Trellus Mobile App: Compliance and Hybrid Platform

1. What we need Primary scope: Google Play compliance. Bring our Android app to target API level 36 and keep it shippable. Secondary scope: web application updates. We may also want this developer handling updates to the bytrellus.com web application, including making sure those updates work correctly inside the Capacitor mobile app. We'll scope the specifics separately. We're looking to outsource ongoing work on this hybrid setup. It isn't a one-off engagement. We want a freelancer or independent consultant who stays on the project. 2. Current architecture Layer-Current state Web app-bytrellus.com, Next.js Mobile-Capacitor.js hybrid, iOS and Android, wrapping the web app Android listing-"Trellus: Local Delivered" Payments-Stripe, on-page iframe for card entry, saved cards on file Current target API-Below requirement, flagged by Google Play A few things you should know up front: • The Capacitor implementation used workarounds to make the hybrid approach function. • Portions of the HTML render conditionally based on detecting the Capacitor environment. • Cookies don't work in the native WebView. User and location state is carried by a session identifier passed as a URL parameter instead. • The native layer is undocumented. All of this works today and we're happy with it. We're being upfront so you can protect it through the upgrade. We're not looking for someone to rebuild it. 3. Primary scope in detail Core work: • Upgrade Capacitor to version 8, which is what targets API 36 • Toolchain: minSdk 24, compileSdk 36, targetSdk 36, Android Gradle Plugin 8.13.0, Java 21, Android Studio Otter or newer, plus the Gradle property-assignment syntax changes throughout • Audit and upgrade every Capacitor plugin for API 36 compatibility. Community plugins are where we expect breakage. • Handle the Android 16 behavior changes that affect us, including orientation-lock changes on large screens • Confirm the environment-conditional rendering behaves identically after the WebView upgrade • Confirm the URL-parameter session mechanism survives navigation, redirects, background resume, and checkout • Regression test the full shopping and checkout flow on real devices, both platforms. Emulator alone won't cover it. • Ship to Play and confirm acceptance • Check iOS SDK requirements while you're in there. Capacitor 8 changes both platforms, and Apple runs its own rolling minimum. Preserve the existing architecture What we need is confidence that the existing workarounds still function after the upgrade. Please don't replace them. • Confirm the session identifier propagates correctly through navigation, redirects, and the full checkout flow • Confirm environment-conditional rendering behaves identically post-upgrade • If something breaks, we want the smallest fix that restores current behavior rather than an improvement Not applicable: the app has no sharing functionality and no deep linking configured, so Android app link verification is out of scope. There are also no push notifications. Payment flow: checkout doesn't redirect to a payment provider's page. Card entry uses a Stripe iframe on-page, with saved cards on file through Stripe. Given no sharing, no deep links, and no push, the Stripe 3DS challenge is the only path where control can leave the page mid-session. That said, if you think something here is genuinely unsafe rather than just unfashionable, tell us. We'll listen. Out of scope • Rewriting the app as fully native • Redesigning the shopping experience • Migrating off Capacitor • Replacing the session-in-URL mechanism • Reworking the environment-conditional rendering Items to confirm at the start • Whether release capability covers both stores or Android only. Apple's certificate and provisioning chain is separate and expires on its own schedule. • Apple Developer account access, certificates, and provisioning profile status • Play App Signing enrollment status • Whether the build succeeds on the tooling Capacitor 8 requires: Android Studio Otter, Java 21, AGP 8.13 4. Secondary scope: web platform work We'd like to outsource ongoing development of the bytrellus.com Next.js application alongside the mobile layer, treating the two as one hybrid system instead of separate projects. Here's our thinking on keeping them together. Any change to the web app renders inside the mobile app, so web changes have to be validated inside the WebView on both platforms rather than only in a desktop browser, and they can't disturb the session-parameter mechanism or the environment-conditional rendering. If we split this across two people, that seam falls in the gap between them. We'll scope specific web updates separately. 5. Documentation We're after a long-term working relationship here, so this isn't about preparing a handoff to our internal team. We do still want two things written down: • A build-and-release runbook covering both platforms • A written inventory of the workarounds in the hybrid setup, what each one does, and why it exists