Consulting Rebrand — Offering Plan

Working plan for JoyRudder LLC’s productized consulting offering. Living doc; hardened through a /leverage planning-team deliberation + three adversarial critique-swarm cycles (12 angles). Standing rule: default-defer. This plan refines by adding; Rick’s scarcest resource is attention. Only build surface the *last sale proved necessary.*

---

★ North Star — Two milestones on one trajectory (job-now → leverage-later)

Milestone	Gross target	Mode
Q1 2027 (Jan–Mar)	$40k — see reframe below	Solo. Productized fixed-price. Cash-now.
Q4 2027 (Oct–Dec)	$60–75k (~$20–25k/mo)	Solo + 1099 subcontractor if needed. Leverage.

⚠ $40k realism reframe (feasibility + coherence critics, HIGH confidence). As cash collected inside a cold-start Q1, $40k is ~1.6–2.2× reality — it fails on five independent grounds: Care Plans bill ~1 month not 3 in a ramp quarter; delivery volume (3 Hardenings + 4 HCs) needs ~335–585h vs a ~230h/quarter ceiling; the 4-wk WTP gate + insurance long-pole eat January (~8–9 sellable weeks, not 13); the path implies ~75% HC→Hardening conversion vs the plan’s own 30–40% kill-line; plus a HC-credit double-count. Cleanest honest framing: ~$22–25k collected in Q1, exiting Q1 at a ~$13k/mo run-rate → $40k is the run-rate to reach by end of Q1, not cash booked within it. Levers to close the gap if $40k-collected is firm: start pipeline before January; go fewer-bigger with funded/high-ACV clients; raise package prices. This is the #1 question for the delphi-chain council.

Refocus from hourly rates to fixed-price, outcome-based service packages. Hourly is the fallback for true unknowns, not the default. Productized revenue isn’t capped by billable hours — and only productized (spec’d) work can be handed to a subcontractor later. An in-Rick’s-head hourly service can’t be handed off.

Fork (frames §7.5; final job-vs-business call deferred to renewal evidence per §7.5/§8.8): Q1 is a cash-now job — maximize booked revenue, minimize admin/brand overhead. The Q4 jump exceeds solo capacity, so the arc bends toward leverage: the contractor bench becomes a Q2–Q3 build, and repeatable/templatized delivery (§6.6) is a Q4 prerequisite, not polish.

Illustrative steady-state quarter (the ~mid-2027 run-rate, NOT cold-start Q1 cash): 4 × Health Check @ ~$2k = $8k · 3 × Hardening @ ~$6k list less ~50% HC credit ≈ $5k net each = $15k · 3 × Care @ ~$1.5k × 3 mo ≈ $14k → ≈ $37k+. In Q1, Care bills ~1 month each (starts ~March after HC→Hardening), so front-load on HC + Hardening; Care is a Q2+ pillar. Fewer-bigger: ~3 anchor clients running the full ladder (~$12–14k each) ≈ $36–42k — two anchors ≈ $28k, short of target.

Q4 $60–75k lever (margin-gated — underwrite before committing): a vetted 1099 executes templatized Hardening/Care under Rick’s review. At $75–125/hr sub cost vs a $4–12k package, margin is thin-to-negative unless packages sell top-of-band; Rick’s mandatory review gate (§6.6) is unbillable overhead (~20–40%), so reclaimed capacity is partial; the sub needs own/added E&O (COGS). Treat $60–75k as conditional on Q1 clearing ~$10k+/mo AND a validated sub-margin. Requires §6.6 delivery system + sub vetting/insurance/legal (§3, §6.6).

Judge everything downstream against: does it book fixed-price revenue toward these targets, and can it be handed to a subcontractor later?

▶ Delphi-chain council verdict (12 experts, 1 pass — decision-critical additions):

