Full-Stack Developer for AI-Powered Provider Onboarding App

We are building a secure internal web application to automate provider onboarding, document organization, credential tracking, email follow-up, and readiness workflows for a U.S.-based healthcare services operation. A detailed product/workflow specification already exists. This is not a greenfield discovery project where the developer needs to figure out the business process from scratch. The workflows, statuses, requirements, human approval gates, document categories, AI restrictions, and operating rules have already been substantially defined. We are looking for one strong full-stack developer who can translate those requirements into reliable production software and work effectively with AI-assisted development tools such as Codex. Core stack / preferred technologies - Next.js - TypeScript - PostgreSQL - Supabase - Supabase Auth / Row Level Security - Google OAuth - Gmail API - Google Drive API - OpenAI API / function calling / structured outputs - GitHub - Cloud deployment Initial application scope The first version will focus specifically on provider onboarding and readiness management. Core functionality includes: - Secure administrator authentication - Role-based access controls - Provider database and profile records - Discipline/role-specific onboarding requirements - Provider onboarding status workflow - Document tracking and evidence states - Google Drive integration - Automatic document classification - Controlled file renaming and organization - Expiration-date tracking - Missing-document detection - Gmail thread reconciliation - Consolidated provider follow-up drafts - Duplicate-request prevention - Owner/compliance review queues - Human approval gates - Complete audit history - Natural-language internal AI assistant - Dashboard showing provider blockers and readiness Important architecture principle This system must separate AI reasoning from authorization. AI may classify documents, extract metadata, identify missing requirements, draft messages, summarize evidence, flag conflicts, and recommend actions. AI must not independently grant final compliance approval, billing readiness, provider activation, or other consequential release statuses. Those decisions remain human-controlled and should be technically enforced rather than relying only on prompts. Security requirements This application will handle sensitive provider information, so security and access control matter significantly. The developer should understand: - least-privilege access - authentication vs authorization - PostgreSQL/Supabase RLS - secure secrets management - Google OAuth token handling - audit logging - file-access permissions - environment separation - backups and recovery - safe API design - idempotent background jobs - duplicate-action prevention Restricted financial information such as banking details, SSNs, tax data, and direct-deposit information must remain outside the AI processing pipeline. Patient/clinical PHI is not part of the initial version. Existing materials The selected developer will receive a detailed implementation/workflow PDF after selection for the paid technical trial. We also have existing operating procedures, requirements matrices, workflow controls, and sanitized examples that can be used to understand the intended application behavior. Production data will not be provided during the initial technical evaluation. Development approach We prefer iterative development rather than attempting to build the entire platform at once. The first vertical slice should demonstrate: Login → provider record → requirements checklist → status engine → audit log Additional integrations will be introduced after the underlying data model and access controls are validated. We expect the developer to use AI coding tools where appropriate. We are interested in output and engineering quality, not paying someone to manually type boilerplate that can be generated safely. Paid technical trial We will begin with a 5–8 hour paid technical trial. The initial assignment will likely include: - review the implementation specification - evaluate the proposed architecture - identify major technical/security concerns - propose the database schema - establish the repository/development environment - build a small working vertical slice - include automated tests - explain the implementation and risks clearly Successful completion may lead to the full build. We are looking for someone who: - has shipped real production web applications - is strong with Next.js and TypeScript - understands PostgreSQL database design - has real Supabase/RLS experience - has implemented OAuth integrations - has worked with Gmail and/or Google Drive APIs - has built applications using OpenAI or similar LLM APIs - understands tool/function calling rather than just chatbot interfaces - writes automated tests - thinks about failure states and edge cases - can explain technical decisions in plain English - is comfortable working from a detailed specification - uses Git properly - can work inside accounts/repositories owned by the client Healthcare experience is helpful but is not required if you have strong security and workflow-automation experience.