We build it, and we run it.

The mobile app talks to Postgres directly, and row-level security is the authorisation boundary rather than a layer of code in front of it. Scoring, referrals and challenge settlement run as database functions and policies, so a tampered client gets nowhere. One schema carries 25 tables, 51 functions and 48 policies.

It held under load. 863,000 predictions came from 32,252 registered players, through a tournament that ran from 11 June to 19 July 2026.

Edge functions on the second product run on Deno, in TypeScript, behind one audited handler shared across every route. That handler carries an allowlist, a method gate, token verification and rate limiting.

31 public images ship across five repositories on GitHub. Every one is rebuilt daily by cron. Tags are CalVer dates and are never deleted, so an old pin still resolves to the image it named.

docker-base publishes five platforms from one build. The other four publish linux/amd64, which is what most of what runs on them needs.

The base image carries the full gate set on every build. That set is Hadolint, container structure tests, an image scan, Cosign signing, an SBOM and a provenance attestation. What runs traces back to the exact build that produced it.

An agent client connects to a Model Context Protocol server and calls the tools it exposes. Seven tools sit behind OAuth 2.1. The product owns its data and its rules; the client does the reasoning.

Agent calls mint a per-user token and run under the same row-level policies as a human session. A model gets no looser path, so an agent that misbehaves is stopped by the same policy that stops a tampered client.

That server is behind OAuth, so you cannot open it and check it yourself. What you can open is the gate set. Agent-written change runs the checks a human change runs, and it runs them before the merge, so a failing check stops the change. The container build publishes that whole set in one workflow file.