SOP-13 — Outreach and communications record

Owner: Owner-operator (Document Owner and Records Owner for every SOP; no delegate exists). Version 2026-10-26 · effective 2026-10-02 · reviewed every 90 days · last reviewed 2026-10-26 · next review due 2027-01-24.

Purpose

Keep every claim made outside the platform true to the platform, and keep the one-message promise.

Scope

Emails, letters, posts, pitches, leave-behinds, agreements.

Procedure

Every outbound message uses only published general or partnership routes; no government program-integrity or complaint inboxes are used for sales; no contacts harvested from registrant records.
Follow-ups (owner direction 2026-10-06): a new letter may carry up to two follow-ups, at about day 10 and day 24, each short and referencing the first; the first letter says so and gives a one-word way to stop. A reply, a stop, or a bounce ends the sequence. Recipients of any earlier letter that promised 'no follow-up' are never re-contacted — that promise stands.
Forbidden words in any outbound copy: verified, certified, real-time, continuous, 24/7, instant, immutable, clean, clearance, compliant, fraud detection, safe harbor.
Every send is logged (recipient, route, date, provider id). Provider acceptance is recorded as acceptance, never as delivery or reply.
Pre-send gate, enforced in code and stored with each send: forbidden-word scan; published route stated; recipient is not a program-integrity, complaint, ethics or compliance inbox; follow-up terms stated in the letter; organization never contacted before; daily cap of new organizations; any audit finding cited is traceable to a Federal Audit Clearinghouse report id and finding reference; the letter names at least one form or regulation line from the Government Forms Register (/forms) so the recipient can see which of their own filings the record supports. A letter that fails any check is recorded as blocked and is not sent.
Traction claims: only external, confirmed events (a file received, a reply, a signed page) are claimed; internal, prebuilt and test activity is never described as usage.
Standing authorization (owner, 2026-10-06): the system may send, without a per-message Go, one message to an organization in these classes — companies that already perform the screening or payee duty for many buyers (Medicaid fiscal agents, payee-onboarding and AP platforms, hospital vendor-credentialing platforms, GovCon subcontractor systems, audit workpaper platforms) and duty-holding buyers (hospitals, health plans, counties, grantees, primes). Limits: at most 20 new organizations per day (follow-ups do not count); published general or partnership route confirmed on the organization's own site at send time; where the route is a web form without CAPTCHA the form is filled as written here and the confirmation text is logged; owner Cc on email, owner email summary on form sends; every other rule in this SOP unchanged. The owner may revoke by saying so; the authorization is listed here so a reader can see it.
Form sends: when the only published route is a web form, the submission is logged with the same fields as an email send (recipient, route, date, confirmation text in place of provider id) via the operator log-form endpoint.
Press and editorial pitches (owner direction 2026-10-08): an outlet is reached only through the route the outlet itself publishes on its masthead or tip page; a pitch leads with a public record (a FAC finding by report id, a public sample page), names at least one form or regulation line, states plainly what is not being claimed (no customer, no file received), offers a story or a byline and never a product; it carries at most one follow-up at about day 7 and says so; press sends share the 20-per-day cap with every other new organization and are logged in the same register with kind 'press' under the same gate.
Queued sends: when the owner says send and the day's cap is already used, the letters are queued in the owner's order for the next send time (08:05 Eastern) by the operator queue endpoint; each letter still passes the full gate at send time, and anything the cap blocks is re-queued for the following reset. Nothing in the queue bypasses a check.
Government conversion desk (owner direction 2026-10-08, 'we go get them'): weekly, local governments in the configured states whose latest single audit prints a type-I (procurement / suspension and debarment) finding are drawn from the Federal Audit Clearinghouse by report id. For each: the body's own website (as it registered in SAM) is read for a mailbox it publishes on a purchasing, procurement, finance or contact page (program-integrity, complaint, ethics, HR and unrelated inboxes excluded; FAC registrant contacts never used); a shared per-state sample of the same bodies is built through the ordinary roster path; the letter quotes the finding as the auditor printed it and cites 2 CFR 180.300; the letter goes to the send queue and passes the full gate at send time under the cap. A body with no published mailbox on its own site waits as 'needs_route' for a human; nothing is guessed.
By-hand and by-form sends (a body whose only published route is a web form or postal address): before sending, read the production register (GET /api/admin/partner-inquiries) and count organisations sent today; at five, hold for the next 08:05 Eastern send time. Run the pre-send gate on the exact text. After sending, record it the same day with POST /log-form (route, text, the form's confirmation); a send that exceeded the cap is recorded with a cap_exception note, never left off the register.
Answers. Every reply, forward, 'no' or bounce arrives in the owner's inbox, not on the platform. The operator records it the same day at /operator/outreach (kind + one line); recording stops any remaining follow-up at once and moves the organisation from 'no reply yet' to a counted answer in the register and in Road Watch. The register's reply count is only as current as this step.
Priority. The operator may list letters that go first at the next 08:05 Eastern send time (/operator/outreach → 'Goes first'). Priority changes order only: the same eight-check gate and the same daily cap apply, and a priority letter that fails the gate is held like any other.
Reply Desk (2026-10-25). A reply is matched to its letter only by exact address, or by exact domain when exactly one letter went to that domain; generic mail domains and ambiguous domains are filed unmatched for a person. On a match the register records replied_at and the kind, follow-ups stop, the owner is alerted with the text. Owner direction 2026-10-25: matched replies are answered automatically with one fixed desk answer (what the receipt is and is not, the free first engagement, the verify link, 'sent automatically; a person reads every message that comes back') with the owner copied on every answer; a plain 'no' receives a one-line acknowledgment and the address goes on the do-not-contact list; an explicit stop/unsubscribe/remove receives silence and the same listing. One automatic answer per sender, ever; later messages from the same sender wait for a person. The fixed answers are written text, not generated, carry no personal name and state no outcome. The owner may switch auto-answer off at /operator/replies; the register records which mode sent each answer.

