Skip to content

Loop #1 L1-7 — ED Keystone Walkthrough (staging)

Ryan drives all three parties to close one real three-party verified placement loop. No test-mode bypass. Cursor prepares; Ryan runs.

Prerequisites

Item Value / action
last1.app Sovereign prod at https://last1.app (loops live here)
last.vet-api staging https://api-staging.last.vet
Org admin ryan@warriorsinneed.org (WIN delivering org)
Veteran curryrg@gmail.com (L0 verified, Last1 ID linked)
Employer email ryan@last1.enterprises (domain you control; Path A attestation)
Migration coordination_* tables applied
Program ID e5c80469-5db2-4fcc-a9b0-dae21f07efab (Warriors in Need MOCK Pipeline)
Beneficiary ID b33c18d2-44e0-4650-b9d9-a5b6d5f59744 (curryrg@gmail.com under WIN)
Veteran Last1 ID 2a805b21-5352-4316-bb4b-a5d4f02a8173 (hub card proxy key)
Fixtures seed Already present; re-run npm run demo:win-ed only if missing

Apply L1 migration (if not done)

# From lastvet-gates
bash scripts/last1app/apply-coordination-loop1-migration.sh

Seed ED fixtures

cd last1.app
npm run demo:win-ed

Captures programId, beneficiaryId from output (Ryan-Curry-Demo beneficiary).

Deploy L1-1..L1-6 code

  • last1.app: L1 code deployed to last1app-app (2026-09-03). Coordination routes return JSON (401 without session). Internal read route registered for hub card proxy.
  • last.vet-api staging: GET /api/veteran/me/job-placement-loop live. BWS env restored; LAST1_APP_API_BASE + LAST1_APP_SECRET set on VM.

Re-deploy last1.app after local changes (git SHA, not rsync):

ssh ryan@192.168.1.104 'bash /opt/last1app/scripts/deploy-from-git.sh origin/main'

See last1.app docs/deploy-from-git.md. Do not rsync a laptop tree to /opt/last1app/src.

ED-test wiring: LastVet hub card → last1.app

The hub card calls GET /api/veteran/me/job-placement-loop on last.vet-api, which proxies:

GET https://last1.app/api/internal/coordination-loop/by-last1id/:last1idSubject

Auth: Authorization: Bearer $LAST1_APP_SECRET (must match last1.app runtime LAST1_APP_SECRET).

BWS status (confirmed 2026-09-03)

BWS key Runtime var Value
LASTVET_R940_STAGING_LAST1_APP_API_BASE LAST1_APP_API_BASE https://last1.app
LASTVET_R940_STAGING_LAST1_APP_SECRET LAST1_APP_SECRET Same as LAST1APP_APP_PROD_LAST1_APP_SECRET (64 chars)
LASTVET_R940_PROD_LAST1_APP_API_BASE LAST1_APP_API_BASE https://last1.app
LASTVET_R940_PROD_LAST1_APP_SECRET LAST1_APP_SECRET Same as above

Source secret: LAST1APP_APP_PROD_LAST1_APP_SECRET (last1-radiocheck + lastvet BWS).

Re-sync script (idempotent):

bash lastvet-gates/scripts/lastvet/sync-last1app-coordination-read-bws.sh

On lastvet-api VM (done 2026-09-03):

sudo /opt/lastvet-gates/scripts/restore-lastvet-api-env-from-bws.sh --env staging
sudo systemctl restart lastvet-api-staging

Verify env contains (values redacted):

grep -E '^(LAST1_APP_API_BASE|LAST1_APP_SECRET)=' /etc/lastvet-api/lastvet-api-staging.env

Preflight (from last1.app with DATABASE_URL):

cd last1.app
LAST1_APP_SECRET=<from BWS> npx tsx --env-file=.env scripts/coordination-loop-l17-preflight.ts

Runnable walkthrough

Print curl steps (fixture UUIDs pre-filled):

cd last1.app
PROGRAM_ID=e5c80469-5db2-4fcc-a9b0-dae21f07efab \
BENEFICIARY_ID=b33c18d2-44e0-4650-b9d9-a5b6d5f59744 \
node scripts/coordination-loop-e2e-staging.mjs

Negative cases:

PROGRAM_ID=e5c80469-5db2-4fcc-a9b0-dae21f07efab \
BENEFICIARY_ID=b33c18d2-44e0-4650-b9d9-a5b6d5f59744 \
node scripts/coordination-loop-e2e-staging.mjs --negative

Happy path (Ryan drives)

  1. Open loop — org admin → POST /api/coordination-loops → open
  2. Deliverer — POST .../attest/deliverer {confirmed} → partial
  3. Recipient — veteran session → POST .../attest/recipient {confirmed} → partial
  4. Issue HM token — org admin → POST .../issue-hm-token → copy magicLinkUrl (email optional)
  5. Independent — GET + POST /public/hm-attest/:token with attester_email at employer domain → verified

Verify close

npx tsx --env-file=.env scripts/verify-coordination-hash-chain.ts $LOOP_ID
curl -sS 'https://last1.app/api/coordination-loops/denominator' -H 'Cookie: ...' | jq

Check:

  • lambda_state=verified, terminal_at set
  • Hash chain PASS
  • Denominator: attempted +1, verified +1
  • /member/progress + LastVet hub card show verified
  • /dashboard CoordinationLoopOrgPanel shows verified

Negative path (prove machinery)

Case Steps Expected Λ
§3.1 block deliverer confirmed → issue-hm-token before veteran confirms 403 INDEPENDENT_TOKEN_BLOCKED
Lapse deliverer {denied} lapsed
Contradiction deliverer {confirmed} + recipient {denied} contradicted

Use separate loop IDs for each negative case.

UI shortcuts (same auth sessions)

Party Surface
Org admin https://last1.app/dashboard — Coordination loops panel + denominator
Veteran https://last1.app/member/progress — placement panel + Confirm
Independent Magic link URL from step 4
Veteran (mobile) LastVet Home → Job placement loop card

Keystone proof

Ryan runs the happy path once end-to-end with real sessions. Success = one loop at verified with intact hash chain, honest denominator increment, and all three read surfaces showing the close.

STOP after Ryan completes the run. Public ledger / anchor (architecture §5) is deferred.