Vendor onboarding packets: sent with a token, chased on a cadence, filed for review

The send scenario selects vendors who have not been sent a packet, are not inactive and have an email, generates a per-vendor token as a SHA-256 of the record id, a timestamp and a random value, stores it on the vendor and emails a personal form link carrying the vendor id and token. The deadline in the email is read from a cycle record rather than written into the template.

The reminder scenario runs daily and selects vendors still marked sent and not received where the days since sending equal 7, 14, 21 or 28. No state machine is needed. From the third reminder onwards the subject and header switch to a final-reminder tone, in the same template, and the reminder count is incremented.

When a signed packet arrives, the watch scenario fetches the full submission and finds the vendor by the token, falling back to a case-insensitive email match, and creates the vendor if neither matches, so both direct and older links work.

It finds the vendor's folder in Drive by name, checks that it is a direct child of the profile folder, and creates it only if absent, then uploads the signed packet with a date in its name. A row is written for each document supplied (the agreement and the separate arbitration agreement, tax form, business licence and the two insurance certificates), with the vendor's stated expiry dates stored as notes.

Status is set to received, pending review; the two agreements are modelled as separate instruments and a missing arbitration signature is flagged; and expiry dates are left for a person to verify. A post to the intake channel says what arrived and what is missing.