Skip to content

How we build it well

Closed-source code.Open-source signal.Receipts you can check.

Live CI across every repo, every third-party we depend on, every public surface you can hit. Pre-qualify the stack without an NDA.

Live

Repos4
Tests3,705
CIAll Green
Last passed1h ago

§ 01Security posture

The vendor questionnaire, pre-filled.

Six concrete security receipts. Each is enforced in code; specifics under contract. Provenance and integrity are public; attack surface stays private — we name what we do, not how an attacker would attack it.

  • Live

    Cryptographic request signing on every /v1/*

    Every request is signed at the integrator boundary with a per-tenant credential. A stolen API key alone is not enough to scrape. Replay protection is part of the scheme. Specifics provided under contract.

    Specifics under NDA

  • Live

    Append-only at the DB layer

    Provenance tables carry UPDATE and DELETE triggers that reject the operation. Append-only is enforced by the database, not by application code. Behaviour is independently verifiable through the public ledger.

    Postgres-enforced

  • Live

    Zero-trust private mesh

    The box is behind a zero-trust private mesh; no public SSH, no internet-routable management surface. Port-scanning the host finds nothing useful. Operational detail under contract.

    Specifics under NDA

  • Live

    Centralised secret management

    Every runtime secret lives in a per-environment secret manager. No env-in-dashboard, no .env committed, no operator memorising. Rotation procedure is part of the operations runbook.

    Operational

  • Live

    Named failure postures

    Every external dependency has a deliberate failure posture, reviewed in code. Security boundaries fail closed; availability paths fail with logged degradation. Specifics under contract.

    Operational

  • Live

    Bot defence at the edge

    Edge-level bot defence on the public signup surface. Edge-level traffic policy on the product API. Both run before any application code. Specifics under contract.

    Edge-enforced

Vulnerability disclosure: SECURITY.md in the audit_trail repo carries the policy + the 7-day disclosure window. Every claim above is verifiable in code under NDA — operational specifics are not public.

§ 02Public surfaces

Receipts, not claims.

Every link below is a real artifact you can hit right now. No NDA, no contract, no demo. Receipts, not claims — written out as six hrefs.

§ 03Stack

What we build on.

The full third-party stack — every vendor we depend on, named before you sign anything. Institutional choices, not duct tape. If we move off something, this list moves in the same commit.

Last reviewed in the same change that ships the stack. If we move off something, this list moves with the commit — same discipline as every other number on the site.

§ 04System architecture

How the pieces fit.

Three lanes. Box-side writes data and anchors it; the API reads and serves it under contract; clients consume it. Supabase Postgres is the bus — everything on the left writes to it, everything on the right reads from it through the API.

Box

Dedicated compute

  • Data ingestion

    Per-sport scrapers + odds backfill + schedule. Python services.

  • ML training + inference

    Per-sport models, conformal-evaluated and calibration-checked. Daily live morning run.

  • Audit anchor writer

    Wrote every alpha live prediction to the immutable audit_trail ledger before kickoff.

  • Orchestrator

    Single scheduler. Cron + webhooks. Operational specifics under NDA.

writes (Supabase)

API

Vercel · US East

  • /v1/* public read tier

    Authenticated and signed on every request. Implementation specifics under NDA.

  • /webhooks/* writers

    Metrics, insights, quant, engineering — CI + n8n triggered.

  • /openapi.json (public)

    OpenAPI 3.1 — every route, every schema, every error code.

signed reads

Clients

EAS · Vercel · GitHub

  • Mobile app

    SplitWinner (React Native + Expo). Ships via EAS to App Store / Play.

  • Marketing site

    splitwinner.com (Next.js 16). The site you're reading right now.

  • Public audit_trail repo

    Daily mirror of the immutable ledger + the verify.py runner. Anyone can clone.

Trust boundary at the API: trusted internal services write their own domain tables within the trusted plane; the API enforces auth, signing, column allow-lists, and entitlement gating before serving any client. The public audit_trail mirror is a separate path — daily push, OpenTimestamps proof, Bitcoin attestation.

§ 05Service topology

Operational footprint, at a glance.

Aggregate counts across the system. Numbers signal scale without naming the individual services — the operational footprint at the resolution that matters for due diligence.

  • Box services

    5

    Five independent tiers — ingest, ML, scoring, delivery, anchoring — each its own restartable process. Health, restart count, and last-deploy SHA visible in the ops console.

  • API endpoint groups

    8

    Public read-tier groups exposed via /v1/*. Every route, request schema, and response shape lives in the public OpenAPI spec — generated from code, never hand-written.

  • Webhook receivers

    5

    Scheduled writers — metrics, insights, quant, engineering, training. Each one's payload schema is in the OpenAPI spec; each one's shared-secret check fails closed.

