Production Readiness
What's real, what's demonstrated, and what happens at award.
An honest accounting. The platform is a working, access-controlled, server-persistent system today — signed sessions, server-enforced roles, durable S3-backed storage, a documented REST API, a hash-chained audit trail, the contracted data-intake-to-publisher-submission flow, and a live AI assistance layer are all running now. The only items left to complete are VA-side authorizations that, by design, can happen only on an awarded contract with VA sponsorship.
Built and running now — code in the repo, enforced at runtime.
Working end-to-end in the live demo; scales out under the contract.
A VA-side authorization that, by design, requires an awarded contract.
Implemented
Built and running now — code in the repo, enforced at runtime.
Authentication
ImplementedWhat’s real now
Signed session cookies (HMAC-SHA256 over a JSON payload), scrypt-hashed credentials with timing-safe comparison, httpOnly + Secure cookies, and 8-hour expiring sessions. Verified server-side on every protected request.
At contract award
The seed roster is replaced by the VA's identity provider — VA SSOi / PIV single sign-on. The session and RBAC contract underneath is unchanged.
Role-based access control
ImplementedWhat’s real now
Six production roles — Platform Admin, Program Manager (RMP), VA HR Specialist (OCHCO), Facility Locality Viewer, VA Observer, and an anonymous guest sandbox. A typed permission model is enforced server-side in the API routes via a single can() check; the UI only mirrors it. Every role sees a tailored module set, and facility coordinators are data-scoped to their own facility.
At contract award
Role assignment is mapped to VA Active Directory groups, so access follows the VA's existing identity governance instead of a local roster.
Server-side persistence
ImplementedWhat’s real now
A durable, shared system-of-record on AWS S3 sitting behind the REST API — one JSON object per collection with read-modify-write appends and updates. This is real server state shared across users, not browser-local storage.
At contract award
The store is repointed to the VA-designated data services (GovCloud if VA directs); the collection API and persistence contract carry over unchanged.
REST API (/api/v1)
ImplementedWhat’s real now
A documented, versioned REST surface — submissions, determinations, versions, audit, surveys, jobs, exports, auth, and health — each role-gated server-side. The entire UI runs on these endpoints; there is no privileged back channel.
At contract award
Traffic is fronted by the VA API gateway and routed through the Trusted Internet Connection (TIC); the endpoint contracts are unchanged.
Audit & lineage
ImplementedWhat’s real now
An append-only, SHA-256 hash-chained audit log — chain integrity is re-verified on every read, so tampering is evident, not assumed away — plus effective-dated catalog versioning. Every published pay figure carries a source-to-recommendation lineage — survey, vintage, crosswalk, percentile, geographic factor, and reviewer sign-off — so no number is a black box.
At contract award
Audit events stream to the VA's enterprise logging / SIEM for retention and continuous monitoring under the ATO.
Reporting & exports
ImplementedWhat’s real now
RFC 4180-compliant CSV exports generated from live data — benchmarks, occupation catalog, submissions, determinations, and audit — served through the role-gated exports endpoint, not pre-baked files.
At contract award
Export destinations and formats are extended to whatever the VA's reporting and records pipelines require.
Security
ImplementedWhat’s real now
A least-privilege IAM user scoped to Get/Put/List on a single bucket, HTTPS with strict security headers (HSTS, CSP, X-Frame-Options), rate limiting on login and AI endpoints, step-up re-authentication for destructive actions, single-use expiring invite tokens with replay rejection, a password-gated ingest endpoint, and FIPS-capable object storage. Secrets stay server-side and never reach the client bundle.
At contract award
Full Assessment & Authorization (A&A), continuous monitoring, and the VA's vulnerability-management cadence are layered on under VA sponsorship.
Observability
ImplementedWhat’s real now
A live health endpoint reports the real reachability of the API, auth, and the S3 store (bucket and region included), and a public System Status page renders that signal continuously.
At contract award
Health and metrics feed the VA's enterprise monitoring and alerting stack alongside the rest of the authorized boundary.
Multi-tenant / facility scoping
ImplementedWhat’s real now
Facility-scoped users are confined to their own facility's data: the API filters reads to the caller's facility and rejects writes that target any other facility — enforced server-side, not in the UI.
At contract award
Facility-to-coordinator mappings are sourced from VA's authoritative org data instead of the demonstration roster.
AI assistance layer
ImplementedWhat’s real now
A live Claude integration (current Opus-generation model) grounded in a prompt-cached compensation corpus: the Compensation Copilot answers §7451/§7431/Title 5 questions with cited sources, the classification assistant proposes OPM series / pay system / grade / FLSA from a duty log, and the Pay Workbench drafts a complete §7451 local labor-market justification memorandum from the on-screen determination figures. Every feature is authenticated, rate-limited, and framed the same way: the AI screens, sorts, and drafts — a named human decides and signs.
