGE, and the carried issues, 30 July 2026 753 754Migration 0096 live in all three databases at v96: candidates.merged_into_id, candidate_merges, and 755mm_candidate_referencing_tables. 756 757A bench gets dirty. The same person applies through the careers page, arrives in an ATS export, and is 758sourced by a recruiter, and now there are three of them with a third of the history each. Dedup existed at 759IMPORT time only; nothing existed for the duplicates that arrive afterwards, which is most of them. 760 761DECISIONS RECORDED. 762- THE TABLES ARE READ FROM THE CATALOG, not a list in Go. It found EIGHTEEN referencing tables where a hand 763 count of the migrations found fifteen, which is the argument in one number: a list would already have been 764 wrong, and the failure is silent, a merge reporting success while history stays on a tombstone. 765- A SAVEPOINT PER TABLE. Repointing collides whenever both records already had the same thing, which for two 766 rows of one person is the common case, and without it the first collision aborts the merge that exists to 767 fix exactly those duplicates. 768- THE LOSER IS A TOMBSTONE, NEVER A DELETE. A scoring decision made in March about that record has to be 769 reconstructable in June, and deleting it destroys the subject of the decision. 770- FIELDS ARE FILLED IN, NEVER OVERWRITTEN, and clearance is not touched at all. Overwriting would let a merge 771 quietly replace a verified clearance with an unverified one. Proven: after merging a Secret record into a 772 TS/SCI one, the kept record is still TS/SCI. 773- MERGING IS org.settings.write, ABOVE ordinary candidate.write. It is not reversible by the person who did 774 it and it rewrites whose history is whose. A recruiter can SEE suggested duplicates, because that is a 775 report, and cannot act on them. 776- DETECTION ONLY SUGGESTS, and labels itself honestly: an email match is strong, a name and location match 777 is WEAK because two cleared analysts called James Smith in one metro area is an ordinary thing. 778 779THE FINDING THAT MATTERS MOST, and it is the system defending itself. aedt_candidate_notices has NO UPDATE 780grant for the application role. The first merge attempt died on it. That grant is correct: a disclosure 781notice sent to a candidate under an Automated Employment Decision Tool rule is a FACT ABOUT THAT PERSON, and 782repointing it at somebody else would falsify a compliance record to make a tidy merge. The merge now records 783those tables as RETAINED, distinct from DROPPED, and carries on; the tombstone still resolves so nothing 784becomes unreachable. candidate_merges is excluded for the same reason. 785 786VERIFIED: 21 of 21 walkthrough assertions against staging, exercising a REAL collision, both records on one 787list and a resume on the loser. 61 Go packages green, vet clean. Both production nodes on identical binary 788sha e0d98251afdf0812. 789 790THREE DEFECTS FOUND BY THE WALKTHROUGH. 7911. ADDING A COLUMN TO candidates BROKE CANDIDATE SEARCH. The search does SELECT c.* into a generated struct 792 by name, so merged_into_id with no matching field made every search a 500. sqlc had not been regenerated. 793 This is the cost of SELECT * with struct mapping and it is worth remembering: a migration that touches 794 candidates now requires a regenerate. 7952. AN ALREADY MERGED RECORD REPORTED "no such candidate". The existence check filtered on deleted_at, so a 796 tombstone looked absent. That is actively misleading: it tells somebody the record does not exist when it 797 is exactly where they left it. Now 409 with the real reason. 7983. The merge tried to repoint the merge LEDGER itself, which would rewrite the record of past merges. 799 800CARRIED ISSUES ALSO CLOSED TODAY. Session status codes now 401 rather than 403 for every "no session" case, 801with the required WWW-Authenticate header and a scheme that does not make a browser show its own login 802dialog; the authenticated but unscoped cases correctly stay 403. All 28 nginx conflicting server name 803warnings had one cause, backup files inside sites-enabled being loaded as live configuration; moved not 804deleted, zero conflicts, all affected sites verified at 200. Clearance data assessed and deliberately NOT 805changed: one record of eleven, no email and no resume, so guessing was refused. And a real security finding 806while sweeping for the pasted keys: /home/user/mmk/*.blob were 0644 in a 0755 home on a host serving sixty 807sites, and live.blob held a live Google key and a live Groq key; now 0600, services unaffected, and those two 808keys should be treated as disclosed. 809 810STILL MISSING: the frontend. Every surface built today is proven at the API only. 811 812## SESSION HANDOFF, 30 July 2026. PHASE 2 IS CLOSED. WRITTEN LAST. 813 814THIS IS THE LAST WRITE OF THIS SESSION. Nothing was done after it. 815 816PHASE 2 CLOSED under Joseph's recorded conditional pre approval: fully green with zero open findings closes it 817on his word. All five gates are green at HEAD and all four findings are closed. GATE_E.md is the account he 818reads, and it LEADS with what is wrong rather than burying it. 819 820CURRENT PHASE: PHASE 3, NOT STARTED. Exactly one phase named, and it is the next one. 821 822GATE STATES, all at HEAD, each with a control that had to fail first 823 A functional PASS. 55 packages ok 0 fail. 217 integration tests 0 fail 1 skip. 824 B stress PASS. Complete at HEAD, needed no rerun. 30 minute soak, 2,028,801 samples. 825 C visual PASS WITH ONE NAMED COVERAGE LIMIT. 88 captures 0 findings both surfaces. Pixel baselines 826 approved and proven both ways, 48 and 40 compared with 0 regressions, controls catching 48 of 827 48 and 40 of 40. THE LIMIT: 48 authenticated captures hold only 18 distinct images because both 828 fixture accounts hold one tool, so most routes render the same denial panel. 829 D drift PASS. Engine diff 0 with anchor and path asserted, controlled at 1476 lines against the wrong 830 anchor. Schema 85 across all three databases, each queried directly. Production API binary byte 831 identical to the pre build hash. 832 E human Joseph's, and the pre approval is already recorded. 833 834WHAT THE RERUNS COST AND FOUND. Gate A FAILED on its first rerun with seven failing integration tests, and the 835reruns found TEN defects. Two were production defects live for days: the embedding provider could not 836authenticate at all, so every embedding depended on another project's node proxy staying alive; and the gateway 837refused every teaching signal ever sent, which is why the teaching tables are empty, not unused but unreachable. 838 THE EARLIER GATE A PASS IS WITHDRAWN AS EVIDENCE. Three of its tests could not have passed against a correctly 839 granted database, so that verdict was taken without them or with other credentials. 840 THE PIXEL HALF OF GATE C NEVER EXISTED. Joseph's approval of the contact sheets unblocked nothing because the 841 code had never been written, and two write ups had filed the gap as awaiting his approval. Built, and proven 842 in both directions. 843 THE SUITE WAS HIDING THE EVIDENCE. Run with default environment it executed 195 tests and silently omitted 22. 844 A test gated on an optional variable does not fail, it disappears. Four of six Gate A defects were only 845 reachable once those tests ran. 846 847STATE AT STOP, measured after the last change 848 HEAD is this commit, tree clean. 55 packages ok, 0 FAIL, GOFIPS140=v1.0.0. 849 Secret sweep CLEAN, working tree and 15 of 15 out of repo scopes. 850 Zero Python, zero dashes across every tracked doc, each with a planted control. 851 Engine diff 0 at internal/modules/matching/engine against e74fd2e, 10 files each end. 852 Schema 85 on tenant, staging, and control plane. 