TMQ Holdings · arlowe · Project status and handover

Where arlowe stands today

arlowe is an AI-first job planning and dispatch system for contractors, built for TMQ Holdings. A contractor prices each job line by line with cost and margin, assigns skilled crew or vetted subcontractors (by hand or through a blind reverse auction), and runs the job from estimate to invoice, with an AI agent that can do the same work from a chat. Its first users are three contractors: JCI, Ward and Liquid Liner.

A review of the arlowe code and planning documents in github.com/arloweai/arlowe, written so a new development team can pick it up from here. It covers what was promised, what exists, how good the code is, and what to do first.

As of Oct 20, 2026 Code reviewed: main @ 6bd0cca (Oct 17) Plus unmerged branch claude/zealous-cori-fwxiai

Bottom line

A sound foundation, well under half of the SOW built, and a Nov 1 plan that has not started building yet.

The base is usable. The code handed over by oBuilds runs, its database builds cleanly, and all of its automated tests pass. The core data model (companies, workers, jobs, line items, pricing and margin) is in good shape.
The workflow that makes it a product is missing. Of the 23 SOW features, 4 are complete, 15 are partly built and 4 are not started. Job statuses, change orders, line-level crew assignment, capacity, sub onboarding and QuickBooks output are the main gaps.
The plan is thorough; execution is at step 1 of 17. A detailed Nov 1 launch plan exists, with all 29 product decisions made. Only the first piece of step 1 has been built. The Oct 19 milestone (staging and automatic tests live) has passed without being met.
Four items need attention before anyone builds further: production still runs on the previous vendor's accounts, there is no copy of the production database, ownership of the unpaid Phase 3 work is unresolved, and there are known security issues in the code.

01 · The commitment

What was supposed to be built

arlowe is an AI-first job planning and dispatch system for contractors. The signed SOW with oBuilds, in three phases, promised a working web app for at least one production client, covering:

Phase	Scope	Backend built	Front end built
1	Core data model (companies, workers, service types, jobs, line items with price, cost and margin) and the job lifecycle (estimate, approval, change orders, unknowns, calendar and capacity)	50%	50%
2	Dispatch and subcontractors (inviting subs, manual dispatch with filters, reverse blind auction, sub performance) and integrations (PDF invoices for QuickBooks, generic CRM hooks)	35%	35%
3	AI foundation: an agent that reads and changes jobs from chat, completion photos and video with metadata, floor plan attachments	20%	20%

Backend is the server, database and agent tools; front end is the screens people use. Each figure starts from per-feature estimates in the line-by-line review in section 02 (complete features count fully, partial ones by how much works) and is set 10 points lower as a conservative allowance. Phase 2 excludes QuickBooks and CRM, which TMQ took on itself.

TMQ has since widened the goal well beyond the SOW. By Nov 1, three design partners (JCI, Ward and Liquid Liner) are meant to run real work on every screen of the arlowe App v2 design, plus push-to-talk voice, a phone and text agent, a supplier portal, QuickBooks Online push, sales and P&L reporting, and leads. None of those additions exist in code yet.

02 · Feature status

SOW versus the code, line by line

Based on the Oct 8 gap review in docs/gaps.md, with key findings re-checked in the code on Oct 20.

Show all 26 linesHide the lines

Complete (4) Partly built (15) Not started (4)

