Opportunity Relay Bilingual lead-response systems for U.S. service businesses Get a 3-point lead-flow review

Operational system · isolated synthetic documents · no client-result claim

Source-to-Record Workbench

Turn a field document into a reviewable operations record—without losing the line, amount, or ambiguity that produced each field.

Inspect the operational frame
Supported
Delivery note · work order
Field states
Verified · review · missing · rejected
Evidence
Page · line · character region
Last reviewed

Operational frame / 01

The delay is not extraction. It is deciding what the office can trust.

Buyer

Field-service operations

Office, dispatch, receiving, and accounting teams re-keying delivery notes and work orders after a job is accepted.

Operational delay

Source re-checking

A person must reopen the document when a job reference, amount, date, or duplicate looks wrong—often after the record has already moved.

Source of truth

Document + evidence

The proposed record never replaces its source. Every populated field keeps an exact, inspectable region and reason.

Reviewed output

Approved JSON + CSV

Exports include field status, original proposal, reviewer correction, and evidence only after explicit source comparison.

Human boundary

No silent choice

Ambiguity, missing values, arithmetic conflicts, duplicate IDs, and hostile instructions stop or route to review.

Controlled delivery

Signed downstream outbox

Approved records enter a durable queue with stable event IDs, leases, receipts, retry, cancellation, and rollback state for the configured destination.

Isolated public tour / 02

Compare the document. Correct the record. Approve the boundary.

Use synthetic or de-identified text only. Do not enter customer names, real addresses, credentials, medical data, access codes, or confidential work notes.

Six pinned documents

Choose the failure boundary you want to inspect.

All samples are synthetic and discarded after the response.
Paste a synthetic tour document

This isolated tour accepts one plain-text sample up to 6,000 characters and stores nothing. Authenticated Operations separately accepts governed PDF, JPG, PNG, or TXT documents up to 20 pages and 100,000 extracted characters.

Record stateReady

Ready. Choose a synthetic scenario or enter bounded fictional text.

Document type
Not classified
Identifier
Not proposed
Validation
0/0
Evidence coverage
0/0

Source / immutable

Synthetic document

text/plain · page 1

No source region selected.

Choose a synthetic scenario or enter bounded fictional text. The source will appear here without persistent browser storage.

Proposed / editable

Closed record

schema v1

Select a scenario to inspect field state, reason, source coordinates, and reviewer corrections.

    Deterministic boundary

    Validation checks

      Local audit trail

      Correction history

      No correction, approval, or handoff event has been recorded.

        Human release gate

        Reviewed output remains locked.

        Technical trace + retention
        Trace ID
        Not created
        Source fingerprint
        Not created
        Local latency
        Not measured
        Contract versions
        Not loaded
        Public-tour provider
        Not invoked · tokens not applicable
        Public retention
        Not persisted · reload clears local state
        External writes
        0
        Public-tour URL fetching
        Blocked by design

        Portfolio evidence ledger

        Evidence, production controls, and release assurance.

        Isolated public tour · fictional or synthetic data · operational controls verified separately.

        Exact role
        Designed and implemented secure file preflight, mandatory malware-scan integration, local text/OCR extraction, the closed schema, exact-evidence validation, encrypted durable review states, role-based approval, controlled export, and signed downstream outbox.
        Human boundary
        A person compares every proposal with exact source evidence, resolves ambiguity and conflicts, and explicitly approves the reviewed record before export or signed downstream delivery.

        Evidence in the build

        Evidence rule
        Exact substringA retained field must point to matching source text.
        Output shape
        Closed schemaUnexpected fields do not enter the reviewed record.
        Export state
        Human controlledNeither the tour nor operational service exports an unreviewed result.
        Operational record
        Encrypted + versionedSource, proposal, corrections, approvals, outbox, and receipts survive restart without clear-text document content.
        File intake
        Scan before extractionProduction ingestion requires valid type and structure plus a clean malware result before embedded text or OCR can run.
        Downstream delivery
        Signed + idempotentOnly approved records enter the durable webhook outbox with leases, receipts, explicit retry, cancellation, and rollback state.