853 PRODUCTION NOW RUNS PHASE 2. Both API nodes on 8ce5a2b8141a2ab1, frontend index-DmaEX_GX.js with self hosted 854 fonts, gateway 9e1ff5da245989cd. Phase 2 routes answer 403 and 405 where they answered 404 yesterday. The 855 teaching boundary accepts the current contract for the first time, 202, and still refuses a planted client 856 fact, 422. Document intake remains DARK by design: MM_STORAGE_ROOT is unset in production and enabling it is 857 a decision about a disk at 82 percent that also holds the backups. Rollback artifacts in place on every host. 858 See deploys/production-deploy.txt, including the three things that went wrong and the checks that caught them. 859 860WHAT CHANGED ON THE MACHINES 861 M4 the STAGING gateway binary was replaced and restarted with identical env, so /v1/teach now accepts 862 the current scoring contract and logs what it accepts. The PRODUCTION gateway on 8092 still carries 863 the old binary and therefore still refuses every teaching signal. FIXING THAT IS A PRODUCTION DEPLOY 864 AND IT IS JOSEPH'S CALL. 865 Bubbles staging frontend redeployed twice: the Admin roster fix and the self hosted fonts. Fonts now served 866 from /fonts, no request leaves for Google. mm-missionclass.timer installed and enabled nightly. 867 pixelmatch and pngjs installed in ~ for the sweep. Gate C baselines in ~/gatec-baselines. 868 megamind mm-identity-sync.sh replaced earlier in the build, backup at /root, hourly timer healthy. 869 DATABASES migration 0085 applied to all three. Its guard makes it a genuine no op outside staging and both 870 other databases logged the skip before recording the version. 871 872PHASE 3, SCOPE ALREADY RECORDED, in dependency order 873 1. The vocabulary decision, MAG and TAG, because every entry written after it inherits the names. 874 2. THE WRAP RATE AND BURDEN MODEL. Zero such columns exist, so bill rate minus pay rate is a SPREAD and the 875 product can show a number that looks like margin and is not one. 876 3. The wage bridge, D22, which is ONE item and not three: canonical SOC form, then ontology_crosswalk, then 877 skills.soc_code. promote-ontology is NOT safe to run until it is settled. 878 4. The self extending knowledge store, rows never tables, which lands before the crosswalk since the 879 crosswalk is its first customer. 880 5. The office format reader holds Phase 3's single IMPROVEMENT slot, which is spent before Phase 3 starts. 881 THE MONEY ITEMS COME BEFORE THE INTELLIGENCE ITEMS. Composition makes an answer only as good as its worst fed 882 generator, and today the profitability half cannot be answered at all. 883 884JOSEPH OWES TWO THINGS, neither blocking 885 Rotate the five API keys pasted into chat: Groq, OpenRouter, Sarvam, Cerebras, Gemini. 886 Decide on the OpenAI account, and rotating that key before funding it is the safer order. 887 888WHAT TO CARRY FORWARD. Seventeen instances are now catalogued of an instrument reporting a clean result while 889measuring something adjacent, ten of them found in this one session. The habit that finds them has not changed: 890assert the instrument CAN fail before believing that it did not, supply every variable a suite will silently 891skip on, and write the number down before changing the thing that produces it. 892 893SELF EXTENDING KNOWLEDGE STORE, DESIGN AND ONE REFUSAL, 29 July 2026. Joseph asked that the intelligence be 894able to create its own tables and graph stores, everything that goes into a database, so that the class of 895problem where it learns something and has nowhere to put it is fixed. 896 897THE PROBLEM IS REAL AND IS CORRECTLY IDENTIFIED. ontology_crosswalk is the proof: a well shaped general code 898bridge, created by migration 0021, granted SELECT, read by G3's skill gap bridge, and NEVER WRITTEN by anything. 899Tonight's scan found the same shape repeatedly. solicitation_extractions holds 2457 grounded extractions no code 900reads. teaching_signal_aggregates and curation_proposals are empty because the transport that fills them was 901refusing every signal. The intelligence keeps learning into places nothing connects. 902 903ONE REFUSAL, AND IT IS SPECIFIC RATHER THAN CAUTIOUS. RUNTIME DDL IS NOT GRANTED. Not CREATE TABLE, not CREATE 904INDEX, not ALTER, from any AI code path. Four reasons, each tied to something already load bearing here: 905 1. A TABLE CREATED AT RUNTIME HAS NO RLS POLICY. Migration 0085 exists tonight because a policy that fails to 906 name a role denies everything. A table with NO policy, made by a role holding CREATE, is the opposite 907 failure: it is readable across tenants with no fail safe at all. The tenancy contract is "no context means 908 zero rows", and a policyless table cannot honour it. 909 2. IT WOULD SIT OUTSIDE EVERY OTHER CONTRACT TOO. No FORCE ROW LEVEL SECURITY, no organization_id leading 910 composite index, no place in safety.go's read allowlist, no provenance column born with the row, and no 911 entry in the sqlc typed layer. Each of those is a rule this build already paid for. 912 3. MIGRATIONS ARE THE ONLY WAY TO CHANGE SCHEMA, and that is an ASSESSOR FACING CONTROL under the 800-171 913 posture, not a style preference. Self created schema is unauditable drift by definition. 914 4. EVERY GATE WOULD STOP MEANING ANYTHING. The schema measured at Gate D would not be the schema at runtime. 915 After a week in which six instruments were caught reporting success while measuring something adjacent, 916 handing the system the ability to change the thing the gates measure is the last thing it needs. 917 The app role is NOBYPASSRLS with column level grants for exactly these reasons. Granting it CREATE undoes a 918 deliberate design, and I am not doing it quietly on my own authority. 919 920WHAT IS BUILT INSTEAD, AND IT SOLVES THE ACTUAL PROBLEM: THE INTELLIGENCE GROWS ROWS, NEVER TABLES. 921 The schema is created ONCE by a migration and is general enough that new knowledge is DATA rather than DDL. 922 New node kinds, edge kinds, code systems, relation types and attributes all become rows. This is not a 923 workaround; it is what ontology_crosswalk already is, and its columns say so: from_system, from_code, 924 to_system, to_code, relation, source_name, synced_at. A general bridge between code spaces, written once, 925 extensible forever without touching schema. 926 THE STORE'S REQUIRED PROPERTIES, all inherited from rules this build already enforces: 927 RLS forced, organization_id leading, so a learned fact is a TENANT fact unless it is explicitly global. 928 PROVENANCE BORN AT ORIGIN, the migration 0081 pattern, so a row carries where it came from immutably and 929 the egress gate can refuse it without anyone remembering to. 930 CITATION OR NOTHING. A learned edge names its evidence, the same rule that makes a fabricated quote 931 impossible to store today. 932 APPEND MOSTLY with supersession rather than mutation, so what the system used to believe stays readable. 933 THE THREE DOORS HOLD. The intelligence PROPOSES into curation_proposals; a NAMED HUMAN promotes. That path 934 already exists with its approve and verify endpoints, and it is the only door into anything the scoring 935 engine can see. 936 SUPPRESSION AND EEO ISOLATION unchanged, so a learned aggregate cannot become a small cell disclosure. 937 WHAT THAT BUYS: the crosswalk gets a writer, the orphaned extractions get a home, the graph planes get edges 938 they can traverse, and the intelligence can invent a new relation type at 3am without a human writing a 939 migration, while it remains impossible for it to invent a table nobody governs. 