Records this procedure produces — and who keeps them current

Record	Where	Updated by	Update trigger	Retention	Public
Outreach send log	`db.partner_inquiries; memory/drafts/*.md send logs`	owner	every send	indefinite	False
Published offers and prices	`/annual, /partners, /challenge`	owner	any price or offer change	current + SOP change log	True
Answers recorded (kind, one-line summary, who recorded, when)	`db.outreach_replies; partner_inquiries.reply_*`	operator	same day as the answer	indefinite	False
Desk replies and answers (sender, text, matched letter, answer text, mode auto/manual, provider id)	`db.desk_replies; partner_inquiries.reply_answered_at`	system	each reply	indefinite	False

Evidence

/trust · /conflicts

Change log

Date	Change
2026-10-06	Written as SOP.
2026-10-06	Owner standing authorization added for one-message outreach to named classes (cap 3/day, published routes only, logged, revocable); web-form sends defined and logged like emails; '/changelog' reference corrected to the SOP change log.
2026-10-06	Owner: 'be aggressive … make sure we follow up.' Follow-ups allowed on new letters (day ~10 and ~24, stop on reply/'no'/bounce); cap raised to 5 new organizations/day; letters lead with the recipient's own public audit finding (FAC) where one exists; earlier no-follow-up promises kept.
2026-10-06	Owner: 'highest standard of operating procedures and quality.' Pre-send gate written into the send path (seven checks, result stored with each send; failures recorded as blocked). Shared letter text no longer uses the word 'clearance' even in negation.
2026-10-07	Stacked-systems audit found a legacy autonomous job ('Record Outreach', outreach.py, built 2026-09) still armed in production: it drew carrier contact emails from the FMCSA Motor Carrier Census — a registrant-record route this SOP forbids — and its log shows 2 sends on 2026-09-24. Sealed (jobs cancelled at startup, handlers dropped); those addresses are never contacted again. Reported here because the rule is that nothing stale stays quiet.
2026-10-07	Owner: 'identify all government forms we can address and citations to encourage and fix.' Government Forms Register published (/forms, /api/public-record/forms: 13 federal forms/lines with citation, official page, what a receipt does and does not show, FAC finding pattern by report id; 50 states + DC Medicaid enrollment and exclusion-list register). Pre-send gate gains an eighth check: the letter must name a form or regulation line from the register. Letters remain evidence offers, not advice.
2026-10-08	Letters link the recipient's form procedure page (/forms/{id}, steps as written with the auditor's test) rather than describing the process in our words. Downstream target lists may be drawn from FAC findings by compliance type (public, by report id) but every recipient is still reached only through a published procurement, grants or general route under the existing checks and the 5-per-day cap.
2026-10-08	A letter may attach or link the recipient's Sector Map (/maps/{id}) as the reference document — the map is the same for every reader and names no organisation; the letter still leads with the recipient's own public finding where one exists.
2026-10-08	Owner: 'Do you follow back up with media companies around the US?' — none had been contacted; owner chose to fold press into this register ('A', then 'Go per outlets'). Press-pitch rule added: masthead-published routes only, public record first, what-is-not-claimed stated, one follow-up at ~day 7, shared 5/day cap, kind 'press' recorded. First eight outlets drawn from memory/drafts/editors_and_reviewers.md.
2026-10-08	Owner said 'Send' (Luzerne County) with the day's cap at 5/5. Queued-send procedure added rather than a cap exception: POST /api/admin/partner-inquiries/queue holds letters in order for the 00:05 UTC reset; gate at send time; cap-blocked letters re-queue. First queue: luzerne_county, then the three cap-held press pitches.