        Tests actually run

        1. 27/27Focused domain and HTTP tests

          Covered extraction, evidence, deterministic validation, input boundaries, and no-write HTTP behavior.

        2. 272/272Complete unit suite

          Completed in the documented Task 03 implementation run.

        3. 13/13Pinned evaluation fixture contracts

          Expected outcomes also passed 13/13 with no external provider call.

        4. 94/94Deterministic evaluation rule outcomes

          The same saved run also reconstructed 150/150 evidence regions and passed 5/5 fail-closed cases.

        5. 13/13Focused browser and portfolio gate

          Eight dedicated workbench tests plus five adjacent portfolio and migration checks.

        Production controls implemented

        • Authenticated workspace intake validates declared type, MIME, magic bytes, file size, PDF structure, page count, image dimensions, and a safe generated filename before extraction.
        • A mandatory malware scanner fails closed on stale signatures; local PDF text extraction and image/PDF OCR share one total deadline and run only after a clean result.
        • The original binary, source text, proposal, corrections, resolutions, outbox payloads, and receipts are encrypted in a durable private SQLite store and removed together at retention expiry.
        • A durable reservation precedes scanner, extractor, and provider work; stable provider IDs, bounded attempts, abort propagation, and expiry recovery make restart and retry safe.
        • Operator, reviewer, and administrator roles enforce original access, corrections, conflict resolution, approval, rejection, export, and delivery through optimistic versions and an HMAC-verified audit chain.
        • Only an approved record can enter the durable signed-webhook outbox; delivery uses stable events, bounded leases, receipts, Retry-After-aware backoff, explicit retry, cancellation, and rollback state.

        Enforced production activation gates

        • File intake refuses to start unless the configured malware scanner and the required local extraction or OCR runtime are healthy.
        • OCR-derived fields remain in human review until exact source evidence is reconstructed; ambiguous or malformed documents release no record.
        • The readiness gate verifies signed activation evidence and requires managed encryption, authenticated roles, current scanner health, approved extraction policy, off-site recovery proof, monitoring, and an approved downstream mapping.

        Architecture / 03

        A document adapter may propose. The release contract still decides.

        1. 01

          Authenticate + inspect

          Bind a supported document of up to 20 pages to one workspace, verify MIME and magic bytes, enforce byte/page/pixel/character limits, and require a clean malware scan.

        2. 02

          Extract + propose

          Use embedded PDF text or local English/Spanish OCR page by page, then map explicit source literals into a versioned closed schema.

        3. 03

          Bind the evidence

          Attach reconstructable source coordinates to every populated field; OCR-derived values remain in review.

        4. 04

          Validate + review

          Run deterministic checks, retain encrypted corrections and resolutions, and enforce optimistic record versions and reviewer roles.

        5. 05

          Approve + deliver

          Unlock JSON or CSV only after approval, then use the durable signed-webhook outbox with receipts and explicit retry.

        Validation rules / 04

        A status is an explanation, not a confidence number.

        Exact evidence

        A verified proposal must reconstruct the exact source substring at its declared coordinates.

        Required fields

        Missing identifiers, dates, vendor, references, currency, lines, or totals remain empty and block release.

        Line arithmetic

        Quantity × unit price must equal each line total, and the line sum must equal the subtotal.

        Total arithmetic

        Subtotal + tax must equal total; the source literal stays visible even when its state drops to needs review.

        Duplicate ID

        A pinned synthetic processed-ID registry blocks a repeated document identifier before approval.

        Untrusted text

        Instructions inside a document are data. They cannot change schema, verification, export, or handoff policy.

        Measured evaluation / 05

        Thirteen pinned failure shapes, measured against one contract.

        Measured July 20, 2026 with deterministic synthetic fixtures; no external provider calls. These are synthetic fixture contract results—not client-document accuracy or commercial performance.