940 941ALLOCATION. This is PHASE 3 SCOPED WORK under the same recorded decision that moved the wrap rate there: it is 942new capability, and building it inside a locked phase whose gates are mid rerun is the exact drift the protocol 943exists to prevent. It is scoped work rather than an improvement, so it does not touch Phase 3's improvement slot, 944which the office format reader holds. 945DEPENDENCY ORDER WITHIN PHASE 3: the store lands BEFORE the crosswalk work in task 13, because the crosswalk is 946its first real customer and building the customer first would mean building it twice. | this commit | 2026-07-29 947 948RECORDED OWNER DECISIONS, 29 July 2026 night, Joseph: "Go i agree with everything now we should be able to 949finish phase 2." Two decisions follow from it and both are written here before any work proceeds. 950 951DECISION ONE, FINDING THREE CLOSES BY DECISION. The external commercial lane stays DISABLED, recorded as 952outside the FIPS boundary and restricted to non regulated tasks, which is what directive 5.3 already says of it. 953THE DIRECTIVE'S OWN WORDS SUPPORT THIS AND I READ THEM TOO STRICTLY FOR TWO DAYS. 5.3 says public SAM notice 954text MAY use the external backend, not must. It requires: a third backend with the enabled flag default false, 955boot failing closed without the secret, only the four public classes leaving the machine, every external call 956auditing backend, payload class, byte count and content hash, and THE VERIFIER GATING ALL RETURNED PROSE 957EXACTLY AS IT DOES FOR LOCAL MODELS. Every one of those is now proven, the audit one only because D19 was found 958and fixed. The verifier requirement is satisfied BY THE DIRECTIVE'S OWN FRAMING: it is backend blind by 959specification, so proving it against local prose proves it. 960 WHAT IS ALSO TRUE: the commercial api.openai.com endpoint is not a sanctioned production provider anywhere in 961 STACK_DECISIONS, which names AWS Bedrock in GovCloud, Azure OpenAI in Azure Government, and self hosted vLLM. 962 Exercising it would have proven a lane production would never use. 963 WHAT REMAINS UNPROVEN AND IS ACCEPTED AS SUCH: prose authored by an external model passing the verifier. The 964 residual risk is small because the validator cannot tell where bytes came from. It is not zero and is not 965 being written up as though it were. 966 THE BOUNDED RUN IS NOT WASTED. It executed every mechanism on this side against the live endpoint for the 967 first time, it proved the boot guard both ways, and it is what surfaced D19. 968 IF AN EXTERNAL LANE IS EVER WANTED IN PRODUCTION it should target Bedrock GovCloud or Azure OpenAI Gov behind 969 the existing provider interface, which is a future phase item and not this one. 970 971DECISION TWO, THE WRAP RATE MODEL IS PHASE 3 SCOPED WORK, NOT PHASE 2. Joseph said go on the wrap rate and in 972the same breath said Phase 2 should now finish. Those two only reconcile one way, and this is the correction: 973building the wrap rate inside Phase 2 would be UNSCOPED WORK INSIDE A LOCKED PHASE, which is the precise drift 974the protocol exists to prevent, and it would enlarge Phase 2's gates so they never settle. Phase 2 therefore 975closes on its existing scope and the wrap rate becomes PHASE 3's FIRST SCOPED ITEM under the full five gate 976protocol. 977 NOTE FOR PHASE 3 PLANNING: Phase 3's single IMPROVEMENT slot is already spent on the office format reader. 978 The wrap rate is SCOPED WORK, not an improvement, so it does not compete for that slot. The distinction 979 matters because conflating them would either lose the office reader or smuggle scope through the improvement 980 channel. 981 THE WRAP RATE'S DEPENDENCY IS ALREADY KNOWN AND RECORDED: it needs the wage bridge, D22, which is one item 982 and not three, and it must ship with a control that asserts a labor category resolves to a SOC code AND that 983 the code returns a non empty OEWS wage row. 984 985SO PHASE 2'S REMAINING WORK IS EXACTLY THREE THINGS: the Gate A, C and D re runs against the settled pipeline 986with positive controls before the first counted run, the honest GATE_E.md rewrite, and the bundle filing. 987Zero open findings once decision one is recorded. | this commit | 2026-07-29 988 989THIRD POSTSCRIPT, WORKING THE LIST, 29 July 2026 night. Joseph asked for a complete list of everything with 990nothing left out, and for work to start down it. The list is 23 open items, tracked in the session task list 991and enumerated across the four entries below this one. PROGRESS AND THE BLOCKING STRUCTURE: 992 993 DONE AND VERIFIED THIS SESSION 994 The corpus is fully embedded, 6902 of 6902, guarded before and verified three ways after. 995 The WS7 classification pass ran for the first time and is still running its full corpus pass in the 996 background: mission tags 0 to 84, incumbent roles 0 to 77 to 273 and climbing. 997 A nightly timer now runs it without me, and the out of repo sweep picked the new unit up automatically. 998 Finding four closed, findings one and two closed by decision, D19 found and fixed. 999 1000 STOPPED BEFORE DOING HARM, which is the real result of starting the list 1001 D22 below. promote-ontology looked like a routine run and would have written O*NET descriptor codes into 1002 skills.soc_code, taking the wage bridge from honestly empty to confidently wrong. Caught by comparing the 1003 two code spaces BEFORE running rather than after. That is one item removed from the safe run list and one 1004 production data corruption not committed. 1005 1006 THE BLOCKING STRUCTURE, so the next session does not rediscover it 1007 THE MONEY ITEMS BLOCK THE INTELLIGENCE ITEMS. Composition and the critic make an answer only as good as its 1008 worst fed generator. Wire the nine generator question today and the wage half returns nothing, because of 1009 D22, and the profitability half cannot be answered at all, because no wrap rate column exists. Build the 1010 money model FIRST or the composition layer will confidently answer half a question. 1011 THE WAGE BRIDGE IS ONE ITEM, NOT THREE. Canonical SOC form, then the crosswalk, then soc_code. Any one 1012 alone accomplishes nothing and will look like progress. 1013 THE KNOWLEDGE ROUTES NEED A DEPLOY DECISION, NOT A CODE FIX. /api/knowledge/manifest and cards are 404 in 1014 production and the handler declares them. Mounting them ships a build feature to the production API, 1015 which the rails close outside a recorded approval. It is Joseph's call, not a patch. 1016 AIOE AND TENANT MISSION TAGGING MAY BE CORRECTLY EMPTY. They read decision history and production holds 11 1017 candidates. Check the precondition before forcing a run; an empty result there is not a defect. 1018 THE VOCABULARY DECISION GATES NOTHING TECHNICAL and should still be made first, because every entry written 1019 after it inherits whichever names win. 1020 1021## RECONSTRUCTION ENTRY, 29 July 2026, recovery session after an unplanned restart 1022 1023WHY THIS REPLACED A HANDOFF. The block that stood here was the 29 July late handoff, and it had gone 1024STALE IN THE SAME WAY THE ONE BEFORE IT DID, for the third time in this ledger. It said the Phase 2 1025close was blocked on a topology decision and that GATE_E.md was not written. Commit f3e4334, made at 102606:54 that morning AFTER that handoff was committed at 00:12, superseded both statements: the trial ran 1027through the genuine intake, gates A through D passed, and GATE_E.md exists. A fresh session reads the 1028top of this file first, so the stale block was again the one most likely to be believed. Replaced, not 1029appended, because two handoffs in one ledger is one handoff too many. 1030 1031THE RECURRENCE IS THE POINT. Twice now a session has written a handoff, kept working, and left the 1032handoff describing a world that no longer existed. The durable fix is not another cleanup: a handoff 1033must be the LAST write of a session, or it must not be written at all. 1034 1035WHAT WAS RECONSTRUCTED, all verified by command against the live systems 1036 Repository /Users/josephanady/missionmatch, branch feature/opportunity-to-outcome, HEAD f3e4334, 1037 397 commits, working tree CLEAN, stash EMPTY. Nothing uncommitted existed, so nothing needed a 1038 ledger note for stashed work. 1039 Phase 2 remains the one current phase. Phase 3 NOT started. 