One clear path. Four accountable layers.

Each provider has one job. Each transition leaves evidence. Nothing sends merely because a model suggested it — the full invariants are documented in docs/ARCHITECTURE.md.

01 · Discover — search the public record

The configured search provider maps firms, people, mandates, portfolios, and current thesis evidence across four capital regions (US, UK, EU, APAC). Results are evidence candidates, not verified contacts — a production deployment normalizes domains, deduplicates firms, and flags ambiguous contact types for review before anything is treated as a reviewed record.

02 · Interpret — explain the fit

Deterministic scoring in lib/matching.ts stays inspectable: every match keeps its reasons and risks. A model can supplement this with drafting and classification, but it cannot erase source-based reasoning or invent a score from nothing.

03 · Control — people hold the edge

Approval, jurisdiction, identity, suppression, and rate-limit gates all fail closed. outreach:sendApproved requires an explicit outbound flag, operator token, approved message, public source, reviewed jurisdiction, clear suppression check, sender postal identity, unsubscribe link, and a stable idempotency key — see Responsible outreach for the full list.

04 · Learn — a pipeline, not a blast

Resend delivery events and replies become an auditable history a founder can act on, instead of a fire-and-forget blast. Suppressions and complaints are meant to feed straight back into the control layer before any further scheduling.

What is real versus preview right now

• Real and persisted: accounts and roles, signup records, organizations, startup profiles, published catalogue listings, investor interest signals, and the aggregate honest counts shown across the site.
• Real and closed end to end: a founder writes a listing, an operator reviews it, an investor expresses interest, and the founder accepts or declines — contact details are released only on acceptance, never before.
• Live when configured: search-backed discovery, model-backed drafting, UI translation, and transactional email — each falls back to a clearly labeled sample or an explicit “unconfigured” state, never a fabricated result, when its provider key is absent.
• Empty rather than fictional: the catalogue lists only what founders have actually published. With none published it shows an empty state, not sample companies.
• Fail-closed until activated: outbound outreach email, gated behind an explicit flag, an approved message, a reviewed jurisdiction, a suppression check, and sender identity.

See the numbers side of the system in the founder planner or investor pacing tool, or read the full architecture documentation.