2026-10-08	Owner: 'we don't wait on customers, we go get them … government customers … fix the problems we see in the system … automatically.' Government conversion desk added (backend/govconvert.py, operator board /api/admin/govconvert): FAC type-I findings → body's own published route → shared state sample → letter → send queue. Routes only from the body's own website; needs_route is a human step, never a guess.
2026-10-09	DEVIATION RECORDED. Cranberry Township (FAC 2025-002, SAM.gov review documentation not retained; auditor Maher Duessel) was reached through its published Contact Us form as the sixth new organisation of the day — cap is five. Cause: the by-form path ran the pre-send gate against the preview database (cap read as open) and the production count was not checked first. Correction: /log-form now applies DAILY_NEW_CAP (was a stale 3) and refuses to record a cap-exceeding send unless a cap_exception note is supplied, so the register stays truthful; procedure step added — before any by-hand or by-form send, read the production register's count for the day. No further new organisations today; the queued COSTARS inquiry and government letters wait for the 00:05 UTC reset.
2026-10-09	Reply capture added: POST /api/admin/partner-inquiries/{company}/reply {kind: replied\|no\|bounce\|forwarded, summary} records what came back (the reply itself lives in the owner's inbox), stops follow-ups the same day (SOP-13 stop rule) and is counted in the register and in Road Watch; operator page /operator/outreach. Queue priority added: POST /queue/priority lists letters that go first at the 00:05 UTC reset ahead of every queued letter — same gate, same cap, nothing bypassed; first use: the COSTARS supplier question.
2026-10-09	Procedure steps written for answers and priority (both shipped 2026-10-09); answers record added to the records table.
2026-10-11	DEVIATION RECORDED. The 00:05 UTC send queue fired on 2026-10-10 (8:05 pm ET Friday), inside the Sabbath (sunset 2026-10-09 22:38Z → 2026-10-10 22:37Z), and sent 5 letters (PA DGS COSTARS question, 3 press pitches, 1 government). The gate had no holy-day check. Correction: gate check 'holy_day_rest' added (fails while holyday.is_resting()); run_send_queue re-queues to the later of rest end + 10 min and the next cap reset; follow-ups hold; press skips with reason 'resting'. Rule as written: from sunset before a Sabbath or Torah feast day to sunset after, information and protection continue, commerce and outreach rest.
2026-10-11	Owner: 'make sure my name is off emails'; 'following up is what separates us'. Every send path signs 'Alpha Covenant Holdings — reference desk'; no personal name in any letter, follow-up, auto-reply prompt or operator draft; the reply mailbox stays until the LLC inbox exists. FOLLOWUP_NOTE reworded (no 'then stop'); second follow-up no longer says 'I will not write again'; deadline follow-ups 30/60/90 days before (by FAC expended) and 7 days after a missed date, re-read first, nothing sent when the file shows it handled.
2026-10-11	Law-firm desk (lawdesk.py): counsel named on Court of Federal Claims and FCA/S&D opinions via GovInfo (official; GOVINFO_API_KEY) → firm's own site → general office inbox only; DOJ counsel never targeted; GAO site refuses automation and is not read. Letter kind 'counsel': the opinion as printed, the dated receipt with FRE 902(13)/(14) certification, no characterization, no legal advice; first receipt free, Litigation Report at the published price.
2026-10-11	Audit Desk (auditdesk.py): single-audit CPA firms as the FAC prints them (auditor_firm_name; latest filing per body; state auditor offices excluded) → firm's own site via the auditor_email DOMAIN only (the FAC mailbox is a registrant contact and is never written to) → general office inbox. Letter kind 'auditor': the firm's FAC counts as printed, Part 3 §I / 2 CFR 180.300 workpaper receipts, client board, auditor-change list; first bundle of 25 free; published prices. Never an opinion on the audit or the client.
2026-10-11	Terms rewritten from the legacy agency text to the records service (service, what-you-decide, billing, acceptable use incl. FCRA non-CRA statement, no-advice, warranty); legal-entity disclosure kept in Terms, footer points to it. Owner: 'whatever protects the company … until I get the LLC set up'.
