diff --git a/references/form-catalog.md b/references/form-catalog.md
new file mode 100644
index 0000000..c06e37d
--- /dev/null
+++ b/references/form-catalog.md
@@ -0,0 +1,65 @@
+# Standard Form Catalog
+
+The recurring forms on FTA-funded transit and general government proposals, what profile data each needs, and the gotchas. When a form matches one of these, use this as your checklist. When it doesn't, fall back to matching field labels against `assets/mpm-profile.json` aliases.
+
+**Legend:** _auto_ = fill from profile · _human_ = certification/signature a person must affirm · _blank-if-TODO_ = leave empty and report if the profile value is missing.
+
+---
+
+## Contents
+1. Bidder / Contractor Information Form
+2. W-9 (Request for Taxpayer ID)
+3. Buy America Certification (49 U.S.C. § 5323(j))
+4. Lobbying Certification — SF-LLL / Byrd Amendment
+5. Debarment & Suspension Certification (2 CFR 180 / 1200)
+6. DBE Participation / Good Faith Effort Form
+7. EEO / Non-Discrimination Certification
+8. Non-Collusion Affidavit
+9. References Form
+10. Drug-Free Workplace Certification
+
+---
+
+## 1. Bidder / Contractor Information Form
+The catch-all cover sheet. Needs: legal_name, dba, entity_type, state_of_incorporation, full address, phone, email, website, ein, uei, cage_code, naics_primary, num_employees, signatory_name, signatory_title _(all auto / blank-if-TODO)_. Signature + date: _human_.
+- Gotcha: many agencies ask for both a "physical" and "remit-to/mailing" address — use the same unless the profile distinguishes them.
+
+## 2. W-9
+Needs: legal_name (line 1, must match IRS records exactly), dba (line 2), entity_type (check box — Corporation), address, city/state/zip, ein (as EIN, not SSN). Signature + date: _human_.
+- Gotcha: Line 1 must be the exact IRS-registered legal name — "Message Point Media of Alabama Inc." Do not abbreviate. Federal tax classification: check the **S corporation** box (per MPM's signed W-9 / `federal_tax_classification` in the profile).
+
+## 3. Buy America Certification
+Identity portion auto: legal_name, signatory_name, signatory_title. The **compliance statement itself is _human_** — whether the product complies depends on the bill of materials for that specific solicitation. Do NOT pre-select "complies" vs. "does not comply."
+- Gotcha: there are usually two mutually exclusive checkboxes (compliant / non-compliant). Leave the selection to the signatory and flag it.
+
+## 4. Lobbying Certification (SF-LLL)
+Standard federal form. Identity auto: legal_name, address, entity_type. Certification language is fixed; the affirmation is _human_. If any lobbying **did** occur, a disclosure form is required — flag for the user rather than assuming "none."
+- Gotcha: SF-LLL is only required above a dollar threshold ($100k federal action) — note this; not every proposal needs it.
+
+## 5. Debarment & Suspension Certification
+Identity auto: legal_name, signatory_name, signatory_title. Affirmation ("is not presently debarred…") is _human_ — record MPM's expected stance (not debarred) as guidance but require signatory confirmation.
+
+## 6. DBE Participation / Good Faith Effort
+Needs: legal_name, dbe_certified, dbe_cert_number, dbe_certifying_agency, socioeconomic_status _(all blank-if-TODO — do not guess DBE status)_.
+- Gotcha: This is the highest-risk form to fabricate. If dbe_certified is TODO/unknown, fill nothing about DBE status and flag prominently. Prime-vs-sub participation percentages are solicitation-specific — never auto-fill.
+
+## 7. EEO / Non-Discrimination Certification
+Identity auto: legal_name, num_employees (some forms branch on employee count / $ thresholds), signatory. Affirmation: _human_.
+
+## 8. Non-Collusion Affidavit
+Identity auto: legal_name, signatory_name, signatory_title. Sworn statement: _human_ (often notarized — flag the notary block).
+
+## 9. References Form
+Needs: bank_reference, business_reference_1/2/3 _(blank-if-TODO)_. Also often the MPM contact block (signatory or RFP POC).
+- Gotcha: references are frequently project-specific — ask the user whether to use the standard three or tailor to the solicitation's domain.
+
+## 10. Drug-Free Workplace Certification
+Identity auto: legal_name, signatory. Affirmation: _human_.
+
+---
+
+## General matching rules
+- Match a form's field labels to profile keys via the `aliases` lists in `assets/mpm-profile.json`; prefer an exact/normalized-substring match.
+- If two profile fields could match one form field, prefer the more specific.
+- Anything you can't confidently map → leave blank and list it under "needs input / review."
+- Anything labeled a certification, affirmation, oath, or signature → route to the human, even if you could technically type text into it.