Technology Diligence Pack

Field	Value
Status	live (baseline pack - first 5 documents authored in dataroom PR-2)
Owner	DIR / INFRA
Applies to	The CTO / technology due-diligence pack: the narrative technical story behind Partile's controls, policies, and registers.
Last updated	2026-06-14
Review cadence	Per-PR when a document's subject changes (upkeep rule below); full pass annually once the platform stabilizes.

Purpose

Give a diligence team, an enterprise security reviewer, or a prospective CTO hire a faithful current-state picture of the Partile platform: what exists, how it works, what evidence backs it, and what is knowingly incomplete. The tone is diligence, not pitch - "this is what exists, this is the evidence, these are the gaps." It complements the controls/policies/registers; it does not duplicate them.

Navigation tip: the static data-room intranet (../intranet/index.html, open from disk) lists this pack as its "Technology diligence" entry point alongside the control register, registers, and product docs. The Markdown here remains canonical.

Honest scope (what is and is not true today)

Current platform state, by idea worktree:

• infra through PR-30 - backend (FastAPI/Postgres/Redis + worker) with block/report enforcement, retention sweeps, shared Redis-backed rate limiting, account erasure, cross-user authz regression coverage, and LinkedIn signed id_token JWKS verification implemented and smoke-verified locally. PR-17 adds the consent-gated event foundation (user_consents, app_events, emit_event); PR-18 wires auth/presence/match/safety product hookpoints through try_emit_event; PR-19 adds worker match.candidate_proposed / match.expired hookpoints as actor-scoped T1 rows; PR-20 adds the k-anonymous T2 snapshot boundary; PR-21 implements the backend boarding-pass-gated /presence contract and rejects manual/self-reported/unverified product presence; PR-22 implements backend message send and metadata-only message.sent; PR-23 implements the in-window directory; PR-24 implements request-with-note connection requests and connection lifecycle events; PR-25 implements professional profile fields and intent tags; PR-26 implements internal-signal relevance ranking; PR-27 implements key-gated cached Claude match rationale; PR-28 implements key-gated advisory Claude profile interview; PR-29 implements the persistent accepted-connections list. PR-30 adds tagged pre-launch mock seed/purge tooling (users.is_seed) for production-like testing, with purge verification before GA. Post-PR-20 hotfix c91bd0f aligns the LinkedIn OIDC issuer default to current provider metadata after the first iPhone auth smoke exposed the drift. Actual model training is still future.
• mobile through PR-26 - React Native client; the API seam preserves 429 + Retry-After, block/report safety UI is implemented, Android EAS development-build profiles plus an emulator/device QA checklist exist, and the app now exposes consent privacy choices for analytics, ml_training, and marketing. Mobile PR-14 adds the iOS EAS dev-build/auth-smoke checklist; on 2026-06-08 the physical iPhone EAS development build installed and real LinkedIn partile:// auth/deep-link smoke passed after infra hotfix c91bd0f. Mobile commit a820543 records the iOS exempt-encryption Info.plist declaration and checklist note. Mobile PR-15 adds the boarding-pass UI/state gate, removes manual presence creation, and fresh-checks presence before candidate/conversation product requests. Mobile PR-16 adds camera barcode scan, on-device BCBP parsing, sanitized confirmation, and document-verified presence creation without raw barcode retention. Mobile PR-17 adds Photos/Files image import through local barcode decode, the same confirmation/submission path, cache-copy cleanup, and fail-closed unsupported/ PDF/non-image states. Mobile PR-18 physically verifies the iPhone product path (auth, boarding-pass gate/no skip, camera preview, non-flight barcode failure, safe synthetic boarding-pass barcode -> sanitized confirm -> verified presence -> unlock, image import, cancel/no-barcode/PDF fail-closed) and fixes the scanner preview hard gate by removing premature CameraView.isAvailableAsync() failure while preserving sanitized onMountError. Mobile PR-19 adds the first automated parser QA: synthetic BCBP fixtures plus npm run test:parser, proving valid derived-only output, fail-closed invalids, default TTL, and no raw payload/PII fields in parser results or test output. Mobile PR-20 adds the stable QA selector/screen-state contract: centralized non-sensitive testIDs, npm run test:selectors, and docs/mobile-qa-selectors.md covering auth, Home, boarding-pass gate, scan/import/confirm, locked/unlocked product surfaces, and safety/report controls without product behavior changes. Mobile PR-21 adds hard-gated local/dev automation seams (__DEV__ plus EXPO_PUBLIC_PARTILE_QA_AUTOMATION=1): in-memory QA sign-in, synthetic scan/import controls, an in-memory presence/API seam for the gated MVP, and npm run test:automation. The flag is default-off and absent from EAS/app config, so the seam is not a beta/product bypass. Mobile PR-22 adds the first app-specific Maestro E2E scaffold (.maestro/) plus npm run test:maestro static validation for QA sign-in, gate-locked, valid scan/import unlock, and fail-closed negative paths. Mobile PR-23 implements message composer/send; PR-24 implements the directory screen plus local-only stars; PR-25 implements request-with-note, incoming/outgoing requests, accept-to-conversation, and block/report on directory plus incoming-request cards; PR-26 implements profile headline/summary/intent-tag editing. Live Maestro execution, Android install/manual QA, mobile AI interview UI, and propose-to-meet remain operator-owned/future.
• ops through the GCP production stack plus selfheal PR-1 - partile-ops: infra/envs/prod-gcp/ defines the live production runtime in partile-prod / europe-west2: Cloud Run API, scheduled Cloud Run Jobs, Cloud SQL PostgreSQL private IP with backups/PITR, Memorystore Redis on the private VPC, Secret Manager, dedicated service accounts, GCS remote state, Artifact Registry, and Cloudflare Worker origin rewrite for api.partile.app. selfheal PR-1 adds the private remediation-responder Cloud Run service in SHADOW mode (ENFORCE=false), alert delivery from Cloud Monitoring through partile-prod-remediation-alerts, least-privilege responder/Push invoker service accounts, and the keyless partile-control director prod-access path with the otto process-separation caveat tracked as an open action. The earlier AWS ECS/Fargate staging path is superseded / not adopted; its account-level RunTask blocker no longer blocks production.
• cloudflare through PR-5 plus live publication consistency update - a dev API tunnel still exists for local/manual auth testing; production API traffic uses the ops-tracked Cloudflare Worker at api.partile.app; the data-room intranet is published at dataroom.partile.app through Cloudflare Pages and protected by Cloudflare Access.
• GCP production exists, but no real user data, no operational SLO/on-call process, no completed third-party pentest, and no SOC 2 / ISO 27001 certification. Current production is a low-cost MVP posture; HA upgrades, restore drills, staging-before-GA, seed purge-before-GA, remediation shadow-to-enforce, and control-plane identity hardening are open items.