1040 Standing order item 1, PACKAGE ACQUISITION: ALREADY DONE AND STILL INTACT. Re verified remotely. 1041 Standing order item 2, D6 CODIFICATION: ALREADY DONE IN FULL, all six required elements present. 1042 Standing order item 4, THE PHASE 2 CLOSE: ALREADY DONE by f3e4334. 1043 Standing order item 3, FAIRNESS SNAPSHOT DEPLOY AND STORAGE: STILL NOT DONE, as recorded. 1044 Standing order item 5, THE CONDITIONAL CLOSE: CANNOT FIRE. It is conditioned on zero open findings 1045 and zero new deviations, and this session opened two findings. The pre approval does not cover them 1046 by its own terms. 1047 1048D6 AND THE CREDENTIAL RE VERIFICATION CONDITION. The standing order says to re verify every D5 consumer 1049IF D6 shows open or partially codified. It shows CLOSED and fully codified, so the condition did not 1050fire on the LEDGER. It should have fired on REALITY: the consumers were checked anyway as part of 1051production health and two of them are broken. Finding D7 below. The lesson is that a condition written 1052against the ledger cannot catch a divergence between the ledger and the running system. 1053 1054FINDING D22, THE WAGE BRIDGE IS BROKEN IN THREE WAYS AND ONE EXISTING COMMAND WOULD MAKE IT WORSE | 29 July 10552026, found while starting the list, before running anything. This corrects the business fit review above, 1056which named two broken sides. There are three, and the third is the one that matters. 1057 1058 SIDE ONE, KNOWN. skills.soc_code is BLANK on all 397 rows. 1059 SIDE TWO, KNOWN. ontology_crosswalk is EMPTY and NO code writes it. Migration 0021 creates it and grants 1060 SELECT to the app and that is all that has ever touched it. 1061 SIDE THREE, NEW, AND IT INVALIDATES THE OTHER TWO FIXES. THE CODE SPACES DO NOT MATCH. 1062 bls_wages.occupation_code is a SIX DIGIT SOC CODE WITH NO HYPHEN, 825 distinct values from 111011 to 1063 537199. That is SOC 11-1011 written as 111011. 1064 The O*NET codes in ontology_terms are CONTENT MODEL DESCRIPTOR IDs: 1.A.1.a.1, 2.B.5.d, 2.C.9.b. Measured: 1065 of 108 coded O*NET rows, ZERO are SOC shaped and 108 are not. 1066 So an O*NET descriptor identifier can never join to an OEWS occupation code. They are different code 1067 spaces that happen to share a column name. 1068 1069 THE TRAP I ALMOST WALKED INTO. cmd/promote-ontology pass 3 does 1070 INSERT INTO skills (name, category, source, soc_code) SELECT ... ot.code ... WHERE source_name = 'O*NET Web 1071 Services' AND source_record_id LIKE 'onet-tech:%' 1072 and its own comment says the soc_code column stores the O*NET code FOR LATER CROSSWALK USE. Running it today 1073 would write O*NET TECHNOLOGY DESCRIPTOR CODES into a column named soc_code. skills.soc_code would go from 1074 honestly empty to CONFIDENTLY WRONG, the crosswalk join would still match nothing, and the bridge would 1075 report as populated while being broken. That is the exact failure mode of this entire week, one step from 1076 being committed to production, and it was caught only by comparing the two code spaces before executing 1077 rather than after. 1078 SO promote-ontology IS NOT SAFE TO RUN until the code space question is settled, and task 19 must not treat 1079 it as a routine run. Its other two passes, corpus mined skills and mission spine terms, do not touch 1080 soc_code and are unaffected. 1081 1082 WHAT THE CROSSWALK IS ACTUALLY FOR, and it is well designed. Its columns are from_system, from_code, 1083 to_system, to_code, relation, source_name, synced_at. That is a GENERAL CODE SPACE BRIDGE, exactly the right 1084 shape for this problem. It was built for this and never filled. 1085 1086 THREE MORE GAPS THE SAME QUERY EXPOSED, all in the ontology 1087 O*NET skill terms: 2782 rows and only 33 CARRY A CODE. 2749 coded nowhere. 1088 Market Extraction skills: 269 rows, ZERO codes. 1089 GSA CALC labor_category: 20 rows, ZERO codes. This one stings, because GSA CALC is a LABOR CATEGORY RATE 1090 source and labor category is the unit the whole bill rate conversation happens in. 1091 1092 WHAT CLOSING THIS ACTUALLY REQUIRES, in order 1093 1. Pick ONE canonical SOC form and normalize on write. bls_wages already uses the six digit no hyphen 1094 form and holds 825 of them, so it is the incumbent and should win. 1095 2. Fill ontology_crosswalk from an authoritative SOC keyed source, mapping SOC to labor category, to 1096 O*NET occupation, and to skill. The table shape already supports all three via from_system and to_system. 1097 3. Only then fill skills.soc_code, with real SOC OCCUPATION codes, and fix promote-ontology pass 3 so it 1098 stops writing a descriptor code into a column named soc_code. Either rename that column to onet_code and 1099 add a real soc_code, or stop populating it there. 1100 4. A POSITIVE CONTROL THAT CANNOT PASS VACUOUSLY: assert that a named labor category resolves to a SOC code 1101 AND that the SOC code returns a non empty OEWS wage row. A count of crosswalk rows proves nothing, which 1102 is what side three teaches. | this commit | 2026-07-29 1103GENERATOR TO DATA MAP, AND THE OVERLAP GAP, 29 July 2026. Joseph supplied the augmentation taxonomy, 37 named 1104patterns, and said the knowledge and the databases must be wired to the CORRECT generators WITH OVERLAP to make 1105one complete intelligence. This entry maps every pattern that has a home here to the data behind it, names the 1106ones with no home, and states the one architectural gap that stops the parts from being one thing. 1107 1108FIRST, A VOCABULARY COLLISION THAT MUST BE SETTLED BEFORE ANY WIRING 1109 Joseph's list reads MAG as MEMORY augmented generation and TAG as TOOL augmented generation. 1110 THIS CODEBASE ALREADY USES BOTH ACRONYMS FOR DIFFERENT THINGS, in 11059 lines, in a boot validated Registry, 1111 and in a DATABASE CHECK CONSTRAINT: 1112 MAG here is MODEL augmented generation. mag.go: the fourth augmentation class after RAG, TAG and GraphRAG. 1113 It is bound to aedt_learned_models.output_kind, which is a CHECK constraint and an AEDT compliance 1114 artifact, so the name is load bearing in the audit trail, not just in comments. 1115 TAG here is TABLE augmented generation. tag.go: answers questions that require the database to COMPUTE. 1116 AND THE THING JOSEPH CALLS MAG EXISTS HERE UNNAMED: ai_memory, 287 rows all embedded, per tenant episodic and 1117 semantic memory in memory.go. 1118 RECOMMENDATION, and it is a recorded decision to make rather than a thing to assume: KEEP the code names as 1119 canonical and document Joseph's names as aliases. Renaming MAG would touch a CHECK constraint and the AEDT 1120 inventory, which is a compliance surface, to gain nothing a mapping table cannot give. Whichever way it goes, 1121 ONE vocabulary must win in writing, because two meanings for one acronym in one system is exactly the drift 1122 that produced the UI failure code mismatch and the declared but never written audit action this week. 1123 1124WHAT ALREADY HAS A HOME, with its real data and its real state 1125 LIVE AND FED 1126 RAG AnswerRAG plus retrieval.go. opportunity_records.embedding now 6902 of 6902, 1127 candidates.resume_embedding, document chunks 836 in staging. 1128 Hybrid RAG tsvector plus pgvector fused by RECIPROCAL RANK FUSION, already present in retrieval.go, 1129 orchestrator.go, candidates.sql.go and eval/metrics.go. The fusion primitive EXISTS. 