GO180

GO-180, Building the Home Base for the Military-to-Civilian Transition

A Benmore Technologies case study.

Client: Donald Carter, Founder & CEO, GO-180 FDE: Arkash Jain

1. Introduction

Overview

GO-180 is a subscription platform for U.S. service members, veterans, and their spouses. It covers the full arc of leaving the military, employment, finances, housing, insurance, relocation, education, benefits, community, and documents, from one login, and tells the member the single next thing to do.

Benmore built the platform from first commit to production with one forward-deployed engineer working directly with the founder.

At a glance

Timeline	November 2025 → September 2026 (v1.24.0)
Users	1,200 live
Delivery	895 commits, 64 pull requests, one FDE
Backend	34 Django apps, ~541 API endpoints, 149 models, 448 migrations
Frontend	180 pages, 609 React components, 33 typed API modules
Admin panel	77 pages
Tests	4,079 automated tests, 82% backend coverage, CI-gated

Challenge

• Cover every domain of transition in one codebase without producing a wall of dashboards for users who may be managing PTSD, TBI, or acute stress.
• Run AI on a dozen surfaces without letting a model invent a benefit, practice law, or tell a veteran to wait for an approval that no longer exists.
• Treat financial and mental-health-adjacent data as PHI: encryption, minimum-necessary access, audit trails, retention.
• Build for a population with elevated crisis risk, where safety has to be architecture, not a feature.
• Bill through Stripe with trials, sponsor-funded memberships, and a paired spouse seat.
• Give the founder outcome reporting credible enough for the VA and corporate sponsors.

2. The Problem

Background

• Roughly 200,000 service members leave the U.S. military every year.
• The transition year compresses a job search, a financial cliff (base pay, housing allowance, and TRICARE end in the same month), often a cross-country move, and the loss of a daily community into a few months.
• The transition period is a recognized high-risk window for suicide. The VA funds community-based programs, such as the SSG Parker Gordon Fox grant, specifically for it.
• Existing support is fragmented: VA.gov, a separate GI Bill comparison tool, commercial job boards that can't parse an MOS, bank websites, base-specific Facebook groups, and a discount ecosystem nobody can price. Each has its own login and no knowledge of the others.

Note. The founder's framing throughout the engagement: the VA reports that a majority of veterans who die by suicide were never registered with the VA. Driving VA registration is treated as a safety metric, not a marketing one.

Pain Points

• No single owner of the transition. Employment tools don't know the member's budget; financial tools don't know the move date; benefit sites don't know the job search. The veteran becomes the integration layer.
• Military experience doesn't translate. A 20-week Signal School course is worth college credit and a resume of real skills, but the mapping is tribal knowledge.
• The financial cliff has no early warning. Most service members have never priced civilian health insurance or rent. There is no readiness score.
• Relocation intel is anecdotal. Housing data, school ratings, BAH tables, and cost-of-living comparisons don't exist in one place.
• Community without safety is a liability. Peer support is one of the most protective factors in transition; an unmoderated forum for this population is a serious failure mode.
• The data is too sensitive for a standard SaaS. Pay stubs, credit reports, VA claim documents, assessments, family details.
• Families transition too. Spouses carry half the load; nearly every veteran tool is built for one user.
• Sponsors and government need proof. VA endorsement and corporate sponsorship require cohort-level outcome reporting that never exposes an individual member.

3. Our Solution

Discovery Process

The engagement ran forward-deployed from the first week:

• Weekly working sessions with Donald; every module demoed as it landed.
• Requirements captured from Donald's own documents and his conversations with senators, sponsors, and VA contacts, not from an abstracted persona.
• New requirements went into the backlog the week they surfaced. Example: after a Florida reunion, caregiver access for members with TBI, amputations, or burns.

Two decisions came out of discovery and held for the life of the project:

1. Transition is a readiness state, not a task list. A veteran doesn't fail transition because one domain goes wrong; they fail because three go wrong at once. The Transition Readiness Index (TRI) sits at the center of the architecture, and every module either feeds it or moves it.
2. Safety is load-bearing. The Veterans Crisis Line (988, Press 1 · Text 838255) is a fixed element of the page chrome. Crisis signals from any surface route to humans and licensed providers through retrying, monitored paths. The platform never diagnoses, never treats, and never silences distress.

