CDO replaces the ConnectTeam + Housecall Pro + spreadsheet stack with one system where the labor code is a design requirement — not a reporting afterthought.
Built and operated by IPS. Live in production with its first customer: a 65-person California roofing crew clocking in from the field every morning. Crews punch in with GPS and geofence evidence, paid to the minute with zero rounding. Every AI-initiated write drafts into a proposals queue and waits for a human.
A California field-service contractor runs on a stack: a workforce app for punches, a job-management product for estimates and invoices, and a spreadsheet to reconcile the two before payroll. Each tool is fine at its own job. None of them knows what the California Labor Code requires.
So compliance becomes a reporting exercise. A missed meal break is discovered weeks later, when someone runs a report — long after the premium was owed and long after the shift where it could have been prevented. CDO inverts that: the law runs at punch time, not at report time.
This is the single rule the entire system is built around. The AI never writes to the database directly. Every AI-initiated change is drafted into a proposals queue, waits for explicit human approval, then applies transactionally — with an immutable audit row and an undo path. There is no code path where a model mutates payroll on its own.
Model output is a draft record, not a mutation. It carries its reasoning, its confidence score, and its citations into the queue so the approver sees why before they see what.
Approval applies the whole proposal or none of it. Partial application is not a state the system can reach — which matters when a single approval touches a timecard, a premium, and a payroll line at once.
Every applied proposal writes an audit row that cannot be edited, and every applied proposal can be undone. In a wage-and-hour dispute, the question is always “who changed this and when” — the system answers it by construction.
The same rule governs the autonomous agent layer. Long-running “Workroom” sessions built on the Claude Agent SDK operate under hard spend caps — $2 per session and $50 per month — and still cannot commit a write without passing through the proposals queue. Autonomy is bounded in two directions at once: what it can spend, and what it can change.
Crews clock in from a Flutter field app. The device timestamp is authoritative and there is zero rounding — a worker is paid for the minutes they worked, not for the nearest quarter hour. Clock-in requires a GPS-verified selfie, and every hour on shift leaves a GPS trail behind it.
GPS-verified selfie clock-in. Identity and location are captured at the same instant as the punch, not asserted afterward.
Hourly GPS trail. Every hour on shift is location-stamped — a continuous evidence record rather than two endpoints.
Haversine geofence math. Distance from the job site is computed deterministically at punch time — not inferred, not estimated by a model.
Off-site punch patterns surfaced automatically. Not a single flagged punch — the pattern across days and crews, raised on its own.
California wage-and-hour exposure is not theoretical for a field-service contractor. A PAGA or DLSE claim is won or lost on the quality of the time record, and the time record is either contemporaneous evidence or it is one party's word.
CDO's field layer is built as a defense posture: contemporaneous, location-stamped, unrounded, and immutable once written. The compliance artifact is a byproduct of doing the work — not a document someone assembles later.
The field app shows hours, breaks, and job assignments — never pay amounts. This is a design decision, not an unfinished feature. Time entry is about recording what happened accurately; putting a running dollar figure in front of a worker mid-shift changes the thing being recorded. Money lives on the payroll surfaces, where it belongs.
Timecard exceptions run through deterministic logic before any model sees them: haversine geofence math and meal-law computation produce hard facts. Only then does an LLM reviewer weigh those facts and return a structured verdict — with a confidence score, the California Labor Code sections it relied on, and pre-drafted worker messages in English and Spanish.
| Verdict | Meaning |
|---|---|
| DISMISS | Exception explained by the deterministic facts — no action needed |
| APPROVE PREMIUM | §226.7 premium owed — pre-filled into payroll on approval |
| NEEDS FOLLOW-UP | Employee must clarify — EN + ES message already drafted |
| ESCALATE HR | Pattern or severity beyond a supervisor's call |
The meal-break clock runs in real time against the live shift, not against a report at the end of the pay period. The violation is prevented on the day it would have happened, which is the only time prevention is possible.
When a premium is owed, it is computed and pre-filled into payroll the day it happens — not reconstructed in a spreadsheet weeks later when nobody remembers the shift. §510 overtime is computed on the same pass.
Language is auto-detected per worker and every worker-facing message is drafted in English and Spanish. Compliance documents are stored permanently in both languages — so the record of what a worker was told exists in the language they actually read.
Labor rules are not static, and a system that hardcodes them is wrong the moment they move. CDO scrapes Tier-1 legal sources directly, content-hashes every tracked section, and detects when the text underneath a rule changes — roughly 105 tracked citations across six source groups, scanned monthly with a digest email.
| Source group | Type | What it governs |
|---|---|---|
| Federal eCFR | API | Federal regulation text, pulled from the official eCFR service |
| CA Title 8 | Scrape | California occupational safety and health regulations |
| leginfo statutes | Scrape | California Labor Code sections — §512, §226.7, §510 and related |
| EDD | Scrape | Employment Development Department guidance pages |
| IWC Wage Order 16 | Scrape | The wage order governing on-site construction, drilling, logging and mining |
| Change detection | Content hash | Per-section hashing across ~105 citations — monthly scan, digest email on drift |
The engine reads the statutes and regulations at their official source. No secondary summaries, no compliance-newsletter paraphrase, no vendor's interpretation of what the rule means this year.
Each tracked section carries a content hash. When the hash moves, the text moved — and the citation is flagged for review rather than silently continuing to back a rule that no longer says what it said.
California is the deepest implementation because it is the hardest jurisdiction. Nine states now have published rule guides in the system, which is what makes the architecture portable beyond the first market.
The job that generated the hours is the job that generates the invoice. Estimates become invoices become Stripe payments natively — payment rails live and verified in production. Stripe mode is resolved server-side and accounts are scoped per legal entity, so a test key can never quietly take a real payment.
Published pricing is $29–$49 per user per month. The system is built and operated by IPS — every layer of it, with no vendor owning the customer's data.
A React 19 admin SPA and a Flutter field app talk to a single Supabase project — Postgres, Auth, Realtime, Storage, and Deno edge functions. There is no separate API tier to deploy, version, or keep in sync with the database.
| Layer | Technology | Notes |
|---|---|---|
| Admin SPA | React 19, TanStack, Tailwind v4, Vite | 10 admin rooms, 5-level role ladder |
| Field app | Flutter (iOS + Android) | 65 screens, GPS + geofence + selfie capture |
| Backend | Single Supabase project | Postgres, Auth, Realtime, Storage, Deno edge functions |
| Data layer | PostgreSQL with RLS on every table | ~210 tables, 190 SQL migrations |
| AI routing | Claude via OpenRouter | Tiered Haiku / Sonnet routing by task complexity |
| Autonomous sessions | Claude Agent SDK — “Workroom” | $2/session and $50/month hard spend caps |
| Payments | Stripe | Mode resolved server-side, per-legal-entity accounts |
| LLM observability | Langfuse | Every model call traced, costed, and inspectable |
CDO is in production with its first customer. These are the numbers behind that sentence.
Building a timeclock is easy. Building one that a California wage-and-hour claim cannot embarrass, that a 65-person crew uses every morning without training, and that an AI can improve without ever being trusted to write — that is a different problem.
IPS builds custom data platforms, intelligence systems, and AI-powered products from scratch — then operates them in production. We have done it for government transparency, sports analytics, cannabis CRM, enterprise sales AI, and now field-service compliance. Every layer is custom, and the customer owns all of it.