Production Readiness
What's real, what's demonstrated, and what happens at award.
An honest accounting. The platform is a working, access-controlled, server-persistent system today — signed sessions, server-enforced roles, durable S3-backed storage, a documented REST API, and an append-only audit trail are all running now. The only items left to complete are VA-side authorizations that, by design, can happen only on an awarded contract with VA sponsorship.
Built and running now — code in the repo, enforced at runtime.
Working end-to-end in the live demo; scales out under the contract.
A VA-side authorization that, by design, requires an awarded contract.
Implemented
Built and running now — code in the repo, enforced at runtime.
Authentication
ImplementedWhat’s real now
Signed session cookies (HMAC-SHA256 over a JSON payload), scrypt-hashed credentials with timing-safe comparison, httpOnly + Secure cookies, and 8-hour expiring sessions. Verified server-side on every protected request.
At contract award
The seed roster is replaced by the VA's identity provider — VA SSOi / PIV single sign-on. The session and RBAC contract underneath is unchanged.
Role-based access control
ImplementedWhat’s real now
Four production roles — Platform Admin, VA HR Specialist (OCHCO), Facility Survey Coordinator, VA Observer — plus an anonymous guest. A typed permission model is enforced server-side in the API routes via a single can() check; the UI only mirrors it. Facility coordinators are data-scoped to their own facility.
At contract award
Role assignment is mapped to VA Active Directory groups, so access follows the VA's existing identity governance instead of a local roster.
Server-side persistence
ImplementedWhat’s real now
A durable, shared system-of-record on AWS S3 sitting behind the REST API — one JSON object per collection with read-modify-write appends and updates. This is real server state shared across users, not browser-local storage.
At contract award
The store is repointed to the VA-designated GovCloud data services; the collection API and persistence contract carry over unchanged.
REST API (/api/v1)
ImplementedWhat’s real now
A documented, versioned REST surface — submissions, determinations, versions, audit, surveys, jobs, exports, auth, and health — each role-gated server-side. The entire UI runs on these endpoints; there is no privileged back channel.
At contract award
Traffic is fronted by the VA API gateway and routed through the Trusted Internet Connection (TIC); the endpoint contracts are unchanged.
Audit & lineage
ImplementedWhat’s real now
An append-only audit log plus effective-dated catalog versioning. Every published pay figure carries a source-to-recommendation lineage — survey, vintage, crosswalk, percentile, geographic factor, and reviewer sign-off — so no number is a black box.
At contract award
Audit events stream to the VA's enterprise logging / SIEM for retention and continuous monitoring under the ATO.
Reporting & exports
ImplementedWhat’s real now
RFC 4180-compliant CSV exports generated from live data — benchmarks, occupation catalog, submissions, determinations, and audit — served through the role-gated exports endpoint, not pre-baked files.
At contract award
Export destinations and formats are extended to whatever the VA's reporting and records pipelines require.
Security
ImplementedWhat’s real now
A least-privilege IAM user scoped to Get/Put/List on a single bucket, HTTPS throughout, a password-gated ingest endpoint, and FIPS-capable object storage. Secrets stay server-side and never reach the client bundle.
At contract award
Full Assessment & Authorization (A&A), continuous monitoring, and the VA's vulnerability-management cadence are layered on under VA sponsorship.
Observability
ImplementedWhat’s real now
A live health endpoint reports the real reachability of the API, auth, and the S3 store (bucket and region included), and a public System Status page renders that signal continuously.
At contract award
Health and metrics feed the VA's enterprise monitoring and alerting stack alongside the rest of the authorized boundary.
Multi-tenant / facility scoping
ImplementedWhat’s real now
Facility Survey Coordinators are confined to their own facility's data: the submissions API filters reads to the caller's facility and rejects writes that target any other facility — enforced server-side, not in the UI.
At contract award
Facility-to-coordinator mappings are sourced from VA's authoritative org data instead of the demonstration roster.
Demonstrated
Working end-to-end in the live demo; scales out under the contract.
Async job pipeline
DemonstratedWhat’s real now
Survey-cycle, recompute, and export jobs run as tracked work items with live status that the UI polls and renders — the queue → running → complete lifecycle is wired end-to-end.
At contract award
Job execution moves onto scaled, isolated runners sized for full-VHA recompute cycles rather than the demo's single tenancy.
Data architecture
DemonstratedWhat’s real now
An AWS GovCloud-pattern design in which Federal data flows OUT of the hosted product into a BAA-scoped FIPS enclave — the same architecture the Task 4 narrative describes, demonstrated on the project's real S3-backed store.
At contract award
The enclave is brought under a VA Authorization to Operate per Handbook 6500 and Directive 6517 — VA-owned authorizations that require the contract.
Hosting
DemonstratedWhat’s real now
The demonstration runs on commercial infrastructure today — the web tier on Vercel and the data store on commercial AWS (us-east-1). That is the honest current footprint; nothing here claims a federal enclave.
At contract award
Production migrates to AWS GovCloud (US) — FedRAMP High infrastructure inheritance — and off the commercial web tier, inside the VA A&A boundary.
Completed at award
A VA-side authorization that, by design, requires an awarded contract.
What the contractor controls — done
- Identity & access: signed sessions + server-enforced RBAC
- Durable, shared persistence on S3 behind the REST API
- Append-only audit log + effective-dated lineage
- Least-privilege IAM, HTTPS, gated ingest, FIPS-capable storage
What only an award unlocks — VA-owned
- VA Authorization to Operate (ATO) under Handbook 6500 / Directive 6517
- VA SSOi / PIV single sign-on and AD-group role mapping
- Integration with VA-designated GovCloud data services and the API gateway / TIC
- Enterprise continuous monitoring, SIEM, and the A&A lifecycle
The honest bottom line
Everything the contractor controls is built and running.
The only items that cannot be completed before award are the VA’s own authorizations — the ATO, VA SSOi / PIV, and integration with VA-operated systems. Those are not gaps in the build; they require a contract and VA sponsorship to even begin, and the platform is architected so they slot in without reworking the session, RBAC, persistence, or audit contracts demonstrated here. No holes — and here is precisely what’s implemented.