        Dataset
        13/13 cases
        Rule outcomes
        94/94
        Closed-schema paths
        16/16
        Populated-field evidence
        138/138
        Region reconstruction
        150/150
        Fail-closed cases
        5/5
        Unsafe verified exports
        0
        External side effects
        0
        Local latency p50 / p95
        0.53 / 8.18 ms
        Reproduction record
        Evaluation clock
        2026-07-20T12:00:00.000Z
        Schema / validator
        source-to-record-record.v1 · source-to-record-validator.v1
        Dataset SHA-256
        c4ba7c7b8ae89951be8601eba8bea5bbb3b9d539a3c07b0f2101d8386ebc6977
        Config SHA-256
        062663a1d95829226c1ea59cd2b4bbd6e0af3cb8e564e3c90cc2362435e6ac20
        Measured test scope
        • These metrics cover pinned synthetic text fixtures and deterministic boundary simulations; customer-specific acceptance uses authorized representative documents.
        • The latency value is local contract-evaluation time; deployed extraction and delivery latency are recorded by the operational monitoring path.
        • Authorization, encrypted retention, durable audit, and reviewer operations are verified by the operational service suite rather than counted in this fixture metric.

        Failure + privacy boundary / 06

        Every document crosses the same security and evidence gates.

        Provider failure

        Fail closed

        Malformed output, unsupported evidence, scanner failure, and extraction timeout release no partial record and no downstream event.

        Upload security

        Inspect before extraction

        MIME, magic bytes, PDF structure, encryption, pages, dimensions, pixels, bytes, names, and allowed document families are validated before use.

        Malware

        Clean result required

        The scanner is mandatory and unavailable, errored, or infected results stop ingestion. OCR never runs before a clean verdict.

        Retention

        Encrypted lifecycle

        Source, proposal, review changes, exports, queue payloads, and receipts are encrypted with explicit retention, purge, and backup operations.

        Review authority

        Roles + record versions

        Operators propose; reviewers correct, resolve, approve, or reject; administrators control export, queueing, and delivery. Stale versions cannot overwrite a committed decision.

        Evidence release

        Exact source required

        Every retained field reconstructs its source. OCR and ambiguity remain in review until a person resolves them; invented evidence is rejected.

        Production control plane / 07

        The production path is implemented as explicit, inspectable state.

        1. 01

          Authenticated intake

          Salted workspace credentials, role checks, strict upload preflight, content fingerprinting, encrypted originals, bounded retention, and cascading purge create the intake boundary.

        2. 02

          Document runtime

          Current malware signatures, local PDF text extraction, image/PDF OCR, an exact page map for up to 20 pages and 100,000 characters, safe temporary files, and one total deadline form a fail-closed pipeline. A governed external provider receives neither the original bytes nor private filename.

        3. 03

          Reviewer operations

          Optimistic versions, original-access audit, corrections, conflict resolutions, approve/reject states, and an HMAC-verified record-event chain survive restart and backup.

        4. 04

          Downstream delivery

          An approved record envelope enters the durable outbox and reaches the configured system through signed HTTPS, stable events, bounded leases, receipts, Retry-After-aware backoff, explicit retry, cancellation, and rollback.

        5. 05

          Activation gate

          The service verifies signed activation evidence and refuses operational readiness unless scanning, extraction, authentication, audit integrity, off-site recovery proof, monitoring, provider policy, and required delivery are healthy.

        Portfolio connection / 08

        The record workflow is designed for the next operational boundary.

        The Bilingual Lead-Response Control Room preserves the inquiry, language, owner, and next step. Source-to-Record governs the later document-to-record boundary. The authenticated services connect only through an approved deployment mapping and exchange only its declared fields.

        Map the source-to-record delay

        Find the field your team checks twice before the next system trusts it.

        Start with one document family, its source owner, the review decision, and the downstream write that must stay controlled.

        Get a 3-point lead-flow review