Orders that file themselves, and an SLA clock that never forgets

Inbound orders hit a webhook, get parsed into structured fields, and the board row fills itself in (matched against existing records so a resend updates rather than duplicates). An ingest ledger records what arrived and what it changed, which makes a disputed row answerable instead of arguable.

The monday token is account-wide and reaches commission columns, so it lives in exactly one process. A Python service owns every credential and all board access; the Next.js front end never sees them and fetches server-side. The module that talks to that service imports server-only, so a client component reaching for it is a build failure rather than something a reviewer has to catch.

Each installer gets a magic link to a page showing only their own jobs. Contacted, booked, in progress and complete flow back onto the board as they tap them. No licence per installer, no password to reset, and no exposure to anything but their own work.

One install item per site is created on every installable order. Allocation fires an SMS when the installer is set and dispatched. A two-business-day clock runs against a real Australian public holiday calendar, survives reallocation, and escalates on its own when it runs out.

The whole allocation and SLA layer shipped behind a shadow-mode flag and a go-live cutoff, running alongside the manual process and logging what it would have done without doing it. Comparing the two for real orders is what made the cutover uneventful. With no installer board configured, the order flow skips allocation entirely rather than flagging every order as unmatched.