  • Cron-driven workflows

    12+

    Scheduled workflows orchestrating ingest, training, scoring, anchoring, and reporting — NY-local, DST-aware.

Each number above is a real count as of the commit that ships this section. When the shape moves — new service, new endpoint group, new workflow — the count moves in the same change. Same discipline as every other number on the site.

§ 06Prediction lifecycle

From raw data to anchored receipt.

Seven deliberate steps from game-data ingest to a delivered bet. The fork that matters most is the bet-or-skip decision — every prediction goes through it, both outcomes get anchored to the public ledger. Skips disclosed, not hidden.

  1. 01

    Ingest

    Per-sport scrapers + odds backfill + schedule pull.

    → Game data

  2. 02

    Train

    Per-sport models, cross-validated out-of-sample, registered to the immutable audit_models ledger.

    → Models

  3. 03

    Predict

    Calibrated probabilities over every outcome on the slate.

    → Probabilities

  4. 04

    Conformal

    Coverage guarantee at the configured alpha. Output is the conformal set per row.

    → Conformal set

  5. 05

    Decision

    Each conformal-evaluated prediction either clears the bar and becomes a bet, or is held back as a disclosed skip.

    → Bet OR Skip

  6. 06

    Anchor

    SHA-256 hash of every prediction (bet AND skip) written to the immutable audit_trail before kickoff while the pipeline runs. Daily OpenTimestamps proof, upgraded to a Bitcoin attestation.

    → Hash

  7. 07

    Deliver

    Promoted bets land in the delivery table for the consumer app + API. Skips are public on the ledger but not delivered as picks.

    → Delivery

The bet-or-skip fork

After conformal evaluation, every prediction either clears the bar or it doesn't. Two outcomes — both anchored, only one delivered.

  • Promoted to bet

    Lands in the delivery table. Delivered through the consumer app and the API. Recorded on the audit_trail row.

  • Disclosed skip

    Anchored to the public ledger but not delivered as a pick. The system publicly says "we won't commit to this one." Recorded on the audit_trail row.

Skips disclosed, not hidden. The bar is deliberately high; as discovery surfaces new signal, more predictions lift from skip to bet over time. Coverage is an improving frontier, not a fixed target.

§ 07Deploy pipeline

How code reaches production.

Push, then CI gate, then deploy. The CI gate is the rigor signal — five checks pass or nothing merges. Web + api auto-deploy on push; mobile builds via EAS on demand. Every commit's deploy status is visible from the engineering quality snapshots below.

  1. 01

    Push triggers CI

    Every commit fires the gated pipeline. Conventional commit messages describe the change; no commit ships without all gates passing.

    GitHub-hosted

  2. 02

    CI gate

    Five checks run on every push. Any red check blocks the deploy.

    • Lint (biome)
    • Typecheck (tsc strict)
    • Tests
    • Coverage floor
    • Dependency audit

    .github/workflows/ci.yml

  3. 03

    Web + api deploy

    Vercel auto-deploys api.splitwinner.com + splitwinner.com on every push to main. US East region.

    Vercel · 2-3 min · auto

  4. 04

    Mobile build

    EAS builds + submits the SplitWinner app to App Store + Play. Manual trigger (not push-triggered) per release.

    EAS · on demand

The CI gate is the merge requirement; no path to production bypasses it. Build-status badges + the engineering snapshot above let any integrator independently verify which commit shipped last and that it passed every gate.

§ 08API quality

The API is closed-source. Its CI signal is not.

Aggregate quality snapshot for the splitwinner-api repo — test count, coverage, lint/typecheck/audit booleans, last passing build. Refreshed on every successful push to main. Under-NDA diligence is a copy of the same signal.

  • Tests

    1,108

    across 90 files; CI fails any red build

  • Line coverage

    92.9%

    92.7% function coverage

  • Enforced floor

    92%

    below this, CI fails — set in bunfig.toml

  • Build status

    Passing

    67839a3 · 1h ago

Static gates

  • Lint (biome)Clean
  • Typecheck (tsc strict)Clean
  • Dependency auditClean

Dependencies

16

11 runtime · 5 dev

Vetted before merge. Audit gate fails on any open vulnerability.

Test depth

  • Unit

    1,108

    across 90 files; gates every CI run

  • Integration

    37

    across 3 files; live-deps nightly

  • E2E

    36

    across 6 files; deployed-URL probes post-deploy

  • Mutation

    Periodic

    Stryker on the accuracy + security logic modules — periodic quality gate.

Snapshot from https://github.com/SplitWinner/splitwinner-api/actions/workflows/ci.yml

§ 09Web quality

Same receipts as the API. This side of the wire.

Aggregate quality snapshot for the splitwinner-web repo itself. Same test/coverage/CI gates as the api, plus an end-to-end browser tier and a public sitemap. Updated on every successful push to main — what you're reading was built by the same pipeline this card describes.