Core Value Proposition

One secure home base that measures a member's readiness, tells them their single next step every time they log in, does the heavy lifting with AI that is grounded and honest about its limits, and wraps it in a community and safety net built for this population. For the founder: the outcome reporting that makes the platform fundable.

Proposed Solution

Member modules

• Employment Hub. AI job matching against a federal pipeline synced from USAJobs every 8 hours across 65 veteran-career keywords; AI resume and cover-letter builder; mock-interview simulator with per-response feedback; mentorship matching; application tracking; career map; a directory of the twelve official transition programs (SkillBridge, TAP, VR&E, etc.) with click-through tracking.
• Financial & Housing Hub. Budgets, debt payoff, savings goals, VA loan readiness, insurance gap analysis (SGLI → VGLI, TRICARE continuity), and AI-generated feedback on every readiness assessment with a 0–100 score. Treated as PHI end to end.
• Relocation Hub. GPT-4o relocation briefings grounded in an 8-provider data layer (housing, schools, census, BAH tables, VA loan limits). The model may not invent a statistic.
• Education Hub. MOS-to-college-credit conversion, a semester-by-semester degree map, GI Bill and Yellow Ribbon tuition forecasting, a school finder on College Scorecard and VA GI Bill data, and an entrepreneurship track.
• Transition Compass. The TRI assessment, the MIND-SET® reflection program, and the Legacy of Transition story archive, behind a clinical guardrail that routes to licensed providers.
• Community Hub. Groups, events with capacity-locked RSVPs, podcasts, and a feed, behind multimodal AI moderation with a dedicated crisis path, appealable holds, and no shadow-banning.
• Secure Engine. AES-256-GCM encrypted document locker for DD-214s and VA paperwork, a hash-chained audit log, and a member-visible security center.
• Personal Space. Appointments (VA medical, benefits, interviews, counselling) with reminders a week out and the day before; a chronological appointment record exportable as a PDF for a VA claim; personal goals.
• AI Assistant. A platform-wide agent with 15 function-calling tools across employment, financial, legal, community, and personal domains, RAG over platform knowledge, prompt-injection screening, and legal-compliance rails.

Platform

• Subscriptions. Stripe billing with a 7-day trial, admin-configurable pricing, sponsor-funded memberships, and a paired spouse seat.
• Admin Panel (77 pages). Role-permission matrix, tamper-evident audit logs, moderation queues, cohort and instructor reporting for MIND-SET®, a configurable report engine that emails scheduled PDFs, and CSV exports on a dedicated queue.

Technology Stack

Layer	Stack
Frontend	Next.js 16 (App Router), React 19, TypeScript strict, Tailwind v4, shadcn/ui, TanStack Query v5, Framer Motion, Recharts, Zod + React Hook Form, Biome, Vitest + Playwright. Vercel.
Backend	Django 6.0 + DRF 3.17, PostgreSQL 17 + pgvector, Redis 7, Celery (4 queues) + Beat, Daphne ASGI + Django Channels (WebSockets), 274 shared TextChoices enums, drf-spectacular OpenAPI, pytest.
AI	OpenAI GPT-4o (assistant, assessment feedback, relocation briefings, resume/cover letters, interview feedback, education plans), omni-moderation-latest (multimodal moderation), text-embedding-3-small + pgvector (RAG).
Identity & billing	Clerk (RS256/JWKS, webhooks, invitations), Stripe.
Data providers	USAJobs, College Scorecard, VA GI Bill, SchoolDigger, NCES, RentCast, Census, HUD, DTMO BAH, FHFA.
Infrastructure	AWS (S3, CloudFormation staging), GitHub Actions with OIDC deploys, Sentry, Amazon SES / Resend / Notify Hub (switchable email).

4. Implementation

The Briefing design system

GO-180's UI follows a written design system with a defined north star ("The Steady Wingman") and an explicit rejection list: no generic SaaS dashboard, no camo militaria, no cold government portal, no hype fintech.