1130 Multi hop RAG the recursive CTE traversals in the graph planes, each with a hard depth cap, a visited 1131 path cycle guard and a total order tiebreaker. 1132 GraphRAG, GAG nine planes G1 to G9. Fed unevenly: award_incumbent_roles 77 as of tonight, 1133 skill_relationships only 11, ontology_crosswalk 0. 1134 Reasoning AG the same planes. Deterministic cited traversal is this build's reasoning surface. 1135 TAG, SQL AG the 35 intent closed Registry, parameterized, RLS scoped, allowlisted, boot validated. 1136 MAG as model aedt_learned_models 12, coefficients 101, four families, promotion gated on eval-model 1137 plus a human. 1138 MAG as memory ai_memory 287, all embedded. 1139 OAG, KAG ontology_terms 8011 (skill 3066, psc_code 2540, ksa 2286, cert 57, work_role 42, 1140 labor_category 20), term_expansions 204, skill_aliases 17. 1141 Domain AG bls_wages 1670 OEWS rows, usaspending_awards 538, the missionclass classifier. 1142 Verifier AG citation per clause, quote hash grounding, ValidateScopeCandidates rejecting a quote not 1143 present verbatim, the faithfulness endpoint, vectorguard on the vector space. 1144 Policy AG safety.go read allowlist, forced RLS, ForbidEEO, the AEDT output_kind CHECK. 1145 Privacy AG scrub egress classes, small cell suppression floor k, eeo schema isolation. 1146 Human AG slate approval, curation approve and verify, champion promotion. THE STRONGEST ONE HERE, 1147 and the one most products lack. 1148 Agentic, PAG planner.go, 841 lines, RoutePlan. 1149 Adaptive RAG Classify(), rule based over question shape. A trained classifier is the documented upgrade. 1150 Federated AG internal/platform/federated, 633 lines, plus the public mm-recall edge. 1151 Event AG the substrate is there and UNUSED AS A GENERATOR: outcome_events 1411, 1152 application_stage_events 1382, requisition_events 1188, audit_logs 56577. 1153 BUILT BUT STARVED 1154 CAG knowledge.go holds curated cards; production serves ZERO and /knowledge is 404. 1155 Feedback AG teaching.go and teach-aggregate exist; teaching_signal_aggregates 0, curation_proposals 0. 1156 Simulation AG cmd/aioe-sim exists and has never been run. 1157 WAG sam-sync and the attachment mining are real; the 2625 notice bodies are still unfetched. 1158 NO HOME, and most of these absences are CORRECT for this domain 1159 TAG as tool, AAG, Program AG no tool calling or code execution layer. Given the no Python rule and the 1160 AEDT posture, adding one is a policy decision, not a gap to fill quietly. 1161 Critic AG there is a verifier and no adversary. The verifier checks grounding; nothing 1162 argues the answer is wrong. This is the most valuable missing one. 1163 Multimodal, VAG, Sensor AG not applicable, with ONE exception: a scanned wage determination needs 1164 vision, which is exactly candidate P2 in IMPROVEMENTS. 1165 Schema AG implicit rather than absent: sqlc compiles the SQL against the schema and 1166 the Registry is schema bound. 1167 1168THE ONE ARCHITECTURAL GAP: THE ROUTER IS EXCLUSIVE, AND INTELLIGENCE NEEDS IT TO BE COMPOSITIONAL 1169 orchestrator.go Answer() is a chain of early returns and a final switch. It selects EXACTLY ONE generator per 1170 question: AnswerGraph, or AnswerPlan, or AnswerRAG, or AnswerDirect, or refuse. There is one compositional 1171 escape hatch, AnswerPlan, and it fires only when isCompoundQuestion sees a conservative keyword signal, and 1172 even then it composes only WITHIN the closed Registry. It never composes RAG with a graph plane with the wage 1173 domain with a learned model with a knowledge card. 1174 SO OVERLAP TODAY IS ACCIDENTAL, NOT DESIGNED. And overlap is not redundancy: two independent generators 1175 agreeing is EVIDENCE, and two disagreeing is a FLAG. That is the same principle as every positive control in 1176 this build, applied to answers instead of instruments. 1177 THE RECRUITER'S REAL QUESTION PROVES IT. "Can we bid this and staff it profitably" needs, in one answer: 1178 WAG to fetch the notice, document RAG over the PWS chunks, OAG to map labor categories to SOC, Domain AG for 1179 the wage determination floor and the OEWS band, TAG for bench counts, GraphRAG for clearance reachability and 1180 the incumbent, MAG for capture readiness, Verifier for citations, and Policy plus Privacy throughout. NINE 1181 generators. Today that question routes to ONE, and whichever one wins, the answer is confidently partial. 1182 WHAT TO BUILD, and RRF is already here so the primitive is not the problem: a composition layer that fans a 1183 question to the generators whose preconditions it satisfies, collects CITED evidence from each, fuses by RRF, 1184 and scores AGREEMENT, with a critic that must attempt to refute the composed answer before it is served. 1185 Disagreement surfaces as a stated uncertainty rather than being averaged away. 1186 1187NOT A DECISION YET. This is a proposal and a map. docs/ARCHITECTURE.txt is untouched, correctly, because its 1188revision protocol admits exactly four moments and a proposal is not one of them. | this commit | 2026-07-29 1189BUSINESS MODEL FIT REVIEW, 29 July 2026, ordered by Joseph before proceeding further with the intelligence 1190layer: is it learning the RIGHT things for a company and a recruiter to see open federal contracts, understand 1191them, and fill the roles. Researched against outside sources, then measured against the actual schema. Every 1192schema number below is a query result, not a reading of the code. 1193 1194HOW A FEDERAL STAFFING AGENCY ACTUALLY MAKES MONEY, from the research 1195 THE BILL RATE IS THE WHOLE BUSINESS. It funds, in order: the worker's pay, the employer burden on that pay 1196 (payroll taxes, insurance, benefits), overhead and recruiting cost, and only then margin. Contract and temp 1197 markups run 30 to 75 percent; permanent placement runs 10 to 20 percent of first year salary; a 25 percent 1198 gross margin is a common target. Gross margin is bill rate minus pay rate MINUS BURDEN. 1199 IN GOVCON THE NUMBER IS THE WRAP RATE. Bill rate equals pay times wrap, where wrap carries fringe, overhead, 1200 G and A, and fee. Price to win is a wrap rate argument. 1201 CLEARED TALENT CARRIES A PREMIUM: average cleared compensation about 119,131 dollars, up roughly 4 percent to 1202 an all time high, with demand exceeding supply. 1203 THE SCA WAGE DETERMINATION IS A LEGAL FLOOR, not a market datapoint. DOL issues a determination per labor 1204 category per locality for service contracts over 2,500 dollars. THE EMPLOYER BEARS THE BURDEN of mapping each 1205 employee to the correct category, and when a determination is revised the contractor must submit a PRICE 1206 ADJUSTMENT to recover the cost. 1207 KEY PERSONNEL ARE A COMPLIANCE ARTIFACT, not a nice to have. Named key personnel, their resumes, signed 1208 letters of commitment stating position, level of effort and period of performance, and availability 1209 statements have been treated in GAO bid protest decisions as MATERIAL solicitation requirements. Omission can 1210 render a proposal unacceptable. Contingent offers must be explicitly contingent on award, customer approval, 1211 and continued eligibility. 1212 THE OPERATING KPIs: submit to interview about 3 to 1, time to fill about 44 days, fill rate above 80 percent 1213 with below 80 treated as a warning, plus submittals per recruiter, offer acceptance, 90 day retention, cost 1214 per hire. 1215 1216WHAT THIS BUILD ALREADY HAS, and it is most of the shape 1217 THE FULL LIFECYCLE EXISTS AS TABLES: requisitions to applications to application_stage_events to interviews 1218 to offers to placements, alongside slates and slate_members for proposal staffing, bid_outcomes, 1219 vendor_submissions, staffing_vendors, recruiter_activities, outcome_events. 