Loop #1 — Real-Veteran Journey Core (browser closeout)¶

Date: 2026-09-04
Milestone: Core real-veteran coordination journey walkable end-to-end in the product, on prod, on real accounts, no curl
Tag: real-veteran-journey-core-2026-09-04

Distinction from L1-7 keystone (l1-7-keystone-2026-09-03): L1-7 proved the coordination machinery (ledger, §3.1, negatives, denominator) including API/runner closes. This milestone proves the same three-party close is runnable by humans through clickable last1.app UI on real identities.

Walkable journey (prod)¶

Step	Actor	Surface	Action
1	WIN org admin	`/beneficiaries` → create	Create beneficiary record
2	WIN org admin	`/beneficiaries/:id`	Link member account (email) → ties to DD-214-verified Last1 ID (3 green checks on open-loop dialog)
3	WIN org admin	`/beneficiaries/:id`	Enroll in program (e.g. Veteran Employment Services)
4	WIN org admin	`/dashboard` → Open coordination loop	Enter employer work email; loop opens (Λ `open`)
5	WIN org admin	`/dashboard` → loop row Actions	Confirm delivery (deliverer attestation) → Λ `partial`
6	Veteran	`/member/progress`	Coordination loop card → Confirm your placement → Λ `partial`, waiting on employer
7	WIN org admin	`/dashboard` → loop row Actions	Issue employer link → copy/open magic link URL (SendGrid optional)
8	Employer	`/public/hm-attest/:token`	Work email at loop's `@employerDomain` → Confirm hire → Λ `verified`

All steps above are in-product on https://last1.app. No curl required for the happy path.

Real accounts (ED walkthrough fixture)¶

Role	Account	Notes
Delivering org admin	`ryan@warriorsinneed.org`	Warriors In Need
Veteran (recipient)	`curryrg@gmail.com`	DD-214 verified; Last1 ID `2a805b21-5352-4316-bb4b-a5d4f02a8173`
Employer (independent)	`ryan@last1.enterprises`	Path A domain-verified magic link
Program	`e5c80469-5db2-4fcc-a9b0-dae21f07efab`	WIN MOCK Pipeline / VES
Beneficiary	`b33c18d2-44e0-4650-b9d9-a5b6d5f59744`	Ryan-Curry-Demo row

Verified loop (this walkthrough)¶

Field	Value
loopId (prefix)	`8525ca52-…` (full UUID on org dashboard; copy from loop row)
Employer domain (per-loop)	`last1.enterprises` (from `hiring_manager_email` at open-loop, not hardcoded)
Environment	Sovereign prod — `https://last1.app`
Prior API keystone loop	`02fcb8a4-18b4-488b-88ec-34b874a85f8f` (L1-7 runner; see `LOOP1_L1-7_KEYSTONE_CLOSEOUT.md`)

Clickable in product vs still API / deferred¶

In product (this milestone)¶

Capability	UI location	Shipped commit (last1.app)
Open loop (employer email → domain stored)	Dashboard dialog	`28d9d0a`
Veteran loop card (approve/deny placement)	`/member/progress`	`02490c4`
Link beneficiary → member account	Beneficiary detail	`42203af`
Deliverer attestation	Dashboard Confirm delivery	`a3bd878`
Issue employer magic link	Dashboard Issue employer link	employer-attest UI slice
Employer hire confirmation	`/public/hm-attest/:token`	employer-attest UI slice

Still API / tooling (not required for browser happy path)¶

Capability	Why
L17 E2E runner (`coordination:l17-run`)	Negative cases, CI/staging proof
SendGrid employer email	Optional; admin gets URL directly from issue-link dialog
LastVet hub card read	`last.vet-api` proxy to internal loop read; separate surface
Beneficiary invite flow	Next build (not this milestone)
Path B employer accounts / employer pipeline	Deferred §10.5

Domain gate (confirmed per-loop)¶

Employer attestation domain is not hardcoded to last1.enterprises.

Open loop: WIN enters any non-public employer email → server derives hiring_manager_domain via assertEmployerEmailAllowed (rejects gmail.com, etc.).
Issue token: Magic link token bound to independent_domain:{loop.hiringManagerDomain}.
Attest page: GET /api/public/hm-attest/:token returns employerDomain: context.loop.hiringManagerDomain; UI and POST /public/hm-attest/:token enforce match.

Example: loop opened with manager@acme-corp.com → attest page requires @acme-corp.com. Ryan's walkthrough shows @last1.enterprises because that was the employer email on this loop.

last1.app commits in this arc¶

Commit	Deliverable
`02490c4`	Veteran coordination loop card
`42203af`	Org-admin link member account
`a3bd878`	Confirm delivery (deliverer) button
employer-attest slice	Issue employer link + `/public/hm-attest/:token`

Repo tags¶

Repo	Tag	Notes
`last1.app`	`real-veteran-journey-core-2026-09-04`	Journey UI + public employer attest
`lastvet-gates`	`real-veteran-journey-core-2026-09-04`	This closeout
`last.vet-api`	`real-veteran-journey-core-2026-09-04`	Hub card proxy (unchanged since L1-7; tag marks journey milestone)
`muster`	`real-veteran-journey-core-2026-09-04`	Tracker item marked done

Next build (explicitly out of scope)¶

Beneficiary invite flow — separate prompt. Core journey assumes org admin links an existing verified member account by email.