1. Reframe the target’s denomination (done above): $40k = exit run-rate, ~$18–25k collected. Start pipeline in December — January is mostly un-sellable (trust-build + insurance long-pole).
2. Owner’s Pay / runway — RESOLVED (Rick, 2026-07-06): 6+ months buffer, one existing client, ~$12k current collection (already near the ~$13k/mo run-rate target). Runway is fine → the strategic $40k exit run-rate framing is affordable; do NOT chase collected-cash or underprice to hit a Q1 number. Still model take-home + tax hold (Profit First), but this is no longer a kill criterion. Implication: he’s ~1 client away from the run-rate goal — the job is 2–3 more funded, survival-screened anchors, not a volume sprint.
3. Screen clients for survival, not just code, at the Health Check (funded? runway? does revenue cover burn?) → converts Care churn from exogenous-random to selected-lower. The audit is a client-underwriting/decline gate (walk away from the account that generates the claim), not only a lead-in.
4. Fewer-bigger — but survival-screened & funded, capped at ~25–30% of revenue per client, with a couple of funded clients as ballast (the ICP shares one AI-startup funding cycle — correlated churn). Reject the productized-scan alternative (commoditizes into CodeRabbit/Greptile).
5. Lead with the deadline-driven Pass-the-Review wedge as the front door (funded B2B, external forcing function) — not one of four co-equal packages.
6. Sign a zero-cost mutual-aid option in Q1 (a pre-agreed, unpaid-until-activated trusted peer) — distinct from the paid Q2–Q3 bench; it’s what lets Rick answer the highest-referral post-pain emergency call. “Never negotiate mutual aid during the fire.”
7. Narrow the Care Plan “monitoring watch” SLA explicitly — vague “peace of mind” writes an uncapped duty-of-care.
8. Q4 leverage is a Q2 customer-selection decision, not a Q4 hire — up-market first, prove Care renewal + a positive sub-margin on one trial package, then staff. Likelier real leverage: productize the Health Check + raise prices, not sub arbitrage.

---

0. Background (self-contained context)

Operator: Rick Gorman, solo engineer, JoyRudder LLC. 15 years at seed→Series-D startups. One-person shop. One proven engagement (“Corvus”) — a solo founder building university-retention SaaS — for whom Rick produced a restaurant-menu-styled “Menu of Services” (consulting-menu.html, now in-repo). That menu is the proven template.

Retired as primary pitch: “The Forge” Rails-agency campaign (wrong channel); the “help anxious senior engineers adapt to AI” EM landing page (→ secondary).

ICP: solo / tiny-team founders (1–20 eng, smaller better) who built an MVP largely with AI tools (Cursor, Claude Code, Lovable, Bolt, v0, Replit) and reached their first paying customer, now needing traditional rigor to keep it stable + offload deep work. Often not career engineers.

Buyer emotion: proud they shipped fast + found demand, now afraid — data loss, a security/auth/payment bug, an outage they can’t debug, a codebase where every new feature regresses an old one. Respect pride, speak to fear. Never “mess”/”toy”/”cleanup.” Two states: pre-pain (nervous, prevention, lower urgency) and post-pain (already broke, highest intent). Catch both.

Hard constraints: no forced nautical metaphor; AI-team-enablement stays secondary; menu page mobile-first AND desktop-friendly.

Preserve (worked for Corvus): restaurant-menu framing, journey-staged courses, aligned-incentive pricing, plain “House Rules.”

Design DNA (consulting-menu.html): Italiana display + EB Garamond body; paper #F8F3E6, ink #2B2620; category dots tomato #A3382C/basil #3E5C3A/olive-gold #A07E35; dotted price leaders; “Course” kickers.

---

1. Positioning + One-Line Promise

• Category (buyer slot): “The senior engineer you bring in after AI built your first version — to make it production-grade and take the hard engineering off your plate.” Hands-on. Restaurant-menu is a delivery device; never lead with “on a menu.”
• Expertise claim (foreground — the differentiation, §6.5): “I specialize in the specific ways AI-generated codebases break — auth/RLS gaps, missing tests, silent data-loss paths, deploy/rollback holes.” Without it, buyers price-compare on rate.
• One-line promise — never open by calling their work “vibe-coded” (contested, pejorative from a vendor; violates the anti-condescension constraint). Test 2–3 variants; keep the one founders repeat back:
  • A: “You built it fast and it’s making money. I make it strong enough to keep making money.”
  • B: “You got your first paying customer. Let’s make sure customer #100 has the same great experience — no outages, no data loss, no security scare.”
  • C (only if they self-identify with “AI-built” first): “You shipped with AI and found real demand. I bring the production engineering that keeps it standing.”
• Value frame — durable, tool-agnostic, NOT “AI code is fragile”: building software and operating/hardening it in production are two different disciplines. AI (and you) nailed the first; the second is a different job, not a failure. Never insults tool or founder; doesn’t decay as AI improves. Purge FUD (“what breaks first,” “before it’s too late”) from headline copy.
• Disqualify: pre-revenue founders who can’t pay; buyers wanting a full agency/team; pure AI-transformation buyers; cheap ticket-takers.
• Ability-to-pay qualifier (screen in the call — the emotional ICP ≠ the financial ICP): “first paying customer” is the fear trigger, not the budget test. Target scared-and-able: founders who are funded (any pre-seed/angel) OR whose first customer(s) pay enough that ~$8k of hardening is < a few months’ revenue. A bootstrapper with one sub-$200/mo customer is the right fear, wrong wallet — route them to the free checklist + “come back when funded/scaled,” not a $2k ask that bounces.

