Loop #1 L0 — Definition of Done Report¶
Date: 2026-09-02 (updated: L1 entry closeout)
Status: L0 CLOSED · L1-entry CLOSED — coordination loop build awaiting plan approval
Architecture: last1.id-owned verification (pre-product gate) with two methods → same verified status; DD-214 file in LastVet encrypted storage; last1.id stores outcome + opaque document_ref only
Confirmed L0 shape¶
| Layer | Delivered |
|---|---|
| Verification capability | last1.id — dual method (va_confirmation | dd214), method-agnostic veteran_verified credential, two-pathway DD-214 review routing |
| Primary surface (DD-214) | auth.last1.id → Credentials → Verify (POST /api/veteran-confirmation/dd214) — last1.id session, pre-product |
| Primary surface (status in LastVet) | last.vet-ios — read-only status + deep link to Last1 ID; VA form still proxied via LastVet for sandbox |
| Document storage | last.vet-api internal verification write — encrypted DD-214 on first upload; writable before product access |
| API proxy (status / VA only) | last.vet-api — /api/veteran/verification/{status,confirm} → last1.id internal API; product DD-214 route retired (410) |
| Human review Pathway 1 | last1.app org-settings Verification tab — org that invited the veteran reviews flagged DD-214 |
| Human review Pathway 2 | last1-admin Last1 ID → DD-214 Reviews — platform admin queue for independent veterans |
| Gate consumer | last1.app — existing last1VerificationService; reads method-agnostic veteran_verified |
Explicitly not built: loop card, full coordination dashboard, L1 coordination_* tables, OCR/ML forgery detection.
Two verification methods¶
| Method | Path | When |
|---|---|---|
| A — DD-214 | last1.id verification → upload → LastVet encrypted storage (opaque ref on last1.id) → parser → auto-confirm OR flag → human review | Interim primary (real veterans now) |
| B — VA Confirmation API | Existing VCA form path | Swap-in when VA production approved; choice for veterans with VA account |
Either method sets the same veteran_verified credential. identity_veteran_confirmations.method records the source (va_confirmation | dd214).
Two-pathway DD-214 review routing¶
| Pathway | Veteran type | Flagged DD-214 routes to | Review surface |
|---|---|---|---|
| 1 | Org-invited (WIN invite → last1.app accept-invite) | That org's admin | last1.app → Org Settings → Verification |
| 2 | Independent (self-created last1.id, no org invite) | Last 1 platform admin | last1-admin → Last1 ID → DD-214 Reviews |
Provenance on confirmation record: reviewer_type (org_admin | platform_admin), reviewing_org_id (Pathway 1 only), acquisition_channel (org_invite | independent), reviewed_by_identity_id after human confirm.
Routing resolves at flag time via last1.app beneficiary/invite lookup (GET /api/internal/from-last1id/veteran-acquisition/:identityId).
L0 DoD checklist¶
| Criterion | Status |
|---|---|
Method-agnostic veteran_verified |
Done — active credential from VCA OR DD-214 (auto or human) |
method field on confirmation record |
Done — migration 20260902130000_veteran_confirmation_dual_method.sql |
| Two-pathway review routing + provenance | Done — migration 20260902140000_dd214_review_routing.sql |
| LastVet iOS status + Last1 ID deep link | Done — Title38VerificationView (no product-side DD-214 upload) |
| DD-214 upload → parse → auto/flag | Done — POST /api/veteran-confirmation/dd214 (last1.id) → LastVet internal storage + dd214Parser.ts |
| Org-admin flagged review (Pathway 1) | Done — last1.app Verification tab |
| Platform-admin flagged review (Pathway 2) | Done — last1-admin DD-214 Reviews + last1.id admin API |
| VA API path preserved (Method B) | Done — unchanged proxy to VCA |
Real veteran can reach verified without VA API |
Proof target — DD-214 auto-parse OR human review |
| Ryan Pathway 2 walkthrough | Done — curryrg@gmail.com, platform-admin confirm (2026-09-02) |
L1 entry — login + verification gate (CLOSED 2026-09-02)¶
Scope: Last1 ID login replaces VA front door; verified veterans reach LastVet main tabs; unverified blocked. Not the coordination loop keystone.