#	Feature	Status	What exists / what is missing
Phase 1 · Core data and job workflow
1	Companies and sub companies	Complete	Each company has its own workers. Only admins can create companies.
2	Worker catalog	Complete	Name, optional login, status, skills.
3	Service types (skills)	Partial	Skill list exists but ships empty; global only, admin-created.
4	Skill assignment rule	Partial	Missing skills are flagged but not blocked. Workers attach to whole jobs, not line items.
5	Line items with margin	Complete	Quantity, unit price and cost, extended values, margin, job totals.
6	Catalog defaults	Complete	Items carry default price and cost.
7	Estimate and approval	Partial	Estimate snapshot and customer e-signature link work. Jobs have no status; estimates can't be edited or sent from the app.
8	B2B jobs through subs	Partial	A sub can be put on a job at a price. The sub can't put its own workers on it.
9	Unknowns (e.g. surface prep)	Not started	No unknown flag, severity or assumed hours.
10	Change orders	Not started	No change order record. Bug: deleting a job line also deletes it from signed estimates and invoices.
11	Calendar and capacity	Partial	Month calendar and week timeline. No capacity per worker or team.
12	Reassign and reschedule	Partial	Works at job level; assignments have no dates or hours.
Phase 2 · Dispatch and subcontractors
13	Inviting subcontractors	Partial	Only subs who already have an arlowe login can be invited.
14	Sub self-management	Partial	Subs manage workers and catalog, but not their own service types.
15	Manual dispatch with filters	Partial	Manual assignment works. No skill, availability or distance filters; jobs have no address.
16	Reverse blind auction	Partial	Time-boxed, price steps down, tested working. Set in dollars, not margin; claimable before start.
17	Auction blindness and vetting	Partial	Subs can't see each other or the floor. No "approved" flag, and the server does not check the claimer is a connected sub.
18	Sub performance data	Not started	No outcome or feedback fields.
Phase 3 · AI foundation
19	Agent-ready data model	Partial	Core entities exist. Schedules are only job dates; chat is text only.
20	AI agent in chat	Partial	Chat on Grok 4 with 93 tools. No tools for subs, auctions, estimates or skills. Field test found it fails on partial names and multi-step requests.
21	Completion photos and video	Partial	One generic file per job note. No video handling or capture metadata.
22	Floor plans	Partial	Generic note attachment only.
23	Room for vision AI	Not started	Not demonstrated.
Deliverables and integrations
D1	Functional specification	Missing	Per-screen notes exist in `web/docs/views/`; no actual specification.
D2	QuickBooks (PDF invoices)	Missing	Browser print view only. TMQ took this on itself.
D3	CRM integration	Dropped	No CRM for Nov 1 (decided Oct 17). Leads to be entered in arlowe or imported from a spreadsheet.

03 · Code quality

How good is the code?

Checked by reading the code and running it locally on Oct 20 (Python 3.13, Postgres, Node 24).

Architecture health map

How each part of the system holds up today, from what users touch down to the accounts it runs on.

What people use

Web appFair

Vue 3, all 120 files in TypeScript, builds cleanly. No tests, no type check, one 500 kB+ bundle.

AI chat agentWeak

Grok 4 on the previous vendor's key. Loses context between turns; fails on partial names.

arlowe's server

APIGood

One area per business function; endpoints 88–100% tested. Needs security settings fixed and a Django upgrade.

Background workerFair

Standard Redis queue that runs chat replies. A failed run leaves the chat waiting forever.

Agent tool serverFair

93 tools load and work. One 2,279-line file with no tests (0% coverage).

Foundation

Data modelGood

Matches the SOW's core entities; 59 migrations line up exactly. One cascade bug on signed estimates.

kbde frameworkWeak

The previous vendor's private 20,400-line framework; arlowe uses ~6,000 lines. Single-person knowledge.

Runs on

Hosting and accountsNot TMQ's

Server, Postgres, Redis, file storage, email, AI key and DNS all sit in the previous vendor's accounts.

Standards scorecard

Fourteen practices a production codebase is expected to follow. The dot shows where arlowe is today; the status compares it with the level expected before real customers use it.

Today Meets on target Close one level short Gap two or more short

Code that needs cleanup~24%

About 12,700 of arlowe's own 52,600 lines, in 22 files, need cleanup: the agent tool server and chat agent, the security settings, the two estimate and invoice models with the cascade bug, the auction claim check, and the 11 screens over 600 lines. The remaining 76% stays as it is.

Separately, the previous vendor's framework (20,400 lines, about 6,000 of them used by arlowe) should be absorbed into arlowe's own code and later replaced with standard tools. New work such as tests, automatic checks and error alerts is added alongside the code, not counted as cleanup.

Check	Result	Detail
API automated tests	145 / 145 pass	All backend tests pass on a fresh Postgres database.
API built (vs SOW)	~40%	Across the three phases (50%, 35% and 20%, see section 01).
API test coverage	82%	Endpoints 88–100%; the agent's tool server 0% and chat agent 63%.
Framework support	Expired	Django 5.0 stopped receiving security fixes in April 2025. Upgrade to 5.2 LTS.
Lint check (ruff)	Minor	No linter configured. A default run finds 15 unused imports, 61 unsorted import blocks and no likely bugs.
Database migrations	Consistent	59 migrations match the models; a fresh database builds fully.
Web app build	Builds	Vue 3 + Vite builds cleanly. One bundle over 500 kB (no code splitting).
Web app built (vs SOW)	~40%	Across the three phases (50%, 35% and 20%, see section 01). Of the 49 design screens, 7 are fully backed by code and 26 partly.
Web app test coverage	0%	No unit, component or end-to-end tests; no type checking or linting set up.
Continuous integration	None	No automated checks on pull requests yet (planned in step 1).
Security basics	6 issues	See below. All are known and planned for step 1, none fixed yet.
Data integrity	1 bug	Deleting a job line silently changes signed estimates and invoices (a $44,330 signed estimate became $43,980 in testing).