Documents

#	Document	Status	Covers
1	architecture-overview.md	live	Components, request/worker flows, trust boundaries
2	data-architecture.md	live	Persisted data classes, Redis ephemera, retention/erasure, event/ML boundary
3	security-architecture.md	live	Auth/session, authz, intake hardening, rate limiting, safety, secrets/TLS, gaps
4	infrastructure-and-deployment.md	live	Local/dev, GCP production, Cloudflare API/data-room edges, superseded AWS path, open items
5	sdlc-and-quality.md	live	Atelier workflow, review/release discipline, test/smoke strategy, quality gaps
6	availability-and-operations.md	planned	SLOs, restore drills, HA/DR, on-call/runbooks (deferred - needs operational maturity)
7	ml-platform.md	planned	Event pipeline, consent gating, anonymization boundary, model lifecycle
8	scalability-plan.md	planned	Capacity model toward 1M users; datastore scaling

Documents 6-8 are deliberately not written yet: availability/ops needs restore-drill, SLO/on-call, and HA decisions to mature, and ML/scalability need firmer event/capacity assumptions. They remain planned follow-ons.

Reading order

1. architecture-overview.md - the map.
2. data-architecture.md - what data exists and how it is governed.
3. security-architecture.md - how it is protected and where it is not yet.
4. infrastructure-and-deployment.md - where it runs (and what is blocked).
5. sdlc-and-quality.md - how changes land and how quality is assured.

Relationship to the rest of the data room

The pack references, it does not re-author. Each document links to the control register (../control-register.md), the relevant policies (../policies/*.md), procedures (../procedures/*.md), registers (../registers/*.md), the evidence register (../evidence/evidence-register.md), and - by path label - the director-root readiness narratives (readiness/*.md, which live outside this worktree by design).

Upkeep rule

When a PR materially changes a subject covered here (architecture, data model, security posture, deployment, or the development process), the author updates the relevant document's Current State / Evidence / Known Gaps sections and its Last updated date - same per-PR discipline as the control register (../policies/change-management-policy.md).

No-secrets reminder

This pack is Tier 1 (Git-safe). No secrets, credentials, .env values, token-bearing URLs, OAuth/handoff codes, full ARNs, raw cloud JSON, image digests, or raw account identifiers. Safe labels (DATABASE_URL, REDIS_URL, APP_ENV, RATE_LIMIT_*) are fine; values are not. Public project DNS names (e.g. the dev tunnel hostname) may appear as already-public context. See ../policies/data-classification-and-handling-policy.md.