• One next step per page. Every task page leads with a single OrdersCard, the member's next action and the page's only gold element. Below it, an asymmetric BriefingLayout with a quiet status rail.
• No card-grid walls. Three-column equal action-card grids are banned on task surfaces. The rule is enforced in code review.
• Trauma-informed defaults. Softened dark mode for PTSD sensitivity, a calm red for error and crisis states, prefers-reduced-motion honored everywhere, 40px touch targets, WCAG 2.2 AA contrast.
• Crisis line as page architecture. The 988 banner is a fixed element of the chrome, not a dismissible alert.
• Typography discipline. Bebas Neue for headings only; Inter for every dense surface. "Display font in UI" is listed as a product defect.

Transition Compass and the TRI

The Transition Readiness Index is the platform's spine.

• TRI v1.1: a 24-item assessment scored across five domains: identity and purpose stability, employment and economic readiness, support network and connectedness, navigation confidence, practical stability.
• Server-only scoring. Item weights and scoring maps never leave the backend. One in-progress session per member; every scoring event is appended to an immutable log.
• Explanatory bands, never pass/fail. "Needs concentrated support," "Emerging readiness," "Developing readiness," "Strong current readiness." The lowest band's copy is written to a clinical standard.
• What the score drives: the member's next step; a warm handoff to a licensed external provider on a crisis flag or sub-threshold score (deduplicated against active routings, with 988 shown alongside a personal battle-buddy contact); cohort reporting for MIND-SET® instructors.
• Legacy of Transition. A de-identified story archive contributed by members or, since v1.21, by veterans with no account, with versioned consent capture, a moderation queue, and an admin confirmation dialog that names the consequences before publishing.

Note. The platform computes readiness signals; it never stores them as clinical labels, never diagnoses, and never stands between a veteran and a clinician.

AI on every surface, constrained by design

The assistant

• GPT-4o with a multi-turn function-calling loop, streaming over SSE.
• 15 tools: list and match jobs, track an application, request a mentor, summarize finances, create a goal, record a debt, list benefit applications, find groups and events, list appointments.
• Every mutating tool is deduplicated by a SHA-256 idempotency key over user, tool, arguments, and conversation. A retried stream cannot double-file an application. Read tools are excluded from the cache; caching them had caused a 24-hour-stale-read bug.
• RAG over platform documentation (pgvector, text-embedding-3-small) so the assistant answers from what GO-180 actually does.
• An injection detector screens for instruction override, role manipulation, prompt extraction, and base64 smuggling.
• A legal rail in the system prompt: benefits information, never legal advice. The assistant will not prepare a VA claim; 38 CFR §14.629 reserves that for accredited representatives.

Assessment feedback that replaced a human queue (v1.24)

• Previously every financial, housing, and insurance assessment waited on an admin to approve it. The housing journey did not unlock until they did.
• Now one shared Celery runner generates the feedback: a summary, actionable recommendations, a readiness score, and for insurance a coverage-gap risk level. One per-module spec each; the plumbing exists once.
• Both new prompts explicitly instruct the model never to state or imply that anyone approves or rejects an assessment. The model cannot know the workflow was removed and, unprompted, will tell a veteran to wait for approval.
• No backend retry. A failed OpenAI call stamps feedback_failed_at and the member presses Regenerate. After two minutes still generating, the panel falls through to recovery copy, so a wedged task can never leave a member on a permanent spinner.

Relocation briefings that cannot invent numbers

• Briefings compose the member's profile, an AreaSnapshot built from eight real providers, and an origin-vs-destination cost comparison under a hard instruction: never invent statistics.
• Snapshots are cached per city. AI and provider spend scales with distinct destinations, not users.
• A provider outage reports {available: false} for its domain instead of failing the briefing.
• v1 shipped with a placeholder façade; it was rebuilt into the grounded pipeline before launch.

Note on naming. The financial AI went from "Advisor" to "Coach" to "Guide" across three releases. "Advisor" is a regulated term. The rename was handled as a compliance change, not a copy tweak.

