#TradeForce — product overview

#Product summary

TradeForce is a shift marketplace for concrete-trade contractors and the companies that hire them. Companies post jobs and shifts, contractors browse and apply, both sides track time and approvals, and contractors review payment cycles. Platform admins verify accounts, inspect shifts and invoices, and set skill-based rates.

Unauthenticated visitors land on the public index, where they can sign in, sign up, request a password reset, or complete email verification. After authentication, the product routes each person by role and onboarding state: unfinished profiles go through role onboarding; contractors enter the shifts-and-profile workspace; companies enter the shift dashboard; admins enter the admin console. Shared chrome (header plus contractor or company side navigation) then opens time tracking, payments, chat, and related tabs.

The rebuild keeps that product shape: React SPA under app/, Supabase auth/data/edge under app/supabase/. New users start unapproved (Approve false on signup). Money-field and most database writes that today run in the browser must become server-authorised in the target stack. Marketplace Connect/payout behaviour is present as fields and settings, not as a fully documented in-app Connect journey — treat it as a programme boundary (see open questions).

Out of product journey scope: the stub 404 page.

#Roles

Three roles are encoded on the user profile (Role option set; storage values contractor, company, admin):

Signup captures role from a type dropdown and sets approval to false. Index page-load routing then sends:

• users who still need onboarding → onboarding
• admin → admin console
• contractor (active / onboarded) → contractor shifts & profile
• company (active / onboarded) → company shift dashboard

Verification and “active” flags gate entry into the marketplace surfaces; admin tabs separately list verified vs not-verified companies and contractors.

#Capabilities

Skill specialties in the product today (option set skill_set): Concrete Finisher, Concrete Laborer, Concrete Walls, Concrete Carpenter. Document types for onboarding credentials (option set docs_type): Diplomas, Resume, Mask Fit Test, Driver's license, Hearing examination-OSHA, References from two foreman/managers, and specialty credentials.

#Cross-cutting rules

1. Authentication is native Bubble today. Index workflows perform Sign Up, Log In, and Send Password Reset Email; the reset-password page performs Reset Password; header/onboarding can Log Out. Target identity must be chosen and cut over deliberately — sessions and password hashes do not transfer.
2. Role + onboarding + approval gate access. Signup sets Approve false and stores role from the type dropdown. Page-load redirects combine logged-in state, role, onboarding flag, and active flag before opening role homes.
3. Shared UI ownership. Job detail, shift row actions, and end-job popup are single implement surfaces reused by company and contractor (and time-tracking) flows — do not fork them per module.
4. Writes must move server-side. Nearly all persistent mutations live in page/reusable client workflows today. Money fields on company, end-job, admin, and payment flows especially need transactional server authority; the same rule applies more broadly to shift, admin, payment, and time-tracking writes.
5. Time-tracking backends are not a line-for-line port. Backend events create tracking lists, send approvals (including a self-scheduling approve workflow), and provide a delay helper. Rebuild as explicit jobs/queues with retries.
6. Transactional email is Postmark (template sends). Used for canceled shifts, new chat messages, new time-tracking reports (companies), and upcoming payment cycles (contractors). Calls are client-side in the export and need a secret-bearing server endpoint in target.
7. Location lookup is Country State City API. Onboarding fetches US states and cities; also client-side in the export → server proxy in target.
8. Every live type carries privacy roles. All nine types that survive in the export have rules (user, shifts, documents, skill_set, chat, message, notification, custom_rate, time_tracking1). The five without rules — company, job, rates, time_tracking, current_contractors_info — are marked deleted: true in the export and are not migrated (see docs/DATA-MODEL.md), so no live type is unprotected. Target RLS re-expresses those nine role sets; note that privacy_role:user:everyone grants search_for to unauthenticated visitors — the only permission any everyone role carries.
9. Marketplace money is a programme boundary. User Stripe account id / name fields and Stripe Connect client settings exist; do not invent Connect KYC or payout UX beyond export evidence until scope is answered.
10. One live time-tracking type. time_tracking1 (display “Time tracking”) holds live rows and is the only one every surface writes; the older time_tracking is deleted: true in the export and is not migrated. The single leftover reference is the stale btype_id in the send_tracking_approve condition — its parameter is already custom.time_tracking1.

#Traceability

#IR evidence

#Pages and module map

Slices (path-key → prefer inventory id): /pages/bTGbC → bTGYf; /pages/AAW → AAL; /pages/bTHDr0 → bTHDn0; /pages/bTHMh → bTHMg; /pages/bTIbd → bTITd; /pages/bTJIF0 → bTJFi0; /pages/bTIzW0 → bTIzV0; /pages/bTHuo0 → bTHun0; /pages/bTJSr0 → bTJQD0; /pages/AAX → AAU.

#Reusables (element definitions)

#Auth actions chased

• Sign Up (bTHpx1 on index): writes role_option_role from dropdown bTGzw0, sets approve1_boolean false.
• Log In (bTHop1), Send Password Reset Email (bTHqz1), Reset Password (bTHrP1 on reset_pw), Log Out (header bTHuE1, onboarding bTKpS).
• Index PageLoaded ChangePage targets: onboarding bTHDn0, admin bTHun0, contractor bTHMg, company bTITd (workflows bTHqV1, bTKna, bTKnB, bTKnO) conditioned on role option values admin / contractor / company plus onboarding/active flags.

#Backend API events

#Privacy & authorization

Types with privacy roles: user, shifts, documents, skill_set, chat, message, notification, custom_rate, time_tracking1.

Types without privacy roles in export: company, job, rates, time_tracking, current_contractors_info — target access must be decided (HQ-3).

#Skill specialties (skill_set option values)

#Onboarding document types (docs_type option values)

#External systems

• external_ns:bTNMZ — Postmark template emails (canceled shifts, new message, new time-tracking report, upcoming payment cycle).
• external_ns:bTKtr — Country State City states / cities calls for onboarding location.

#Open programme risks (module-map)

• MON-MARKETPLACE → MOD-PAYMENTS
• MON-CLIENT-WRITES / LOG-CLIENT-WRITES → company shifts (and related write surfaces)
• LOG-RECURSIVE → MOD-TIME-TRACKING
• ACC-AUTH-SURFACE → MOD-AUTH

#Needs human clarification