1220 STAGING PROVES IT HAS BEEN EXERCISED: requisitions 1082, requisition_events 1188, applications 677, 1221 application_stage_events 1382, interviews and offers and placements present, slate_members 2070, 1222 candidate_evaluations 1777, bid_outcomes 1220, vendor_submissions 1385, recruiter_activities 612. 1223 THE MONEY FIELDS EXIST AT THE RIGHT GRAIN: requisitions carry bill_rate_min/max, pay_rate_min/max, 1224 salary_min/max; offers carry bill_rate, pay_rate, salary, fee_pct; placements carry bill_rate, pay_rate, 1225 salary, fee_amount; requirement_drafts carry bill_rate_min/max and pay_band_min/max. 1226 THE CAPTURE SIDE EXISTS: contract_vehicle, incumbent_name and incumbent_uei on opportunity_records for 1227 recompete positioning, an agency buying pattern graph plane, a capture readiness champion model with a 1228 documented GO/REVIEW/NO_GO threshold, and bls_wages holding 1670 OEWS rows behind the M5 price to win plane. 1229 1230THE GAPS, in business impact order. Every one verified by query. 1231 1232 GAP 1, THERE IS NO WRAP RATE, BURDEN, FRINGE, OVERHEAD, G AND A, OR INDIRECT COLUMN ANYWHERE. Zero. 1233 My first regex reported three matches and all three were FALSE POSITIVES: uploaded_by_user_id matched on 1234 "loaded", and signal_value and source_signal matched on "gna" inside "signal". Named and checked, the true 1235 count is ZERO. 1236 CONSEQUENCE, and it is the most important sentence in this entry: bill_rate minus pay_rate is a SPREAD, not 1237 a gross margin. Without burden the product cannot tell a recruiter whether a placement makes money, and it 1238 cannot produce a defensible price to win, because price to win in GovCon is a wrap rate argument. The 1239 system can currently show a number that LOOKS like margin and is not one. That is the same class of defect 1240 as every instrument this week that reported a clean result while measuring something adjacent. 1241 1242 GAP 2, THERE IS NO SCA WAGE DETERMINATION MODEL AT ALL. Zero tables and zero columns matching wage 1243 determination, sca, wd_number or wd_rev. 1244 AND IT COMPOUNDS WITH FINDING ONE: the one document class the extractor cannot read is the SCA wage 1245 determination, whose text layer carries no usable character map. So the legal floor under every bill rate on 1246 a service contract is neither modelled nor readable. There is also no mechanism for the price adjustment 1247 that follows a revised determination, which is money the contractor is entitled to and would simply not 1248 claim. 1249 1250 GAP 3, THE BRIDGE FROM A LABOR CATEGORY TO WAGE DATA IS BROKEN ON BOTH SIDES. 1251 bls_wages is keyed by occupation_code, a SOC code. skills carries a soc_code column on all 397 rows and it 1252 is BLANK ON EVERY ONE, 0 non blank. ontology_crosswalk, which G3's skill gap bridge joins with 1253 ox.from_code = req.soc_code, is EMPTY. 1254 So even if the crosswalk were populated tomorrow the join would still match nothing, because there are no 1255 SOC codes to join to. Two empty sides of one bridge, and it is why the price to win plane cannot reach real 1256 wages for a given skill. Fixing either alone accomplishes nothing, which is worth knowing before someone 1257 fixes one and reports progress. 1258 1259 GAP 4, KEY PERSONNEL IS A SINGLE BOOLEAN. requirements.key_personnel, and nothing else: no letter of 1260 commitment record, no signed status, no level of effort, no period of performance, no availability 1261 statement, no contingent offer state. Given that GAO treats these as material solicitation requirements, 1262 a proposal staffing product that cannot track whether the LOC is signed is missing the artifact that 1263 decides whether the proposal is acceptable at all. 1264 1265 GAP 5, THE INPUTS THAT WOULD FILL ALL OF THE ABOVE ARE STILL UNREAD. Labor categories, quantities, clearance 1266 levels and certifications live in the PWS and the SOW, and the notice body has never been fetched while the 1267 attachment corpus is only now being mined nightly. solicitation_extractions already holds 2457 rows with 1268 labor_category, required_clearance, required_skills, required_certifications and required_years, grounded to 1269 2457 distinct opportunity_records, and NO CODE READS IT. That is the shape of the answer sitting unused. 1270 1271WHAT I AM NOT CLAIMING. This is a fit review against outside sources and the schema. It is not a customer 1272discovery interview, and Joseph knows this market far better than a web search does. Where the research and his 1273experience disagree, his experience wins and this entry should be corrected by name rather than quietly edited. 1274| this commit | 2026-07-29 1275INTELLIGENCE ACTIVATION, 29 July 2026, on Joseph's order that all of it be fixed and that it be learning and 1276growing from SAM.gov and using what it has learned. THE HEADLINE: this was overwhelmingly a RUN problem, not a 1277BUILD problem. Every dark item but two already had a command built for it, and none of those commands had ever 1278been run in production. That is why the intelligence looked absent while being present. 1279 1280WHAT WAS ACTUALLY RUN AND VERIFIED TONIGHT, in production 1281 1282 1. THE CORPUS IS NOW FULLY EMBEDDED. 6902 of 6902 opportunity_records, up from 6535. 367 backfilled. 1283 GUARDED FIRST, because embedding with the wrong model silently corrupts the vector space and there would 1284 be no error to see: cmd/verify-vector-model compared stored vectors against fresh embeddings of the same 1285 text and returned cosine 1.000000 on five samples, PASS at qllama/bge-small-en-v1.5 dim 384. Only then 1286 was the backfill run, with -only-missing so it could touch nothing that already had a vector. 1287 VERIFIED AFTER, three ways: 0 rows still missing, 6858 DISTINCT non zero vectors so nothing was zero 1288 filled, and a nearest neighbour query seeded from an elevator record returned three Elevator 1289 Modernization notices first. The vector space answers. 1290 1291 2. THE FEDERAL SIGNAL CLASSIFICATION PASS RAN FOR THE FIRST TIME. cmd/missionclass-sync, WS7. 1292 federal_mission_tags 0 to 84. award_incumbent_roles 0 to 77. 10065 records scanned, which is exactly 1293 6902 opportunity_records plus 2625 sam_opportunities plus 538 usaspending_awards. 1294 AND IT MINES SAM ATTACHMENTS ITSELF, which corrects D20 again: it fetches the attachment package, 1295 extracts text, and classifies from it, bounded by -max-attachments to protect the SAM quota. First pass 1296 50 notices, second 300, and a full pass over the remaining 2325 is running in the background. 1297 It also names what it cannot read rather than guessing, logging skipped unreadable attachments per 1298 record, which is the same honesty posture as the Phase 2 extractor. 1299 1300 3. IT NOW LEARNS ON A SCHEDULE INSTEAD OF WHEN I RUN IT. mm-missionclass.timer installed and enabled on 1301 Bubbles, nightly at 04:20 with a 600 second jitter, ExecStart capped at 300 attachments per run. The cap 1302 is deliberate: the job is idempotent and self limiting, so a nightly cadence works through the backlog 1303 instead of spending a whole day's SAM quota in one pass and failing the rest of the way through. It runs 1304 AFTER the nightly SAM sync so it classifies what arrived tonight, not what arrived yesterday. 1305 The unit carries TWO EnvironmentFile lines and ZERO inline Environment= lines, so no credential is 1306 embedded and none is passed as an argument. The out of repo secret sweep from finding four picked the new 1307 unit up automatically, because its scope is a glob over /etc/systemd/system/mm-*.service, and reported 1308 15 of 15 scopes clean. That is the sweep earning its keep on a unit written after it. 1309 1310WHAT REMAINS, split honestly into runs and builds 1311 1312 RUNS, the command exists and has never been run in production 1313 teach-aggregate the WS8 teaching loop cadence. teaching_signal_aggregates 0, curation_proposals 0. 