Carbotura Finance Portal — How It's Built

2026-08-19 — Deal Room: real, watermarked PDF downloads

The pre-existing "Allow download" toggles never actually worked — the only Content-Disposition header in the system sat on the route the PDF.js viewer fetches via XHR, which the browser never sees. There's now a distinct /api/doc/:doc_id/download route the viewer's real ⬇ Download button navigates to, gated by a single room-level setting (Edit Room → Download allowed), watermarking the viewer's email + date into the actual PDF bytes server-side (not just the on-screen overlay), and logging every download to the room's Views tab.

First production use: the Wells Fargo deal room, enabled at their request. Full detail in the Deal Room runbook and admin/dr/DEAL_ROOM_MODEL.md §6b.

2026-08-19 — Investor Qualification Questionnaire

A public, ungated 10-question form at /finance/qualify/ that scores every submission deterministically against a fixed 100-point rubric (proven capacity, check-size fit, decision-maker access, 90-day timeline, sector fit, structure understanding, transaction history, diligence clarity) and tiers it — Chairman (80–100), IR/Diligence (65–79), Nurture (50–64), Automated (<50). Built to stop "I'm interested" submissions from consuming data-room access and management time before anyone has confirmed they can actually close.

• Notification: only Chairman and IR/Diligence tiers email Shannon + the Architect immediately. Everything else lands silently in the admin queue.
• Two scores, never blended: the qualification score (the rubric above) is stored separately from form-guard's generic spam/bot risk score — a submission can be low-risk but low-qualification, or vice versa.
• Admin surface: admin/js/tabs/investor-qualifications.js, under the Finance tab group. master_admin+ scoped to finance — same tier as the deal-room admin surface, not looser. List + detail view (score breakdown, the two comparable-deals card, review status/notes).
• AI dossier — on-demand only, never automatic. An admin clicks "Run Dossier" to have Claude web-search-verify the entity's legitimacy and the two claimed comparable deals. Writes verified / unverified / contradicted findings per claim; never mutates the score or tier — it's a separate human-judgment artifact, not a scoring input.
• Schema: investor_qualifications (own table — see schema/investor-qualification-v1.sql), not form_submissions.

2026-08-13 — Deal Room sessions last 90 days

Viewer sessions went from 24 hours to 90 days; manual grant links from 1 hour to 7 days (up to 30). A counterparty working through weeks of diligence no longer requests a fresh code every morning.

2026-08-13 — Manual Access Grant

For a recipient whose own email security quarantines the access code — common at banks. After verifying identity out-of-band, an admin issues a single-use link containing no code at all. Used successfully for a Wells Fargo contact whose bank filtered every OTP.

Check the Access-code attempts log first. If it shows masked_not_allowed rather than sent, no code was ever sent and the real problem is the allow-list — a grant won't fix that. That exact misdiagnosis happened; the recipient simply wasn't on the room's recipient list.

2026-08-13 — /finance/api/verify hardened

The investor verification endpoint now runs the shared form guard: length caps, email validation, rate limits, risk scoring and the review queue. Previously it validated presence only, and raw values reached a Teams card that renders markdown.

Managed at /admin/investors/. Every promotion and demotion writes a grant-history row with who, when and why.

How someone gets in

1. They request access — email entered at /finance/verify/.
2. A one-time code is emailed (Resend, DKIM-signed).
3. They verify; a server-side session is created.
4. An admin grants an access level. This is a human decision — nothing auto-promotes on verification alone.

Rate limits, all in rlOverGate: code requests capped 6/hour per email and 20/hour per IP; verification attempts 10 per 10 min per email and 20 per 10 min per IP.

The surfaces

ADeal Room tiers

Canon §3.4.2. Document tier and investor level are two separate checks — both must pass.

Full operating detail is in the Deal Room runbook. That book is task-oriented; this one just places it in the wider picture.

BPPM

The offering document for the Cornerstone Preferred raise. Four surfaces: an index with all ten Parts, a condensed 5-page summary, the complete document, and an in-portal viewer that wraps it in a sandboxed iframe with ?s=part-N deep-linking.

• Rule 506(c). General solicitation is permitted, but every investor must be verified accredited — self-certification alone is not enough for the equity round. That's why L3 exists as a distinct level.
• Permanent exclusions. Vendor identities, the full FMEA, and URVS-2026 methodology inputs are never disclosed at any tier. No override exists. Don't add one.
• URVS methodology. Summary and outputs may be disclosed under executed NDA, deal-room-gated, with the §3.4.1 legend. Formulas, model, proprietary inputs and calibration never are.
• Third-party firms. No named professional-service firms in investor-facing content — generic descriptors only. Aon plc is the sole permitted named firm, as Insurance Broker of Record.
• Deal-room access logs are the disclosure register. There is no separate register to maintain; the logs are it. That's why view logging must never be disabled.
• Canon governs the numbers. Royalty mechanics, fee structures and per-ton figures come from carbotura-commercial-canon. Never hand-edit a figure in a finance page — check canon first.

Routine tasks and where they live

Diagnosing "I can't get in"

1. Check Access-code attempts. sent means it left us — their side is filtering. masked_not_allowed means we never sent it and the allow-list is the problem. These need completely different fixes.
2. Check their screening status. Must be clear, not pending or blocked.
3. Check both allow-lists. Room recipient list and the specific link's list — a link minted for one person doesn't work for another.
4. Check their level against the document tiers. If every document is T2 and they cap at T1, they'll see an empty room rather than an error.