Community moderation with a crisis path

Pre-publish gate

• Every post and comment passes through omni-moderation-latest before publication, text and image attachments together, scores merged worst-per-category.
• Outcomes route by admin-tunable thresholds stored in the database:

Outcome	Behaviour
Safe	Published
Borderline	Published, with a dismissible supportive rephrase suggestion
Violation	Held, plain-language reason to the author, appeal path
Severe	Held, silent admin escalation
AI unavailable	Published with a needs_review flag (fails open by design)

The crisis path

• Self-harm scores are deliberately excluded from the hide decision. A veteran expressing distress is supported, not silenced.
• Self-harm signals route through a delivery-critical path: a retrying Celery task on the never-starved notifications queue sends the member the crisis line through a supportive channel while independently alerting the admin team. The two deliveries are decoupled so neither can fail the other.
• Trust tiers are monotonic: no demotions, no shadow-banning. Held content is never silently removed.

Note on the most instructive bug. The moderation SDK returns scores under underscore keys; our category constants used aliases. Self-harm scores were misrouted into the hide path in production, the exact inversion of the design. The fix was by_alias=True plus a regression suite over every threshold boundary. In safety-critical seams, the serialization contract is the safety property.

Security the member can see

• Document encryption. AES-256-GCM under keys derived via HKDF-SHA256 from a dedicated DOCUMENT_ENCRYPTION_KEY, with no fallback to Django's SECRET_KEY. Versioned envelopes and per-use additional authenticated data prevent cross-context replay.
• Tamper-evident audit log. Hash-chained entries, periodic checkpoints, a verification command.
• HIPAA-informed controls. 15-minute idle auto-logoff, minimum-necessary response filtering, PHI access logging, scheduled retention enforcement.
• Re-identification-safe reporting. Free-text reasons (for example, why an appointment was missed) are keyword-bucketed before aggregation; a verbatim reason identifies one person regardless of cohort size.
• Identity delegated to Clerk. Django is a pure resource server verifying RS256 JWTs against Clerk's JWKS, fail-closed on authorized parties. The migration from a custom dual-JWT / Redis-blacklist / TOTP system included a bulk Argon2 hash import (no user reset a password) and an account-takeover guard that links accounts only on a verified primary email. It removed a password store, an admin secret, a blacklist, and a 2FA implementation from the threat model.

Note on compliance posture. HIPAA-aware by design, mapped control-by-control against 45 CFR 164.312, with GDPR/CCPA documentation and a Section 508 VPAT. No certification is claimed that hasn't been earned.

Billing

• Stripe is the source of truth; the platform database is a mirror reconciled through webhooks.
• Two-phase idempotency via a ProcessedWebhookEvent row survives Stripe's retry schedule and a Redis flush.
• An out-of-order guard stops a late subscription.updated from resurrecting a deleted subscription.
• A trial-recycle check consults Stripe's own record, so deleting and re-registering does not mint a second free week.
• The spouse seat provisions a second account through a Clerk invitation, linked automatically on signup, with add-on billing and end-of-period removal.
• A subscription gate middleware covers 13 module prefixes with explicit failure semantics: infrastructure exceptions fail open (an outage never locks veterans out); a definitive "no subscription" always fails closed.

Operations

• Celery: four queues (default, exports, broadcasts, notifications), routing in one settings table. After an April 2026 outage (result accumulation in Redis plus prefetch head-of-line blocking), CELERY_TASK_IGNORE_RESULT=True and PREFETCH_MULTIPLIER=1 are permanent.
• Staging on AWS via CloudFormation: VPC, RDS PostgreSQL 17.9, ElastiCache Redis 7.1, S3, Secrets Manager, and a single Graviton instance running Caddy, web, worker, beat, and the Next.js frontend as containers. About $54/month; no NAT, no ALB, no multi-AZ. A Fargate + ALB blueprint is retained for production scale.
• Deploys through GitHub OIDC; no static AWS keys anywhere.
• Email routing between SES, Resend, and Notify Hub is a database setting with instant rollback.

