What we found: the code already on GitHub that does this 100x better
Written 2026-08-29 from the seven analysis lanes, three competitor lanes, and an adversarial review that broke two of the four original claims. Every claim below is verified at source or against a real vendor page; killed claims are kept visible because knowing what NOT to port is worth as much as knowing what to.
What the client is actually building
Camron thinks he built a CRM. He built the operating system for a creator-talent agency — the back office that runs the business. There is no name for the category, so he called it a CRM and hand-built every part.
The market fact that reframes everything
Every named competitor is fan-layer software. The agency back office is empty. Verified across Infloww, Supercreator, CreatorHero, OnlyMonster, Scrile, FansMetric, Substy, OFManager: NONE do invoicing, payroll disbursement, contracts/e-sign, or a content pipeline. They compete on one axis — chat inbox speed and AI chat quality. Camron built the half nobody sells. His app is the complement to Infloww, not a competitor to it.
(Sharpening: Infloww and CreatorHero DO measure per-chatter revenue attribution. What the market lacks is payment EXECUTION and finance/legal DOCUMENTS — disbursement + statements
- tax forms + contracts. That is precisely Camron's half.)
What to PORT (survived adversarial review)
1. Money -> a double-entry ledger that models earnings as trust liability, not revenue. The highest-value port. Talent agencies (Syngency, AgencyPin, Prism.fm) treat platform money as belonging to the creator: a per-creator liability sub-ledger with periodic statements that prevent split disputes. Camron models this as a float commission field computed two contradictory ways (referrals.ts:534 vs :546). Medici (double-entry JS, verified) or Beancount's model is categorically better than what exists. This becomes existential the moment a creator disputes a split or the agency is audited. In licensed US states, commingling can void the contract against the talent.
2. Auth/identity -> better-auth + convex-helpers (first-party, Apache-2.0). Not a feature — the foundation. 52 money/credential write functions currently trust a client-supplied identity; gamification.ts:185 already wrote the pattern (assertQuestManager) and wired it to the caller's honesty. Nothing else is safely buildable until this exists.
What to STUDY, not port
Content pipeline -> steal Immich's patterns (EXIF/GPS stripping, perceptual dedupe, scan/index model), do not mount a DAM. His pipeline is his best work; the gaps are specific, not structural.
What NOT to port (killed by review — recorded so we don't repeat the mistake)
CRUD generator (Refine): killed. Pages are 11% of the code (7,698/68,706), not 40%, and the biggest pages are the least generatable. Refine's promise-based getList with required total fights Convex's 79 push-based useQuery subscriptions and 1 paginate call against 166 .collect(). It would remove his reactivity and force a query-layer rewrite.
Mount Chatwoot for the fan layer: killed. Our own research says "port the data model, don't deploy it" and rates the inbox gap not urgent. There is no conversation/message/fan table among the 56 to mount onto. It is greenfield, not a port.
BUY, don't build (verified vendors)
- Contractor pay + tax forms: Deel (~$49/contractor), Trolley (W-8/W-9, 1099/1042 e-file).
Note: 1099-NEC threshold rose $600 -> $2,000 for payments from 2026-01-01 (OBBBA).
- Age/ID/KYC verification: Yoti (openly serves adult platforms), Persona (from $250/mo).
A real near-term legal requirement; expect adult-vertical premiums or vendor refusal.
- Chatter QA: MaestroQA-class scorecards. His gamification layer rewards a measurement
layer that does not exist — QA scoring is the thing underneath it.
The finding bigger than the thesis (adversarial review, verified at source)
convex/googleDrive.ts is an unauthenticated write handle on the LIVE Google Drive. Four public actions mint a Workspace OAuth token (driveClient.ts:53-66) and act on the real Drive: trashDriveItem (:155, any fileId, no ownership check), createDriveFolder, listFolder (all-drives), markUsed. A public query hands out folder IDs to enumerate. It is the only finding whose blast radius escapes the Convex deployment and its backup guarantee — the consequence is the agency's irreplaceable content library, bounded only by Google's 30-day bin. Plus two more destructive public mutations beyond the known nine: resetIndex (driveScan.ts:326, wipes the index + thumbnails; module already imports internalMutation) and migrateToPeriodCycles (invoicing.ts:628, re-merges real money if re-run).
Claim 0 — the operating contract (the adversarial review's strongest point)
Before more code: decide what HALO IS — an internal back office, a product for other agencies, or a fan-revenue OS — and define what is authoritative, who may change it, what must be retained, and what must be exportable when a platform bans an account or a chatter leaves. Every graft below increases the number of places truth can diverge (39 Supabase files, float money duplicated across two settlement paths, no audit trail, no compliance lane). The highest-value NEXT move may be a workflow + business audit — watch one onboarding, one shift, one payout, one dispute — not adopting any repo at all.
The corrected build order (adversarial review reordered this)
My first draft said "auth first." The review caught that as wrong: server identity is a RELEASE gate for new features, not the FIRST action. The plaintext credentials and the public wipe endpoint are live NOW, and encryption-at-rest cannot repair a breach that may already have happened. Containment comes first.
- Contain the live blast radius. Internalize every reset/demo/migrate mutation and the
four Drive write actions; disable public vault reads/writes; ROTATE creator-platform and employee credentials; inspect production logs. Incident response, not architecture — hours, not days. Rotate before internalizing, or a still-public resetAndSeed erases the freshly-rotated plaintext.
- Make changes reversible. Preview deployments (fixes the documented deploy-split
incident), separate preview data + Drive roots, backups, and a restore DRILL.
- Characterization tests on the invariants that matter — auth escalation, destructive
functions, vault access, invoice settlement, payment mutations. convex-test covers the backend, not Vercel coupling / localStorage / Drive behavior.
- Identity + authorization as a vertical slice, not a flag day. Derive actor identity
server-side; protect admin/credentials/payments/payroll/creators/contracts first. "Authenticated" is not "authorized" — each of 221 functions needs a tenant/ownership answer. Weeks, not a wiring fix.
- Economic + provenance truth. Append-only audit records and integer minor-unit money
ALONGSIDE existing fields; run old/new calculations in parallel before switching reads.
- THEN feature ports (the trust-liability ledger; better-auth as the identity engine), on
a foundation that can hold them.
Note on my earlier framing: "auth first" confused construction dependency with release dependency. You CAN model fan records, audit schemas and attribution before auth exists — you just cannot ship them safely. And "fix the actorId wiring" is not small: a verified identity does not answer which tenant a user belongs to, whether an employee may see a given creator, or which functions are intentionally public. That is the week-scale work in step 4, not a one-line change.