At contract award
The same features run under the VA's AI governance with VA-furnished data grounding the corpus; the human-review contract is unchanged.
VA data intake → publisher submissions
ImplementedWhat’s real now
The contracted flow (Subtasks 2.1–2.3), operable end-to-end: ingest an employee extract, de-identify to counts and rates, screen every record through a classification QA queue with desk routing and analyst disposition of flagged records, then generate each publisher's submission in its own format — five representative templates today, exportable per-file or in bulk.
At contract award
The real VHA extract arrives by secure transfer into the accredited VA-data workroom, and the format library reconciles to each of the ~50 VA-approved publishers' current-year templates.
Demonstrated
Working end-to-end in the live demo; scales out under the contract.
Async job pipeline
DemonstratedWhat’s real now
Survey-cycle, recompute, and export jobs run as tracked work items with live status that the UI polls and renders — the queue → running → complete lifecycle is wired end-to-end.
At contract award
Job execution moves onto scaled, isolated runners sized for full-VHA recompute cycles rather than the demo's single tenancy.
Data architecture
DemonstratedWhat’s real now
A scoped-enclave design in which Federal data flows OUT of the hosted product into a BAA-scoped FIPS enclave — the same architecture the Task 4 narrative describes, demonstrated on the project's real S3-backed store.
At contract award
The enclave is brought under a VA Authorization to Operate per Handbook 6500 and Directive 6517 — VA-owned authorizations that require the contract.
Hosting
DemonstratedWhat’s real now
The demonstration runs on commercial infrastructure today — the web tier on Vercel and the data store on commercial AWS (us-east-1). That is the honest current footprint; nothing here claims a federal enclave.
At contract award
Production migrates to the FedRAMP-authorized AWS environment VA approves (Moderate inherited at the hosting layer; GovCloud if VA directs), off the commercial web tier, inside the VA A&A boundary.
Completed at award
A VA-side authorization that, by design, requires an awarded contract.
VA Authorization to Operate (A&A)
Completed at awardWhat’s real now
The architecture is built for the authorization path — federal data kept out of the hosted product, a FIPS-encrypted enclave pattern, least-privilege access, and a tamper-evident audit trail ready for assessment evidence.
At contract award
The VA sponsors the Assessment & Authorization under Handbook 6500 / Directive 6517 and issues the ATO — a VA-owned decision that can only begin on contract.
VA SSOi / PIV identity
Completed at awardWhat’s real now
The session and RBAC contracts are identity-provider-agnostic by design: swap the seed roster for a federated provider and every downstream permission check is unchanged.
At contract award
VA SSOi / PIV single sign-on with AD-group role mapping replaces the demonstration credentials.
Production environment migration
Completed at awardWhat’s real now
Runs today on commercial AWS (us-east-1) and Vercel — stated plainly on every architecture view. The store, API, and audit contracts are portable by construction.
At contract award
Production moves to the FedRAMP-authorized AWS environment VA approves (Moderate inherited at the hosting layer; GovCloud if VA directs), inside the VA A&A boundary, off the commercial web tier.
VA HR data feeds
Completed at awardWhat’s real now
The intake pipeline runs on a 1,000-record synthetic extract modeled on OPM EHRI/FedScope structure, so the parsing, QA, and aggregation logic is exercised today — and every screen labels VHA-current pay as illustrative until the real extract loads.
At contract award
Annual VHA WMC HR CoE data files (employee salary, duty station, pay schedules) flow in as Government-furnished information per Subtask 2.1, replacing the synthetic data.
What the contractor controls — done
- Identity & access: signed sessions + server-enforced RBAC
- Durable, shared persistence on S3 behind the REST API
- Hash-chained audit log + effective-dated lineage
- Least-privilege IAM, HTTPS, rate limits, gated ingest, FIPS-capable storage
- AI copilot, classification, and §7451 memo drafting — human-decided, live today
What only an award unlocks — VA-owned
- VA Authorization to Operate (ATO) under Handbook 6500 / Directive 6517
- VA SSOi / PIV single sign-on and AD-group role mapping
- Integration with VA-designated data services and the API gateway / TIC
- Enterprise continuous monitoring, SIEM, and the A&A lifecycle
The honest bottom line
Everything the contractor controls is built and running.
The only items that cannot be completed before award are the VA’s own authorizations — the ATO, VA SSOi / PIV, and integration with VA-operated systems. Those are not gaps in the build; they require a contract and VA sponsorship to even begin, and the platform is architected so they slot in without reworking the session, RBAC, persistence, or audit contracts demonstrated here. No holes — and here is precisely what’s implemented.