2026-10-11	Owner: 'we don't want to give people the answer' → A & B: letters no longer link the rule's how-to page or count the manual steps; the free offer is the first 25 names (same receipt the paid roster prints), with the county roster price stated in the letter ($2,400/yr to 150 vendors, $4,800 to 500). Deadline reminders go out 30 days ahead for bodies under $3M federal expended, 60 days for $3M–$25M, 90 days above $25M (FAC total expended, latest audit year); 7 days after a missed date, re-read first.
2026-10-11	Owner: 'we see the errors and needs based on their filings … approved.' Government discovery widened from Procurement/S&D (I) only to every finding kind the receipt answers: I (S&D), N with exclusion-screening text (42 CFR 455.436 / OIG LEIE monthly), M subrecipient monitoring (2 CFR 200.332 — letter says we cover only its exclusion and audit-results steps), and repeat findings of any type (letter says plainly the finding is not our file and points to the test next to it). Each kind has its own bridge, form line and ≤45-char subject; the auditor's severity line (material weakness / significant deficiency / repeat) is quoted as printed. Finding text now stored to 3,000 chars so the Condition paragraph is quoted. Same gate, cap, window.
2026-10-11	Owner: 'find deadlines … send reminders … selling ourselves.' Deadline Desk added (backend/deadlines.py, operator board /api/admin/deadlines): a daily scan of the government list reads two dates the public file prints — SAM.gov registration expiration (FAR 52.204-7) and the Single Audit due date computed from the FAC fiscal year end (2 CFR 200.512) — and queues a reminder letter (kind 'deadline') that states the date and the rule and offers the free receipts and the monthly roster. The letter never says late, lapsed or non-compliant. Same gate, same 5/day cap, same holy-day rest; never to a personal-named address, an address that said no or bounced, one promised no follow-up, or one written to within seven days; one letter per body per deadline.
2026-10-11	Owner: letters should land as offices open, not overnight. Send time moved from 00:05 UTC to 08:05 Eastern (America/New_York); run_send_queue holds and re-queues anything that fires outside 08:00–12:00 Eastern or on a weekend. Same gate, same 5/day cap, same holy-day rest.
2026-10-11	Owner: reach people by the dollars they are losing, facts only. Benefit-first letter templates drafted for review (memory/drafts/dollar_letters.md: time back → dollars at risk in the recipient's state/sector as printed → proof in hand); figures drawn at send time from /api/cost-record and /api/exclusion-settlements. Not wired until the owner approves.
2026-10-11	Owner: 'Proceed to complete build.' Three lanes added on the same gate, cap, window and rest, all written to only at an office inbox the organisation publishes on its own site: (1) First-time filers (firstfilers.py, /api/admin/first-filers): bodies whose Single Audit the FAC accepted in the last 120 days with no earlier filing under the same UEI (dissemination begins 2016) — letter kind 'first_filer' states the filing as printed, the Part 3 §I record and the next 200.512 date; bodies already on the finding list are skipped. (2) Health Desk (healthdesk.py, /api/admin/health-desk): employers HHS-OIG printed in an exclusion-employment settlement in the last three years — letter kind 'health_employer' quotes the posting as printed, cites 42 CFR 1001.1901 and offers the monthly LEIE roster; no characterization of the matter; the employer's site comes from the Places API when enabled, else a human gives the site (POST /{key}/route) and the inbox is still found only on that site. (3) Deadline Desk route pass: needs_route items are re-tried through the body's own site every 14 days (POST /find-routes); operator page /operator/deadlines. Auditor-change weekly list added as a subscribed product (POST /api/audit-desk/subscribe, confirm link, unsubscribe link in every issue; four free issues then $600/yr on invoice); issues hold on holy days and go after 09:00 Eastern.