2. Naming

• Launch on the descriptor — zero brand creation, ships today: “JoyRudder — production rigor for AI-built MVPs.” The tagline is clearer than any candidate name.
• Parked (revisit only if validation flags a problem): Bedrock (⚠️ collides with AWS Bedrock in this exact AI niche — reads as the AWS thing; high WOM/SEO tax); Second Commit (engineer-native, talks past a non-technical buyer). Both are internal codenames at best.
• Name recall is NOT a launch gate. A solo who can’t sell until strangers recite his brand may never sell. Validate the promise (§8), not the name.

3. Service Ladder / Menu — Productized (fixed-price)

Journey stages: Stabilize → Harden → Scale → Extend. Single CTA: “book a free 20-min diagnostic call” — a frightened stranger won’t grant prod access from a checkout button; the call is the conversion event (fit-qualify + trust-build) and closes the Health Check. Rick is sole closer — keep it short/scripted.

Launch menu = TWO SKUs + one continuation. Everything else is deferred (see italics).

Tier	SKU	Format	What it is	Price model
Wedge	The Health Check (MVP audit)	Fixed price, 2–3 days, delivered via the §6.6 Audit Rubric (not freestyled)	Ranked “what’s fragile” findings each mapped to a corpus category + severity, plain-English report + 90-day plan; every finding traceable so Hardening maps 1:1	Flat fee (CAC, not margin); ~50% credited toward Hardening/first Care month on conversion in 30 days — never full refund
Land	The Hardening	Fixed-price outcome package(s), 2–4 wks, scoped only to named findings	e.g. Ship-Safe (backups + monitoring + rollback + error tracking); Lock It Down (auth/RLS + secrets + payment review); Test Harness (critical-path tests + CI); Pass-the-Review (answer a bigger customer’s vendor security questionnaire / SOC2-lite readiness — the Corvus-shaped B2B trigger, deadline-driven, highest intent). Sold as warranty + high-stakes judgment, NOT execution labor — the report can be DIY’d on low-stakes items; Rick is who you pay for fixes where a wrong fix silently breaks (auth/RLS/payments/data-loss) and he warrants his fix; your AI and your Upwork dev don’t	Flat package price with published exclusions + written change-order gate for anything discovered mid-work. Never fixed-bid the whole codebase (adding tests to tangled AI code unspools cascading breakage)
Expand	Care Plan (productized retainer)	Flat monthly, deliverable/SLA-based — not an hour bucket	Monitoring watch + monthly dep/patch updates + priority triage + monthly written report; higher tier adds N fix/feature items/mo	Flat monthly (see §4). Sold as outcomes + peace of mind, not hours
Overlay	Emergency triage (intake, not a published SKU until the bench exists)	Ad-hoc	Keep the post-pain triage message as a front door; scope best-effort response in the call	Do NOT publish emergency pricing/SLA while benchless — Risk 1 says a missed emergency is the most referral-destroying failure

Deferred to post-launch (NOT on v1 menu): the AI Co-Pilot Setup SKU (Secondary; its role is unresolved; adds a menu decision + anti-AI-tone risk for zero first-sale value — revisit if a client asks). Emergency as a *published, priced SKU (waits for the bench).*

House Rules (publish verbatim, plain): fixed-price when possible; client owns all code + credentials; weekly written update; no lock-in, cancel with (2–6) weeks notice; I’ll tell you when you don’t need me; emergencies jump the queue; no unlimited Slack; no “just one more thing” scope creep.

