Activa · working demo

24 BLVD is a full org now.

Overnight autonomous build · 1 Sep 2026 · 18 commits · Paquito. Backend verified over the live HTTP API; nothing on remote.

You went to sleep asking for a working product: a full 24 BLVD org with tenants, the ticket system connected, membership and loyalty, a POS like Setpoint's, a staff QR check-in app, and a Thailand payments proposal. It's built and verified. Here's the state of it — and the one thing waiting on you (the remote apply).

10venues
4tenant operators
7modules live
26real events
8demo members
45assertions green

Three loops, driven over the real HTTP API

It doesn't just paint — it runs.

Every step below was executed through the live GoTrue + PostgREST stack (the exact path the apps call), each returning 2xx with verified post-action state. Not screenshots, not psql shortcuts.

1
Member RSVP

Anon sign-in → become a member → RSVP → QR code issued, +50 pts.

200 · code CU6TYFC6
2
Door check-in

Staff scans the code → ticket flips to checked_in, +100 pts. Non-staff blocked.

200 · ok:true
3
POS sale

Staff charges 2× off the LULU menu → atomic order, stock down, 7% VAT, one ledger.

200 · INV-…-0001
4
Loyalty

Points move on every action; tiers recompute Guest→Insider→Icon.

balance verified

What 24 BLVD holds now

A full destination, not a stub

Org → Venues → Tenants

The multi-vendor layer you asked about is real.

  • 10 venues (the 7 concepts + The Courtyard, The Terrace, SŌVANA from the IG data)
  • 4 tenant operators: SŌVANA Wellness, Courtyard Live, LULU Kitchen, House of Savoy Co.
  • Every operator scoped to its venue, on the org's backbone

Events & tickets ✓ connected

26 real events from our Instagram pipeline, all venue-linked, all published — RSVP issues a QR pass, staff scan it in.

Membership & loyalty

3 plans (BLVD Social/Insider/Icon), 3 loyalty tiers, 8 demo members spread across all tiers with real balances and streaks. Loyalty coexists with membership exactly as designed.

POS — our Square ✓ new

Item/variation catalogue, open tabs, immutable orders, per-seller attribution, atomic server-side checkout with VAT + stock + one shared ledger. Seeded LULU F&B menu. Same members, same check-in architecture.

Roles & RBAC by module

Each org sees only modules it bought; each role sees only modules its matrix grants — enforced at the data layer, not just hidden in the UI. Two cross-tenant breaches found by review and sealed.

Three apps

  • Member app — module-aware tabs, events feed, RSVP pass, live rewards
  • Staff app — door QR scan + a POS terminal
  • Admin HQ — the earlier prototype (peer session)

Payments — researched, not built (as you said)

A Thailand plan is waiting for you

Full proposal in payments-thailand-proposal.html. The short version:

Recommendation

Opn Payments (Omise) as the primary gateway — Thai-native, cards ~3.65%, PromptPay ~1.65%, Schedules API for recurring memberships — with PromptPay dynamic QR as the default rail for tickets, top-ups and POS.

Multi-tenant payouts

MVP = ledger-and-org-payout: everything settles to the 24 BLVD org account; Activa computes weekly per-operator statements and never holds funds. Phase 2 = native sub-merchant split via Opn Account Chaining.

Why not Stripe

Setpoint's stack, but no Terminal in Thailand, no daily payouts, 4.75% tourist cards. Activa diverges — a shared provider-adapter interface, a different first adapter.

The big risk

A stored-credit wallet spendable across multiple tenant legal entities likely triggers Bank of Thailand e-money licensing. Needs Thai counsel before that feature ships — this is the one to discuss together.

Verification

How I know it works

Nothing here is claimed on a render alone.

45 SQL assertions

Four suites — core RBAC, security hardening, POS, POS hardening — pass on every fresh supabase db reset. They prove entitlement walls, per-role reads, the sealed breaches, RSVP/check-in/signup, the full POS checkout lifecycle (VAT, atomic stock, one ledger, immutability), and that the negative-checkout exploit is rejected.

Live HTTP round-trips

The member, door and POS loops were each driven through the running GoTrue + PostgREST stack with 2xx responses and verified post-action state (ticket checked_in, stock decremented, invoice issued, payment in the ledger).

Flutter analyze clean

Both apps (member + staff) pass flutter analyze with zero issues. The Flutter widget rendering itself is the one layer not yet exercised — that needs a simulator, which is your step.

Adversarial review — twice

A 22-agent fleet reviewed the RBAC layer (2 breaches sealed). A 20-agent fleet then reviewed POS and found a real one: negative-quantity checkout (inflate stock + forge a negative payment). Sealed, and the exploit is now verified dead over HTTP (400, stock unchanged, zero negative ledger rows). 13 of 15 findings fixed; 2 low-risk lows accepted.

Your call when you wake

The go/no-go

1 · Remote apply. 12 migrations are proven on a fresh local reset but not on the remote Supabase. One supabase db push when you say so — your single deploy decision.

2 · Sim the apps. Both apps take a --dart-define local-URL flag now, so you can run them against the local stack (still up) or the remote once applied. You run the sim.

3 · Payments & the wallet. Let's pick the gateway together and get Thai counsel on the cross-tenant wallet before it ships.

4 · Next. A POS terminal in the admin, paid ticketing once a gateway lands, and per-operator payout statements.