2026-10-11	Trust tightening (owner: 'build what makes sense … tighten what needs tightened'): /verify is now a page — anyone verifies a receipt (id, VC JSON or receipt JSON) against the registry and both signatures, then may log that they did; the entry is pending until confirmed from the verifier's own mailbox and is published as organisation + role + result + date only (/api/verify-log). /api/public/entity and the About page print who operates the site (Alpha Covenant Holdings LLC (PA 0016032097), registered office, Department of State search, first receipt date, counts) with links to every public record of ourselves. /trust control narrative gained: signing keys and custody (no HSM; keys in the application database; rotation keeps old key ids resolvable), encryption (provider volume encryption relied on, not attested), vulnerability disclosure (two business days to acknowledge), continuity and exit (VC portability; DID document kept twelve months after any closure), outreach conduct, legal entity, Google Places and api.data.gov as subprocessors. Generated case studies (verified: false) are no longer served by the public case-studies endpoint.
2026-10-11	Insurer Desk (owner: 'Build it, it brings us value'): insurerdesk.py, /api/admin/insurer-desk, key prefix ins_. Prospects = parent organisations in Medicaid.gov's Managed Care Enrollment by Program and Plan (data.medicaid.gov, latest year), largest enrollment first; letter kind 'health_plan' states the report as printed, cites 42 CFR 438.610 / 438.608(b) / 422.503(b)(4)(vi) as printed, offers the enterprise roster (pricing product health_plans: $4,800/yr to 1,000 names, $18,000 to 5,000, above by agreement) — never a view of the plan's compliance program. Route: SAM.gov entityURL as the company registered it (new samentity.lookup_by_name), else the Places listing whose name matches, else operator-given site; vendor/supplier/procurement or general office inbox only; same gate, cap and rest. Public page /for-health-plans; home tab added.
2026-10-12	Owner: 'prices are not too low… we have to eat; free things don't pay the bills.' Roster 150 $2,400→$3,600, Roster 500 $4,800→$7,200; enterprise roster $4,800→$6,000 (1k) and $18,000→$21,000 (5k); Audit Desk tiers and bundles unchanged. The 'first 25 names free' offer is withdrawn from every letter, follow-up, page and the dossier slide; the one free receipt at /screening stays as the demo; the first 25 names are now the first delivery under a signed roster, within 48 hours of the order. Auditor-change weekly list: one free issue (was four). Every unsent letter in every desk was regenerated so no body is quoted a number we then raise.
2026-10-12	Owner: 'we’re not gonna let people clone us without making some kind of money on any part of what we do.' Audit Handover licence added (pricing product handover_license; GET /api/partner/v1/handover/{UEI} under a partner key; $24 per body per month read, $480 minimum, or revenue share at 20% with the same floor; 'Read by Alpha Covenant Holdings' stays visible, brand as issued_via; spec §7b; Acceptable Use names unlicensed embedding). Roster product renamed 'Roster — counties, districts and authorities' (code county_roster unchanged). Queue audit this day: templates carry current prices; the only free item in any letter is the single demo receipt; Audit Desk tier prices ($2,400/$4,800) are unchanged by owner decision and are not stale.
2026-10-13	Order path: every desk letter's offer line now ends 'on invoice, the quote is one step at /order' (forms auditor/health/insurer/short -2026-10-13). Queued letters are re-rendered from the current form when read for sending, so a price or offer change never ships stale without a manual rewrite; nothing else in the letter changes.
2026-10-13	Owner: 'We can send 20 emails per day. Please increase.' Daily cap of new organizations raised 5 → 20 (partnerdesk.DAILY_NEW_CAP; compliancedesk and the sealed outreach.py kept consistent). Every other rule unchanged: published office inboxes only, no personal-named addresses, 08:00–12:00 Eastern weekday window, holy-day rest, stop on reply/no/bounce, follow-ups do not count toward the cap.