1314 aioe-backfill, aioe-run converts decision history to outcome_events, then one deterministic AIOE pass. 1315 All three aioe tables are 0. Production has almost no decision history, so this 1316 one may be correctly empty until tenant data exists. Check before forcing it. 1317 tag-missions tenant mission tagging. Same caveat: production holds 11 candidates. 1318 ontology-sync, grow the ontology further from free federal sources and O*NET. 1319 promote-ontology 1320 train-model, eval-model retrain on the grown corpus, then the promotion gate. Do NOT promote a champion 1321 without eval-model passing the ranking and four fifths gates AND a human. 1322 brain-probe stress tests the LIVE brain end to end. Run it LAST, as the acceptance check. 1323 1324 BUILDS, small, and nothing does them today 1325 A. FETCH THE NOTICE BODY. 2625 description_url values, every one 94 characters and http prefixed. The 1326 column is stored, selected and upserted and NEVER FETCHED. This is the single highest ratio of value to 1327 risk left: it turns 168 bytes of header per notice into real notice text for the embedder, the 1328 classifier, and REQUIREMENT_NORMALIZE. 1329 B. WRITE ontology_crosswalk. It is READ by G3's skill gap bridge, which joins it on soc_code, and it is 1330 allowlisted in safety.go, and NO code writes it. So G3's taxonomy bridge traversal has nothing to walk. 1331 1332 AND THREE SMALL FIXES 1333 C. Mount /api/knowledge/manifest and /api/knowledge/cards. Both 404 in production. 1334 D. Teach the curated CAG cards into production. /api/mm-recall is live and returns 1335 {"results":[],"count":0} for an ordinary query. 1336 E. FIX THE mm-recall CONTROL. Its documented guarantee is that a protected attribute query returns no 1337 cards. That cannot be distinguished from an empty knowledge base, and today the base IS empty, so the 1338 control passes while proving nothing. It must assert that an ORDINARY query returns cards in the same 1339 run that asserts a protected attribute query returns none. Do this WITH D, not after it. | this commit | 2026-07-29 1340 1341INTELLIGENCE LAYER INVENTORY, 29 July 2026, ordered by Joseph after he said the build already has its own 1342intelligence and that two days had been spent drifting. He was right on both counts. This is a full scan of 1343every file and every database, and it CORRECTS finding D20 above, which was written from the production tenant 1344alone and drew the wrong conclusion from a half empty database. 1345 1346WHAT IS BUILT. internal/modules/ai is 11059 lines, the LARGEST module in a 112469 line Go codebase, and it is 1347a complete augmented generation architecture, not a wrapper around a model call. 1348 SIX ROUTES the orchestrator chooses between: refuse (eeo and injection), tag (the database computes), rag 1349 (retrieve and narrate), direct (CAG, answer from stable rules with no retrieval), graph (walk a cited 1350 evidence path), plan (bounded plan and execute over the closed Registry). 1351 FOUR AUGMENTATION CLASSES: RAG, TAG, GraphRAG, MAG. MAG is model augmented generation, the fourth class. 1352 NINE NAMED GRAPH PLANES, each a reviewed static SQL constant with a depth cap, a cycle guard and a total 1353 order tiebreaker: G1 market and relationship, G2 vendor co occurrence and teaming, G3 skill and role 1354 adjacency, G4 bench, G5 clearance lattice, G6 the integrated capture loop, G7 agency buying pattern, 1355 G9 recompete lifecycle and foresight, M5 price to win on real BLS OEWS wages. 1356 35 INTENTS in ONE closed Registry, tag.go:112 to 585, asserted at boot by ValidateRegistry from 1357 cmd/api/main.go:367. 11 of them are MAG model intents. 1358 THE AEDT GUARDRAIL HOLDS IN THE TYPE SYSTEM. A MAG intent may emit exactly three output kinds, 1359 opportunity_score, display_order, confidence. A candidate score is impossible to register, impossible to 1360 store because it is also the CHECK on aedt_learned_models.output_kind, and impossible to emit. The frozen 1361 v1.4.0 engine stays the only per candidate scorer. 1362 Plus a planner, a teaching and curation loop, per tenant episodic and semantic memory, a vector model guard, 1363 small cell suppression, mission scoping, capture readiness, vendor intelligence, and a one way public 1364 knowledge feed. 1365 1366WHAT IS TRAINED, in the PRODUCTION tenant, all exact counts 1367 aedt_learned_models 12, aedt_model_versions 5, aedt_model_coefficients 101. 1368 FOUR MODEL FAMILIES, all fit by cmd/train-model on real labels, not placeholders: 1369 opportunity_win_probability logistic, champion v1, prior only, intercept is the logit of a defensible 1370 0.60 federal recompete base rate 1371 requirement_time_to_fill discrete hazard, champion v1, challengers v2 to v4 fit over 415 requirements 1372 opportunity_capture_readiness weighted scorecard, champion v1, factor weights 0.35/0.30/0.20/0.15, 1373 GO at 0.65, REVIEW 0.45 to 0.65, NO_GO below 1374 slate_display_order pairwise logistic, champion v6, fit over 46 decided slates and 2316 approved 1375 over rejected pairs, ridge l2=1. Earlier fit used 93 slates and 1138 pairs. 1376 Champion promotion is gated: challengers sit champion=false until cmd/eval-model passes the ranking and four 1377 fifths gates AND a human promotes. That gate is real and is holding. 1378 1379THE DATA SUBSTRATE, PRODUCTION, exact 1380 audit_logs 56577, ontology_terms 8011, opportunity_records 6902 with 6535 EMBEDDED, sam_opportunities 2625, 1381 solicitation_extractions 2457, bls_wages 1670, usaspending_awards 538, ai_memory 287 ALL embedded, 1382 skills 267 ALL embedded, term_expansions 204, aedt_model_coefficients 101, mission_areas 10, mission_spine 10, 1383 skill_aliases 17, skill_relationships 11. 41 of 86 tables populated. 1384 ontology_terms by kind: skill 3066, psc_code 2540, ksa 2286, certification 57, work_role 42, labor_category 20. 1385 1386THE CORRECTION TO D20, AND IT IS A BIG ONE. STAGING IS WHERE THE SYSTEM ACTUALLY LIVES. 1387 staging: candidates 8872, organizations 2814, users 1105, slate_members 2070, candidate_evaluations 1777, 1388 candidate_skills 1515, outcome_events 1411, vendor_submissions 1385, application_stage_events 1382, 1389 bid_outcomes 1220, requirements 1184, requisition_events 1188, requisitions 1082, applications 677, 1390 recruiter_activities 612, slates 496, aedt_model_coefficients 433, skills 397, 1391 AND opportunity_document_chunks 836. 1392 production: candidates 11, organizations 1, users 7, requirements 6, slates 13, document chunks 0. 1393 SO THE PHASE 2 DOCUMENT PIPELINE IS NOT DARK. It has 836 chunks in staging. What is empty is PRODUCTION, 1394 and production is empty of TENANT data generally, not of documents specifically. D20's headline, that the 1395 document pipeline has processed nothing, is true only of production and reads as though it were true of the 1396 build. Withdrawn as stated and restated here. 1397 1398WHAT IS GENUINELY DARK, and this is the useful list 1399 1. THE PUBLIC KNOWLEDGE BASE IS EMPTY IN PRODUCTION. /api/mm-recall is LIVE and unauthenticated by design, 1400 a contents free federation edge, and it returns {"results":[],"count":0} for an ordinary query. The 1401 curated CAG cards in knowledge.go were never taught into production. Worse, the documented control that a 1402 protected attribute query returns no cards CANNOT DISCRIMINATE while everything returns no cards. That is 1403 the same failure mode as every other instrument caught this week. 1404 2. /api/knowledge/manifest and /api/knowledge/cards return 404 in production. Not mounted. 