What happens after you click.

01 / communication

A weekly demo, in writing and on a call.

Every week you get a written demo note with what shipped, what is next and what I need from you, and a call to walk through it. We share one channel for questions in between. There are no status meetings; the demo is the status.

02 / tooling

Your repos, your cloud, your accounts.

Everything is created inside accounts you own from day one. I name every tool, model and service in the proposal, with its cost, before you pay anything. If a tool appears later, it is a written decision, not a line on an invoice.

03 / decisions

Written decision records for anything that costs money later.

Model choice, cloud provider, database, framework, build versus buy: each gets a short record in the repository with the options considered, the reason, and what would make us revisit it. Your next engineer reads why, not only what.

04 / what I do not do

• Hourly billing without a cap
• Unscoped retainers
• Rewrites when a fix will do
• Reselling platforms
• Agent washing: calling a scheduled script or a chatbot an agent

below $25,000

I do the work myself, from the first call to handover. You talk to the person who writes the code.

above $25,000

Specialists are named in the proposal before you sign, work under my contract and my review, and never hold credentials in their own name. I remain the one person you call.

if we disagree

If we disagree at a milestone, we hold a 30-minute review against the written acceptance criteria within 3 business days. If they are not met, the sprint invoice is cancelled or refunded within 10 business days.

how you pay

Card via Stripe for the instant offers and monthly plans. Invoices for everything else, bank transfer on request. A starting point, not a quote: if the kickoff call shows a different fit, the price changes before work starts, never after. If it shows the offer is wrong for you, you get a full refund.

01 / scope and acceptance

• Acceptance criteria are written in plain language and agreed before work starts
• Every criterion has been demonstrated, recorded or witnessed by your reviewer
• Anything out of scope is listed, so "not done" and "not asked for" cannot be confused
• Open questions are resolved or logged as follow-up tickets with an owner

02 / code and quality

• Reviewed by a second person, every comment resolved or deferred with a reason
• Automated tests pass in CI and cover the failure paths, not only the happy path
• Dependencies audited, pinned, and the build reproducible from a clean checkout
• Schema changes ship with a migration and a tested way to reverse it

03 / security and privacy

• Authentication and authorisation checked separately on every endpoint and screen, including negative tests
• All outside input validated at the boundary, including anything a model produces
• Personal data listed: fields, storage, retention, who can see it; never in logs or prompts without approval
• Secrets in a vault, never in the repository or its history; least privilege on every account

04 / ai-specific items

• An evaluation set exists, is versioned with the code, runs automatically and passes the agreed threshold
• Every prompt is versioned; the production version is identifiable from any log entry
• Any action with a side effect passes an approval gate or an explicit allow-list agreed with you
• Cost, latency and fallback behaviour measured and tested; the system says what it is

05 / performance and accessibility

• Performance budgets met on the target environment, not a developer machine
• Core Web Vitals in the good range on a mid-range phone over a throttled connection
• WCAG 2.1 AA checks run, plus a screen-reader pass of the primary journeys
• Tested on real devices at the smallest supported width

06 / operations

• Deployed by the pipeline, not by hand; infrastructure defined in code
• Alerts for availability, error rate and latency reach a named person, tested by triggering one
• Backups run on a schedule and a restore was performed, not assumed
• A rollback path exists, was rehearsed, and the runbook says how

07 / handover

• Documentation matches what shipped: README, architecture notes, API reference, runbook
• Repository, credentials, domains and cloud accounts registered to you
• Your named person can deploy, roll back and read the monitoring without me on the call
• Known limitations written down with an owner and a next step

08 / sign-off

Per release, in writing, by both of us. Items marked N/A carry a reason we both accept. Defaults such as test level, budgets and retention periods are recorded at the top of the document per engagement.

01 / ownership statement

• You own source, infrastructure definitions, prompts, agent configurations, evals, pipelines, designs and documentation
• Repositories transferred, not forked, if any started outside your organisation
• No Onebit-AI account remains as owner of any of your assets
• Third-party components listed with licences; model and SaaS subscriptions in your name

02 / repositories and access

• You hold admin on every repository and registry, verified by you
• Branch protection and required reviews configured and documented
• CI/CD runs under your service accounts
• My access downgraded or removed on the agreed date

03 / environments and infrastructure

• Cloud accounts owned by you, with root credentials held by you only
• Domains and DNS in your accounts, auto-renew on, every record documented
• A fresh environment can be created from infrastructure code alone, demonstrated once
• Budget alerts set on each account and routed to you

04 / credentials and secrets

• Secrets move through your secret manager or an expiring one-time link, never email or chat
• Repository history scanned for secrets, result attached
• Every secret I had access to rotated by you within 5 business days
• MFA enabled on every account listed

05 / documentation set

• README, architecture overview, runbook and decision records beside the code
• API specification, data model and migration history
• Prompt and agent catalogue: each prompt, its purpose, model, version and owner
• Evaluation reports and how to re-run them, so you can change a prompt and see whether quality moved

06 / operations

• Dashboards for availability, latency, error rate and, for AI components, cost and eval trend
• Alerts route to your channel; none goes only to me
• A restore test performed with you present, date recorded
• On-call expectations agreed: who responds, in what hours, how escalation works

07 / knowledge transfer

• Recorded walkthrough of architecture, deploy and runbook
• At least one live session with the people who will run the system
• A deploy led by your team and observed by me
• Support period with a start and end date agreed in writing, 30 days by default

08 / sign-off

Sign-off means you have verified sections 01 to 07 and accept the open items with their owners and dates. Open items do not block sign-off unless marked blocking. The date my access is removed and the date secret rotation was confirmed are written on the document.