feat(partners): wire the RPO/MSP application funnel end-to-end

[thecelestialmismatch]

Description

The RPO/MSP application backend — POST /api/partners/apply → partner_applications insert + founder alert + branded welcome email, plus migration 005 — has existed and been tested for months, but no UI ever called it. Every CTA on /partners and /partners/kit pointed at the generic /contact form, so the Stage-1 channel #1 funnel never ran: no RPO landed in partner_applications, no founder alert fired, no welcome email sent. The classic "capability with no caller" dangling thread (tasks/lessons.md, 2026-07-04).

This ships the missing caller and closes the loop:

• app/partners/apply/PartnerApplyForm.tsx — honest-fetch application form. Payload maps 1:1 to the route's zod schema (name, company, email, partnerType, numeric clientCount, message). Shows success only on res.ok && data.success; degrades to a direct, monitored inbox (contact@houndshield.com) on any failure — never a fake success (the 2026-07-12 lead-shredder pattern).
• app/partners/apply/page.tsx — SEO'd application page (canonical + OG, sitemap entry), offer recap ($299 wholesale · 14-day local · no exclusivity · local-only), and a "what happens next" strip mirroring the welcome email's two-business-day promise.
• Repointed all three partner CTAs (/partners ×2, /partners/kit) from /contact → /partners/apply.

Channel doctrine preserved: the form states the C3PAO exclusion (32 CFR Part 170 — assessors cannot refer tools to clients they assess). No fabricated metrics, no sub-$499 pricing, no second grid.

Fixes # (no tracked issue — dangling-thread cleanup surfaced during the OODA session)

Type of change

• New feature (non-breaking change which adds functionality)
• Documentation update

Jordan's Test Plan (CMMC Buyer — required before merge)

• npm run build passes in compliance-firewall-agent/ (exit 0; /partners/apply prerenders static ○, /api/partners/apply wired ƒ)
• No hardcoded secrets (API keys, license keys, passwords)
• Local-only data boundary preserved — this is a marketing/lead surface; no prompt content or CUI touched
• Compliance patterns untouched — proxy/patterns/ not modified
• SPRS scoring logic unchanged
• If Supabase referenced: partner_applications is a marketing lead table (name/company/email), never CUI

Verification

• npm run build succeeds locally (exit 0)
• Linter passes — eslint . = 0 errors; new files 0 warnings
• Test suite passes — full suite 1497/1497 (+18 new)
• tsc --noEmit = 0

New guards (+18):

• PartnerApplyForm.test.tsx — validation, exact payload shape (numeric clientCount, omitted when blank), success-only-on-ok, honest fallback on both failure modes, C3PAO exclusion copy.
• apply-funnel-contract.test.ts — source-level regression guard: the route has a caller, the page renders the form, no partner CTA falls back to /contact, page in sitemap, no-fake-success pattern holds.

Checklist

• My code follows the style guidelines of this project (design-system tokens, honest-fetch form pattern mirrored from /contact)
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (docs/PARTNER-APPLICATION-FUNNEL.md)
• No TypeScript any types added in compliance-critical code

🤖 Generated with Claude Code

https://claude.ai/code/session_019737b2ENNDFaA7gPyg5hJo

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
compliance-firewall-agent	Ready	Preview, Comment	Jul 22, 2026 9:47pm

[supabase]

This pull request has been ignored for the connected project qifynzuyrdxmxlumpsrq because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[thecelestialmismatch]

Proxy Build & Test went red on the first commit, but the cause was pre-existing on main, not this PR — the funnel work touches no files under proxy/.

Root cause: dependabot's better-sqlite3 12 → 13 bump (#232) landed on main; v13's native binding requires Node ≥22, but the proxy CI job pinned Node 20, so npm ci warned EBADENGINE and vitest's worker forks crashed on import ("Worker exited unexpectedly") — 0 tests ran.

Since it was blocking this PR from reaching all-green, I fixed it here (7019c47): bumped the proxy CI job to Node 22 and corrected proxy/package.json engines.node to >=22.0.0 so the declared engine matches the dependency's real requirement. Validated locally on Node v22.22.2 — proxy tsc 0 · tests 61/61 · bench p99 1.049 ms (<10 ms contract) · build 0. This also un-reds the same check on main.

---

Generated by Claude Code