Prototype Scope

Exactly what this build demonstrates, what is simulated only, and what remains real engineering and validation work.

1. Confirmed prototype behavior

Built & clickable

Shared-tablet workflow

Tablet-first layout with large touch targets, sticky project worksheet header, and a floor-friendly navigation model for a shared shop tablet.

Visible technician PIN UI

Numeric 4-digit PIN pads are visible wherever the spec calls for them: clock in/out, archive actions, and the settings gate.

Project worksheet

Sticky top card with customer, vehicle and project code; sequential departments, main services and subservices with status icons and the single time modal (current workers, alphabetical technician selector, Clock In, Clock Out → Pause or Complete).

Notes

Note entry at department, main service and subservice level with name selection on the shared tablet.

Media gallery UI

Photo and short-video tiles, the damage annotation editor (draw, arrow, box, label, undo/redo, four colors) and a 30-day recovery area presentation.

Management & settings UI

Manager/Admin PIN-gated settings menu, role-based options, technician denial, and the 10-minute inactivity return to Active Projects.

Reports & audit UI

Timesheet drill-down from project totals to department, main service, subservice, technician and session rows, plus a filterable combined audit history view.

Signup & billing lifecycle mock

Multi-step onboarding, plan and payment method presentation, verification-code simulation, and trial / grace / suspension / reactivation state visuals.

2. Simulated-only behavior

Not real

These appear to work on screen, but nothing is enforced, sent, stored or charged.

Authentication & PIN enforcement

PINs are hardcoded for demo (1234); there is no hashing, rate limiting, sessions or trusted-device verification.

Role checks

Manager/admin/technician gating is a visual simulation only; nothing is enforced server-side.

Timers

Clock-in, pause and complete states are in-memory demo state; no real time persistence or auto-pause alerting exists.

Notifications

Email and text alerts (auto-pause, trial reminders, billing recovery, verification codes) are never sent.

Exports

Excel/PDF export buttons do not generate files.

Media upload, camera, compression & annotation saving

The gallery and annotation tools are presentational; no upload, capture, compression or annotated-image persistence occurs.

Audit persistence

Audit history is session-local demo data, not tamper-evident storage with retention windows.

Payments & billing states

Plans, card capture, invoices, grace periods, suspension and reactivation are visual mock states; no payment provider is involved.

3. Deferred — Google Calendar

Future feature — not built

Desired future flow: a Google appointment creates a reviewable draft project; a manager reviews, finalizes and activates it. The exact calendar event format, and how event updates, duplicates and cancellations are handled, remain intentionally deferred.

4. Production validation still required

Before any real launch

Per-business isolation

Multi-tenant data separation, access scoping and isolation testing across businesses must be designed and validated.

Privacy & data retention

Retention windows (30-day media recovery, 90-day post-suspension hold), export-before-deletion flows, privacy policy and data processing agreements.

Security

Real authentication, PIN hashing and rate limiting, session handling, server-side role enforcement, and penetration/security validation.

Payment provider behavior

Subscription billing, dunning, failed-payment grace, suspension and reactivation behavior against a real provider.

Email & text providers

Deliverability, templates, verification codes and recovery flows with real email/SMS providers.

Regional legal review