feat(company-monitoring): classify and admit material impacts - #6470

Summary

Company Monitoring can now turn normalized evidence candidates into deterministic publish, hold, reject, or expiry decisions. The model proposes structured facts only. Versioned policy owns the confidence floors, source authority, retry schedule, and final decision.

This is the admission slice after normalized evidence. Downstream impact publication remains a separate slice and is not part of this PR.

This PR does not close the target issue. The frozen admission scorer gate is not available, and its tracking issue remains open. Also, the current exact-content candidate contract cannot place two independently worded reports in one persisted candidate. That production path needs a separately approved event-level grouping contract before two-origin corroboration can clear end to end.

Design decisions

• The classifier has no tools and must return one strict schema. Malformed, missing, contradictory, out-of-range, oversized, refused, or incomplete output fails closed.
• Policy computes attribution, occurrence, and materiality floors independently. It counts verified first-party evidence and unique independent origins, but not ordinary social posts or syndicated copies.
• Every decision appends its reason codes and policy, model, query, schema, retry, and evidence-selection versions. Revision and lease fences prevent stale or replay-conflicting writes.
• Held candidates use fixed checkpoints near 6, 24, and 48 hours and reach terminal expiry by 72 hours. Transport failures use the same durable hold path and cannot leave a five-minute retry loop hidden behind healthy worker status.

Type of change

• Bug fix
• New feature
• New data source / feed
• New map layer
• Refactor / code cleanup
• Documentation
• CI / Build / Infrastructure

Affected areas

• Map / Globe
• News panels / RSS feeds
• AI Insights / World Brief
• Market Radar / Crypto
• Desktop app (Tauri)
• API endpoints (/api/*)
• Config / Settings
• Other: Company Monitoring policy, Convex persistence, and Railway worker

Validation

• npm run test:data
• vitest run --config vitest.config.mts --maxWorkers=1 — full Convex suite
• Focused policy, transport, worker, evidence, admission persistence, lifecycle, orchestration, and X-ingestion tests
• npm run typecheck
• npm run typecheck:api
• tsc --noEmit -p convex/tsconfig.json
• Repository pre-push gate

The checks cover all nine required fixtures, confidence boundaries, malformed and contradictory output, authority and syndication rules, held admission and expiry, replay conflicts, stale revisions, expired leases, purge safety, bounded provider responses, and transport-failure health. No credentialed live OpenRouter request was made.

Checklist

• Tested on worldmonitor.app variant (N/A: no dashboard UI changed)
• Tested on tech.worldmonitor.app variant (N/A: no dashboard UI changed)
• New RSS feed domains added to api/rss-proxy.js allowlist (N/A: no feed added)
• No API keys or secrets committed
• TypeScript compiles without errors (npm run typecheck)
• New or repointed health probes have a completed Railway-side pre-seed, or an owner-bound baseline acknowledgement with an entry-level expiresAt bounded to the first scheduled cron window (N/A: no health probe changed)

Documentation Alignment Checklist

• Claim ledger attached or linked (N/A: no documentation claims changed)
• All required Audit Council role signoffs attached (N/A)
• Generated docs regenerated from proto where applicable (N/A: no proto changed)
• Fixture-backed examples recomputed (N/A: no documentation examples changed)
• Redis writers/readers enumerated for every documented key (N/A: no Redis key documented)

Rollout and rollback

Admission stays disabled unless both the OpenRouter key and classifier model are configured. After activation, monitor Company Monitoring worker outcomes and the admission decision ledger for claim or finalize errors, repeated lease expiry, a growing pending backlog, or a malformed-output reject spike. Disable the classifier configuration or revert this PR if those signals appear. Observe the first 72-hour hold window before treating the retry path as operationally accepted.

Related

Related: #6011, #6010, #6006, and #6012.

Screenshots

N/A. This PR changes backend policy and worker behavior only.