Activa · status

Where we are: MVP built, running, verified.

1 Sep 2026 · 22 commits on main · backend verified over the live API · member app running on the simulator · nothing on remote

The full 24 BLVD product is standing: a real multi-tenant org, the ticket loop, membership, loyalty, a Square-style POS, two Flutter apps, and a Thailand payments plan. Two adversarial security reviews ran and every real finding is sealed. The one open decision is yours: the remote apply.

13DB migrations
7modules live
45assertions green
2apps
2security reviews passed
LIVEon remote (prod)

Live proof

The app runs on your simulator.

The Activa member app, built onto your iPhone 16e against the local backend, rendering real 24 BLVD data — header, QR-pass button, event-type filters, the events feed, and a working event detail sheet with correct paid-vs-RSVP logic. This is the Flutter UI actually painting, not a mockup.

Behind it, every loop is verified over the real GoTrue + PostgREST API: member RSVP, door check-in, POS sale — each a 2xx with confirmed post-action state.

Activa member app running on the iOS simulator showing 24 BLVD events

Member app · iPhone 16e · live local backend · 1 Sep 2026

Component status

What's built, what's verified

Org → Venues → Tenants
24 BLVD, 10 venues, 4 tenant operators — the multi-vendor layer
verified
Events & tickets
26 real IG events, all venue-linked; RSVP → QR pass → door check-in
verified
Memberships
3 plans (Social/Insider/Icon), one QR pass, module-gated
built
Loyalty & gamification
Points, tiers, streaks; earns on RSVP + check-in, tiers recompute
verified
POS (our Square)
Catalogue, tabs, immutable orders, atomic checkout, 7% VAT, one ledger
verified
Roles & RBAC by module
Per-org entitlements + per-role access, enforced at the data layer
verified
Member app
Events, RSVP pass, My Passes, membership, live rewards — running on sim
verified
Staff app
Door QR scan (check-in) + a POS terminal; analyze clean
built
Payments (Thailand)
Researched & proposed — Opn/Omise + PromptPay. Not built, by your call
planned
Remote deploy
All migrations applied to the hosted project (prod); anon reads + PII walls verified live over the API
live

How it's verified

Not claimed — exercised.

45 assertions

Four SQL suites (core RBAC, hardening, POS, POS hardening) pass on every fresh supabase db reset.

Live HTTP loops

RSVP, check-in and POS checkout each driven through the real API — 2xx with verified state (ticket checked-in, stock decremented, invoice issued, points banked).

App on device

Member app built + run on the iPhone 16e simulator, rendering live 24 BLVD data (screenshot above).

Two red-team passes

42 review agents total. Found 3 real breaches (2 RBAC cross-tenant reads, 1 POS cash-skim exploit) — all sealed and re-verified dead.

Open decisions

What's waiting on you

1 · Remote apply. Your single deploy call — one supabase db push puts all 13 migrations on the hosted project.

2 · Payments & the wallet. Pick the gateway together (Opn/Omise recommended) and get Thai counsel on the cross-tenant stored-credit wallet (Bank of Thailand e-money question).

3 · Next build. Paid ticketing once a gateway lands, a POS terminal in the admin, and per-operator payout statements.

→ Working-demo report → Thailand payments proposal → Competitor teardown → RBAC design