Strengths

Clear structure: one Django app per business area (jobs, estimates, invoices, workers, skills, orgs, chat).
Sensible data model that matches the SOW's core entities; pricing and margin logic is correct.
Every API area has tests (145 tests, ~3,300 lines).
AI-ready by design: an MCP server exposes 93 tools so an agent can do most of what a user can.
Each of ~100 screens has a written spec in web/docs/views/, and coding conventions are documented.

Weaknesses

Built on kbde, the previous vendor's own 20,000-line framework (MIT licence). arlowe uses about 6,000 lines of it; knowledge of it sits with one person.
Custom API layer instead of a standard one (Django REST Framework), which makes hiring and onboarding slower.
The AI agent runs on Grok 4 through the previous vendor's personal xAI account, and loses context between turns.
Large files: the MCP server is one 2,279-line file; the biggest screens are 800 to 950 lines.
No front-end tests, so every UI change is checked by hand.
Runs on Django 5.0, which no longer gets security fixes.

Security issues found in the code

Issue	Where	Risk
Django secret key hardcoded in source	api/config/settings_base.py:23	Anyone with the code can forge sessions
Debug on and any host accepted by default	settings_base.py:26-28	Leaks internals if not overridden in production
Any website can call the API	api/config/settings.py:11	Cross-site requests
Uploaded files are public	api/config/settings.py:21	Job photos and plans readable by anyone with the link
Auction claims not checked on the server	api/v1/job/views.py:841	Any company manager could claim another contractor's auction
Email sent from the old vendor's domain	api/config/settings.py:26	Login codes depend on oBuilds' email account

04 · Progress against the plan

The Nov 1 build plan

The 17-step plan, all decisions and a CLAUDE.md for AI-assisted development are written, but sit on an unmerged branch. Building was meant to run around the clock from Oct 17.

Oct 8–9Code received from oBuilds, verified, gap list and acceptance test (27-step "duplex test") written

Oct 17Build plan and all 29 decisions finalised; first piece of step 1 merged (PR #1)

Oct 19 · missedAutomatic tests and staging live; text-messaging registrations submitted

Oct 20 · todayThis review

Oct 22Meeting with the previous vendor (Kurtis, oBuilds): production database, accounts, exit terms

Oct 28Feature freeze; partners' crew, subs and price lists due

Oct 30Production live on TMQ's own accounts (needs legal go-ahead on code ownership)

Nov 1JCI, Ward and Liquid Liner running real work

1Remove dependence on previous vendor, fix security basics, automatic tests
Done: kbde installs from the repo. Not done: security fixes, move kbde into arlowe's code, CI.Partial
2Switch the AI agent from Grok to ClaudeNot started
3Staging environment on RenderNot started
4Voice v1 (push-to-talk)Not started
5Jobs: statuses, customers, line assignment with skill rule, starter skillsNot started
6Change orders and unknowns; lock signed estimatesNot started
7Estimates and invoices: status flow, PDFs, emailNot started
8Subs: invite anyone, vetting, ratings, margin-based auctionsNot started
9Schedule: shifts, conflicts, capacityNot started
10Supply: supplier companies and material ordersNot started
11QuickBooks, sales, P&L, leadsNot started
12Field capture: photo, video, plans with metadataNot started
13Design pass to arlowe App v2Not started
14Phone and text agent; Claude connectorNot started
15Voice test and model choiceNot started
16Security review, then productionNot started
17Onboard the three partnersNot started

Steps 5 to 12 are each estimated at a few days of focused work. With 12 days left and staging not yet running, the full Nov 1 scope is not realistic.

05 · Risks

What could block the handover

Risk	Status	Why it matters
Production runs on the previous vendor's accounts	Open	Hosting, database, Redis, file storage, email, AI key and DNS are all outside TMQ's control.
No copy of the production database	Open	Partner data entered since August is on oBuilds' server. Without a dump, partners re-enter their jobs.
Code ownership of Phase 3	Open	Under the MSA, ownership transfers on payment. Phase 3 (the AI agent work) is unpaid. Legal sign-off is needed before production cutover.
Nov 1 scope versus time	High	16 of 17 steps not started; the first milestone has slipped.
Data model changes on live data	Planned	Moving assignments to line items and fixing the estimate-cascade bug both reshape stored data. Back up first; fix the cascade bug before any more deletes.
Outside approvals	Planned	Text messaging registration (5 to 10 days) and Intuit's QuickBooks review have no fixed turnaround.
Missing pieces from handover	Known	Git history before Aug 17, production settings and keys, and the vendor's AI build skills were not handed over.

