Credential verification web app — Next.js + Supabase, 4 milestones

Credential verification web app — Next.js + Supabase (4 milestones) We are building a mobile-first PWA where a professional submits a credential they hold (degree, professional licence, certification). It is verified against the issuing institution by a human operator through an internal console, and the result is stored with full provenance. There is NO automated verification in this phase, no blockchain, no AI, no wallets, and no third-party identity provider. Please do not quote for any of these. Four milestones, quoted separately: M1 Foundation — schema with row-level security, auth with a regional signup gate, issuer table with alias and trigram matching, institution-first intake, four-way routing by issuer tier M2 Submission and consent — credential form, mobile OTP, private file storage with hashing at upload, two independently refusable consent records, per-account caps, conflict detection on duplicate credential numbers, signup and submission metadata capture M3 Operator console — separate auth with audit log, queue by issuer, batch CSV export, manual paste-in of registrar replies, adjudication screen, immutable verification receipts with canonical hashing, account clustering view, nightly retention job M4 Points and referrals — an append-only points ledger, continuous multiplier curves frozen at submission, a nightly settling job with clawback, cohort counters, gated single-tier referrals Stack proposed: Next.js on Vercel, Supabase (Postgres, Singapore region), Resend or Postmark, pg_cron, Sentry. Alternatives welcome with reasoning. The full specification is 20 pages and will be shared with shortlisted candidates. Please do not quote a total without seeing it. In your reply, tell us: 1. Your available days per week, not just total days 2. How you would build an append-only ledger that can reconstruct any user's balance at any historical date, and produce a consistent full-population balance export at a specified timestamp without pausing the service 3. How you would handle a data-erasure request against that ledger while preserving reconstruction 4. Whether you have built inbound email handling before Replies that do not address points 2 and 3 will not be considered.