Tenfo

Tenfo turns unclear requests into clear agreements and trusted payments.

Comment

Tenfo Project Story

Inspiration

Professional projects often fail before the work begins. A requester may understand the outcome they need without knowing the terminology, scope, or risks involved. Important assumptions remain hidden, messages are mistaken for agreements, and payment approval becomes disconnected from the work that was actually accepted.

Tenfo was inspired by a simple principle: AI should help people understand and structure work, but people should retain control over every consequential decision.

We wanted to build a platform where someone could begin with a plain-language description, receive useful guidance, and turn that request into a clear agreement without allowing AI to silently make commitments on their behalf. The original request, AI suggestions, user corrections, approved scope, professional acceptance, review findings, and payment decisions should remain distinguishable and auditable.

What it does

Tenfo supports the complete lifecycle of professional work:

  1. A requester describes what they need in their own words.
  2. AI-assisted intake identifies missing details and prepares a structured brief.
  3. The requester reviews, edits, and explicitly approves the brief and budget.
  4. Tenfo presents relevant professional profiles without automatically selecting or contacting anyone.
  5. The requester chooses a professional and approves the exact contact message.
  6. The professional accepts the proposed work, and the requester confirms the assignment.
  7. The requester approves a PayPal Sandbox order during checkout.
  8. Tenfo binds the approved payer, seller, amount, currency, and agreement before authorization.
  9. Both parties collaborate through conversations connected to the specific task.
  10. The professional provides review packages containing notes, files, or live links.
  11. The requester records findings, accepts the work, and separately approves payment release.

Tenfo also supports optional independent reviews. Reviewer discovery, conflicts, scope, fees, and availability are represented in the same professional profile system. All required participants must accept the review engagement before it begins, and a reviewer fee can use its own payer-approved PayPal flow.

The platform deliberately keeps important decisions separate. Approving a brief does not contact a professional. Sending a message does not amend an agreement. Accepting work does not automatically release payment.

How we built it

Tenfo is implemented as a TypeScript monorepo with clear boundaries between the web experience, domain logic, integrations, and background processing.

  • Next.js App Router and React provide the web application and API routes.
  • TypeScript and Zod provide typed, schema-validated boundaries.
  • Tailwind CSS supports the responsive interface.
  • PostgreSQL and Drizzle ORM store versioned workflow state through append-only migrations.
  • pg-boss powers background jobs and outbox processing.
  • PayPal Orders APIs support seller onboarding, buyer approval, authorization, capture, webhook verification, and reconciliation.
  • Schema-validated AI adapters support intake interpretation, clarification, and brief composition.
  • Vitest and Playwright cover domain, integration, API, and browser behavior.
  • Docker Compose, Caddy, and AWS EC2 run the deployed public beta.

The domain is modeled as explicit state machines rather than loosely connected forms. Contracts, agreements, reviews, payment decisions, and release approvals are bound to exact versions and participants.

Payment operations are designed to fail safely. External network calls never run inside database transactions. Provider outcomes can be successful, declined, or unknown, and uncertain outcomes must be reconciled instead of blindly retried. Stable idempotency keys, immutable payer snapshots, append-only operation records, authenticated callbacks, and database constraints protect against duplicate or mismatched captures.

AI output is treated as a proposal rather than authority. The system preserves the requester's original wording and requires explicit confirmation before suggested information becomes part of an approved brief.

Challenges we ran into

Making AI helpful without giving it authority

The first challenge was separating assistance from consent. AI can organize a request and identify unanswered questions, but it cannot choose a professional, create binding requirements, accept terms, judge work quality, or authorize payment.

This required preserving provenance across original text, generated proposals, user corrections, and approved versions.

Building a safe payment lifecycle

A payment button is straightforward. A trustworthy payment system is not.

We had to account for duplicate callbacks, concurrent reconciliation, expired authorizations, network timeouts, changed payer accounts, seller restrictions, mismatched economic data, and provider responses whose outcomes were uncertain.

The final design establishes the buyer's PayPal identity from an approved checkout order, revalidates the professional's seller account before capture, and prevents economic bindings from being rewritten afterward.

Coordinating a long workflow

Tenfo connects intake, agreements, professional selection, messaging, execution, review, and payment. Each stage needed clear transition rules so that one action could not accidentally imply approval of another.

Supporting flexible human roles

A member may be a requester on one task, a professional on another, and an independent reviewer elsewhere. Modeling these as task-specific relationships avoided artificial permanent account roles while preserving authorization and conflict checks.

Deploying the complete system

The application includes a web service, background worker, PostgreSQL database, migrations, object storage integration, health checks, and external provider configuration. Deploying these components as a reproducible public beta while keeping credentials and live payment capabilities safely gated required substantial operational work.

Accomplishments that we're proud of

  • We built a functioning end-to-end workflow instead of a static prototype.
  • We integrated PayPal Sandbox seller onboarding, buyer-approved orders, authorization, capture, webhooks, and reconciliation.
  • We made payer identity part of checkout approval instead of requiring a disconnected setup step.
  • We created a payment policy engine with explicit, auditable checks before money can move.
  • We implemented immutable economic bindings and append-only payment records at the database level.
  • We kept AI-generated suggestions separate from user-approved decisions.
  • We connected agreements, conversations, submissions, reviews, and payments to exact task and contract versions.
  • We added optional paid independent reviews with consent and conflict controls.
  • We built evaluator fixtures that remain reproducible without pretending simulated payments are real transactions.
  • We deployed a public beta with automated migrations, health checks, a worker process, and persistent PostgreSQL storage.

What we learned

The biggest lesson was that trust comes from boundaries that users can understand and systems can enforce.

We learned that:

  • AI provenance is as important as AI output quality.
  • Every approval needs a precise meaning and scope.
  • Payment integrations require reconciliation, not only successful API responses.
  • Unknown provider outcomes must be treated as real states rather than generic errors.
  • Database constraints and immutable records provide protection that application logic alone cannot.
  • Idempotency must be designed across API requests, database writes, callbacks, and background jobs.
  • Human review should preserve uncertainty instead of manufacturing a binary verdict.
  • Communication, agreements, evidence, and payments should remain connected without allowing one to become automatic consent for another.
  • Testing financial workflows against a freshly migrated disposable database catches problems that unit tests alone cannot reveal.

What's next for Tenfo

The current public beta uses PayPal Sandbox for member payment flows and simulated payments for evaluator fixtures. Live payments remain intentionally disabled until production credentials, partner approval, compliance requirements, and operational controls are complete.

Our next priorities are:

  • broader usability and accessibility testing;
  • stronger evaluation of AI-assisted intake across more professional domains;
  • additional currencies with explicit validation and no silent conversion;
  • improved professional and reviewer discovery;
  • richer notification and activity-history experiences;
  • more browser-level tests for concurrent and interrupted payment flows;
  • operational dashboards for webhooks, reconciliation, and payment exceptions;
  • completion of the legal, compliance, and support processes required for responsibly enabling live payments.
  • improved user experience and a more polished UI.

The long-term goal is for Tenfo to become a trusted coordination layer for professional work: clear agreements, explicit consent, accountable collaboration, and payments that move only when the people involved have approved the correct step.

Built With

Share this project:

Updates

Submission history