Liability & trust posture (publish the trust-building parts; rest in contract — existential for a solo touching strangers’ payments/auth/PII):

• Liability cap = fees paid trailing 3 months; in every MSA/SOW.
• Warranty on my work (say this to the buyer): “I warrant the hardening I deliver — the backups, the auth fix, the tests I add work as specified.” The legal carve-out (I can’t retroactively guarantee every line of pre-existing AI-generated code I wasn’t hired to touch) lives in the MSA and is framed as exactly why ongoing Care exists — never let raw “I don’t warrant code I didn’t write” surface in a sale; it reads as “I take no responsibility.”
• Critical-finding escalation protocol (pre-registered, not improvised — a live breach/exposed PII is near-certain within the first few audits): on an active exposure (live breach, readable PII/secrets, open payment path): (1) stop ranking, notify the client in writing immediately; (2) document but do NOT self-remediate outside scope without written go-ahead; (3) flag the client’s own potential breach-notification duty (state/GDPR/CCPA) as their legal call, explicitly not Rick’s legal advice; (4) if it exceeds his competence, refer out. This moment is the trust product, not just a liability — §6.6 makes it repeatable.
• E&O + cyber insurance is a LAUNCH PREREQUISITE (~$1.5–3k/yr; cost of goods). Binding takes days-to-weeks — start day one; it may be the true long-pole. Uninsured personally-named engineering on payments/auth/PII is the single highest-severity exposure.
• Least-privilege access executed via the §6.6 onboarding runbook (<½-day intake), not improvised per client — improvisation under deadline is how creds end up on a laptop. Doubles as a sales asset (“here’s how I touch your prod safely”).
• Confirm the LLC veil holds; insurance may be the real shield.

4. Pricing — Fixed-Price Packages First

• Health Check: flat $1,500–$2,500, 2–3 days. Below blended rate by design — CAC, not margin. ~50% credit toward Hardening/first Care month on conversion, credit valid ~60–90 days (not a 30-day countdown — a tight clock reads as high-pressure upsell to a trust-first buyer). Cap scope so non-converting audits don’t run at a loss.
• The Hardening: flat $4k–$12k per package, scoped only to named findings, published exclusions (“no rewrites, no unbounded refactors, no new features”); materially-worse-than-audited code → change order, not silent absorption.
• Care Plan (flat monthly, productized):
  • Peace of Mind ~$1.5–2k/mo: monitoring watch + monthly dep/patch/security updates + priority triage + monthly report.
  • Active ~$3–4k/mo: above + a defined allotment of fix/feature items/mo.
  • Sold as outcomes. If a month’s asks exceed the tier, it’s a change-order/upsell conversation, not silent overservice.
• Hourly (fallback only): for genuine unknowns not yet packageable, a single blended rate in the $150–$225 range, set in the call. Do NOT publish an MRR-band matrix at launch — banding a market you haven’t sold to is premature and a 3×3 grid is the #1 menu-paralysis risk for a scared buyer. (Parked for ~month 3, once 2–3 engagements show what founders at each stage actually pay: Pre-traction/Traction/Scaling × 5/10/20 rate table.)
• Rules: packages/Care bill monthly in advance (Care) or on milestone (Hardening); Health Check is a flat fee paid in full up front — not a “deposit” (state the ceiling: “$2k, that’s the whole price, no add-ons” — “deposit” signals an unknown running total and chills a cash-anxious buyer).

Honest capacity math (why productized, not hourly): realistic solo ≈ 46 wks × 40h = ~1,840 h/yr; ~half consumed by GTM + admin + scoping → ~920 billable h/yr ceiling. Hourly at the ICP’s affordable rate can’t reach $40k/quarter and leave room to sell — fixed-price packages decouple revenue from hours and are the only path to the $40k (Q1) and $60–75k (Q4-with-sub) targets.

5. Go-To-Market

Launch = warm outreach + Corvus proof. Everything else deferred. (§8.7: concentrate, don’t spread.)

Launch channels (only these):

1. Warm network + Corvus referral — direct personal outreach to Rick’s 15-yr network: “here’s what I’m now doing — who do you know who shipped fast to revenue and is now nervous about it?” Ask Corvus for a testimonial + 2 intros. Highest trust, fastest close, zero ban risk. The engine for the first 5–10 clients.
2. Referral loop from delivered work — every engagement ends with “who else is in this spot?” + a small incentive.

Deferred to post-launch (build only after warm is saturated; judge on a 6-month horizon): VC/operator referral one-pager; AI-builder Discords (Cursor/Lovable/Bolt/v0/Replit — earn standing first, hard anti-self-promo rules, a cold pitch burns the room); X/build-in-public teardowns; dual-vocabulary SEO (category + panicked-buyer symptom terms: “my Supabase app got hacked,” “app crashes after every deploy”); Indie Hackers/Reddit/office hours.

