Public web
Live waves, pack purchase, queue position, reveal, public proof, share pages, and post-reveal decisions.
Technical team
This brief is for potential employees and external teams. It explains the product architecture, trust boundaries, critical workflows, and the quality bar expected before public launch.
01 / System shape
Live waves, pack purchase, queue position, reveal, public proof, share pages, and post-reveal decisions.
Inventory intake, wave publishing, manual review, RBAC approvals, support context, and exception handling.
Hono command/query surface. Business actions call approved domain operations rather than writing tables directly.
Outbox dispatch, queue processing, provider webhooks, retry scheduling, reconciliation, and staff alerts.
System of record with Kysely reads, plain SQL migrations, critical functions, proof metadata, and audit trail.
Separate service/database for market observations, confidence scoring, buyback quote inputs, and future data APIs.
02 / Architecture rules
Public web, admin web, reveal UX, verifier pages
Never hide proof, state, or next action behind decoration.
Commands, auth mapping, validation, provider orchestration
Keep provider-specific behavior behind typed adapters.
Wave rules, opening queue, draw algorithm, ledger, inventory lifecycle
Critical transitions are explicit functions with tests and audit events.
Postgres functions, constraints, projections, S3 proof/provider archives
Runtime roles cannot directly mutate trust-critical tables.
Outbox, SQS wakeups, retries, webhooks, reconciliation polling
Every external side effect is idempotent and recoverable.
ECS Fargate, Terraform-managed GitOps, S3 artifacts, environment config
Deployment should be reproducible, observable, and split by runtime boundary.
03 / Critical workflows
Only active available inventory can enter a wave; delivered cards remain history only.
Duplicate webhooks cannot duplicate payments, ledger debits, or openings.
A paid opening produces at most one valid draw result, replayable forever.
Buyback acceptance credits store credit and resolves the pulled card atomically.
04 / Scope boundaries
05 / Trust and failure model
Versioned algorithm, randomness provider proof, pre-draw pool state, selected cards, proof hash.
Do not consume cards if randomness/provider work fails before the atomic result write.
Immutable ledger entries, holds, debits, credits, source detail tables, reconciled balance projection.
No direct balance edits and no double spend across concurrent checkouts.
Unique active PSA certs, owner/bin/status lifecycle, pulled-card decisions, exception states.
A draw cannot select unavailable, pulled, delivered, replaced, or removed inventory.
Sanitized contract fixtures, typed errors, raw archive for critical Stripe/randomness/shipping/PSA data.
External retries must be idempotent and manually recoverable.
06 / How we build
Real Postgres CI for migrations, SQL functions, constraints, permissions, and locking behavior.
Deterministic draw/verifier tests cover old algorithm versions, depleted tiers, slot order, and proof hashes.
Recorded contract fixtures and typed adapter errors for Stripe, randomness, shipping, PSA, Resend, and pricing.
Playwright covers browse, auth, checkout, queue, reveal, delivery, buyback, verifier, admin, and support flows.
07 / Team fit
Strong Postgres, SQL functions, transactions, row permissions, event modeling, and financial-style ledgers.
Next.js, state-rich flows, accessible reveal UX, admin tools, proof pages, and high-signal operational UI.
Provider adapters, webhooks, queues, Terraform/AWS posture, observability, security, and incident recovery.