5. Results

Product Outcomes

• 1,200 users live on a platform built in ten months by one FDE.
• 25 member modules and a 77-page admin panel from one codebase: 34 Django apps, ~541 endpoints, 180 pages, 609 components, 149 models, 274 shared enums.
• AI in production on a dozen surfaces, each behind guardrails, throttles, and graceful degradation.
• Safety shipped as infrastructure: the 988 banner, the moderation crisis path, the TRI clinical guardrail with warm handoff, keyword detection in reporting, a mood check-in on the front door.
• 4,079 automated tests across 261 files, 82% backend coverage, CI-gated; Vitest and Playwright on the frontend.

Technical Achievements

• Crisis-aware moderation: multimodal pre-publish gating, database-tunable thresholds, fail-open posting, appealable holds, monotonic trust tiers, and a self-harm path excluded from content-hiding decisions.
• A 15-tool AI assistant with RAG, idempotent writes, injection screening, subscription-aware dispatch, and legal rails.
• Human assessment review replaced by AI feedback with a member-controlled recovery path, across three modules through one shared runner.
• Grounded relocation AI over an 8-provider data layer, cost scaling with cities rather than users.
• AES-256-GCM with HKDF-derived keys and per-use AAD, a hash-chained audit log, HIPAA-informed session and retention controls, re-identification-safe reports.
• A federal job pipeline syncing 65 keyword searches every 8 hours with async top-up and a never-block-the-web-process rule.
• A written, enforced design system that makes calm a code-review property.

Business Impact

• One platform replaces the browser-tab transition. One login, one readiness score, one next step.
• Outcome reporting is the differentiator. The report engine, cohort filters, and per-module utilization tracking give the founder proof for government sponsors and the VA that a nonprofit's story can't provide.
• The sponsorship model is live. Sponsor-funded memberships, the spouse seat, admin-configurable pricing, and the trial flow are in production for the corporate and public-sector sponsors in the founder's pipeline.
• Grant-ready. A VA SSG Fox suicide-prevention grant readiness package (narrative, logic model, evaluation plan, capability statement, budget) was drafted around capabilities the platform already ships.
• Hand-off ready. 47 CLAUDE.md files, a per-release changelog, an OpenAPI schema, and infrastructure-as-code. GO-180 is not dependent on the engineer who built it.

Read client reviews on Trustpilot ↗

6. Lessons Learned

• In safety-critical AI seams, the data contract is the safety property. The self-harm misrouting bug was a key-normalization mismatch, not a model or threshold problem. Test the contract, not just the logic.
• Choose the failure direction per seam, in writing. Fail open for participation (moderation outages), fail closed for money and identity (auth, subscription gate).
• Constrain first, generate second. The relocation module's biggest upgrade was removing freedom from the model. The assessment prompts' most important line tells the model what it doesn't know.
• Distress is a routing problem, not a moderation problem. Excluding self-harm scores from hide decisions was the single most important design call in the community system.
• The founder's vocabulary is the spec. "Active duty never pays." "An appointment booked in Germany keeps German time after a PCS." "Never call it an advisor." Each became a data model, a timezone column, or a prompt line.
• Calm is a design system, not a tone of voice. One gold element per page, no card-grid walls, softened dark mode. Enforced as rules, these survive every new feature.

7. Conclusion

GO-180 consolidates the highest-risk year of a service member's life into one home base: a readiness index at the center, AI that is grounded and guarded, a community wrapped in crisis-aware moderation, documents behind real cryptography, billing shaped around sponsorship, and a design system built for users under stress. One forward-deployed engineer shipped it in ten months to 1,200 users, working from the founder's requirements directly into pull requests.

Roadmap

• Sponsored caregiver accounts for members with TBI or physical disabilities
• VA-registration tracking as a safety metric
• Family Care Plan module
• Accessibility and performance pass (M5)
• Fargate production blueprint when scale demands it

The architecture for all of it is already in place.

⭐ A Note on the Mission

The roughly 200,000 Americans who take off the uniform every year should not have to reassemble their lives out of browser tabs. The highest-risk year of a service member's life deserves software built with the same discipline as the institutions they served in: a crisis line that is part of the page, a moderation system that hears distress instead of hiding it, an encryption key that can't be leaked by a settings file, an AI that knows it isn't an advisor, and a readiness score that tells the truth.

Their mission continues here. So does ours.