Launch proof (the two load-bearing assets — build BEFORE outbound; trust is the bottleneck, not awareness):

• Corvus case study (with permission): problem → what was fragile → what was hardened → outcome. One named real reference beats ten cold teardowns. Source: RICK_GORMAN_PROFILE.md. Secure Corvus as a live callable reference for serious warm prospects — a reference they can’t phone is marketing, not proof. (Robustness: also prep a self-audit of Rick’s own AI-built repo as a backup case study, so proof doesn’t hinge on one client’s goodwill.)
• Leave-behind after the call: a 1–2 page redacted sample Health Check report so the buyer holds something tangible before writing $2k and can sleep on it / forward it internally — the 20-min call otherwise produces no artifact, and a stranger’s first $2k check usually needs a second async touch.
• “How I handle your access” trust page — least-privilege, read-only-first, no stored secrets, client owns code+creds, NDA on request. Answers “why let a stranger in?”

Deferred proof: testimonials (add as first clients land — can’t exist at launch); anonymized teardown portfolio (§6.5 flags it NOT a moat — build only if a content channel is built).

Wedge asset (launch): one free static “AI-MVP Production Readiness Checklist” (ungated or trivial email capture). The interactive email-gated scorer is deferred — building branching/routing before there’s traffic to score is premature. It never substitutes for the paid audit: the checklist says what is at risk; the Health Check is me actually looking, ranking, handing you the plan.

Conversion path — LAUNCH (warm): personal outreach → booked 20-min call → Health Check. No checklist/nurture needed for warm contacts. (LATER, cold/content: content → checklist → 3–4-email nurture → call → Health Check — month-2+ work.)

Teardown tone guardrail (when content is built): own AI-generated or consented/anonymized code only — never a named founder’s repo; credit the tool for the 90% it nailed; frame as “the discipline AI isn’t trying to do yet.” A single dunk-read post poisons the builder communities.

Best first message (three, by buyer state): Pre-pain: “First paying customer? Before you onboard the next ten, have a senior engineer stress-check the MVP.” Post-pain (highest intent): “App down, data scare, or ‘it broke and I can’t tell why’? A senior engineer can triage today.” Post-pain deal-blocking (highest ACV): “A bigger customer sent a security questionnaire you can’t answer? A senior engineer can get you review-ready fast.” (→ the Pass-the-Review package.)

Timing: land-grab with a clock — the “first customer” moment is a narrow per-founder window and builder-community channels saturate. Win the reputation moat (§6.5) first; convert rented attention into an owned asset (checklist + list + corpus-as-content).

6. Deliverable — the Menu Page (IA/conversion spec, not a vibe)

★ Concept decided (Rick, 2026-07-06): the page is a “locate-yourself trail guide,” NOT a price list. Warm Direction-01 editorial DNA. The founder places themselves on a 5-leg trail — Trailhead → Firm Footing (Stabilize) → Load-Bearing (Harden) → The Open Trail (Scale) → Solid Ground (Extend) — which does three jobs: confidence (ground already covered, no-failure language), passive self-diagnosis (“You’re here if…” symptoms → “that’s me”), expertise demo (name the exact “what breaks next” at each leg). No pricing on the page; services appear only as “who walks with you on this leg”; single CTA = book the call; sticky post-pain triage strip. Three treatments built & parked as an Artifact: V1 Trail Map (spatial spine — the hook), V2 The Courses (restaurant-menu literal — safest), V3 Field Guide (naturalist almanac — expertise/SEO layer). Pending: Rick picks one (or blend) to build into the full production page from consulting-menu.html.