| Criterion | Status | Evidence |
|---|---|---|
| Last1 ID OAuth entry (not VA login first) | Done | last.vet-ios Last1IDAuthManager → auth.last1.id/oauth/authorize?client_id=lastvet |
| Verification gate enforced | Done | AuthManager.isVeteranVerified; main tabs gated until confirmed |
| VA auto-popup removed | Done | 48c22e4 — no Service History prompt on onboarding / App Lock |
| LastVet API session mint | Done | POST /api/auth/last1/veteran/callback prod (201bb3c) |
| Google OAuth branding (Last1 ID, not RealOutcomes) | Done | GoTrue client 322031692113-…; see AUTH_VM_L1_ENTRY_CONFIG.md |
| E2E on verified account | Done | curryrg@gmail.com — DD-214 Pathway 2, simulator sign-off |
Closeout record: L1_ENTRY_CLOSEOUT_2026-09-02.md · suggested tag l1-entry-2026-09-02 on lastvet-gates.
Next increment: LOOP1_COORDINATION_LOOP_BUILD_PLAN.md (scope only) → Ryan approval → L1 loop build.
Positive path A — DD-214 auto-confirm (real veterans NOW)¶
- Unverified veteran signs in at auth.last1.id.
- Opens Credentials → Verify veteran status → DD-214 upload.
- PDF lands in LastVet encrypted document storage on first upload; last1.id receives opaque
document_ref+ parser outcome only. - Parser returns high confidence, no critical flags (and
DD214_AUTO_CONFIRM_ENABLED=trueif testing auto) → last1.idstatus=confirmed,method=dd214,review_path=auto. veteran_verifiedcredential issued → LastVet/last1.app product access gates pass.
Positive path A′ — DD-214 human confirm (Pathway 1, org-invited)¶
- Steps 1–4 as above; parser flags uncertainty →
status=pending_review,reviewer_type=org_admin. - Inviting org admin opens last1.app → Org Settings → Verification → DD-214 reviews.
- Reviews parser flags → Confirm veteran.
- last1.id
status=confirmed,method=dd214,review_path=human,reviewer_type=org_admin→veteran_verified=true.
Positive path A″ — DD-214 human confirm (Pathway 2, independent — Ryan test)¶
- Reset test account:
npx tsx scripts/reset-veteran-verification-by-email.ts curryrg@gmail.com(last1.id). - Confirm
DD214_AUTO_CONFIRM_ENABLED=falseon last1.id (and LastVet if mirrored). - At auth.last1.id/credentials, upload DD-214 → file to LastVet storage → parser flags → routes to platform-admin queue.
- Ryan opens admin.last1.enterprises → Last1 ID → DD-214 Reviews → Confirm.
- Outcome:
method=dd214,review_path=human,reviewer_type=platform_admin,acquisition_channel=independent→ then LastVet/last1.app access.
Positive path B — VA API (when production-approved)¶
- Veteran chooses Verify with VA → enters name/DOB/ZIP.
- VCA confirms →
method=va_confirmation→ sameveteran_verified.
Negative path (documented walkthrough)¶
- DD-214 upload with unreadable PDF → flagged → pending review (not self-verified).
- Reviewer rejects →
not_confirmed, noveteran_verified. - VA sandbox fails for real veteran → veteran can switch to Method A.
Breaking change note (updated)¶
Removed: auto-issuing veteran_verified on LastVet app link alone.
Removed: hardcoded WIN-only review routing (DD214_REVIEW_ORG_SLUG).
Fixed: veteran_verified no longer requires VCA specifically. Either verification method suffices.
Environment variables¶
| Service | Variable | Purpose |
|---|---|---|
| last1.id | VA_VETERAN_CONFIRMATION_API_KEY |
VA sandbox/prod API key (Method B) |
| last1.id | VA_VCA_MOCK_MODE |
Local/test without VA key |
| last1.id | LAST1_APP_SECRET, LAST1_APP_API_BASE |
Acquisition lookup from last1.app |
| last.vet-api | LASTVET_APP_SECRET, LAST1_ID_API_BASE |
Proxy auth to last1.id |
| last.vet-api | DD214_AUTO_CONFIRM_ENABLED |
Defaults false (human-first). Set true to opt in to auto-confirm when parser marks eligible |
| last1.id | LASTVET_INTERNAL_ADMIN_SECRET, LASTVET_API_BASE |
DD-214 document proxy for review panels |
| last1.app | LAST1_APP_SECRET, LAST1_ID_API_BASE |
Org review API proxy + acquisition endpoint auth |
L0 + L1-entry closed. Coordination loop keystone: review LOOP1_COORDINATION_LOOP_BUILD_PLAN.md before any L1 loop code.