2026-10-14	Owner: test the threshold on the larger bodies — 'they have the money'. Roster 500 $7,200→$9,600 (still under the $10,000 federal micro-purchase threshold, 2 CFR 200.320, and under Pennsylvania county/municipal quote thresholds). Roster 150 stays $3,600; enterprise, Audit Desk, Handover licence unchanged. Letters render the price at send time; queued letters inherit it.
2026-10-14	Owner: 'leave Roster 150 ($3,600), change everything else' at the top of the list. Enterprise roster 1,000 names $6,000→$9,600 and 5,000 names $21,000→$30,000 (health plans, health systems); Audit Desk firm-wide (200+ clients) $9,600→$12,000. Unchanged: Roster 150 $3,600, Audit Desk $2,400/$4,800 and bundles, Handover licence $24/body-month, Partner API tiers, the one free demo receipt. Letters and pages read these constants at render time.
2026-10-14	Owner: hand-holding for departments that lack the experience, 'based on stated documents and procedures, nothing more nothing less.' Audit Calendar (dated reminders by fiscal year end, two audiences, each quoting the controlling section as the eCFR serves it) and Forms Desk (an answer box that draws only from the Forms Register, procedure steps, eCFR text and the body's own filing; every sentence cited; forbidden determinations stripped in code; every exchange hashed and logged) shipped. Priced as one product: $600 a year per body, included with any roster, Audit Desk or enterprise roster; thirty desk questions a day free without an account. Owner's direction on price: included in the raised tiers unless a separate sale returns more — the desk is kept as the entry step and the reason to stay, not a separate knowledge product.
2026-10-15	Owner: 'stay $1 under the threshold for fast approvals.' Every price except Roster 150 ($3,600, unchanged) now sits one dollar under its approval line: Roster 500 $9,600→$9,999 and enterprise 1,000 $9,600→$9,999 (federal micro-purchase threshold $10,000, 2 CFR 200.320); enterprise 5,000 $30,000→$29,999; Audit Desk $2,400/$4,800/$12,000→$4,999/$9,999/$14,999; bundles $150/$300→$249/$499; auditor-change weekly $600→$999; Audit Calendar + Forms Desk $600→$999 (still included with any roster); Handover licence $24→$36 per customer-month, minimum $480→$720. Letters re-render at send time from the current constants (re-render now keyed on text, not form label — two queued letters found still quoting $7,200 were corrected). Customer-facing wording: 'body' replaced by customer/organization/agency across pages and letters.
2026-10-25	Reply Desk added (replydesk.py, /operator/replies): replies matched to letters by exact address/domain only; follow-ups stop on match; owner alerted. Owner: 'I prefer auto answer with me copied on all responses' — matched replies get one fixed, written desk answer with the owner copied; plain 'no' gets a one-line acknowledgment and do-not-contact; explicit stop gets silence; one automatic answer per sender ever; switch at /operator/replies. Mailbox poll hands desk replies to this path before any other responder, so the legacy generated responder never answers a desk letter.
2026-10-26	Route discovery for CPA firms (owner: 'routes'): (a) a domain taken from the firm's OWN filing mailbox on the FAC is treated as the firm's own site (domain_is_own) — the .gov-registry detour and the name-in-hostname test are skipped, but the home page must still name the firm or the domain's root word must be part of the firm's name; (b) a firm-name mailbox is accepted as the general desk when the local part equals the domain root minus a trade suffix (wessel@wesselcpa.com, maner@manercpa.com) — a first name alone never qualifies (john@johnsmithcpa.com stays personal), and looks_personal() and the presend gate apply the same rule; (c) a firm that publishes a contact form and no mailbox is recorded as form_route — a published route a person uses by hand from /operator/form-routes, one submission ever, recorded as sent with 'no follow-up' stated in the text, never a privacy/CCPA/careers form. Preview retry of 40 stalled firms: 2 mailboxes + 19 forms found.

Quality Manual · All SOPs · Records Register