The conversion surface a scared stranger touches on a phone. Spec it as information architecture. Retains menu DNA but subordinates it to reassurance-first, progressive disclosure. /design is graded against these requirements:

• Above-the-fold contract (mobile, ~1 screen at 390px): one-line promise (§1 winning variant) + one primary CTA (“Book a free 20-min diagnostic call”) + one trust proof (testimonial line or insured/least-privilege badge) — before any SKU, price, or “menu” framing. Reassurance + a button precede the catalog. Surface “I’ll tell you when you don’t need me” here and in the call script — it’s the direct antidote to the “he audits and sells the fix” conflict-of-interest fear (currently buried in House Rules).
• Dual buyer-state, one page, one CTA: a persistent sticky post-pain triage strip at top (“App down / data scare? A senior engineer can triage today →”) routing to the same booking — not buried below the menu. Below the fold, the menu itself for the pre-pain browser.
• Progressive disclosure: do NOT dump all SKUs + prices + House Rules + Emergency in one scroll (mobile decision-paralysis/bounce). Lead with the Health Check (the only real entry action); collapse/defer Care tiers, Hardening packages, House Rules behind expandable sections or a lower tier. Repeat the single CTA in every section — never make the reader scroll back up to act.
• Trust inline, not link-away: 2–3 load-bearing trust signals (least-privilege, you own your code+creds, insured, NDA) render adjacent to the CTA; the full trust page is the deep-dive link.
• Anchoring, mobile caveat: if Care/Hardening tiers are shown high-to-low, keep the anchor and the reachable entry price co-visible in one glance (side-by-side cards or “from ~$1.5k/mo”) — a tall top-down price list bounces the pre-traction ICP before they reach the affordable tier.
• Metaphor kill-criterion: the restaurant-menu was proven on ONE warm, trusting client. “Menu/à-la-carte” connotes leisure + invites price-shopping. Test it in the §8 calls; if founders read the phone page as “a catalog to shop” not “a person who’ll help,” demote the metaphor to a light visual motif, not the organizing logic.
• Mobile-first = build constraint, not a breakpoint: design up from 360–390px; the paper card goes edge-comfortable, not a centered poster with wasted gutters; verify tap targets, contrast, and that serif display + dotted leaders stay legible and don’t wrap badly at 360px.
• DX/maintainability (solo): prices/SKUs change often — structure so Rick edits copy/prices as content without touching bespoke layout, or the menu rots and re-scoping (§3b) silently doesn’t happen.

6.5 Moat / Why This Isn’t Trivially Copyable (deferred build — matters Q2+, irrelevant at launch)

The positioning is copyable in a weekend, menu gimmick included. Build advantages that compound:

• Proprietary failure-mode corpus — only real if capture is mechanized (§6.6): each finding logged as a structured record, the client report generated from it, so capture costs ~zero marginal time. After ~30 audits, a data asset no newcomer has; makes each Health Check faster/cheaper for Rick than a copycat. Without the §6.6 schema this moat is fiction.
• Accountable on-call relationship — a named human who already knows your system. Not replicable by an AI tool or a first-time freelancer. This, not the audit, is the durable product.
• Niche reputation compounding — owning “the person you hire when your AI-built app breaks” in 2–3 communities is winner-take-most.
• NOT a moat (don’t over-invest): menu design, the checklist (public lead magnet), generic skill, the brand name.
• Moat test per SKU: does delivering it make the next delivery cheaper or the client stickier? If neither, it’s undifferentiated hours — price/staff accordingly.

6.6 Delivery System — the repeatability layer (v1 is lightweight: ONE checklist + ONE spreadsheet + off-the-shelf scanners — no custom tooling built)

The moat (§6.5) and the bench/subcontractor (§North Star, §7) both depend on ONE artifact: a standardized, versioned Audit Rubric that is simultaneously the runbook, the corpus schema, the quality bar, and the bench-handoff doc. Build v1 (a checklist + a spreadsheet) before the first paid Health Check, seeded from Corvus + Rick’s own AI-built repos.