06 · Recommendations

First steps for the team taking over

Reset the Nov 1 target to a launch slice.Ship steps 1, 2, 3, 5, 6 and 7 first: security, the AI agent on TMQ's key, staging, job statuses, change orders and the estimate-to-invoice flow. Move supply, phone/text agent, P&L and the full design pass to a second release.
Use the Oct 22 meeting to secure the hand-off.Get a full database dump, every account login (hosting, Postgres, Redis, S3, email, xAI, DNS) and a signed code assignment. Then rotate every key.
Merge the planning branch into main.The build plan, decisions and CLAUDE.md on claude/zealous-cori-fwxiai are the team's working brief and should be the single source of truth.
Fix the six security issues and the cascade bug before any new feature.All are small, contained changes in settings and two model fields. Upgrade Django from 5.0 to the supported 5.2 LTS at the same time.
Turn on automatic checks.Run the 145 API tests on every pull request, protect main, and add the duplex acceptance test as features land. Add basic front-end tests for the job and estimate screens.
Keep the base, phase out kbde.A rewrite is not justified. Move the parts arlowe uses into its own code, then replace them with standard Django tools after launch.

07 · Access and setup

What's needed to run arlowe

The access a team needs to work on the live app, and everything required to run it on a developer's machine.

What is running today

The live system is up and answering, on a server the previous vendor controls. The marketing site is separate and not part of this code.

Address	What it is	Status on Oct 20	Who controls it
app.arlowe.ai	The web app people sign in to	Live	Previous vendor's server
api.arlowe.ai	The API behind the app	Live	Previous vendor's server
mcp.arlowe.ai	Tool server the AI agent uses	Live	Previous vendor's server
arlowe.ai	Marketing website	Live	Separate host; not in this repository

Access the team needs

Access	Why it's needed	Held by today	Status
GitHub: `arloweai/arlowe`	The code, history and planning documents	TMQ	Available
Production server	Deploys, logs and restarts for the app, API, worker and agent tool server	Previous vendor	Needed
Production database (Postgres)	A full backup before any change, and the partners' data since August	Previous vendor	Needed
Redis	Background job queue for chat replies	Previous vendor	Needed
File storage (S3 bucket)	Photos, plans and files attached to jobs	Previous vendor	Needed
Email sending account	Login codes and invites, sent today from no-reply@obuilds.com	Previous vendor	Replace
AI key (xAI, Grok 4)	The in-app chat agent; currently the vendor's personal account	Previous vendor	Replace
DNS for arlowe.ai	Points app, api and mcp addresses at the server	To confirm	Confirm
Admin login on the live app	Checking real data and behaviour	Previous vendor	Needed
New TMQ accounts (Render, Claude API, Deepgram, Cloudflare R2, Resend, Twilio, Sentry)	Hosting, AI, voice, storage, email, texting and error alerts on TMQ's own accounts	TMQ	Planned

After every account moves to TMQ, change every key and password, and generate a new Django secret key.

Running it on a developer's machine

1Install Python 3.12 or newer (tests also pass on 3.13), Node 22, Postgres 16 and Redis.
2Backend: in api/, run pip install -r requirements.txt, then ./manage.py migrate.
Installing kbde downloads Bootstrap from GitHub and can hang behind a firewall. If it does, install the other requirements and point PYTHONPATH at the kbde/ folder instead.
3Start the three backend processes: the API (./manage.py runserver), the worker (./manage.py rqworker) and the agent tool server (./scripts/run_mcp_server_dev.bash), or all at once with honcho start -f Procfile-dev.
4Web app: in web/, run npm install, then ENDPOINT_URL=http://localhost:8001 npm run dev.
5Tests: ./manage.py test in api/ runs all 145 backend tests in about 30 seconds.

Environment variables

Example values are for a local machine. Production values sit with the previous vendor and must never be committed to the repository.