  • Tests

    792

    across 52 files; CI fails any red build

  • Line coverage

    94.2%

    88.9% function coverage

  • Enforced floor

    90%

    below this, CI fails — set in bunfig.toml

  • Build status

    Passing

    a4c71dc · 54 days ago

Static gates

  • Lint (biome)Clean
  • Typecheck (tsc strict)Clean
  • Dependency auditClean

Dependencies

44

26 runtime · 18 dev

Vetted before merge. Audit gate fails on any open vulnerability.

Public surface

/sitemap.xml (opens in new tab)

Every public URL the marketing site publishes. Same source the deploy reads — what you scan here is what Google indexes.

Test depth

  • Unit

    792

    across 52 files; component + section + screen coverage

  • Integration

    6

    across 1 files; live upstream seams

  • E2E

    140

    across 11 specs; Playwright + axe-core, mobile-first

  • Mutation

    Periodic

    Stryker isn't wired here yet — Playwright + axe-core act as the browser-tier quality gate.

Snapshot from https://github.com/SplitWinner/splitwinner-web/actions

§ 10Mobile quality

The same gates, applied to what ships to the App Store + Play.

Aggregate quality snapshot for the splitwinner-app repo (Expo / React Native). Same test/coverage/CI gates as the api and web, plus Maestro flows on every PR (lint) and a nightly run on a real iOS simulator. Updated on every successful push to main.

  • Tests

    1,356

    across 153 files; jest-expo with the coverage floor enforced

  • Line coverage

    96.9%

    96.1% function coverage

  • Enforced floor

    95%

    below this, CI fails — set in package.json (jest.coverageThreshold)

  • Build status

    Passing

    e657d03 · 1h ago

Static gates

  • Lint (expo lint)Clean
  • Typecheck (tsc strict)Clean
  • Dependency auditClean

Dependencies

65

54 runtime · 11 dev

Vetted before merge. Audit gate fails on any open vulnerability.

Published bundle id

com.splitwinner.app

Paste into the App Store or Play Store to confirm the published build matches this snapshot.

Test depth

  • Unit

    1,356

    across 153 files; component + screen coverage

  • Integration

    25

    across 1 files; live upstream seams, nightly

  • E2E

    17

    across 17 Maestro flows on a booted iOS simulator

  • Mutation

    Periodic

    Stryker isn't configured for the mobile repo — Maestro on a real device runtime is the higher-value mutation surface for an app.

Snapshot from https://github.com/SplitWinner/splitwinner-app/actions/workflows/ci.yml

§ 11Services quality

The ops console is internal. Its CI is not.

Aggregate quality snapshot for the splitwinner-services repo. Same gates, same coverage floor as the other repos. Updated on every successful push to main.

  • Tests

    449

    across 36 files; bun test with the coverage floor enforced

  • Line coverage

    82.7%

    80.6% function coverage

  • Enforced floor

    83%

    below this, CI fails — set in bunfig.toml (coverageThreshold)

  • Build status

    Passing

    6aeb5f9 · 53 days ago

Static gates

  • Lint (biome)Clean
  • Typecheck (tsc strict)Clean
  • Dependency auditClean

Dependencies

19

9 runtime · 10 dev

Vetted before merge. Audit gate fails on any open vulnerability. Counts the api package + the UI workspace.

Source repository

github.com/OffensiveEdge/edgeseeker-services

Internal repo — access controlled. The CI snapshot itself is the public receipt.

Test depth

  • Unit

    449

    across 36 files; route + UI coverage

  • Integration

    13

    across 2 files; live Supabase seams, gated by RUN_INTEGRATION

  • E2E

    10

    across 1 files against a real deployment target

  • Mutation

    Periodic

    Stryker isn't configured for the services repo — the audit-trail-anchored writers carry the higher-value mutation surface.

Snapshot from https://github.com/OffensiveEdge/edgeseeker-services/actions/workflows/ci.yml

§ 12Public documentation

The corpus is bigger than the website suggests.

Every long-form document in the public audit_trail repo. Procurement, legal, and security teams can clone and read — no NDA needed for any of these. The marketing site you're reading just summarises what's already published.

Each document above is a stable URL. When the audit_trail repo moves a file, the link here moves in the same commit — no drift. The whole corpus is one git clone deep.

Convinced on the engineering.

Now the product. The sandbox ships the surface this engine produces — hold a key and check it; the audit page proves the predictions are honest.

Get a sandbox key See the proof

Sandbox first. Then the beta.

A key in minutes — the full API surface, mocked plausibly-live, no card, no NDA. When it holds up on your desk, the 2026 beta cohort is a direct conversation: a limited set of desks, a fixed seasonal price in writing.

Get a sandbox keyApply for the 2026 beta

No card · no NDA · fixed price in writing