• Health Check runbook (makes “2–3 days” real): fixed dimension checklist — auth/authz/RLS, secrets/config, data-safety (backups, migrations, destructive paths), payments/webhook idempotency, deploy/rollback, monitoring, critical-path test coverage, dependency/supply-chain, obvious perf/cost cliffs. Time-boxed: Day 1 onboarding + scoped access + automated scans + recon; Day 2 manual deep-dive on top-ranked risks only; Day 3 write-up + 90-day plan from templates.
• Standardize the tooling once (Rick’s force-multiplier vs Risk 3a): a fixed scan stack every audit — Semgrep, gitleaks, dependency/npm audit, coverage report, + one AI reviewer (CodeRabbit/Greptile//security-review). Tools buy breadth; Rick adds prioritized remediation judgment. Keeps his time bounded and margin above a copycat’s.
• Corpus capture = byproduct of delivery: every finding logged as {platform, stack, category, symptom, root cause, severity, remediation, effort} in one queryable store (markdown/JSON repo or Airtable to start); the client report is generated from it. No structured capture at delivery → no corpus, ever. Confidentiality boundary (reconciles the §3 NDA promise): records store only abstracted, de-identified patterns — no client name, no repo/table names, no verbatim secrets. The standard SOW carries an explicit carve-out reserving Rick’s right to retain anonymized methodology/pattern learnings. Settle this in the engagement-#1 contract — a silent NDA that forbids it makes the moat unbuildable.
• Definition of Done: every Health Check ships ranked findings (each → corpus category + severity), a 90-day plan, and top-3 with concrete remediation + effort. Findings map 1:1 to Hardening milestones — operationally enforces the §3/§4 “scope frozen to findings” rule.
• Onboarding/access runbook (executable §3 trust posture): intake questionnaire → templated read-only repo + read-only prod/DB + scoped time-boxed IAM → secrets in a password manager/short-lived tokens, nothing on the personal laptop, all revoked at end.
• Bench handoff package (makes Q4 subcontracting buildable): a 1099 executes Hardening against the findings→milestones map + corpus remediation notes + access runbook + per-milestone DoD + Rick’s review gate before anything reaches the client. No package → no bench → the Risk-1 capacity ceiling + missed-emergency failure are unavoidable. Legal scaffolding (Q2–Q3, before sub #1 touches client code): written sub agreement with IP-assignment flow-through (sub → Rick → client, or the “client owns all code” House Rule breaks); sub under the client NDA; W-9 + 1099-NEC; sub carries own E&O or is named-insured; structure to survive a worker-classification (control-test) challenge.
• Per-client state doc: one living page/client (access map, stack, open findings, decisions, last update) so a Care Plan portfolio doesn’t degrade into dropped balls.

7. Risks

#	Risk	Why it bites	Mitigation
1	Solo capacity / concentration / bus factor	Full-time delivery leaves no room for sales/on-call; a 2–3-client book = 33–50% revenue each — one churn halves income	Productize (revenue ≠ hours); favor a portfolio of Care Plans + steady Health Checks over a few whales; the bench (1–2 vetted, insured contractors) + §6.6 handoff package is a Q2–Q3 build, prerequisite before the 2nd big engagement / the Q4 target
2	ICP can’t/won’t pay — or dies	Pre-traction founders are cash-poor AND high-mortality; retainers churn exogenously; low ACV + high churn + solo sales = a re-selling treadmill	Low-commitment Health Check entry; model the pipeline (at X%/mo churn, how many Health Checks/mo hold N Care Plans?); bias toward fewer, larger, more-durable clients
3a	AI review tools substitute the audit (CodeRabbit, Greptile, /security-review, GH scanning)	The Health Check artifact commoditizes fastest; the free checklist trains self-serve	Audit = loss-leader wedge, never the profit center; sell prioritized judgment + accountability; use AI tools as Rick’s own multiplier; profit lives in Care Plans
3b	Platforms ship native reliability (Replit/Lovable/Supabase add auth, backups, monitoring, rollbacks)	Deletes Hardening line items	Re-anchor Hardening on what platforms don’t do (cross-cutting correctness, payment/data integrity, custom tests, migration safety); re-scope Hardening every ~2 quarters
3c	Proud-founder / anti-AI read	Wrong tone kills the deal	Respectful framing (§1); Co-Pilot (deferred) rides with the trend
3d	Buyer self-executes Hardening from the report (feeds ranked findings to Cursor/Claude Code or a cheap Upwork dev)	The audit hands over a remediation spec; the priced work looks like commoditizable execution	Report ranks + explains what/why/severity; concrete remediation for high-stakes items (auth/RLS/payments/data) is delivered as the warranted Hardening — “DIY the low-stakes findings; hire me for the ones a wrong fix silently breaks, where I warrant my fix and your AI doesn’t”
4	Client graduation shortens LTV	Stable codebase / Series-A full-time hire / self-service all reduce need; LTV maybe 6–9 mo	Size top-of-funnel for continuous replacement; monetize the exit — graduated client → low-cost alumni tier (emergency-only + quarterly check) + referral source

7.5 Fork — Job or Business?

For launch, default to “job” (maximize rate, minimize admin/brand) and defer the decision until ~5 engagements exist to inform it — the launch motion is identical either way, and every “business” investment (corpus productization, templatized Hardening, team) requires audits not yet done. Gate the expensive fork on evidence: do the first 2–3 Care Plans renew past their initial term? If they churn by month 2–3, LTV is too short to amortize an asset layer — the fork resolves to “job” by data. The Q4 subcontractor goal already bends the arc toward light leverage regardless.