Variable	What it sets	Local example	Needed
Backend (API, worker, agent tool server)
DJANGO_SETTINGS_MODULE	Which settings file Django loads	config.settings	Always
PYTHONPATH	Lets the API import kbde when it isn't installed as a package	path to kbde/	If kbde not installed
APP_NAME	App name used in emails and pages	arlowe	Always
APP_HOST, AR_API_HOST	Public address of the API; the agent tool server calls it	http://localhost:8001	Always
UI_HOST	Address of the web app, for links and allowed origins	http://localhost:5173	Always
APP_DEV_PORT	Port for the local API server	8001	Local only
MCP_SERVER_PORT	Port for the agent tool server	8002	Always
DATABASE_URL	Postgres connection	postgres://localhost:5432/arlowe	Always
REDIS_URL	Redis connection for the queue and cache	redis://localhost:6379/0	Always
DEBUG, DEBUG_EMAIL	Debug mode; DEBUG requires an email to receive outgoing mail	1, your email	Local only
DEBUG_PHONE_NUMBER	Receives outgoing texts in debug mode	your number	Optional
XAI_API_KEY	Key for the in-app chat agent (Grok 4)	your key	For chat
EMAIL_HOST, EMAIL_PORT, EMAIL_USERNAME, EMAIL_PASSWORD	Outgoing email server	provider values	For email
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_STORAGE_BUCKET_NAME, AWS_S3_ENDPOINT_URL	File storage for uploads (S3 or a compatible store such as R2)	provider values	For uploads
RQ_SYNC	Runs background jobs immediately instead of queueing them	1	Optional
DJANGO_LOG_LEVEL, APP_LOG_LEVEL	How much the server logs	INFO	Optional
Web app
ENDPOINT_URL	Address of the API the web app calls; required to run or build	http://localhost:8001	Always
UI_DEV_PORT	Port for the local web app	5173	Optional

Appendix · For developers

Repository at a glance

Area	Technology	Size
`api/`	Django 5.0, Postgres, Redis + RQ worker, FastMCP server, LangChain Deep Agents (Grok 4)	~9,400 lines + 3,300 test lines
`web/`	Vue 3, Vite, TypeScript, Bootstrap 5	112 view files
`kbde/`	Previous vendor's base library (MIT, kBuilds LLC)	~20,400 lines
`docs/`	SOW, gap list, duplex acceptance test, decisions, handover record, design file	—

Document	Use it for
`README.md`	Local setup: four processes (API, worker, MCP server, web) and environment variables
`docs/sow.md`	The contract baseline
`docs/gaps.md`	Line-by-line to-do list, plus five field-test bugs (F1–F5) with file and line references
`docs/duplex-test.md`	27-step acceptance test; run after every change
`docs/handover.md`	What oBuilds handed over, commit hashes and accounts to transfer
`docs/build-plan.md`*	Steps 1 to 17 with the gaps each closes, and data-migration risks
`docs/decisions.md`*	All 29 product decisions (statuses, roles, auctions, change orders, voice)
`docs/in-house-plan.md`, `CLAUDE.md`	Launch plan, accounts, costs, and rules for AI-assisted development

* On branch claude/zealous-cori-fwxiai, not yet merged into main.

Area	Screens	Code has	Still needed
Today, sidebar, chat	5	Chat, 93 agent tools, conversation list	Attention cards, badges, recent chats; agent does 2 of the design's 13 actions
Talk (voice)	1	Nothing	All of it
Jobs, job page, forms	4	Jobs, projects, lines with price, cost, margin	Job status, contract and change totals, who is on each line, Push a week
Changes and unknowns	4	Nothing	Change orders with customer approval; unknowns
Crew and line assignment	4	Workers with skills, on whole jobs	Per-line assignment, skill rule, owner override
Subs and auction	5	Invites to existing users, auction in dollars	Invite anyone, vetting switch, trade, distance, rating, margin rounds
Schedule	2	Month and week views	Shift hours, conflicts, capacity by trade
Estimates	2	Estimates, e-signature link, print view	Status flow, send from app, becomes job budget
Invoices	3	Invoices with status, print view	Send, PDF, email, change orders on invoice, QuickBooks
Sales and P&L	4	Line totals only	Dated sales, goals, full P&L with overhead, PDF
Leads	1	Nothing	Lead entry and spreadsheet import, lead to job and estimate
Settings	7	Items, units, skills, users	Starter skills, company skills and profile, job defaults, QuickBooks, roles
Accounts, orgs, supplier	6	Sign-in, profile, org list	Org types, supplier view, org switching
Field capture	1	One file per job note	Photo, video, plans with who, when, phase, GPS