1405 3. solicitation_extractions holds 2457 rows grounded to 2457 distinct opportunity_records, 2163 of them ok, 1406 carrying labor_category, required_clearance, required_skills, required_certifications and required_years, 1407 AND NO GO CODE REFERENCES THE TABLE AT ALL. Only migration 0060 mentions it. Written by code that no 1408 longer exists, read by nothing. That is extracted intelligence, orphaned. 1409 4. The teaching loop is dark in production: teaching_signal_aggregates 0, curation_proposals 0. 1410 5. AIOE is dark: aioe_runs 0, aioe_weight_profiles 0, aioe_weight_adjustments 0. 1411 6. ontology_crosswalk is 0, so G3's skill gap bridge traversal has no crosswalk taxonomy to walk. 1412 7. Mission tagging is dark: candidate_mission_tags 0, requirement_mission_tags 0, federal_mission_tags 0, 1413 even though mission_areas and mission_spine each hold 10 curated rows. 1414 8. 367 of 6902 opportunity_records carry no embedding. 1415 9. The two unfetched link sets from D20 still stand and are still the deepest gap in the MARKET corpus: 1416 2625 notice description URLs and 5363 attachment links, none ever followed. Verified again: every 1417 description value is 94 characters and begins with http, so no notice body has ever been fetched. 1418 10. nginx reports 34 CONFLICTING SERVER NAME warnings across the vhost set, caused by backup files left 1419 inside sites-enabled where the glob loads them. missionmatch.thatwebhostingguy.com has such a .bak 1420 sibling. Not a missionMATCH defect and it affects missionMATCH. 1421 1422WHAT I GOT WRONG, named so it is not repeated 1423 I probed the brain against missionmatch.thatdevpro.com, which is not the hostname, got 000 on every route, 1424 and was one sentence away from reporting the brain unreachable in production. The real host is 1425 missionmatch.thatwebhostingguy.com and /api/ai/query answers 403, meaning MOUNTED AND AUTH GATED. Caught by 1426 running a control first: / answers 200 and /api/auth/session answers 403. A check with no control is a 1427 rumour. 1428 I also read the first inventory off pg_stat_user_tables.n_live_tup, which reported skills 0 and 1429 ontology_terms 0 when exact counts are 267 and 8011. Stale planner statistics. Every number above is an 1430 exact count(*), taken through query_to_xml per table. | this commit | 2026-07-29 1431 1432FINDING D20, THE INTELLIGENCE LEARNS FROM HEADERS, AND THE DOCUMENTS IT WAS BUILT TO READ ARE UNREAD IN 1433PRODUCTION | 29 July 2026. Found by measuring the ingest and embed loop after Joseph pointed out that the whole 1434point is to ingest SAM.gov, embed it, and grow from it. He was right, and the measurement is worse than the 1435question implied. Every number below is from the PRODUCTION tenant, read only. 1436 1437WHAT IS GENUINELY GROWING, and it is not nothing 1438 opportunity_records 6902 rows, 6535 EMBEDDED, 94.7 percent 1439 ontology_terms 8011 1440 skills 267, ALL embedded 1441 ai_memory 287, ALL embedded 1442 sam_opportunities 2625 notices cached 1443 So the market scale ingest and the vector substrate are real and working. 1444 1445WHAT IT IS LEARNING FROM, measured rather than assumed 1446 The deepest text any SAM notice contributes is 75 to 445 BYTES, average 168, composed from the flat metadata 1447 columns: title, department, sub agency, notice type, NAICS, PSC, set aside, place of performance. That is a 1448 HEADER. It is not a solicitation. 1449 1450WHAT IS SITTING IN THE DATABASE UNREAD, with the pointers already stored 1451 2625 notice DESCRIPTION URLS. The cache column is description_url and the raw jsonb description key is also a 1452 URL, verified: all 2625 values are exactly 94 characters and every one begins with http. The notice BODY 1453 has never been fetched. One HTTP GET per notice would produce it. 1454 5363 ATTACHMENT LINKS across 1484 notices, all URL shaped, none ever followed. 1455 RESULT: opportunity_documents 0. opportunity_document_chunks 0. opportunity_scope_items 0. ZERO. 1456 1457SO THE ENTIRE PHASE 2 DOCUMENT PIPELINE HAS PROCESSED NOTHING IN PRODUCTION. Table extraction, the readability 1458bar, chunking, provenance born at origin, the amendment diff, the split and merge, the draft generator. All of 1459it is PROVEN, on the real Package A and Package B, in STAGING. In production it has no fuel, because nothing 1460follows either of the two link types the database already holds. Only 1 opportunity is tracked, and tier one 1461attachment sync is track driven by design, so it can only ever pull for what a customer already found. 1462 1463THIS REFRAMES FINDING THREE ENTIRELY, and the reframing is mine to own. I spent an evening trying to make an 1464external model extract contract scope from 168 bytes of header metadata. Even had OpenAI answered, it would 1465have been reading "Elevator Preventive Maintenance. Department: VA. NAICS: 238290." That is why each of the 1466three notices yielded exactly ONE scope item and why the payloads were 237, 117 and 114 bytes. The bottleneck 1467was never the model. It was that the text was never fetched. 1468 1469ALSO FOUND, smaller 1470 367 opportunity_records carry NO embedding, 6902 minus 6535. 1471 ontology_crosswalk is EMPTY, 0 rows, so the crosswalk has never been populated. 1472 1473WHAT THIS IS AND IS NOT. It is NOT a defect in Phase 2's scope: the phase was to build the document pipeline 1474and the pipeline works. It IS the gap between a pipeline that works and a product that knows things, and it is 1475the same lesson already recorded as depth equals completeness. NOTHING WAS BUILT FOR IT IN THIS SESSION, and 1476nothing should be: it is a scope decision under a phase lock and it belongs to Joseph. 1477 1478THE ORDER OF VALUE, if he wants it, cheapest and most local first 1479 1. Follow the 2625 description URLs. Local, no third party, no new dependency, turns 168 bytes per notice into 1480 real notice text for the embedder and for REQUIREMENT_NORMALIZE. This is the single highest ratio of value 1481 to risk available in this codebase right now. 1482 2. Follow the 5363 attachment links into the pipeline that already exists and is already proven. This is 1483 IMPROVEMENTS item 2, tier two the rolling corpus harvest, approved and NOT STARTED, and its recorded 1484 caveat stands: it needs a storage budget with a ceiling and a retention rule first, because Bubbles is at 1485 82 percent of a 221G root disk and the backups live on that same disk. 1486 3. Embed the 367 stragglers and populate ontology_crosswalk. 1487 None of the three needs an external model. | this commit | 2026-07-29 1488 1489FINDING D19, THE EXTERNAL INFERENCE AUDIT ACTION WAS DECLARED AND NEVER WRITTEN | 29 July 2026, found while 1490executing finding three. ai.ActionExternalInference has existed since 27 July, and AllowExternal carried a 1491comment stating that binding the gate and the audit in one call means a caller cannot send without both. 1492THE BINDING WAS NEVER REAL. AllowExternal returned a map and trusted its caller to record it, and the only 1493caller in the codebase wrote that map to a LOG LINE and persisted nothing. 1494So the single class of call that physically leaves this machine was the ONLY class with no audit trail, for 1495two days, while FIVE UNIT TESTS PASSED. They passed because every one of them asserts the SHAPE OF A MAP. Not 1496one asked whether a row existed. This is the eleventh instance in this build of an instrument reporting a 1497clean result while measuring something adjacent to the thing it claims to measure. 1498FIXED. AllowExternalAudited gates and writes as ONE call and FAILS CLOSED: an external call whose audit row 1499cannot be written does not happen, which is the posture the auth module already takes for security events. The 1500row is written BEFORE the payload leaves, the only ordering an auditor can trust, because a row written