7.6 Kill / Pivot Criteria (pre-register now, while judgment is cold)

• WTP kill (week 4): <2 paid Health Checks from ~10 target conversations → the pre-pain buyer won’t pay. Do NOT build the full menu page. Pivot to post-pain messaging (best-effort triage scoped per-call, per §3 — a published, priced emergency SKU still waits on the bench), or shelve.
• Retainer-model kill (month 4): Health Checks sell but <~30% convert to a Care Plan, or the first 2–3 Care Plans churn inside ~2 months → the income engine doesn’t exist. Revert to pure one-off Hardenings + emergencies (the §7.5 “job”).
• Pipeline kill (month 6): warm network + referral fail to yield ≥1 signed Care Plan by month 3 / ≥2 by month 6 → demand isn’t reachable at acceptable CAC. Stop; re-underwrite the ICP or return to employment.
• Diagnose the failure: book calls but never pay → offer/price wrong; don’t book at all → message/channel wrong. Log which.

8. Sequencing / Next Steps (sell before you build the storefront)

1. Riskiest-assumption test FIRST, before build spend. The load-bearing assumption: pre-pain, first-revenue AI-MVP founders will pay for hardening before an outage forces them. Test with the cheapest surface — a one-page description (+ the Corvus case study) + a booked call, no menu page, no brand, no checklist. Go/kill gate: ≥2 paid-deposit (or signed-SOW) Health Checks from ≤10 conversations within ~4 weeks (§7.6).
2. Launch prerequisites (start day one — insurance is the long-pole): E&O + cyber insurance bound; liability cap/indemnity in a standard MSA/SOW; least-privilege access protocol written (= the trust page); Audit Rubric v1 (checklist + spreadsheet, §6.6) seeded from Corvus + own repos — expect the first 2–3 audits to run long, price them as founding engagements, advertise the fixed 2–3-day price only once the runbook holds it twice.
3. De-biased validation calls: (a) problem-first — have them describe codebase fears in their own words BEFORE showing any variant; (b) mixed sample — include ≥2 semi-cold founders, not 5 warm friends; (c) pay-intent probe every call (“$2k for a 3-day ranked review + 90-day plan — buy this quarter?”), log verbatim. Track “that’s me” and “I’d buy that” as separate columns; only the second counts. Also put a phone-rendered menu draft in front of ≥3 cold: pass = CTA found in <5s, described as “someone who’ll help” not “a catalog” (else fire the §6 metaphor kill-criterion).
4. Only after the WTP gate clears: ship the full menu page (§6 spec) + static checklist; /design produces mobile-first directions graded against §6. Launch on the descriptor brand (§2).
5. Measurement instrument (day one, solo-realistic): one spreadsheet, one row per lead — source, buyer-state (pre/post-pain), call date, Health Check paid?, converted to Care Plan?, Care-months-survived — + one scripted call question (“what made you reach out?”). This makes the §7.6 kill criteria measurable.
6. Track the funnel, not vanity counts: conversation→call rate, call→paid-Health-Check rate, and the one that predicts the business — Health-Check→Care-Plan conversion (target ≥30–40%) + Care-Plan survival at 90 days. Two Health Checks/mo that never convert is a subsidized treadmill.
7. Concentrate, don’t spread: run only warm network + referral until saturated; judge deferred channels on their own horizon (warm = weeks; cold/SEO = 4–6 mo) — don’t cut slow-but-real channels at a blanket 60-day gate.
8. Q2–Q3: build the bench + §6.6 handoff package + start the corpus; decide the §7.5 fork on renewal evidence — en route to the Q4 $60–75k leverage target.

Alternatives Considered (rejected)

Lead with AI-team-enablement (headline) · “Fractional CTO” name · nautical metaphor · pure hourly / no productized wedge · fixed-bid whole codebase · uncapped “included” on-call · full Health-Check refund · complete-rewrite package · agency/studio branding · first-sale-keyed pricing · target all 1–20 equally · “AI code is fragile” value frame · warm network as low-priority channel · publish a 3×3 MRR-band matrix at launch · name-recall as a launch gate · build menu page/brand/scorer/SEO/nurture before proving willingness-to-pay.