Migration and Production Support Engineer for helping scale our POC

## 1. Background & Objectives Barlow Labs is building Yoova.com, an AI-native platform for homeowners and real estate agents/brokers. The product enables a homeowner to capture photos/video, upload documents, and build an all-in-one repository for home management and maintenance (warranties, repairs, vendor discovery, and related workflows). The Client has validated demand with a working proof-of-concept / MVP built rapidly ("vibe-coded"), and now requires professional engineering to consolidate, harden, and scale the product. Barlow Labs is seeking a low cost technical partnership with a capable provider that may possess the following qualifications depending on final scope alignment: Certified cloud partner (e.g AWS), expertise in building mobile apps, existing highly reliabile, AI-native CI/CD pipeline for product development and release, experience working with 'vibe-coded' products, Certifications in ISO, SOC2, others. Firm should be capable of ongoing breakfix and feature development support, including QA, site performance management and tweaking and real-time on-call CX response teams. Ideally firm should offer low-cost options (including off-shore) for dedicated-resources provided on an hourly-package or fixed-scope project basis. Since Barlow Labs intends one day to build our own internal capabilities in this space there may also be long-term interest in the firm helping us establish off-shore employees once the need arises. We aim to move the platform from disparate prototypes to a unified, production-ready, scalable product across web and mobile, and to establish an ongoing engineering partnership that operates in an AI-native manner. --- ## 2. Scope of Services The engagement is organized into three workstreams. Each workstream may be authorized independently via a signed Work Order / SOW addendum so the Client is never committed to a later phase before the prior phase is accepted. ### Workstream 1 — Consolidation & Product Unification ("Stitch & Polish") *Fixed-scope project.* Take the Client's existing, separately-built components and unify them into a single coherent product ready for the first ~1,000 users. - Audit the current codebase, feature set, product vision, and UX designs. - Integrate the disparate front-end pieces into one consistent application. - Reconcile the front-end UX with the existing backend so flows work end-to-end. - Ensure the experience renders and functions correctly on mobile devices. - Resolve defects and UX inconsistencies across the stitched product. - Deliver an initial deployable build (acceptable as a PWA wrapped via Capacitor for the first launch, per Client direction). ### Workstream 2 — Production Hardening & Scale *Fixed-scope project (may run before, after, or in parallel with Workstream 1 at Client's option).* Re-platform the product for maintainability, scale, and operational control. This is an example of one approach, but we expect the firm to advise on options, including pros/cons and cost/timing implications. - Rewrite / re-architect the front end in **React Native** (with **React / TypeScript** web as applicable) for maintainable, scalable native-ish iOS and Android delivery. - Stand up cloud infrastructure on **AWS** (e.g., S3 for object/media storage, EC2 or equivalent compute), provisioned as a real, controllable production environment. - Implement source control, branch/diff management, and **CI/CD** pipelines. - Implement security best practices and the compliance controls relevant to the Client's data (see §10). - Establish the architecture to support scaling from ~1,000 toward 10,000+ users without material re-work. - Support app-store readiness and submission workflows for the Apple App Store (iOS) and Google Play (Android suite). ### Workstream 3 — Ongoing Engineering & Support Partnership *Dedicated-resource and/or hourly-package engagement (recurring).* Provide continuous engineering capacity so the founders can focus on customers, product vision, and investors. - Ongoing feature development, executed AI-natively. - Break-fix, maintenance, performance, and reliability work as the user base scales beyond 1,000. - Option for a dedicated **Project Manager** who receives Client direction, dispatches the right specialist (front-end, back-end, full-stack, UI design, DevOps, infrastructure, QA), and provides daily status updates. - Optional **customer-support / operations** staffing (associates/analysts handling email, chat, and in-app queries), scoped separately if elected. --- ## 3. Deliverables | # | Workstream | Deliverable | Acceptance basis (§9) | |---|-----------|-------------|-----------------------| | D1 | 1 | Codebase & UX audit report + integration plan | Client review sign-off | | D2 | 1 | Unified application build (web + mobile-responsive), first-launch ready | Functional acceptance test | | D3 | 1 | Defect resolution log; known-issues list | Client review sign-off | | D4 | 2 | React Native mobile app (iOS + Android) | Functional acceptance test | | D5 | 2 | AWS production environment (IaC / documented) | Environment walkthrough | | D6 | 2 | CI/CD pipeline + source-control workflow | Demonstration + docs | | D7 | 2 | Security & compliance implementation summary | Client / advisor review | | D8 | 2 | App-store submission packages (iOS + Android) | Successful store submission | | D9 | 3 | Recurring sprint deliverables + daily/weekly status reports | Per sprint acceptance | All source code, infrastructure-as-code, and documentation are delivered to Client-owned repositories and cloud accounts (see §8, §9). --- ## 4. Out of Scope Unless added by written change order (§13), the following are excluded: net-new product lines beyond the home-management platform; third-party license/subscription fees (AWS, app-store, API, and SaaS costs are Client's direct responsibility); paid marketing; content creation; hardware procurement; and any regulatory certification/audit fees. --- ## 5. Engagement Model & Team Client anticipates a blend: - **Workstreams 1 & 2:** fixed-scope, milestone-based projects. - **Workstream 3:** dedicated resources (≈160–180 hours / 20–22 working days per month per FTE) and/or hourly packages (e.g., 40 or 80 hours/month). Indicative roles: full-stack engineer(s), React Native / front-end engineer, back-end engineer, UI/UX designer, DevOps/cloud engineer, QA, and a project manager. Final team composition and named resources to be attached as **Exhibit A** before start. The Client may interview and approve proposed resources and may request replacement of any resource with reasonable notice. --- ## 6. Timeline & Milestones The Client's timeline is **fast**; decisions are being made within ~2 weeks and work should begin promptly thereafter. Indicative schedule (to be finalized in Exhibit A): | Milestone | Target | |-----------|--------| | SOW / MSA / NDA / DPA executed | [Week 0] | | Kickoff, access provisioning, discovery | [Week 0–1] | | Workstream 1 delivery (D2) | [Week __] | | Workstream 2 infra + RN app (D4–D6) | [Week __] | | App-store submissions (D8) | [Week __] | | Workstream 3 ongoing | Rolling, monthly | ## 7. Intellectual Property & Ownership - All work product — source code, designs, documentation, and infrastructure configuration — created under this SOW is a **work made for hire** and is the exclusive property of the Client; Firm hereby assigns all right, title, and interest to the Client. - Code is committed to **Client-owned repositories**; cloud infrastructure is provisioned in **Client-owned AWS accounts** (or transferred to Client on request at no cost). - Firm retains no residual license except pre-existing tools/libraries it owned prior to the engagement, which are licensed to Client on a perpetual, royalty-free basis to the extent embedded in the deliverables. - No open-source component with a copyleft/viral license may be incorporated without prior written Client approval. ## 8. Confidentiality, Security & Compliance - Governed by an executed **NDA** and **DPA**; Client data and code are confidential and may not be shared with third parties. - Firm will implement security best practices and support the compliance regimes relevant to the product's data (e.g., **GDPR**, **SOC 2**, and **HIPAA** if any health-adjacent data is handled). - All development access is via least-privilege, revocable credentials in Client-controlled systems. No production data is copied to developer machines without authorization. - Data residency, sub-processor list, and breach-notification obligations to be specified in the DPA.